deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-1362
Published: 2014-07-01
Description: WebKit, as used in Apple iOS before 7.1.2, Apple Safari before 6.1.5 and 7.x before 7.0.5, and Apple TV before 6.1.2, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-06-30-1, APPLE-SA-2014-06-30-3, and APPLE-SA-2014-06-30-4.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2014-06/0171.html; http://archives.neohapsis.com/archives/bugtraq/2014-06/0174.html; http://archives.neohapsis.com/archives/bugtraq/2014-06/0175.html
CVE: CVE-2014-1363
Published: 2014-07-01
Description: WebKit, as used in Apple iOS before 7.1.2, Apple Safari before 6.1.5 and 7.x before 7.0.5, and Apple TV before 6.1.2, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-06-30-1, APPLE-SA-2014-06-30-3, and APPLE-SA-2014-06-30-4.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2014-06/0171.html; http://archives.neohapsis.com/archives/bugtraq/2014-06/0174.html; http://archives.neohapsis.com/archives/bugtraq/2014-06/0175.html
CVE: CVE-2014-1364
Published: 2014-07-01
Description: WebKit, as used in Apple iOS before 7.1.2, Apple Safari before 6.1.5 and 7.x before 7.0.5, and Apple TV before 6.1.2, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-06-30-1, APPLE-SA-2014-06-30-3, and APPLE-SA-2014-06-30-4.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2014-06/0171.html; http://archives.neohapsis.com/archives/bugtraq/2014-06/0174.html; http://archives.neohapsis.com/archives/bugtraq/2014-06/0175.html
CVE: CVE-2014-1365
Published: 2014-07-01
Description: WebKit, as used in Apple iOS before 7.1.2, Apple Safari before 6.1.5 and 7.x before 7.0.5, and Apple TV before 6.1.2, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-06-30-1, APPLE-SA-2014-06-30-3, and APPLE-SA-2014-06-30-4.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2014-06/0171.html; http://archives.neohapsis.com/archives/bugtraq/2014-06/0174.html; http://archives.neohapsis.com/archives/bugtraq/2014-06/0175.html
CVE: CVE-2014-1366
Published: 2014-07-01
Description: WebKit, as used in Apple iOS before 7.1.2, Apple Safari before 6.1.5 and 7.x before 7.0.5, and Apple TV before 6.1.2, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-06-30-1, APPLE-SA-2014-06-30-3, and APPLE-SA-2014-06-30-4.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2014-06/0171.html; http://archives.neohapsis.com/archives/bugtraq/2014-06/0174.html; http://archives.neohapsis.com/archives/bugtraq/2014-06/0175.html
CVE: CVE-2014-1367
Published: 2014-07-01
Description: WebKit, as used in Apple iOS before 7.1.2, Apple Safari before 6.1.5 and 7.x before 7.0.5, and Apple TV before 6.1.2, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-06-30-1, APPLE-SA-2014-06-30-3, and APPLE-SA-2014-06-30-4.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2014-06/0171.html; http://archives.neohapsis.com/archives/bugtraq/2014-06/0174.html; http://archives.neohapsis.com/archives/bugtraq/2014-06/0175.html
CVE: CVE-2014-1368
Published: 2014-07-01
Description: WebKit, as used in Apple iOS before 7.1.2, Apple Safari before 6.1.5 and 7.x before 7.0.5, and Apple TV before 6.1.2, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-06-30-1, APPLE-SA-2014-06-30-3, and APPLE-SA-2014-06-30-4.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2014-06/0171.html; http://archives.neohapsis.com/archives/bugtraq/2014-06/0174.html; http://archives.neohapsis.com/archives/bugtraq/2014-06/0175.html
CVE: CVE-2014-1369
Published: 2014-07-01
Description: WebKit in Apple Safari before 6.1.5 and 7.x before 7.0.5 allows user-assisted remote attackers to access file: URLs by leveraging a URL drag operation that originates at a crafted web site.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://archives.neohapsis.com/archives/bugtraq/2014-06/0171.html; http://www.securitytracker.com/id/1030495; http://archives.neohapsis.com/archives/bugtraq/2014-06/0171.html
CVE: CVE-2014-1370
Published: 2014-07-01
Description: The byte-swapping implementation in copyfile in Apple OS X before 10.9.4 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds memory access and application crash) via a crafted AppleDouble file in a ZIP archive.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2014-06/0172.html; http://secunia.com/advisories/59475; http://support.apple.com/kb/HT6296
