deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-9460
Published: 2015-01-02
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the WP-ViperGB plugin before 1.3.11 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change plugin settings via unspecified vectors or conduct cross-site scripting (XSS) attacks via the (2) vgb_page or (3) vgb_items_per_pg parameter in the wp-vipergb page to wp-admin/options-general.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.com/files/129501/WordPress-WP-ViperGB-1.3.10-CSRF-XSS.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/99439; https://exchange.xforce.ibmcloud.com/vulnerabilities/99440
CVE: CVE-2014-9428
Published: 2015-01-02
Description: The batadv_frag_merge_packets function in net/batman-adv/fragmentation.c in the B.A.T.M.A.N. implementation in the Linux kernel through 3.18.1 uses an incorrect length field during a calculation of an amount of memory, which allows remote attackers to cause a denial of service (mesh-node system crash) via fragmented packets.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://bugs.debian.org/774155; http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=5b6698b0e4a37053de35cc24ee695b98a7eb712b; http://lists.fedoraproject.org/pipermail/package-announce/2015-January/147864.html
CVE: CVE-2013-7418
Published: 2015-01-02
Description: cgi-bin/iptablesgui.cgi in IPCop (aka IPCop Firewall) before 2.1.5 allows remote authenticated users to execute arbitrary code via shell metacharacters in the TABLE parameter.  NOTE: this can be exploited remotely by leveraging a separate cross-site scripting (XSS) vulnerability.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-77
References: http://packetstormsecurity.com/files/129697/IPCop-2.1.4-Cross-Site-Request-Forgery-Cross-Site-Scripting.html; http://sourceforge.net/p/ipcop/bugs/807/; http://www.asafety.fr/vuln-exploit-poc/xss-rce-ipcop-2-1-4-remote-command-execution/
CVE: CVE-2014-9461
Published: 2015-01-02
Description: Directory traversal vulnerability in models/Cart66.php in the Cart66 Lite plugin before 1.5.4 for WordPress allows remote authenticated users to read arbitrary files via a .. (dot dot) in the member_download action to wp-admin/admin-ajax.php.
CVSS Score: 3.5 (LOW)
CWE: CWE-22
References: https://plugins.trac.wordpress.org/changeset/1052064/cart66-lite; https://research.g0blin.co.uk/g0blin-00021/; https://wordpress.org/plugins/cart66-lite/changelog/
CVE: CVE-2014-9427
Published: 2015-01-03
Description: sapi/cgi/cgi_main.c in the CGI component in PHP through 5.4.36, 5.5.x through 5.5.20, and 5.6.x through 5.6.4, when mmap is used to read a .php file, does not properly consider the mapping's length during processing of an invalid file that begins with a # character and lacks a newline character, which causes an out-of-bounds read and might (1) allow remote attackers to obtain sensitive information from php-cgi process memory by leveraging the ability to upload a .php file or (2) trigger unexpected code execution if a valid PHP script is present in memory locations adjacent to the mapping.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://advisories.mageia.org/MGASA-2015-0040.html; http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=f9ad3086693fce680fbe246e4a45aa92edd2ac35; http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html
CVE: CVE-2010-5314
Published: 2015-01-03
Description: Cross-site scripting (XSS) vulnerability in controllers/home_controller.php in BEdita before 3.1 allows remote attackers to inject arbitrary web script or HTML via the searchstring parameter to news/index.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://www.htbridge.com/advisory/HTB22723; https://www.htbridge.com/advisory/HTB22723
CVE: CVE-2010-5315
Published: 2015-01-03
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in BEdita before 3.1 allow remote attackers to hijack the authentication of administrators for requests that (1) create categories via a data array to news/saveCategories or (2) modify credentials via a data array to admin/saveUser.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: https://www.htbridge.com/advisory/HTB22723; https://www.htbridge.com/advisory/HTB22723
CVE: CVE-2010-5316
Published: 2015-01-03
Description: Cross-site scripting (XSS) vulnerability in as/index.php in SweetRice CMS before 0.6.7.1 allows remote attackers to inject arbitrary web script or HTML via a top_height cookie.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://www.htbridge.com/advisory/HTB22667; https://www.htbridge.com/advisory/HTB22667
CVE: CVE-2010-5317
Published: 2015-01-03
