deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-6635
Published: 2014-10-26
Description: Cross-site scripting (XSS) vulnerability in Exponent CMS 2.3.0 allows remote attackers to inject arbitrary web script or HTML via the src parameter in the search action to index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/128335/Exponent-CMS-2.3.0-Cross-Site-Scripting.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/96158; http://packetstormsecurity.com/files/128335/Exponent-CMS-2.3.0-Cross-Site-Scripting.html
CVE: CVE-2010-4820
Published: 2014-10-27
Description: Untrusted search path vulnerability in Ghostscript 8.62 allows local users to execute arbitrary PostScript code via a Trojan horse Postscript library file in Encoding/ under the current working directory, a different vulnerability than CVE-2010-2055.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-94
References: http://bugs.ghostscript.com/show_bug.cgi?id=691339; http://rhn.redhat.com/errata/RHSA-2012-0095.html; http://rhn.redhat.com/errata/RHSA-2012-0096.html
CVE: CVE-2011-4103
Published: 2014-10-27
Description: emitters.py in Django Piston before 0.2.3 and 0.2.x before 0.2.2.1 does not properly deserialize YAML data, which allows remote attackers to execute arbitrary Python code via vectors related to the yaml.load method.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.debian.org/security/2011/dsa-2344; http://www.openwall.com/lists/oss-security/2011/11/01/10; https://bitbucket.org/jespern/django-piston/commits/91bdaec89543/
CVE: CVE-2011-4104
Published: 2014-10-27
Description: The from_yaml method in serializers.py in Django Tastypie before 0.9.10 does not properly deserialize YAML data, which allows remote attackers to execute arbitrary Python code via vectors related to the yaml.load method.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2011/11/02/1; http://www.openwall.com/lists/oss-security/2011/11/02/7; https://github.com/toastdriven/django-tastypie/commit/e8af315211b07c8f48f32a063233cc3f76dd5bc2
CVE: CVE-2011-4953
Published: 2014-10-27
Description: The set_mgmt_parameters function in item.py in cobbler before 2.2.2 allows context-dependent attackers to execute arbitrary code via vectors related to the use of the yaml.load function instead of the yaml.safe_load function, as demonstrated using Puppet.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00019.html; https://bugs.launchpad.net/ubuntu/oneiric/+source/cobbler/+bug/858883; https://bugzilla.novell.com/show_bug.cgi?id=757062
CVE: CVE-2014-0136
Published: 2014-10-27
Description: The (1) get and (2) log methods in the AgentController in Red Hat CloudForms 3.0 Management Engine (CFME) 5.x allow remote attackers to insert arbitrary text into log files via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://rhn.redhat.com/errata/RHSA-2014-1037.html; http://www.securityfocus.com/bid/69233; http://rhn.redhat.com/errata/RHSA-2014-1037.html
CVE: CVE-2014-2988
Published: 2014-10-27
Description: EGroupware Enterprise Line (EPL) before 1.1.20140505, EGroupware Community Edition before 1.8[PII_REDACTED]6, and EGroupware before 14.1 beta allows remote authenticated administrators to execute arbitrary PHP code via crafted callback values to the call_user_func PHP function, as demonstrated using the newsettings[system] parameter. NOTE: this can be exploited by remote attackers by leveraging CVE-2014-2987.
CVSS Score: 8.5 (HIGH)
CWE: CWE-94
References: http://advisories.mageia.org/MGASA-2014-0221.html; http://www.mandriva.com/security/advisories?name=MDVSA-2015:087; http://www.securityfocus.com/archive/1/532103/100/0/threaded
CVE: CVE-2014-3711
Published: 2014-10-27
Description: namei in FreeBSD 9.1 through 10.1-RC2 allows remote attackers to cause a denial of service (memory exhaustion) via vectors that trigger a sandboxed process to look up a large number of nonexistent path names.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://secunia.com/advisories/62218; http://www.debian.org/security/2014/dsa-3070; http://www.securitytracker.com/id/1031100
CVE: CVE-2014-3954
Published: 2014-10-27
Description: Stack-based buffer overflow in rtsold in FreeBSD 9.1 through 10.1-RC2 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via crafted DNS parameters in a router advertisement message.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://www.securitytracker.com/id/1031098; https://www.freebsd.org/security/advisories/FreeBSD-SA-14%3A20.rtsold.asc; http://www.securitytracker.com/id/1031098
CVE: CVE-2014-3955
Published: 2014-10-27
Description: routed in FreeBSD 8.4 through 10.1-RC2 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via an RIP request from a source not on a directly connected network.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/61865; http://www.securitytracker.com/id/1031099; https://www.freebsd.org/security/advisories/FreeBSD-SA-14:21.routed.asc
CVE: CVE-2014-8327
Published: 2014-10-27
Description: The fal_sftp extension before 0.2.6 for TYPO3 uses weak permissions for sFTP driver files and folders, which allows remote authenticated users to obtain sensitive information via unspecified vectors.
