deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-2579
Published: 2014-04-25
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in XCloner Standalone 3.5 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) change the administrator password via the config task to index2.php or (2) when the enable_db_backup and sql_mem options are enabled, access the database backup functionality via the dbbackup_comp parameter in the generate action to index2.php.  NOTE: vector 2 might be a duplicate of CVE-2014-2340, which is for the XCloner Wordpress plugin.  NOTE: remote attackers can leverage CVE-2014-2996 with vector 2 to execute arbitrary commands.
CVSS Score: 7.6 (HIGH)
CWE: CWE-352
References: http://www.exploit-db.com/exploits/32790; http://www.securityfocus.com/archive/1/531780/100/0/threaded; http://www.securityfocus.com/bid/66751
CVE: CVE-2014-2996
Published: 2014-04-25
Description: XCloner Standalone 3.5 and earlier, when enable_db_backup and sql_mem are enabled, allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in the dbbackup_comp parameter in a generate action to index2.php.  NOTE: it is not clear whether this issue crosses privilege boundaries, since administrators might already have the privileges to execute code.  NOTE: this can be leveraged by remote attackers using CVE-2014-2579.
CVSS Score: 7.1 (HIGH)
CWE: CWE-94
References: http://www.exploit-db.com/exploits/32790; http://www.securityfocus.com/archive/1/531780/100/0/threaded; https://www.htbridge.com/advisory/HTB23207
CVE: CVE-2014-0350
Published: 2014-04-26
Description: The Poco::Net::X509Certificate::verify method in the NetSSL library in POCO C++ Libraries before 1.4.6p4 allows man-in-the-middle attackers to spoof SSL servers via crafted DNS PTR records that are requested during comparison of a server name to a wildcard domain name in an X.509 certificate.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-310
References: http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177471.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177573.html; http://www.kb.cert.org/vuls/id/118748
CVE: CVE-2014-2992
Published: 2014-04-26
Description: The Misli.com application for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-310
References: http://archives.neohapsis.com/archives/bugtraq/2014-04/0152.html; http://sceptive.com/p/mislicom-android-app-ssl-certificate-validation-weakness-; http://archives.neohapsis.com/archives/bugtraq/2014-04/0152.html
CVE: CVE-2014-2993
Published: 2014-04-26
Description: The Birebin.com application for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-310
References: http://archives.neohapsis.com/archives/bugtraq/2014-04/0153.html; http://sceptive.com/p/birebincom-android-app-ssl-certificate-validation-weakness-; http://www.securityfocus.com/bid/67524
CVE: CVE-2014-1730
Published: 2014-04-26
Description: Google V8, as used in Google Chrome before 34.0.1847.131 on Windows and OS X and before 34.0.1847.132 on Linux, does not properly store internationalization metadata, which allows remote attackers to bypass intended access restrictions by leveraging "type confusion" and reading property values, related to i18n.js and runtime.cc.
CVSS Score: 7.8 (HIGH)
CWE: CWE-843
References: http://googlechromereleases.blogspot.com/2014/04/stable-channel-update_24.html; http://lists.opensuse.org/opensuse-updates/2014-05/msg00049.html; http://lists.opensuse.org/opensuse-updates/2014-05/msg00050.html
CVE: CVE-2014-1731
Published: 2014-04-26
Description: core/html/HTMLSelectElement.cpp in the DOM implementation in Blink, as used in Google Chrome before 34.0.1847.131 on Windows and OS X and before 34.0.1847.132 on Linux, does not properly check renderer state upon a focus event, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that leverage "type confusion" for SELECT elements.
