deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-4856
Published: 2014-07-10
Description: Cross-site scripting (XSS) vulnerability in the Polldaddy Polls & Ratings plugin before 2.0.25 for WordPress allows remote attackers to inject arbitrary web script or HTML via vectors related to a ratings shortcode and a unique ID.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/59323; http://wordpress.org/plugins/polldaddy/changelog; http://secunia.com/advisories/59323
CVE: CVE-2014-4907
Published: 2014-07-11
Description: Cross-site scripting (XSS) vulnerability in share/pnp/application/views/kohana_error_page.php in PNP4Nagios before 0.6.22 allows remote attackers to inject arbitrary web script or HTML via a parameter that is not properly handled in an error message.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://docs.pnp4nagios.org/pnp-0.6/dwnld; http://openwall.com/lists/oss-security/2014/07/11/3; http://secunia.com/advisories/59535
CVE: CVE-2014-4908
Published: 2014-07-11
Description: Multiple cross-site scripting (XSS) vulnerabilities in PNP4Nagios through 0.6.22 allow remote attackers to inject arbitrary web script or HTML via the URI used for reaching (1) share/pnp/application/views/kohana_error_page.php or (2) share/pnp/application/views/template.php, leading to improper handling within an http-equiv="refresh" META element.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://openwall.com/lists/oss-security/2014/07/11/3; http://secunia.com/advisories/58973; http://www.securityfocus.com/bid/68352
CVE: CVE-2014-0174
Published: 2014-07-11
Description: Cumin (aka MRG Management Console), as used in Red Hat Enterprise MRG 2.5, does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://rhn.redhat.com/errata/RHSA-2014-0858.html; http://rhn.redhat.com/errata/RHSA-2014-0859.html; http://rhn.redhat.com/errata/RHSA-2014-0858.html
CVE: CVE-2014-3485
Published: 2014-07-11
Description: The REST API in the ovirt-engine in oVirt, as used in Red Hat Enterprise Virtualization (rhevm) 3.4, allows remote authenticated users to read arbitrary files and have other unspecified impact via unknown vectors, related to an XML External Entity (XXE) issue.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://rhn.redhat.com/errata/RHSA-2014-0814.html; http://www.securitytracker.com/id/1030501; http://rhn.redhat.com/errata/RHSA-2014-0814.html
CVE: CVE-2014-3499
Published: 2014-07-11
Description: Docker 1.0.0 uses world-readable and world-writable permissions on the management socket, which allows local users to gain privileges via unspecified vectors.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://rhn.redhat.com/errata/RHSA-2014-0820.html; https://bugzilla.redhat.com/show_bug.cgi?id=1111687; http://rhn.redhat.com/errata/RHSA-2014-0820.html
CVE: CVE-2014-3503
Published: 2014-07-11
Description: Apache Syncope 1.1.x before 1.1.8 uses weak random values to generate passwords, which makes it easier for remote attackers to guess the password via a brute force attack.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://packetstormsecurity.com/files/127375/Apache-Syncope-Insecure-Password-Generation.html; http://syncope.apache.org/security.html; http://www.securityfocus.com/archive/1/532669/100/0/threaded
CVE: CVE-2014-3991
Published: 2014-07-11
