deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-4844
Published: 2014-12-17
Description: The import/export functionality in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, and 8.5.x through 8.5.5 allows remote authenticated users to bypass intended access restrictions via a project action for a (1) process application or (2) toolkit.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg1JR51286; http://www.ibm.com/support/docview.wss?uid=swg21690554; https://exchange.xforce.ibmcloud.com/vulnerabilities/95724
CVE: CVE-2014-6182
Published: 2014-12-17
Description: Directory traversal vulnerability in an export function in the Process Center in IBM Business Process Manager (BPM) 8.0.x through 8.0.1.3 and 8.5.x through 8.5.5 allows remote authenticated users to read arbitrary files via a .. (dot dot) in a URL.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-22
References: http://www-01.ibm.com/support/docview.wss?uid=swg1JR51234; http://www.ibm.com/support/docview.wss?uid=swg21692540; http://www.securitytracker.com/id/1031379
CVE: CVE-2014-8006
Published: 2014-12-17
Description: The Disaster Recovery (DRA) feature on the Cisco ISB8320-E High-Definition IP-Only DVR allows remote attackers to bypass authentication by establishing a TELNET session during a recovery boot, aka Bug ID CSCup85422.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-287
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-8006; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-8006
CVE: CVE-2014-4626
Published: 2014-12-17
Description: EMC Documentum Content Server before 6.7 SP1 P29, 6.7 SP2 before P18, 7.0 before P16, and 7.1 before P09 allows remote authenticated users to gain privileges by (1) placing a command in a dm_job object and setting this object's owner to a privileged user or placing a rename action in a dm_job_request object and waiting for a (2) dm_UserRename or (3) dm_GroupRename service task, aka ESA-2014-105.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2515.
CVSS Score: 9.0 (HIGH)
CWE: CWE-264
References: http://www.kb.cert.org/vuls/id/315340; http://www.kb.cert.org/vuls/id/386056; http://www.kb.cert.org/vuls/id/874632
CVE: CVE-2014-8133
Published: 2014-12-17
Description: arch/x86/kernel/tls.c in the Thread Local Storage (TLS) implementation in the Linux kernel through 3.18.1 allows local users to bypass the espfix protection mechanism, and consequently makes it easier for local users to bypass the ASLR protection mechanism, via a crafted application that makes a set_thread_area system call and later reads a 16-bit value.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=41bdc78544b8a93a9c6814b8bbbfef966272abbe; http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00025.html; http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00015.html
CVE: CVE-2014-9322
Published: 2014-12-17
Description: arch/x86/kernel/entry_64.S in the Linux kernel before 3.17.5 does not properly handle faults associated with the Stack Segment (SS) segment register, which allows local users to gain privileges by triggering an IRET instruction that leads to access to a GS Base address from the wrong space.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=6f442be2fb22be02cafa606f1769fa1e6f894441; http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00025.html; http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00015.html
CVE: CVE-2014-7285
Published: 2014-12-17
Description: The management console on the Symantec Web Gateway (SWG) appliance before 5.2.2 allows remote authenticated users to execute arbitrary OS commands by injecting command strings into unspecified PHP scripts.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-77
References: http://karmainsecurity.com/KIS-2014-19; http://osvdb.org/show/osvdb/116009; http://packetstormsecurity.com/files/130612/Symantec-Web-Gateway-5-restore.php-Command-Injection.html
CVE: CVE-2014-7880
Published: 2014-12-17
Description: Multiple unspecified vulnerabilities in the POP implementation in HP OpenVMS TCP/IP 5.7 before ECO5 allow remote attackers to cause a denial of service via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://www.securitytracker.com/id/1031387; https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04530570; http://www.securitytracker.com/id/1031387