CVE: CVE-2014-1371
Published: 2014-07-01
Description: Array index error in Dock in Apple OS X before 10.9.4 allows attackers to execute arbitrary code or cause a denial of service (incorrect function-pointer dereference and application crash) by leveraging access to a sandboxed application for sending a message.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2014-06/0172.html; http://secunia.com/advisories/59475; http://support.apple.com/kb/HT6296
CVE: CVE-2014-1372
Published: 2014-07-01
Description: Graphics Driver in Apple OS X before 10.9.4 does not properly restrict read operations during processing of an unspecified system call, which allows local users to obtain sensitive information from kernel memory and bypass the ASLR protection mechanism via a crafted call.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-264
References: http://archives.neohapsis.com/archives/bugtraq/2014-06/0172.html; http://secunia.com/advisories/59475; http://support.apple.com/kb/HT6296
CVE: CVE-2014-1373
Published: 2014-07-01
Description: Intel Graphics Driver in Apple OS X before 10.9.4 does not properly restrict an unspecified OpenGL API call, which allows attackers to execute arbitrary code via a crafted application.
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://archives.neohapsis.com/archives/bugtraq/2014-06/0172.html; http://secunia.com/advisories/59475; http://support.apple.com/kb/HT6296
CVE: CVE-2014-1375
Published: 2014-07-01
Description: Intel Graphics Driver in Apple OS X before 10.9.4 allows local users to bypass the ASLR protection mechanism by leveraging read access to a kernel pointer in an IOKit object.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://archives.neohapsis.com/archives/bugtraq/2014-06/0172.html; http://secunia.com/advisories/59475; http://support.apple.com/kb/HT6296
CVE: CVE-2014-1376
Published: 2014-07-01
Description: Intel Compute in Apple OS X before 10.9.4 does not properly restrict an unspecified OpenCL API call, which allows attackers to execute arbitrary code via a crafted application.
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://archives.neohapsis.com/archives/bugtraq/2014-06/0172.html; http://secunia.com/advisories/59475; http://support.apple.com/kb/HT6296
CVE: CVE-2014-1377
Published: 2014-07-01
Description: Array index error in IOAcceleratorFamily in Apple OS X before 10.9.4 allows attackers to execute arbitrary code via a crafted application.
CVSS Score: 10.0 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2014-06/0172.html; http://secunia.com/advisories/59475; http://support.apple.com/kb/HT6296
CVE: CVE-2014-1378
Published: 2014-07-01
Description: IOGraphicsFamily in Apple OS X before 10.9.4 allows local users to bypass the ASLR protection mechanism by leveraging read access to a kernel pointer in an IOKit object.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://archives.neohapsis.com/archives/bugtraq/2014-06/0172.html; http://support.apple.com/kb/HT6296; http://www.securitytracker.com/id/1030505
CVE: CVE-2014-1379
Published: 2014-07-01
Description: Graphics Drivers in Apple OS X before 10.9.4 allows attackers to gain privileges or cause a denial of service (NULL pointer dereference and system crash) via a 32-bit executable file for a crafted application.
CVSS Score: 10.0 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2014-06/0172.html; http://secunia.com/advisories/59475; http://support.apple.com/kb/HT6296
CVE: CVE-2014-1380
Published: 2014-07-01
Description: The Security - Keychain component in Apple OS X before 10.9.4 does not properly implement keystroke observers, which allows physically proximate attackers to bypass the screen-lock protection mechanism, and enter characters into an arbitrary window under the lock window, via keyboard input.
CVSS Score: 2.6 (LOW)
CWE: CWE-264
References: http://archives.neohapsis.com/archives/bugtraq/2014-06/0172.html; http://support.apple.com/kb/HT6296; http://www.securitytracker.com/id/1030505
CVE: CVE-2014-1381
Published: 2014-07-01
Description: Thunderbolt in Apple OS X before 10.9.4 does not properly restrict IOThunderBoltController API calls, which allows attackers to execute arbitrary code or cause a denial of service (out-of-bounds memory access and application crash) via a crafted call.
