DuyTa/cve-kgrag-db huggingface dataset:
CVE-2014-3585
redhat-upgrade-tool: Does not check GPG signatures when upgrading versions
CVSS v3.1 Score: 9.8 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: enterprise_linux, redhat-upgrade-tool
Related CWEs: CWE-347
Related CAPECs: CAPEC-475, CAPEC-463
References: https://access.redhat.com/security/cve/cve-2014-3585, https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-3585, https://access.redhat.com/security/cve/cve-2014-3585
CWE: CWE-347
CVE-2014-5470
Actual Analyzer through 2014-08-29 allows code execution via shell metacharacters because untrusted input is used for part of the input data passed to an eval operation.
CVSS v3.1 Score: 9.8 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Related CWEs: CWE-77
Related CAPECs: CAPEC-43, CAPEC-183, CAPEC-76
References: https://vulmon.com/exploitdetails?qidtp=exploitdb&qid=35549, https://www.exploit-db.com/exploits/35549, https://vulmon.com/exploitdetails?qidtp=exploitdb&qid=35549
CWE: CWE-77
CVE-2014-5669
The 9GAG - Funny pics and videos (aka com.ninegag.android.app) application 2.4.10 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS v2.0 Score: 5.4 (MEDIUM)
CVSS v2.0 Vector: AV:A/AC:M/Au:N/C:P/I:P/A:P
Affected Products: 9gag_-_funny_pics_and_videos
Related CWEs: CWE-310
References: http://www.kb.cert.org/vuls/id/582497, http://www.kb.cert.org/vuls/id/977969, https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CWE: CWE-310
CVE-2014-5674
The PicsArt - Photo Studio (aka com.picsart.studio) application 4.5.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS v2.0 Score: 5.4 (MEDIUM)
CVSS v2.0 Vector: AV:A/AC:M/Au:N/C:P/I:P/A:P
Affected Products: picsart_-_photo_studio
Related CWEs: CWE-310
References: http://www.kb.cert.org/vuls/id/582497, http://www.kb.cert.org/vuls/id/989497, https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CWE: CWE-310
CVE-2014-2854
Cross-site scripting (XSS) vulnerability in the SemanticTitle extension before 1.1.0 for MediaWiki allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: semantictitle
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://www.mediawiki.org/wiki/Extension:SemanticTitle#Version_1.1.0, http://www.mediawiki.org/wiki/Extension:SemanticTitle#Version_1.1.0
CWE: CWE-79
CVE-2014-1971
Cross-site scripting (XSS) vulnerability in Silex before 2.0.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: silex
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://jvn.jp/en/jp/JVN14282890/index.html, http://jvndb.jvn.jp/jvndb/JVNDB-2014-000032, http://www.securityfocus.com/bid/66329
CWE: CWE-79
CVE-2014-6829
The Hook (aka com.hook.android) application 0.9.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS v2.0 Score: 5.4 (MEDIUM)
CVSS v2.0 Vector: AV:A/AC:M/Au:N/C:P/I:P/A:P
Affected Products: hook
Related CWEs: CWE-310
References: http://www.kb.cert.org/vuls/id/582497, http://www.kb.cert.org/vuls/id/934321, https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CWE: CWE-310
CVE-2014-9302
Server-side request forgery (SSRF) vulnerability in the cmisbrowser servlet in Content Management Interoperability Service (CMIS) in Alfresco Community Edition 5.0.a and earlier allows remote attackers to trigger outbound requests via a crafted URI in the url parameter.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: community_edition
References: http://seclists.org/bugtraq/2014/Jul/72, https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140716-0_Alfresco_Community_Edition_Multiple_SSRF_vulnerabilities_v10.txt, http://seclists.org/bugtraq/2014/Jul/72
CVE-2014-1291
WebKit, as used in Apple iOS before 7.1 and Apple TV before 6.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2014-1289, CVE-2014-1290, CVE-2014-1292, CVE-2014-1293, and CVE-2014-1294.
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Affected Products: tvos, iphone_os
Related CWEs: CWE-119
Related CAPECs: CAPEC-14, CAPEC-45, CAPEC-9
References: http://archives.neohapsis.com/archives/bugtraq/2014-04/0009.html, http://support.apple.com/kb/HT6162, http://support.apple.com/kb/HT6163
CWE: CWE-119
CVE-2014-2062
Jenkins before 1.551 and LTS before 1.532.2 does not invalidate the API token when a user is deleted, which allows remote authenticated users to retain access via the token.
