DuyTa/cve-kgrag-db huggingface dataset:
CVE-2014-3620
cURL and libcurl before 7.38.0 allow remote attackers to bypass the Same Origin Policy and set cookies for arbitrary sites by setting a cookie for a top-level domain.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: mac_os_x, curl, libcurl
Related CWEs: CWE-310
References: http://curl.haxx.se/docs/adv_20140910B.html, http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10743, http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html
CWE: CWE-310
CVE-2014-5410
The DNP3 feature on Rockwell Automation Allen-Bradley MicroLogix 1400 1766-Lxxxxx A FRN controllers 7 and earlier and 1400 1766-Lxxxxx B FRN controllers before 15.001 allows remote attackers to cause a denial of service (process disruption) via malformed packets over (1) an Ethernet network or (2) a serial line.
CVSS v2.0 Score: 7.1 (HIGH)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:C
Affected Products: ab_micrologix_controller
Related CWEs: CWE-399, CWE-20
Related CAPECs: CAPEC-31, CAPEC-53, CAPEC-261
MITRE ATT&CK Techniques: T1574.006, T1553.002, T1574.007
MITRE ATT&CK Tactics: T1562, T1574, T1553
References: https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2014/icsa-14-254-02.json, https://rockwellautomation.custhelp.com/app/answers/detail/a_id/620295, https://www.cisa.gov/news-events/ics-advisories/icsa-14-254-02
CWE: CWE-399, CWE-20
MITRE ATT&CK techniques: T1574.006, T1553.002, T1574.007, T1539, T1036.001, T1562.003, T1027
MITRE ATT&CK tactics: T1562, T1574, T1553, T1036
CVE-2014-1290
WebKit, as used in Apple iOS before 7.1 and Apple TV before 6.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2014-1289, CVE-2014-1291, CVE-2014-1292, CVE-2014-1293, and CVE-2014-1294.
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Affected Products: tvos, iphone_os
Related CWEs: CWE-119
Related CAPECs: CAPEC-14, CAPEC-45, CAPEC-9
References: http://archives.neohapsis.com/archives/bugtraq/2014-04/0009.html, http://support.apple.com/kb/HT6162, http://support.apple.com/kb/HT6163
CWE: CWE-119
CVE-2014-0525
The API in Adobe Reader and Acrobat 10.x before 10.1.10 and 11.x before 11.0.07 on Windows and OS X does not prevent access to unmapped memory, which allows attackers to execute arbitrary code via unspecified API calls.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: mac_os_x, windows, acrobat, acrobat_reader
Related CWEs: CWE-264
References: http://helpx.adobe.com/security/products/reader/apsb14-15.html, http://helpx.adobe.com/security/products/reader/apsb14-15.html
CWE: CWE-264
CVE-2014-8275
OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k does not enforce certain constraints on certificate data, which allows remote attackers to defeat a fingerprint-based certificate-blacklist protection mechanism by including crafted data within a certificate's unsigned portion, related to crypto/asn1/a_verify.c, crypto/dsa/dsa_asn1.c, crypto/ecdsa/ecs_vrf.c, and crypto/x509/x_all.c.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: openssl
Related CWEs: CWE-310
References: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10679, http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html, http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148363.html
CWE: CWE-310
CVE-2014-0283
Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
CVSS v2.0 Score: 9.3 (HIGH)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
Affected Products: internet_explorer
Related CWEs: CWE-119
Related CAPECs: CAPEC-14, CAPEC-45, CAPEC-9
References: http://osvdb.org/103181, http://secunia.com/advisories/56796, http://www.securityfocus.com/bid/65382
CWE: CWE-119
CVE-2014-6589
Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox before 4.3.20 allows local users to affect integrity and availability via vectors related to VMSVGA virtual graphics device, a different vulnerability than CVE-2014-6588, CVE-2014-6590, CVE-2014-6595, and CVE-2015-0427.
CVSS v2.0 Score: 3.2 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:S/C:N/I:P/A:P
Affected Products: vm_virtualbox, opensuse
References: http://lists.opensuse.org/opensuse-updates/2015-02/msg00030.html, http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html, https://security.gentoo.org/glsa/201612-27
CVE-2014-5595
The actionpuzzlefamily for Kakao (aka com.com2us.actionpuzzlefamily.kakao.freefull.google.global.android.common) application 1.4.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS v2.0 Score: 5.4 (MEDIUM)
CVSS v2.0 Vector: AV:A/AC:M/Au:N/C:P/I:P/A:P
Affected Products: actionpuzzlefamily_for_kakao
Related CWEs: CWE-310
References: http://www.kb.cert.org/vuls/id/360121, http://www.kb.cert.org/vuls/id/582497, https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CWE: CWE-310
CVE-2014-0027
The play_wave_from_socket function in audio/auserver.c in Flite 1.4 allows local users to modify arbitrary files via a symlink attack on /tmp/awb.wav.  NOTE: some of these details are obtained from third party information.
