deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2012-6108
Published: 2014-02-15
Description: HP Linux Imaging and Printing (HPLIP) before 3.13.2 uses world-writable permissions for /var/log/hp and /var/log/hp/tmp, which allows local users to delete log files via standard filesystem operations.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://sourceforge.net/projects/hplip/files/hplip/3.13.2/hplip-3.13.2.tar.gz/download; https://bugs.launchpad.net/hplip/+bug/1016507/comments/1; https://bugs.launchpad.net/hplip/+bug/1016507/comments/6
CVE: CVE-2012-6638
Published: 2014-02-15
Description: The tcp_rcv_state_process function in net/ipv4/tcp_input.c in the Linux kernel before 3.2.24 allows remote attackers to cause a denial of service (kernel resource consumption) via a flood of SYN+FIN TCP packets, a different vulnerability than CVE-2012-2663.
CVSS Score: 7.8 (HIGH)
CWE: CWE-400
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=fdf5af0daf8019cec2396cdef8fb042d80fe71fa; http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.2.24; https://bugzilla.redhat.com/show_bug.cgi?id=826702
CVE: CVE-2013-0346
Published: 2014-02-15
Description: Apache Tomcat 7.x uses world-readable permissions for the log directory and its files, which might allow local users to obtain sensitive information by reading a file. NOTE: One Tomcat distributor has stated "The tomcat log directory does not contain any sensitive information."
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://www.openwall.com/lists/oss-security/2013/02/23/5; https://bugzilla.redhat.com/show_bug.cgi?id=924841; http://www.openwall.com/lists/oss-security/2013/02/23/5
CVE: CVE-2013-4737
Published: 2014-02-15
Description: The CONFIG_STRICT_MEMORY_RWX implementation for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, does not properly consider certain memory sections, which makes it easier for attackers to bypass intended access restrictions by leveraging the presence of RWX memory at a fixed location.
CVSS Score: 9.3 (HIGH)
CWE: CWE-264
References: https://www.codeaurora.org/projects/security-advisories/configstrictmemoryrwx-not-strictly-enforced-cve-2013-4737; https://www.codeaurora.org/projects/security-advisories/configstrictmemoryrwx-not-strictly-enforced-cve-2013-4737
CVE: CVE-2013-6166
Published: 2014-02-15
Description: Google Chrome before 29 sends HTTP Cookie headers without first validating that they have the required character-set restrictions, which allows remote attackers to conduct the equivalent of a persistent Logout CSRF attack via a crafted parameter that forces a web application to set a malformed cookie within an HTTP response.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://redmine.lighttpd.net/issues/2188; http://seclists.org/oss-sec/2013/q4/117; http://seclists.org/oss-sec/2013/q4/121
CVE: CVE-2013-6167
Published: 2014-02-15
Description: Mozilla Firefox through 27 sends HTTP Cookie headers without first validating that they have the required character-set restrictions, which allows remote attackers to conduct the equivalent of a persistent Logout CSRF attack via a crafted parameter that forces a web application to set a malformed cookie within an HTTP response.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://redmine.lighttpd.net/issues/2188; http://seclists.org/oss-sec/2013/q4/117; http://seclists.org/oss-sec/2013/q4/121
CVE: CVE-2011-0528
Published: 2014-02-17
Description: Puppet 2.6.0 through 2.6.3 does not properly restrict access to node resources, which allows remote authenticated Puppet nodes to read or modify the resources of other nodes via unspecified vectors.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-264
References: http://www.mail-archive.com/puppet-users%40googlegroups.com/msg16429.html; http://www.openwall.com/lists/oss-security/2011/01/27/6; http://www.openwall.com/lists/oss-security/2011/01/31/5
CVE: CVE-2011-3601
Published: 2014-02-17
Description: Buffer overflow in the process_ra function in the router advertisement daemon (radvd) before 1.8.2 allows remote attackers to execute arbitrary code or cause a denial of service (crash) via a negative value in a label_len value.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.litech.org/radvd/CHANGES; http://www.openwall.com/lists/oss-security/2011/10/06/3; http://www.ubuntu.com/usn/USN-1257-1
CVE: CVE-2011-3604
Published: 2014-02-17
