deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-0244
Published: 2014-06-23
Description: The sys_recvfrom function in nmbd in Samba 3.6.x before 3.6.24, 4.0.x before 4.0.19, and 4.1.x before 4.1.9 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a malformed UDP packet.
CVSS Score: 3.3 (LOW)
CWE: CWE-20
References: http://advisories.mageia.org/MGASA-2014-0279.html; http://linux.oracle.com/errata/ELSA-2014-0866.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136864.html
CVE: CVE-2014-3493
Published: 2014-06-23
Description: The push_ascii function in smbd in Samba 3.6.x before 3.6.24, 4.0.x before 4.0.19, and 4.1.x before 4.1.9 allows remote authenticated users to cause a denial of service (memory corruption and daemon crash) via an attempt to read a Unicode pathname without specifying use of Unicode, leading to a character-set conversion failure that triggers an invalid pointer dereference.
CVSS Score: 2.7 (LOW)
CWE: CWE-119
References: http://advisories.mageia.org/MGASA-2014-0279.html; http://linux.oracle.com/errata/ELSA-2014-0866.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136864.html
CVE: CVE-2014-0206
Published: 2014-06-25
Description: Array index error in the aio_read_events_ring function in fs/aio.c in the Linux kernel through 3.15.1 allows local users to obtain sensitive information from kernel memory via a large head value.
CVSS Score: 2.1 (LOW)
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=edfbbf388f293d70bf4b7c0bc38774d05e6f711a; http://secunia.com/advisories/59278; http://www.securityfocus.com/bid/68176
CVE: CVE-2014-2005
Published: 2014-06-25
Description: Sophos Disk Encryption (SDE) 5.x in Sophos Enterprise Console (SEC) 5.x before 5.2.2 does not enforce intended authentication requirements for a resume action from sleep mode, which allows physically proximate attackers to obtain desktop access by leveraging the absence of a login screen.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287
References: http://jvn.jp/en/jp/JVN63940326/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2014-000061; http://www.securityfocus.com/bid/68169
CVE: CVE-2014-3299
Published: 2014-06-25
Description: Cisco IOS allows remote authenticated users to cause a denial of service (device reload) via malformed IPsec packets, aka Bug ID CSCui79745.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/59382; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3299; http://www.securityfocus.com/bid/68177
CVE: CVE-2014-3882
Published: 2014-06-25
Description: Cross-site request forgery (CSRF) vulnerability in the Login rebuilder plugin before 1.2.0 for WordPress allows remote attackers to hijack the authentication of arbitrary users.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://12net.jp/news/n20140623_01.html; http://jvn.jp/en/jp/JVN05329568/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2014-000062
CVE: CVE-2014-4348
Published: 2014-06-25
Description: Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.2.x before 4.2.4 allow remote authenticated users to inject arbitrary web script or HTML via a crafted (1) database name or (2) table name that is improperly handled after presence in (a) the favorite list or (b) recent tables.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://phpmyadmin.net/home_page/security/PMASA-2014-2.php; http://www.securityfocus.com/bid/68201; https://github.com/phpmyadmin/phpmyadmin/commit/cb7c703c03f656debcea2a16468bd53660fc888e
CVE: CVE-2014-4349
Published: 2014-06-25
Description: Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.1.x before 4.1.14.1 and 4.2.x before 4.2.4 allow remote authenticated users to inject arbitrary web script or HTML via a crafted table name that is improperly handled after a (1) hide or (2) unhide action.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-updates/2014-08/msg00045.html; http://phpmyadmin.net/home_page/security/PMASA-2014-3.php; http://secunia.com/advisories/60397
CVE: CVE-2014-4617
Published: 2014-06-25
Description: The do_uncompress function in g10/compress.c in GnuPG 1.x before 1.4.17 and 2.x before 2.0.24 allows context-dependent attackers to cause a denial of service (infinite loop) via malformed compressed packets, as demonstrated by an a3 01 5b ff byte sequence.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git%3Ba=commit%3Bh=014b2103fcb12f261135e3954f26e9e07b39e342; http://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git%3Ba=commit%3Bh=11fdfcf82bd8d2b5bc38292a29876e10770f4b0a; http://lists.gnupg.org/pipermail/gnupg-announce/2014q2/000344.html