CVSS v2.0 Score: 3.3 (LOW)
CVSS v2.0 Vector: AV:L/AC:M/Au:N/C:P/I:P/A:N
Affected Products: flite
Related CWEs: CWE-59
Related CAPECs: CAPEC-132, CAPEC-76, CAPEC-17
MITRE ATT&CK Techniques: T1547.009, T1027.006, T1564.009
MITRE ATT&CK Tactics: T1574, T1547, T1564
References: http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127748.html, http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127776.html, http://seclists.org/oss-sec/2014/q1/59
CWE: CWE-59
MITRE ATT&CK techniques: T1547.009, T1027.006, T1564.009, T1574.010, T1574.005, T1027.009
MITRE ATT&CK tactics: T1574, T1547, T1564, T1027
CVE-2014-1478
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 27.0 and SeaMonkey before 2.24 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to the MPostWriteBarrier class in js/src/jit/MIR.h and stack alignment in js/src/jit/AsmJS.cpp in OdinMonkey, and unknown other vectors.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: opensuse, firefox, solaris, seamonkey, ubuntu_linux
Related CWEs: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00004.html, http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00005.html, http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.html
CWE: CWE-787
CVE-2014-9619
Unrestricted file upload vulnerability in webadmin/ajaxfilemanager/ajaxfilemanager.php in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote authenticated users with admin privileges on the Cloud Manager web console to execute arbitrary PHP code by uploading a file with a double extension, then accessing it via a direct request to the file in webadmin/deny/images/, as demonstrated by secuid0.php.gif.
CVSS v3.0 Score: 7.2 (HIGH)
CVSS v3.0 Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 6.5 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P
Affected Products: netsweeper
Related CWEs: CWE-434
Related CAPECs: CAPEC-1
MITRE ATT&CK Techniques: T1574.010
MITRE ATT&CK Tactics: T1574
References: http://packetstormsecurity.com/files/133034/Netsweeper-Bypass-XSS-Redirection-SQL-Injection-Execution.html, https://www.exploit-db.com/exploits/37932/, http://packetstormsecurity.com/files/133034/Netsweeper-Bypass-XSS-Redirection-SQL-Injection-Execution.html
CWE: CWE-434
MITRE ATT&CK techniques: T1574.010
MITRE ATT&CK tactics: T1574
CVE-2014-8168
Red Hat Satellite 6 allows local users to access mongod and delete pulp_database.
CVSS v3.0 Score: 6.1 (MEDIUM)
CVSS v3.0 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Affected Products: satellite
Related CWEs: CWE-284
Related CAPECs: CAPEC-563, CAPEC-536, CAPEC-478
MITRE ATT&CK Techniques: T1014, T1562.001, T1543.003
MITRE ATT&CK Tactics: T1556, T1546, T1547
References: https://bugzilla.redhat.com/show_bug.cgi?id=1192249, https://bugzilla.redhat.com/show_bug.cgi?id=1192249
CWE: CWE-284
MITRE ATT&CK techniques: T1014, T1562.001, T1543.003, T1546.008, T1037, T1562.007, T1027.009, T1543.001, T1547, T1543.004, T1562.002, T1553.004, T1546.016, T1080, T1574.011, T1556.006, T1543, T1546.004, T1547.006, T1546.001, T1562.004, T1542.003, T1505.005, T1562.008, T1562.009
MITRE ATT&CK tactics: T1556, T1546, T1547, T1542, T1505, T1553, T1562, T1574, T1543, T1027
CVE-2014-6652
The Wizaz Forum (aka com.tapatalk.wizazplforum) application 3.6.4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS v2.0 Score: 5.4 (MEDIUM)
CVSS v2.0 Vector: AV:A/AC:M/Au:N/C:P/I:P/A:P
Affected Products: wizaz_forum
Related CWEs: CWE-310
References: http://www.kb.cert.org/vuls/id/215185, http://www.kb.cert.org/vuls/id/582497, https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CWE: CWE-310
CVE-2014-4746
IBM WebSphere Portal 8.0.0 before 8.0.0.1 CF13 and 8.5.0 through CF01 provides different error codes for firewall-traversal requests depending on whether the intranet host exists, which allows remote attackers to map the intranet network via a series of requests.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: websphere_portal
Related CWEs: CWE-200
Related CAPECs: CAPEC-497, CAPEC-285, CAPEC-59
MITRE ATT&CK Techniques: T1036.005, T1574.007, T1217
MITRE ATT&CK Tactics: T1134, T1036, T1550
References: http://secunia.com/advisories/60612, http://www-01.ibm.com/support/docview.wss?uid=swg1PI21858, http://www-01.ibm.com/support/docview.wss?uid=swg21680230
CWE: CWE-200
MITRE ATT&CK techniques: T1036.005, T1574.007, T1217, T1590, T1135, T1069, T1057, T1124, T1595, T1134.001, T1087, T1033, T1574.006, T1111, T1120, T1592, T1016, T1046, T1082, T1049, T1083, T1550.004, T1615, T1007, T1562.003, T1018
MITRE ATT&CK tactics: T1134, T1036, T1550, T1562, T1574
CVE-2014-3669
Integer overflow in the object_custom function in ext/standard/var_unserializer.c in PHP before 5.4.34, 5.5.x before 5.5.18, and 5.6.x before 5.6.2 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an argument to the unserialize function that triggers calculation of a large length value.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: php
Related CWEs: CWE-189
References: http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=56754a7f9eba0e4f559b6ca081d9f2a447b3f159, http://linux.oracle.com/errata/ELSA-2014-1767.html, http://linux.oracle.com/errata/ELSA-2014-1768.html
CWE: CWE-189
CVE-2014-9748
The uv_rwlock_t fallback implementation for Windows XP and Server 2003 in libuv before 1.7.4 does not properly prevent threads from releasing the locks of other threads, which allows attackers to cause a denial of service (deadlock) or possibly have unspecified other impact by leveraging a race condition.