CVSS Score: 7.5 (HIGH)
CWE: CWE-843
References: http://archives.neohapsis.com/archives/bugtraq/2014-05/0128.html; http://archives.neohapsis.com/archives/bugtraq/2014-06/0174.html; http://archives.neohapsis.com/archives/bugtraq/2014-06/0175.html
CVE: CVE-2014-1732
Published: 2014-04-26
Description: Use-after-free vulnerability in browser/ui/views/speech_recognition_bubble_views.cc in Google Chrome before 34.0.1847.131 on Windows and OS X and before 34.0.1847.132 on Linux allows remote attackers to cause a denial of service or possibly have unspecified other impact via an INPUT element that triggers the presence of a Speech Recognition Bubble window for an incorrect duration.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: http://googlechromereleases.blogspot.com/2014/04/stable-channel-update_24.html; http://lists.opensuse.org/opensuse-updates/2014-05/msg00049.html; http://lists.opensuse.org/opensuse-updates/2014-05/msg00050.html
CVE: CVE-2014-1733
Published: 2014-04-26
Description: The PointerCompare function in codegen.cc in Seccomp-BPF, as used in Google Chrome before 34.0.1847.131 on Windows and OS X and before 34.0.1847.132 on Linux, does not properly merge blocks, which might allow remote attackers to bypass intended sandbox restrictions by leveraging renderer access.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://googlechromereleases.blogspot.com/2014/04/stable-channel-update_24.html; http://lists.opensuse.org/opensuse-updates/2014-05/msg00049.html; http://lists.opensuse.org/opensuse-updates/2014-05/msg00050.html
CVE: CVE-2014-1734
Published: 2014-04-26
Description: Multiple unspecified vulnerabilities in Google Chrome before 34.0.1847.131 on Windows and OS X and before 34.0.1847.132 on Linux allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://googlechromereleases.blogspot.com/2014/04/stable-channel-update_24.html; http://lists.opensuse.org/opensuse-updates/2014-05/msg00049.html; http://lists.opensuse.org/opensuse-updates/2014-05/msg00050.html
CVE: CVE-2014-1735
Published: 2014-04-26
Description: Multiple unspecified vulnerabilities in Google V8 before 3.24.35.33, as used in Google Chrome before 34.0.1847.131 on Windows and OS X and before 34.0.1847.132 on Linux, allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://googlechromereleases.blogspot.com/2014/04/stable-channel-update_24.html; http://lists.opensuse.org/opensuse-updates/2014-05/msg00049.html; http://lists.opensuse.org/opensuse-updates/2014-05/msg00050.html
CVE: CVE-2012-4410
Published: 2014-04-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2014-0181
Published: 2014-04-27
Description: The Netlink implementation in the Linux kernel through 3.14.1 does not provide a mechanism for authorizing socket operations based on the opener of a socket, which allows local users to bypass intended access restrictions and modify network configurations by using a Netlink socket for the (1) stdout or (2) stderr of a setuid program.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00010.html; http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00025.html; http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00000.html
CVE: CVE-2014-2889
Published: 2014-04-27
Description: Off-by-one error in the bpf_jit_compile function in arch/x86/net/bpf_jit_comp.c in the Linux kernel before 3.1.8, when BPF JIT is enabled, allows local users to cause a denial of service (system crash) or possibly gain privileges via a long jump after a conditional jump.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-189
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=a03ffcf873fe0f2565386ca8ef832144c42e67fa; http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.1.8; http://www.openwall.com/lists/oss-security/2014/04/18/6
CVE: CVE-2013-4145
Published: 2014-04-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2012-3414.  Reason: This candidate is a duplicate of CVE-2012-3414.  Notes: All CVE users should reference CVE-2012-3414 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2014-2994
Published: 2014-04-27
Description: Stack-based buffer overflow in Acunetix Web Vulnerability Scanner (WVS) 8 build 20120704 allows remote attackers to execute arbitrary code via an HTML file containing an IMG element with a long URL (src attribute).
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://an7isec.blogspot.co.il/2014/04/pown-noobs-acunetix-0day.html; http://osandamalith.wordpress.com/2014/04/24/pwning-script-kiddies-acunetix-buffer-overflow/; http://packetstormsecurity.com/files/126306/Acunetix-8-Stack-Buffer-Overflow.html
CVE: CVE-2014-1762
Published: 2014-04-27
Description: Unspecified vulnerability in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code with medium-integrity privileges and bypass a sandbox protection mechanism via unknown vectors, as demonstrated by ZDI during a Pwn4Fun competition at CanSecWest 2014.
CVSS Score: 7.5 (HIGH)
References: http://twitter.com/thezdi/statuses/[PII_REDACTED]58958592; http://www.pwn2own.com/2014/03/pwn2own-results-for-wednesday-day-one/; http://www.securityfocus.com/bid/67511
CVE: CVE-2014-1763
Published: 2014-04-27
Description: Use-after-free vulnerability in Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code and bypass a sandbox protection mechanism via unspecified vectors, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2014.
