deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-1514
Published: 2014-03-19
Description: vmtypedarrayobject.cpp in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 does not validate the length of the destination array before a copy operation, which allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds write and application crash) by triggering incorrect use of the TypedArrayObject class.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00016.html; http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.html; http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00022.html
CVE: CVE-2013-5952
Published: 2014-03-19
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Freichat (com_freichat) component, possibly 9.4 and earlier, for Joomla! allow remote attackers to inject arbitrary web script or HTML via the (1) id or (2) xhash parameter to client/chat.php or (3) toname parameter to client/plugins/upload/upload.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/fulldisclosure/2014-03/0275.html; http://packetstormsecurity.com/files/125737; http://secunia.com/advisories/57361
CVE: CVE-2013-5953
Published: 2014-03-19
Description: Multiple cross-site scripting (XSS) vulnerabilities in tmpl/layout_editevent.php in the Multi Calendar (com_multicalendar) component 4.0.2, and possibly 4.8.5 and earlier, for Joomla! allow remote attackers to inject arbitrary web script or HTML via the (1) calid or (2) paletteDefault parameter in an editevent action to index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/fulldisclosure/2014-03/0276.html; http://packetstormsecurity.com/files/125738; http://secunia.com/advisories/57360
CVE: CVE-2013-5955
Published: 2014-03-19
Description: Cross-site scripting (XSS) vulnerability in manage.php in the PBBooking (com_pbbooking) component 2.4 for Joomla! allows remote attackers to inject arbitrary web script or HTML via the an arbitrary parameter in an edit action to administrator/index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/125734; http://seclists.org/fulldisclosure/2014/Mar/269; http://www.securityfocus.com/bid/66257
CVE: CVE-2014-1977
Published: 2014-03-19
Description: The NTT DOCOMO sp mode mail application 6300 and earlier for Android 4.0.x and 6700 and earlier for Android 4.1 through 4.4 uses weak permissions for attachments during processing of incoming e-mail messages, which allows attackers to obtain sensitive information via a crafted application.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://jvn.jp/en/jp/JVN81739241/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2014-000027; http://jvn.jp/en/jp/JVN81739241/index.html
CVE: CVE-2014-1978
Published: 2014-03-19
Description: The application link interface in the NTT DOCOMO sp mode mail application 6100 through 6300 for Android 4.0.x and 6130 through 6700 for Android 4.1 through 4.4 writes message content to the SD card during e-mail composition, which allows attackers to obtain sensitive information via a crafted application.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://jvn.jp/en/jp/JVN05951929/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2014-000028; http://jvn.jp/en/jp/JVN05951929/index.html
CVE: CVE-2014-1979
Published: 2014-03-19
Description: The NTT DOCOMO sp mode mail application 5900 through 6300 for Android 4.0.x and 6000 through 6620 for Android 4.1 through 4.4 allows remote attackers to execute arbitrary Java methods via Deco-mail emoticon POP data in an e-mail message.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://jvn.jp/en/jp/JVN89260331/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2014-000029; http://jvn.jp/en/jp/JVN89260331/index.html
CVE: CVE-2014-2339
Published: 2014-03-19
Description: Multiple SQL injection vulnerabilities in bbs/ajax.autosave.php in GNUboard 5.x and possibly earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) subject or (2) content parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://seclists.org/fulldisclosure/2014/Mar/299; http://www.securityfocus.com/bid/66228; https://exchange.xforce.ibmcloud.com/vulnerabilities/91814
CVE: CVE-2014-1970
Published: 2014-03-20
Description: Directory traversal vulnerability in the ES File Explorer File Manager application before 3.0.4 for Android allows remote attackers to overwrite or create arbitrary files via unspecified vectors.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-22
References: http://jvn.jp/en/jp/JVN70029459/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2014-000033; http://jvn.jp/en/jp/JVN70029459/index.html
CVE: CVE-2014-1971
Published: 2014-03-20
Description: Cross-site scripting (XSS) vulnerability in Silex before 2.0.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN14282890/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2014-000032; http://www.securityfocus.com/bid/66329
CVE: CVE-2013-0805
Published: 2014-03-20