CVSS v3.1 Score: 8.1 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Affected Products: node.js, windows_server_2003, windows_xp, libuv
Related CWEs: CWE-362
Related CAPECs: CAPEC-29, CAPEC-26
References: https://github.com/libuv/libuv/issues/515, https://github.com/libuv/libuv/pull/516, https://github.com/nodejs/node/pull/2723
CWE: CWE-362
CVE-2014-10006
Multiple cross-site request forgery (CSRF) vulnerabilities in Maian Uploader 4.0 allow remote attackers to hijack the authentication of unspecified users for requests that conduct cross-site scripting (XSS) attacks via the width parameter to (1) uploader/admin/js/load_flv.js.php or (2) uploader/js/load_flv.js.php.
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Affected Products: maian_uploader
Related CWEs: CWE-352
Related CAPECs: CAPEC-467, CAPEC-111, CAPEC-462
References: http://packetstormsecurity.com/files/124918, http://packetstormsecurity.com/files/124918
CWE: CWE-352
CVE-2014-0880
IBM SAN Volume Controller; Storwize V3500, V3700, V5000, and V7000; and Flex System V7000 with software 6.3 and 6.4 before 6.4.1.8, and 7.1 and 7.2 before 7.2.0.3, allow remote attackers to obtain CLI access, and consequently cause a denial of service, via unspecified traffic to the administrative IP address.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: storwize_v3700_software, storwize_v7000_software, storwize_v3500_software, flex_system_v7000_software, storwize_v3700
References: http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004570, https://exchange.xforce.ibmcloud.com/vulnerabilities/91145, http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004570
CVE-2014-6643
The FIAT Forum (aka com.tapatalk.fiatforumcom) application 3.8.41 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS v2.0 Score: 5.4 (MEDIUM)
CVSS v2.0 Vector: AV:A/AC:M/Au:N/C:P/I:P/A:P
Affected Products: fiat_forum
Related CWEs: CWE-310
References: http://www.kb.cert.org/vuls/id/331169, http://www.kb.cert.org/vuls/id/582497, https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CWE: CWE-310
CVE-2014-6417
net/ceph/auth_x.c in Ceph, as used in the Linux kernel before 3.16.3, does not properly consider the possibility of kmalloc failure, which allows remote attackers to cause a denial of service (system crash) or possibly have unspecified other impact via a long unencrypted auth ticket.
CVSS v2.0 Score: 7.8 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C
Affected Products: linux_kernel
Related CWEs: CWE-399
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=c27a3e4d667fdcad3db7b104f75659478e0c68d8, http://tracker.ceph.com/issues/8979, http://tracker.ceph.com/issues/9560
CWE: CWE-399
CVE-2014-2212
The remember me feature in portal/scr_authentif.php in POSH (aka Posh portal or Portaneo) 3.0, 3.2.1, 3.3.0, and earlier stores the username and MD5 digest of the password in cleartext in a cookie, which allows attackers to obtain sensitive information by reading this cookie.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: posh
Related CWEs: CWE-255
References: http://seclists.org/oss-sec/2014/q1/444, http://www.sysdream.com/CVE-2014-2211_2214, http://www.sysdream.com/system/files/POSH-3.2.1-advisory_0.pdf
CWE: CWE-255
CVE-2014-2731
Multiple unspecified vulnerabilities in the integrated web server in Siemens SINEMA Server before 12 SP1 allow remote attackers to execute arbitrary code via HTTP traffic to port (1) 4999 or (2) 80.
CVSS v2.0 Score: 9.3 (HIGH)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
Affected Products: sinema_server
References: http://ics-cert.us-cert.gov/advisories/ICSA-14-107-01, http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-364879.pdf, http://ics-cert.us-cert.gov/advisories/ICSA-14-107-01
CVE-2014-5601
The 1800CONTACTS App (aka com.contacts1800.ecomapp) application 2.7.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS v2.0 Score: 5.4 (MEDIUM)
CVSS v2.0 Vector: AV:A/AC:M/Au:N/C:P/I:P/A:P
Affected Products: 1800contacts_app
Related CWEs: CWE-310
References: http://www.kb.cert.org/vuls/id/503385, http://www.kb.cert.org/vuls/id/582497, https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CWE: CWE-310
CVE-2014-6255
Open redirect vulnerability in the login form in Zenoss Core before 4.2.5 SP161 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the came_from parameter, aka ZEN-11998.
CVSS v2.0 Score: 6.4 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N
Affected Products: zenoss_core
References: http://www.kb.cert.org/vuls/id/449452, https://docs.google.com/spreadsheets/d/1dHAc4PxUbs-4Dxzm1wSCE0sMz5UCMY6SW3PlMHSyuuQ/edit?usp=sharing, http://www.kb.cert.org/vuls/id/449452
CVE-2014-4420
The network-statistics interface in the kernel in Apple iOS before 8 and Apple TV before 7 does not properly initialize memory, which allows attackers to obtain sensitive memory-content and memory-layout information via a crafted application, a different vulnerability than CVE-2014-4371, CVE-2014-4419, and CVE-2014-4421.
