DuyTa/cve-kgrag-db huggingface dataset:
CVE-2014-4629
EMC Documentum Content Server 7.0, 7.1 before 7.1 P10, and 6.7 before SP2 P19 allows remote authenticated users to read or delete arbitrary files via unspecified vectors related to an insecure direct object reference.
CVSS v2.0 Score: 9.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:S/C:C/I:C/A:C
Affected Products: documentum_content_server
Related CWEs: CWE-264
References: http://packetstormsecurity.com/files/129376/EMC-Documentum-Content-Server-Insecure-Direct-Object-Reference.html, http://www.securityfocus.com/archive/1/534135/100/0/threaded, http://www.securityfocus.com/bid/71422
CWE: CWE-264
CVE-2014-5856
The Selfie Camera -Facial Beauty- (aka com.cfinc.cunpic) application 1.2.7 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS v2.0 Score: 5.4 (MEDIUM)
CVSS v2.0 Vector: AV:A/AC:M/Au:N/C:P/I:P/A:P
Affected Products: selfie_camera_-facial_beauty-
Related CWEs: CWE-310
References: http://www.kb.cert.org/vuls/id/579065, http://www.kb.cert.org/vuls/id/582497, https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CWE: CWE-310
CVE-2014-1296
CFNetwork in Apple iOS before 7.1.1, Apple OS X through 10.9.2, and Apple TV before 6.1.1 does not ensure that a Set-Cookie HTTP header is complete before interpreting the header's value, which allows remote attackers to bypass intended access restrictions by triggering the closing of a TCP connection during transmission of a header, as demonstrated by an HTTPOnly restriction.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N
Affected Products: mac_os_x_server, iphone_os, tvos, mac_os_x
Related CWEs: CWE-264
References: http://archives.neohapsis.com/archives/bugtraq/2014-04/0134.html, http://archives.neohapsis.com/archives/bugtraq/2014-04/0135.html, http://archives.neohapsis.com/archives/bugtraq/2014-04/0136.html
CWE: CWE-264
CVE-2014-7573
The droid Survey Offline Forms (aka com.contact.droidSURVEY) application 2.5.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS v2.0 Score: 5.4 (MEDIUM)
CVSS v2.0 Vector: AV:A/AC:M/Au:N/C:P/I:P/A:P
Affected Products: droid_survey_offline_forms
Related CWEs: CWE-310
References: http://www.kb.cert.org/vuls/id/582497, http://www.kb.cert.org/vuls/id/599833, https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CWE: CWE-310
CVE-2014-2628
Unspecified vulnerability in HP Enterprise Maps 1 allows remote authenticated users to obtain sensitive information via unknown vectors.
CVSS v2.0 Score: 4.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:S/C:P/I:N/A:N
Affected Products: enterprise_maps
References: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04390793, https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04390793
CVE-2014-8073
Cross-site request forgery (CSRF) vulnerability in OpenMRS 2.1 Standalone Edition allows remote attackers to hijack the authentication of administrators for requests that add a new user via a Save User action to admin/users/user.form.
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Affected Products: openmrs
Related CWEs: CWE-352
Related CAPECs: CAPEC-467, CAPEC-111, CAPEC-462
References: http://packetstormsecurity.com/files/128748/OpenMRS-2.1-Access-Bypass-XSS-CSRF.html, http://www.securityfocus.com/bid/70664, https://exchange.xforce.ibmcloud.com/vulnerabilities/97692
CWE: CWE-352
CVE-2014-0653
The Identity Firewall (IDFW) functionality in Cisco Adaptive Security Appliance (ASA) Software allows remote attackers to trigger authentication-state modifications via a crafted NetBIOS logout probe response, aka Bug ID CSCuj45340.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: adaptive_security_appliance
Related CWEs: CWE-20
Related CAPECs: CAPEC-31, CAPEC-53, CAPEC-261
MITRE ATT&CK Techniques: T1574.006, T1553.002, T1574.007
MITRE ATT&CK Tactics: T1562, T1574, T1553
References: http://osvdb.org/101834, http://secunia.com/advisories/56366, http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0653
CWE: CWE-20
MITRE ATT&CK techniques: T1574.006, T1553.002, T1574.007, T1539, T1036.001, T1562.003, T1027
MITRE ATT&CK tactics: T1562, T1574, T1553, T1036
CVE-2014-6660
The Koleksi Hadis Nabi SAW (aka com.wKoleksiHadisNabiSAW) application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS v2.0 Score: 5.4 (MEDIUM)
CVSS v2.0 Vector: AV:A/AC:M/Au:N/C:P/I:P/A:P
Affected Products: koleksi_hadis_nabi_saw
Related CWEs: CWE-310
References: http://www.kb.cert.org/vuls/id/582497, http://www.kb.cert.org/vuls/id/851425, https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CWE: CWE-310
CVE-2014-5009
Snoopy allows remote attackers to execute arbitrary commands.  NOTE: this vulnerability exists due to an incomplete fix for CVE-2014-5008.
CVSS v3.0 Score: 9.8 (CRITICAL)
CVSS v3.0 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: snoopy, openstack, nagios
Related CWEs: CWE-77
Related CAPECs: CAPEC-43, CAPEC-183, CAPEC-76
References: http://rhn.redhat.com/errata/RHSA-2017-0211.html, http://rhn.redhat.com/errata/RHSA-2017-0212.html, http://rhn.redhat.com/errata/RHSA-2017-0213.html
CWE: CWE-77
CVE-2014-0260
Microsoft Word 2003 SP3, 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Office Compatibility Pack SP3; Word Viewer; SharePoint Server 2010 SP1 and SP2 and 2013; Office Web Apps 2010 SP1 and SP2; and Office Web Apps Server 2013 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Word Memory Corruption Vulnerability."
