deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-3284
Published: 2014-05-25
Description: Cisco IOS XE on ASR1000 devices, when PPPoE termination is enabled, allows remote attackers to cause a denial of service (device reload) via a malformed PPPoE packet, aka Bug ID CSCuo55180.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/58405; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3284; http://tools.cisco.com/security/center/viewAlert.x?alertId=34346
CVE: CVE-2014-2196
Published: 2014-05-26
Description: Cisco Wide Area Application Services (WAAS) 5.1.1 before 5.1.1e, when SharePoint prefetch optimization is enabled, allows remote SharePoint servers to execute arbitrary code via a malformed response, aka Bug ID CSCue18479.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140521-waas; http://www.securitytracker.com/id/1030265; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140521-waas
CVE: CVE-2014-2504
Published: 2014-05-26
Description: EMC Documentum D2 3.1 before P20, 3.1 SP1 before P02, 4.0 before P10, 4.1 before P13, and 4.2 before P01 allows remote authenticated users to bypass intended access restrictions and execute arbitrary Documentum Query Language (DQL) queries by calling (1) a core method or (2) a D2FS web-service method.
CVSS Score: 9.0 (HIGH)
CWE: CWE-264
References: http://archives.neohapsis.com/archives/bugtraq/current/0130.html; http://secunia.com/advisories/58938; http://www.securitytracker.com/id/1030282
CVE: CVE-2014-3266
Published: 2014-05-26
Description: Cross-site scripting (XSS) vulnerability in the web framework in Cisco Security Manager 4.6 and earlier allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCun65189.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/58923; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3266; http://tools.cisco.com/security/center/viewAlert.x?alertId=34340
CVE: CVE-2014-3267
Published: 2014-05-26
Description: Cross-site request forgery (CSRF) vulnerability in the web framework in Cisco Security Manager 4.6 and earlier allows remote attackers to hijack the authentication of arbitrary users for requests that make unspecified changes, aka Bug ID CSCuo46427.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3267; http://tools.cisco.com/security/center/viewAlert.x?alertId=34325; http://www.securitytracker.com/id/1030271
CVE: CVE-2014-3272
Published: 2014-05-26
Description: The Agent in Cisco Tidal Enterprise Scheduler (TES) 6.1 and earlier allows local users to gain privileges via crafted Tidal Job Buffers (TJB) parameters, aka Bug ID CSCuo33074.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/58922; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3272; http://tools.cisco.com/security/center/viewAlert.x?alertId=34339
CVE: CVE-2014-3274
Published: 2014-05-26
Description: Cisco TelePresence System (CTS) 6.0(.5)(5) and earlier falls back to HTTP when certain HTTPS sessions cannot be established, which allows man-in-the-middle attackers to obtain sensitive directory information by leveraging a network position between CTS and Cisco Unified Communications Manager (UCM) to block HTTPS traffic, aka Bug ID CSCuj26326.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-310
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3274; http://tools.cisco.com/security/center/viewAlert.x?alertId=34327; http://www.securitytracker.com/id/1030272
CVE: CVE-2014-3275
Published: 2014-05-26
Description: SQL injection vulnerability in the web framework in Cisco Identity Services Engine (ISE) 1.2(.1 patch 2) and earlier allows remote authenticated users to execute arbitrary SQL commands via a crafted URL, aka Bug ID CSCul21337.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3275; http://tools.cisco.com/security/center/viewAlert.x?alertId=34328; http://www.securityfocus.com/bid/67555
CVE: CVE-2014-3276
Published: 2014-05-26
Description: Cisco Identity Services Engine (ISE) 1.2(.1 patch 2) and earlier does not properly handle deadlock conditions during reception of crafted RADIUS accounting packets from multiple NAS devices, which allows remote authenticated users to cause a denial of service (RADIUS outage) by sourcing these packets from two origins, aka Bug ID CSCuo56780.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3276; http://tools.cisco.com/security/center/viewAlert.x?alertId=34329; http://www.securitytracker.com/id/1030274
CVE: CVE-2013-1191
Published: 2014-05-26
Description: Cisco NX-OS 6.1 before 6.1(5) on Nexus 7000 devices, when local authentication and multiple VDCs are enabled, allows remote authenticated users to gain privileges within an unintended VDC via crafted SSH key data in an SSH session to a management interface, aka Bug ID CSCud88400.