CVSS v2.0 Score: 1.9 (LOW)
CVSS v2.0 Vector: AV:L/AC:M/Au:N/C:P/I:N/A:N
Affected Products: tvos, iphone_os, mac_os_x
References: http://archives.neohapsis.com/archives/bugtraq/2014-09/0106.html, http://archives.neohapsis.com/archives/bugtraq/2014-09/0107.html, http://archives.neohapsis.com/archives/bugtraq/2014-10/0101.html
CVE-2014-7849
The Role Based Access Control (RBAC) implementation in JBoss Enterprise Application Platform (EAP) 6.2.0 through 6.3.2 does not properly verify authorization conditions, which allows remote authenticated users to add, modify, and undefine otherwise restricted attributes by leveraging the Maintainer role.
CVSS v2.0 Score: 4.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:S/C:N/I:P/A:N
Affected Products: jboss_enterprise_application_platform
Related CWEs: CWE-264
References: http://rhn.redhat.com/errata/RHSA-2015-0215.html, http://rhn.redhat.com/errata/RHSA-2015-0216.html, http://rhn.redhat.com/errata/RHSA-2015-0217.html
CWE: CWE-264
CVE-2014-7868
Multiple SQL injection vulnerabilities in ZOHO ManageEngine OpManager 11.3 and 11.4, IT360 10.3 and 10.4, and Social IT Plus 11.0 allow remote attackers or remote authenticated users to execute arbitrary SQL commands via the (1) OPM_BVNAME parameter in a Delete operation to the APMBVHandler servlet or (2) query parameter in a compare operation to the DataComparisonServlet servlet.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: manageengine_social_it_plus, manageengine_opmanager, manageengine_it360
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: http://packetstormsecurity.com/files/129037/ManageEngine-OpManager-Social-IT-Plus-IT360-File-Upload-SQL-Injection.html, http://seclists.org/fulldisclosure/2014/Nov/21, http://www.securityfocus.com/archive/1/533946/100/0/threaded
CWE: CWE-89
CVE-2014-6467
Unspecified vulnerability in the Java VM component in Oracle Database Server 11.1.0.7, 11.2.0.3, 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2014-6453, CVE-2014-6545, and CVE-2014-6560.
CVSS v2.0 Score: 9.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:S/C:C/I:C/A:C
Affected Products: database_server
References: http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html, http://www.securityfocus.com/bid/70514, http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
CVE-2014-6664
The Latin Angels Music HD (aka com.applizards.lafreetj) application 2.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS v2.0 Score: 5.4 (MEDIUM)
CVSS v2.0 Vector: AV:A/AC:M/Au:N/C:P/I:P/A:P
Affected Products: latin_angels_music_hd
Related CWEs: CWE-310
References: http://www.kb.cert.org/vuls/id/356161, http://www.kb.cert.org/vuls/id/582497, https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CWE: CWE-310
CVE-2014-6575
Unspecified vulnerability in Oracle Sun Solaris 10 and 11 allows remote attackers to affect availability via unknown vectors related to Network, a different vulnerability than CVE-2004-0230.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: sunos
References: http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html, http://www.securitytracker.com/id/1031583, http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
CVE-2014-4424
SQL injection vulnerability in Wiki Server in CoreCollaboration in Apple OS X Server before 2.2.3 and 3.x before 3.2.1 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: os_x_server
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: http://archives.neohapsis.com/archives/bugtraq/2014-10/0103.html, http://secunia.com/advisories/61305, http://secunia.com/advisories/61307
CWE: CWE-89
CVE-2014-1259
Buffer overflow in File Bookmark in Apple OS X before 10.9.2 allows attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted filename.
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Affected Products: mac_os_x_server, mac_os_x
Related CWEs: CWE-119
Related CAPECs: CAPEC-14, CAPEC-45, CAPEC-9
References: http://support.apple.com/kb/HT6150, http://support.apple.com/kb/HT6150
CWE: CWE-119
CVE-2014-0947
Unspecified vulnerability in the server in IBM Rational Software Architect Design Manager 4.0.6 allows remote authenticated users to execute arbitrary code via a crafted update site.
CVSS v2.0 Score: 6.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:S/C:P/I:P/A:P
Affected Products: rational_software_architect_design_manager
References: http://www-01.ibm.com/support/docview.wss?uid=swg21678323, https://exchange.xforce.ibmcloud.com/vulnerabilities/92620, http://www-01.ibm.com/support/docview.wss?uid=swg21678323
CVE-2014-6498
Unspecified vulnerability in the Oracle Transportation Management component in Oracle Supply Chain Products Suite 6.1, 6.2, 6.3, 6.3.1, 6.3.2, 6.3.3, 6.3.4, and 6.3.5 allows remote attackers to affect confidentiality via unknown vectors related to Security.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: supply_chain_products_suite
References: http://secunia.com/advisories/61721, http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html, http://www.securityfocus.com/bid/70542
CVE-2014-2013
Stack-based buffer overflow in the xps_parse_color function in xps/xps-common.c in MuPDF 1.3 and earlier allows remote attackers to execute arbitrary code via a large number of entries in the ContextColor value of the Fill attribute in a Path element.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: mupdf
Related CWEs: CWE-119
Related CAPECs: CAPEC-14, CAPEC-45, CAPEC-9
References: http://bugs.ghostscript.com/show_bug.cgi?id=694957, http://git.ghostscript.com/?p=mupdf.git%3Ba=commitdiff%3Bh=60dabde18d7fe12b19da8b509bdfee9cc886aafc, http://lists.opensuse.org/opensuse-updates/2014-02/msg00088.html
CWE: CWE-119
CVE-2014-6233
SQL injection vulnerability in the Flat Manager (flatmgr) extension before 2.7.10 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: flat_manager
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: http://secunia.com/advisories/60876, http://typo3.org/extensions/repository/view/flatmgr, http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2014-010
CWE: CWE-89
CVE-2014-8388
Stack-based buffer overflow in Advantech WebAccess, formerly BroadWin WebAccess, before 8.0 allows remote attackers to execute arbitrary code via a crafted ip_address parameter in an HTML document.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: webaccess
Related CWEs: CWE-119
Related CAPECs: CAPEC-14, CAPEC-45, CAPEC-9
References: https://ics-cert.us-cert.gov/advisories/ICSA-14-324-01, https://ics-cert.us-cert.gov/advisories/ICSA-14-324-01
CWE: CWE-119
CVE-2014-7811
Multiple cross-site scripting (XSS) vulnerabilities in Spacewalk and Red Hat Network (RHN) Satellite before 5.7.0 allow remote authenticated users to inject arbitrary web script or HTML via crafted XML data to the REST API.
