deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-1729
Published: 2014-04-09
Description: Multiple unspecified vulnerabilities in Google V8 before 3.24.35.22, as used in Google Chrome before 34.0.1847.116, allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html; http://lists.opensuse.org/opensuse-updates/2014-05/msg00012.html; http://security.gentoo.org/glsa/glsa-201408-16.xml
CVE: CVE-2014-0165
Published: 2014-04-10
Description: WordPress before 3.7.2 and 3.8.x before 3.8.2 allows remote authenticated users to publish posts by leveraging the Contributor role, related to wp-admin/includes/post.php and wp-admin/includes/class-wp-posts-list-table.php.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://codex.wordpress.org/Version_3.7.2; http://codex.wordpress.org/Version_3.8.2; http://core.trac.wordpress.org/changeset/27976
CVE: CVE-2014-0166
Published: 2014-04-10
Description: The wp_validate_auth_cookie function in wp-includes/pluggable.php in WordPress before 3.7.2 and 3.8.x before 3.8.2 does not properly determine the validity of authentication cookies, which makes it easier for remote attackers to obtain access via a forged cookie.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-287
References: http://codex.wordpress.org/Version_3.7.2; http://codex.wordpress.org/Version_3.8.2; http://core.trac.wordpress.org/changeset/28054
CVE: CVE-2014-2544
Published: 2014-04-10
Description: Unspecified vulnerability in Spotfire Web Player Engine, Spotfire Desktop, and Spotfire Server Authentication Module in TIBCO Spotfire Server 3.3.x before 3.3.4, 4.5.x before 4.5.1, 5.0.x before 5.0.2, 5.5.x before 5.5.1, and 6.x before 6.0.2; Spotfire Professional 4.0.x before 4.0.4, 4.5.x before 4.5.2, 5.0.x before 5.0.2, 5.5.x before 5.5.1, and 6.x before 6.0.1; Spotfire Web Player 4.0.x before 4.0.4, 4.5.x before 4.5.2, 5.0.x before 5.0.2, 5.5.x before 5.5.1, and 6.x before 6.0.1; Spotfire Automation Services 4.0.x before 4.0.4, 4.5.x before 4.5.2, 5.0.x before 5.0.2, 5.5.x before 5.5.1, and 6.x before 6.0.1; Spotfire Deployment Kit 4.0.x before 4.0.4, 4.5.x before 4.5.2, 5.0.x before 5.0.2, 5.5.x before 5.5.1, and 6.x before 6.0.1; Spotfire Desktop 6.x before 6.0.1; and Spotfire Analyst 6.x before 6.0.1 allows remote attackers to execute arbitrary code via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://www.tibco.com/mk/advisory.jsp; http://www.tibco.com/multimedia/spotfire_advisory_20140409_tcm8-20764.txt; http://www.tibco.com/mk/advisory.jsp
CVE: CVE-2014-2126
Published: 2014-04-10
Description: Cisco Adaptive Security Appliance (ASA) Software 8.2 before 8.2(5.47), 8.4 before 8.4(7.5), 8.7 before 8.7(1.11), 9.0 before 9.0(3.10), and 9.1 before 9.1(3.4) allows remote authenticated users to gain privileges by leveraging level-0 ASDM access, aka Bug ID CSCuj33496.
CVSS Score: 8.5 (HIGH)
CWE: CWE-264
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140409-asa; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140409-asa
CVE: CVE-2014-2127
Published: 2014-04-10
Description: Cisco Adaptive Security Appliance (ASA) Software 8.x before 8.2(5.48), 8.3 before 8.3(2.40), 8.4 before 8.4(7.9), 8.6 before 8.6(1.13), 9.0 before 9.0(4.1), and 9.1 before 9.1(4.3) does not properly process management-session information during privilege validation for SSL VPN portal connections, which allows remote authenticated users to gain privileges by establishing a Clientless SSL VPN session and entering crafted URLs, aka Bug ID CSCul70099.