CVSS Score: 4.0 (MEDIUM)
References: http://typo3.org/extensions/repository/view/fal_sftp; http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2014-014/; https://exchange.xforce.ibmcloud.com/vulnerabilities/97668
CVE: CVE-2003-1599
Published: 2014-10-27
Description: PHP remote file inclusion vulnerability in wp-links/links.all.php in WordPress 0.70 allows remote attackers to execute arbitrary PHP code via a URL in the $abspath variable.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://www.kernelpanik.org/docs/kernelpanik/wordpressadv.txt; http://www.openwall.com/lists/oss-security/2012/01/06/3; http://www.osvdb.org/4611
CVE: CVE-2010-5077
Published: 2014-10-27
Description: server/sv_main.c in Quake3 Arena, as used in ioquake3 before r1762, OpenArena, Tremulous, and other products, allows remote attackers to cause a denial of service (network traffic amplification) via a spoofed (1) getstatus or (2) rcon request.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://openarena.ws/board/index.php?topic=4391.0; http://permalink.gmane.org/gmane.comp.games.ioquake3/961; http://www.debian.org/security/2012/dsa-2442
CVE: CVE-2011-2702
Published: 2014-10-27
Description: Integer signedness error in Glibc before 2.13 and eglibc before 2.13, when using Supplemental Streaming SIMD Extensions 3 (SSSE3) optimization, allows context-dependent attackers to execute arbitrary code via a negative length parameter to (1) memcpy-ssse3-rep.S, (2) memcpy-ssse3.S, or (3) memset-sse2.S in sysdeps/i386/i686/multiarch/, which triggers an out-of-bounds read, as demonstrated using the memcpy function.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://seclists.org/oss-sec/2011/q3/123; http://seclists.org/oss-sec/2011/q3/153; http://www.eglibc.org/cgi-bin/viewvc.cgi/trunk/libc/ChangeLog?view=markup&pathrev=10032
CVE: CVE-2012-1111
Published: 2014-10-27
Description: lightdm before 1.0.9 does not properly close file descriptors before opening a child process, which allows local users to write to the lightdm log or have other unspecified impact.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-200
References: http://lists.opensuse.org/opensuse-updates/2012-03/msg00019.html; http://seclists.org/oss-sec/2012/q1/557; http://seclists.org/oss-sec/2012/q1/566
CVE: CVE-2012-5580
Published: 2014-10-27
Description: Format string vulnerability in the print_proxies function in bin/proxy.c in libproxy 0.3.1 might allow context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via format string specifiers in a proxy name, as demonstrated using the http_proxy environment variable or a PAC file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://www.securityfocus.com/bid/56712; https://bugzilla.novell.com/show_bug.cgi?id=791086; https://bugzilla.redhat.com/show_bug.cgi?id=883100
CVE: CVE-2014-4586
Published: 2014-10-27
Description: Multiple cross-site scripting (XSS) vulnerabilities in the wp-football plugin 1.1 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the league parameter to (1) football_classification.php, (2) football_criteria.php, (3) templates/template_default_preview.php, or (4) templates/template_worldCup_preview.php; the (5) f parameter to football-functions.php; the id parameter in an "action" action to (6) football_groups_list.php, (7) football_matches_list.php, (8) football_matches_phase.php, or (9) football_phases_list.php; or the (10) id_league parameter in a delete action to football_matches_load.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://codevigilant.com/disclosure/wp-plugin-wp-football-a3-cross-site-scripting-xss; http://codevigilant.com/disclosure/wp-plugin-wp-football-a3-cross-site-scripting-xss
CVE: CVE-2014-4023
Published: 2014-10-28
Description: Cross-site scripting (XSS) vulnerability in tmui/dashboard/echo.jsp in the Configuration utility in F5 BIG-IP LTM, APM, ASM, GTM, and Link Controller 11.0.0 before 11.6.0 and 10.1.0 through 10.2.4, AAM 11.4.0 before 11.6.0, AFM and PEM 11.3.0 before 11.6.0, Analytics 11.0.0 through 11.5.1, Edge Gateway, WebAccelerator, and WOM 11.0.0 through 11.3.0 and 10.1.0 through 10.2.4, and PSM 11.0.0 through 11.4.1 and 10.1.0 through 10.2.4 and Enterprise Manager 3.0.0 through 3.1.1 and 2.1.0 through 2.3.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securitytracker.com/id/1030776; https://support.f5.com/kb/en-us/solutions/public/15000/500/sol15532.html; https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140828-F5_BIG-IP_Reflected_XSS_v10.txt
CVE: CVE-2014-8505
Published: 2014-10-28
Description: Multiple cross-site scripting (XSS) vulnerabilities in Etiko CMS allow remote attackers to inject arbitrary web script or HTML via the (1) page_id parameter to loja/index.php or (2) article_id parameter to index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/128644/Etiko-CMS-Cross-Site-Scripting-SQL-Injection.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/97031; http://packetstormsecurity.com/files/128644/Etiko-CMS-Cross-Site-Scripting-SQL-Injection.html