CVSS Score: 10.0 (HIGH)
CWE: CWE-399
References: http://secunia.com/advisories/59775; http://twitter.com/thezdi/statuses/[PII_REDACTED]73754624; http://www.pwn2own.com/2014/03/pwn2own-results-for-wednesday-day-one/
CVE: CVE-2014-1764
Published: 2014-04-27
Description: Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code and bypass a sandbox protection mechanism by leveraging "object confusion" in a broker process, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2014.
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://twitter.com/thezdi/statuses/[PII_REDACTED]73754624; http://www.pwn2own.com/2014/03/pwn2own-results-for-wednesday-day-one/; http://www.securityfocus.com/archive/1/532798/100/0/threaded
CVE: CVE-2014-1765
Published: 2014-04-27
Description: Multiple use-after-free vulnerabilities in Microsoft Internet Explorer 6 through 11 allow remote attackers to execute arbitrary code via unspecified vectors, as demonstrated by Sebastian Apelt and Andreas Schmidt during a Pwn2Own competition at CanSecWest 2014.
CVSS Score: 7.6 (HIGH)
CWE: CWE-399
References: http://secunia.com/advisories/59775; http://twitter.com/thezdi/statuses/[PII_REDACTED]34666240; http://www.pwn2own.com/2014/03/pwn2own-results-thursday-day-two/
CVE: CVE-2014-1766
Published: 2014-04-27
Description: Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, as demonstrated by Sebastian Apelt and Andreas Schmidt during a Pwn2Own competition at CanSecWest 2014. NOTE: the original disclosure referred to triggering a kernel bug with the Internet Explorer exploit payload, but this ID is not for a kernel vulnerability.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://twitter.com/thezdi/statuses/[PII_REDACTED]34666240; http://www.pwn2own.com/2014/03/pwn2own-results-thursday-day-two/; http://www.securityfocus.com/bid/67518
CVE: CVE-2014-1776
Published: 2014-04-27
Description: Use-after-free vulnerability in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via vectors related to the CMarkup::IsConnectedToPrimaryMarkup function, as exploited in the wild in April 2014.  NOTE: this issue originally emphasized VGX.DLL, but Microsoft clarified that "VGX.DLL does not contain the vulnerable code leveraged in this exploit. Disabling VGX.DLL is an exploit-specific workaround that provides an immediate, effective workaround to help block known attacks."
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416, CWE-416
References: http://blogs.technet.com/b/srd/archive/2014/04/30/protection-strategies-for-the-security-advisory-2963983-ie-0day.aspx; http://secunia.com/advisories/57908; http://securitytracker.com/id?1030154
CVE: CVE-2010-5105
Published: 2014-04-27
Description: The undo save quit routine in the kernel in Blender 2.5, 2.63a, and earlier allows local users to overwrite arbitrary files via a symlink attack on the quit.blend temporary file.  NOTE: this issue might be a regression of CVE-2008-1103.
CVSS Score: 3.3 (LOW)
CWE: CWE-59
References: http://lists.opensuse.org/opensuse-updates/2013-02/msg00047.html; http://www.openwall.com/lists/oss-security/2012/09/06/3; http://www.openwall.com/lists/oss-security/2012/09/07/13
CVE: CVE-2011-3152
Published: 2014-04-27
Description: DistUpgrade/DistUpgradeFetcherCore.py in Update Manager before 1:0.87.31.1, 1:0.134.x before 1:0.134.11.1, 1:0.142.x before 1:0.142.23.1, 1:0.150.x before 1:0.150.5.1, and 1:0.152.x before 1:0.152.25.5 on Ubuntu 8.04 through 11.10 does not verify the GPG signature before extracting an upgrade tarball, which allows man-in-the-middle attackers to (1) create or overwrite arbitrary files via a directory traversal attack using a crafted tar file, or (2) bypass authentication via a crafted meta-release file.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-310
References: http://secunia.com/advisories/47024; http://www.osvdb.org/77642; http://www.securityfocus.com/bid/50833
CVE: CVE-2013-4337
Published: 2014-04-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2013-5965.  Reason: This candidate is a duplicate of CVE-2013-5965.  Notes: All CVE users should reference CVE-2013-5965 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2013-6887
Published: 2014-04-27
Description: OpenJPEG 1.5.1 allows remote attackers to cause a denial of service via unspecified vectors that trigger NULL pointer dereferences, division-by-zero, and other errors.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-20
References: http://openjpeg.googlecode.com/svn/tags/version.1.5.2/NEWS; http://seclists.org/oss-sec/2013/q4/412; http://secunia.com/advisories/57285
CVE: CVE-2014-0162
Published: 2014-04-27
Description: The Sheepdog backend in OpenStack Image Registry and Delivery Service (Glance) 2013.2 before 2013.2.4 and icehouse before icehouse-rc2 allows remote authenticated users with permission to insert or modify an image to execute arbitrary commands via a crafted location.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-20
References: http://rhn.redhat.com/errata/RHSA-2014-0455.html; http://www.openwall.com/lists/oss-security/2014/04/10/13; http://www.ubuntu.com/usn/USN-2193-1
CVE: CVE-2014-3007
Published: 2014-04-27
Description: Python Image Library (PIL) 1.1.7 and earlier and Pillow 2.3 might allow remote attackers to execute arbitrary commands via shell metacharacters in unspecified vectors related to CVE-2014-1932, possibly JpegImagePlugin.py.