CVSS Score: 8.5 (HIGH)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140409-asa; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140409-asa
CVE: CVE-2014-2128
Published: 2014-04-10
Description: The SSL VPN implementation in Cisco Adaptive Security Appliance (ASA) Software 8.2 before 8.2(5.47, 8.3 before 8.3(2.40), 8.4 before 8.4(7.3), 8.6 before 8.6(1.13), 9.0 before 9.0(3.8), and 9.1 before 9.1(3.2) allows remote attackers to bypass authentication via (1) a crafted cookie value within modified HTTP POST data or (2) a crafted URL, aka Bug ID CSCua85555.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-287
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140409-asa; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140409-asa
CVE: CVE-2014-2129
Published: 2014-04-10
Description: The SIP inspection engine in Cisco Adaptive Security Appliance (ASA) Software 8.2 before 8.2(5.48), 8.4 before 8.4(6.5), 9.0 before 9.0(3.1), and 9.1 before 9.1(2.5) allows remote attackers to cause a denial of service (memory consumption or device reload) via crafted SIP packets, aka Bug ID CSCuh44052.
CVSS Score: 7.1 (HIGH)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140409-asa; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140409-asa
CVE: CVE-2014-2141
Published: 2014-04-10
Description: The session-termination functionality on Cisco ONS 15454 controller cards with software 9.6 and earlier does not initialize an unspecified pointer, which allows remote authenticated users to cause a denial of service (card reset) via crafted session-close actions, aka Bug ID CSCug97416.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-119
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2141; http://tools.cisco.com/security/center/viewAlert.x?alertId=33682; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2141
CVE: CVE-2012-4921
Published: 2014-04-10
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the DVS Custom Notification plugin 1.0.1 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change application settings or (2) conduct cross-site scripting (XSS) attacks.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://osvdb.org/89441; http://secunia.com/advisories/51531; http://osvdb.org/89441
CVE: CVE-2013-2033
Published: 2014-04-10
Description: Cross-site scripting (XSS) vulnerability in Jenkins before 1.514, LTS before 1.509.1, and Enterprise 1.466.x before 1.466.14.1 and 1.480.x before 1.480.4.1 allows remote authenticated users with write permission to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://osvdb.org/92982; http://www.cloudbees.com/jenkins-advisory/jenkins-security-advisory-2013-05-02.cb; https://exchange.xforce.ibmcloud.com/vulnerabilities/84004
CVE: CVE-2013-2693
Published: 2014-04-10
Description: Cross-site request forgery (CSRF) vulnerability in the Options in the WP-Print plugin before 2.52 for WordPress allows remote attackers to hijack the authentication of administrators for requests that manipulate plugin settings via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://osvdb.org/92053; http://secunia.com/advisories/52878; http://wordpress.org/plugins/wp-print/changelog
CVE: CVE-2013-2699
Published: 2014-04-10
Description: Cross-site request forgery (CSRF) vulnerability in the underConstruction plugin before 1.09 for WordPress allows remote attackers to hijack the authentication of administrators for requests that deactivate a plugin via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://osvdb.org/93857; http://secunia.com/advisories/52881; http://wordpress.org/plugins/underconstruction/changelog
CVE: CVE-2013-3251
Published: 2014-04-10
Description: Cross-site request forgery (CSRF) vulnerability in the qTranslate plugin 2.5.34 and earlier for WordPress allows remote attackers to hijack the authentication of administrators for requests that change plugin settings via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://osvdb.org/93873; http://secunia.com/advisories/53126; http://osvdb.org/93873
CVE: CVE-2013-3252
Published: 2014-04-10
Description: Cross-site request forgery (CSRF) vulnerability in the options admin page in the WP-PostViews plugin before 1.63 for WordPress allows remote attackers to hijack the authentication of administrators for requests that change plugin settings via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://osvdb.org/93096; http://secunia.com/advisories/53127; http://wordpress.org/plugins/wp-postviews/changelog
CVE: CVE-2013-6468
Published: 2014-04-10
Description: JBoss Drools, Red Hat JBoss BRMS before 6.0.1, and Red Hat JBoss BPM Suite before 6.0.1 allows remote authenticated users to execute arbitrary Java code via a (1) MVFLEX Expression Language (MVEL) or (2) Drools expression.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-94