CVE: CVE-2014-4030
Published: 2014-06-25
Description: Cross-site request forgery (CSRF) vulnerability in the JW Player plugin before 2.1.4 for WordPress allows remote attackers to hijack the authentication of administrators for requests that remove players via a delete action to wp-admin/admin.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://seclists.org/fulldisclosure/2014/Jun/64; http://secunia.com/advisories/59173; http://wordpress.org/plugins/jw-player-plugin-for-wordpress/changelog
CVE: CVE-2014-4643
Published: 2014-06-25
Description: Multiple heap-based buffer overflows in the client in Core FTP LE 2.2 build 1798 allow remote FTP servers to cause a denial of service (application crash) and possibly execute arbitrary code via a long string in a reply to a (1) USER, (2) PASS, (3) PASV, (4) SYST, (5) PWD, or (6) CDUP command.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://osvdb.org/show/osvdb/108051; http://packetstormsecurity.com/files/127075/Core-FTP-LE-2.2-Heap-Overflow.html; http://secunia.com/advisories/58818
CVE: CVE-2014-4644
Published: 2014-06-25
Description: SQL injection vulnerability in superlinks.php in the superlinks plugin 1.4-2 for Cacti allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/show/osvdb/108452; http://www.exploit-db.com/exploits/33809; http://www.securityfocus.com/bid/68141
CVE: CVE-2014-4645
Published: 2014-06-25
Description: Cross-site scripting (XSS) vulnerability in dhcpinfo.html in D-link DSL-2760U-E1 allows remote attackers to inject arbitrary web script or HTML via a hostname.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.exploit-db.com/exploits/33822; http://www.securityfocus.com/bid/68144; http://www.exploit-db.com/exploits/33822
CVE: CVE-2014-3432
Published: 2014-06-27
Description: Cross-site scripting (XSS) vulnerability in the management console in Symantec Data Insight 3.x and 4.x before 4.5 allows remote attackers to inject arbitrary web script or HTML via an unspecified form field.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/59538; http://secunia.com/advisories/59561; http://www.securityfocus.com/bid/68160
CVE: CVE-2014-3433
Published: 2014-06-27
Description: Cross-site scripting (XSS) vulnerability in the management console in Symantec Data Insight 3.x and 4.x before 4.5 allows remote attackers to inject arbitrary web script or HTML via an unspecified form field, related to an "HTML script injection" issue.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/68161; http://www.securitytracker.com/id/1030472; http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20140625_00
CVE: CVE-2011-1381
Published: 2014-06-27
Description: Unspecified vulnerability in IBM OpenPages GRC Platform 6.1.0.1 before IF4 allows remote attackers to bypass intended access restrictions via unknown vectors.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg21676990; http://www-01.ibm.com/support/docview.wss?uid=swg21676990
CVE: CVE-2014-3011
Published: 2014-06-27
Description: IBM OpenPages GRC Platform 6.1.0.1 before IF4 allows remote attackers to conduct link injection attacks via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-94
References: http://www-01.ibm.com/support/docview.wss?uid=swg21676990; http://www-01.ibm.com/support/docview.wss?uid=swg21676990
CVE: CVE-2013-6308
Published: 2014-06-28
Description: IBM Marketing Platform 9.1 before FP2 allows remote authenticated users to conduct phishing attacks and capture login credentials via an unspecified injection.
CVSS Score: 4.9 (MEDIUM)
References: http://www-01.ibm.com/support/docview.wss?uid=swg21676688; https://exchange.xforce.ibmcloud.com/vulnerabilities/88558; http://www-01.ibm.com/support/docview.wss?uid=swg21676688
CVE: CVE-2013-6309
Published: 2014-06-28
Description: IBM Marketing Platform 9.1 before FP2 allows remote authenticated users to hijack sessions, and consequently read records, modify records, or conduct transactions, via an unspecified link injection.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-94
References: http://www-01.ibm.com/support/docview.wss?uid=swg21676688; https://exchange.xforce.ibmcloud.com/vulnerabilities/88559; http://www-01.ibm.com/support/docview.wss?uid=swg21676688
