deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2012-5572
Published: 2014-05-30
Description: CRLF injection vulnerability in the cookie method (lib/Dancer/Cookie.pm) in Dancer before 1.3114 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a cookie name, a different vulnerability than CVE-2012-5526.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://advisories.mageia.org/MGASA-2013-0183.html; http://www.mandriva.com/security/advisories?name=MDVSA-2013:184; http://www.openwall.com/lists/oss-security/2012/11/26/10
CVE: CVE-2012-5876
Published: 2014-05-30
Description: Multiple off-by-one errors in NMMediaServerService.dll in Nero MediaHome 4.5.8.0 and earlier allow remote attackers to cause a denial of service (crash) via a long string in the (1) request line or (2) HTTP Referer header to TCP port 54444, which triggers a heap-based buffer overflow.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://archives.neohapsis.com/archives/bugtraq/2013-01/0037.html; http://osvdb.org/89149; http://www.exploit-db.com/exploits/24022
CVE: CVE-2012-5877
Published: 2014-05-30
Description: Nero MediaHome 4.5.8.0 and earlier allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via an HTTP header without a name.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2013-01/0037.html; http://osvdb.org/89151; http://www.exploit-db.com/exploits/24022
CVE: CVE-2013-4143
Published: 2014-05-30
Description: The (1) checkPasswd and (2) checkGroupXlockPasswds functions in xlockmore before 5.43 do not properly handle when a NULL value is returned upon an error by the crypt or dispcrypt function as implemented in glibc 2.17 and later, which allows attackers to bypass the screen lock via vectors related to invalid salts.
CVSS Score: 2.1 (LOW)
References: http://openwall.com/lists/oss-security/2013/07/16/8; http://openwall.com/lists/oss-security/2013/07/18/6; http://www.tux.org/~bagleyd/xlock/xlockmore.README
CVE: CVE-2013-5919
Published: 2014-05-30
Description: Suricata before 1.4.6 allows remote attackers to cause a denial of service (crash) via a malformed SSL record.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/54968; http://suricata-ids.org/2013/09/24/suricata-1-4-6-released/; https://exchange.xforce.ibmcloud.com/vulnerabilities/87492
CVE: CVE-2013-6788
Published: 2014-05-30
Description: The Bitrix e-Store module before 14.0.1 for Bitrix Site Manager uses sequential values for the BITRIX_SM_SALE_UID cookie, which makes it easier for remote attackers to guess the cookie value and bypass authentication via a brute force attack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://secunia.com/advisories/56033; http://www.bitrixsoft.com/products/cms/versions.php?module=sale; http://www.securityfocus.com/bid/63606
CVE: CVE-2014-0202
Published: 2014-05-30
Description: The setup script in ovirt-engine-dwh, as used in the Red Hat Enterprise Virtualization Manager data warehouse (rhevm-dwh) package before 3.3.3, stores the history database password in cleartext, which allows local users to obtain sensitive information by reading an unspecified file.
CVSS Score: 2.1 (LOW)
CWE: CWE-255
References: http://rhn.redhat.com/errata/RHSA-2014-0559.html; http://rhn.redhat.com/errata/RHSA-2014-0559.html
CVE: CVE-2014-3780
Published: 2014-05-30
Description: Unspecified vulnerability in Citrix VDI-In-A-Box 5.3.x before 5.3.8 and 5.4.x before 5.4.4 allows remote attackers to bypass authentication via unspecified vectors, related to a Java servlet.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://secunia.com/advisories/58431; http://support.citrix.com/article/CTX140779; http://www.securityfocus.com/bid/67687
CVE: CVE-2014-3921
Published: 2014-05-30
Description: Cross-site scripting (XSS) vulnerability in popup.php in the Simple Popup Images plugin for WordPress allows remote attackers to inject arbitrary web script or HTML via the z parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/126763/WordPress-Simple-Popup-Cross-Site-Scripting.html; http://www.securityfocus.com/bid/67562; http://packetstormsecurity.com/files/126763/WordPress-Simple-Popup-Cross-Site-Scripting.html
CVE: CVE-2014-3922
Published: 2014-05-30
Description: Cross-site scripting (XSS) vulnerability in Trend Micro InterScan Messaging Security Virtual Appliance 8.5.1.1516 allows remote authenticated users to inject arbitrary web script or HTML via the addWhiteListDomainStr parameter to addWhiteListDomain.imss.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/126847/InterScan-Messaging-Security-Virtual-Appliance-8.5.1.1516-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2014/May/164; http://secunia.com/advisories/58491