Description: Multiple cross-site scripting (XSS) vulnerabilities in the search feature in iTop (aka IT Operations Portal) 2.0, 1.2.1, 1.2, and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) text parameter to pages/UI.php or (2) expression parameter to pages/run_query.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/fulldisclosure/2013-01/0208.html; http://osvdb.org/89574; http://packetstormsecurity.com/files/119767/iTop-Cross-Site-Scripting.html
CVE: CVE-2013-3249
Published: 2014-03-20
Description: Stack-based buffer overflow in the "Add from text file" feature in the DameWare Exporter tool (DWExporter.exe) in DameWare Remote Support 10.0.0.372, 9.0.1.247, and earlier allows user-assisted attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 9.3 (HIGH)
CWE: CWE-787
References: http://osvdb.org/95658; http://secunia.com/advisories/53096; http://www.securityfocus.com/bid/61453
CVE: CVE-2014-1609
Published: 2014-03-20
Description: Multiple SQL injection vulnerabilities in MantisBT before 1.2.16 allow remote attackers to execute arbitrary SQL commands via unspecified parameters to the (1) mc_project_get_attachments function in api/soap/mc_project_api.php; the (2) news_get_limited_rows function in core/news_api.php; the (3) summary_print_by_enum, (4) summary_print_by_age, (5) summary_print_by_developer, (6) summary_print_by_reporter, or (7) summary_print_by_category function in core/summary_api.php; the (8) create_bug_enum_summary or (9) enum_bug_group function in plugins/MantisGraph/core/graph_api.php; (10) bug_graph_bycategory.php or (11) bug_graph_bystatus.php in plugins/MantisGraph/pages/; or (12) proj_doc_page.php, related to use of the db_query function, a different vulnerability than CVE-2014-1608.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/61432; http://www.debian.org/security/2014/dsa-3030; http://www.mantisbt.org/bugs/view.php?id=16880
CVE: CVE-2014-1904
Published: 2014-03-20
Description: Cross-site scripting (XSS) vulnerability in web/servlet/tags/form/FormTag.java in Spring MVC in Spring Framework 3.0.0 before 3.2.8 and 4.0.0 before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via the requested URI in a default action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://docs.spring.io/spring/docs/3.2.8.RELEASE/changelog.txt; http://rhn.redhat.com/errata/RHSA-2014-0400.html; http://seclists.org/fulldisclosure/2014/Mar/101
CVE: CVE-2014-2077
Published: 2014-03-20
Description: Cross-site scripting (XSS) vulnerability in the frontend in Open-Xchange (OX) AppSuite 7.4.1 before 7.4.1-rev10 and 7.4.2 before 7.4.2-rev8 allows remote attackers to inject arbitrary web script or HTML via the subject of an email, involving 'the aria "tags" for screenreaders at the top bar'.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2014-03/0108.html; http://secunia.com/advisories/57290; http://archives.neohapsis.com/archives/bugtraq/2014-03/0108.html
CVE: CVE-2014-2219
Published: 2014-03-20
Description: Cross-site scripting (XSS) vulnerability in whizzywig/wb.php in CMSimple Classic 3.54 and earlier, possibly as downloaded before February 26, 2014, allows remote attackers to inject arbitrary web script or HTML via the d parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/archive/1/531527/100/0/threaded; http://www.securityfocus.com/bid/66312; https://www.htbridge.com/advisory/HTB23205
CVE: CVE-2014-2280
Published: 2014-03-20
Description: Cross-site scripting (XSS) vulnerability in the search feature in SeedDMS (formerly LetoDMS and MyDMS) before 4.3.4 allows remote attackers to inject arbitrary web script or HTML via the query parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2014-03/0101.html; http://packetstormsecurity.com/files/125726; http://secunia.com/advisories/57475
CVE: CVE-2013-6401
Published: 2014-03-21
Description: Jansson, possibly 2.4 and earlier, does not restrict the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted JSON document.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://comments.gmane.org/gmane.comp.security.oss.general/12099; http://lists.opensuse.org/opensuse-updates/2014-03/msg00057.html; https://bugzilla.redhat.com/show_bug.cgi?id=1035538
CVE: CVE-2014-0708
Published: 2014-03-21
Description: WebEx Meeting Center in Cisco WebEx Business Suite does not properly compose URLs for HTTP GET requests, which allows remote attackers to obtain sensitive information by reading (1) web-server access logs, (2) web-server Referer logs, or (3) a browser's history, aka Bug ID CSCul98272.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0708; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0708
CVE: CVE-2014-2119
Published: 2014-03-21
Description: The End User Safelist/Blocklist (aka SLBL) service in Cisco AsyncOS Software for Email Security Appliance (ESA) before 7.6.3-023 and 8.x before 8.0.1-023 and Cisco Content Security Management Appliance (SMA) before 7.9.1-110 and 8.x before 8.1.1-013 allows remote authenticated users to execute arbitrary code with root privileges via an FTP session that uploads a modified SLBL database file, aka Bug IDs CSCug79377 and CSCug80118.