CVE: CVE-2013-6310
Published: 2014-06-28
Description: Cross-site scripting (XSS) vulnerability in IBM Marketing Platform 9.1 before FP2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21676688; https://exchange.xforce.ibmcloud.com/vulnerabilities/88560; http://www-01.ibm.com/support/docview.wss?uid=swg21676688
CVE: CVE-2013-6311
Published: 2014-06-28
Description: SQL injection vulnerability in IBM Marketing Platform 9.1 before FP2 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://www-01.ibm.com/support/docview.wss?uid=swg21676688; https://exchange.xforce.ibmcloud.com/vulnerabilities/88561; http://www-01.ibm.com/support/docview.wss?uid=swg21676688
CVE: CVE-2014-0891
Published: 2014-06-28
Description: IBM WebSphere Application Server (WAS) 7.0.x before 7.0.0.33, 8.0.x before 8.0.0.9, and 8.5.x before 8.5.5.2 allows remote attackers to obtain sensitive information by leveraging incorrect request handling by the (1) Proxy or (2) ODR server.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PI09786; http://www-01.ibm.com/support/docview.wss?uid=swg21669554; http://www-01.ibm.com/support/docview.wss?uid=swg21676091
CVE: CVE-2014-2006
Published: 2014-06-28
Description: Cross-site scripting (XSS) vulnerability in Intercom Web Kyukincho 3.x before 3.0.030 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN80006084/995199/index.html; http://jvn.jp/en/jp/JVN80006084/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2014-000063
CVE: CVE-2014-3881
Published: 2014-06-28
Description: Cross-site request forgery (CSRF) vulnerability in Intercom Web Kyukincho 3.x before 3.0.030 allows remote attackers to hijack the authentication of arbitrary users.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://jvn.jp/en/jp/JVN36259412/index.html; http://jvn.jp/en/jp/JVN80006084/995199/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2014-000064
CVE: CVE-2014-2612
Published: 2014-06-28
Description: Unspecified vulnerability in HP Release Control 9.x before 9.13 p3 and 9.2x before RC 9.21.0003 p1 on Windows and 9.2x before RC 9.21.0002 p1 on Linux allows remote authenticated users to obtain sensitive information via unknown vectors.
CVSS Score: 4.0 (MEDIUM)
References: http://www.securityfocus.com/bid/68244; http://www.securitytracker.com/id/1030490; https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04352674
CVE: CVE-2014-2613
Published: 2014-06-28
Description: Unspecified vulnerability in HP Release Control 9.x before 9.13 p3 and 9.2x before RC 9.21.0003 p1 on Windows and 9.2x before RC 9.21.0002 p1 on Linux allows remote authenticated users to gain privileges via unknown vectors.
CVSS Score: 9.0 (HIGH)
References: http://www.securityfocus.com/bid/68245; http://www.securitytracker.com/id/1030490; https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04352674
CVE: CVE-2014-4648
Published: 2014-06-28
Description: Unspecified vulnerability in Piwigo before 2.6.3 has unknown impact and attack vectors, related to a "security failure."
CVSS Score: 10.0 (HIGH)
References: http://piwigo.org/forum/viewtopic.php?id=24009; http://piwigo.org/releases/2.6.3; http://piwigo.org/forum/viewtopic.php?id=24009
CVE: CVE-2014-4649
Published: 2014-06-28
Description: SQL injection vulnerability in the photo-edit subsystem in Piwigo 2.6.x and 2.7.x before 2.7.0beta2 allows remote authenticated administrators to execute arbitrary SQL commands via the associate[] field.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://piwigo.org/bugs/changelog_page.php; http://piwigo.org/bugs/view.php?id=3089; http://piwigo.org/bugs/changelog_page.php
CVE: CVE-2014-4669
Published: 2014-06-28
Description: HP Enterprise Maps 1.00 allows remote authenticated users to read arbitrary files via a WSDL document containing an XML external entity declaration in conjunction with an entity reference within a GetQuote operation, related to an XML External Entity (XXE) issue.
CVSS Score: 3.5 (LOW)
CWE: CWE-200
References: http://packetstormsecurity.com/files/127239/HP-Enterprise-Maps-1.00-Authenticated-XXE-Injection.html; http://seclists.org/fulldisclosure/2014/Jun/127; http://www.securityfocus.com/bid/68200
CVE: CVE-2014-2509
Published: 2014-07-01
Description: Session fixation vulnerability in the Report Advisor (RA) component in EMC Network Configuration Manager (NCM) before 9.3 allows remote attackers to hijack web sessions via a session cookie.