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://archives.neohapsis.com/archives/bugtraq/2014-06/0172.html; http://secunia.com/advisories/59475; http://support.apple.com/kb/HT6296
CVE: CVE-2014-1382
Published: 2014-07-01
Description: WebKit, as used in Apple iOS before 7.1.2, Apple Safari before 6.1.5 and 7.x before 7.0.5, and Apple TV before 6.1.2, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-06-30-1, APPLE-SA-2014-06-30-3, and APPLE-SA-2014-06-30-4.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2014-06/0171.html; http://archives.neohapsis.com/archives/bugtraq/2014-06/0174.html; http://archives.neohapsis.com/archives/bugtraq/2014-06/0175.html
CVE: CVE-2014-1383
Published: 2014-07-01
Description: Apple TV before 6.1.2 allows remote authenticated users to bypass an intended password requirement for iTunes Store purchase transactions via unspecified vectors.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-264
References: http://archives.neohapsis.com/archives/bugtraq/2014-06/0175.html; http://www.securitytracker.com/id/1030503; http://archives.neohapsis.com/archives/bugtraq/2014-06/0175.html
CVE: CVE-2014-4513
Published: 2014-07-01
Description: Multiple cross-site scripting (XSS) vulnerabilities in server/offline.php in the ActiveHelper LiveHelp Live Chat plugin 3.1.0 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) MESSAGE, (2) EMAIL, or (3) NAME parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://codevigilant.com/disclosure/wp-plugin-activehelper-livehelp-a3-cross-site-scripting-xss; http://codevigilant.com/disclosure/wp-plugin-activehelper-livehelp-a3-cross-site-scripting-xss
CVE: CVE-2014-4515
Published: 2014-07-01
Description: Cross-site scripting (XSS) vulnerability in mce_anyfont/dialog.php in the AnyFont plugin 2.2.3 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the text parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://codevigilant.com/disclosure/wp-plugin-anyfont-a3-cross-site-scripting-xss; http://www.securityfocus.com/bid/68314; http://codevigilant.com/disclosure/wp-plugin-anyfont-a3-cross-site-scripting-xss
CVE: CVE-2014-4516
Published: 2014-07-01
Description: Cross-site scripting (XSS) vulnerability in bicm-carousel-preview.php in the BIC Media Widget plugin 1.0 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the param parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://codevigilant.com/disclosure/wp-plugin-bic-media-a3-cross-site-scripting-xss; http://codevigilant.com/disclosure/wp-plugin-bic-media-a3-cross-site-scripting-xss
CVE: CVE-2014-4518
Published: 2014-07-01
Description: Cross-site scripting (XSS) vulnerability in xd_resize.php in the Contact Form by ContactMe.com plugin 2.3 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the width parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://codevigilant.com/disclosure/wp-plugin-contactme-a3-cross-site-scripting-xss; http://codevigilant.com/disclosure/wp-plugin-contactme-a3-cross-site-scripting-xss
CVE: CVE-2014-4520
Published: 2014-07-01
Description: Cross-site scripting (XSS) vulnerability in phprack.php in the DMCA WaterMarker plugin before 1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the plugin_dir parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://codevigilant.com/disclosure/wp-plugin-dmca-watermarker-a3-cross-site-scripting-xss; http://www.securityfocus.com/bid/68313; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=904684%40dmca-watermarker&old=549072%40dmca-watermarker
CVE: CVE-2014-4521
Published: 2014-07-01
Description: Cross-site scripting (XSS) vulnerability in client-assist.php in the dsIDXpress IDX plugin before 2.1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the action parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://codevigilant.com/disclosure/wp-plugin-dsidxpress-a3-cross-site-scripting-xss; http://wordpress.org/plugins/dsidxpress/changelog; http://codevigilant.com/disclosure/wp-plugin-dsidxpress-a3-cross-site-scripting-xss
CVE: CVE-2014-4528
Published: 2014-07-01
Description: Multiple cross-site scripting (XSS) vulnerabilities in admin/swarm-settings.php in the Bugs Go Viral : Facebook Promotion Generator (fbpromotions) plugin 1.3.4 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) promo_type, (2) fb_edit_action, or (3) promo_id parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://codevigilant.com/disclosure/wp-plugin-fbpromotions-a3-cross-site-scripting-xss; http://codevigilant.com/disclosure/wp-plugin-fbpromotions-a3-cross-site-scripting-xss