Description: The process_ra function in the router advertisement daemon (radvd) before 1.8.2 allows remote attackers to cause a denial of service (stack-based buffer over-read and crash) via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.debian.org/security/2011/dsa-2323; http://www.litech.org/radvd/CHANGES; http://www.openwall.com/lists/oss-security/2011/10/06/3
CVE: CVE-2011-3605
Published: 2014-02-17
Description: The process_rs function in the router advertisement daemon (radvd) before 1.8.2, when UnicastOnly is enabled, allows remote attackers to cause a denial of service (temporary service hang) via a large number of ND_ROUTER_SOLICIT requests.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://www.debian.org/security/2011/dsa-2323; http://www.litech.org/radvd/CHANGES; http://www.openwall.com/lists/oss-security/2011/10/06/3
CVE: CVE-2011-4083
Published: 2014-02-17
Description: The sosreport utility in the Red Hat sos package before 1.7-9 and 2.x before 2.2-17 includes (1) Certificate-based Red Hat Network private entitlement keys and the (2) private key for the entitlement in an archive of debugging information, which might allow remote attackers to obtain sensitive information by reading the archive.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-310
References: http://rhn.redhat.com/errata/RHSA-2011-1536.html; http://rhn.redhat.com/errata/RHSA-2012-0153.html; http://rhn.redhat.com/errata/RHSA-2011-1536.html
CVE: CVE-2012-0270
Published: 2014-02-17
Description: Multiple stack-based buffer overflows in Csound before 5.16.6 allow remote attackers to execute arbitrary code via a crafted (1) hetro file to the getnum function in util/heti_main.c or (2) PVOC file to the getnum function in util/pv_import.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00027.html; http://lists.opensuse.org/opensuse-updates/2012-03/msg00027.html; http://secunia.com/advisories/47585
CVE: CVE-2013-1069
Published: 2014-02-17
Description: Ubuntu Metal as a Service (MaaS) 1.2 and 1.4 uses world-readable permissions for txlongpoll.yaml, which allows local users to obtain RabbitMQ authentication credentials by reading the file.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://www.ubuntu.com/usn/USN-2105-1; https://bugs.launchpad.net/ubuntu/%2Bsource/maas/%2Bbug/1254034; http://www.ubuntu.com/usn/USN-2105-1
CVE: CVE-2013-1070
Published: 2014-02-17
Description: Cross-site scripting (XSS) vulnerability in the API in Ubuntu Metal as a Service (MaaS) 1.2 and 1.4 allows remote attackers to inject arbitrary web script or HTML via the op parameter to nodes/.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/65575; http://www.ubuntu.com/usn/USN-2105-1; https://bugs.launchpad.net/maas/%2Bbug/1251336
CVE: CVE-2013-6674
Published: 2014-02-17
Description: Cross-site scripting (XSS) vulnerability in Mozilla Thunderbird 17.x through 17.0.8, Thunderbird ESR 17.x through 17.0.10, and SeaMonkey before 2.20 allows user-assisted remote attackers to inject arbitrary web script or HTML via an e-mail message containing a data: URL in an IFRAME element, a related issue to CVE-2014-2018.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/102566; http://packetstormsecurity.com/files/124965/Mozilla-Thunderbird-Filter-Bypass.html; http://seclists.org/fulldisclosure/2014/Jan/182
CVE: CVE-2014-2018
Published: 2014-02-17
Description: Cross-site scripting (XSS) vulnerability in Mozilla Thunderbird 17.x through 17.0.8, Thunderbird ESR 17.x through 17.0.10, and SeaMonkey before 2.20 allows user-assisted remote attackers to inject arbitrary web script or HTML via an e-mail message containing a data: URL in a (1) OBJECT or (2) EMBED element, a related issue to CVE-2013-6674.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.kb.cert.org/vuls/id/863369; http://www.mozilla.org/security/announce/2014/mfsa2014-14.html; http://www.oracle.com/technetwork/topics/security/bulletinapr2[PII_REDACTED].html
CVE: CVE-2014-0625
Published: 2014-02-18
Description: The SSLSocket implementation in the (1) JSAFE and (2) JSSE APIs in EMC RSA BSAFE SSL-J 5.x before 5.1.3 and 6.x before 6.0.2 allows remote attackers to cause a denial of service (memory consumption) by triggering application-data processing during the TLS handshake, a time at which the data is internally buffered.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://archives.neohapsis.com/archives/bugtraq/2014-02/0061.html; http://archives.neohapsis.com/archives/bugtraq/2014-02/0061.html
CVE: CVE-2014-0626
Published: 2014-02-18