CVSS v2.0 Score: 9.3 (HIGH)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
Affected Products: word_viewer, word, office_web_apps_server, sharepoint_server, office_web_apps
Related CWEs: CWE-119
Related CAPECs: CAPEC-14, CAPEC-45, CAPEC-9
References: http://www.securitytracker.com/id/1029598, http://www.securitytracker.com/id/1029599, https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-001
CWE: CWE-119
CVE-2014-6806
The Thanodi - Setswana Translator (aka com.thanodi.thanodi) application 1.0.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS v2.0 Score: 5.4 (MEDIUM)
CVSS v2.0 Vector: AV:A/AC:M/Au:N/C:P/I:P/A:P
Affected Products: thanodi_-_setswana_translator
Related CWEs: CWE-310
References: http://www.kb.cert.org/vuls/id/582497, http://www.kb.cert.org/vuls/id/787625, https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CWE: CWE-310
CVE-2014-2285
The perl_trapd_handler function in perl/TrapReceiver/TrapReceiver.xs in Net-SNMP 5.7.3.pre3 and earlier, when using certain Perl versions, allows remote attackers to cause a denial of service (snmptrapd crash) via an empty community string in an SNMP trap, which triggers a NULL pointer dereference within the newSVpv function in Perl.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P
Affected Products: net-snmp
Related CWEs: CWE-20
Related CAPECs: CAPEC-31, CAPEC-53, CAPEC-261
MITRE ATT&CK Techniques: T1574.006, T1553.002, T1574.007
MITRE ATT&CK Tactics: T1562, T1574, T1553
References: http://comments.gmane.org/gmane.comp.security.oss.general/12284, http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705, http://lists.opensuse.org/opensuse-updates/2014-03/msg00060.html
CWE: CWE-20
MITRE ATT&CK techniques: T1574.006, T1553.002, T1574.007, T1539, T1036.001, T1562.003, T1027
MITRE ATT&CK tactics: T1562, T1574, T1553, T1036
CVE-2014-0522
Adobe Reader and Acrobat 10.x before 10.1.10 and 11.x before 11.0.07 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0523, CVE-2014-0524, and CVE-2014-0526.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: mac_os_x, windows, acrobat, acrobat_reader
Related CWEs: CWE-119
Related CAPECs: CAPEC-14, CAPEC-45, CAPEC-9
References: http://helpx.adobe.com/security/products/reader/apsb14-15.html, http://helpx.adobe.com/security/products/reader/apsb14-15.html
CWE: CWE-119
CVE-2014-7957
Multiple cross-site request forgery (CSRF) vulnerabilities in the Pods plugin before 2.5 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) conduct cross-site scripting (XSS) attacks via the toggled parameter in a toggle action in the pods-components page to wp-admin/admin.php, (2) delete a pod in a delete action in the pods page to wp-admin/admin.php, (3) reset pod settings and data via the pods_reset parameter in the pod-settings page to wp-admin/admin.php, (4) deactivate and reset pod data via the pods_reset_deactivate parameter in the pod-settings page to wp-admin/admin.php, (5) delete the admin role via the id parameter in a delete action in the pods-component-roles-and-capabilities page to wp-admin/admin.php, or (6) enable "roles and capabilities" in a toggle action in the pods-components page to wp-admin/admin.php.
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Affected Products: pods
Related CWEs: CWE-352
Related CAPECs: CAPEC-467, CAPEC-111, CAPEC-462
References: http://packetstormsecurity.com/files/129890/WordPress-Pods-2.4.3-CSRF-Cross-Site-Scripting.html, http://seclists.org/fulldisclosure/2015/Jan/26, http://www.securityfocus.com/archive/1/534437/100/0/threaded
CWE: CWE-352
CVE-2014-0953
Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 6.1.0.0 through 6.1.0.6 CF27, 6.1.5.0 through 6.1.5.3 CF27, 7.0.0 through 7.0.0.2 CF28, and 8.0.0 before 8.0.0.1 CF12 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: websphere_portal
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PI16127, http://www-01.ibm.com/support/docview.wss?uid=swg21680230, http://www.securitytracker.com/id/1030669
CWE: CWE-79
CVE-2014-3759
Multiple SQL injection vulnerabilities in the BibTex Publications (si_bibtex) extension 0.2.3 for TYPO3 allow remote attackers to execute arbitrary SQL commands via vectors related to the (1) search or (2) list functionality.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: si_bibtex
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: http://seclists.org/fulldisclosure/2014/Apr/314, http://www.securityfocus.com/archive/1/531980/100/0/threaded, http://www.securityfocus.com/bid/67145
CWE: CWE-89
CVE-2014-0604
Directory traversal vulnerability in the rftpcom.dll ActiveX control in Attachmate Reflection FTP Client before 14.1.429 allows remote attackers to execute arbitrary code via unspecified vectors to the StartLog method.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: reflection_ftp_client
Related CWEs: CWE-22
Related CAPECs: CAPEC-78, CAPEC-126, CAPEC-76
References: http://support.attachmate.com/techdocs/2501.html, http://www.zerodayinitiative.com/advisories/ZDI-14-289/, http://support.attachmate.com/techdocs/2501.html
CWE: CWE-22
CVE-2014-4823
The administration console in IBM Security Access Manager for Web 7.x before 7.0.0-ISS-WGA-IF0009 and 8.x before 8.0.0-ISS-WGA-FP0005, and Security Access Manager for Mobile 8.x before 8.0.0-ISS-ISAM-FP0005, allows remote attackers to inject system commands via unspecified vectors.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: security_access_manager_for_web_8.0_firmware, security_access_manager_for_web_appliance, security_access_manager_for_mobile_8.0_firmware, security_access_manager_for_web_7.0_firmware, security_access_manager_for_mobile_appliance
Related CWEs: CWE-78
Related CAPECs: CAPEC-43, CAPEC-6, CAPEC-88
References: http://secunia.com/advisories/61278, http://secunia.com/advisories/61294, http://www-01.ibm.com/support/docview.wss?uid=swg1IV64910
CWE: CWE-78
CVE-2014-8684
CodeIgniter before 3.0 and Kohana 3.2.3 and earlier and 3.3.x through 3.3.2 make it easier for remote attackers to spoof session cookies and consequently conduct PHP object injection attacks by leveraging use of standard string comparison operators to compare cryptographic hashes.