CVSS v2.0 Score: 6.5 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P
Affected Products: jenkins
Related CWEs: CWE-287
Related CAPECs: CAPEC-151, CAPEC-94, CAPEC-593
MITRE ATT&CK Techniques: T1134, T1550.001, T1557
MITRE ATT&CK Tactics: T1550, T1505
References: http://www.openwall.com/lists/oss-security/2014/02/21/2, https://github.com/jenkinsci/jenkins/commit/5548b5220cfd496831b5721124189ff18fbb12a3, https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-02-14
CWE: CWE-287
MITRE ATT&CK techniques: T1134, T1550.001, T1557, T1185, T1505.003, T1548, T1563, T1040
MITRE ATT&CK tactics: T1550, T1505
CVE-2014-0493
Adobe Reader and Acrobat 10.x before 10.1.9 and 11.x before 11.0.06 on Windows and Mac OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0495.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: windows, acrobat, mac_os_x
Related CWEs: CWE-119
Related CAPECs: CAPEC-14, CAPEC-45, CAPEC-9
References: http://helpx.adobe.com/security/products/acrobat/apsb14-01.html, http://www.securitytracker.com/id/1029604, http://helpx.adobe.com/security/products/acrobat/apsb14-01.html
CWE: CWE-119
CVE-2014-3102
Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 7.0.0 through 7.0.0.2 CF28 and 8.0.0 before 8.0.0.1 CF13 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
CVSS v2.0 Score: 3.5 (LOW)
CVSS v2.0 Vector: AV:N/AC:M/Au:S/C:N/I:P/A:N
Affected Products: websphere_portal
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PI16174, http://www-01.ibm.com/support/docview.wss?uid=swg21680230, http://www.securitytracker.com/id/1030669
CWE: CWE-79
CVE-2014-2968
Cross-site scripting (XSS) vulnerability in the web interface on the Huawei E355 CH1E355SM modem with software 21.157.37.01.910 and Web UI 11.001.08.00.03 allows remote attackers to inject arbitrary web script or HTML via an SMS message.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: e355_web_ui, e355, e355_firmware
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://www.kb.cert.org/vuls/id/688812, http://www.kb.cert.org/vuls/id/688812
CWE: CWE-79
CVE-2014-4140
Microsoft Internet Explorer 8 through 11 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Internet Explorer ASLR Bypass Vulnerability."
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N
Affected Products: internet_explorer
Related CWEs: CWE-264
References: http://secunia.com/advisories/60968, http://www.securityfocus.com/bid/70325, http://www.securitytracker.com/id/1031018
CWE: CWE-264
CVE-2014-7943
Skia, as used in Google Chrome before 40.0.2214.91, allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: opensuse, chrome, enterprise_linux_server_supplementary, chromium, enterprise_linux_server_supplementary_eus
Related CWEs: CWE-119
Related CAPECs: CAPEC-14, CAPEC-45, CAPEC-9
References: http://googlechromereleases.blogspot.com/2015/01/stable-update.html, http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00005.html, http://rhn.redhat.com/errata/RHSA-2015-0093.html
CWE: CWE-119
CVE-2014-0904
The update process in IBM Security AppScan Standard 7.9 through 8.8 does not require integrity checks of downloaded files, which allows remote attackers to execute arbitrary code via a crafted file.
CVSS v2.0 Score: 7.6 (HIGH)
CVSS v2.0 Vector: AV:N/AC:H/Au:N/C:C/I:C/A:C
Affected Products: security_appscan
Related CWEs: CWE-20
Related CAPECs: CAPEC-31, CAPEC-53, CAPEC-261
MITRE ATT&CK Techniques: T1574.006, T1553.002, T1574.007
MITRE ATT&CK Tactics: T1562, T1574, T1553
References: http://www-01.ibm.com/support/docview.wss?uid=swg21666775, https://exchange.xforce.ibmcloud.com/vulnerabilities/91536, http://www-01.ibm.com/support/docview.wss?uid=swg21666775
CWE: CWE-20
MITRE ATT&CK techniques: T1574.006, T1553.002, T1574.007, T1539, T1036.001, T1562.003, T1027
MITRE ATT&CK tactics: T1562, T1574, T1553, T1036
CVE-2014-5421
CareFusion Pyxis SupplyStation 8.1 with hardware test tool 1.0.16 and earlier has a hardcoded database password, which makes it easier for local users to gain privileges by leveraging cabinet access.
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:P
Affected Products: pyxis_supplystation
Related CWEs: CWE-255
References: https://ics-cert.us-cert.gov/advisories/ICSA-14-288-01, https://ics-cert.us-cert.gov/advisories/ICSA-14-288-01
CWE: CWE-255
CVE-2014-7890
The OLE Point of Sale (OPOS) drivers before 1.13.003 on HP Point of Sale Windows PCs allow remote attackers to execute arbitrary code via vectors involving OPOSToneIndicator.ocx for POS keyboards and POS keyboards with MSR, aka ZDI-CAN-2510.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: pos_keyboard_fk221aa, ole_point_of_sale_driver, pos_keyboard_with_msr_fk218aa
References: http://www.securitytracker.com/id/1031840, https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04583185, http://www.securitytracker.com/id/1031840
CVE-2014-1867
suPHP before 0.7.2 source-highlighting feature allows security bypass which could lead to arbitrary code execution
CVSS v3.1 Score: 7.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 4.4 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:M/Au:N/C:P/I:P/A:P
Affected Products: suphp
Related CWEs: CWE-287
Related CAPECs: CAPEC-151, CAPEC-94, CAPEC-593
MITRE ATT&CK Techniques: T1134, T1550.001, T1557
MITRE ATT&CK Tactics: T1550, T1505
References: http://www.openwall.com/lists/oss-security/2014/02/10/1, http://www.securityfocus.com/bid/65212, https://exchange.xforce.ibmcloud.com/vulnerabilities/91315
CWE: CWE-287
MITRE ATT&CK techniques: T1134, T1550.001, T1557, T1185, T1505.003, T1548, T1563, T1040
MITRE ATT&CK tactics: T1550, T1505
CVE-2014-6321
Schannel in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code via crafted packets, aka "Microsoft Schannel Remote Code Execution Vulnerability."