CVE: CVE-2014-3923
Published: 2014-05-30
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Digital Zoom Studio (DZS) Video Gallery plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via the logoLink parameter to (1) preview.swf, (2) preview_skin_rouge.swf, (3) preview_allchars.swf, or (4) preview_skin_overlay.swf in deploy/.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2014/May/157; http://websecurity.com.ua/7183; http://seclists.org/fulldisclosure/2014/May/157
CVE: CVE-2014-3924
Published: 2014-05-30
Description: Multiple cross-site scripting (XSS) vulnerabilities in Webmin before 1.690 and Usermin before 1.600 allow remote attackers to inject arbitrary web script or HTML via vectors related to popup windows.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/58917; http://secunia.com/advisories/58919; http://www.securityfocus.com/bid/67647
CVE: CVE-2014-3010
Published: 2014-05-30
Description: Cross-site scripting (XSS) vulnerability in the Web UI in IBM WebSphere Service Registry and Repository (WSRR) 6.2, 6.3 before 6.3.0.6, 7.0 before 7.0.0.6, 7.5 before 7.5.0.5, and 8.0 before 8.0.0.3 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/58949; http://www-01.ibm.com/support/docview.wss?uid=swg1IV56254; http://www-01.ibm.com/support/docview.wss?uid=swg21672829
CVE: CVE-2014-3227
Published: 2014-05-30
Description: dpkg 1.15.9, 1.16.x before 1.16.14, and 1.17.x before 1.17.9 expect the patch program to be compliant with a need for the "C-style encoded filenames" feature, but is supported in environments with noncompliant patch programs, which triggers an interaction error that allows remote attackers to conduct directory traversal attacks and modify files outside of the intended directories via a crafted source package. NOTE: this vulnerability exists because of reliance on unrealistic constraints on the behavior of an external program.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-22
References: http://openwall.com/lists/oss-security/2014/04/29/4; http://openwall.com/lists/oss-security/2014/05/29/16; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=746306
CVE: CVE-2014-3864
Published: 2014-05-30
Description: Directory traversal vulnerability in dpkg-source in dpkg-dev 1.3.0 allows remote attackers to modify files outside of the intended directories via a crafted source package that lacks a --- header line.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-22
References: http://openwall.com/lists/oss-security/2014/05/25/2; http://www.debian.org/security/2014/dsa-2953; http://www.securityfocus.com/bid/67725
CVE: CVE-2014-3865
Published: 2014-05-30
Description: Multiple directory traversal vulnerabilities in dpkg-source in dpkg-dev 1.3.0 allow remote attackers to modify files outside of the intended directories via a source package with a crafted Index: pseudo-header in conjunction with (1) missing --- and +++ header lines or (2) a +++ header line with a blank pathname.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-22
References: http://openwall.com/lists/oss-security/2014/05/25/2; http://www.debian.org/security/2014/dsa-2953; http://www.securityfocus.com/bid/67727
CVE: CVE-2014-0925
Published: 2014-05-30
Description: Open redirect vulnerability in IBM Sterling Control Center 5.4.0 before 5.4.0.1 iFix 3 and 5.4.1 before 5.4.1.0 iFix 2 allows remote authenticated users to redirect users to arbitrary web sites and conduct phishing attacks via a crafted URL.
CVSS Score: 3.5 (LOW)
References: http://www-01.ibm.com/support/docview.wss?uid=swg21673004; https://exchange.xforce.ibmcloud.com/vulnerabilities/92078; http://www-01.ibm.com/support/docview.wss?uid=swg21673004
CVE: CVE-2013-6744
Published: 2014-05-30
Description: The Stored Procedure infrastructure in IBM DB2 9.5, 9.7 before FP9a, 10.1 before FP3a, and 10.5 before FP3a on Windows allows remote authenticated users to gain privileges by leveraging the CONNECT privilege and the CREATE_EXTERNAL_ROUTINE authority.
CVSS Score: 8.5 (HIGH)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IC98849; http://www-01.ibm.com/support/docview.wss?uid=swg1IC99478; http://www-01.ibm.com/support/docview.wss?uid=swg1IC99480
CVE: CVE-2014-0907
Published: 2014-05-30
Description: Multiple untrusted search path vulnerabilities in unspecified (1) setuid and (2) setgid programs in IBM DB2 9.5, 9.7 before FP9a, 9.8, 10.1 before FP3a, and 10.5 before FP3a on Linux and UNIX allow local users to gain root privileges via a Trojan horse library.
