deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-0213
Published: 2014-05-27
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in mod/assign/locallib.php in the Assignment subsystem in Moodle through 2.3.11, 2.4.x before 2.4.10, 2.5.x before 2.5.6, and 2.6.x before 2.6.3 allow remote attackers to hijack the authentication of teachers for quick-grading requests.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-44606; http://openwall.com/lists/oss-security/2014/05/19/1; https://moodle.org/mod/forum/discuss.php?d=260361
CVE: CVE-2014-0214
Published: 2014-05-27
Description: login/token.php in Moodle through 2.3.11, 2.4.x before 2.4.10, 2.5.x before 2.5.6, and 2.6.x before 2.6.3 creates a MoodleMobile web-service token with an infinite lifetime, which makes it easier for remote attackers to hijack sessions via a brute-force attack.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-43119; http://openwall.com/lists/oss-security/2014/05/19/1; https://moodle.org/mod/forum/discuss.php?d=260362
CVE: CVE-2014-0215
Published: 2014-05-27
Description: The blind-marking implementation in Moodle through 2.3.11, 2.4.x before 2.4.10, 2.5.x before 2.5.6, and 2.6.x before 2.6.3 allows remote authenticated users to de-anonymize student identities by (1) using a screen reader or (2) reading the HTML source.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-44750; http://openwall.com/lists/oss-security/2014/05/19/1; https://moodle.org/mod/forum/discuss.php?d=260363
CVE: CVE-2014-0216
Published: 2014-05-27
Description: The My Home implementation in the block_html_pluginfile function in blocks/html/lib.php in Moodle through 2.3.11, 2.4.x before 2.4.10, 2.5.x before 2.5.6, and 2.6.x before 2.6.3 does not properly restrict file access, which allows remote attackers to obtain sensitive information by visiting an HTML block.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-43877; http://openwall.com/lists/oss-security/2014/05/19/1; https://moodle.org/mod/forum/discuss.php?d=260364
CVE: CVE-2014-0217
Published: 2014-05-27
Description: enrol/index.php in Moodle 2.6.x before 2.6.3 does not check for the moodle/course:viewhiddencourses capability before listing hidden courses, which allows remote attackers to obtain sensitive name and summary information about these courses by leveraging the guest role and visiting a crafted URL.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-45126; http://openwall.com/lists/oss-security/2014/05/19/1; https://moodle.org/mod/forum/discuss.php?d=260365
CVE: CVE-2014-0218
Published: 2014-05-27
Description: Cross-site scripting (XSS) vulnerability in the URL downloader repository in repository/url/lib.php in Moodle through 2.3.11, 2.4.x before 2.4.10, 2.5.x before 2.5.6, and 2.6.x before 2.6.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-45332; http://openwall.com/lists/oss-security/2014/05/19/1; http://www.securityfocus.com/bid/67479
CVE: CVE-2014-2720
Published: 2014-05-27
Description: IZArc 4.1.8 displays a file's name on the basis of a ZIP archive's Central Directory entry, but launches this file on the basis of a ZIP archive's local file header, which allows user-assisted remote attackers to conduct file-extension spoofing attacks via a modified Central Directory, as demonstrated by unintended code execution prompted by a .jpg extension in the Central Directory and a .exe extension in the local file header.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://www.xchg.info/?p=418; http://www.xchg.info/?p=418
CVE: CVE-2014-3840
Published: 2014-05-27
Description: Multiple cross-site scripting (XSS) vulnerabilities in apps/common/templates/calculate_form_title.html in Mayan EDMS 0.13 allow remote authenticated users to inject arbitrary web script or HTML via a (1) tag or the (2) title of a source in a Staging folder, (3) Name field in a bootstrap setup, or Title field in a (4) smart link or (5) web form.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://research.openflare.org/advisories/OF-2014-09/mayan-edbs-storedxss.txt; http://research.openflare.org/poc/maya-edms/maya-edms_multiple_xss.avi; http://seclists.org/oss-sec/2014/q2/349
CVE: CVE-2014-3870
Published: 2014-05-27
Description: Cross-site scripting (XSS) vulnerability in the bib2html plugin 0.9.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the styleShortName parameter in an adminStyleAdd action to OSBiB/create/index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/126782/wpbib2html-xss.txt; http://www.securityfocus.com/bid/67589; http://packetstormsecurity.com/files/126782/wpbib2html-xss.txt
CVE: CVE-2014-3871