CVSS Score: 5.4 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2014-06/0168.html; http://packetstormsecurity.com/files/127301/EMC-Network-Configuration-Manager-NCM-Session-Fixation.html; http://secunia.com/advisories/59423
CVE: CVE-2014-2512
Published: 2014-07-01
Description: Multiple cross-site scripting (XSS) vulnerabilities in EMC Documentum eRoom 7.4.3, 7.4.4 before P19, and 7.4.4 SP1 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2014-06/0176.html; http://packetstormsecurity.com/files/127309/EMC-Documentum-eRoom-Cross-Site-Scripting.html; http://packetstormsecurity.com/files/127321/EMC-Documentum-eRoom-Stored-Cross-Site-Scripting.html
CVE: CVE-2014-1317
Published: 2014-07-01
Description: iBooks Commerce in Apple OS X before 10.9.4 places Apple ID credentials in the iBooks log, which allows local users to obtain sensitive information by reading this file.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://archives.neohapsis.com/archives/bugtraq/2014-06/0172.html; http://secunia.com/advisories/59475; http://support.apple.com/kb/HT6296
CVE: CVE-2014-1325
Published: 2014-07-01
Description: WebKit, as used in Apple iOS before 7.1.2, Apple Safari before 6.1.5 and 7.x before 7.0.5, and Apple TV before 6.1.2, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-06-30-1, APPLE-SA-2014-06-30-3, and APPLE-SA-2014-06-30-4.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2014-06/0171.html; http://archives.neohapsis.com/archives/bugtraq/2014-06/0174.html; http://archives.neohapsis.com/archives/bugtraq/2014-06/0175.html
CVE: CVE-2014-1340
Published: 2014-07-01
Description: WebKit, as used in Apple Safari before 6.1.5 and 7.x before 7.0.5, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-06-30-1.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2014-06/0171.html; http://secunia.com/advisories/59481; http://www.securitytracker.com/id/1030495
CVE: CVE-2014-1345
Published: 2014-07-01
Description: WebKit in Apple iOS before 7.1.2 and Apple Safari before 6.1.5 and 7.x before 7.0.5 does not properly encode domain names in URLs, which allows remote attackers to spoof the address bar via a crafted web site.
CVSS Score: 4.3 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2014-06/0171.html; http://archives.neohapsis.com/archives/bugtraq/2014-06/0174.html; http://secunia.com/advisories/59481
CVE: CVE-2014-1348
Published: 2014-07-01
Description: Mail in Apple iOS before 7.1.2 advertises the availability of data protection for attachments but stores cleartext attachments under mobile/Library/Mail/, which makes it easier for physically proximate attackers to obtain sensitive information by mounting the data partition.
CVSS Score: 2.1 (LOW)
CWE: CWE-310
References: http://archives.neohapsis.com/archives/bugtraq/2014-06/0174.html; http://archives.neohapsis.com/archives/bugtraq/2014-09/0106.html; http://support.apple.com/kb/HT6441
CVE: CVE-2014-1349
Published: 2014-07-01
Description: Use-after-free vulnerability in Safari in Apple iOS before 7.1.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via an invalid URL.
CVSS Score: 6.8 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2014-06/0174.html; http://www.securityfocus.com/bid/68276; http://www.securitytracker.com/id/1030500
CVE: CVE-2014-1350
Published: 2014-07-01
Description: Settings in Apple iOS before 7.1.2 allows physically proximate attackers to bypass an intended iCloud password requirement, and turn off the Find My iPhone service, by leveraging incorrect state management.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-264
References: http://archives.neohapsis.com/archives/bugtraq/2014-06/0174.html; http://www.securityfocus.com/bid/68276; http://www.securitytracker.com/id/1030500
CVE: CVE-2014-1351
Published: 2014-07-01
Description: Siri in Apple iOS before 7.1.2 allows physically proximate attackers to bypass an intended lock-screen passcode requirement, and read a contact list, via a Siri request that refers to a contact ambiguously.
CVSS Score: 3.6 (LOW)
CWE: CWE-264
References: http://archives.neohapsis.com/archives/bugtraq/2014-06/0174.html; http://www.securityfocus.com/bid/68276; http://www.securitytracker.com/id/1030500
CVE: CVE-2014-1352
Published: 2014-07-01
Description: Lock Screen in Apple iOS before 7.1.2 does not properly enforce the limit on failed passcode attempts, which makes it easier for physically proximate attackers to conduct brute-force passcode-guessing attacks via unspecified vectors.
CVSS Score: 1.9 (LOW)
CWE: CWE-264
References: http://archives.neohapsis.com/archives/bugtraq/2014-06/0174.html; http://www.securityfocus.com/bid/68276; http://www.securitytracker.com/id/1030500
CVE: CVE-2014-1353
Published: 2014-07-01
Description: Lock Screen in Apple iOS before 7.1.2 does not properly manage the telephony state in Airplane Mode, which allows physically proximate attackers to bypass the lock protection mechanism, and access a certain foreground application, via unspecified vectors.