References: http://rhn.redhat.com/errata/RHSA-2014-0371.html; http://rhn.redhat.com/errata/RHSA-2014-0372.html; http://secunia.com/advisories/57716
CVE: CVE-2014-0331
Published: 2014-04-10
Description: Cross-site scripting (XSS) vulnerability in the web administration interface in FortiADC with firmware before 3.2.1 allows remote attackers to inject arbitrary web script or HTML via the locale parameter to gui_partA/.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2014/Apr/53; http://www.fortiguard.com/advisory/FG-IR-14-004; http://www.kb.cert.org/vuls/id/667340
CVE: CVE-2014-1455
Published: 2014-04-10
Description: SQL injection vulnerability in the password reset functionality in Pearson eSIS Enterprise Student Information System, possibly 3.3.0.13 and earlier, allows remote attackers to execute arbitrary SQL commands via the new password.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/archive/1/531751/100/0/threaded; http://www.securityfocus.com/bid/66689; http://www.securityfocus.com/archive/1/531751/100/0/threaded
CVE: CVE-2014-2583
Published: 2014-04-10
Description: Multiple directory traversal vulnerabilities in pam_timestamp.c in the pam_timestamp module for Linux-PAM (aka pam) 1.1.8 allow local users to create arbitrary files or possibly bypass authentication via a .. (dot dot) in the (1) PAM_RUSER value to the get_ruser function or (2) PAM_TTY value to the check_tty function, which is used by the format_timestamp_name function.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/57317; http://www.openwall.com/lists/oss-security/2014/03/24/5; http://www.openwall.com/lists/oss-security/2014/03/26/10
CVE: CVE-2014-2708
Published: 2014-04-10
Description: Multiple SQL injection vulnerabilities in graph_xport.php in Cacti 0.8.7g, 0.8.8b, and earlier allow remote attackers to execute arbitrary SQL commands via the (1) graph_start, (2) graph_end, (3) graph_height, (4) graph_width, (5) graph_nolegend, (6) print_source, (7) local_graph_id, or (8) rra_id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://bugs.cacti.net/view.php?id=2405; http://lists.fedoraproject.org/pipermail/package-announce/2014-April/131821.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-April/131842.html
CVE: CVE-2012-6132
Published: 2014-04-10
Description: Cross-site scripting (XSS) vulnerability in Roundup before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via the otk parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2012/11/10/2; http://www.openwall.com/lists/oss-security/2013/02/13/8; https://bugzilla.redhat.com/show_bug.cgi?id=722672
CVE: CVE-2013-0740
Published: 2014-04-10
Description: Open redirect vulnerability in Dell OpenManage Server Administrator (OMSA) before 7.3.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the file parameter to HelpViewer.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://osvdb.org/95545; http://secunia.com/advisories/52742; http://www.securityfocus.com/bid/61383
CVE: CVE-2013-7355
Published: 2014-04-10
Description: SQL injection vulnerability in SAP BI Universal Data Integration allows remote attackers to execute arbitrary SQL commands via unspecified vectors, related to the J2EE schema.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.onapsis.com/get.php?resid=adv_onapsis-2013-013; http://www.onapsis.com/research-advisories.php; http://www.onapsis.com/get.php?resid=adv_onapsis-2013-013
CVE: CVE-2013-7356
Published: 2014-04-10
Description: Unspecified vulnerability in the SAP CCMS / Database Monitors for Oracle allows attackers to obtain the database password via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://www.onapsis.com/get.php?resid=adv_onapsis-2013-012; http://www.onapsis.com/research-advisories.php; http://www.onapsis.com/get.php?resid=adv_onapsis-2013-012
CVE: CVE-2013-7357
Published: 2014-04-10
Description: Unspecified vulnerability in the configuration service in SAP J2EE Engine allows remote attackers to obtain credential information via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://www.onapsis.com/get.php?resid=adv_onapsis-2013-010; http://www.onapsis.com/research-advisories.php; http://www.onapsis.com/get.php?resid=adv_onapsis-2013-010
CVE: CVE-2013-7358
Published: 2014-04-10
Description: Unspecified vulnerability in SAP Guided Procedures Archive Monitor allows remote attackers to obtain usernames, roles, profiles, and possibly other identity information via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://www.onapsis.com/get.php?resid=adv_onapsis-2013-011; http://www.onapsis.com/research-advisories.php; http://www.onapsis.com/get.php?resid=adv_onapsis-2013-011
CVE: CVE-2013-7359
Published: 2014-04-10
Description: Unspecified vulnerability in SAP Mobile Infrastructure allows remote attackers to obtain sensitive port information via unknown vectors, related to an "internal port scanning" issue.