Published: 2014-05-27
Description: Multiple SQL injection vulnerabilities in register.php in Geodesic Solutions GeoCore MAX 7.3.3 (formerly GeoClassifieds and GeoAuctions) allow remote attackers to execute arbitrary SQL commands via the (1) c[password] or (2) c[username] parameter.  NOTE: the b parameter to index.php vector is already covered by CVE-2006-3823.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://geodesicsolutions.com/changelog/7.3/changelog.html; http://osvdb.org/show/osvdb/106364; http://packetstormsecurity.com/files/126329/GeoCore-MAX-DB-7.3.3-Blind-SQL-Injection.html
CVE: CVE-2014-3872
Published: 2014-05-27
Description: Multiple SQL injection vulnerabilities in the administration login page in D-Link DAP-1350 (Rev. A1) with firmware 1.14 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) password.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/58254; http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10023; http://www.securityfocus.com/bid/67310
CVE: CVE-2012-5662
Published: 2014-05-27
Description: x3270 before 3.3.12ga12 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-310
References: http://osvdb.org/91572; http://secunia.com/advisories/52650; http://sourceforge.net/projects/x3270/files/x3270/3.3.12ga12/
CVE: CVE-2012-6452
Published: 2014-05-27
Description: Axway Secure Messenger before 6.5 Updated Release 7, as used in Axway Email Firewall, provides different responses to authentication requests depending on whether the user exists, which allows remote attackers to enumerate users via a series of requests.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-287
References: http://archives.neohapsis.com/archives/bugtraq/2013-01/0076.html; http://www.securityfocus.com/bid/57457; https://exchange.xforce.ibmcloud.com/vulnerabilities/81388
CVE: CVE-2013-0724
Published: 2014-05-27
Description: PHP remote file inclusion vulnerability in includes/generate-pdf.php in the WP ecommerce Shop Styling plugin for WordPress before 1.8 allows remote attackers to execute arbitrary PHP code via a URL in the dompdf parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://osvdb.org/89921; http://secunia.com/advisories/51707; http://wordpress.org/plugins/wp-ecommerce-shop-styling/changelog/
CVE: CVE-2013-1883
Published: 2014-05-27
Description: Mantis Bug Tracker (aka MantisBT) 1.2.12 before 1.2.15 allows remote attackers to cause a denial of service (resource consumption) via a filter using a criteria, text search, and the "any condition" match type.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://www.mantisbt.org/bugs/view.php?id=15573; http://www.openwall.com/lists/oss-security/2013/03/22/2; http://www.securityfocus.com/bid/58626
CVE: CVE-2013-2090
Published: 2014-05-27
Description: The set_meta_data function in lib/cremefraiche.rb in the Creme Fraiche gem before 0.6.1 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in the file name of an email attachment.  NOTE: some of these details are obtained from third party information.
CVSS Score: 9.3 (HIGH)
CWE: CWE-78
References: http://osvdb.org/93395; http://packetstormsecurity.com/files/121635/Ruby-Gem-Creme-Fraiche-0.6-Command-Injection.html; http://secunia.com/advisories/53391
CVE: CVE-2013-2111
Published: 2014-05-27
Description: The IMAP functionality in Dovecot before 2.2.2 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via invalid APPEND parameters.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/53492; http://www.dovecot.org/list/dovecot-news/2013-May/000255.html; http://www.openwall.com/lists/oss-security/2013/05/24/1
CVE: CVE-2013-2124
Published: 2014-05-27
Description: Double free vulnerability in inspect-fs.c in LibguestFS 1.20.x before 1.20.7, 1.21.x, 1.22.0, and 1.23.0 allows remote attackers to cause a denial of service (crash) via empty guest files.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/93724; http://seclists.org/oss-sec/2013/q2/431; http://www.securityfocus.com/bid/60205
CVE: CVE-2013-2125
Published: 2014-05-27
Description: OpenSMTPD before 5.3.2 does not properly handle SSL sessions, which allows remote attackers to cause a denial of service (connection blocking) by keeping a connection open.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://git.zx2c4.com/OpenSMTPD/commit/?id=38b26921bad5fe24ad747bf9d591330d683728b0; http://osvdb.org/93495; http://seclists.org/oss-sec/2013/q2/362
CVE: CVE-2013-2225
Published: 2014-05-27
Description: inc/ticket.class.php in GLPI 0.83.9 and earlier allows remote attackers to unserialize arbitrary PHP objects via the _predefined_fields parameter to front/ticket.form.php.
