deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-9031
Published: 2014-11-25
Description: Cross-site scripting (XSS) vulnerability in the wptexturize function in WordPress before 3.7.5, 3.8.x before 3.8.5, and 3.9.x before 3.9.3 allows remote attackers to inject arbitrary web script or HTML via crafted use of shortcode brackets in a text field, as demonstrated by a comment or a post.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://advisories.mageia.org/MGASA-2014-0493.html; http://klikki.fi/adv/wordpress.html; http://openwall.com/lists/oss-security/2014/11/25/12
CVE: CVE-2014-9032
Published: 2014-11-25
Description: Cross-site scripting (XSS) vulnerability in the media-playlists feature in WordPress before 3.9.x before 3.9.3 and 4.x before 4.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://advisories.mageia.org/MGASA-2014-0493.html; http://openwall.com/lists/oss-security/2014/11/25/12; http://www.mandriva.com/security/advisories?name=MDVSA-2014:233
CVE: CVE-2014-9033
Published: 2014-11-25
Description: Cross-site request forgery (CSRF) vulnerability in wp-login.php in WordPress 3.7.4, 3.8.4, 3.9.2, and 4.0 allows remote attackers to hijack the authentication of arbitrary users for requests that reset passwords.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://advisories.mageia.org/MGASA-2014-0493.html; http://core.trac.wordpress.org/changeset/30418; http://openwall.com/lists/oss-security/2014/11/25/12
CVE: CVE-2014-9034
Published: 2014-11-25
Description: wp-includes/class-phpass.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to cause a denial of service (CPU consumption) via a long password that is improperly handled during hashing, a similar issue to CVE-2014-9016.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-19
References: http://advisories.mageia.org/MGASA-2014-0493.html; http://core.trac.wordpress.org/changeset/30467; http://openwall.com/lists/oss-security/2014/11/25/12
CVE: CVE-2014-9035
Published: 2014-11-25
Description: Cross-site scripting (XSS) vulnerability in Press This in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://advisories.mageia.org/MGASA-2014-0493.html; http://openwall.com/lists/oss-security/2014/11/25/12; http://www.debian.org/security/2014/dsa-3085
CVE: CVE-2014-9036
Published: 2014-11-25
Description: Cross-site scripting (XSS) vulnerability in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to inject arbitrary web script or HTML via a crafted Cascading Style Sheets (CSS) token sequence in a post.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://advisories.mageia.org/MGASA-2014-0493.html; http://openwall.com/lists/oss-security/2014/11/25/12; http://www.debian.org/security/2014/dsa-3085
CVE: CVE-2014-9037
Published: 2014-11-25
Description: WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow remote attackers to obtain access to an account idle since 2008 by leveraging an improper PHP dynamic type comparison for an MD5 hash.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-310
References: http://advisories.mageia.org/MGASA-2014-0493.html; http://openwall.com/lists/oss-security/2014/11/25/12; http://www.debian.org/security/2014/dsa-3085
CVE: CVE-2014-9038
Published: 2014-11-25
Description: wp-includes/http.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to conduct server-side request forgery (SSRF) attacks by referring to a 127.0.0.0/8 resource.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-20
References: http://advisories.mageia.org/MGASA-2014-0493.html; http://openwall.com/lists/oss-security/2014/11/25/12; http://www.debian.org/security/2014/dsa-3085
CVE: CVE-2014-9039
Published: 2014-11-25
Description: wp-login.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow remote attackers to reset passwords by leveraging access to an e-mail account that received a password-reset message.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-254
References: http://advisories.mageia.org/MGASA-2014-0493.html; http://core.trac.wordpress.org/changeset/30431; http://openwall.com/lists/oss-security/2014/11/25/12
CVE: CVE-2014-6093
Published: 2014-11-26
Description: Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 7.0.x before 7.0.0.2 CF29, 8.0.x through 8.0.0.1 CF14, and 8.5.x before 8.5.0 CF02 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://secunia.com/advisories/59752; http://secunia.com/advisories/60912; http://www-01.ibm.com/support/docview.wss?uid=swg1PI24678
CVE: CVE-2014-6196
Published: 2014-11-26
Description: Cross-site scripting (XSS) vulnerability in IBM Web Experience Factory (WEF) 6.1.5 through 8.5.0.1, as used in WebSphere Dashboard Framework (WDF) and Lotus Widget Factory (LWF), allows remote attackers to inject arbitrary web script or HTML by leveraging a Dojo builder error in an unspecified WebSphere Portal configuration, leading to improper construction of a response page by an application.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/59546; http://www-01.ibm.com/support/docview.wss?uid=swg1LO82672; http://www-01.ibm.com/support/docview.wss?uid=swg1LO82673
CVE: CVE-2014-7247
Published: 2014-11-26
Description: Unspecified vulnerability in JustSystems Ichitaro 2008 through 2011; Ichitaro Government 6, 7, 2008, 2009, and 2010; Ichitaro Pro; Ichitaro Pro 2; Ichitaro 2011 Sou; Ichitaro 2012 Shou; Ichitaro 2013 Gen; and Ichitaro 2014 Tetsu allows remote attackers to execute arbitrary code via a crafted file.