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: windows_server_2012, windows_7, windows_server_2003, windows_8, windows_rt_8.1
Related CWEs: CWE-94
Related CAPECs: CAPEC-242, CAPEC-77, CAPEC-35
MITRE ATT&CK Techniques: T1027.006, T1564.009, T1027.009
MITRE ATT&CK Tactics: T1564, T1027
References: http://blog.beyondtrust.com/triggering-ms14-066, http://marc.info/?l=bugtraq&m=142384364031268&w=2, http://secunia.com/advisories/59800
CWE: CWE-94
MITRE ATT&CK techniques: T1027.006, T1564.009, T1027.009
MITRE ATT&CK tactics: T1564, T1027
CVE-2014-6552
Unspecified vulnerability in the Oracle Access Manager component in Oracle Fusion Middleware 11.1.1.5, 11.1.1.7, 11.1.2.1, and 11.1.2.2 allows remote attackers to affect integrity via unknown vectors related to Admin Console.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: fusion_middleware
References: http://secunia.com/advisories/61767, http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html, http://www.securityfocus.com/bid/70452
CVE-2014-10058
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile SD 210/SD 212/SD 205, SD 400, SD 425, SD 427, SD 430, SD 435, SD 450, SD 617, SD 625, SD 650/52, SD 800, SD 845, and Snapdragon_High_Med_2016, unauthorized users can potentially modify system time.
CVSS v3.0 Score: 7.5 (HIGH)
CVSS v3.0 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: sd_800, sd_430_firmware, sd_425_firmware, sd_210_firmware, sd_210
Related CWEs: CWE-264
References: http://www.securityfocus.com/bid/103671, https://source.android.com/security/bulletin/2018-04-01, http://www.securityfocus.com/bid/103671
CWE: CWE-264
CVE-2014-1827
The iThoughtsHD app 4.19 for iOS on iPad devices, when the WiFi Transfer feature is used, allows remote attackers to upload arbitrary files by placing a %00 sequence after a dangerous extension, as demonstrated by a .html%00.txt file.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: ithoughtshd
Related CWEs: CWE-20
Related CAPECs: CAPEC-31, CAPEC-53, CAPEC-261
MITRE ATT&CK Techniques: T1574.006, T1553.002, T1574.007
MITRE ATT&CK Tactics: T1562, T1574, T1553
References: http://www.madirish.net/559, http://www.madirish.net/559
CWE: CWE-20
MITRE ATT&CK techniques: T1574.006, T1553.002, T1574.007, T1539, T1036.001, T1562.003, T1027
MITRE ATT&CK tactics: T1562, T1574, T1553, T1036
CVE-2014-7892
The OLE Point of Sale (OPOS) drivers before 1.13.003 on HP Point of Sale Windows PCs allow remote attackers to execute arbitrary code via vectors involving OPOSMSR.ocx for Mini MSR magnetic stripe readers, Retail Integrated Dual-Head MSR magnetic stripe readers, Integrated Single Head MSR w/o SRED magnetic stripe readers, Integrated Single Head w/o MSR SRED magnetic stripe readers, RP7 Single Head MSR w/o SRED magnetic stripe readers, POS keyboards, and POS keyboards with MSR, aka ZDI-CAN-2508.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: integrated_single_head_w//o_msr_sred_j1a34aa, ole_point_of_sale_driver, retail_integrated_dual-head_msr_qz673aa, integrated_single_head_msr_w//o_sred_j1a33aa, pos_keyboard_fk221aa
References: http://www.securitytracker.com/id/1031840, https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04583185, http://www.securitytracker.com/id/1031840
CVE-2014-2234
A certain Apple patch for OpenSSL in Apple OS X 10.9.2 and earlier uses a Trust Evaluation Agent (TEA) feature without terminating certain TLS/SSL handshakes as specified in the SSL_CTX_set_verify callback function's documentation, which allows remote attackers to bypass extra verification within a custom application via a crafted certificate chain that is acceptable to TEA but not acceptable to that application.
CVSS v2.0 Score: 6.4 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N
Affected Products: mac_os_x
Related CWEs: CWE-20
Related CAPECs: CAPEC-31, CAPEC-53, CAPEC-261
MITRE ATT&CK Techniques: T1574.006, T1553.002, T1574.007
MITRE ATT&CK Tactics: T1562, T1574, T1553
References: https://hynek.me/articles/apple-openssl-verification-surprises/, https://hynek.me/articles/apple-openssl-verification-surprises/
CWE: CWE-20
MITRE ATT&CK techniques: T1574.006, T1553.002, T1574.007, T1539, T1036.001, T1562.003, T1027
MITRE ATT&CK tactics: T1562, T1574, T1553, T1036
CVE-2014-0150
Integer overflow in the virtio_net_handle_mac function in hw/net/virtio-net.c in QEMU 2.0 and earlier allows local guest users to execute arbitrary code via a MAC addresses table update request, which triggers a heap-based buffer overflow.
CVSS v2.0 Score: 4.9 (MEDIUM)
CVSS v2.0 Vector: AV:A/AC:M/Au:S/C:P/I:P/A:P
Affected Products: enterprise_linux, qemu
Related CWEs: CWE-189
References: http://article.gmane.org/gmane.comp.emulators.qemu/266768, http://secunia.com/advisories/57878, http://secunia.com/advisories/58191
CWE: CWE-189
CVE-2014-4263
Unspecified vulnerability in Oracle Java SE 5.0u65, 6u75, 7u60, and 8u5, and JRockit R27.8.2 and R28.3.2, allows remote attackers to affect confidentiality and integrity via unknown vectors related to "Diffie-Hellman key agreement."