CVSS v3.0 Score: 9.8 (CRITICAL)
CVSS v3.0 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: kohana, codeigniter
Related CWEs: CWE-310
References: http://packetstormsecurity.com/files/130609/Seagate-Business-NAS-Unauthenticated-Remote-Command-Execution.html, http://seclists.org/fulldisclosure/2014/May/54, https://github.com/kohana/core/pull/492
CWE: CWE-310
CVE-2014-7226
The file comment feature in Rejetto HTTP File Server (hfs) 2.3c and earlier allows remote attackers to execute arbitrary code by uploading a file with certain invalid UTF-8 byte sequences that are interpreted as executable macro symbols.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: http_file_server
Related CWEs: CWE-94
Related CAPECs: CAPEC-242, CAPEC-77, CAPEC-35
MITRE ATT&CK Techniques: T1027.006, T1564.009, T1027.009
MITRE ATT&CK Tactics: T1564, T1027
References: http://packetstormsecurity.com/files/128532/HTTP-File-Server-2.3a-2.3b-2.3c-Remote-Command-Execution.html, http://www.exploit-db.com/exploits/34852, http://www.rejetto.com/forum/hfs-~-http-file-server/new-version-2-3d/
CWE: CWE-94
MITRE ATT&CK techniques: T1027.006, T1564.009, T1027.009
MITRE ATT&CK tactics: T1564, T1027
CVE-2014-7592
The FOL (aka com.desire2learn.fol.mobile.app.campuslife.directory) application 3.0.729.1459 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS v2.0 Score: 5.4 (MEDIUM)
CVSS v2.0 Vector: AV:A/AC:M/Au:N/C:P/I:P/A:P
Affected Products: fol
Related CWEs: CWE-310
References: http://www.kb.cert.org/vuls/id/582497, http://www.kb.cert.org/vuls/id/649113, https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CWE: CWE-310
CVE-2014-4527
Multiple cross-site scripting (XSS) vulnerabilities in paginas/vista-previa-form.php in the EnvialoSimple: Email Marketing and Newsletters (envialosimple-email-marketing-y-newsletters-gratis) plugin before 1.98 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) FormID or (2) AdministratorID parameter.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: email_marketing_y_newsletters
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://codevigilant.com/disclosure/wp-plugin-envialosimple-email-marketing-y-newsletters-gratis-a3-cross-site-scripting-xss, https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=843064%40envialosimple-email-marketing-y-newsletters-gratis&old=839677%40envialosimple-email-marketing-y-newsletters-gratis&sfp_email=&sfph_mail=, http://codevigilant.com/disclosure/wp-plugin-envialosimple-email-marketing-y-newsletters-gratis-a3-cross-site-scripting-xss
CWE: CWE-79
CVE-2014-9157
Format string vulnerability in the yyerror function in lib/cgraph/scan.l in Graphviz allows remote attackers to have unspecified impact via format string specifiers in unknown vectors, which are not properly handled in an error string.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: debian_linux, graphviz
Related CWEs: CWE-134
Related CAPECs: CAPEC-135, CAPEC-67
References: http://advisories.mageia.org/MGASA-2014-0520.html, http://seclists.org/oss-sec/2014/q4/784, http://seclists.org/oss-sec/2014/q4/872
CWE: CWE-134
CVE-2014-3972
Directory traversal vulnerability in Apexis APM-J601-WS cameras with firmware before 17.35.2.49 allows remote attackers to read arbitrary files via unspecified vectors.
CVSS v3.0 Score: 5.3 (MEDIUM)
CVSS v3.0 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: apm-j601-ws_firmware, apm-j601-ws
Related CWEs: CWE-22
Related CAPECs: CAPEC-78, CAPEC-126, CAPEC-76
References: https://fortiguard.com/zeroday/FG-VD-14-004, https://fortiguard.com/zeroday/FG-VD-14-004
CWE: CWE-22
CVE-2014-1497
The mozilla::WaveReader::DecodeAudioData function in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to obtain sensitive information from process heap memory, cause a denial of service (out-of-bounds read and application crash), or possibly have unspecified other impact via a crafted WAV file.
CVSS v3.1 Score: 8.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Affected Products: thunderbird, debian_linux, enterprise_linux_server_tus, opensuse, firefox
Related CWEs: CWE-125
Related CAPECs: CAPEC-540
References: http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00016.html, http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.html, http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00022.html
CWE: CWE-125
CVE-2014-5627
The Ice Age Village (aka com.gameloft.android.ANMP.GloftIAHM) application 2.8.0m for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS v2.0 Score: 5.4 (MEDIUM)
CVSS v2.0 Vector: AV:A/AC:M/Au:N/C:P/I:P/A:P
Affected Products: ice_age_village
Related CWEs: CWE-310
References: http://www.kb.cert.org/vuls/id/520633, http://www.kb.cert.org/vuls/id/582497, https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CWE: CWE-310
CVE-2014-9207
Untrusted search path vulnerability in CmnView.exe in CIMON CmnView 2.14.0.1 and 3.x before UltimateAccess 3.02 allows local users to gain privileges via a Trojan horse DLL in the current working directory.