CVSS Score: 8.5 (HIGH)
CWE: CWE-264
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140319-asyncos; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140319-asyncos
CVE: CVE-2014-2124
Published: 2014-03-21
Description: Cisco IOS 15.1(2)SY3 and earlier, when used with Supervisor Engine 2T (aka Sup2T) on Catalyst 6500 devices, allows remote attackers to cause a denial of service (device crash) via crafted multicast packets, aka Bug ID CSCuf60783.
CVSS Score: 7.1 (HIGH)
CWE: CWE-399
References: http://secunia.com/advisories/57515; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2124; http://tools.cisco.com/security/center/viewAlert.x?alertId=33413
CVE: CVE-2011-3195
Published: 2014-03-21
Description: shared/inc/sql/lists.php in Domain Technologie Control (DTC) before 0.34.1 allows remote authenticated users to execute arbitrary commands via shell metacharacters in mailing list tunable options.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://git.gplhost.com/gitweb/?p=dtc.git%3Ba=blob%3Bf=debian/changelog%3Bhb=3eb6ef5cea6c571aae5e49e1930de778eca280c3; http://www.debian.org/security/2011/dsa-2365; http://www.openwall.com/lists/oss-security/2011/08/13/1
CVE: CVE-2011-3196
Published: 2014-03-21
Description: The setup script in Domain Technologie Control (DTC) before 0.34.1 uses world-readable permissions for /etc/apache2/apache2.conf, which allows local users to obtain the dtcdaemons MySQL password by reading the file.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://git.gplhost.com/gitweb/?p=dtc.git%3Ba=blob%3Bf=debian/changelog%3Bhb=3eb6ef5cea6c571aae5e49e1930de778eca280c3; http://www.debian.org/security/2011/dsa-2365; http://www.openwall.com/lists/oss-security/2011/08/13/1
CVE: CVE-2011-3197
Published: 2014-03-21
Description: SQL injection vulnerability in Domain Technologie Control (DTC) before 0.34.1 allows remote authenticated users to execute arbitrary SQL commands via the addrlink parameter to shared/inc/forms/domain_info.php.  NOTE: CVE-2011-3197 has been SPLIT due to findings by different researchers. CVE-2011-5272 has been assigned for the vps_note parameter to dtcadmin/logPushlet.php vector.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://git.gplhost.com/gitweb/?p=dtc.git%3Ba=blob%3Bf=debian/changelog%3Bhb=3eb6ef5cea6c571aae5e49e1930de778eca280c3; http://www.debian.org/security/2011/dsa-2365; http://www.openwall.com/lists/oss-security/2011/08/13/1
CVE: CVE-2011-3198
Published: 2014-03-21
Description: Domain Technologie Control (DTC) before 0.34.1 includes a password in the -b command line argument to htpasswd, which might allow local users to read the password by listing the process and its arguments.
CVSS Score: 2.1 (LOW)
CWE: CWE-255
References: http://git.gplhost.com/gitweb/?p=dtc.git%3Ba=blob%3Bf=debian/changelog%3Bhb=3eb6ef5cea6c571aae5e49e1930de778eca280c3; http://www.debian.org/security/2011/dsa-2365; http://www.openwall.com/lists/oss-security/2011/08/13/1
CVE: CVE-2011-3199
Published: 2014-03-21
Description: Multiple cross-site scripting (XSS) vulnerabilities in Domain Technologie Control (DTC) before 0.34.1 allow remote authenticated users to inject arbitrary web script or HTML via the (1) message body of a support ticket or unspecified vectors to the (2) DNS and (3) MX form, as demonstrated by the "Domain root TXT record:" field.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://git.gplhost.com/gitweb/?p=dtc.git%3Ba=blob%3Bf=debian/changelog%3Bhb=3eb6ef5cea6c571aae5e49e1930de778eca280c3; http://www.debian.org/security/2011/dsa-2365; http://www.openwall.com/lists/oss-security/2011/08/13/1
CVE: CVE-2011-5272
Published: 2014-03-21
Description: SQL injection vulnerability in Domain Technologie Control (DTC) before 0.34.1 allows remote authenticated users to execute arbitrary SQL commands via the vps_note parameter to dtcadmin/logPushlet.php.  NOTE: this issue was originally part of CVE-2011-3197, but that ID was SPLIT due to different researchers.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://git.gplhost.com/gitweb/?p=dtc.git%3Ba=blob%3Bf=debian/changelog%3Bhb=3eb6ef5cea6c571aae5e49e1930de778eca280c3; http://www.debian.org/security/2011/dsa-2365; http://www.openwall.com/lists/oss-security/2011/08/13/1