CVSS Score: 6.4 (MEDIUM)
References: http://osvdb.org/94683; http://seclists.org/oss-sec/2013/q2/626; http://seclists.org/oss-sec/2013/q2/645
CVE: CVE-2013-2698
Published: 2014-05-27
Description: Cross-site request forgery (CSRF) vulnerability in the Calendar plugin before 1.3.3 for WordPress allows remote attackers to hijack the authentication of users for requests that add a calendar entry via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://secunia.com/advisories/52841; http://wordpress.org/plugins/calendar/changelog/; http://www.securityfocus.com/bid/59661
CVE: CVE-2013-3477
Published: 2014-05-27
Description: Cross-site request forgery (CSRF) vulnerability in the Related Posts by Zemanta plugin before 1.3.2 for WordPress allows remote attackers to hijack the authentication of unspecified users for requests that change settings via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://secunia.com/advisories/53321; http://wordpress.org/plugins/related-posts-by-zemanta/changelog/; http://www.securityfocus.com/bid/59840
CVE: CVE-2013-4598
Published: 2014-05-27
Description: The Groups, Communities and Co (GCC) module 7.x-1.x before 7.x-1.1 for Drupal does not properly check permission, which allows remote attackers to access the configuration pages via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/55651; http://www.securityfocus.com/bid/63703; https://drupal.org/node/2132747
CVE: CVE-2013-5036
Published: 2014-05-27
Description: The Square Squash allows remote attackers to execute arbitrary code via a YAML document in the (1) namespace parameter to the deobfuscation function or (2) sourcemap parameter to the sourcemap function in app/controllers/api/v1_controller.rb.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://ceriksen.com/2013/08/06/squash-remote-code-execution-vulnerability-advisory/; http://osvdb.org/95992; http://www.exploit-db.com/exploits/27530
CVE: CVE-2014-0177
Published: 2014-05-27
Description: The am function in lib/hub/commands.rb in hub before 1.12.1 allows local users to overwrite arbitrary files via a symlink attack on a temporary patch file.
CVSS Score: 3.6 (LOW)
CWE: CWE-310
References: http://secunia.com/advisories/58273; https://github.com/github/hub/commit/016ec99d25b1cb83cb4367e541177aa431beb600; http://secunia.com/advisories/58273
CVE: CVE-2014-0240
Published: 2014-05-27
Description: The mod_wsgi module before 3.5 for Apache, when daemon mode is enabled, does not properly handle error codes returned by setuid when run on certain Linux kernels, which allows local users to gain privileges via vectors related to the number of running processes.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-264
References: http://blog.dscpl.com.au/2014/05/security-release-for-modwsgi-version-35.html; http://modwsgi.readthedocs.org/en/latest/release-notes/version-3.5.html; http://rhn.redhat.com/errata/RHSA-2014-0789.html
CVE: CVE-2014-0178
Published: 2014-05-28
Description: Samba 3.6.6 through 3.6.23, 4.0.x before 4.0.18, and 4.1.x before 4.1.8, when a certain vfs shadow copy configuration is enabled, does not properly initialize the SRV_SNAPSHOT_ARRAY response field, which allows remote authenticated users to obtain potentially sensitive information from process memory via a (1) FSCTL_GET_SHADOW_COPY_DATA or (2) FSCTL_SRV_ENUMERATE_SNAPSHOTS request.