CVSS Score: 10.0 (HIGH)
CWE: CWE-19
References: http://jvn.jp/en/jp/JVN16318793/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2014-000131; http://www.justsystems.com/jp/info/js14003.html
CVE: CVE-2014-8005
Published: 2014-11-26
Description: Race condition in the lighttpd module in Cisco IOS XR 5.1 and earlier on Network Convergence System 6000 devices allows remote attackers to cause a denial of service (process reload) by establishing many TCP sessions, aka Bug ID CSCuq45239.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-362
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-8005; http://tools.cisco.com/security/center/viewAlert.x?alertId=36532; http://www.securityfocus.com/bid/71287
CVE: CVE-2014-8551
Published: 2014-11-26
Description: The WinCC server in Siemens SIMATIC WinCC 7.0 through SP3, 7.2 before Update 9, and 7.3 before Update 2; SIMATIC PCS 7 7.1 through SP4, 8.0 through SP2, and 8.1; and TIA Portal 13 before Update 6 allows remote attackers to execute arbitrary code via crafted packets.
CVSS Score: 10.0 (HIGH)
CWE: CWE-94
References: http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-134508.pdf; http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-134508.pdf
CVE: CVE-2014-8552
Published: 2014-11-26
Description: The WinCC server in Siemens SIMATIC WinCC 7.0 through SP3, 7.2 before Update 9, and 7.3 before Update 2; SIMATIC PCS 7 7.1 through SP4, 8.0 through SP2, and 8.1; and TIA Portal 13 before Update 6 allows remote attackers to read arbitrary files via crafted packets.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-134508.pdf; http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-134508.pdf
CVE: CVE-2014-2037
Published: 2014-11-26
Description: Openswan 2.6.40 allows remote attackers to cause a denial of service (NULL pointer dereference and IKE daemon restart) via IKEv2 packets that lack expected payloads.  NOTE: this vulnerability exists because of an incomplete fix for CVE 2013-6466.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2014/02/18/1; http://www.openwall.com/lists/oss-security/2014/02/20/2; http://www.securityfocus.com/bid/65629
CVE: CVE-2014-6609
Published: 2014-11-26
Description: The res_pjsip_pubsub module in Asterisk Open Source 12.x before 12.5.1 allows remote authenticated users to cause a denial of service (crash) via crafted headers in a SIP SUBSCRIBE request for an event package.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-20
References: http://downloads.asterisk.org/pub/security/AST-2014-009.html; http://downloads.asterisk.org/pub/security/AST-2014-009.html
CVE: CVE-2014-6610
Published: 2014-11-26
Description: Asterisk Open Source 11.x before 11.12.1 and 12.x before 12.5.1 and Certified Asterisk 11.6 before 11.6-cert6, when using the res_fax_spandsp module, allows remote authenticated users to cause a denial of service (crash) via an out of call message, which is not properly handled in the ReceiveFax dialplan application.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-19
References: http://downloads.asterisk.org/pub/security/AST-2014-010.html; http://downloads.asterisk.org/pub/security/AST-2014-010.html
CVE: CVE-2014-7141
Published: 2014-11-26
Description: The pinger in Squid 3.x before 3.4.8 allows remote attackers to obtain sensitive information or cause a denial of service (out-of-bounds read and crash) via a crafted type in an (1) ICMP or (2) ICMP6 packet.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-19
References: http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html; http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00040.html; http://seclists.org/oss-sec/2014/q3/539
CVE: CVE-2014-7142
Published: 2014-11-26
Description: The pinger in Squid 3.x before 3.4.8 allows remote attackers to obtain sensitive information or cause a denial of service (crash) via a crafted (1) ICMP or (2) ICMP6 packet size.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html; http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00040.html; http://seclists.org/oss-sec/2014/q3/539
CVE: CVE-2014-8419
Published: 2014-11-26
Description: Wibu-Systems CodeMeter Runtime before 5.20 uses weak permissions (read and write access for all users) for codemeter.exe, which allows local users to gain privileges via a Trojan horse file.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://packetstormsecurity.com/files/129234/CodeMeter-Weak-Service-Permissions.html; http://www.securityfocus.com/archive/1/534079/100/0/threaded; http://packetstormsecurity.com/files/129234/CodeMeter-Weak-Service-Permissions.html