CVSS v2.0 Score: 3.5 (LOW)
CVSS v2.0 Vector: AV:N/AC:M/Au:S/C:N/I:P/A:N
Affected Products: manager, network_satellite, spacewalk
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00020.html, http://rhn.redhat.com/errata/RHSA-2015-0033.html, http://secunia.com/advisories/62183
CWE: CWE-79
CVE-2014-5848
The Dubstep Hero (aka com.electricpunch.dubstephero) application 1.9 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS v2.0 Score: 5.4 (MEDIUM)
CVSS v2.0 Vector: AV:A/AC:M/Au:N/C:P/I:P/A:P
Affected Products: dubstep_hero
Related CWEs: CWE-310
References: http://www.kb.cert.org/vuls/id/480065, http://www.kb.cert.org/vuls/id/582497, https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CWE: CWE-310
CVE-2014-0765
To exploit this vulnerability, the attacker sends data from the GotoCmd 
argument to control. If the value of the argument is overly long, the 
static stack buffer can be overflowed. This will allow the attacker to 
execute arbitrary code remotely.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: advantech_webaccess
Related CWEs: CWE-121, CWE-119
Related CAPECs: CAPEC-14, CAPEC-45, CAPEC-9
References: http://webaccess.advantech.com/, http://www.securityfocus.com/bid/66740, https://www.cisa.gov/news-events/ics-advisories/icsa-14-079-03
CWE: CWE-121, CWE-119
CVE-2014-8012
Cross-site scripting (XSS) vulnerability in the WebVPN Portal Login page in Cisco Adaptive Security Appliance (ASA) Software allows remote attackers to inject arbitrary web script or HTML via crafted attributes in a cookie, aka Bug ID CSCuh24695.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: adaptive_security_appliance_software
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-8012, http://www.securitytracker.com/id/1031395, http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-8012
CWE: CWE-79
CVE-2014-5867
The Capital One Spark Pay (aka com.capitalone.sparkpay) application 0.9.81 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS v2.0 Score: 5.4 (MEDIUM)
CVSS v2.0 Vector: AV:A/AC:M/Au:N/C:P/I:P/A:P
Affected Products: capital_one_spark
Related CWEs: CWE-310
References: http://www.kb.cert.org/vuls/id/520545, http://www.kb.cert.org/vuls/id/582497, https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CWE: CWE-310
CVE-2014-5609
The Stickman Ski Racer (aka com.djinnworks.StickmanSkiRacer.free) application 2.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS v2.0 Score: 5.4 (MEDIUM)
CVSS v2.0 Vector: AV:A/AC:M/Au:N/C:P/I:P/A:P
Affected Products: stickman_ski_racer
Related CWEs: CWE-310
References: http://www.kb.cert.org/vuls/id/582497, http://www.kb.cert.org/vuls/id/587073, https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CWE: CWE-310
CVE-2014-5002
The lynx gem before 1.0.0 for Ruby places the configured password on command lines, which allows local users to obtain sensitive information by listing processes.
CVSS v3.0 Score: 7.8 (HIGH)
CVSS v3.0 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N
Affected Products: lynx
Related CWEs: CWE-255
References: http://www.openwall.com/lists/oss-security/2014/07/07/23, http://www.openwall.com/lists/oss-security/2014/07/17/5, http://www.vapid.dhs.org/advisories/lynx-0.2.0.html
CWE: CWE-255
CVE-2014-0289
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0267 and CVE-2014-0290.