CVE: CVE-2014-5437
Published: 2014-12-17
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in ARRIS Touchstone TG862G/CT Telephony Gateway with firmware 7.6.59S.CT and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) enable remote management via a request to remote_management.php, (2) add a port forwarding rule via a request to port_forwarding_add.php, (3) change the wireless network to open via a request to wireless_network_configuration_edit.php, or (4) conduct cross-site scripting (XSS) attacks via the keyword parameter to managed_sites_add_keyword.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://seclists.org/fulldisclosure/2014/Dec/57; http://seclists.org/fulldisclosure/2014/Dec/58; http://seclists.org/fulldisclosure/2014/Dec/57
CVE: CVE-2014-5438
Published: 2014-12-17
Description: Cross-site scripting (XSS) vulnerability in ARRIS Touchstone TG862G/CT Telephony Gateway with firmware 7.6.59S.CT and earlier allows remote authenticated users to inject arbitrary web script or HTML via the computer_name parameter to connected_devices_computers_edit.php.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2014/Dec/58; http://seclists.org/fulldisclosure/2014/Dec/58
CVE: CVE-2014-9253
Published: 2014-12-17
Description: The default file type whitelist configuration in conf/mime.conf in the Media Manager in DokuWiki before 2014-09-29b allows remote attackers to execute arbitrary web script or HTML by uploading an SWF file, then accessing it via the media parameter to lib/exe/fetch.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://advisories.mageia.org/MGASA-2014-0540.html; http://seclists.org/oss-sec/2014/q4/1050; http://security.szurek.pl/dokuwiki-20140929a-xss.html
CVE: CVE-2013-7402
Published: 2014-12-17
Description: Multiple unspecified vulnerabilities in request.c in c-icap 0.2.x allow remote attackers to cause a denial of service (crash) via a crafted ICAP request.
CVSS Score: 5.0 (MEDIUM)
References: http://advisories.mageia.org/MGASA-2014-0530.html; http://seclists.org/oss-sec/2014/q3/603; http://secunia.com/advisories/61381
CVE: CVE-2014-7170
Published: 2014-12-17
Description: Race condition in Puppet Server 0.2.0 allows local users to obtain sensitive information by accessing it in between package installation or upgrade and the start of the service.
CVSS Score: 1.9 (LOW)
CWE: CWE-362
References: http://puppetlabs.com/security/cve/cve-2014-7170; http://puppetlabs.com/security/cve/cve-2014-7170
CVE: CVE-2014-8116
Published: 2014-12-17
Description: The ELF parser (readelf.c) in file before 5.21 allows remote attackers to cause a denial of service (CPU consumption or crash) via a large number of (1) program or (2) section headers or (3) invalid capabilities.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://advisories.mageia.org/MGASA-2015-0040.html; http://rhn.redhat.com/errata/RHSA-2016-0760.html; http://seclists.org/oss-sec/2014/q4/1056
CVE: CVE-2014-8117
Published: 2014-12-17
Description: softmagic.c in file before 5.21 does not properly limit recursion, which allows remote attackers to cause a denial of service (CPU consumption or crash) via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://advisories.mageia.org/MGASA-2015-0040.html; http://rhn.redhat.com/errata/RHSA-2016-0760.html; http://seclists.org/oss-sec/2014/q4/1056
CVE: CVE-2014-8553
Published: 2014-12-17
Description: The mci_account_get_array_by_id function in api/soap/mc_account_api.php in MantisBT before 1.2.18 allows remote attackers to obtain sensitive information via a (1) mc_project_get_users, (2) mc_issue_get, (3) mc_filter_get_issues, or (4) mc_project_get_issues SOAP request.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://seclists.org/oss-sec/2014/q4/955; http://secunia.com/advisories/62101; http://www.debian.org/security/2015/dsa-3120
CVE: CVE-2014-9387
Published: 2014-12-17
Description: SAP BusinessObjects Edge 4.1 allows remote attackers to obtain the SI_PLATFORM_SEARCH_SERVER_LOGON_TOKEN token and gain privileges via a crafted CORBA call, aka SAP Note 2039905.