CVSS v2.0 Score: 6.9 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C
Affected Products: cmnview, ultimateaccess
References: https://ics-cert.us-cert.gov/advisories/ICSA-15-069-01, https://ics-cert.us-cert.gov/advisories/ICSA-15-069-01
CVE-2014-8334
The WP-DBManager (aka Database Manager) plugin before 2.7.2 for WordPress allows remote authenticated users to execute arbitrary commands via shell metacharacters in the (1) $backup['filepath'] (aka "Path to Backup:" field) or (2) $backup['mysqldumppath'] variable.
CVSS v2.0 Score: 6.5 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P
Affected Products: wp-dbmanager
Related CWEs: CWE-78
Related CAPECs: CAPEC-43, CAPEC-6, CAPEC-88
References: http://osvdb.org/show/osvdb/113508, http://packetstormsecurity.com/files/128785/WordPress-Database-Manager-2.7.1-Command-Injection-Credential-Leak.html, http://seclists.org/fulldisclosure/2014/Oct/99
CWE: CWE-78
CVE-2014-2409
Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality and integrity via unknown vectors related to Deployment.
CVSS v2.0 Score: 6.4 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N
Affected Products: jre, jdk
References: http://marc.info/?l=bugtraq&m=140852886808946&w=2, http://marc.info/?l=bugtraq&m=140852974709252&w=2, http://security.gentoo.org/glsa/glsa-201502-12.xml
CVE-2014-2884
The ProcessVolumeDeviceControlIrp function in Ntdriver.c in TrueCrypt 7.1a allows local users to bypass access restrictions and obtain sensitive information about arbitrary files via a (1) TC_IOCTL_OPEN_TEST or (2) TC_IOCTL_GET_SYSTEM_DRIVE_CONFIG IOCTL call.
CVSS v3.0 Score: 3.3 (LOW)
CVSS v3.0 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N
Affected Products: truecrypt
Related CWEs: CWE-284, CWE-200
Related CAPECs: CAPEC-497, CAPEC-536, CAPEC-578
MITRE ATT&CK Techniques: T1014, T1562.001, T1543.003
MITRE ATT&CK Tactics: T1134, T1556, T1546
References: http://www.openwall.com/lists/oss-security/2014/04/17/7, https://opencryptoaudit.org/reports/iSec_Final_Open_Crypto_Audit_Project_TrueCrypt_Security_Assessment.pdf, http://www.openwall.com/lists/oss-security/2014/04/17/7
CWE: CWE-284, CWE-200
MITRE ATT&CK techniques: T1014, T1562.001, T1543.003, T1036.005, T1574.007, T1546.008, T1217, T1590, T1135, T1069, T1037, T1562.007, T1027.009, T1057, T1543.001, T1124, T1547, T1595, T1543.004, T1134.001, T1562.002, T1553.004, T1546.016, T1087, T1080, T1574.011, T1033, T1556.006, T1543, T1574.006, T1111, T1120, T1546.004, T1592, T1016, T1547.006, T1046, T1546.001, T1082, T1562.004, T1049, T1542.003, T1083, T1505.005, T1550.004, T1615, T1562.008, T1007, T1562.009, T1562.003, T1018
MITRE ATT&CK tactics: T1134, T1556, T1546, T1547, T1542, T1036, T1505, T1553, T1550, T1562, T1574, T1543, T1027
CVE-2014-6386
Juniper Junos 11.4 before 11.4R8, 12.1X44 before 12.1X44-D35, 12.1X45 before 12.1X45-D25, 12.1X46 before 12.1X46-D20, 12.1X47 before 12.1X47-D10, 12.2 before 12.2R9, 12.3R2 before 12.3R2-S3, 12.3 before 12.3R3, 13.1 before 13.1R4, and 13.2 before 13.2R1 allows remote attackers to cause a denial of service (assertion failure and rpd restart) via a crafted BGP FlowSpec prefix.
CVSS v2.0 Score: 7.8 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C
Affected Products: junos
Related CWEs: CWE-17
References: http://www.securityfocus.com/bid/72067, http://www.securitytracker.com/id/1031548, https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10670
CWE: CWE-17
CVE-2014-1708
The boot implementation in Google Chrome OS before 33.0.1750.152 does not properly consider file persistence, which allows remote attackers to execute arbitrary code via unspecified vectors.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: chrome_os
References: http://googlechromereleases.blogspot.com/2014/03/stable-channel-update-for-chrome-os_14.html, https://code.google.com/p/chromium/issues/detail?id=344051, http://googlechromereleases.blogspot.com/2014/03/stable-channel-update-for-chrome-os_14.html
CVE-2014-1402
The default configuration for bccache.FileSystemBytecodeCache in Jinja2 before 2.7.2 does not properly create temporary files, which allows local users to gain privileges via a crafted .cache file with a name starting with __jinja2_ in /tmp.