CVSS Score: 7.1 (HIGH)
CWE: CWE-264
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140521-nxos; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140521-nxos
CVE: CVE-2014-2200
Published: 2014-05-26
Description: Cisco NX-OS 5.0 before 5.0(5) on Nexus 7000 devices, when local authentication and multiple VDCs are enabled, allows remote authenticated users to gain privileges within an unintended VDC via an SSH session to a management interface, aka Bug ID CSCti11629.
CVSS Score: 7.1 (HIGH)
CWE: CWE-264
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140521-nxos; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140521-nxos
CVE: CVE-2014-2201
Published: 2014-05-26
Description: The Message Transfer Service (MTS) in Cisco NX-OS before 6.2(7) on MDS 9000 devices and 6.0 before 6.0(2) on Nexus 7000 devices allows remote attackers to cause a denial of service (NULL pointer dereference and kernel panic) via a large volume of crafted traffic, aka Bug ID CSCtw98915.
CVSS Score: 7.8 (HIGH)
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140521-nxos; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140521-nxos
CVE: CVE-2014-2607
Published: 2014-05-26
Description: Unspecified vulnerability in HP Operations Manager i 9.1 through 9.13 and 9.2 through 9.24 allows remote authenticated users to execute arbitrary code by leveraging the OMi operator role.
CVSS Score: 8.5 (HIGH)
References: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04296442; https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04296442
CVE: CVE-2014-3015
Published: 2014-05-26
Description: Cross-site request forgery (CSRF) vulnerability in the Web player in IBM Sametime Proxy Server and Web Client 9.0 through 9.0.0.1 allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www-01.ibm.com/support/docview.wss?uid=swg21673260; https://exchange.xforce.ibmcloud.com/vulnerabilities/93026; http://www-01.ibm.com/support/docview.wss?uid=swg21673260
CVE: CVE-2014-3261
Published: 2014-05-26
Description: Buffer overflow in the Smart Call Home implementation in Cisco NX-OS on Fabric Interconnects in Cisco Unified Computing System 1.4 before 1.4(1i), NX-OS 5.0 before 5.0(3)U2(2) on Nexus 3000 devices, NX-OS 4.1 before 4.1(2)E1(1l) on Nexus 4000 devices, NX-OS 5.x before 5.1(3)N1(1) on Nexus 5000 devices, NX-OS 5.2 before 5.2(3a) on Nexus 7000 devices, and CG-OS CG4 before CG4(2) on Connected 1000 Connected Grid Routers allows remote SMTP servers to execute arbitrary code via a crafted reply, aka Bug IDs CSCtk00695, CSCts56633, CSCts56632, CSCts56628, CSCug14405, and CSCuf61322.
CVSS Score: 7.6 (HIGH)
CWE: CWE-119
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140521-nxos; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140521-nxos
CVE: CVE-2013-3046
Published: 2014-05-26
Description: The Meeting Server in IBM Sametime 8.x through 8.5.2.1 and 9.x through 9.0.0.1 does not send the HSTS Strict-Transport-Security header, which makes it easier for man-in-the-middle attackers to hijack sessions or obtain sensitive information by leveraging the presence of HTTP requests.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-287
References: http://www-01.ibm.com/support/docview.wss?uid=swg21671201; https://exchange.xforce.ibmcloud.com/vulnerabilities/84819; http://www-01.ibm.com/support/docview.wss?uid=swg21671201
CVE: CVE-2013-3975
Published: 2014-05-26
Description: Unspecified vulnerability in the Meeting Server in IBM Sametime 8.x through 8.5.2.1 and 9.x through 9.0.0.1 allows remote attackers to discover user names, full names, and e-mail addresses via a search.