CVSS v2.0 Score: 9.3 (HIGH)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
Affected Products: internet_explorer
Related CWEs: CWE-119
Related CAPECs: CAPEC-14, CAPEC-45, CAPEC-9
References: http://osvdb.org/103187, http://secunia.com/advisories/56796, http://www.securityfocus.com/bid/65389
CWE: CWE-119
CVE-2014-6239
SQL injection vulnerability in the Address visualization with Google Maps (st_address_map) extension before 0.3.6 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: address_visualization_with_google_maps
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: http://typo3.org/extensions/repository/view/st_address_map, http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2014-010, http://www.securityfocus.com/bid/69564
CWE: CWE-89
CVE-2014-9382
Freebox OS Web interface 3.0.2 has CSRF which can allow VPN user account creation
CVSS v3.1 Score: 6.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: freebox_os
Related CWEs: CWE-352
Related CAPECs: CAPEC-467, CAPEC-111, CAPEC-462
References: http://packetstormsecurity.com/files/132121/FreeBox-3.0.2-Cross-Site-Request-Forgery-Cross-Site-Scripting.html, http://seclists.org/fulldisclosure/2015/Jun/1, http://www.securityfocus.com/bid/74936
CWE: CWE-352
CVE-2014-125050
A vulnerability was found in ScottTZhang voter-js and classified as critical. Affected by this issue is some unknown functionality of the file main.js. The manipulation leads to sql injection. The patch is identified as 6317c67a56061aeeaeed3cf9ec665fd9983d8044. It is recommended to apply a patch to fix this issue. VDB-217562 is the identifier assigned to this vulnerability.
CVSS v3.1 Score: 5.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v2.0 Score: 5.2 (MEDIUM)
CVSS v2.0 Vector: AV:A/AC:L/Au:S/C:P/I:P/A:P
Affected Products: voter-js
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: https://github.com/ScottTZhang/voter-js/commit/6317c67a56061aeeaeed3cf9ec665fd9983d8044, https://github.com/ScottTZhang/voter-js/pull/15, https://vuldb.com/?ctiid.217562
CWE: CWE-89
CVE-2014-3570
The BN_sqr implementation in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k does not properly calculate the square of a BIGNUM value, which might make it easier for remote attackers to defeat cryptographic protection mechanisms via unspecified vectors, related to crypto/bn/asm/mips.pl, crypto/bn/asm/x86_64-gcc.c, and crypto/bn/bn_asm.c.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: openssl
Related CWEs: CWE-310
References: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10679, http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html, http://lists.fedoraproject.org/pipermail/package-announce/2015-January/147938.html
CWE: CWE-310
CVE-2014-7620
The Authors On Tour - Live! (aka com.appmakr.app122286) application 4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS v2.0 Score: 5.4 (MEDIUM)
CVSS v2.0 Vector: AV:A/AC:M/Au:N/C:P/I:P/A:P
Affected Products: authors_on_tour_-_live\!
Related CWEs: CWE-310
References: http://www.kb.cert.org/vuls/id/582497, http://www.kb.cert.org/vuls/id/669793, https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CWE: CWE-310
CVE-2014-8074
Buffer overflow in the SetLogFile method in Foxit.FoxitPDFSDKProCtrl.5 in Foxit PDF SDK ActiveX 2.3 through 5.0.1820 before 5.0.2.924 allows remote attackers to execute arbitrary code via a long string, related to global variables.
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Affected Products: foxit_pdf_sdk_activex
Related CWEs: CWE-119
Related CAPECs: CAPEC-14, CAPEC-45, CAPEC-9
References: http://www.foxitsoftware.com/support/security_bulletins.php#FRD-22, http://www.securityfocus.com/bid/70608, http://www.zerodayinitiative.com/advisories/ZDI-14-362/
CWE: CWE-119
CVE-2014-1599
Multiple cross-site scripting (XSS) vulnerabilities in the SFR Box router with firmware NB6-MAIN-R3.3.4 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters to (1) dns, (2) dhcp, (3) nat, (4) route, or (5) lan in network/; or (6) wifi/config.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: sfr_box_router, sfr_box_router_firmware
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://www.securityfocus.com/archive/1/531349/100/0/threaded, http://www.securityfocus.com/bid/65973, http://www.securityfocus.com/archive/1/531349/100/0/threaded
CWE: CWE-79
CVE-2014-6242
Multiple SQL injection vulnerabilities in the All In One WP Security & Firewall plugin before 3.8.3 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the (1) orderby or (2) order parameter in the aiowpsec page to wp-admin/admin.php.  NOTE: this can be leveraged using CSRF to allow remote attackers to execute arbitrary SQL commands.
CVSS v2.0 Score: 6.5 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P
Affected Products: all_in_one_wordpress_security_and_firewall
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: http://packetstormsecurity.com/files/128419/All-In-One-WP-Security-3.8.2-SQL-Injection.html, http://www.exploit-db.com/exploits/34781, http://www.securityfocus.com/archive/1/533519/100/0/threaded
CWE: CWE-89
CVE-2014-5527
The Tapjoy library for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS v2.0 Score: 5.4 (MEDIUM)
CVSS v2.0 Vector: AV:A/AC:M/Au:N/C:P/I:P/A:P
Affected Products: tapjoy_library
Related CWEs: CWE-310
References: http://www.kb.cert.org/vuls/id/123577, http://www.kb.cert.org/vuls/id/582497, https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CWE: CWE-310
CVE-2014-2414
Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JAXB.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: debian_linux, jre, ubuntu_linux, jdk
References: http://marc.info/?l=bugtraq&m=140852886808946&w=2, http://marc.info/?l=bugtraq&m=140852974709252&w=2, http://rhn.redhat.com/errata/RHSA-2014-0675.html
CVE-2014-6028
TorrentFlux 2.4 allows remote authenticated users to obtain other users' cookies via the cid parameter in an editCookies action to profile.php.