CVSS v2.0 Score: 4.4 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:M/Au:N/C:P/I:P/A:P
Affected Products: jinja2
Related CWEs: CWE-264
References: http://advisories.mageia.org/MGASA-2014-0028.html, http://jinja.pocoo.org/docs/changelog/, http://openwall.com/lists/oss-security/2014/01/10/2
CWE: CWE-264
CVE-2014-4826
IBM Security QRadar SIEM 7.2 before 7.2.3 Patch 1 does not properly handle SSH connections, which allows remote attackers to obtain sensitive cleartext information by sniffing the network.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N
Affected Products: qradar_security_information_and_event_manager
Related CWEs: CWE-200
Related CAPECs: CAPEC-497, CAPEC-285, CAPEC-59
MITRE ATT&CK Techniques: T1036.005, T1574.007, T1217
MITRE ATT&CK Tactics: T1134, T1036, T1550
References: http://secunia.com/advisories/61261, http://www-01.ibm.com/support/docview.wss?uid=swg21684448, https://exchange.xforce.ibmcloud.com/vulnerabilities/95576
CWE: CWE-200
MITRE ATT&CK techniques: T1036.005, T1574.007, T1217, T1590, T1135, T1069, T1057, T1124, T1595, T1134.001, T1087, T1033, T1574.006, T1111, T1120, T1592, T1016, T1046, T1082, T1049, T1083, T1550.004, T1615, T1007, T1562.003, T1018
MITRE ATT&CK tactics: T1134, T1036, T1550, T1562, T1574
CVE-2014-0088
The SPDY implementation in the ngx_http_spdy_module module in nginx 1.5.10 before 1.5.11, when running on a 32-bit platform, allows remote attackers to execute arbitrary code via a crafted request.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: nginx
Related CWEs: CWE-119
Related CAPECs: CAPEC-14, CAPEC-45, CAPEC-9
References: http://mailman.nginx.org/pipermail/nginx-announce/2014/000132.html, http://www.securitytracker.com/id/1030150, http://mailman.nginx.org/pipermail/nginx-announce/2014/000132.html
CWE: CWE-119
CVE-2014-2380
Schneider Electric Wonderware Information Server (WIS) Portal 4.0 SP1 through 5.5 uses weak encryption, which allows remote attackers to obtain sensitive information by reading a credential file.
CVSS v2.0 Score: 7.8 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:N/A:N
Affected Products: wonderware_information_server
Related CWEs: CWE-326
Related CAPECs: CAPEC-112, CAPEC-192, CAPEC-20
MITRE ATT&CK Techniques: T1110
References: https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2014/icsa-14-238-02.json, https://www.cisa.gov/news-events/ics-advisories/icsa-14-238-02, https://ics-cert.us-cert.gov/advisories/ICSA-14-238-02
CWE: CWE-326
MITRE ATT&CK techniques: T1110
CVE-2014-0925
Open redirect vulnerability in IBM Sterling Control Center 5.4.0 before 5.4.0.1 iFix 3 and 5.4.1 before 5.4.1.0 iFix 2 allows remote authenticated users to redirect users to arbitrary web sites and conduct phishing attacks via a crafted URL.
CVSS v2.0 Score: 3.5 (LOW)
CVSS v2.0 Vector: AV:N/AC:M/Au:S/C:N/I:P/A:N
Affected Products: sterling_control_center
References: http://www-01.ibm.com/support/docview.wss?uid=swg21673004, https://exchange.xforce.ibmcloud.com/vulnerabilities/92078, http://www-01.ibm.com/support/docview.wss?uid=swg21673004
CVE-2014-8472
CA Cloud Service Management (CSM) before Summer 2014 does not properly verify authentication tokens from an Identity Provider, which allows user-assisted remote attackers to bypass intended access restrictions via unspecified vectors.
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Affected Products: cloud_service_management
Related CWEs: CWE-287
Related CAPECs: CAPEC-151, CAPEC-94, CAPEC-593
MITRE ATT&CK Techniques: T1134, T1550.001, T1557
MITRE ATT&CK Tactics: T1550, T1505
References: http://www.ca.com/us/support/ca-support-online/product-content/recommended-reading/security-notices/ca20141103-01-security-notice-for-ca-cloud-service-management.aspx, http://www.securityfocus.com/bid/70923, http://www.securitytracker.com/id/1031214
CWE: CWE-287
MITRE ATT&CK techniques: T1134, T1550.001, T1557, T1185, T1505.003, T1548, T1563, T1040
MITRE ATT&CK tactics: T1550, T1505
CVE-2014-3307
The DHCP client implementation in Universal Small Cell firmware on Cisco Small Cell products allows remote attackers to execute arbitrary commands via crafted DHCP messages, aka Bug ID CSCup47513.
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:A/AC:H/Au:N/C:C/I:C/A:C
Affected Products: universal_small_cell_series_firmware
References: http://secunia.com/advisories/59024, http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3307, http://www.securityfocus.com/bid/68307
CVE-2014-0246
SOSreport stores the md5 hash of the GRUB bootloader password in an archive, which allows local users to obtain sensitive information by reading the archive.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N
Affected Products: sosreport
Related CWEs: CWE-255
References: http://www.openwall.com/lists/oss-security/2014/05/27/1, http://www.securityfocus.com/bid/67634, https://bugzilla.redhat.com/show_bug.cgi?id=1101393
CWE: CWE-255
CVE-2014-9978
In all Qualcomm products with Android releases from CAF using the Linux kernel, a buffer overflow vulnerability exists in a QTEE service.
CVSS v3.0 Score: 9.8 (CRITICAL)
CVSS v3.0 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: android
Related CWEs: CWE-119
Related CAPECs: CAPEC-14, CAPEC-45, CAPEC-9
References: http://www.securityfocus.com/bid/99467, https://source.android.com/security/bulletin/2017-07-01, http://www.securityfocus.com/bid/99467
CWE: CWE-119
CVE-2014-10381
The user-domain-whitelist plugin before 1.5 for WordPress has CSRF.
CVSS v3.0 Score: 8.8 (HIGH)
CVSS v3.0 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Affected Products: user_domain_whitelist
Related CWEs: CWE-352
Related CAPECs: CAPEC-467, CAPEC-111, CAPEC-462
References: https://wordpress.org/plugins/user-domain-whitelist/#developers, https://wordpress.org/plugins/user-domain-whitelist/#developers
CWE: CWE-352
CVE-2014-2751
SAP Print and Output Management has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: print_and_output_management
Related CWEs: CWE-255
References: http://secunia.com/advisories/57737, http://www.onapsis.com/get.php?resid=adv_onapsis-2014-004, http://www.onapsis.com/research-advisories.php
CWE: CWE-255
CVE-2014-6568
Unspecified vulnerability in Oracle MySQL Server 5.5.40 and earlier, and 5.6.21 and earlier, allows remote authenticated users to affect availability via vectors related to Server : InnoDB : DML.