CVE: CVE-2014-8962
Published: 2014-11-26
Description: Stack-based buffer overflow in stream_decoder.c in libFLAC before 1.3.1 allows remote attackers to execute arbitrary code via a crafted .flac file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://advisories.mageia.org/MGASA-2014-0499.html; http://lists.opensuse.org/opensuse-updates/2014-12/msg00034.html; http://packetstormsecurity.com/files/129261/libFLAC-1.3.0-Stack-Overflow-Heap-Overflow-Code-Execution.html
CVE: CVE-2014-9028
Published: 2014-11-26
Description: Heap-based buffer overflow in stream_decoder.c in libFLAC before 1.3.1 allows remote attackers to execute arbitrary code via a crafted .flac file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://advisories.mageia.org/MGASA-2014-0499.html; http://lists.opensuse.org/opensuse-updates/2014-12/msg00034.html; http://packetstormsecurity.com/files/129261/libFLAC-1.3.0-Stack-Overflow-Heap-Overflow-Code-Execution.html
CVE: CVE-2014-9093
Published: 2014-11-26
Description: LibreOffice before 4.3.5 allows remote attackers to cause a denial of service (invalid write operation and crash) and possibly execute arbitrary code via a crafted RTF file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://lists.fedoraproject.org/pipermail/package-announce/2014-November/144836.html; http://www.debian.org/security/2015/dsa-3163; http://www.openwall.com/lists/oss-security/2014/11/19/3
CVE: CVE-2014-9094
Published: 2014-11-26
Description: Multiple cross-site scripting (XSS) vulnerabilities in deploy/designer/preview.php in the Digital Zoom Studio (DZS) Video Gallery plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) swfloc or (2) designrand parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2014/Jul/65; http://websecurity.com.ua/7152/; http://www.securityfocus.com/bid/108579
CVE: CVE-2014-9095
Published: 2014-11-26
Description: Multiple SQL injection vulnerabilities in Raritan Power IQ 4.1.0 and 4.2.1 allow remote attackers to execute arbitrary SQL commands via the (1) sort or (2) dir parameter to license/records.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/127525/Raritan-PowerIQ-Unauthenticated-SQL-Injection.html; http://seclists.org/fulldisclosure/2014/Jul/79; http://secunia.com/advisories/60138
CVE: CVE-2014-9096
Published: 2014-11-26
Description: Multiple SQL injection vulnerabilities in recover.php in Pligg CMS 2.0.1 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id or (2) n parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/127615/Pligg-2.0.1-SQL-Injection-Command-Execution.html; http://seclists.org/fulldisclosure/2014/Jul/136; http://www.securityfocus.com/bid/68893
CVE: CVE-2014-9097
Published: 2014-11-26
Description: Multiple SQL injection vulnerabilities in the Apptha WordPress Video Gallery (contus-video-gallery) plugin 2.5, possibly as distributed before 2014-07-23, for WordPress allow (1) remote attackers to execute arbitrary SQL commands via the vid parameter in a myextract action to wp-admin/admin-ajax.php or (2) remote authenticated users to execute arbitrary SQL commands via the playlistId parameter in the newplaylist page or (3) videoId parameter in a newvideo page to wp-admin/admin.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/127611/WordPress-Video-Gallery-2.5-Cross-Site-Scripting-SQL-Injection.html; http://wordpress.org/plugins/contus-video-gallery/changelog; http://www.securityfocus.com/bid/68883
CVE: CVE-2014-9098
Published: 2014-11-26
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Apptha WordPress Video Gallery (contus-video-gallery) plugin 2.5, possibly before 2014-07-23, for WordPress allow remote authenticated users to inject arbitrary web script or HTML via the videoadssearchQuery parameter to (1) videoads/videoads.php, (2) video/video.php, or (3) playlist/playlist.php.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://packetstormsecurity.com/files/127611/WordPress-Video-Gallery-2.5-Cross-Site-Scripting-SQL-Injection.html; http://www.securityfocus.com/bid/68883; http://packetstormsecurity.com/files/127611/WordPress-Video-Gallery-2.5-Cross-Site-Scripting-SQL-Injection.html
CVE: CVE-2014-9099
Published: 2014-11-26