CVSS v2.0 Score: 4.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:S/C:N/I:P/A:N
Affected Products: torrentflux
Related CWEs: CWE-20
Related CAPECs: CAPEC-31, CAPEC-53, CAPEC-261
MITRE ATT&CK Techniques: T1574.006, T1553.002, T1574.007
MITRE ATT&CK Tactics: T1562, T1574, T1553
References: http://www.openwall.com/lists/oss-security/2014/08/29/5, http://www.openwall.com/lists/oss-security/2014/09/02/3, http://www.securitytracker.com/id/1030791
CWE: CWE-20
MITRE ATT&CK techniques: T1574.006, T1553.002, T1574.007, T1539, T1036.001, T1562.003, T1027
MITRE ATT&CK tactics: T1562, T1574, T1553, T1036
CVE-2014-6585
Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality via unknown vectors related to 2D, a different vulnerability than CVE-2014-6591.
CVSS v2.0 Score: 2.6 (LOW)
CVSS v2.0 Vector: AV:N/AC:H/Au:N/C:P/I:N/A:N
Affected Products: jre, jdk
References: http://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04583581, http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00001.html, http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00024.html
CVE-2014-6532
Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2014-4288, CVE-2014-6493, and CVE-2014-6503.
CVSS v2.0 Score: 9.3 (HIGH)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
Affected Products: jre, jdk
References: http://lists.opensuse.org/opensuse-security-announce/2014-11/msg00021.html, http://lists.opensuse.org/opensuse-security-announce/2014-12/msg00002.html, http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00026.html
CVE-2014-0960
IBM PureApplication System 1.0 before 1.0.0.4 cfix8 and 1.1 before 1.1.0.4 IF1 allows remote authenticated users to bypass intended access restrictions by establishing an SSH session from a deployed virtual machine.
CVSS v2.0 Score: 6.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:M/Au:S/C:C/I:C/A:C
Affected Products: pureapplication_system
Related CWEs: CWE-264
References: http://secunia.com/advisories/59254, http://www-01.ibm.com/support/docview.wss?uid=swg21675216, https://exchange.xforce.ibmcloud.com/vulnerabilities/92743
CWE: CWE-264
CVE-2014-5640
The CM Backup -Restore,Cloud,Photo (aka com.ijinshan.kbackup) application 1.1.0.135 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS v2.0 Score: 5.4 (MEDIUM)
CVSS v2.0 Vector: AV:A/AC:M/Au:N/C:P/I:P/A:P
Affected Products: cm_backup_restore_cloud_photo
Related CWEs: CWE-310
References: http://www.kb.cert.org/vuls/id/582497, http://www.kb.cert.org/vuls/id/596049, https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CWE: CWE-310
CVE-2014-4195
Cross-site scripting (XSS) vulnerability in zero_view_article.php in ZeroCMS 1.0 allows remote attackers to inject arbitrary web script or HTML via the article_id parameter.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: zerocms
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://packetstormsecurity.com/files/127262/ZeroCMS-1.0-Cross-Site-Scripting.html, http://www.securityfocus.com/bid/68246, http://packetstormsecurity.com/files/127262/ZeroCMS-1.0-Cross-Site-Scripting.html
CWE: CWE-79
CVE-2014-1855
Multiple cross-site scripting (XSS) vulnerabilities in Seo Panel before 3.5.0 allow remote attackers to inject arbitrary web script or HTML via the (1) capcheck parameter to directories.php or (2) keyword parameter to proxy.php.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: seo_panel
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://forum.seopanel.in/viewtopic.php?f=7&t=10978, http://packetstormsecurity.com/files/126706/Seo-Panel-3.4.0-Cross-Site-Scripting.html, http://secunia.com/advisories/58706
CWE: CWE-79
CVE-2014-8293
Cross-site scripting (XSS) vulnerability in Voice Of Web AllMyGuests 0.4.1 allows remote attackers to inject arbitrary web script or HTML via the AMG_signin_topic parameter to index.php.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: voice_of_web_allmyguests
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://packetstormsecurity.com/files/128479/AllMyGuests-0.4.1-XSS-SQL-Injection-Insecure-Cookie-Handling.html, http://packetstormsecurity.com/files/128479/AllMyGuests-0.4.1-XSS-SQL-Injection-Insecure-Cookie-Handling.html
CWE: CWE-79
CVE-2014-2609
The Java Glassfish Admin Console in HP Executive Scorecard 9.40 and 9.41 does not require authentication, which allows remote attackers to execute arbitrary code via a session on TCP port 10001, aka ZDI-CAN-2116.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: executive_scorecard
Related CWEs: CWE-287
Related CAPECs: CAPEC-151, CAPEC-94, CAPEC-593
MITRE ATT&CK Techniques: T1134, T1550.001, T1557
MITRE ATT&CK Tactics: T1550, T1505
References: http://secunia.com/advisories/59363, http://www.securityfocus.com/bid/68093, http://www.securitytracker.com/id/1030439
CWE: CWE-287
MITRE ATT&CK techniques: T1134, T1550.001, T1557, T1185, T1505.003, T1548, T1563, T1040
MITRE ATT&CK tactics: T1550, T1505
CVE-2014-6339
Microsoft Internet Explorer 8 and 9 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Internet Explorer ASLR Bypass Vulnerability."
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: internet_explorer
Related CWEs: CWE-264
References: http://www.securityfocus.com/bid/70948, http://www.securitytracker.com/id/1031185, https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-065
CWE: CWE-264
CVE-2014-5013
DOMPDF before 0.6.2 allows remote code execution, a related issue to CVE-2014-2383.