CVSS v2.0 Score: 3.5 (LOW)
CVSS v2.0 Vector: AV:N/AC:M/Au:S/C:N/I:N/A:P
Affected Products: debian_linux, enterprise_linux_server_tus, enterprise_linux_server_aus, enterprise_linux_workstation, fedora
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-February/149929.html, http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00016.html, http://rhn.redhat.com/errata/RHSA-2015-0116.html
CVE-2014-4845
Cross-site scripting (XSS) vulnerability in the BannerMan plugin 0.2.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the bannerman_background parameter to wp-admin/options-general.php.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: bannerman
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://packetstormsecurity.com/files/127289/WordPress-Bannerman-0.2.4-Cross-Site-Scripting.html, http://www.securityfocus.com/bid/68278, http://packetstormsecurity.com/files/127289/WordPress-Bannerman-0.2.4-Cross-Site-Scripting.html
CWE: CWE-79
CVE-2014-5731
The Word Search (aka com.virtuesoft.wordsearch) application 2.3.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS v2.0 Score: 5.4 (MEDIUM)
CVSS v2.0 Vector: AV:A/AC:M/Au:N/C:P/I:P/A:P
Affected Products: word_search
Related CWEs: CWE-310
References: http://www.kb.cert.org/vuls/id/151121, http://www.kb.cert.org/vuls/id/582497, https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CWE: CWE-310
CVE-2014-8587
SAPCRYPTOLIB before 5.555.38, SAPSECULIB, and CommonCryptoLib before 8.4.30, as used in SAP NetWeaver AS for ABAP and SAP HANA, allows remote attackers to spoof Digital Signature Algorithm (DSA) signatures via unspecified vectors.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: hana, commoncryptolib, sapseculib, sapcryptolib, netweaver
Related CWEs: CWE-310
References: http://blog.onapsis.com/sap-security-note-2067859-potential-exposure-to-digital-signature-spoofing/, http://secunia.com/advisories/57606, http://service.sap.com/sap/support/notes/2067859
CWE: CWE-310
CVE-2014-4955
Cross-site scripting (XSS) vulnerability in the PMA_TRI_getRowForList function in libraries/rte/rte_list.lib.php in phpMyAdmin 4.0.x before 4.0.10.1, 4.1.x before 4.1.14.2, and 4.2.x before 4.2.6 allows remote authenticated users to inject arbitrary web script or HTML via a crafted trigger name that is improperly handled on the database triggers page.
CVSS v2.0 Score: 3.5 (LOW)
CVSS v2.0 Vector: AV:N/AC:M/Au:S/C:N/I:P/A:N
Affected Products: phpmyadmin
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://lists.opensuse.org/opensuse-updates/2014-08/msg00045.html, http://secunia.com/advisories/60397, http://www.phpmyadmin.net/home_page/security/PMASA-2014-5.php
CWE: CWE-79
CVE-2014-7238
The WordPress plugin Contact Form Integrated With Google Maps 1.0-2.4 has Stored XSS
CVSS v3.1 Score: 6.1 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: contact_form_integrated_with_google_maps
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://wpvulndb.com/vulnerabilities/8235, https://wpvulndb.com/vulnerabilities/8235
CWE: CWE-79
CVE-2014-8105
389 Directory Server before 1.3.2.27 and 1.3.3.x before 1.3.3.9 does not properly restrict access to the "cn=changelog" LDAP sub-tree, which allows remote attackers to obtain sensitive information from the changelog via unspecified vectors.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: fedora, 389_directory_server
Related CWEs: CWE-200
Related CAPECs: CAPEC-497, CAPEC-285, CAPEC-59
MITRE ATT&CK Techniques: T1036.005, T1574.007, T1217
MITRE ATT&CK Tactics: T1134, T1036, T1550
References: http://directory.fedoraproject.org/docs/389ds/releases/release-1-3-2-27.html, http://directory.fedoraproject.org/docs/389ds/releases/release-1-3-3-9.html, http://lists.fedoraproject.org/pipermail/package-announce/2015-March/153991.html
CWE: CWE-200
MITRE ATT&CK techniques: T1036.005, T1574.007, T1217, T1590, T1135, T1069, T1057, T1124, T1595, T1134.001, T1087, T1033, T1574.006, T1111, T1120, T1592, T1016, T1046, T1082, T1049, T1083, T1550.004, T1615, T1007, T1562.003, T1018
MITRE ATT&CK tactics: T1134, T1036, T1550, T1562, T1574
CVE-2014-5196
Cross-site request forgery (CSRF) vulnerability in improved-user-search-in-backend.php in the backend in the Improved user search in backend plugin before 1.2.5 for WordPress allows remote attackers to hijack the authentication of administrators for requests that insert XSS sequences via the iusib_meta_fields parameter.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: improved_user_search_in_backend
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://secunia.com/advisories/60590, http://wordpress.org/plugins/improved-user-search-in-backend/changelog, https://security.dxw.com/advisories/csrf-and-xss-in-improved-user-search-allow-execution-of-arbitrary-javascript-in-wordpress-admin-area/
CWE: CWE-79
CVE-2014-7375
The Childcare (aka com.app_macchildcare.layout) application 1.399 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS v2.0 Score: 5.4 (MEDIUM)
CVSS v2.0 Vector: AV:A/AC:M/Au:N/C:P/I:P/A:P
Affected Products: childcare
Related CWEs: CWE-310
References: http://www.kb.cert.org/vuls/id/281889, http://www.kb.cert.org/vuls/id/582497, https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CWE: CWE-310
CVE-2014-4611