Description: Cross-site request forgery (CSRF) vulnerability in the WhyDoWork AdSense plugin 1.2 for WordPress allows remote attackers to hijack the authentication of administrators for requests that have unspecified impact via a request to the whydowork_adsense page in wp-admin/options-general.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.com/files/127658/WordPress-WhyDoWork-AdSense-1.2-XSS-CSRF.html; http://www.securityfocus.com/bid/68954; http://packetstormsecurity.com/files/127658/WordPress-WhyDoWork-AdSense-1.2-XSS-CSRF.html
CVE: CVE-2014-9100
Published: 2014-11-26
Description: Cross-site scripting (XSS) vulnerability in the WhyDoWork AdSense plugin 1.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the idcode parameter in the whydowork_adsense page to wp-admin/options-general.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/127658/WordPress-WhyDoWork-AdSense-1.2-XSS-CSRF.html; http://www.securityfocus.com/bid/68954; http://packetstormsecurity.com/files/127658/WordPress-WhyDoWork-AdSense-1.2-XSS-CSRF.html
CVE: CVE-2014-9101
Published: 2014-11-26
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in Oxwall 1.7.0 (build 7907 and 7906) and SkaDate Lite 2.0 (build 7651) allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks or possibly have other unspecified impact via the (1) label parameter to admin/users/roles/, (2) lang[1][base][questions_account_type_5615100a931845eca8da20cfdf7327e0] in an AddAccountType action or (3) qst_name parameter in an addQuestion action to admin/questions/ajax-responder/, or (4) form_name or (5) restrictedUsername parameter to admin/restricted-usernames.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://osvdb.org/show/osvdb/109622; http://osvdb.org/show/osvdb/109623; http://osvdb.org/show/osvdb/109624
CVE: CVE-2014-9102
Published: 2014-11-26
Description: Multiple SQL injection vulnerabilities in the Kunena component before 3.0.6 for Joomla! allow remote authenticated users to execute arbitrary SQL commands via the index value in an array parameter, as demonstrated by the topics[] parameter in an unfavorite action to index.php.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://packetstormsecurity.com/files/127683/Joomla-Kunena-Forum-3.0.5-SQL-Injection.html; http://www.kunena.org/blog/139-kunena-3-0-6-released; http://www.kunena.org/docs/Kunena_3.0.6_Read_Me
CVE: CVE-2014-9103
Published: 2014-11-26
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Kunena component before 3.0.6 for Joomla! allow remote attackers to inject arbitrary web script or HTML via the (1) index value of an array parameter or the filename parameter in the Content-Disposition header to the (2) file or (3) profile image upload functionality.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/127684/joomlakunena305-xss.txt; http://www.kunena.org/blog/139-kunena-3-0-6-released; http://www.kunena.org/docs/Kunena_3.0.6_Read_Me
CVE: CVE-2014-9104
Published: 2014-11-26
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the XML-RPC API in the Desktop Client in OpenVPN Access Server 1.5.6 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) disconnecting established VPN sessions, (2) connect to arbitrary VPN servers, or (3) create VPN profiles and execute arbitrary commands via crafted API requests.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://openvpn.net/index.php/access-server/security-advisories.html; http://seclists.org/fulldisclosure/2014/Jul/76; http://www.securityfocus.com/archive/1/532795/100/0/threaded
CVE: CVE-2014-5426
Published: 2014-11-27
Description: MatrikonOPC OPC Server for DNP3 1.2.3 and earlier allows remote attackers to cause a denial of service (unhandled exception and DNP3 process crash) via a crafted message.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-17
References: http://www.opcsupport.com/link/portal/4164/4590/Article/3004/SECURITY-NOTIFICATION-OPC-Server-for-SCADA-DNP3-SN-2014-10-14-01; https://ics-cert.us-cert.gov/advisories/ICSA-14-329-01; http://www.opcsupport.com/link/portal/4164/4590/Article/3004/SECURITY-NOTIFICATION-OPC-Server-for-SCADA-DNP3-SN-2014-10-14-01
CVE: CVE-2014-3407
Published: 2014-11-28
Description: The SSL VPN implementation in Cisco Adaptive Security Appliance (ASA) Software 9.3(.2) and earlier does not properly allocate memory blocks during HTTP packet handling, which allows remote attackers to cause a denial of service (memory consumption) via crafted packets, aka Bug ID CSCuq68888.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-400