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://seclists.org/fulldisclosure/2014/Dec/60; http://www.onapsis.com/research/security-advisories/sap-business-objects-search-token-privilege-escalation-via-corba; http://www.securityfocus.com/archive/1/534249/100/0/threaded
CVE: CVE-2014-9388
Published: 2014-12-17
Description: bug_report.php in MantisBT before 1.2.18 allows remote attackers to assign arbitrary issues via the handler_id parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-284
References: http://seclists.org/oss-sec/2014/q4/955; http://secunia.com/advisories/62101; http://www.debian.org/security/2015/dsa-3120
CVE: CVE-2014-3580
Published: 2014-12-18
Description: The mod_dav_svn Apache HTTPD server module in Apache Subversion 1.x before 1.7.19 and 1.8.x before 1.8.11 allows remote attackers to cause a denial of service (NULL pointer dereference and server crash) via a REPORT request for a resource that does not exist.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2015/Mar/msg00003.html; http://rhn.redhat.com/errata/RHSA-2015-0165.html; http://rhn.redhat.com/errata/RHSA-2015-0166.html
CVE: CVE-2014-8108
Published: 2014-12-18
Description: The mod_dav_svn Apache HTTPD server module in Apache Subversion 1.7.x before 1.7.19 and 1.8.x before 1.8.11 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a request for a URI that triggers a lookup for a virtual transaction name that does not exist.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2015/Mar/msg00003.html; http://rhn.redhat.com/errata/RHSA-2015-0166.html; http://secunia.com/advisories/61131
CVE: CVE-2014-8120
Published: 2014-12-18
Description: The agent in Thermostat before 1.0.6, when using unspecified configurations, allows local users to obtain the JMX management URLs of all local Java virtual machines and gain privileges via unknown vectors.
CVSS Score: 4.4 (MEDIUM)
References: http://icedtea.classpath.org/pipermail/thermostat-announce/2014-December/000013.html; http://rhn.redhat.com/errata/RHSA-2014-2000.html; http://icedtea.classpath.org/pipermail/thermostat-announce/2014-December/000013.html
CVE: CVE-2014-9406
Published: 2014-12-18
Description: ARRIS Touchstone TG862G/CT Telephony Gateway with firmware 7.6.59S.CT and earlier has a default password of password for the admin account, which makes it easier for remote attackers to obtain access via a request to home_loggedout.php.
CVSS Score: 10.0 (HIGH)
CWE: CWE-255
References: http://seclists.org/fulldisclosure/2014/Dec/57; http://seclists.org/fulldisclosure/2014/Dec/57
CVE: CVE-2014-6076
Published: 2014-12-18
Description: IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 allow remote attackers to conduct clickjacking attacks via a crafted web site.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-254
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IV67358; http://www-01.ibm.com/support/docview.wss?uid=swg1IV67581; http://www-01.ibm.com/support/docview.wss?uid=swg21684475
CVE: CVE-2014-6077
Published: 2014-12-18
Description: Cross-site request forgery (CSRF) vulnerability in IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IV67358; http://www-01.ibm.com/support/docview.wss?uid=swg1IV67581; http://www-01.ibm.com/support/docview.wss?uid=swg21684475
CVE: CVE-2014-6078
Published: 2014-12-18
Description: IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 do not have a lockout period after invalid login attempts, which makes it easier for remote attackers to obtain admin access via a brute-force attack.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-284
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IV67358; http://www-01.ibm.com/support/docview.wss?uid=swg1IV67581; http://www-01.ibm.com/support/docview.wss?uid=swg21684475
CVE: CVE-2014-6080
Published: 2014-12-18
Description: SQL injection vulnerability in IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IV67358; http://www-01.ibm.com/support/docview.wss?uid=swg1IV67581; http://www-01.ibm.com/support/docview.wss?uid=swg21684475
CVE: CVE-2014-6082
Published: 2014-12-18
Description: IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 allow remote authenticated users to cause a denial of service (administration UI outage) via unspecified vectors.