Description: Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr ERP/CRM 3.5.3 allow remote attackers to inject arbitrary web script or HTML via the (1) dol_use_jmobile, (2) dol_optimize_smallscreen, (3) dol_no_mouse_hover, (4) dol_hide_topmenu, (5) dol_hide_leftmenu, (6) mainmenu, or (7) leftmenu parameter to index.php; the (8) dol_use_jmobile, (9) dol_optimize_smallscreen, (10) dol_no_mouse_hover, (11) dol_hide_topmenu, or (12) dol_hide_leftmenu parameter to user/index.php; the (13) dol_use_jmobile, (14) dol_optimize_smallscreen, (15) dol_no_mouse_hover, (16) dol_hide_topmenu, or (17) dol_hide_leftmenu parameter to user/logout.php; the (18) email, (19) firstname, (20) job, (21) lastname, or (22) login parameter in an update action in a "User Card" to user/fiche.php; or the (23) modulepart or (24) file parameter to viewimage.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/127389/Dolibarr-CMS-3.5.3-SQL-Injection-Cross-Site-Scripting.html; http://packetstormsecurity.com/files/127389/Dolibarr-CMS-3.5.3-SQL-Injection-Cross-Site-Scripting.html
CVE: CVE-2014-3992
Published: 2014-07-11
Description: Multiple SQL injection vulnerabilities in Dolibarr ERP/CRM 3.5.3 allow remote authenticated users to execute arbitrary SQL commands via the (1) entity parameter in an update action to user/fiche.php or (2) sortorder parameter to user/group/index.php.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://packetstormsecurity.com/files/127389/Dolibarr-CMS-3.5.3-SQL-Injection-Cross-Site-Scripting.html; http://packetstormsecurity.com/files/127389/Dolibarr-CMS-3.5.3-SQL-Injection-Cross-Site-Scripting.html
CVE: CVE-2014-4167
Published: 2014-07-11
Description: The L3-agent in OpenStack Neutron before 2013.2.4, 2014.x before 2014.1.2, and Juno before Juno-2 allows remote authenticated users to cause a denial of service (IPv4 address attachment outage) by attaching an IPv6 private subnet to a L3 router.
CVSS Score: 3.5 (LOW)
CWE: CWE-264
References: http://seclists.org/oss-sec/2014/q2/572; http://secunia.com/advisories/59533; http://www.ubuntu.com/usn/USN-2255-1
CVE: CVE-2014-4700
Published: 2014-07-11
Description: Citrix XenDesktop 7.x, 5.x, and 4.x, when pooled random desktop groups is enabled and ShutdownDesktopsAfterUse is disabled, allows local guest users to gain access to another user's desktop via unspecified vectors.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/59889; http://support.citrix.com/article/CTX139591; http://www.securityfocus.com/bid/68530
CVE: CVE-2013-6117
Published: 2014-07-11
Description: Dahua DVR 2.608.0000.0 and 2.608.GV00.0 allows remote attackers to bypass authentication and obtain sensitive information including user credentials, change user passwords, clear log files, and perform other actions via a request to TCP port 37777.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://blog.depthsecurity.com/2013/11/dahua-dvr-authentication-bypass-cve.html; http://packetstormsecurity.com/files/124022/Dahua-DVR-Authentication-Bypass.html; http://seclists.org/bugtraq/2013/Nov/62
CVE: CVE-2014-3815
Published: 2014-07-11
Description: Juniper Junos 12.1X46 before 12.1X46-D20 and 12.1X47 before 12.1X47-D10 on SRX Series devices allows remote attackers to cause a denial of service (flowd crash) via a crafted SIP packet.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/68551; http://www.securitytracker.com/id/1030557; https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10633
CVE: CVE-2014-3816
Published: 2014-07-11
Description: Juniper Junos 11.4 before 11.4R12, 12.1 before 12.1R11, 12.1X44 before 12.1X44-D35, 12.1X45 before 12.1X45-D30, 12.1X46 before 12.1X46-D20, 12.1X47 before 12.1X47-D10, 12.2 before 12.2R8-S2, 12.3 before 12.3R7, 13.1 before 13.1R4-S2, 13.2 before 13.2R5, 13.3 before 13.3R2-S2, and 14.1 before 14.1R1 allows remote authenticated users to gain privileges via unspecified combinations of CLI commands and arguments.