Description: The (1) JSAFE and (2) JSSE APIs in EMC RSA BSAFE SSL-J 5.x before 5.1.3 and 6.x before 6.0.2 make it easier for remote attackers to bypass intended cryptographic protection mechanisms by triggering application-data processing during the TLS handshake, a time at which the data is both unencrypted and unauthenticated.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://archives.neohapsis.com/archives/bugtraq/2014-02/0061.html; http://archives.neohapsis.com/archives/bugtraq/2014-02/0061.html
CVE: CVE-2014-0627
Published: 2014-02-18
Description: The SSLEngine API implementation in EMC RSA BSAFE SSL-J 5.x before 5.1.3 and 6.x before 6.0.2 allows remote attackers to trigger the selection of a weak cipher suite by using the wrap method during a certain incomplete-handshake state.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://archives.neohapsis.com/archives/bugtraq/2014-02/0061.html; http://archives.neohapsis.com/archives/bugtraq/2014-02/0061.html
CVE: CVE-2013-7226
Published: 2014-02-18
Description: Integer overflow in the gdImageCrop function in ext/gd/gd.c in PHP 5.5.x before 5.5.9 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via an imagecrop function call with a large x dimension value, leading to a heap-based buffer overflow.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-189
References: http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=8f4a5373bb71590352fd934028d6dde5bc18530b; http://secunia.com/advisories/56829; http://www.mandriva.com/security/advisories?name=MDVSA-2014:027
CVE: CVE-2013-7327
Published: 2014-02-18
Description: The gdImageCrop function in ext/gd/gd.c in PHP 5.5.x before 5.5.9 does not check return values, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via invalid imagecrop arguments that lead to use of a NULL pointer as a return value, a different vulnerability than CVE-2013-7226.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=8f4a5373bb71590352fd934028d6dde5bc18530b; http://www.ubuntu.com/usn/USN-2126-1; https://bugs.php.net/bug.php?id=66356
CVE: CVE-2013-7328
Published: 2014-02-18
Description: Multiple integer signedness errors in the gdImageCrop function in ext/gd/gd.c in PHP 5.5.x before 5.5.9 allow remote attackers to cause a denial of service (application crash) or obtain sensitive information via an imagecrop function call with a negative value for the (1) x or (2) y dimension, a different vulnerability than CVE-2013-7226.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-189
References: http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=8f4a5373bb71590352fd934028d6dde5bc18530b; http://www.ubuntu.com/usn/USN-2126-1; https://bugs.php.net/bug.php?id=66356
CVE: CVE-2014-1861
Published: 2014-02-18
Description: The client in Jetro COCKPIT Secure Browsing (JCSB) 4.3.1 and 4.3.3 does not validate the FileName element in an RDP_FILE_TRANSFER document, which allows remote JCSB servers to execute arbitrary programs by providing a .EXE extension.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://archives.neohapsis.com/archives/bugtraq/2014-02/0075.html; http://blog.quaji.com/2014/02/remote-code-execution-on-all-enterprise.html; http://archives.neohapsis.com/archives/bugtraq/2014-02/0075.html
CVE: CVE-2014-1903
Published: 2014-02-18
Description: admin/libraries/view.functions.php in FreePBX 2.9 before 2.9.0.14, 2.10 before 2.10.1.15, 2.11 before 2.11.0.23, and 12 before 12.0.1alpha22 does not restrict the set of functions accessible to the API handler, which allows remote attackers to execute arbitrary PHP code via the function and args parameters to admin/config.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://archives.neohapsis.com/archives/fulldisclosure/2014-02/0097.html; http://archives.neohapsis.com/archives/fulldisclosure/2014-02/0111.html; http://code.freepbx.org/changelog/FreePBX_Framework?cs=a29382efeb293ef4f42aa9b841dfc8eabb2d1e03
CVE: CVE-2014-2019
Published: 2014-02-18
Description: The iCloud subsystem in Apple iOS before 7.1 allows physically proximate attackers to bypass an intended password requirement, and turn off the Find My iPhone service or complete a Delete Account action and then associate this service with a different Apple ID account, by entering an arbitrary iCloud Account Password value and a blank iCloud Account Description value.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-264
References: http://news.softpedia.com/news/Major-iOS-7-Security-Flaw-Discovered-Video-425011.shtml; http://support.apple.com/kb/HT6162; http://www.youtube.com/watch?v=QnPk4RRWjic
CVE: CVE-2014-2020
Published: 2014-02-18