CVSS Score: 5.0 (MEDIUM)
References: http://www-01.ibm.com/support/docview.wss?uid=swg21671201; https://exchange.xforce.ibmcloud.com/vulnerabilities/84855; http://www-01.ibm.com/support/docview.wss?uid=swg21671201
CVE: CVE-2013-3977
Published: 2014-05-26
Description: The Meeting Server in IBM Sametime 8.x through 8.5.2.1 and 9.x through 9.0.0.1 allows remote attackers to determine which meeting rooms are owned by a user by leveraging knowledge of valid user names.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-287
References: http://www-01.ibm.com/support/docview.wss?uid=swg21671201; https://exchange.xforce.ibmcloud.com/vulnerabilities/84901; http://www-01.ibm.com/support/docview.wss?uid=swg21671201
CVE: CVE-2013-3980
Published: 2014-05-26
Description: The Meeting Server in IBM Sametime 8.x through 8.5.2.1 and 9.x through 9.0.0.1 allows remote attackers to cause a denial of service (room unusability) by generating a large number of fictitious users to enter a meeting room.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://www-01.ibm.com/support/docview.wss?uid=swg21671201; https://exchange.xforce.ibmcloud.com/vulnerabilities/84906; http://www-01.ibm.com/support/docview.wss?uid=swg21671201
CVE: CVE-2013-3981
Published: 2014-05-26
Description: The Meeting Server in IBM Sametime 8.x through 8.5.2.1 and 9.x through 9.0.0.1 allows remote attackers to download avatar photos of arbitrary users via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg21671201; https://exchange.xforce.ibmcloud.com/vulnerabilities/84907; http://www-01.ibm.com/support/docview.wss?uid=swg21671201
CVE: CVE-2013-3982
Published: 2014-05-26
Description: The Meeting Server in IBM Sametime 8.x through 8.5.2.1 and 9.x through 9.0.0.1 allows remote attackers to obtain unspecified installation information and technical data via a request to a public page.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg21671201; https://exchange.xforce.ibmcloud.com/vulnerabilities/84908; http://www-01.ibm.com/support/docview.wss?uid=swg21671201
CVE: CVE-2013-3984
Published: 2014-05-26
Description: The Meeting Server in IBM Sametime 8.x through 8.5.2.1 and 9.x through 9.0.0.1 does not set the secure flag for an unspecified cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.
CVSS Score: 2.9 (LOW)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg21671201; https://exchange.xforce.ibmcloud.com/vulnerabilities/84967; http://www-01.ibm.com/support/docview.wss?uid=swg21671201
CVE: CVE-2014-0906
Published: 2014-05-26
Description: The Meeting Server in IBM Sametime 8.x through 8.5.2.1 and 9.x through 9.0.0.1 does not check whether a session cookie is current, which allows remote attackers to conduct user-search actions by leveraging possession of a (1) expired or (2) invalidated cookie.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg21671201; https://exchange.xforce.ibmcloud.com/vulnerabilities/91854; http://www-01.ibm.com/support/docview.wss?uid=swg21671201
CVE: CVE-2014-3014
Published: 2014-05-26
Description: Cross-site scripting (XSS) vulnerability in the Meeting Server in IBM Sametime 8.x through 8.5.2.1 and 9.x through 9.0.0.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21671201; http://www.securityfocus.com/bid/67597; https://exchange.xforce.ibmcloud.com/vulnerabilities/93025
CVE: CVE-2012-3333
Published: 2014-05-26
Description: CRLF injection vulnerability in IBM Maximo Asset Management 7.x before 7.5.0.6 and SmartCloud Control Desk 7.x before 7.5.0.3 and 7.5.1.x before 7.5.1.2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted parameter in a URL.
CVSS Score: 4.3 (MEDIUM)
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IV26377; http://www-01.ibm.com/support/docview.wss?uid=swg21670870; https://exchange.xforce.ibmcloud.com/vulnerabilities/78145
CVE: CVE-2013-2998
Published: 2014-05-26
Description: frontcontroller.jsp in IBM Maximo Asset Management 7.x before 7.5.0.6 and SmartCloud Control Desk 7.x before 7.5.0.3 and 7.5.1.x before 7.5.1.2 allows remote authenticated users to obtain sensitive information via an invalid action_code.