CVE: CVE-2014-8506
Published: 2014-10-28
Description: Multiple SQL injection vulnerabilities in Etiko CMS allow remote attackers to execute arbitrary SQL commands via the (1) page_id parameter to loja/index.php or (2) article_id parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/128644/Etiko-CMS-Cross-Site-Scripting-SQL-Injection.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/97030; http://packetstormsecurity.com/files/128644/Etiko-CMS-Cross-Site-Scripting-SQL-Injection.html
CVE: CVE-2014-3293
Published: 2014-10-28
Description: Cisco IOS 15.4(3)S0b on ASR901 devices makes incorrect decisions to use the CPU for IPv4 packet processing, which allows remote attackers to cause a denial of service (BGP neighbor flapping) by sending many crafted IPv4 packets, aka Bug ID CSCuo29736.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://secunia.com/advisories/61830; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3293; http://tools.cisco.com/security/center/viewAlert.x?alertId=36195
CVE: CVE-2014-4808
Published: 2014-10-28
Description: Unspecified vulnerability in IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0 through 7.0.0.2 CF28, 8.0 through 8.0.0.1 CF14, and 8.5.0 before CF03 allows remote authenticated users to execute arbitrary code via unknown vectors.
CVSS Score: 6.5 (MEDIUM)
References: http://secunia.com/advisories/59740; http://www-01.ibm.com/support/docview.wss?uid=swg1PI25993; http://www-01.ibm.com/support/docview.wss?uid=swg21684651
CVE: CVE-2014-4814
Published: 2014-10-28
Description: IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0 through 7.0.0.2 CF28, 8.0 through 8.0.0.1 CF14, and 8.5.0 before CF03 does not properly detect recursion during entity expansion, which allows remote authenticated users to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.
CVSS Score: 3.5 (LOW)
CWE: CWE-399
References: http://secunia.com/advisories/59740; http://www-01.ibm.com/support/docview.wss?uid=swg1PI24622; http://www-01.ibm.com/support/docview.wss?uid=swg21684651
CVE: CVE-2014-4821
Published: 2014-10-28
Description: IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0 through 7.0.0.2 CF28, 8.0 through 8.0.0.1 CF14, and 8.5.0 before CF03 provides different web-server error codes depending on whether a requested file exists, which allows remote attackers to determine the validity of filenames via a series of requests.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PI27710; http://www-01.ibm.com/support/docview.wss?uid=swg21684651; http://www.securityfocus.com/bid/70755
CVE: CVE-2014-6125
Published: 2014-10-28
Description: Cross-site request forgery (CSRF) vulnerability in IBM WebSphere Portal 8.5.0 before CF03 allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PI26889; http://www-01.ibm.com/support/docview.wss?uid=swg21684651; http://www.securityfocus.com/bid/70759
CVE: CVE-2014-6126
Published: 2014-10-28
Description: Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 8.5.0 before CF03 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PI26889; http://www-01.ibm.com/support/docview.wss?uid=swg21684651; http://www.securityfocus.com/bid/70756
CVE: CVE-2014-3051
Published: 2014-10-29
Description: The Internet Service Monitor (ISM) agent in IBM Tivoli Composite Application Manager (ITCAM) for Transactions 7.1 and 7.2 before 7.2.0.3 IF28, 7.3 before 7.3.0.1 IF30, and 7.4 before 7.4.0.0 IF18 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain credential information via a crafted certificate.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-310
References: http://secunia.com/advisories/59756; http://www-01.ibm.com/support/docview.wss?uid=swg21682290; https://exchange.xforce.ibmcloud.com/vulnerabilities/93444
CVE: CVE-2014-3668
Published: 2014-10-29
Description: Buffer overflow in the date_from_ISO8601 function in the mkgmtime implementation in libxmlrpc/xmlrpc.c in the XMLRPC extension in PHP before 5.4.34, 5.5.x before 5.5.18, and 5.6.x before 5.6.2 allows remote attackers to cause a denial of service (application crash) via (1) a crafted first argument to the xmlrpc_set_type function or (2) a crafted argument to the xmlrpc_decode function, related to an out-of-bounds read operation.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=88412772d295ebf7dd[PII_REDACTED]7dc9bcac726e; http://linux.oracle.com/errata/ELSA-2014-1767.html; http://linux.oracle.com/errata/ELSA-2014-1768.html
CVE: CVE-2014-3669
Published: 2014-10-29
Description: Integer overflow in the object_custom function in ext/standard/var_unserializer.c in PHP before 5.4.34, 5.5.x before 5.5.18, and 5.6.x before 5.6.2 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an argument to the unserialize function that triggers calculation of a large length value.