Description: ext/gd/gd.c in PHP 5.5.x before 5.5.9 does not check data types, which might allow remote attackers to obtain sensitive information by using a (1) string or (2) array data type in place of a numeric data type, as demonstrated by an imagecrop function call with a string for the x dimension value, a different vulnerability than CVE-2013-7226.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://www.ubuntu.com/usn/USN-2126-1; https://bugs.php.net/bug.php?id=66356; https://github.com/php/php-src/commit/2938329ce19cb8c4197dec146c3ec887c6f61d01
CVE: CVE-2013-6396
Published: 2014-02-18
Description: The OpenStack Python client library for Swift (python-swiftclient) 1.0 through 1.9.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-310
References: http://www.openwall.com/lists/oss-security/2014/02/17/7; https://bugs.launchpad.net/python-swiftclient/+bug/1199783; http://www.openwall.com/lists/oss-security/2014/02/17/7
CVE: CVE-2014-1943
Published: 2014-02-18
Description: Fine Free file before 5.17 allows context-dependent attackers to cause a denial of service (infinite recursion, CPU consumption, and crash) via a crafted indirect offset value in the magic of a file.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-755
References: http://lists.opensuse.org/opensuse-updates/2014-03/msg00034.html; http://lists.opensuse.org/opensuse-updates/2014-03/msg00037.html; http://mx.gw.com/pipermail/file/2014/001327.html
CVE: CVE-2014-0732
Published: 2014-02-20
Description: The Real Time Monitoring Tool (RTMT) web application in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier does not properly enforce authentication requirements, which allows remote attackers to read application files via a direct request to a URL, aka Bug ID CSCum46495.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-287
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0732; http://tools.cisco.com/security/center/viewAlert.x?alertId=32913; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0732
CVE: CVE-2014-0734
Published: 2014-02-20
Description: SQL injection vulnerability in the Certificate Authority Proxy Function (CAPF) implementation in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier allows remote attackers to execute arbitrary SQL commands via a crafted URL, aka Bug ID CSCum46483.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0734; http://tools.cisco.com/security/center/viewAlert.x?alertId=32916; http://www.securityfocus.com/bid/65645
CVE: CVE-2014-0735
Published: 2014-02-20
Description: Cross-site scripting (XSS) vulnerability in the IP Manager Assistant (IPMA) interface in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCum46470.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0735; http://tools.cisco.com/security/center/viewAlert.x?alertId=32912; http://www.securityfocus.com/bid/65641
CVE: CVE-2014-0736
Published: 2014-02-20
Description: Cross-site request forgery (CSRF) vulnerability in the Call Detail Records Analysis and Reporting (CAR) page in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier allows remote attackers to hijack the authentication of arbitrary users for requests that make CAR modifications, aka Bug ID CSCum46468.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0736; http://tools.cisco.com/security/center/viewAlert.x?alertId=32911; http://www.securitytracker.com/id/1029792
CVE: CVE-2014-0080
Published: 2014-02-20
Description: SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql/cast.rb in Active Record in Ruby on Rails 4.0.x before 4.0.3, and 4.1.0.beta1, when PostgreSQL is used, allows remote attackers to execute "add data" SQL commands via vectors involving \ (backslash) characters that are not properly handled in operations on array columns.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://openwall.com/lists/oss-security/2014/02/18/9; https://groups.google.com/forum/message/raw?msg=rubyonrails-security/Wu96YkTUR6s/pPLBMZrlwvYJ; http://openwall.com/lists/oss-security/2014/02/18/9
CVE: CVE-2014-0081
Published: 2014-02-20
Description: Multiple cross-site scripting (XSS) vulnerabilities in actionview/lib/action_view/helpers/number_helper.rb in Ruby on Rails before 3.2.17, 4.0.x before 4.0.3, and 4.1.x before 4.1.0.beta2 allow remote attackers to inject arbitrary web script or HTML via the (1) format, (2) negative_format, or (3) units parameter to the (a) number_to_currency, (b) number_to_percentage, or (c) number_to_human helper.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-updates/2014-02/msg00081.html; http://openwall.com/lists/oss-security/2014/02/18/8; http://rhn.redhat.com/errata/RHSA-2014-0215.html