Integer overflow in the LZ4 algorithm implementation, as used in Yann Collet LZ4 before r118 and in the lz4_uncompress function in lib/lz4/lz4_decompress.c in the Linux kernel before 3.15.2, on 32-bit platforms might allow context-dependent attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted Literal Run that would be improperly handled by programs not complying with an API limitation, a different vulnerability than CVE-2014-4715.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: linux_kernel
Related CWEs: CWE-20
Related CAPECs: CAPEC-31, CAPEC-53, CAPEC-261
MITRE ATT&CK Techniques: T1574.006, T1553.002, T1574.007
MITRE ATT&CK Tactics: T1562, T1574, T1553
References: http://blog.securitymouse.com/2014/06/raising-lazarus-20-year-old-bug-that.html, http://fastcompression.blogspot.fr/2014/06/debunking-lz4-20-years-old-bug-myth.html, http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=206204a1162b995e2185275167b22468c00d6b36
CWE: CWE-20
MITRE ATT&CK techniques: T1574.006, T1553.002, T1574.007, T1539, T1036.001, T1562.003, T1027
MITRE ATT&CK tactics: T1562, T1574, T1553, T1036
CVE-2014-5825
The Guess The Movie (aka com.june.guessthemovie) application 2.982 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS v2.0 Score: 5.4 (MEDIUM)
CVSS v2.0 Vector: AV:A/AC:M/Au:N/C:P/I:P/A:P
Affected Products: guess_the_movie
Related CWEs: CWE-310
References: http://www.kb.cert.org/vuls/id/257953, http://www.kb.cert.org/vuls/id/582497, https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CWE: CWE-310
CVE-2014-4898
The Harivijay (aka com.upasanhar.marathi.harivijay) application 4.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS v2.0 Score: 5.4 (MEDIUM)
CVSS v2.0 Vector: AV:A/AC:M/Au:N/C:P/I:P/A:P
Affected Products: harivijay
Related CWEs: CWE-310
References: http://www.kb.cert.org/vuls/id/439409, http://www.kb.cert.org/vuls/id/582497, https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CWE: CWE-310
CVE-2014-2926
kapfa.sys in Kaseya Virtual System Administrator (VSA) 6.5 before 6.5.0.17 and 7.0 before 7.0.0.16 allows local users to cause a denial of service (NULL pointer dereference and application crash) via unspecified vectors.
CVSS v2.0 Score: 1.7 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:S/C:N/I:N/A:P
Affected Products: virtual_system_administrator
References: http://www.kb.cert.org/vuls/id/204988, http://www.kb.cert.org/vuls/id/204988
CVE-2014-9496
The sd2_parse_rsrc_fork function in sd2.c in libsndfile allows attackers to have unspecified impact via vectors related to a (1) map offset or (2) rsrc marker, which triggers an out-of-bounds read.
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:N/I:N/A:P
Affected Products: debian_linux, opensuse, libsndfile, solaris, ubuntu_linux
References: http://advisories.mageia.org/MGASA-2015-0015.html, http://lists.opensuse.org/opensuse-updates/2015-01/msg00016.html, http://secunia.com/advisories/62320
CVE-2014-5438
Cross-site scripting (XSS) vulnerability in ARRIS Touchstone TG862G/CT Telephony Gateway with firmware 7.6.59S.CT and earlier allows remote authenticated users to inject arbitrary web script or HTML via the computer_name parameter to connected_devices_computers_edit.php.
CVSS v2.0 Score: 3.5 (LOW)
CVSS v2.0 Vector: AV:N/AC:M/Au:S/C:N/I:P/A:N
Affected Products: touchstone_tg862g//ct_firmware, touchstone_tg862g//ct
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://seclists.org/fulldisclosure/2014/Dec/58, http://seclists.org/fulldisclosure/2014/Dec/58
CWE: CWE-79
CVE-2014-1749
Multiple unspecified vulnerabilities in Google Chrome before 35.0.1916.114 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: chrome
References: http://googlechromereleases.blogspot.com/2014/05/stable-channel-update_20.html, http://lists.opensuse.org/opensuse-updates/2014-06/msg00023.html, http://secunia.com/advisories/58920
CVE-2014-6232
Unspecified vulnerability in the LDAP (eu_ldap) extension before 2.8.18 for TYPO3 allows remote authenticated users to obtain sensitive information via unknown vectors.
CVSS v2.0 Score: 4.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:S/C:P/I:N/A:N
Affected Products: ldap
References: http://secunia.com/advisories/60886, http://typo3.org/extensions/repository/view/eu_ldap, http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2014-010
CVE-2014-1371
Array index error in Dock in Apple OS X before 10.9.4 allows attackers to execute arbitrary code or cause a denial of service (incorrect function-pointer dereference and application crash) by leveraging access to a sandboxed application for sending a message.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: mac_os_x_server, mac_os_x
Related CWEs: CWE-119
Related CAPECs: CAPEC-14, CAPEC-45, CAPEC-9
References: http://archives.neohapsis.com/archives/bugtraq/2014-06/0172.html, http://secunia.com/advisories/59475, http://support.apple.com/kb/HT6296
CWE: CWE-119
CVE-2014-9104
Multiple cross-site request forgery (CSRF) vulnerabilities in the XML-RPC API in the Desktop Client in OpenVPN Access Server 1.5.6 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) disconnecting established VPN sessions, (2) connect to arbitrary VPN servers, or (3) create VPN profiles and execute arbitrary commands via crafted API requests.