CVSS v2.0 Score: 4.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:N
Affected Products: jrockit, jre, jdk
References: http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00026.html, http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00033.html, http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00036.html
CVE-2014-6708
The Sporting Club Uphoria (aka com.sportinginnovations.skc) application 2.1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS v2.0 Score: 5.4 (MEDIUM)
CVSS v2.0 Vector: AV:A/AC:M/Au:N/C:P/I:P/A:P
Affected Products: utah_jazz
Related CWEs: CWE-310
References: http://www.kb.cert.org/vuls/id/563225, http://www.kb.cert.org/vuls/id/582497, https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CWE: CWE-310
CVE-2014-9816
ImageMagick allows remote attackers to cause a denial of service (out-of-bounds access) via a crafted viff file.
CVSS v3.1 Score: 5.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P
Affected Products: imagemagick
Related CWEs: CWE-125
Related CAPECs: CAPEC-540
References: http://www.openwall.com/lists/oss-security/2014/12/24/1, http://www.openwall.com/lists/oss-security/2016/06/02/13, https://anonscm.debian.org/cgit/collab-maint/imagemagick.git/commit/?h=debian-patches/6.8.9.9-4-for-upstream&id=35aa01dd5511a2616a6427f7d5d49de0132aeb5f
CWE: CWE-125
CVE-2014-2008
SQL injection vulnerability in confirm.php in the mPAY24 payment module before 1.6 for PrestaShop allows remote attackers to execute arbitrary SQL commands via the TID parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: mpay24
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: http://osvdb.org/show/osvdb/110737, http://packetstormsecurity.com/files/128136/Mpay24-Payment-Module-1.5-Information-Disclosure-SQL-Injection.html, http://seclists.org/fulldisclosure/2014/Sep/23
CWE: CWE-89
CVE-2014-0946
The RES Console in Rule Execution Server in IBM Operational Decision Manager 7.5 before FP3 IF37, 8.0 before MP1 FP2, and 8.5 before MP1 IF26 does not send appropriate Cache-Control HTTP headers, which allows remote attackers to obtain sensitive information by leveraging an unattended workstation.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N
Affected Products: operational_decision_manager
Related CWEs: CWE-200
Related CAPECs: CAPEC-497, CAPEC-285, CAPEC-59
MITRE ATT&CK Techniques: T1036.005, T1574.007, T1217
MITRE ATT&CK Tactics: T1134, T1036, T1550
References: http://www-01.ibm.com/support/docview.wss?uid=swg21671324, https://exchange.xforce.ibmcloud.com/vulnerabilities/92573, http://www-01.ibm.com/support/docview.wss?uid=swg21671324
CWE: CWE-200
MITRE ATT&CK techniques: T1036.005, T1574.007, T1217, T1590, T1135, T1069, T1057, T1124, T1595, T1134.001, T1087, T1033, T1574.006, T1111, T1120, T1592, T1016, T1046, T1082, T1049, T1083, T1550.004, T1615, T1007, T1562.003, T1018
MITRE ATT&CK tactics: T1134, T1036, T1550, T1562, T1574
CVE-2014-7132
The Jambatan PBB Semporna (aka com.wJAMBATANPBBSEMPORNA) application 13523.82613 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS v2.0 Score: 5.4 (MEDIUM)
CVSS v2.0 Vector: AV:A/AC:M/Au:N/C:P/I:P/A:P
Affected Products: jambatan_pbb_semporna
Related CWEs: CWE-310
References: http://www.kb.cert.org/vuls/id/151825, http://www.kb.cert.org/vuls/id/582497, https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CWE: CWE-310
CVE-2014-2794
Microsoft Internet Explorer 6 and 7 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-2788.
CVSS v2.0 Score: 9.3 (HIGH)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
Affected Products: internet_explorer
Related CWEs: CWE-119
Related CAPECs: CAPEC-14, CAPEC-45, CAPEC-9
References: http://secunia.com/advisories/59775, http://www.securityfocus.com/bid/68378, http://www.securitytracker.com/id/1030532
CWE: CWE-119
CVE-2014-1348
Mail in Apple iOS before 7.1.2 advertises the availability of data protection for attachments but stores cleartext attachments under mobile/Library/Mail/, which makes it easier for physically proximate attackers to obtain sensitive information by mounting the data partition.
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N
Affected Products: iphone_os
Related CWEs: CWE-310
References: http://archives.neohapsis.com/archives/bugtraq/2014-06/0174.html, http://archives.neohapsis.com/archives/bugtraq/2014-09/0106.html, http://support.apple.com/kb/HT6441
CWE: CWE-310
CVE-2014-5328
Buffer overflow in the Webserver component on the Huawei E5332 router before 21.344.27.00.1080 allows remote authenticated users to cause a denial of service (reboot) via a long parameter in an API service request message.
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:S/C:N/I:N/A:C
Affected Products: e5332_firmware, e5332
Related CWEs: CWE-399
References: http://jvn.jp/en/jp/JVN63587560/index.html, http://jvndb.jvn.jp/jvndb/JVNDB-2014-000119, http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-373056.htm
CWE: CWE-399
CVE-2014-9809
ImageMagick allows remote attackers to cause a denial of service (segmentation fault and application crash) via a crafted xwd image.