CVE: CVE-2014-0082
Published: 2014-02-20
Description: actionpack/lib/action_view/template/text.rb in Action View in Ruby on Rails 3.x before 3.2.17 converts MIME type strings to symbols during use of the :text option to the render method, which allows remote attackers to cause a denial of service (memory consumption) by including these strings in headers.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-updates/2014-02/msg00081.html; http://openwall.com/lists/oss-security/2014/02/18/10; http://rhn.redhat.com/errata/RHSA-2014-0215.html
CVE: CVE-2014-0733
Published: 2014-02-20
Description: The Enterprise License Manager (ELM) component in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier does not properly enforce authentication requirements, which allows remote attackers to read ELM files via a direct request to a URL, aka Bug ID CSCum46494.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-287
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0733; http://tools.cisco.com/security/center/viewAlert.x?alertId=32914; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0733
CVE: CVE-2014-1879
Published: 2014-02-20
Description: Cross-site scripting (XSS) vulnerability in import.php in phpMyAdmin before 4.1.7 allows remote authenticated users to inject arbitrary web script or HTML via a crafted filename in an import action.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-updates/2014-03/msg00017.html; http://secunia.com/advisories/59832; http://www.phpmyadmin.net/home_page/security/PMASA-2014-1.php
CVE: CVE-2013-4420
Published: 2014-02-20
Description: Multiple directory traversal vulnerabilities in the (1) tar_extract_glob and (2) tar_extract_all functions in libtar 1.2.20 and earlier allow remote attackers to overwrite arbitrary files via a .. (dot dot) in a crafted tar file.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-22
References: http://www.debian.org/security/2014/dsa-2863; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=731860; https://lists.feep.net:8080/pipermail/libtar/2014-February/000403.html
CVE: CVE-2014-0498
Published: 2014-02-21
Description: Stack-based buffer overflow in Adobe Flash Player before 11.7.700.269 and 11.8.x through 12.0.x before 12.0.0.70 on Windows and Mac OS X and before 11.2.202.341 on Linux, Adobe AIR before 4.0.0.1628 on Android, Adobe AIR SDK before 4.0.0.1628, and Adobe AIR SDK & Compiler before 4.0.0.1628 allows attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://helpx.adobe.com/security/products/flash-player/apsb14-07.html; http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00014.html; http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00015.html
CVE: CVE-2014-0499
Published: 2014-02-21
Description: Adobe Flash Player before 11.7.700.269 and 11.8.x through 12.0.x before 12.0.0.70 on Windows and Mac OS X and before 11.2.202.341 on Linux, Adobe AIR before 4.0.0.1628 on Android, Adobe AIR SDK before 4.0.0.1628, and Adobe AIR SDK & Compiler before 4.0.0.1628 do not prevent access to address information, which makes it easier for attackers to bypass the ASLR protection mechanism via unspecified vectors.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://helpx.adobe.com/security/products/flash-player/apsb14-07.html; http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00014.html; http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00015.html
CVE: CVE-2014-0502
Published: 2014-02-21
Description: Double free vulnerability in Adobe Flash Player before 11.7.700.269 and 11.8.x through 12.0.x before 12.0.0.70 on Windows and Mac OS X and before 11.2.202.341 on Linux, Adobe AIR before 4.0.0.1628 on Android, Adobe AIR SDK before 4.0.0.1628, and Adobe AIR SDK & Compiler before 4.0.0.1628 allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in February 2014.
CVSS Score: 8.8 (HIGH)
CWE: CWE-415, CWE-415
References: http://helpx.adobe.com/security/products/flash-player/apsb14-07.html; http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00014.html; http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00015.html
CVE: CVE-2014-1910
Published: 2014-02-21
Description: Citrix ShareFile Mobile and ShareFile Mobile for Tablets before 2.4.4 for Android do not verify X.509 certificates from SSL servers, which allow man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-310
References: http://secunia.com/advisories/57020; http://support.citrix.com/article/CTX140303; http://www.securitytracker.com/id/1029791