CVSS Score: 3.5 (LOW)
CWE: CWE-665
References: http://advisories.mageia.org/MGASA-2014-0279.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136864.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134717.html
CVE: CVE-2014-0239
Published: 2014-05-28
Description: The internal DNS server in Samba 4.x before 4.0.18 does not check the QR field in the header section of an incoming DNS message before sending a response, which allows remote attackers to cause a denial of service (CPU and bandwidth consumption) via a forged response packet that triggers a communication loop, a related issue to CVE-1999-0103.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/59579; http://security.gentoo.org/glsa/glsa-201502-15.xml; http://www.samba.org/samba/security/CVE-2014-0239
CVE: CVE-2012-4915
Published: 2014-05-29
Description: Directory traversal vulnerability in the Google Doc Embedder plugin before 2.5.4 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter to libs/pdf.php.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/88891; http://secunia.com/advisories/50832; http://www.securityfocus.com/bid/57133
CVE: CVE-2013-0199
Published: 2014-05-29
Description: The default LDAP ACIs in FreeIPA 3.0 before 3.1.2 do not restrict access to the (1) ipaNTTrustAuthIncoming and (2) ipaNTTrustAuthOutgoing attributes, which allow remote attackers to obtain the Cross-Realm Kerberos Trust key via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/89539; http://www.freeipa.org/page/CVE-2013-0199; http://www.freeipa.org/page/Releases/3.1.2
CVE: CVE-2013-2193
Published: 2014-05-29
Description: Apache HBase 0.92.x before 0.92.3 and 0.94.x before 0.94.9, when the Kerberos features are enabled, allows man-in-the-middle attackers to disable bidirectional authentication and obtain sensitive information via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-287
References: http://osvdb.org/96615; http://seclists.org/fulldisclosure/2013/Aug/250; https://www.cloudera.com/documentation/other/security-bulletins/topics/csb_topic_1.html
CVE: CVE-2013-4177
Published: 2014-05-29
Description: The Google Authenticator login module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.4 for Drupal does not properly identify user account names, which might allow remote attackers to bypass the two-factor authentication requirement via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://www.securityfocus.com/bid/59884; https://drupal.org/node/1995482; https://drupal.org/node/1995634
CVE: CVE-2013-4178
Published: 2014-05-29
Description: The Google Authenticator login module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.4 for Drupal allows remote attackers to obtain access by replaying the username, password, and one-time password (OTP).
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-287
References: http://www.securityfocus.com/bid/59884; https://drupal.org/node/1995482; https://drupal.org/node/1995634
CVE: CVE-2014-0199
Published: 2014-05-29
Description: The setup script in ovirt-engine-reports, as used in the Red Hat Enterprise Virtualization reports (rhevm-reports) package before 3.3.3, stores the reports database password in cleartext, which allows local users to obtain sensitive information by reading an unspecified file.
CVSS Score: 2.1 (LOW)
CWE: CWE-310
References: http://rhn.redhat.com/errata/RHSA-2014-0558.html; http://www.securityfocus.com/bid/67682; http://rhn.redhat.com/errata/RHSA-2014-0558.html
CVE: CVE-2014-0200
Published: 2014-05-29
Description: The Red Hat Enterprise Virtualization Manager reports (rhevm-reports) package before 3.3.3-1 uses world-readable permissions on the datasource configuration file (js-jboss7-ds.xml), which allows local users to obtain sensitive information by reading the file.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://rhn.redhat.com/errata/RHSA-2014-0558.html; http://www.securityfocus.com/bid/67684; http://rhn.redhat.com/errata/RHSA-2014-0558.html
CVE: CVE-2014-0201
Published: 2014-05-29
Description: ovirt-engine-reports, as used in the Red Hat Enterprise Virtualization reports package (rhevm-reports) before 3.3.3, uses world-readable permissions on configuration files, which allows local users to obtain sensitive information by reading the files.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://rhn.redhat.com/errata/RHSA-2014-0558.html; http://rhn.redhat.com/errata/RHSA-2014-0558.html
CVE: CVE-2014-0246
Published: 2014-05-29
Description: SOSreport stores the md5 hash of the GRUB bootloader password in an archive, which allows local users to obtain sensitive information by reading the archive.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-255
References: http://www.openwall.com/lists/oss-security/2014/05/27/1; http://www.securityfocus.com/bid/67634; https://bugzilla.redhat.com/show_bug.cgi?id=1101393
CVE: CVE-2014-3414
Published: 2014-05-29