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Affected Products: openvpn_access_server
Related CWEs: CWE-352
Related CAPECs: CAPEC-467, CAPEC-111, CAPEC-462
References: http://openvpn.net/index.php/access-server/security-advisories.html, http://seclists.org/fulldisclosure/2014/Jul/76, http://www.securityfocus.com/archive/1/532795/100/0/threaded
CWE: CWE-352
CVE-2014-7659
The ExpeditersOnline.com Forum (aka com.quoord.tapatalkeo.activity) application 3.7.13 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS v2.0 Score: 5.4 (MEDIUM)
CVSS v2.0 Vector: AV:A/AC:M/Au:N/C:P/I:P/A:P
Affected Products: expeditersonline.com_forum
Related CWEs: CWE-310
References: http://www.kb.cert.org/vuls/id/327473, http://www.kb.cert.org/vuls/id/582497, https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CWE: CWE-310
CVE-2014-1745
Use-after-free vulnerability in the SVG implementation in Blink, as used in Google Chrome before 35.0.1916.114, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger removal of an SVGFontFaceElement object, related to core/svg/SVGFontFaceElement.cpp.
CVSS v3.1 Score: 7.1 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: chrome
Related CWEs: CWE-399
References: http://googlechromereleases.blogspot.com/2014/05/stable-channel-update_20.html, http://lists.opensuse.org/opensuse-updates/2014-06/msg00023.html, http://secunia.com/advisories/58920
CWE: CWE-399
CVE-2014-1908
The error-handling feature in (1) bp.php, (2) videowhisper_streaming.php, and (3) ls/rtmp.inc.php in the VideoWhisper Live Streaming Integration plugin before 4.29.5 for WordPress allows remote attackers to obtain sensitive information via a direct request, which reveals the full path in an error message.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: videowhisper_live_streaming_integration
Related CWEs: CWE-200
Related CAPECs: CAPEC-497, CAPEC-285, CAPEC-59
MITRE ATT&CK Techniques: T1036.005, T1574.007, T1217
MITRE ATT&CK Tactics: T1134, T1036, T1550
References: https://www.htbridge.com/advisory/HTB23199, https://www.htbridge.com/advisory/HTB23199
CWE: CWE-200
MITRE ATT&CK techniques: T1036.005, T1574.007, T1217, T1590, T1135, T1069, T1057, T1124, T1595, T1134.001, T1087, T1033, T1574.006, T1111, T1120, T1592, T1016, T1046, T1082, T1049, T1083, T1550.004, T1615, T1007, T1562.003, T1018
MITRE ATT&CK tactics: T1134, T1036, T1550, T1562, T1574
CVE-2014-7765
The Hundred Thousands Kid Book (aka it.tinytap.attsa.thousands) application 1.6.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS v2.0 Score: 5.4 (MEDIUM)
CVSS v2.0 Vector: AV:A/AC:M/Au:N/C:P/I:P/A:P
Affected Products: hundred_thousands_kid_book
Related CWEs: CWE-310
References: http://www.kb.cert.org/vuls/id/501449, http://www.kb.cert.org/vuls/id/582497, https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CWE: CWE-310
CVE-2014-9204
Stack-based buffer overflow in OPCTest.exe in Rockwell Automation RSLinx Classic before 3.73.00 allows remote attackers to execute arbitrary code via a crafted CSV file.
CVSS v2.0 Score: 6.9 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C
Affected Products: rslinx
Related CWEs: CWE-119
Related CAPECs: CAPEC-14, CAPEC-45, CAPEC-9
References: https://ics-cert.us-cert.gov/advisories/ICSA-15-111-02, https://rockwellautomation.custhelp.com/app/answers/detail/a_id/646324, https://ics-cert.us-cert.gov/advisories/ICSA-15-111-02
CWE: CWE-119
CVE-2014-9059
lib/setup.php in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 does not provide charset information in HTTP headers, which might allow remote attackers to conduct cross-site scripting (XSS) attacks via UTF-7 characters during interaction with AJAX scripts.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: moodle
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-47966, http://openwall.com/lists/oss-security/2014/11/17/11, http://www.securityfocus.com/bid/71133
CWE: CWE-79
CVE-2014-5747
The XFINITY Constant Guard Mobile (aka com.whitesky.mobile.android) application 3.1.140603 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS v2.0 Score: 5.4 (MEDIUM)
CVSS v2.0 Vector: AV:A/AC:M/Au:N/C:P/I:P/A:P
Affected Products: xfinity_constant_guard_mobile
Related CWEs: CWE-310
References: http://www.kb.cert.org/vuls/id/582497, http://www.kb.cert.org/vuls/id/743801, https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CWE: CWE-310
CVE-2014-6639
The TIO MobilePay - Bill Payments (aka com.tionetworks.mobile.android.tioclient) application 1.1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS v2.0 Score: 5.4 (MEDIUM)
CVSS v2.0 Vector: AV:A/AC:M/Au:N/C:P/I:P/A:P
Affected Products: tio_mobilepay_-_bill_payments
Related CWEs: CWE-310
References: http://www.kb.cert.org/vuls/id/417937, http://www.kb.cert.org/vuls/id/582497, https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CWE: CWE-310
CVE-2014-2353
Cross-site scripting (XSS) vulnerability in Cogent DataHub before 7.3.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS v2.0 Score: 7.1 (HIGH)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:C/I:N/A:N
Affected Products: cogent_datahub
Related CWEs: CWE-80, CWE-79
Related CAPECs: CAPEC-86, CAPEC-209, CAPEC-591
References: http://cogentdatahub.com/Download_Software.html, https://www.cisa.gov/news-events/ics-advisories/icsa-14-149-02, http://ics-cert.us-cert.gov/advisories/ICSA-14-149-02
CWE: CWE-80, CWE-79