CVSS Score: 4.0 (MEDIUM)
References: http://secunia.com/advisories/61945; http://www-01.ibm.com/support/docview.wss?uid=swg1IV67358; http://www-01.ibm.com/support/docview.wss?uid=swg1IV67581
CVE: CVE-2014-6083
Published: 2014-12-18
Description: IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 allow remote attackers to obtain sensitive cookie information by sniffing the network during an HTTP session.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IV67358; http://www-01.ibm.com/support/docview.wss?uid=swg1IV67581; http://www-01.ibm.com/support/docview.wss?uid=swg21684475
CVE: CVE-2014-6084
Published: 2014-12-18
Description: IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 make it easier for remote attackers to obtain sensitive information by sniffing the network during use of a weak SSL cipher.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IV67358; http://www-01.ibm.com/support/docview.wss?uid=swg1IV67581; http://www-01.ibm.com/support/docview.wss?uid=swg21684475
CVE: CVE-2014-6086
Published: 2014-12-18
Description: IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 do not ensure that HTTPS is used, which allows remote attackers to obtain sensitive information by sniffing the network during an HTTP session.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IV67358; http://www-01.ibm.com/support/docview.wss?uid=swg1IV67581; http://www-01.ibm.com/support/docview.wss?uid=swg21684475
CVE: CVE-2014-6087
Published: 2014-12-18
Description: IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 make it easier for remote attackers to obtain sensitive information by sniffing the network during use of a weak algorithm in an SSL cipher suite.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IV67358; http://www-01.ibm.com/support/docview.wss?uid=swg1IV67581; http://www-01.ibm.com/support/docview.wss?uid=swg21684475
CVE: CVE-2014-6088
Published: 2014-12-18
Description: IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 allow remote attackers to obtain sensitive information by sniffing the network during use of the null SSL cipher.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IV67358; http://www-01.ibm.com/support/docview.wss?uid=swg1IV67581; http://www-01.ibm.com/support/docview.wss?uid=swg21684475
CVE: CVE-2014-6089
Published: 2014-12-18
Description: IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 allow remote authenticated users to cause a denial of service (disrupted system operations) by uploading a file to a protected area.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-19
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IV67358; http://www-01.ibm.com/support/docview.wss?uid=swg1IV67581; http://www-01.ibm.com/support/docview.wss?uid=swg21684475
CVE: CVE-2014-6164
Published: 2014-12-18
Description: IBM WebSphere Application Server 8.0.x before 8.0.0.10 and 8.5.x before 8.5.5.4 allows remote attackers to spoof OpenID and OpenID Connect cookies, and consequently obtain sensitive information, via a crafted URL.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PI23430; http://www-01.ibm.com/support/docview.wss?uid=swg21690185; https://exchange.xforce.ibmcloud.com/vulnerabilities/97713
CVE: CVE-2014-6166
Published: 2014-12-18
Description: The Communications Enabled Applications (CEA) service in IBM WebSphere Application Server 8.0.x before 8.0.0.10 and 8.5.x before 8.5.5.4, and Feature Pack for CEA 1.x before 1.0.0.15, allows remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
CVSS Score: 4.3 (MEDIUM)
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PI25310; http://www-01.ibm.com/support/docview.wss?uid=swg1PI28632; http://www-01.ibm.com/support/docview.wss?uid=swg21690185
CVE: CVE-2014-6167
Published: 2014-12-18
Description: Cross-site scripting (XSS) vulnerability in the URL rewriting feature in IBM WebSphere Application Server 7.x before 7.0.0.37, 8.0.x before 8.0.0.10, and 8.5.x before 8.5.5.4 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PI23819; http://www-01.ibm.com/support/docview.wss?uid=swg21690185; https://exchange.xforce.ibmcloud.com/vulnerabilities/97748
CVE: CVE-2014-6174
Published: 2014-12-18