CVSS Score: 7.5 (HIGH)
CWE: CWE-189
References: http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=56754a7f9eba0e4f559b6ca081d9f2a447b3f159; http://linux.oracle.com/errata/ELSA-2014-1767.html; http://linux.oracle.com/errata/ELSA-2014-1768.html
CVE: CVE-2014-3670
Published: 2014-10-29
Description: The exif_ifd_make_value function in exif.c in the EXIF extension in PHP before 5.4.34, 5.5.x before 5.5.18, and 5.6.x before 5.6.2 operates on floating-point arrays incorrectly, which allows remote attackers to cause a denial of service (heap memory corruption and application crash) or possibly execute arbitrary code via a crafted JPEG image with TIFF thumbnail data that is improperly handled by the exif_thumbnail function.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=ddb207e7fa2e9adeba021a1303c3781efda5409b; http://linux.oracle.com/errata/ELSA-2014-1767.html; http://linux.oracle.com/errata/ELSA-2014-1768.html
CVE: CVE-2014-3694
Published: 2014-10-29
Description: The (1) bundled GnuTLS SSL/TLS plugin and the (2) bundled OpenSSL SSL/TLS plugin in libpurple in Pidgin before 2.10.10 do not properly consider the Basic Constraints extension during verification of X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-310
References: http://hg.pidgin.im/pidgin/main/rev/2e4475087f04; http://lists.opensuse.org/opensuse-updates/2014-11/msg00023.html; http://lists.opensuse.org/opensuse-updates/2014-11/msg00037.html
CVE: CVE-2014-3695
Published: 2014-10-29
Description: markup.c in the MXit protocol plugin in libpurple in Pidgin before 2.10.10 allows remote servers to cause a denial of service (application crash) via a large length value in an emoticon response.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://hg.pidgin.im/pidgin/main/rev/6436e14bdb9d; http://lists.opensuse.org/opensuse-updates/2014-11/msg00023.html; http://lists.opensuse.org/opensuse-updates/2014-11/msg00037.html
CVE: CVE-2014-3696
Published: 2014-10-29
Description: nmevent.c in the Novell GroupWise protocol plugin in libpurple in Pidgin before 2.10.10 allows remote servers to cause a denial of service (application crash) via a crafted server message that triggers a large memory allocation.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://hg.pidgin.im/pidgin/main/rev/44fd89158777; http://lists.opensuse.org/opensuse-updates/2014-11/msg00023.html; http://lists.opensuse.org/opensuse-updates/2014-11/msg00037.html
CVE: CVE-2014-3697
Published: 2014-10-29
Description: Absolute path traversal vulnerability in the untar_block function in win32/untar.c in Pidgin before 2.10.10 on Windows allows remote attackers to write to arbitrary files via a drive name in a tar archive of a smiley theme.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-22
References: http://hg.pidgin.im/pidgin/main/rev/68b8eb10977f; http://lists.opensuse.org/opensuse-updates/2014-11/msg00023.html; http://lists.opensuse.org/opensuse-updates/2014-11/msg00037.html
CVE: CVE-2014-3698
Published: 2014-10-29
Description: The jabber_idn_validate function in jutil.c in the Jabber protocol plugin in libpurple in Pidgin before 2.10.10 allows remote attackers to obtain sensitive information from process memory via a crafted XMPP message.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://hg.pidgin.im/pidgin/main/rev/ea46ab68f0dc; http://lists.opensuse.org/opensuse-updates/2014-11/msg00023.html; http://lists.opensuse.org/opensuse-updates/2014-11/msg00037.html
CVE: CVE-2014-4839
Published: 2014-10-29
Description: Cross-site request forgery (CSRF) vulnerability in birtviewer.query in IBM TRIRIGA Application Platform 3.2 and 3.3 before 3.3.0.2, 3.3.1 before 3.3.1.3, 3.3.2 before 3.3.2.2, and 3.4 before 3.4.0.1 allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS sequences.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-352
References: http://www-01.ibm.com/support/docview.wss?uid=swg21686241; https://exchange.xforce.ibmcloud.com/vulnerabilities/95635; http://www-01.ibm.com/support/docview.wss?uid=swg21686241
CVE: CVE-2014-4877
Published: 2014-10-29
Description: Absolute path traversal vulnerability in GNU Wget before 1.16, when recursion is enabled, allows remote FTP servers to write to arbitrary files, and consequently execute arbitrary code, via a LIST response that references the same filename within two entries, one of which indicates that the filename is for a symlink.