CVSS v3.1 Score: 8.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Affected Products: dompdf
References: https://github.com/dompdf/dompdf/compare/v0.6.1...v0.6.2, https://github.com/dompdf/dompdf/releases/tag/v0.6.2, https://github.com/dompdf/dompdf/compare/v0.6.1...v0.6.2
CVE-2014-2906
The psub function in fish (aka fish-shell) 1.16.0 before 2.1.1 does not properly create temporary files, which allows local users to execute arbitrary commands via a temporary file with a predictable name.
CVSS v3.1 Score: 7.0 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 4.4 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:M/Au:N/C:P/I:P/A:P
Affected Products: fish
Related CWEs: CWE-362
Related CAPECs: CAPEC-29, CAPEC-26
References: http://www.openwall.com/lists/oss-security/2014/04/28/4, https://github.com/fish-shell/fish-shell/issues/1437, https://github.com/fish-shell/fish-shell/releases/tag/2.1.1
CWE: CWE-362
CVE-2014-9444
Cross-site scripting (XSS) vulnerability in the Frontend Uploader plugin 0.9.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the errors[fu-disallowed-mime-type][0][name] parameter to the default URI.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: frontend_uploader
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://packetstormsecurity.com/files/129749/WordPress-Frontend-Uploader-0.9.2-Cross-Site-Scripting.html, http://seclists.org/fulldisclosure/2014/Dec/122, http://www.securityfocus.com/bid/71808
CWE: CWE-79
CVE-2014-0553
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.244 and 14.x and 15.x before 15.0.0.152 on Windows and OS X and before 11.2.202.406 on Linux, Adobe AIR before 15.0.0.249 on Windows and OS X and before 15.0.0.252 on Android, Adobe AIR SDK before 15.0.0.249, and Adobe AIR SDK & Compiler before 15.0.0.249 allows attackers to execute arbitrary code via unspecified vectors.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: adobe_air, opensuse, flash_player, adobe_air_sdk, linux_kernel
References: http://helpx.adobe.com/security/products/flash-player/apsb14-21.html, http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00006.html, http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00016.html
CVE-2014-7068
The Neumann Student Activities (aka com.appmakr.app153856) application 216607 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS v2.0 Score: 5.4 (MEDIUM)
CVSS v2.0 Vector: AV:A/AC:M/Au:N/C:P/I:P/A:P
Affected Products: neumann_student_activities
Related CWEs: CWE-310
References: http://www.kb.cert.org/vuls/id/234545, http://www.kb.cert.org/vuls/id/582497, https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CWE: CWE-310
CVE-2014-6152
Multiple cross-site scripting (XSS) vulnerabilities in IBM Tivoli Integrated Portal (TIP) 2.2.x allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS v2.0 Score: 3.5 (LOW)
CVSS v2.0 Vector: AV:N/AC:M/Au:S/C:N/I:P/A:N
Affected Products: tivoli_integrated_portal
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://secunia.com/advisories/61899, http://www-01.ibm.com/support/docview.wss?uid=swg1PI27417, http://www-01.ibm.com/support/docview.wss?uid=swg21687541
CWE: CWE-79
CVE-2014-8017
The periodic-backup feature in Cisco Identity Services Engine (ISE) allows remote attackers to discover backup-encryption passwords via a crafted request that triggers inclusion of a password in a reply, aka Bug ID CSCur41673.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: identity_services_engine_software
Related CWEs: CWE-200
Related CAPECs: CAPEC-497, CAPEC-285, CAPEC-59
MITRE ATT&CK Techniques: T1036.005, T1574.007, T1217
MITRE ATT&CK Tactics: T1134, T1036, T1550
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-8017, http://www.securityfocus.com/bid/71767, http://www.securitytracker.com/id/1031425
CWE: CWE-200
MITRE ATT&CK techniques: T1036.005, T1574.007, T1217, T1590, T1135, T1069, T1057, T1124, T1595, T1134.001, T1087, T1033, T1574.006, T1111, T1120, T1592, T1016, T1046, T1082, T1049, T1083, T1550.004, T1615, T1007, T1562.003, T1018
MITRE ATT&CK tactics: T1134, T1036, T1550, T1562, T1574
CVE-2014-3184
The report_fixup functions in the HID subsystem in the Linux kernel before 3.16.2 might allow physically proximate attackers to cause a denial of service (out-of-bounds write) via a crafted device that provides a small report descriptor, related to (1) drivers/hid/hid-cherry.c, (2) drivers/hid/hid-kye.c, (3) drivers/hid/hid-lg.c, (4) drivers/hid/hid-monterey.c, (5) drivers/hid/hid-petalynx.c, and (6) drivers/hid/hid-sunplus.c.
CVSS v2.0 Score: 4.7 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:M/Au:N/C:N/I:N/A:C
Affected Products: linux_kernel
Related CWEs: CWE-119
Related CAPECs: CAPEC-14, CAPEC-45, CAPEC-9
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=4ab25786c87eb20857bbb715c3ae34ec8fd6a214, http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00010.html, http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00025.html
CWE: CWE-119
CVE-2014-1475
The OpenID module in Drupal 6.x before 6.30 and 7.x before 7.26 allows remote OpenID users to authenticate as other users via unspecified vectors.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: drupal
References: http://secunia.com/advisories/56260, http://secunia.com/advisories/56601, http://www.debian.org/security/2014/dsa-2847