CVSS Score: 9.0 (HIGH)
CWE: CWE-264
References: http://www.securitytracker.com/id/1030559; https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10634; http://www.securitytracker.com/id/1030559
CVE: CVE-2014-3817
Published: 2014-07-11
Description: Juniper Junos 11.4 before 11.4R12, 12.1X44 before 12.1X44-D32, 12.1X45 before 12.1X45-D25, 12.1X46 before 12.1X46-D20, and 12.1X47 before 12.1X47-D10 on SRX Series devices, when NAT protocol translation from IPv4 to IPv6 is enabled, allows remote attackers to cause a denial of service (flowd hang or crash) via a crafted packet.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://secunia.com/advisories/59136; http://www.securityfocus.com/bid/68545; http://www.securitytracker.com/id/1030558
CVE: CVE-2014-3819
Published: 2014-07-11
Description: Juniper Junos 11.4 before 11.4R12, 12.1 before 12.1R10, 12.1X44 before 12.1X44-D35, 12.1X45 before 12.1X45-D25, 12.1X46 before 12.1X46-D20, 12.1X47 before 12.1X47-D10, 12.2 before 12.2R8, 12.3 before 12.3R7, 13.1 before 13.1R4, 13.2 before 13.2R4, 13.3 before 13.3R2, and 14.1 before 14.1R1, when Auto-RP is enabled, allows remote attackers to cause a denial of service (RDP routing process crash and restart) via a malformed PIM packet.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/68539; http://www.securitytracker.com/id/1030561; https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10637
CVE: CVE-2014-3821
Published: 2014-07-11
Description: Cross-site scripting (XSS) vulnerability in SRX Web Authentication (webauth) in Juniper Junos 11.4 before 11.4R11, 12.1X44 before 12.1X44-D34, 12.1X45 before 12.1X45-D25, 12.1X46 before 12.1X46-D20, and 12.1X47 before 12.1X47-D10 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/68548; http://www.securitytracker.com/id/1030563; https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10640
CVE: CVE-2014-3822
Published: 2014-07-11
Description: Juniper Junos 11.4 before 11.4R8, 12.1 before 12.1R5, 12.1X44 before 12.1X44-D20, 12.1X45 before 12.1X45-D15, 12.1X46 before 12.1X46-D10, and 12.1X47 before 12.1X47-D10 on SRX Series devices, allows remote attackers to cause a denial of service (flowd crash) via a malformed packet, related to translating IPv6 to IPv4.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-20
References: http://www.securitytracker.com/id/1030560; https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10641; http://www.securitytracker.com/id/1030560
CVE: CVE-2014-4738
Published: 2014-07-11
Description: Multiple cross-site scripting (XSS) vulnerabilities in FortiGuard FortiWeb 5.0.x, 5.1.x, and 5.2.x before 5.2.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors to (1) user/ldap_user/check_dlg or (2) user/radius_user/check_dlg.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/59882; http://www.fortiguard.com/advisory/FG-IR-14-012/; http://www.securityfocus.com/bid/68528
CVE: CVE-2014-4937
Published: 2014-07-11
Description: Directory traversal vulnerability in includes/bookx_export.php BookX plugin 1.7 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://codevigilant.com/disclosure/wp-plugin-bookx-local-file-inclusion/; http://codevigilant.com/disclosure/wp-plugin-bookx-local-file-inclusion/
CVE: CVE-2014-4938
Published: 2014-07-11
Description: SQL injection vulnerability in the WP Rss Poster (wp-rss-poster) plugin 1.0.0 for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter in the wrp-add-new page to wp-admin/admin.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://codevigilant.com/disclosure/wp-plugin-wp-rss-poster-a1-injection/; http://codevigilant.com/disclosure/wp-plugin-wp-rss-poster-a1-injection/
CVE: CVE-2014-4939
Published: 2014-07-11
Description: SQL injection vulnerability in the ENL Newsletter (enl-newsletter) plugin 1.0.1 for WordPress allows remote authenticated administrators to execute arbitrary SQL commands via the id parameter in the enl-add-new page to wp-admin/admin.php.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://codevigilant.com/disclosure/wp-plugin-enl-newsletter-a1-injection/; http://codevigilant.com/disclosure/wp-plugin-enl-newsletter-a1-injection/
CVE: CVE-2014-4940
Published: 2014-07-11
Description: Multiple directory traversal vulnerabilities in Tera Charts (tera-charts) plugin 0.1 for WordPress allow remote attackers to read arbitrary files via a .. (dot dot) in the fn parameter to (1) charts/treemap.php or (2) charts/zoomabletreemap.php.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://codevigilant.com/disclosure/wp-plugin-tera-chart-local-file-inclusion/; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=851874%40tera-charts&old=799253%40tera-charts&sfp_email=&sfph_mail=; http://codevigilant.com/disclosure/wp-plugin-tera-chart-local-file-inclusion/