Description: Multiple SQL injection vulnerabilities in index.php in SweetRice CMS before 0.6.7.1 allow remote attackers to execute arbitrary SQL commands via (1) the file_name parameter in an attachment action, (2) the post parameter in a show_comment action, (3) the sys-name parameter in an rssfeed action, or (4) the sys-name parameter in a view action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://www.htbridge.com/advisory/HTB22667; https://www.htbridge.com/advisory/HTB22667
CVE: CVE-2010-5318
Published: 2015-01-03
Description: The password-reset feature in as/index.php in SweetRice CMS before 0.6.7.1 allows remote attackers to modify the administrator's password by specifying the administrator's e-mail address in the email parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-255
References: https://www.htbridge.com/advisory/HTB22667; https://www.htbridge.com/advisory/HTB22667
CVE: CVE-2010-5319
Published: 2015-01-03
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in Kandidat CMS 1.4.2 allow remote attackers to hijack the authentication of administrators for requests that (1) modify settings via a validate action to admin/settings.php, (2) modify pages via the what parameter to admin/edit.php, or (3) modify articles via the edit parameter to admin/news.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: https://www.htbridge.com/advisory/HTB22648; https://www.htbridge.com/advisory/HTB22648
CVE: CVE-2010-5320
Published: 2015-01-03
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in MemHT Portal 4.0.1 allow remote attackers to hijack the authentication of administrators for requests that (1) modify settings via a configuration action to admin.php, (2) modify articles via an articles action to admin.php, or (3) modify credentials via a users action to admin.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: https://www.htbridge.com/advisory/HTB22662; https://www.htbridge.com/advisory/HTB22662
CVE: CVE-2014-9464
Published: 2015-01-03
Description: SQL injection vulnerability in Category.php in Microweber CMS 0.95 before 20141209 allows remote attackers to execute arbitrary SQL commands via the category parameter when displaying a category, related to the $parent_id variable.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://github.com/microweber/microweber/commit/4ee09f9dda35cd1b15daa351f335c2a4a0538d29; https://www.youtube.com/watch?v=SSE8Xj_-QaQ; https://github.com/microweber/microweber/commit/4ee09f9dda35cd1b15daa351f335c2a4a0538d29
CVE: CVE-2013-2131
Published: 2015-01-04
Description: Format string vulnerability in the rrdtool module 1.4.7 for Python, as used in Zenoss, allows context-dependent attackers to cause a denial of service (crash) via format string specifiers to the rrdtool.graph function.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-134
References: http://www.openwall.com/lists/oss-security/2013/04/18/5; http://www.openwall.com/lists/oss-security/2013/05/19/5; http://www.openwall.com/lists/oss-security/2013/05/31/2
CVE: CVE-2014-9276
Published: 2015-01-04
Description: Cross-site request forgery (CSRF) vulnerability in the Special:ExpandedTemplates page in MediaWiki before 1.19.22, 1.20.x through 1.22.x before 1.22.14, and 1.23.x before 1.23.7, when $wgRawHTML is set to true, allows remote attackers to hijack the authentication of users with edit permissions for requests that cross-site scripting (XSS) attacks via the wpInput parameter, which is not properly handled in the preview.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-352
References: http://securitytracker.com/id?1031301; http://www.openwall.com/lists/oss-security/2014/12/03/9; http://www.openwall.com/lists/oss-security/2014/12/04/16
CVE: CVE-2014-9277
Published: 2015-01-04
Description: The wfMangleFlashPolicy function in OutputHandler.php in MediaWiki before 1.19.22, 1.20.x through 1.22.x before 1.22.14, and 1.23.x before 1.23.7 allows remote attackers to conduct PHP object injection attacks via a crafted string containing <cross-domain-policy> in a PHP format request, which causes the string length to change when converting the request to <NOT-cross-domain-policy>.
CVSS Score: 7.5 (HIGH)
CWE: CWE-77
References: http://securitytracker.com/id?1031301; http://www.debian.org/security/2014/dsa-3100; http://www.openwall.com/lists/oss-security/2014/12/03/9
CVE: CVE-2014-9506
Published: 2015-01-04
Description: MantisBT before 1.2.18 does not properly check permissions when sending an email that indicates when a monitored issue is related to another issue, which allows remote authenticated users to obtain sensitive information about restricted issues.