Description: IBM WebSphere Application Server 7.x before 7.0.0.37, 8.0.x before 8.0.0.10, and 8.5.x before 8.5.5.4 allows remote attackers to conduct clickjacking attacks via a crafted web site.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-254
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PI27152; http://www-01.ibm.com/support/docview.wss?uid=swg21690185; https://exchange.xforce.ibmcloud.com/vulnerabilities/98486
CVE: CVE-2014-8012
Published: 2014-12-18
Description: Cross-site scripting (XSS) vulnerability in the WebVPN Portal Login page in Cisco Adaptive Security Appliance (ASA) Software allows remote attackers to inject arbitrary web script or HTML via crafted attributes in a cookie, aka Bug ID CSCuh24695.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-8012; http://www.securitytracker.com/id/1031395; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-8012
CVE: CVE-2014-8014
Published: 2014-12-18
Description: Cisco IOS XR allows remote attackers to cause a denial of service (RSVP process reload) via a malformed RSVP packet, aka Bug ID CSCub63710.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-19
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-8014; http://www.securitytracker.com/id/1031396; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-8014
CVE: CVE-2014-8890
Published: 2014-12-18
Description: IBM WebSphere Application Server Liberty Profile 8.5.x before 8.5.5.4 allows remote attackers to gain privileges by leveraging the combination of a servlet's deployment descriptor security constraints and ServletSecurity annotations.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PI29911; http://www-01.ibm.com/support/docview.wss?uid=swg21690185; http://www-01.ibm.com/support/docview.wss?uid=swg21963275
CVE: CVE-2014-8901
Published: 2014-12-18
Description: IBM DB2 9.5 through FP10, 9.7 through FP10, 9.8 through FP5, 10.1 through FP4, and 10.5 before FP5 allows remote authenticated users to cause a denial of service (CPU consumption) via a crafted XML query.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-399
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IT05933; http://www-01.ibm.com/support/docview.wss?uid=swg1IT05936; http://www-01.ibm.com/support/docview.wss?uid=swg1IT05937
CVE: CVE-2014-4801
Published: 2014-12-19
Description: Cross-site scripting (XSS) vulnerability in IBM Rational Quality Manager 2.x through 2.0.1.1, 3.x before 3.0.1.6 iFix 4, 4.x before 4.0.7 iFix 2, and 5.x before 5.0.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21692615; https://exchange.xforce.ibmcloud.com/vulnerabilities/95303; http://www-01.ibm.com/support/docview.wss?uid=swg21692615
CVE: CVE-2014-6171
Published: 2014-12-19
Description: Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0.0 through 7.0.0.2 CF29, 8.0.0 through 8.0.0.1 CF14, and 8.5.0 before CF04 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PI29134; http://www-01.ibm.com/support/docview.wss?uid=swg21692107; https://exchange.xforce.ibmcloud.com/vulnerabilities/98383
CVE: CVE-2014-6173
Published: 2014-12-19
Description: Cross-site scripting (XSS) vulnerability in the Process Inspector in IBM Business Process Manager (BPM) 8.0.x through 8.0.1.3 and 8.5.x through 8.5.5 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1JR50241; http://www-01.ibm.com/support/docview.wss?uid=swg21690553; https://exchange.xforce.ibmcloud.com/vulnerabilities/98418
CVE: CVE-2014-6193
Published: 2014-12-19
Description: IBM WebSphere Portal 8.0.0 through 8.0.0.1 CF14 and 8.5.0 before CF04, when the Managed Pages setting is enabled, allows remote authenticated users to write to pages via an XML injection attack.
CVSS Score: 4.9 (MEDIUM)
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PI28699; http://www-01.ibm.com/support/docview.wss?uid=swg21692107; https://exchange.xforce.ibmcloud.com/vulnerabilities/98567
CVE: CVE-2014-8016
Published: 2014-12-19
Description: The Cisco IronPort Email Security Appliance (ESA) allows remote attackers to cause a denial of service (CPU consumption) via long Subject headers in e-mail messages, aka Bug ID CSCzv93864.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-8016; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-8016