CVSS v3.1 Score: 5.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P
Affected Products: imagemagick
Related CWEs: CWE-20
Related CAPECs: CAPEC-31, CAPEC-53, CAPEC-261
MITRE ATT&CK Techniques: T1574.006, T1553.002, T1574.007
MITRE ATT&CK Tactics: T1562, T1574, T1553
References: http://www.openwall.com/lists/oss-security/2014/12/24/1, http://www.openwall.com/lists/oss-security/2016/06/02/13, https://anonscm.debian.org/cgit/collab-maint/imagemagick.git/commit/?h=debian-patches/6.8.9.9-4-for-upstream&id=82f779cbc24045af2eaecb95d0842ca7b97c71f4
CWE: CWE-20
MITRE ATT&CK techniques: T1574.006, T1553.002, T1574.007, T1539, T1036.001, T1562.003, T1027
MITRE ATT&CK tactics: T1562, T1574, T1553, T1036
CVE-2014-6053
The rfbProcessClientNormalMessage function in libvncserver/rfbserver.c in LibVNCServer 0.9.9 and earlier does not properly handle attempts to send a large amount of ClientCutText data, which allows remote attackers to cause a denial of service (memory consumption or daemon crash) via a crafted message that is processed by using a single unchecked malloc.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: libvncserver, ubuntu_linux, debian_linux
Related CWEs: CWE-19
References: http://lists.opensuse.org/opensuse-updates/2015-12/msg00022.html, http://seclists.org/oss-sec/2014/q3/639, http://secunia.com/advisories/61506
CWE: CWE-19
CVE-2014-0739
Race condition in the Phone Proxy component in Cisco Adaptive Security Appliance (ASA) Software 9.1(.3) and earlier allows remote attackers to bypass sec_db authentication and provide certain pass-through services to untrusted devices via a crafted configuration-file TFTP request, aka Bug ID CSCuj66766.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: adaptive_security_appliance_software
Related CWEs: CWE-287
Related CAPECs: CAPEC-151, CAPEC-94, CAPEC-593
MITRE ATT&CK Techniques: T1134, T1550.001, T1557
MITRE ATT&CK Tactics: T1550, T1505
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0739, http://tools.cisco.com/security/center/viewAlert.x?alertId=32955, http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0739
CWE: CWE-287
MITRE ATT&CK techniques: T1134, T1550.001, T1557, T1185, T1505.003, T1548, T1563, T1040
MITRE ATT&CK tactics: T1550, T1505
CVE-2014-8013
The TACACS+ command-authorization implementation in Cisco NX-OS allows local users to cause a denial of service (device reload) via a long CLI command, aka Bug ID CSCur54182.
CVSS v2.0 Score: 4.9 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:N/I:N/A:C
Affected Products: nx-os
Related CWEs: CWE-20
Related CAPECs: CAPEC-31, CAPEC-53, CAPEC-261
MITRE ATT&CK Techniques: T1574.006, T1553.002, T1574.007
MITRE ATT&CK Tactics: T1562, T1574, T1553
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-8013, http://www.securityfocus.com/bid/72393, http://www.securitytracker.com/id/1031685
CWE: CWE-20
MITRE ATT&CK techniques: T1574.006, T1553.002, T1574.007, T1539, T1036.001, T1562.003, T1027
MITRE ATT&CK tactics: T1562, T1574, T1553, T1036
CVE-2014-1421
mountall 1.54, as used in Ubuntu 14.10, does not properly handle the umask when using the mount utility, which allows local users to bypass intended access restrictions via unspecified vectors.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: ubuntu_linux
Related CWEs: CWE-264
References: http://www.ubuntu.com/usn/USN-2411-1, http://www.ubuntu.com/usn/USN-2411-1
CWE: CWE-264
CVE-2014-4048
The PJSIP Channel Driver in Asterisk Open Source before 12.3.1 allows remote attackers to cause a denial of service (deadlock) by terminating a subscription request before it is complete, which triggers a SIP transaction timeout.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P
Affected Products: asterisk
References: http://downloads.asterisk.org/pub/security/AST-2014-008.html, http://packetstormsecurity.com/files/127090/Asterisk-Project-Security-Advisory-AST-2014-008.html, http://www.securityfocus.com/archive/1/532416/100/0/threaded
CVE-2014-6355
The Graphics Component in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly process JPEG images, which makes it easier for remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Graphics Component Information Disclosure Vulnerability."
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: windows_server_2012, windows_7, windows_server_2003, windows_8, windows_rt_8.1
Related CWEs: CWE-200
Related CAPECs: CAPEC-497, CAPEC-285, CAPEC-59
MITRE ATT&CK Techniques: T1036.005, T1574.007, T1217
MITRE ATT&CK Tactics: T1134, T1036, T1550
References: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-085, https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-085
CWE: CWE-200
MITRE ATT&CK techniques: T1036.005, T1574.007, T1217, T1590, T1135, T1069, T1057, T1124, T1595, T1134.001, T1087, T1033, T1574.006, T1111, T1120, T1592, T1016, T1046, T1082, T1049, T1083, T1550.004, T1615, T1007, T1562.003, T1018
MITRE ATT&CK tactics: T1134, T1036, T1550, T1562, T1574
CVE-2014-7944
The sycc422_to_rgb function in fxcodec/codec/fx_codec_jpx_opj.cpp in PDFium, as used in Google Chrome before 40.0.2214.91, does not properly handle odd values of image width, which allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted PDF document.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: chrome
Related CWEs: CWE-119
Related CAPECs: CAPEC-14, CAPEC-45, CAPEC-9
References: http://googlechromereleases.blogspot.com/2015/01/stable-update.html, http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00005.html, http://rhn.redhat.com/errata/RHSA-2015-0093.html
CWE: CWE-119
CVE-2014-2411
Unspecified vulnerability in the Oracle Identity Analytics component in Oracle Fusion Middleware Oracle Identity Analytics 11.1.1.5 and Sun Role Manager 5.0 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors related to Security.