CVE: CVE-2014-4941
Published: 2014-07-11
Description: Absolute path traversal vulnerability in Cross-RSS (wp-cross-rss) plugin 1.7 for WordPress allows remote attackers to read arbitrary files via a full pathname in the rss parameter to proxy.php.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://codevigilant.com/disclosure/wp-plugin-cross-rss-local-file-inclusion/; http://codevigilant.com/disclosure/wp-plugin-cross-rss-local-file-inclusion/
CVE: CVE-2014-4942
Published: 2014-07-11
Description: The EasyCart (wp-easycart) plugin before 2.0.6 for WordPress allows remote attackers to obtain configuration information via a direct request to inc/admin/phpinfo.php, which calls the phpinfo function.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://codevigilant.com/disclosure/wp-plugin-wp-easycart-information-disclosure/; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=829290%40wp-easycart&old=827627%40wp-easycart&sfp_email=&sfph_mail=; http://codevigilant.com/disclosure/wp-plugin-wp-easycart-information-disclosure/
CVE: CVE-2014-4013
Published: 2014-07-14
Description: SQL injection vulnerability in the Policy Manager in Aruba Networks ClearPass 5.x, 6.0.x, 6.1.x through 6.1.4.61696, 6.2.x through 6.2.6.62196, and 6.3.x before 6.3.4 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/58936; http://www.arubanetworks.com/support/alerts/aid-07032014.txt; http://secunia.com/advisories/58936
CVE: CVE-2014-4944
Published: 2014-07-14
Description: Multiple SQL injection vulnerabilities in inc/bsk-pdf-dashboard.php in the BSK PDF Manager plugin 1.3.2 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the (1) categoryid or (2) pdfid parameter to wp-admin/admin.php.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://packetstormsecurity.com/files/127407/WordPress-BSK-PDF-Manager-1.3.2-SQL-Injection.html; http://www.securityfocus.com/bid/68488; http://packetstormsecurity.com/files/127407/WordPress-BSK-PDF-Manager-1.3.2-SQL-Injection.html
CVE: CVE-2014-4945
Published: 2014-07-14
Description: Multiple cross-site scripting (XSS) vulnerabilities in Horde Internet Mail Program (IMP) before 6.1.8, as used in Horde Groupware Webmail Edition before 5.1.5, allow remote attackers to inject arbitrary web script or HTML via an unspecified flag in the basic (1) mailbox or (2) message view.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.horde.org/archives/announce/2014/001019.html; http://lists.horde.org/archives/announce/2014/001025.html; http://secunia.com/advisories/59770
CVE: CVE-2014-4946
Published: 2014-07-14
Description: Multiple cross-site scripting (XSS) vulnerabilities in Horde Internet Mail Program (IMP) before 6.1.8, as used in Horde Groupware Webmail Edition before 5.1.5, allow remote attackers to inject arbitrary web script or HTML via (1) unspecified flags or (2) a mailbox name in the dynamic mailbox view.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.horde.org/archives/announce/2014/001019.html; http://lists.horde.org/archives/announce/2014/001025.html; http://secunia.com/advisories/59770
CVE: CVE-2013-5567
Published: 2014-07-14
Description: Cisco Adaptive Security Appliance (ASA) Software 8.4(.6) and earlier, when using an unsupported configuration with overlapping criteria for filtering and inspection, allows remote attackers to cause a denial of service (traffic loop and device crash) via a packet that triggers multiple matches, aka Bug ID CSCui45606.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-400
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-5567; http://tools.cisco.com/security/center/viewAlert.x?alertId=34911; http://www.securityfocus.com/bid/68504
CVE: CVE-2013-6691
Published: 2014-07-14
Description: The WebVPN CIFS implementation in Cisco Adaptive Security Appliance (ASA) Software 9.0(.4.1) and earlier allows remote CIFS servers to cause a denial of service (device reload) via a long share list, aka Bug ID CSCuj83344.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-6691; http://tools.cisco.com/security/center/viewAlert.x?alertId=34921; http://www.securityfocus.com/bid/68517
CVE: CVE-2014-2926
Published: 2014-07-14
Description: kapfa.sys in Kaseya Virtual System Administrator (VSA) 6.5 before 6.5.0.17 and 7.0 before 7.0.0.16 allows local users to cause a denial of service (NULL pointer dereference and application crash) via unspecified vectors.