CVSS Score: 3.5 (LOW)
CWE: CWE-200
References: http://seclists.org/oss-sec/2014/q4/955; http://secunia.com/advisories/62101; http://www.debian.org/security/2015/dsa-3120
CVE: CVE-2014-9507
Published: 2015-01-04
Description: MediaWiki 1.21.x, 1.22.x before 1.22.14, and 1.23.x before 1.23.7, when $wgContentHandlerUseDB is enabled, allows remote attackers to conduct cross-site scripting (XSS) attacks by setting the content model for a revision to JS.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: https://lists.wikimedia.org/pipermail/mediawiki-announce/2014-November/000170.html; https://phabricator.wikimedia.org/T72901; https://lists.wikimedia.org/pipermail/mediawiki-announce/2014-November/000170.html
CVE: CVE-2014-9508
Published: 2015-01-04
Description: The frontend rendering component in TYPO3 4.5.x before 4.5.39, 4.6.x through 6.2.x before 6.2.9, and 7.x before 7.0.2, when config.prefixLocalAnchors is set and using a homepage with links that only contain anchors, allows remote attackers to change URLs to arbitrary domains for those links via unknown vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-59
References: http://lists.opensuse.org/opensuse-updates/2016-08/msg00106.html; http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2014-003/; http://lists.opensuse.org/opensuse-updates/2016-08/msg00106.html
CVE: CVE-2014-9509
Published: 2015-01-04
Description: The frontend rendering component in TYPO3 4.5.x before 4.5.39, 4.6.x through 6.2.x before 6.2.9, and 7.x before 7.0.2, when config.prefixLocalAnchors is set to all or cached, allows remote attackers to have an unspecified impact (possibly resource consumption) via a "Cache Poisoning" attack using a URL with arbitrary arguments, which triggers a reload of the page.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2014-003/; http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2014-003/
CVE: CVE-2013-6125
Published: 2015-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2013.  Notes: none
CVE: CVE-2013-6126
Published: 2015-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2013.  Notes: none
CVE: CVE-2014-9492
Published: 2015-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2014-9323.  Reason: This candidate is a reservation duplicate of CVE-2014-9323.  Notes: All CVE users should reference CVE-2014-9323 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2014-1679
Published: 2015-01-05
Description: Cross-site scripting (XSS) vulnerability in Open-Xchange (OX) AppSuite before 7.2.2-rev31, 7.4.0 before 7.4.0-rev27, and 7.4.1 before 7.4.1-rev17 allows remote attackers to inject arbitrary web script or HTML via the header in an attached SVG file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/56828; http://www.securityfocus.com/archive/1/531005; https://exchange.xforce.ibmcloud.com/vulnerabilities/91059
CVE: CVE-2014-2598
Published: 2015-01-05
Description: Cross-site request forgery (CSRF) vulnerability in the Quick Page/Post Redirect plugin before 5.0.5 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the quickppr_redirects[request][] parameter in the redirect-updates page to wp-admin/admin.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://osvdb.org/show/osvdb/105707; http://osvdb.org/show/osvdb/105708; http://packetstormsecurity.com/files/126127
CVE: CVE-2014-8083
Published: 2015-01-05
Description: SQL injection vulnerability in the Search::setJsonAlert method in OSClass before 3.4.3 allows remote attackers to execute arbitrary SQL commands via the alert parameter in a search alert subscription action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://blog.osclass.org/2014/10/09/osclass-3-4-3-ready-download/; http://karmainsecurity.com/KIS-2014-14; http://packetstormsecurity.com/files/129775/Osclass-3.4.2-SQL-Injection.html
CVE: CVE-2014-8084
Published: 2015-01-05
Description: Directory traversal vulnerability in oc-includes/osclass/controller/ajax.php in OSClass before 3.4.3 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the ajaxfile parameter in a custom action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://blog.osclass.org/2014/10/09/osclass-3-4-3-ready-download/; http://karmainsecurity.com/KIS-2014-15; http://packetstormsecurity.com/files/129776/Osclass-3.4.2-Local-File-Inclusion.html
CVE: CVE-2014-8085
Published: 2015-01-05
Description: Unrestricted file upload vulnerability in the CWebContact::doModel method in oc-includes/osclass/controller/contact.php in OSClass before 3.4.3 allows remote attackers to execute arbitrary PHP code by uploading a file with a PHP extension, then accessing it via a direct request to the file in an unspecified directory.