Description: Cross-site request forgery (CSRF) vulnerability in Sharetronix before 3.4 allows remote attackers to hijack the authentication of administrators for requests that add administrative privileges to a user via the admin parameter to admin/administrators.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.com/files/126859/Sharetronix-3.3-Cross-Site-Request-Forgery-SQL-Injection.html; https://www.htbridge.com/advisory/HTB23214; http://packetstormsecurity.com/files/126859/Sharetronix-3.3-Cross-Site-Request-Forgery-SQL-Injection.html
CVE: CVE-2014-3415
Published: 2014-05-29
Description: SQL injection vulnerability in Sharetronix before 3.4 allows remote authenticated users to execute arbitrary SQL commands via the invite_users[] parameter to the /invite page for a group.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://packetstormsecurity.com/files/126859/Sharetronix-3.3-Cross-Site-Request-Forgery-SQL-Injection.html; http://www.securityfocus.com/bid/67680; https://www.htbridge.com/advisory/HTB23214
CVE: CVE-2014-3416
Published: 2014-05-29
Description: uPortal before 4.0.13.1 does not properly check the MANAGE permissions, which allows remote authenticated users to manage arbitrary portlets by leveraging the SUBSCRIBE permission for the portlet-admin portlet.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://www.jasig.org/uportal/download/uportal-4-0-13-1; https://issues.jasig.org/browse/UP-4105; http://www.jasig.org/uportal/download/uportal-4-0-13-1
CVE: CVE-2014-3417
Published: 2014-05-29
Description: uPortal before 4.0.13.1 does not properly check the CONFIG permission, which allows remote authenticated users to configure portlets by leveraging the SUBSCRIBE permission for a portlet.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://www.jasig.org/uportal/download/uportal-4-0-13-1; https://issues.jasig.org/browse/UP-4106; http://www.jasig.org/uportal/download/uportal-4-0-13-1
CVE: CVE-2014-3277
Published: 2014-05-29
Description: The Administration GUI in the web framework in VOSS in Cisco Unified Communications Domain Manager (CDM) 9.0(.1) and earlier does not properly implement access control, which allows remote authenticated users to obtain sensitive user and group information by leveraging Location Administrator privileges and entering a crafted URL, aka Bug ID CSCum77005.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-287
References: http://secunia.com/advisories/58400; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3277; http://tools.cisco.com/security/center/viewAlert.x?alertId=34380
CVE: CVE-2014-3279
Published: 2014-05-29
Description: The Administration GUI in the web framework in VOSS in Cisco Unified Communications Domain Manager (CDM) 9.0(.1) and earlier does not properly implement access control, which allows remote attackers to enumerate account names via a crafted URL, aka Bug IDs CSCun39631 and CSCun39643.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/58400; http://secunia.com/advisories/58657; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3279
CVE: CVE-2014-3282
Published: 2014-05-29
Description: The Administration GUI in the web framework in VOSS in Cisco Unified Communications Domain Manager (CDM) 9.0(.1) and earlier does not properly implement access control, which allows remote authenticated users to obtain sensitive number-translation information by leveraging Location Administrator privileges and entering a crafted URL, aka Bug ID CSCum76930.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/58400; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3282; http://tools.cisco.com/security/center/viewAlert.x?alertId=34382
CVE: CVE-2014-3283
Published: 2014-05-29
Description: Open redirect vulnerability in Self-Care Client Portal applications in the web framework in VOSS in Cisco Unified Communications Domain Manager (CDM) 9.0(.1) and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a crafted URL, aka Bug ID CSCun79731.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/58400; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3283; http://tools.cisco.com/security/center/viewAlert.x?alertId=34383
CVE: CVE-2014-3285
Published: 2014-05-29
Description: Cisco Wide Area Application Services (WAAS) 5.3(.5a) and earlier, when SharePoint acceleration is enabled, does not properly parse SharePoint responses, which allows remote attackers to cause a denial of service (application-optimization handler reload) via a crafted SharePoint application, aka Bug ID CSCue47674.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/58806; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3285; http://tools.cisco.com/security/center/viewAlert.x?alertId=34395
CVE: CVE-2014-3463
Published: 2014-05-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not a unique security issue.  Notes: none
CVE: CVE-2012-5560
Published: 2014-05-30
Description: The default configuration in mate-settings-daemon 1.5.3 allows local users to change the timezone for the system via a crafted D-Bus call.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://lists.fedoraproject.org/pipermail/package-announce/2013-March/099545.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-March/099552.html; https://bugzilla.redhat.com/show_bug.cgi?id=878102