CVSS Score: 1.7 (LOW)
References: http://www.kb.cert.org/vuls/id/204988; http://www.kb.cert.org/vuls/id/204988
CVE: CVE-2014-2950
Published: 2014-07-14
Description: Datum Systems SnIP on PSM-500 and PSM-4500 devices does not require authentication for FTP sessions, which allows remote attackers to obtain sensitive information via RETR commands.
CVSS Score: 7.8 (HIGH)
References: http://www.kb.cert.org/vuls/id/917348; http://www.kb.cert.org/vuls/id/917348
CVE: CVE-2014-2951
Published: 2014-07-14
Description: Datum Systems SnIP on PSM-500 and PSM-4500 devices has a hardcoded password of admin for the admin account, which makes it easier for remote attackers to obtain access via unspecified vectors.
CVSS Score: 10.0 (HIGH)
References: http://www.kb.cert.org/vuls/id/917348; http://www.kb.cert.org/vuls/id/917348
CVE: CVE-2014-2955
Published: 2014-07-14
Description: Raritan PX before 1.5.11 on DPXR20A-16 devices allows remote attackers to bypass authentication and execute arbitrary IPMI commands by using cipher suite 0 (aka cipher zero) and an arbitrary password.
CVSS Score: 10.0 (HIGH)
CWE: CWE-287
References: http://seclists.org/fulldisclosure/2014/Jul/14; http://www.kb.cert.org/vuls/id/712660; http://seclists.org/fulldisclosure/2014/Jul/14
CVE: CVE-2014-3317
Published: 2014-07-14
Description: Directory traversal vulnerability in the Multiple Analyzer in the Dialed Number Analyzer (DNA) component in Cisco Unified Communications Manager 10.0(1) allows remote authenticated users to delete arbitrary files via a crafted URL, aka Bug ID CSCup76314.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/59727; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3317; http://tools.cisco.com/security/center/viewAlert.x?alertId=34898
CVE: CVE-2014-3319
Published: 2014-07-14
Description: Directory traversal vulnerability in the Real-Time Monitoring Tool (RTMT) in Cisco Unified Communications Manager (CM) 10.0(1) allows remote authenticated users to read arbitrary files via a crafted URL, aka Bug ID CSCup57676.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/59734; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3319; http://tools.cisco.com/security/center/viewAlert.x?alertId=34909
CVE: CVE-2014-1474
Published: 2014-07-15
Description: Algorithmic complexity vulnerability in Email::Address::List before 0.02, as used in RT 4.2.0 through 4.2.2, allows remote attackers to cause a denial of service (CPU consumption) via a string without an address.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://blog.bestpractical.com/2014/01/security-vulnerability-in-rt-42.html; http://lists.bestpractical.com/pipermail/rt-announce/2014-June/000257.html; https://metacpan.org/changes/release/ALEXMV/Email-Address-List-0.02
CVE: CVE-2014-3418
Published: 2014-07-15
Description: config/userAdmin/login.tdf in Infoblox NetMRI before 6.8.5 allows remote attackers to execute arbitrary commands via shell metacharacters in the skipjackUsername parameter.