CVSS v2.0 Score: 6.5 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P
Affected Products: sun_role_manager, identity_analytics
References: http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html, http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html
CVE-2014-3553
mod/forum/classes/post_form.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 does not enforce the moodle/site:accessallgroups capability requirement before proceeding with a post to all groups, which allows remote authenticated users to bypass intended access restrictions by leveraging two or more group memberships.
CVSS v2.0 Score: 4.9 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:S/C:P/I:P/A:N
Affected Products: moodle
Related CWEs: CWE-264
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-38990, http://openwall.com/lists/oss-security/2014/07/21/1, https://moodle.org/mod/forum/discuss.php?d=264268
CWE: CWE-264
CVE-2014-5919
The SurDoc - 100GB+ FREE storage (aka com.jd.surdoc) application 1.3.4.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS v2.0 Score: 5.4 (MEDIUM)
CVSS v2.0 Vector: AV:A/AC:M/Au:N/C:P/I:P/A:P
Affected Products: surdoc_-_100gb\+_free_storage
Related CWEs: CWE-310
References: http://www.kb.cert.org/vuls/id/361177, http://www.kb.cert.org/vuls/id/582497, https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CWE: CWE-310
CVE-2014-9389
Directory traversal vulnerability in Sonatype Nexus OSS and Pro before 2.11.1-01 allows remote attackers to read or write to arbitrary files via unspecified vectors.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: nexus
Related CWEs: CWE-22
Related CAPECs: CAPEC-78, CAPEC-126, CAPEC-76
References: http://secunia.com/advisories/61134, http://www.sonatype.org/advisories/archive/2014-12-23-Nexus/, https://support.sonatype.com/entries/84705937-CVE-2014-9389-Nexus-Security-Advisory-Directory-Traversal
CWE: CWE-22
CVE-2014-6877
The Santander Personal Banking (aka com.sovereign.santander) application 2.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS v2.0 Score: 5.4 (MEDIUM)
CVSS v2.0 Vector: AV:A/AC:M/Au:N/C:P/I:P/A:P
Affected Products: santander_personal_banking
Related CWEs: CWE-310
References: http://www.kb.cert.org/vuls/id/315417, http://www.kb.cert.org/vuls/id/582497, https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CWE: CWE-310
CVE-2014-7327
The Macau Business (aka com.magzter.macaubusiness) application 3.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS v2.0 Score: 5.4 (MEDIUM)
CVSS v2.0 Vector: AV:A/AC:M/Au:N/C:P/I:P/A:P
Affected Products: macau_business
Related CWEs: CWE-310
References: http://www.kb.cert.org/vuls/id/582497, http://www.kb.cert.org/vuls/id/656329, https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CWE: CWE-310
CVE-2014-0636
EMC RSA BSAFE Micro Edition Suite (MES) 3.2.x before 3.2.6 and 4.0.x before 4.0.5 does not properly validate X.509 certificate chains, which allows man-in-the-middle attackers to spoof SSL servers via a crafted certificate chain.
CVSS v2.0 Score: 5.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:N
Affected Products: bsafe_micro-edition-suite
Related CWEs: CWE-310
References: http://archives.neohapsis.com/archives/bugtraq/2014-04/0069.html, http://www.securityfocus.com/bid/66791, http://archives.neohapsis.com/archives/bugtraq/2014-04/0069.html
CWE: CWE-310
CVE-2014-5863
The mpang.gp (aka air.com.cjenm.mpang.gp) application 4.0.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS v2.0 Score: 5.4 (MEDIUM)
CVSS v2.0 Vector: AV:A/AC:M/Au:N/C:P/I:P/A:P
Affected Products: mpang.gp
Related CWEs: CWE-310
References: http://www.kb.cert.org/vuls/id/582497, http://www.kb.cert.org/vuls/id/693817, https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CWE: CWE-310
CVE-2014-9967
In all Android releases from CAF using the Linux kernel, an untrusted pointer dereference vulnerability exists in WideVine DRM.
CVSS v3.0 Score: 7.8 (HIGH)
CVSS v3.0 Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 9.3 (HIGH)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
Affected Products: android
Related CWEs: CWE-476
References: http://www.securityfocus.com/bid/98874, http://www.securitytracker.com/id/1038623, https://source.android.com/security/bulletin/2017-06-01
CWE: CWE-476
CVE-2014-5359
Directory traversal vulnerability in SafeNet Authentication Service (SAS) Outlook Web Access Agent (formerly CRYPTOCard) before 1.03.30109 allows remote attackers to read arbitrary files via a .. (dot dot) in the GetFile parameter to owa/owa.