CVE: CVE-2014-4533
Published: 2014-07-01
Description: Cross-site scripting (XSS) vulnerability in ajax_functions.php in the GEO Redirector plugin 1.0.1 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the hid_id parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://codevigilant.com/disclosure/wp-plugin-geo-redirector-a3-cross-site-scripting-xss; http://codevigilant.com/disclosure/wp-plugin-geo-redirector-a3-cross-site-scripting-xss
CVE: CVE-2014-4538
Published: 2014-07-01
Description: Cross-site scripting (XSS) vulnerability in process.php in the Malware Finder plugin 1.1 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the query parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://codevigilant.com/disclosure/wp-plugin-malware-finder-a3-cross-site-scripting-xss; http://codevigilant.com/disclosure/wp-plugin-malware-finder-a3-cross-site-scripting-xss
CVE: CVE-2014-4545
Published: 2014-07-01
Description: Multiple cross-site scripting (XSS) vulnerabilities in pq_dialog.php in the Pro Quoter plugin 1.0 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) leftorright or (2) author parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://codevigilant.com/disclosure/wp-plugin-proquoter-a3-cross-site-scripting-xss; http://www.securityfocus.com/bid/68318; http://codevigilant.com/disclosure/wp-plugin-proquoter-a3-cross-site-scripting-xss
CVE: CVE-2014-4556
Published: 2014-07-01
Description: Cross-site scripting (XSS) vulnerability in test-plugin.php in the Swipe Checkout for eShop plugin 3.7.0 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the api_url parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://codevigilant.com/disclosure/wp-plugin-swipe-hq-checkout-for-eshop-a3-cross-site-scripting-xss; http://codevigilant.com/disclosure/wp-plugin-swipe-hq-checkout-for-eshop-a3-cross-site-scripting-xss
CVE: CVE-2014-4564
Published: 2014-07-01
Description: Cross-site scripting (XSS) vulnerability in check.php in the Validated plugin 1.0.2 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the slug parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://codevigilant.com/disclosure/wp-plugin-validated-a3-cross-site-scripting-xss; http://codevigilant.com/disclosure/wp-plugin-validated-a3-cross-site-scripting-xss
CVE: CVE-2014-4569
Published: 2014-07-01
Description: Cross-site scripting (XSS) vulnerability in ls/vv_login.php in the VideoWhisper Live Streaming Integration plugin 4.27.2 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the room_name parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://codevigilant.com/disclosure/wp-plugin-videowhisper-live-streaming-integration-a3-cross-site-scripting-xss; http://www.securityfocus.com/bid/68321; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=833654%40videowhisper-live-streaming-integration&old=833649%40videowhisper-live-streaming-integration&sfp_email=&sfph_mail=
CVE: CVE-2014-4575
Published: 2014-07-01
Description: Cross-site scripting (XSS) vulnerability in js/window.php in the Wikipop plugin 2.0 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://codevigilant.com/disclosure/wp-plugin-wikipop-a3-cross-site-scripting-xss; http://codevigilant.com/disclosure/wp-plugin-wikipop-a3-cross-site-scripting-xss
CVE: CVE-2014-4583
Published: 2014-07-01
Description: Multiple cross-site scripting (XSS) vulnerabilities in forms/messages.php in the WP-Contact (wp-contact-sidebar-widget) plugin 1.0 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) edit, (2) order_direction, (3) limit_start, (4) id, or (5) order parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://codevigilant.com/disclosure/wp-plugin-wp-contact-sidebar-widget-a3-cross-site-scripting-xss; http://codevigilant.com/disclosure/wp-plugin-wp-contact-sidebar-widget-a3-cross-site-scripting-xss
CVE: CVE-2014-4584
Published: 2014-07-01
Description: Cross-site scripting (XSS) vulnerability in admin/editFacility.php in the wp-easybooking plugin 1.0.3 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the fID parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://codevigilant.com/disclosure/wp-plugin-wp-easybooking-a3-cross-site-scripting-xss; http://codevigilant.com/disclosure/wp-plugin-wp-easybooking-a3-cross-site-scripting-xss