CVE: CVE-2011-5273
Published: 2014-03-21
Description: Directory traversal vulnerability in shared/package-installer in Domain Technologie Control (DTC) before 0.34.1 allows remote authenticated users to execute arbitrary PHP code via a .. (dot dot) in the pkg parameter in a do_install action to dtc/.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: http://git.gplhost.com/gitweb/?p=dtc.git%3Ba=blob%3Bf=debian/changelog%3Bhb=3eb6ef5cea6c571aae5e49e1930de778eca280c3; http://www.debian.org/security/2011/dsa-2365; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=637629
CVE: CVE-2011-5274
Published: 2014-03-21
Description: The drawAdminTools_PackageInstaller function in shared/inc/forms/packager.php in Domain Technologie Control (DTC) before 0.32.11 allows remote attackers to execute arbitrary commands via shell metacharacters in the dtcpkg_directory parameter in a do_install action to dtc/.
CVSS Score: 7.5 (HIGH)
References: http://git.gplhost.com/gitweb/?p=dtc.git%3Ba=blob%3Bf=debian/changelog%3Bh=dec9970db76b82295e9003ca34cecab8d629da4f%3Bhb=65a7a1b166ea3c4325efd4da80a78498c829aa5a; http://git.gplhost.com/gitweb/?p=dtc.git%3Ba=commitdiff%3Bh=541d8457a6989a1a925bb866ed972a5f07c2de64; http://www.debian.org/security/2011/dsa-2365
CVE: CVE-2011-5275
Published: 2014-03-21
Description: The install script in Domain Technologie Control (DTC) before 0.34.1 gives sudo permissions for chrootuid to the dtc user, which makes it easier for context-dependent users to gain privileges.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://git.gplhost.com/gitweb/?p=dtc.git%3Ba=blob%3Bf=debian/changelog%3Bhb=3eb6ef5cea6c571aae5e49e1930de778eca280c3; http://www.debian.org/security/2011/dsa-2365; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=637618
CVE: CVE-2011-5276
Published: 2014-03-21
Description: SQL injection vulnerability in the drawAdminTools_PackageInstaller function in shared/inc/forms/packager.php in Domain Technologie Control (DTC) before 0.32.11 allows remote authenticated users to execute arbitrary SQL commands via the database_name parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://git.gplhost.com/gitweb/?p=dtc.git%3Ba=blob%3Bf=debian/changelog%3Bh=dec9970db76b82295e9003ca34cecab8d629da4f%3Bhb=65a7a1b166ea3c4325efd4da80a78498c829aa5a; http://git.gplhost.com/gitweb/?p=dtc.git%3Ba=commitdiff%3Bh=541d8457a6989a1a925bb866ed972a5f07c2de64; http://www.debian.org/security/2011/dsa-2365
CVE: CVE-2013-7340
Published: 2014-03-21
Description: VideoLAN VLC Media Player before 2.0.7 allows remote attackers to cause a denial of service (memory consumption) via a crafted playlist file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-399
References: http://www.videolan.org/developers/vlc-branch/NEWS; http://www.videolan.org/developers/vlc-branch/NEWS
CVE: CVE-2014-0002
Published: 2014-03-21
Description: The XSLT component in Apache Camel before 2.11.4 and 2.12.x before 2.12.3 allows remote attackers to read arbitrary files and possibly have other unspecified impact via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://camel.apache.org/security-advisories.data/CVE-2014-0002.txt.asc; http://rhn.redhat.com/errata/RHSA-2014-0371.html; http://rhn.redhat.com/errata/RHSA-2014-0372.html
CVE: CVE-2014-0003
Published: 2014-03-21
Description: The XSLT component in Apache Camel 2.11.x before 2.11.4, 2.12.x before 2.12.3, and possibly earlier versions allows remote attackers to execute arbitrary Java methods via a crafted message.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://camel.apache.org/security-advisories.data/CVE-2014-0003.txt.asc; http://rhn.redhat.com/errata/RHSA-2014-0245.html; http://rhn.redhat.com/errata/RHSA-2014-0254.html
CVE: CVE-2013-5401
Published: 2014-03-21
Description: The command-port listener in IBM WebSphere MQ Internet Pass-Thru (MQIPT) 2.x before 2.1.0.1 allows remote attackers to cause a denial of service (remote-administration outage) via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://www-01.ibm.com/support/docview.wss?uid=swg21666863; https://exchange.xforce.ibmcloud.com/vulnerabilities/87297; http://www-01.ibm.com/support/docview.wss?uid=swg21666863