CVSS v2.0 Score: 7.8 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:N/A:N
Affected Products: safenet_authentication_service_outlook_web_access_agent
Related CWEs: CWE-22
Related CAPECs: CAPEC-78, CAPEC-126, CAPEC-76
References: http://appcheck-ng.com/safenet-sas-owa-agent-directory-traversal-vulnerability/, http://www.safenet-inc.com/technical-support/security-updates/, http://appcheck-ng.com/safenet-sas-owa-agent-directory-traversal-vulnerability/
CWE: CWE-22
CVE-2014-2240
Stack-based buffer overflow in the cf2_hintmap_build function in cff/cf2hints.c in FreeType before 2.5.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large number of stem hints in a font file.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: freetype
Related CWEs: CWE-119
Related CAPECs: CAPEC-14, CAPEC-45, CAPEC-9
References: http://savannah.nongnu.org/bugs/?41697, http://secunia.com/advisories/57291, http://secunia.com/advisories/57447
CWE: CWE-119
CVE-2014-0524
Adobe Reader and Acrobat 10.x before 10.1.10 and 11.x before 11.0.07 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0522, CVE-2014-0523, and CVE-2014-0526.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: windows, acrobat, acrobat_reader, mac_os_x
Related CWEs: CWE-119
Related CAPECs: CAPEC-14, CAPEC-45, CAPEC-9
References: http://helpx.adobe.com/security/products/reader/apsb14-15.html, http://helpx.adobe.com/security/products/reader/apsb14-15.html
CWE: CWE-119
CVE-2014-7525
The Domain Name Search & Web Host (aka com.wDomainNameSearchandRegistration) application 0.64.13398.55733 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS v2.0 Score: 5.4 (MEDIUM)
CVSS v2.0 Vector: AV:A/AC:M/Au:N/C:P/I:P/A:P
Affected Products: domain_name_search_\&_web_host
Related CWEs: CWE-310
References: http://www.kb.cert.org/vuls/id/582497, http://www.kb.cert.org/vuls/id/803025, https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CWE: CWE-310
CVE-2014-7800
The Daily Green (aka it.opentt.blog.dailygreen) application 2014.07 dlygrn for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS v2.0 Score: 5.4 (MEDIUM)
CVSS v2.0 Vector: AV:A/AC:M/Au:N/C:P/I:P/A:P
Affected Products: daily_green
Related CWEs: CWE-310
References: http://www.kb.cert.org/vuls/id/284089, http://www.kb.cert.org/vuls/id/582497, https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CWE: CWE-310
CVE-2014-0411
Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; JRockit R27.7.7 and R28.2.9; Java SE Embedded 7u45; and OpenJDK 7 allows remote attackers to affect confidentiality and integrity via vectors related to JSSE.  NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that this issue allows remote attackers to obtain sensitive information about encryption keys via a timing discrepancy during the TLS/SSL handshake.
CVSS v2.0 Score: 4.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:N
Affected Products: jrockit, jre, jdk
References: http://hg.openjdk.java.net/jdk7u/jdk7u/jdk/rev/d533e96c7acc, http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00009.html, http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00012.html
CVE-2014-9507
MediaWiki 1.21.x, 1.22.x before 1.22.14, and 1.23.x before 1.23.7, when $wgContentHandlerUseDB is enabled, allows remote attackers to conduct cross-site scripting (XSS) attacks by setting the content model for a revision to JS.
CVSS v2.0 Score: 2.6 (LOW)
CVSS v2.0 Vector: AV:N/AC:H/Au:N/C:N/I:P/A:N
Affected Products: mediawiki
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://lists.wikimedia.org/pipermail/mediawiki-announce/2014-November/000170.html, https://phabricator.wikimedia.org/T72901, https://lists.wikimedia.org/pipermail/mediawiki-announce/2014-November/000170.html
CWE: CWE-79
CVE-2014-9862
Integer signedness error in bspatch.c in bspatch in bsdiff, as used in Apple OS X before 10.11.6 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow) via a crafted patch file.
CVSS v3.0 Score: 7.8 (HIGH)
CVSS v3.0 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: mac_os_x
Related CWEs: CWE-190
Related CAPECs: CAPEC-92
References: http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html, http://lists.opensuse.org/opensuse-updates/2016-08/msg00026.html, http://seclists.org/fulldisclosure/2020/Jul/8
CWE: CWE-190
CVE-2014-3321
Cisco IOS XR 4.3.4 and earlier on ASR 9000 devices, when bridge-group virtual interface (BVI) routing is enabled, allows remote attackers to cause a denial of service (chip and card hangs) via a series of crafted MPLS packets, aka Bug ID CSCuo91149.
CVSS v2.0 Score: 5.7 (MEDIUM)
CVSS v2.0 Vector: AV:A/AC:M/Au:N/C:N/I:N/A:C
Affected Products: asr_9001, asr_9010, asr_9904, asr_9000_rsp440_router, asr_9922
Related CWEs: CWE-20
Related CAPECs: CAPEC-31, CAPEC-53, CAPEC-261
MITRE ATT&CK Techniques: T1574.006, T1553.002, T1574.007
MITRE ATT&CK Tactics: T1562, T1574, T1553
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3321, http://tools.cisco.com/security/center/viewAlert.x?alertId=34936, http://www.securitytracker.com/id/1030597
CWE: CWE-20
MITRE ATT&CK techniques: T1574.006, T1553.002, T1574.007, T1539, T1036.001, T1562.003, T1027
MITRE ATT&CK tactics: T1562, T1574, T1553, T1036
CVE-2014-7624
The Guess the Pixel Character Quiz (aka com.aiadp.pixelcQuiz) application 1.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS v2.0 Score: 5.4 (MEDIUM)
CVSS v2.0 Vector: AV:A/AC:M/Au:N/C:P/I:P/A:P
Affected Products: guess_the_pixel_character_quiz
Related CWEs: CWE-310
References: http://www.kb.cert.org/vuls/id/109585, http://www.kb.cert.org/vuls/id/582497, https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CWE: CWE-310
CVE-2014-2171
Heap-based buffer overflow in Cisco TelePresence TC Software 4.x through 6.x before 6.0.1 and TE Software 4.x and 6.0.x before 6.0.2 allows remote attackers to execute arbitrary code via crafted SIP packets, aka Bug ID CSCud81796.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: telepresence_tc_software, telepresence_te_software
Related CWEs: CWE-119
Related CAPECs: CAPEC-14, CAPEC-45, CAPEC-9
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140430-tcte, http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140430-tcte
CWE: CWE-119
CVE-2014-6155
Multiple directory traversal vulnerabilities in the ServiceRegistry UI in IBM WebSphere Service Registry and Repository (WSRR) 7.5.x through 7.5.0.4, 8.0.x before 8.0.0.3, and 8.5.x before 8.5.0.1 allow remote authenticated users to read arbitrary files via unspecified vectors.