CVSS Score: 9.3 (HIGH)
CWE: CWE-22
References: http://advisories.mageia.org/MGASA-2014-0431.html; http://git.savannah.gnu.org/cgit/wget.git/commit/?id=18b0979357ed7dc4e11d4f2b1d7e0f5932d82aa7; http://git.savannah.gnu.org/cgit/wget.git/commit/?id=b4440d96cf8173d68ecaa07c36b8f4316ee794d0
CVE: CVE-2014-6149
Published: 2014-10-29
Description: Directory traversal vulnerability in BIRT-viewer in IBM Tivoli Application Dependency Discovery Manager (TADDM) 7.2.0.0 through 7.2.0.10, 7.2.1.0 through 7.2.1.6, and 7.2.2.0 through 7.2.2.2 allows remote authenticated users to read arbitrary files via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://www-01.ibm.com/support/docview.wss?uid=swg21688296; http://www.securityfocus.com/bid/70805; https://exchange.xforce.ibmcloud.com/vulnerabilities/96919
CVE: CVE-2014-8518
Published: 2014-10-29
Description: The (1) Removable Media and (2) CD and DVD encryption offsite access options (formerly Endpoint Encryption for Removable Media or EERM) in McAfee File and Removable Media Protection (FRP) 4.3.0.x, and Endpoint Encryption for Files and Folders (EEFF) 3.2.x through 4.2.x, uses a hard-coded salt, which makes it easier for local users to obtain passwords via a brute force attack.
CVSS Score: 2.1 (LOW)
CWE: CWE-255
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10089; https://kc.mcafee.com/corporate/index?page=content&id=SB10089
CVE: CVE-2014-8519
Published: 2014-10-29
Description: Unspecified vulnerability in McAfee Network Data Loss Prevention (NDLP) before 9.2.2 allows local users to read arbitrary files via unknown vectors.
CVSS Score: 2.1 (LOW)
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10044; https://kc.mcafee.com/corporate/index?page=content&id=SB10044
CVE: CVE-2014-8520
Published: 2014-10-29
Description: McAfee Network Data Loss Prevention (NDLP) before 9.3 allows remote attackers to obtain sensitive information via vectors related to open network ports.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/70815; https://exchange.xforce.ibmcloud.com/vulnerabilities/98433; https://kc.mcafee.com/corporate/index?page=content&id=SB10053
CVE: CVE-2014-8521
Published: 2014-10-29
Description: Cross-site scripting (XSS) vulnerability in McAfee Network Data Loss Prevention (NDLP) before 9.3 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-352
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10053; https://kc.mcafee.com/corporate/index?page=content&id=SB10053
CVE: CVE-2014-8522
Published: 2014-10-29
Description: The MySQL database in McAfee Network Data Loss Prevention (NDLP) before 9.3 does not require a password, which makes it easier for remote attackers to obtain access.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10053; https://kc.mcafee.com/corporate/index?page=content&id=SB10053
CVE: CVE-2014-8523
Published: 2014-10-29
Description: Cross-site request forgery (CSRF) vulnerability in McAfee Network Data Loss Prevention (NDLP) before 9.3 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10053; https://kc.mcafee.com/corporate/index?page=content&id=SB10053