CVSS Score: 5.0 (MEDIUM)
References: http://www.onapsis.com/get.php?resid=adv_onapsis-2013-009; http://www.onapsis.com/research-advisories.php; http://www.onapsis.com/get.php?resid=adv_onapsis-2013-009
CVE: CVE-2013-7360
Published: 2014-04-10
Description: Unspecified vulnerability in SAP adminadapter allows remote attackers to read or write to arbitrary files via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://www.onapsis.com/get.php?resid=adv_onapsis-2013-007; http://www.onapsis.com/research-advisories.php; http://www.onapsis.com/get.php?resid=adv_onapsis-2013-007
CVE: CVE-2013-7361
Published: 2014-04-10
Description: Directory traversal vulnerability in SAP CMS and CM Services allows attackers to upload arbitrary files via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://www.onapsis.com/get.php?resid=adv_onapsis-2013-008; http://www.onapsis.com/research-advisories.php; http://www.onapsis.com/get.php?resid=adv_onapsis-2013-008
CVE: CVE-2013-7362
Published: 2014-04-10
Description: An unspecified RFC function in SAP CCMS Agent allows remote attackers to execute arbitrary commands via unknown vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://archives.neohapsis.com/archives/bugtraq/2013-02/0135.html; http://scn.sap.com/docs/DOC-8218; http://www.onapsis.com/get.php?resid=adv_onapsis-2013-005
CVE: CVE-2013-7363
Published: 2014-04-10
Description: Unspecified vulnerability in the Diagnostics (SMD) agent in SAP Solution Manager allows remote attackers to obtain sensitive information, modify the configuration of applications, and install or remove applications via vectors involving the P4 protocol.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2013-02/0134.html; http://scn.sap.com/docs/DOC-8218; http://www.onapsis.com/get.php?resid=adv_onapsis-2013-006
CVE: CVE-2013-7364
Published: 2014-04-10
Description: An unspecified J2EE core service in the J2EE Engine in SAP NetWeaver does not properly restrict access, which allows remote attackers to read and write to arbitrary files via unknown vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://archives.neohapsis.com/archives/bugtraq/2013-02/0133.html; http://scn.sap.com/docs/DOC-8218; http://www.onapsis.com/get.php?resid=adv_onapsis-2013-004
CVE: CVE-2013-7365
Published: 2014-04-10
Description: Cross-site scripting (XSS) vulnerability in SAP Enterprise Portal allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2013-02/0132.html; http://scn.sap.com/docs/DOC-8218; http://www.onapsis.com/get.php?resid=adv_onapsis-2013-003
CVE: CVE-2013-7366
Published: 2014-04-10
Description: The SAP Software Deployment Manager (SDM), in certain unspecified conditions, allows remote attackers to cause a denial of service via vectors related to failed authentications.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-287
References: http://archives.neohapsis.com/archives/bugtraq/2013-02/0131.html; http://scn.sap.com/docs/DOC-8218; http://www.onapsis.com/get.php?resid=adv_onapsis-2013-002
CVE: CVE-2013-7367
Published: 2014-04-10
Description: SAP Enterprise Portal does not properly restrict access to the Federation configuration pages, which allows remote attackers to gain privileges via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://archives.neohapsis.com/archives/bugtraq/2013-02/0130.html; http://scn.sap.com/docs/DOC-8218; http://www.onapsis.com/get.php?resid=adv_onapsis-2013-001
CVE: CVE-2014-2748
Published: 2014-04-10
Description: The Security Audit Log facility in SAP Enhancement Package (EHP) 6 for SAP ERP 6.0 allows remote attackers to modify or delete arbitrary log classes via unspecified vectors.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/57741; http://www.onapsis.com/get.php?resid=adv_onapsis-2014-002; http://www.onapsis.com/research-advisories.php
CVE: CVE-2014-2749
Published: 2014-04-10
Description: The HANA ICM process in SAP HANA allows remote attackers to obtain the platform version, host name, instance number, and possibly other sensitive information via a malformed HTTP GET request.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://secunia.com/advisories/57443; http://www.onapsis.com/get.php?resid=adv_onapsis-2014-001; http://www.onapsis.com/research-advisories.php
CVE: CVE-2014-2750
Published: 2014-04-10
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2014-2744, CVE-2014-2745.  Reason: This candidate is a duplicate of CVE-2014-2744 and/or CVE-2014-2745.  Notes: All CVE users should reference CVE-2014-2744 and/or CVE-2014-2745 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2014-2751
Published: 2014-04-10
Description: SAP Print and Output Management has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-255