CVSS Score: 10.0 (HIGH)
CWE: CWE-78
References: http://blog.depthsecurity.com/2014/07/os-command-injection-in-infoblox-netmri.html; http://seclists.org/fulldisclosure/2014/Jul/35; http://www.exploit-db.com/exploits/34030
CVE: CVE-2014-3419
Published: 2014-07-15
Description: Infoblox NetMRI before 6.8.5 has a default password of admin for the "root" MySQL database account, which makes it easier for local users to obtain access via unspecified vectors.
CVSS Score: 7.2 (HIGH)
CWE: CWE-255
References: http://blog.depthsecurity.com/2014/07/os-command-injection-in-infoblox-netmri.html; http://packetstormsecurity.com/files/127410/Infoblox-6.8.4.x-Weak-MySQL-Password.html; http://www.securityfocus.com/archive/1/532710/100/0/threaded
CVE: CVE-2014-3952
Published: 2014-07-15
Description: FreeBSD 8.4 before p14, 9.1 before p17, 9.2 before p10, and 10.0 before p7 does not properly initialize the buffer between the header and data of a control message, which allows local users to obtain sensitive information from kernel memory via unspecified vectors.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-119
References: http://secunia.com/advisories/62218; http://www.debian.org/security/2014/dsa-3070; http://www.freebsd.org/security/advisories/FreeBSD-SA-14:17.kmem.asc
CVE: CVE-2014-3953
Published: 2014-07-15
Description: FreeBSD 8.4 before p14, 9.1 before p17, 9.2 before p10, and 10.0 before p7 does not properly initialize certain data structures, which allows local users to obtain sensitive information from kernel memory via a (1) SCTP_SNDRCV, (2) SCTP_EXTRCV, or (3) SCTP_RCVINFO SCTP cmsg or a (4) SCTP_PEER_ADDR_CHANGE, (5) SCTP_REMOTE_ERROR, or (6) SCTP_AUTHENTICATION_EVENT notification.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-119
References: http://secunia.com/advisories/62218; http://www.debian.org/security/2014/dsa-3070; http://www.freebsd.org/security/advisories/FreeBSD-SA-14:17.kmem.asc
CVE: CVE-2014-4031
Published: 2014-07-15
Description: The Policy Manager in Aruba Networks ClearPass 5.x, 6.0.x, 6.1.x through 6.1.4.61696, 6.2.x through 6.2.6.62196, and 6.3.x before 6.3.4 allows remote authenticated users to obtain database credentials via unspecified vectors.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://secunia.com/advisories/58936; http://www.arubanetworks.com/support/alerts/aid-07032014.txt; http://secunia.com/advisories/58936
CVE: CVE-2014-4663
Published: 2014-07-15
Description: TimThumb 2.8.13 and WordThumb 1.07, when Webshot (aka Webshots) is enabled, allows remote attackers to execute arbitrary commands via shell metacharacters in the src parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://packetstormsecurity.com/files/127192/TimThumb-2.8.13-Remote-Code-Execution.html; http://seclists.org/fulldisclosure/2014/Jul/4; http://seclists.org/fulldisclosure/2014/Jun/117
CVE: CVE-2014-4962
Published: 2014-07-15
Description: Shopizer 1.1.5 and earlier allows remote attackers to reduce the total cost of their shopping cart via a negative number in the productQuantity parameter, which causes the price of the item to be subtracted from the total cost.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-189
References: http://seclists.org/fulldisclosure/2014/Jul/38; http://www.securityfocus.com/archive/1/532726/100/0/threaded; http://seclists.org/fulldisclosure/2014/Jul/38
CVE: CVE-2014-4963
Published: 2014-07-15
Description: Shopizer 1.1.5 and earlier allows remote attackers to modify the account settings of arbitrary users via the customer.customerId parameter to shop/profile/register.action.
CVSS Score: 6.8 (MEDIUM)
References: http://seclists.org/fulldisclosure/2014/Jul/38; http://www.securityfocus.com/archive/1/532726/100/0/threaded; http://seclists.org/fulldisclosure/2014/Jul/38