CVSS Score: 10.0 (HIGH)
CWE: CWE-78
References: http://people.canonical.com/~ubuntu-security/cve/2014/CVE-2014-1932.html; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737059; http://people.canonical.com/~ubuntu-security/cve/2014/CVE-2014-1932.html
CVE: CVE-2011-3602
Published: 2014-04-27
Description: Directory traversal vulnerability in device-linux.c in the router advertisement daemon (radvd) before 1.8.2 allows local users to overwrite arbitrary files, and remote attackers to overwrite certain files, via a .. (dot dot) in an interface name.  NOTE: this can be leveraged with a symlink to overwrite arbitrary files.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-22
References: http://www.debian.org/security/2011/dsa-2323; http://www.litech.org/radvd/CHANGES; http://www.openwall.com/lists/oss-security/2011/10/06/3
CVE: CVE-2011-3603
Published: 2014-04-27
Description: The router advertisement daemon (radvd) before 1.8.2 does not properly handle errors in the privsep_init function, which causes the radvd daemon to run as root and has an unspecified impact.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-20
References: http://www.litech.org/radvd/CHANGES; http://www.openwall.com/lists/oss-security/2011/10/06/3; https://access.redhat.com/security/cve/CVE-2011-3603
CVE: CVE-2013-0296
Published: 2014-04-27
Description: Race condition in pigz before 2.2.5 uses permissions derived from the umask when compressing a file before setting that file's permissions to match those of the original file, which might allow local users to bypass intended access permissions while compression is occurring.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-updates/2013-03/msg00106.html; http://mail.zlib.net/pipermail/pigz-announce_zlib.net/2012-July/000006.html; http://www.openwall.com/lists/oss-security/2013/02/15/4
CVE: CVE-2012-3415
Published: 2014-04-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2012-2401.  Reason: This candidate is a duplicate of CVE-2012-2401.  Notes: All CVE users should reference CVE-2012-2401 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2013-4336
Published: 2014-04-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2013-5964. Reason: This candidate is a duplicate of CVE-2013-5964.  Notes: All CVE users should reference CVE-2013-5964 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2013-6053
Published: 2014-04-27
Description: OpenJPEG 1.5.1 allows remote attackers to obtain sensitive information via unspecified vectors that trigger a heap-based out-of-bounds read.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://openjpeg.googlecode.com/svn/tags/version.1.5.2/NEWS; http://seclists.org/oss-sec/2013/q4/412; http://www.securityfocus.com/bid/64121
CVE: CVE-2014-2285
Published: 2014-04-27
Description: The perl_trapd_handler function in perl/TrapReceiver/TrapReceiver.xs in Net-SNMP 5.7.3.pre3 and earlier, when using certain Perl versions, allows remote attackers to cause a denial of service (snmptrapd crash) via an empty community string in an SNMP trap, which triggers a NULL pointer dereference within the newSVpv function in Perl.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://comments.gmane.org/gmane.comp.security.oss.general/12284; http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705; http://lists.opensuse.org/opensuse-updates/2014-03/msg00060.html
CVE: CVE-2013-4285
Published: 2014-04-28
Description: A certain Gentoo patch for the PAM S/Key module does not properly clear credentials from memory, which allows local users to obtain sensitive information by reading system memory.