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3407; http://tools.cisco.com/security/center/viewAlert.x?alertId=36542; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3407
CVE: CVE-2014-4829
Published: 2014-11-28
Description: Cross-site request forgery (CSRF) vulnerability in IBM Security QRadar SIEM and QRadar Risk Manager 7.1 before MR2 Patch 9 and 7.2 before 7.2.4 Patch 1, and QRadar Vulnerability Manager 7.2 before 7.2.4 Patch 1, allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www-01.ibm.com/support/docview.wss?uid=swg21691211; https://exchange.xforce.ibmcloud.com/vulnerabilities/95579; http://www-01.ibm.com/support/docview.wss?uid=swg21691211
CVE: CVE-2014-4831
Published: 2014-11-28
Description: IBM Security QRadar SIEM and QRadar Risk Manager 7.1 before MR2 Patch 9 and 7.2 before 7.2.4 Patch 1, and QRadar Vulnerability Manager 7.2 before 7.2.4 Patch 1, allow remote attackers to hijack sessions via unspecified vectors.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-287
References: http://www-01.ibm.com/support/docview.wss?uid=swg21691211; https://exchange.xforce.ibmcloud.com/vulnerabilities/95581; http://www-01.ibm.com/support/docview.wss?uid=swg21691211
CVE: CVE-2014-4832
Published: 2014-11-28
Description: IBM Security QRadar SIEM and QRadar Risk Manager 7.1 before MR2 Patch 9 and 7.2 before 7.2.4 Patch 1, and QRadar Vulnerability Manager 7.2 before 7.2.4 Patch 1, allow remote attackers to obtain sensitive cookie information by sniffing the network during an HTTP session.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg21691211; https://exchange.xforce.ibmcloud.com/vulnerabilities/95582; http://www-01.ibm.com/support/docview.wss?uid=swg21691211
CVE: CVE-2014-4883
Published: 2014-11-28
Description: resolv.c in the DNS resolver in uIP, and dns.c in the DNS resolver in lwIP 1.4.1 and earlier, does not use random values for ID fields and source ports of DNS query packets, which makes it easier for man-in-the-middle attackers to conduct cache-poisoning attacks via spoofed reply packets.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-345
References: http://git.savannah.gnu.org/cgit/lwip.git/commit/?id=9fb46e120655ac481b2af8f865d5ae56c39b831a; http://www.kb.cert.org/vuls/id/210620; http://git.savannah.gnu.org/cgit/lwip.git/commit/?id=9fb46e120655ac481b2af8f865d5ae56c39b831a
CVE: CVE-2014-6075
Published: 2014-11-28
Description: IBM Security QRadar SIEM and QRadar Risk Manager 7.1 before MR2 Patch 9 and 7.2 before 7.2.4 Patch 1, and QRadar Vulnerability Manager 7.2 before 7.2.4 Patch 1, place credentials in URLs, which allows remote attackers to obtain sensitive information by reading (1) web-server access logs, (2) web-server Referer logs, or (3) the browser history.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg21691211; https://exchange.xforce.ibmcloud.com/vulnerabilities/95727; http://www-01.ibm.com/support/docview.wss?uid=swg21691211
CVE: CVE-2014-7178
Published: 2014-11-28
Description: Enalean Tuleap before 7.5.99.6 allows remote attackers to execute arbitrary commands via the User-Agent header, which is provided to the passthru PHP function.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://seclists.org/fulldisclosure/2014/Oct/121; https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-7178/; https://www.tuleap.org/recent-vulnerabilities
CVE: CVE-2014-7850
Published: 2014-11-28
Description: Cross-site scripting (XSS) vulnerability in the Web UI in FreeIPA 4.x before 4.1.2 allows remote attackers to inject arbitrary web script or HTML via vectors related to breadcrumb navigation.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.fedoraproject.org/pipermail/package-announce/2014-November/144848.html; https://bugzilla.redhat.com/show_bug.cgi?id=1165280; https://fedorahosted.org/freeipa/ticket/4742
CVE: CVE-2014-8423
Published: 2014-11-28
Description: Unspecified vulnerability in the management portal in ARRIS VAP2500 before FW08.41 allows remote attackers to execute arbitrary commands via unknown vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-74
References: http://www.zerodayinitiative.com/advisories/ZDI-14-389/; http://www.zerodayinitiative.com/advisories/ZDI-14-389/