CVSS Score: 6.8 (MEDIUM)
References: http://blog.osclass.org/2014/10/09/osclass-3-4-3-ready-download/; http://karmainsecurity.com/KIS-2014-16; http://packetstormsecurity.com/files/129777/Osclass-3.4.2-Shell-Upload.html
CVE: CVE-2014-9389
Published: 2015-01-05
Description: Directory traversal vulnerability in Sonatype Nexus OSS and Pro before 2.11.1-01 allows remote attackers to read or write to arbitrary files via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/61134; http://www.sonatype.org/advisories/archive/2014-12-23-Nexus/; https://support.sonatype.com/entries/84705937-CVE-2014-9389-Nexus-Security-Advisory-Directory-Traversal
CVE: CVE-2014-9516
Published: 2015-01-05
Description: Cross-site scripting (XSS) vulnerability in Social Microblogging PRO 1.5 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to the default URI, related to the "Web Site" input in the Profile section.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/show/osvdb/116553; http://www.exploit-db.com/exploits/35659; http://osvdb.org/show/osvdb/116553
CVE: CVE-2014-9517
Published: 2015-01-05
Description: Cross-site scripting (XSS) vulnerability in D-link IP camera DCS-2103 with firmware before 1.20 allows remote attackers to inject arbitrary web script or HTML via the QUERY_STRING to vb.htm.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/129609/D-Link-DCS-2103-Brute-Force-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2014/Dec/85; http://websecurity.com.ua/7288/
CVE: CVE-2014-9518
Published: 2015-01-05
Description: Cross-site scripting (XSS) vulnerability in login.cgi in D-Link router DIR-655 (rev Bx) with firmware before 2.12b01 allows remote attackers to inject arbitrary web script or HTML via the html_response_page parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/61831; http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10048; http://www.securityfocus.com/bid/71772
CVE: CVE-2014-9519
Published: 2015-01-05
Description: SQL injection vulnerability in login.php in InfiniteWP Admin Panel before 2.4.3 allows remote attackers to execute arbitrary SQL commands via the email parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://seclists.org/fulldisclosure/2014/Dec/43; https://lifeforms.nl/20141210/infinitewp-vulnerabilities/; http://seclists.org/fulldisclosure/2014/Dec/43
CVE: CVE-2014-9520
Published: 2015-01-05
Description: SQL injection vulnerability in execute.php in InfiniteWP Admin Panel before 2.4.4 allows remote attackers to execute arbitrary SQL commands via the historyID parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://seclists.org/fulldisclosure/2014/Dec/43; https://lifeforms.nl/20141210/infinitewp-vulnerabilities/; http://seclists.org/fulldisclosure/2014/Dec/43
CVE: CVE-2014-9521
Published: 2015-01-05
Description: Unrestricted file upload vulnerability in uploadScript.php in InfiniteWP Admin Panel before 2.4.4, when the allWPFiles query parameter is set, allows remote attackers to execute arbitrary code by uploading a file with a double extension, then accessing it via a direct request to the file in the uploads directory, as demonstrated by the .php.swp filename.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://seclists.org/fulldisclosure/2014/Dec/43; https://lifeforms.nl/20141210/infinitewp-vulnerabilities/; http://seclists.org/fulldisclosure/2014/Dec/43
CVE: CVE-2014-9522
Published: 2015-01-05
Description: Multiple cross-site scripting (XSS) vulnerabilities in CMS Papoo Light 6.0.0 (Rev 4701) allow remote attackers to inject arbitrary web script or HTML via the (1) author field to guestbook.php or (2) username field to account.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/show/osvdb/115944; http://packetstormsecurity.com/files/129586/CMS-Papoo-6.0.0-Revision-4701-Cross-Site-Scripting.html; http://sroesemann.blogspot.de/2014/12/bericht-zu-advisory-sroeadv-2014-01.html
CVE: CVE-2014-9523
Published: 2015-01-05
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the Our Team Showcase (our-team-enhanced) plugin before 1.3 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change plugin settings via unspecified vectors or (2) conduct cross-site scripting (XSS) attacks via the sc_our_team_member_count parameter in the sc_team_settings page to wp-admin/edit.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.com/files/129499/WordPress-Our-Team-Showcase-1.2-CSRF-XSS.html; http://packetstormsecurity.com/files/129499/WordPress-Our-Team-Showcase-1.2-CSRF-XSS.html