CVSS Score: 2.1 (LOW)
CWE: CWE-255
References: http://security.gentoo.org/glsa/glsa-201402-12.xml; http://security.gentoo.org/glsa/glsa-201402-12.xml
CVE: CVE-2014-0037
Published: 2014-04-28
Description: The ValidateUserLogon function in provider/libserver/ECSession.cpp in Zarafa 5.00 before 7.1.8 beta2 allows remote attackers to cause a denial of service (crash) via vectors related to "a NULL pointer of the username."
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://www.mandriva.com/security/advisories?name=MDVSA-2014:044; http://www.openwall.com/lists/oss-security/2014/01/31/14; https://bugzilla.redhat.com/show_bug.cgi?id=1056767
CVE: CVE-2014-0079
Published: 2014-04-28
Description: The ValidateUserLogon function in provider/libserver/ECSession.cpp in Zarafa 7.1.8, 6.20.0, and earlier, when using certain build conditions, allows remote attackers to cause a denial of service (crash) via vectors related to "a NULL pointer of the password."
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://www.mandriva.com/security/advisories?name=MDVSA-2014:044; https://bugzilla.redhat.com/show_bug.cgi?id=1059903; http://www.mandriva.com/security/advisories?name=MDVSA-2014:044
CVE: CVE-2014-0187
Published: 2014-04-28
Description: The openvswitch-agent process in OpenStack Neutron 2013.1 before 2013.2.4 and 2014.1 before 2014.1.1 allows remote authenticated users to bypass security group restrictions via an invalid CIDR in a security group rule, which prevents further rules from being applied.
CVSS Score: 9.0 (HIGH)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-updates/2014-08/msg00035.html; http://secunia.com/advisories/59533; http://www.openwall.com/lists/oss-security/2014/04/22/8
CVE: CVE-2014-1217
Published: 2014-04-28
Description: Livetecs Timelive before 6.2.8 does not properly restrict access to systemsetting.aspx, which allows remote attackers to change configurations and obtain the database connection string and credentials via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://seclists.org/fulldisclosure/2014/Apr/259; http://www.securityfocus.com/archive/1/531911/100/0/threaded; http://www.securityfocus.com/bid/67043
CVE: CVE-2014-2042
Published: 2014-04-28
Description: Unrestricted file upload vulnerability in the Manage Project functionality in Livetecs Timelive before 6.5.1 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in a predictable directory in Uploads/.
CVSS Score: 7.5 (HIGH)
References: http://seclists.org/fulldisclosure/2014/Apr/260; http://www.securityfocus.com/archive/1/531914/100/0/threaded; http://seclists.org/fulldisclosure/2014/Apr/260
CVE: CVE-2014-2383
Published: 2014-04-28
Description: dompdf.php in dompdf before 0.6.1, when DOMPDF_ENABLE_PHP is enabled, allows context-dependent attackers to bypass chroot protections and read arbitrary files via a PHP protocol and wrappers in the input_file parameter, as demonstrated by a php://filter/read=convert.base64-encode/resource in the input_file parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-200
References: http://seclists.org/fulldisclosure/2014/Apr/258; http://www.securityfocus.com/archive/1/531912/100/0/threaded; https://explore.avertium.com/resource/lfi-rfi-escalation-to-rce
CVE: CVE-2014-2657
Published: 2014-04-28
Description: Unspecified vulnerability in the print release functionality in PaperCut MF before 14.1 (Build 26983) has unknown impact and remote vectors, related to embedded MFPs.
CVSS Score: 7.5 (HIGH)
References: http://www.papercut-mf.com/release-history/; https://exchange.xforce.ibmcloud.com/vulnerabilities/92650; http://www.papercut-mf.com/release-history/
CVE: CVE-2014-2658
Published: 2014-04-28
Description: Unspecified vulnerability in Papercut MF and NG before 14.1 (Build 26983) allows attacker to cause a denial of service via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/58037; http://www.papercut-mf.com/release-history/; http://www.papercut.com/release-history/
CVE: CVE-2014-2715
Published: 2014-04-28
Description: Multiple cross-site scripting (XSS) vulnerabilities in vwrooms\templates\logout.tpl.php in the VideoWhisper Webcam plugins for Drupal 7.x allow remote attackers to inject arbitrary web script or HTML via the (1) module or (2) message parameter to index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/58306; http://www.securityfocus.com/archive/1/531935/100/0/threaded; http://www.securityfocus.com/bid/67069