CVSS Score: 3.5 (LOW)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IV34110; http://www-01.ibm.com/support/docview.wss?uid=swg21670870; https://exchange.xforce.ibmcloud.com/vulnerabilities/84841
CVE: CVE-2014-3867
Published: 2014-05-26
Description: The Meeting Server in IBM Sametime 8.x through 8.5.2.1 and 9.x through 9.0.0.1 does not include the HTTPOnly flag in a Set-Cookie header for an unspecified cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie, a different vulnerability than CVE-2013-3984.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg21671201; http://www.securityfocus.com/bid/67659; https://exchange.xforce.ibmcloud.com/vulnerabilities/84967
CVE: CVE-2013-4016
Published: 2014-05-26
Description: SQL injection vulnerability in IBM Maximo Asset Management 7.x before 7.1.1.7 LAFIX.20[PII_REDACTED], 7.1.1.11 before IFIX.20[PII_REDACTED], 7.1.1.12 before IFIX.20[PII_REDACTED], 7.5.x before 7.5.0.3 IFIX027, 7.5.0.4 before IFIX011, and 7.5.0.5 before IFIX006; SmartCloud Control Desk 7.x before 7.5.0.3 and 7.5.1.x before 7.5.1.2; and Tivoli IT Asset Management for IT, Tivoli Service Request Manager, Maximo Service Desk, and Change and Configuration Management Database (CCMDB) 7.x before 7.1.1.7 LAFIX.20[PII_REDACTED], 7.1.1.11 before IFIX.20[PII_REDACTED], and 7.1.1.12 before IFIX.20[PII_REDACTED] allows remote authenticated users to execute arbitrary SQL commands via a Birt report with a WHERE clause in plain text.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IV41871; http://www-01.ibm.com/support/docview.wss?uid=swg21670870; https://exchange.xforce.ibmcloud.com/vulnerabilities/85793
CVE: CVE-2013-5460
Published: 2014-05-26
Description: IBM Maximo Asset Management 7.x before 7.5.0.6 and SmartCloud Control Desk 7.x before 7.5.0.3 and 7.5.1.x before 7.5.1.2 allow remote authenticated users to bypass intended access restrictions, and read communication logs associated with unrelated records, via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IV46745; http://www-01.ibm.com/support/docview.wss?uid=swg21670870; https://exchange.xforce.ibmcloud.com/vulnerabilities/88308
CVE: CVE-2013-5464
Published: 2014-05-26
Description: IBM Maximo Asset Management 7.5.x before 7.5.0.3 IFIX027, 7.5.0.4 before IFIX011, and 7.5.0.5 before IFIX006 and SmartCloud Control Desk 7.x before 7.5.0.3 and 7.5.1.x before 7.5.1.2 allow remote authenticated users to bypass intended access restrictions, and modify physical counts associated with restricted storerooms, via unspecified vectors.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IV46277; http://www-01.ibm.com/support/docview.wss?uid=swg21670870; https://exchange.xforce.ibmcloud.com/vulnerabilities/88362
CVE: CVE-2013-5465
Published: 2014-05-26
Description: IBM Maximo Asset Management 7.x before 7.1.1.7 LAFIX.20[PII_REDACTED], 7.1.1.11 before IFIX.20[PII_REDACTED], 7.1.1.12 before IFIX.20[PII_REDACTED], 7.5.x before 7.5.0.3 IFIX027, and 7.5.0.4 before IFIX011; SmartCloud Control Desk 7.x before 7.5.0.3 and 7.5.1.x before 7.5.1.2; and Tivoli IT Asset Management for IT, Tivoli Service Request Manager, Maximo Service Desk, and Change and Configuration Management Database (CCMDB) 7.x before 7.1.1.7 LAFIX.20[PII_REDACTED], 7.1.1.11 before IFIX.20[PII_REDACTED], and 7.1.1.12 before IFIX.20[PII_REDACTED] do not properly restrict file types during uploads, which allows remote authenticated users to have an unspecified impact via an invalid type.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IV46511; http://www-01.ibm.com/support/docview.wss?uid=swg21670870; https://exchange.xforce.ibmcloud.com/vulnerabilities/88364
CVE: CVE-2013-6741
Published: 2014-05-26
Description: IBM Maximo Asset Management 7.x before 7.1.1.7 LAFIX.20[PII_REDACTED] and 7.5.x before 7.5.0.5 IFIX006; SmartCloud Control Desk 7.x before 7.5.0.3 and 7.5.1.x before 7.5.1.2; and Tivoli IT Asset Management for IT, Tivoli Service Request Manager, Maximo Service Desk, and Change and Configuration Management Database (CCMDB) 7.x before 7.1.1.7 LAFIX.20[PII_REDACTED] allow remote authenticated users to obtain potentially sensitive stack-trace information by triggering a Birt error.