CVE: CVE-2014-9524
Published: 2015-01-05
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the Facebook Like Box (cardoza-facebook-like-box) plugin before 2.8.3 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change plugin settings via unspecified vectors or conduct cross-site scripting (XSS) attacks via the (2) frm_title, (3) frm_url, (4) frm_border_color, (5) frm_width, or (6) frm_height parameter in the slug_for_fb_like_box page to wp-admin/admin.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.com/files/129506/WordPress-Facebook-Like-Box-2.8.2-CSRF-XSS.html; http://secunia.com/advisories/61557; https://wordpress.org/plugins/cardoza-facebook-like-box/changelog/
CVE: CVE-2014-9525
Published: 2015-01-05
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the Timed Popup (wp-timed-popup) plugin 1.3 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change plugin settings via unspecified vectors or (2) conduct cross-site scripting (XSS) attacks via the sc_popup_subtitle parameter in the wp-popup.php page to wp-admin/options-general.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.com/files/129510/WordPress-Timed-Popup-1.3-CSRF-XSS.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/99376; https://exchange.xforce.ibmcloud.com/vulnerabilities/99377
CVE: CVE-2014-9526
Published: 2015-01-05
Description: Multiple cross-site scripting (XSS) vulnerabilities in concrete5 5.7.2.1, 5.7.2, and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) gName parameter in single_pages/dashboard/users/groups/bulkupdate.php or (2) instance_id parameter in tools/dashboard/sitemap_drag_request.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://morxploit.com/morxploits/morxconxss.txt; http://packetstormsecurity.com/files/129446/Concrete5-CMS-5.7.2-5.7.2.1-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2014/Dec/38
CVE: CVE-2014-3628
Published: 2015-01-06
Description: Cross-site scripting (XSS) vulnerability in the Admin UI Plugin / Stats page in Apache Solr 4.x before 4.10.3 allows remote attackers to inject arbitrary web script or HTML via the fieldvaluecache object.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://mail-archives.us.apache.org/mod_mbox/www-announce/201412.mbox/%3C54A1A7C7.2070804%40apache.org%3E; http://secunia.com/advisories/62024; http://mail-archives.us.apache.org/mod_mbox/www-announce/201412.mbox/%3C54A1A7C7.2070804%40apache.org%3E
CVE: CVE-2014-3764
Published: 2015-01-06
Description: Cross-site scripting (XSS) vulnerability in the web-based device management interface in Palo Alto Networks PAN-OS before 5.0.15, 5.1.x before 5.1.10, and 6.0.x before 6.0.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Ref ID 64563.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/61811; https://security.paloaltonetworks.com/CVE-2014-3764; http://secunia.com/advisories/61811
CVE: CVE-2014-7209
Published: 2015-01-06
Description: run-mailcap in the Debian mime-support package before 3.52-1+deb7u1 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename.
CVSS Score: 7.5 (HIGH)
CWE: CWE-77
References: http://secunia.com/advisories/61892; http://secunia.com/advisories/62079; http://www.debian.org/security/2014/dsa-3114
CVE: CVE-2014-8131
Published: 2015-01-06
Description: The qemu implementation of virConnectGetAllDomainStats in libvirt before 1.2.11 does not properly handle locks when a domain is skipped due to ACL restrictions, which allows a remote authenticated users to cause a denial of service (deadlock or segmentation fault and crash) via a request to access the users does not have privileges to access.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-updates/2015-01/msg00005.html; http://security.libvirt.org/2014/0008.html; http://lists.opensuse.org/opensuse-updates/2015-01/msg00005.html
CVE: CVE-2014-9527
Published: 2015-01-06
Description: HSLFSlideShow in Apache POI before 3.11 allows remote attackers to cause a denial of service (infinite loop and deadlock) via a crafted PPT file.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-February/150228.html; http://poi.apache.org/changes.html; http://secunia.com/advisories/61953