CVSS Score: 7.2 (HIGH)
References: http://packetstormsecurity.com/files/126940/IBM-DB2-Privilege-Escalation.html; http://seclists.org/fulldisclosure/2014/Jun/7; http://secunia.com/advisories/59451
CVE: CVE-2014-2342
Published: 2014-05-30
Description: Triangle MicroWorks SCADA Data Gateway before 3.00.0635 allows remote attackers to cause a denial of service (excessive data processing) via a crafted DNP3 packet.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-400, CWE-20
References: http://www.trianglemicroworks.com/products/scada-data-gateway/what%27s-new; https://www.cisa.gov/news-events/ics-advisories/icsa-14-149-01; http://ics-cert.us-cert.gov/advisories/ICSA-14-149-01
CVE: CVE-2014-2343
Published: 2014-05-30
Description: Triangle MicroWorks SCADA Data Gateway before 3.00.0635 allows physically proximate attackers to cause a denial of service (excessive data processing) via a crafted DNP request over a serial line.
CVSS Score: 1.2 (LOW)
CWE: CWE-400, CWE-20
References: http://www.trianglemicroworks.com/products/scada-data-gateway/what%27s-new; https://www.cisa.gov/news-events/ics-advisories/icsa-14-149-01; http://ics-cert.us-cert.gov/advisories/ICSA-14-149-01
CVE: CVE-2014-2352
Published: 2014-05-30
Description: The directory specifier can include designators that can be used to 
traverse the directory path. Exploiting this vulnerability may enable an
 attacker to access a limited number of hardcoded file types. Further 
exploitation of this vulnerability may allow an attacker to cause the 
web server component to enter a denial-of-service condition.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22, CWE-22
References: http://cogentdatahub.com/Download_Software.html; https://www.cisa.gov/news-events/ics-advisories/icsa-14-149-02; http://ics-cert.us-cert.gov/advisories/ICSA-14-149-02
CVE: CVE-2014-2353
Published: 2014-05-30
Description: Cross-site scripting (XSS) vulnerability in Cogent DataHub before 7.3.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 7.1 (HIGH)
CWE: CWE-80, CWE-79
References: http://cogentdatahub.com/Download_Software.html; https://www.cisa.gov/news-events/ics-advisories/icsa-14-149-02; http://ics-cert.us-cert.gov/advisories/ICSA-14-149-02
CVE: CVE-2014-2354
Published: 2014-05-30
Description: Cogent DataHub before 7.3.5 does not use a salt during password hashing, which makes it easier for context-dependent attackers to obtain cleartext passwords via a brute-force attack.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-916, CWE-255
References: http://cogentdatahub.com/Download_Software.html; https://www.cisa.gov/news-events/ics-advisories/icsa-14-149-02; http://ics-cert.us-cert.gov/advisories/ICSA-14-149-02
CVE: CVE-2014-0075
Published: 2014-05-31
Description: Integer overflow in the parseChunkHeader function in java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 allows remote attackers to cause a denial of service (resource consumption) via a malformed chunk size in chunked transfer coding of a request during the streaming of data.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://advisories.mageia.org/MGASA-2014-0268.html; http://linux.oracle.com/errata/ELSA-2014-0865.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-February/150282.html
CVE: CVE-2014-0095
Published: 2014-05-31
Description: java/org/apache/coyote/ajp/AbstractAjpProcessor.java in Apache Tomcat 8.x before 8.0.4 allows remote attackers to cause a denial of service (thread consumption) by using a "Content-Length: 0" AJP request to trigger a hang in request processing.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://seclists.org/fulldisclosure/2014/May/134; http://secunia.com/advisories/59873; http://secunia.com/advisories/60729
CVE: CVE-2014-0096
Published: 2014-05-31
Description: java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 does not properly restrict XSLT stylesheets, which allows remote attackers to bypass security-manager restrictions and read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://advisories.mageia.org/MGASA-2014-0268.html; http://linux.oracle.com/errata/ELSA-2014-0865.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-February/150282.html
CVE: CVE-2014-0099
Published: 2014-05-31
Description: Integer overflow in java/org/apache/tomcat/util/buf/Ascii.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4, when operated behind a reverse proxy, allows remote attackers to conduct HTTP request smuggling attacks via a crafted Content-Length HTTP header.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-189
References: http://advisories.mageia.org/MGASA-2014-0268.html; http://linux.oracle.com/errata/ELSA-2014-0865.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-February/150282.html
CVE: CVE-2014-0119
Published: 2014-05-31
Description: Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loader that accesses the XML parser used with an XSLT stylesheet, which allows remote attackers to (1) read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, or (2) read files associated with different web applications on a single Tomcat instance via a crafted web application.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://advisories.mageia.org/MGASA-2014-0268.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]5317&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1440&w=2
CVE: CVE-2014-3793
Published: 2014-05-31
Description: VMware Tools in VMware Workstation 10.x before 10.0.2, VMware Player 6.x before 6.0.2, VMware Fusion 6.x before 6.0.3, and VMware ESXi 5.0 through 5.5, when a Windows 8.1 guest OS is used, allows guest OS users to gain guest OS privileges or cause a denial of service (kernel NULL pointer dereference and guest OS crash) via unspecified vectors.