CVSS v2.0 Score: 4.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:S/C:P/I:N/A:N
Affected Products: websphere_service_registry_and_repository
Related CWEs: CWE-22
Related CAPECs: CAPEC-78, CAPEC-126, CAPEC-76
References: http://secunia.com/advisories/61805, http://www-01.ibm.com/support/docview.wss?uid=swg1IV63585, http://www.ibm.com/support/docview.wss?uid=swg21693384
CWE: CWE-22
CVE-2014-9442
SQL injection vulnerability in models/Cart66Ajax.php in the Cart66 Lite plugin before 1.5.4 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the q parameter in a promotionProductSearch action to wp-admin/admin-ajax.php.
CVSS v2.0 Score: 6.5 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P
Affected Products: cart66_lite
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: http://secunia.com/advisories/61942, https://plugins.trac.wordpress.org/changeset/1052064/cart66-lite, https://research.g0blin.co.uk/g0blin-00022/
CWE: CWE-89
CVE-2014-9569
Multiple cross-site scripting (XSS) vulnerabilities in SAP NetWeaver Business Client (NWBC) for HTML 3.0 allow remote attackers to inject arbitrary web script or HTML via the (1) title or (2) roundtrips parameter, aka SAP Security Note 2051285.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: netweaver_business_client_for_html
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://secunia.com/advisories/62017, http://www.securitytracker.com/id/1031509, http://www.senseofsecurity.com.au/advisories/SOS-14-005
CWE: CWE-79
CVE-2014-2474
Unspecified vulnerability in the Oracle Secure Global Desktop component in Oracle Virtualization 5.0 and 5.1 allows remote attackers to affect availability via vectors related to SGD Proxy Server (ttaauxserv), a different vulnerability than CVE-2014-2472, CVE-2014-2476, and CVE-2014-6459.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: virtualization
References: http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html, http://www.securitytracker.com/id/1031034, http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
CVE-2014-3596
The getCN function in Apache Axis 1.4 and earlier does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a certificate with a subject that specifies a common name in a field that is not the CN field. NOTE: this issue exists because of an incomplete fix for CVE-2012-5784.
CVSS v2.0 Score: 5.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:N
Affected Products: axis
References: http://linux.oracle.com/errata/ELSA-2014-1193.html, http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00007.html, http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00022.html
CVE-2014-0369
Unspecified vulnerability in the Siebel Core - EAI component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect confidentiality via unknown vectors related to Java Integration, a different vulnerability than CVE-2015-0366.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: siebel_crm
References: http://osvdb.org/102107, http://secunia.com/advisories/56480, http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html
CVE-2014-7698
The Xinhua International (aka org.xinhua.xnews_international) application 5.5.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS v2.0 Score: 5.4 (MEDIUM)
CVSS v2.0 Vector: AV:A/AC:M/Au:N/C:P/I:P/A:P
Affected Products: xinhua_international
Related CWEs: CWE-310
References: http://www.kb.cert.org/vuls/id/582497, http://www.kb.cert.org/vuls/id/657297, https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CWE: CWE-310
CVE-2014-9880
drivers/video/msm/vidc/common/enc/venc.c in the Qualcomm components in Android before 2016-08-05 on Nexus 7 (2013) devices does not validate VEN_IOCTL_GET_SEQUENCE_HDR ioctl calls, which allows attackers to gain privileges via a crafted application, aka Android internal bug 28769352 and Qualcomm internal bug CR556356.
CVSS v3.0 Score: 7.8 (HIGH)
CVSS v3.0 Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Affected Products: android
Related CWEs: CWE-264
References: http://source.android.com/security/bulletin/2016-08-01.html, http://www.securityfocus.com/bid/92219, https://source.codeaurora.org/quic/la/kernel/msm/commit/?id=f2a3f5e63e15e97a66e8f5a300457378bcb89d9c
CWE: CWE-264
CVE-2014-5972
The Loving - Couple Essential (aka com.xiaoenai.app) application 4.0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS v2.0 Score: 5.4 (MEDIUM)
CVSS v2.0 Vector: AV:A/AC:M/Au:N/C:P/I:P/A:P
Affected Products: loving_-_couple_essential
Related CWEs: CWE-310
References: http://www.kb.cert.org/vuls/id/582497, http://www.kb.cert.org/vuls/id/822297, https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CWE: CWE-310
CVE-2014-2949
SQL injection vulnerability in the web service in F5 ARX Data Manager 3.0.0 through 3.1.0 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
CVSS v2.0 Score: 6.5 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P
Affected Products: arx_data_manager
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: http://support.f5.com/kb/en-us/solutions/public/15000/300/sol15310.html?sr=38021626, http://www.kb.cert.org/vuls/id/210884, http://www.securityfocus.com/bid/68078
CWE: CWE-89