References: http://secunia.com/advisories/57737; http://www.onapsis.com/get.php?resid=adv_onapsis-2014-004; http://www.onapsis.com/research-advisories.php
CVE: CVE-2014-2752
Published: 2014-04-10
Description: SAP Business Object Processing Framework (BOPF) for ABAP has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-255
References: http://secunia.com/advisories/57736; http://www.onapsis.com/get.php?resid=adv_onapsis-2014-003; http://www.onapsis.com/research-advisories.php
CVE: CVE-2014-0908
Published: 2014-04-10
Description: The User Attribute implementation in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.2, and 8.5.x through 8.5.0.1 does not verify authorization for read or write access to attribute values, which allows remote authenticated users to obtain sensitive information, configure e-mail notifications, or modify task assignments via REST API calls.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg1JR49505; http://www-01.ibm.com/support/docview.wss?uid=swg21669330; https://exchange.xforce.ibmcloud.com/vulnerabilities/91870
CVE: CVE-2014-0920
Published: 2014-04-10
Description: IBM SPSS Analytic Server 1.0 before IF002 and 1.0.1 before IF004 logs cleartext passwords, which allows remote authenticated users to obtain sensitive information via unspecified vectors.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-255
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PI13527; http://www-01.ibm.com/support/docview.wss?uid=swg21669506; https://exchange.xforce.ibmcloud.com/vulnerabilities/92073
CVE: CVE-2014-2741
Published: 2014-04-11
Description: nio/XMLLightweightParser.java in Ignite Realtime Openfire before 3.9.2 does not properly restrict the processing of compressed XML elements, which allows remote attackers to cause a denial of service (resource consumption) via a crafted XMPP stream, aka an "xmppbomb" attack.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://community.igniterealtime.org/thread/52317; http://fisheye.igniterealtime.org/changelog/openfiregit?cs=3aec383e07ee893b77396fe946766bbd3758af77; http://openwall.com/lists/oss-security/2014/04/07/7
CVE: CVE-2014-2742
Published: 2014-04-11
Description: Isode M-Link before 16.0v7 does not properly restrict the processing of compressed XML elements, which allows remote attackers to cause a denial of service (resource consumption) via a crafted XMPP stream, aka an "xmppbomb" attack.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://openwall.com/lists/oss-security/2014/04/07/7; http://openwall.com/lists/oss-security/2014/04/09/1; http://xmpp.org/resources/security-notices/uncontrolled-resource-consumption-with-highly-compressed-xmpp-stanzas/
CVE: CVE-2014-2743
Published: 2014-04-11
Description: plugins/mod_compression.lua in Lightwitch Metronome through 3.4 does not properly restrict the processing of compressed XML elements, which allows remote attackers to cause a denial of service (resource consumption) via a crafted XMPP stream, aka an "xmppbomb" attack.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://code.lightwitch.org/metronome/rev/49f47277a411; http://openwall.com/lists/oss-security/2014/04/07/7; http://openwall.com/lists/oss-security/2014/04/09/1
CVE: CVE-2014-2744
Published: 2014-04-11
Description: plugins/mod_compression.lua in (1) Prosody before 0.9.4 and (2) Lightwitch Metronome through 3.4 negotiates stream compression while a session is unauthenticated, which allows remote attackers to cause a denial of service (resource consumption) via compressed XML elements in an XMPP stream, aka an "xmppbomb" attack.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://blog.prosody.im/prosody-0-9-4-released/; http://code.lightwitch.org/metronome/rev/49f47277a411; http://hg.prosody.im/0.9/rev/b3b1c9da38fb
CVE: CVE-2014-2745
Published: 2014-04-11
Description: Prosody before 0.9.4 does not properly restrict the processing of compressed XML elements, which allows remote attackers to cause a denial of service (resource consumption) via a crafted XMPP stream, aka an "xmppbomb" attack, related to core/portmanager.lua and util/xmppstream.lua.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://blog.prosody.im/prosody-0-9-4-released/; http://hg.prosody.im/0.9/rev/1107d66d2ab2; http://hg.prosody.im/0.9/rev/a97591d2e1ad
CVE: CVE-2014-2746
Published: 2014-04-11
Description: net/IOService.java in Tigase before 5.2.1 does not properly restrict the processing of compressed XML elements, which allows remote attackers to cause a denial of service (resource consumption) via a crafted XMPP stream, aka an "xmppbomb" attack.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://openwall.com/lists/oss-security/2014/04/07/7; http://openwall.com/lists/oss-security/2014/04/09/1; http://www.tigase.org/content/uncontrolled-resource-consumption-highly-compressed-xmpp-messages