CVSS Score: 5.8 (MEDIUM)
References: http://packetstormsecurity.com/files/126869/VMware-Security-Advisory-2014-0005.html; http://secunia.com/advisories/58894; http://www.securityfocus.com/archive/1/532236/100/0/threaded
CVE: CVE-2014-0237
Published: 2014-06-01
Description: The cdf_unpack_summary_info function in cdf.c in the Fileinfo component in PHP before 5.4.29 and 5.5.x before 5.5.13 allows remote attackers to cause a denial of service (performance degradation) by triggering many file_printf calls.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2014-07/msg00002.html; http://rhn.redhat.com/errata/RHSA-2014-1765.html
CVE: CVE-2014-0238
Published: 2014-06-01
Description: The cdf_read_property_info function in cdf.c in the Fileinfo component in PHP before 5.4.29 and 5.5.x before 5.5.13 allows remote attackers to cause a denial of service (infinite loop or out-of-bounds memory access) via a vector that (1) has zero length or (2) is too long.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2014-07/msg00002.html; http://rhn.redhat.com/errata/RHSA-2014-1765.html
CVE: CVE-2014-3790
Published: 2014-06-01
Description: Ruby vSphere Console (RVC) in VMware vCenter Server Appliance allows remote authenticated users to execute arbitrary commands as root by escaping from a chroot jail.
CVSS Score: 9.0 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/58823; http://www.securityfocus.com/bid/67756; http://www.securitytracker.com/id/1030436
CVE: CVE-2014-3925
Published: 2014-06-01
Description: sosreport in Red Hat sos 1.7 and earlier on Red Hat Enterprise Linux (RHEL) 5 produces an archive with an fstab file potentially containing cleartext passwords, and lacks a warning about reviewing this archive to detect included passwords, which might allow remote attackers to obtain sensitive information by leveraging access to a technical-support data stream.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-255
References: http://openwall.com/lists/oss-security/2014/05/29/6; http://openwall.com/lists/oss-security/2014/05/30/3; http://www.ubuntu.com/usn/USN-2845-1
CVE: CVE-2014-3932
Published: 2014-06-02
Description: SQL injection vulnerability in the device registration component in wsf/webservice.php in CoSoSys Endpoint Protector 4 4.3.0.4 and 4.4.0.2 allows remote attackers to execute arbitrary SQL commands via unspecified parameters.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/58878; https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140521-CoSoSys_Endpoint_Protector_Multiple_Vulnerabilities_v10_wo_poc.txt; http://secunia.com/advisories/58878
CVE: CVE-2014-3933
Published: 2014-06-02
Description: Cross-site scripting (XSS) vulnerability in the address components field formatter in the AddressField Tokens module 7.x-1.x before 7.x-1.4 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via an address field.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://secunia.com/advisories/58399; http://www.securityfocus.com/bid/67545; https://drupal.org/node/2267475
CVE: CVE-2014-3934
Published: 2014-06-02
Description: SQL injection vulnerability in the Submit_News module for PHP-Nuke 8.3 allows remote attackers to execute arbitrary SQL commands via the topics[] parameter to modules.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/126803/phpnuke83news-sql.txt; http://www.securityfocus.com/bid/67656; http://packetstormsecurity.com/files/126803/phpnuke83news-sql.txt
CVE: CVE-2014-3935
Published: 2014-06-02
Description: SQL injection vulnerability in glossaire-aff.php in the Glossaire module 1.0 for XOOPS allows remote attackers to execute arbitrary SQL commands via the lettre parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/126701; http://www.securityfocus.com/bid/67460; http://packetstormsecurity.com/files/126701
CVE: CVE-2014-3936
Published: 2014-06-02