CVE: CVE-2014-4585
Published: 2014-07-01
Description: Cross-site scripting (XSS) vulnerability in the WP-FaceThumb plugin possibly 1.0 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the ajax_url parameter to index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://codevigilant.com/disclosure/wp-plugin-wp-facethumb-a3-cross-site-scripting-xss; http://codevigilant.com/disclosure/wp-plugin-wp-facethumb-a3-cross-site-scripting-xss
CVE: CVE-2014-4602
Published: 2014-07-01
Description: Multiple cross-site scripting (XSS) vulnerabilities in xencarousel-admin.js.php in the XEN Carousel plugin 0.12.2 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) path or (2) ajaxpath parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://codevigilant.com/disclosure/wp-plugin-xen-carousel-a3-cross-site-scripting-xss; http://codevigilant.com/disclosure/wp-plugin-xen-carousel-a3-cross-site-scripting-xss
CVE: CVE-2014-3491
Published: 2014-07-01
Description: Cross-site scripting (XSS) vulnerability in Foreman before 1.4.5 and 1.5.x before 1.5.1 allows remote attackers to inject arbitrary web script or HTML via the Name field to the New Host groups page, related to create, update, and destroy notification boxes.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://projects.theforeman.org/issues/5881; http://projects.theforeman.org/issues/5881
CVE: CVE-2014-3492
Published: 2014-07-01
Description: Multiple cross-site scripting (XSS) vulnerabilities in the host YAML view in Foreman before 1.4.5 and 1.5.x before 1.5.1 allow remote attackers to inject arbitrary web script or HTML via a parameter (1) name or (2) value related to the host.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://projects.theforeman.org/issues/6149; http://projects.theforeman.org/issues/6149
CVE: CVE-2014-3494
Published: 2014-07-01
Description: kio/usernotificationhandler.cpp in the POP3 kioslave in kdelibs 4.10.95 before 4.13.3 does not properly generate warning notifications, which allows man-in-the-middle attackers to obtain sensitive information via an invalid certificate.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://lists.opensuse.org/opensuse-updates/2015-03/msg00068.html; http://quickgit.kde.org/?p=kdelibs.git&a=commitdiff&h=bbae87dc1be3ae063796a582774bd5642cacdd5d&hp=1ccdb43ed3b32a7798eec6d39bb3c83a6e40228f; http://www.kde.org/info/security/advisory-20140618-1.txt
CVE: CVE-2013-3662
Published: 2014-07-01
Description: Timbre SketchUp (formerly Google SketchUp) before 8 Maintenance 2 allows remote attackers to execute arbitrary code via a crafted color palette table in a MAC Pict texture, which triggers a stack-based buffer overflow.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2013-06/0006.html; http://blog.binamuse.com/2013/05/multiple-vulnerabilities-on-sketchup.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/84720
CVE: CVE-2013-3664
Published: 2014-07-01
Description: Trimble SketchUp (formerly Google SketchUp) before 2013 (13.0.3689) allows remote attackers to execute arbitrary code via a crafted color palette table in a MAC Pict texture, which triggers an out-of-bounds stack write.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-3662.  NOTE: this issue was SPLIT due to different affected products and codebases (ADT1); CVE-2013-7388 has been assigned to the paintlib issue.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2013-06/0008.html; http://blog.binamuse.com/2013/05/multiple-vulnerabilities-on-sketchup.html; http://secunia.com/advisories/53635
CVE: CVE-2013-7388
Published: 2014-07-01
Description: Heap-based buffer overflow in paintlib, as used in Trimble SketchUp (formerly Google SketchUp) before 2013 (13.0.3689), allows remote attackers to execute arbitrary code via a crafted RLE4-compressed bitmap (BMP).  NOTE: this issue was SPLIT from CVE-2013-3664 due to different affected products and codebases (ADT1).
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://blog.binamuse.com/2013/05/multiple-vulnerabilities-on-sketchup.html; http://secunia.com/advisories/53635; http://www.binamuse.com/advisories/BINA-20130521B.txt