CVSS Score: 3.6 (LOW)
CWE: CWE-264
References: http://archives.neohapsis.com/archives/bugtraq/2014-06/0174.html; http://www.securityfocus.com/bid/68276; http://www.securitytracker.com/id/1030500
CVE: CVE-2014-1354
Published: 2014-07-01
Description: CoreGraphics in Apple iOS before 7.1.2 does not properly restrict allocation of stack memory for processing of XBM images, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted image data.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-399
References: http://archives.neohapsis.com/archives/bugtraq/2014-06/0174.html; http://www.securityfocus.com/bid/68276; http://www.securitytracker.com/id/1030500
CVE: CVE-2014-1355
Published: 2014-07-01
Description: The IOKit implementation in the kernel in Apple iOS before 7.1.2 and Apple TV before 6.1.2, and in IOReporting in Apple OS X before 10.9.4, allows local users to cause a denial of service (NULL pointer dereference and reboot) via crafted API arguments.
CVSS Score: 4.9 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2014-06/0172.html; http://archives.neohapsis.com/archives/bugtraq/2014-06/0174.html; http://archives.neohapsis.com/archives/bugtraq/2014-06/0175.html
CVE: CVE-2014-1356
Published: 2014-07-01
Description: Heap-based buffer overflow in launchd in Apple iOS before 7.1.2, Apple OS X before 10.9.4, and Apple TV before 6.1.2 allows attackers to execute arbitrary code via a crafted application that sends IPC messages.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2014-06/0172.html; http://archives.neohapsis.com/archives/bugtraq/2014-06/0174.html; http://archives.neohapsis.com/archives/bugtraq/2014-06/0175.html
CVE: CVE-2014-1357
Published: 2014-07-01
Description: Heap-based buffer overflow in launchd in Apple iOS before 7.1.2, Apple OS X before 10.9.4, and Apple TV before 6.1.2 allows attackers to execute arbitrary code via a crafted application that generates log messages.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2014-06/0172.html; http://archives.neohapsis.com/archives/bugtraq/2014-06/0174.html; http://archives.neohapsis.com/archives/bugtraq/2014-06/0175.html
CVE: CVE-2014-1358
Published: 2014-07-01
Description: Integer overflow in launchd in Apple iOS before 7.1.2, Apple OS X before 10.9.4, and Apple TV before 6.1.2 allows attackers to execute arbitrary code via a crafted application.
CVSS Score: 10.0 (HIGH)
CWE: CWE-189
References: http://archives.neohapsis.com/archives/bugtraq/2014-06/0172.html; http://archives.neohapsis.com/archives/bugtraq/2014-06/0174.html; http://archives.neohapsis.com/archives/bugtraq/2014-06/0175.html
CVE: CVE-2014-1359
Published: 2014-07-01
Description: Integer underflow in launchd in Apple iOS before 7.1.2, Apple OS X before 10.9.4, and Apple TV before 6.1.2 allows attackers to execute arbitrary code via a crafted application.
CVSS Score: 10.0 (HIGH)
CWE: CWE-189
References: http://archives.neohapsis.com/archives/bugtraq/2014-06/0172.html; http://archives.neohapsis.com/archives/bugtraq/2014-06/0174.html; http://archives.neohapsis.com/archives/bugtraq/2014-06/0175.html
CVE: CVE-2014-1360
Published: 2014-07-01
Description: Lockdown in Apple iOS before 7.1.2 does not properly verify data from activation servers, which makes it easier for physically proximate attackers to bypass the Activation Lock protection mechanism via unspecified vectors.
CVSS Score: 2.1 (LOW)
CWE: CWE-20
References: http://archives.neohapsis.com/archives/bugtraq/2014-06/0174.html; http://archives.neohapsis.com/archives/bugtraq/2014-09/0106.html; http://support.apple.com/kb/HT6441
CVE: CVE-2014-1361
Published: 2014-07-01
Description: Secure Transport in Apple iOS before 7.1.2, Apple OS X before 10.9.4, and Apple TV before 6.1.2 does not ensure that a DTLS message is accepted only for a DTLS connection, which allows remote attackers to obtain potentially sensitive information from uninitialized process memory by providing a DTLS message within a TLS connection.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://archives.neohapsis.com/archives/bugtraq/2014-06/0172.html; http://archives.neohapsis.com/archives/bugtraq/2014-06/0174.html; http://archives.neohapsis.com/archives/bugtraq/2014-06/0175.html