CVE: CVE-2013-6729
Published: 2014-03-21
Description: Cross-site scripting (XSS) vulnerability in IBM QuickFile 1.0.0.0 before iFix 4 and 1.1.0.1 before iFix 3 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IC98112; http://www-01.ibm.com/support/docview.wss?uid=swg21667388; http://www.securityfocus.com/bid/66246
CVE: CVE-2014-0829
Published: 2014-03-21
Description: Multiple buffer overflows in IBM Rational ClearCase 7.x before 7.1.2.13, 8.0.0.x before 8.0.0.10, and 8.0.1.x before 8.0.1.3 allow remote authenticated users to obtain privileged access via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: http://www-01.ibm.com/support/docview.wss?&uid=swg21662086; http://www.securityfocus.com/bid/66339; https://exchange.xforce.ibmcloud.com/vulnerabilities/90568
CVE: CVE-2014-0879
Published: 2014-03-21
Description: Stack-based buffer overflow in the Taskmaster Capture ActiveX control in IBM Datacap Taskmaster Capture 8.0.1, and 8.1 before FP2, allows remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www-01.ibm.com/support/docview.wss?uid=swg21666888; https://exchange.xforce.ibmcloud.com/vulnerabilities/91115; http://www-01.ibm.com/support/docview.wss?uid=swg21666888
CVE: CVE-2014-2567
Published: 2014-03-21
Description: The OpenConnectionTask::handleStateHelper function in Imap/Tasks/OpenConnectionTask.cpp in Trojita before 0.4.1 allows man-in-the-middle attackers to trigger use of cleartext for saving a message into a (1) sent or (2) draft folder via a PREAUTH response that prevents later use of the STARTTLS command.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://jkt.flaska.net/blog/Trojita_0_4_1__a_security_update_for_CVE_2014_2567.html; https://github.com/jktjkt/trojita/commit/25fffa3e25cbad85bbca804193ad336b090a9ce1; http://jkt.flaska.net/blog/Trojita_0_4_1__a_security_update_for_CVE_2014_2567.html
CVE: CVE-2014-2276
Published: 2014-03-21
Description: The FileUploadController servlet in EMC Connectrix Manager Converged Network Edition (CMCNE) before 12.1.5 does not properly restrict additions to the Connectrix Manager repository, which allows remote attackers to obtain sensitive information by importing a crafted firmware file.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://archives.neohapsis.com/archives/bugtraq/2014-03/0115.html; http://secunia.com/advisories/57513; http://www.securityfocus.com/bid/66308
CVE: CVE-2014-2497
Published: 2014-03-21
Description: The gdImageCreateFromXpm function in gdxpm.c in libgd, as used in PHP 5.4.26 and earlier, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted color table in an XPM file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-476
References: http://advisories.mageia.org/MGASA-2014-0288.html; http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2014-07/msg00001.html
CVE: CVE-2013-7341
Published: 2014-03-24
Description: Multiple cross-site scripting (XSS) vulnerabilities in Flowplayer Flash before 3.2.17, as used in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2, allow remote attackers to inject arbitrary web script or HTML by (1) providing a crafted playerId or (2) referencing an external domain, a related issue to CVE-2013-7342.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://flash.flowplayer.org/documentation/version-history.html; http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-43344; http://openwall.com/lists/oss-security/2014/03/17/1
CVE: CVE-2013-7342
Published: 2014-03-24
Description: Cross-site scripting (XSS) vulnerability in flowplayer.swf in the Flash fallback feature in Flowplayer HTML5 5.4.1 allows remote attackers to inject arbitrary web script or HTML via the callback parameter, a related issue to CVE-2013-7341.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://github.com/flowplayer/flowplayer/commit/017f8c2a0865ab31e01d591adc43d34f2dd60e59; https://github.com/flowplayer/flowplayer/issues/381; https://github.com/flowplayer/flowplayer/commit/017f8c2a0865ab31e01d591adc43d34f2dd60e59