CVSS Score: 3.5 (LOW)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IV50316; http://www-01.ibm.com/support/docview.wss?uid=swg21670870; https://exchange.xforce.ibmcloud.com/vulnerabilities/89857
CVE: CVE-2014-0824
Published: 2014-05-26
Description: Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 7.x before 7.1.1.8 LAFIX.20[PII_REDACTED] and 7.1.1.12 before IFIX.20[PII_REDACTED] and Tivoli IT Asset Management for IT, Tivoli Service Request Manager, Maximo Service Desk, and Change and Configuration Management Database (CCMDB) 7.x before 7.1.1.8 LAFIX.20[PII_REDACTED] and 7.1.1.12 before IFIX.20[PII_REDACTED] allows remote authenticated users to inject arbitrary web script or HTML via an attachment URL.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IV52829; http://www-01.ibm.com/support/docview.wss?uid=swg21670870; https://exchange.xforce.ibmcloud.com/vulnerabilities/90500
CVE: CVE-2014-0825
Published: 2014-05-26
Description: Cross-site scripting (XSS) vulnerability in openreport.jsp in IBM Maximo Asset Management 7.x before 7.1.1.12 IFIX.20[PII_REDACTED] and 7.5.x before 7.5.0.5 IFIX006; SmartCloud Control Desk 7.x before 7.5.0.3 and 7.5.1.x before 7.5.1.2; and Tivoli IT Asset Management for IT, Tivoli Service Request Manager, Maximo Service Desk, and Change and Configuration Management Database (CCMDB) 7.x before 7.1.1.12 IFIX.20[PII_REDACTED] allows remote authenticated users to inject arbitrary web script or HTML via a crafted report parameter.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IV53362; http://www-01.ibm.com/support/docview.wss?uid=swg21670870; https://exchange.xforce.ibmcloud.com/vulnerabilities/90501
CVE: CVE-2014-0849
Published: 2014-05-26
Description: IBM Maximo Asset Management 7.x before 7.5.0.3 IFIX027 and SmartCloud Control Desk 7.x before 7.5.0.3 and 7.5.1.x before 7.5.1.2 allow remote authenticated users to gain privileges by leveraging membership in two security groups.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IV53952; http://www-01.ibm.com/support/docview.wss?uid=swg21670870; https://exchange.xforce.ibmcloud.com/vulnerabilities/90738
CVE: CVE-2014-0893
Published: 2014-05-26
Description: Cross-site scripting (XSS) vulnerability in customreport.jsp in IBM Maximo Asset Management 7.5.x before 7.5.0.5 IFIX006 and SmartCloud Control Desk 7.x before 7.5.0.3 and 7.5.1.x before 7.5.1.2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified parameters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IV55019; http://www-01.ibm.com/support/docview.wss?uid=swg21670870; https://exchange.xforce.ibmcloud.com/vulnerabilities/91287
CVE: CVE-2013-6713
Published: 2014-05-26
Description: The Data Protection for VMware component in IBM Tivoli Storage Manager for Virtual Environments (TSMVE) 6.3 through 7.1.0.2 does not properly check authorization for backup and restore operations, which allows local users to obtain sensitive VM data or cause a denial of service (disk consumption) via unspecified GUI actions.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg21673051; https://exchange.xforce.ibmcloud.com/vulnerabilities/89055; http://www-01.ibm.com/support/docview.wss?uid=swg21673051
CVE: CVE-2013-6714
Published: 2014-05-26
Description: The FlashCopy Manager for VMware component in IBM Tivoli Storage FlashCopy Manager 3.1 through 4.1.0.1 does not properly check authorization for backup and restore operations, which allows local users to obtain sensitive VM data or cause a denial of service (data overwrite or disk consumption) via unspecified GUI actions.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg21673045; https://exchange.xforce.ibmcloud.com/vulnerabilities/89057; http://www-01.ibm.com/support/docview.wss?uid=swg21673045
CVE: CVE-2014-0878
Published: 2014-05-26
Description: The IBMSecureRandom component in the IBMJCE and IBMSecureRandom cryptographic providers in IBM SDK Java Technology Edition 5.0 before Service Refresh 16 FP6, 6 before Service Refresh 16, 6.0.1 before Service Refresh 8, 7 before Service Refresh 7, and 7R1 before Service Refresh 1 makes it easier for context-dependent attackers to defeat cryptographic protection mechanisms by predicting the random number generator's output.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-310
References: http://secunia.com/advisories/59022; http://secunia.com/advisories/59023; http://secunia.com/advisories/59058
CVE: CVE-2014-3866
Published: 2014-05-26
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in user_settings.php in Usercake 2.0.2 and earlier allow remote attackers to hijack the authentication of administrators for requests that change the (1) administrative password via the passwordc parameter or (2) administrative e-mail address via the email parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://research.openflare.org/advisories/OF-2014-11/usercake_csrf.txt; http://research.openflare.org/advisories/OF-2014-11/usercake_csrf.txt
CVE: CVE-2012-6647
Published: 2014-05-26
Description: The futex_wait_requeue_pi function in kernel/futex.c in the Linux kernel before 3.5.1 does not ensure that calls have two different futex addresses, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted FUTEX_WAIT_REQUEUE_PI command.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-20
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=6f7b0a2a5c0fb03be7c25bd1745baa50582348ef; http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.5.1; http://www.openwall.com/lists/oss-security/2014/05/14/9