Description: Stack-based buffer overflow in the do_hnap function in www/my_cgi.cgi in D-Link DSP-W215 (Rev. A1) with firmware 1.01b06 and earlier, DIR-505 with firmware before 1.08b10, and DIR-505L with firmware 1.01 and earlier allows remote attackers to execute arbitrary code via a long Content-Length header in a GetDeviceSettings action in an HNAP request.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://packetstormsecurity.com/files/127427/D-Link-HNAP-Request-Remote-Buffer-Overflow.html; http://secunia.com/advisories/58728; http://secunia.com/advisories/58972
CVE: CVE-2011-5280
Published: 2014-06-02
Description: Multiple stack-based buffer overflows in BOINC 6.13.x allow remote attackers to cause a denial of service (crash) via a long trickle-up to (1) client/cs_trickle.cpp or (2) db/db_base.cpp.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://boinc.berkeley.edu/gitweb/?p=boinc-v2.git%3Ba=commitdiff%3Bh=5b04b249db166ec38c1ee99a9eadcaa300c0f454; http://boinc.berkeley.edu/gitweb/?p=boinc-v2.git%3Ba=commitdiff%3Bh=ae04b50a71f3e96ee1bc59b76fca97cf0fe976f7; http://www.openwall.com/lists/oss-security/2013/04/28/3
CVE: CVE-2012-5391
Published: 2014-06-02
Description: Session fixation vulnerability in Special:UserLogin in MediaWiki before 1.18.6, 1.19.x before 1.19.3, and 1.20.x before 1.20.1 allows remote attackers to hijack web sessions via the session_id.
CVSS Score: 6.8 (MEDIUM)
References: http://lists.fedoraproject.org/pipermail/package-announce/2013-February/098975.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-March/100843.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-March/100845.html
CVE: CVE-2012-5395
Published: 2014-06-02
Description: Session fixation vulnerability in the CentralAuth extension for MediaWiki before 1.18.6, 1.19.x before 1.19.3, and 1.20.x before 1.20.1 allows remote attackers to hijack web sessions via the centralauth_Session cookie.
CVSS Score: 6.8 (MEDIUM)
References: http://lists.wikimedia.org/pipermail/mediawiki-announce/2012-November/000122.html; https://bugzilla.wikimedia.org/show_bug.cgi?id=40962; http://lists.wikimedia.org/pipermail/mediawiki-announce/2012-November/000122.html
CVE: CVE-2013-1348
Published: 2014-06-02
Description: The Yaml::parse function in Symfony 2.0.x before 2.0.22 remote attackers to execute arbitrary PHP code via a PHP file, a different vulnerability than CVE-2013-1397.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/51980; http://symfony.com/blog/security-release-symfony-2-0-22-and-2-1-7-released; http://www.securityfocus.com/bid/57574
CVE: CVE-2013-1397
Published: 2014-06-02
Description: Symfony 2.0.x before 2.0.22, 2.1.x before 2.1.7, and 2.2.x remote attackers to execute arbitrary PHP code via a serialized PHP object to the (1) Yaml::parse or (2) Yaml\Parser::parse function, a different vulnerability than CVE-2013-1348.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/51980; http://symfony.com/blog/security-release-symfony-2-0-22-and-2-1-7-released; http://www.securityfocus.com/bid/57574
CVE: CVE-2013-1412
Published: 2014-06-02
Description: DataLife Engine (DLE) 9.7 allows remote attackers to execute arbitrary PHP code via the catlist[] parameter to engine/preview.php, which is used in a preg_replace function call with an e modifier.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://archives.neohapsis.com/archives/bugtraq/2013-01/0117.html; http://dleviet.com/dle/bug-fix/3281-security-patches-for-dle-97.html; http://karmainsecurity.com/KIS-2013-01
CVE: CVE-2013-1818
Published: 2014-06-02
Description: maintenance/mwdoc-filter.php in MediaWiki before 1.20.3 allows remote attackers to read arbitrary files via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www.mediawiki.org/wiki/Release_notes/1.20; http://www.securityfocus.com/bid/58304; https://bugzilla.wikimedia.org/show_bug.cgi?id=45355
CVE: CVE-2013-2014
Published: 2014-06-02
Description: OpenStack Identity (Keystone) before 2013.1 allows remote attackers to cause a denial of service (memory consumption and crash) via multiple long requests.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://lists.fedoraproject.org/pipermail/package-announce/2013-July/111914.html; http://secunia.com/advisories/53397; http://www.securityfocus.com/bid/59936