deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-0268
Published: 2014-02-12
Description: Microsoft Internet Explorer 8 through 11 does not properly restrict file installation and registry-key creation, which allows remote attackers to bypass the Mandatory Integrity Control protection mechanism via a crafted web site, aka "Internet Explorer Elevation of Privilege Vulnerability."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/103165; http://secunia.com/advisories/56796; http://www.securityfocus.com/bid/65392
CVE: CVE-2014-0269
Published: 2014-02-12
Description: Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/103169; http://secunia.com/advisories/56796; http://www.securityfocus.com/bid/65363
CVE: CVE-2014-0270
Published: 2014-02-12
Description: Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0273, CVE-2014-0274, and CVE-2014-0288.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/103170; http://secunia.com/advisories/56796; http://www.securityfocus.com/bid/65367
CVE: CVE-2014-0271
Published: 2014-02-12
Description: The VBScript engine in Microsoft Internet Explorer 6 through 11, and VBScript 5.6 through 5.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "VBScript Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/103166; http://secunia.com/advisories/56796; http://secunia.com/advisories/56814
CVE: CVE-2014-0272
Published: 2014-02-12
Description: Microsoft Internet Explorer 8 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/103171; http://secunia.com/advisories/56796; http://www.securityfocus.com/bid/65370
CVE: CVE-2014-0273
Published: 2014-02-12
Description: Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0270, CVE-2014-0274, and CVE-2014-0288.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/103172; http://secunia.com/advisories/56796; http://www.securityfocus.com/bid/65371
CVE: CVE-2014-0274
Published: 2014-02-12
Description: Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0270, CVE-2014-0273, and CVE-2014-0288.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/103173; http://secunia.com/advisories/56796; http://www.securityfocus.com/bid/65372
CVE: CVE-2014-0275
Published: 2014-02-12
Description: Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0285 and CVE-2014-0286.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/103174; http://secunia.com/advisories/56796; http://www.securityfocus.com/bid/65373
CVE: CVE-2014-0276
Published: 2014-02-12
Description: Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/103175; http://secunia.com/advisories/56796; http://www.securityfocus.com/bid/65375
CVE: CVE-2014-0277
Published: 2014-02-12
Description: Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0278 and CVE-2014-0279.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1440&w=2; http://osvdb.org/103176; http://secunia.com/advisories/56796
CVE: CVE-2014-0278
Published: 2014-02-12
Description: Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0277 and CVE-2014-0279.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/103177; http://secunia.com/advisories/56796; http://www.securityfocus.com/bid/65377
CVE: CVE-2014-0279
Published: 2014-02-12
Description: Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0277 and CVE-2014-0278.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/103178; http://secunia.com/advisories/56796; http://www.securityfocus.com/bid/65378
CVE: CVE-2014-0280
Published: 2014-02-12
Description: Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/103179; http://secunia.com/advisories/56796; http://www.securityfocus.com/bid/65380
CVE: CVE-2014-0281
Published: 2014-02-12
Description: Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0287.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/103180; http://secunia.com/advisories/56796; http://www.securityfocus.com/bid/65381
CVE: CVE-2014-0283
Published: 2014-02-12
Description: Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/103181; http://secunia.com/advisories/56796; http://www.securityfocus.com/bid/65382
CVE: CVE-2014-0284
Published: 2014-02-12
Description: Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/103182; http://secunia.com/advisories/56796; http://www.securityfocus.com/bid/65383
CVE: CVE-2014-0285
Published: 2014-02-12
Description: Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0275 and CVE-2014-0286.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/103183; http://secunia.com/advisories/56796; http://www.securityfocus.com/bid/65384
CVE: CVE-2014-0286
Published: 2014-02-12
Description: Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0275 and CVE-2014-0285.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/103184; http://secunia.com/advisories/56796; http://www.securityfocus.com/bid/65385
CVE: CVE-2014-0287
Published: 2014-02-12
Description: Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0281.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/103185; http://secunia.com/advisories/56796; http://www.securityfocus.com/bid/65386
CVE: CVE-2014-0288
Published: 2014-02-12
Description: Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0270, CVE-2014-0273, and CVE-2014-0274.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/103186; http://secunia.com/advisories/56796; http://www.securityfocus.com/bid/65388
CVE: CVE-2014-0289
Published: 2014-02-12
Description: Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0267 and CVE-2014-0290.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/103187; http://secunia.com/advisories/56796; http://www.securityfocus.com/bid/65389
CVE: CVE-2014-0290
Published: 2014-02-12
Description: Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0267 and CVE-2014-0289.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/103188; http://secunia.com/advisories/56796; http://www.securityfocus.com/bid/65390
CVE: CVE-2014-0293
Published: 2014-02-12
Description: Microsoft Internet Explorer 9 through 11 allows remote attackers to read content from a different (1) domain or (2) zone via a crafted web site, aka "Internet Explorer Cross-domain Information Disclosure Vulnerability."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://osvdb.org/103167; http://secunia.com/advisories/56796; http://www.securityfocus.com/bid/65394
CVE: CVE-2014-0294
Published: 2014-02-12
Description: Microsoft Forefront Protection 2010 for Exchange Server does not properly parse e-mail content, which might allow remote attackers to execute arbitrary code via a crafted message, aka "RCE Vulnerability."
CVSS Score: 10.0 (HIGH)
CWE: CWE-94
References: http://osvdb.org/103161; http://secunia.com/advisories/56788; http://www.securityfocus.com/bid/65397
CVE: CVE-2014-0295
Published: 2014-02-12
Description: VsaVb7rt.dll in Microsoft .NET Framework 2.0 SP2 and 3.5.1 does not implement the ASLR protection mechanism, which makes it easier for remote attackers to execute arbitrary code via a crafted web site, as exploited in the wild in February 2014, aka "VSAVB7RT ASLR Vulnerability."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/103164; http://secunia.com/advisories/56793; http://www.greyhathacker.net/?p=585
CVE: CVE-2014-0500
Published: 2014-02-12
Description: Adobe Shockwave Player before 12.0.9.149 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0501.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://helpx.adobe.com/security/products/shockwave/apsb14-06.html; http://osvdb.org/103157; http://secunia.com/advisories/56740
CVE: CVE-2014-0501
Published: 2014-02-12
Description: Adobe Shockwave Player before 12.0.9.149 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0500.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://helpx.adobe.com/security/products/shockwave/apsb14-06.html; http://osvdb.org/103158; http://secunia.com/advisories/56740
CVE: CVE-2013-6229
Published: 2014-02-12
Description: Multiple cross-site scripting (XSS) vulnerabilities in Atmail Webmail Server 7.0.2 allow remote attackers to inject arbitrary web script or HTML via the (1) filter parameter to index.php/mail/mail/listfoldermessages/searching/true/selectFolder/INBOX/resultContext/searchResultsTab5 or (2) mailId[] parameter to index.php/mail/mail/movetofolder/fromFolder/INBOX/toFolder/INBOX.Trash. NOTE: the view attachment message process vector is already covered by CVE-2013-2585.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.isecauditors.com/advisories-2013#2013-014; http://www.securityfocus.com/archive/1/530934/100/0/threaded; http://www.isecauditors.com/advisories-2013#2013-014
CVE: CVE-2013-2585
Published: 2014-02-12
Description: Cross-site scripting (XSS) vulnerability in Atmail Webmail Server 6.6.x before 6.6.3 and 7.0.x before 7.0.3 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to index.php/mail/viewmessage/getattachment/folder/INBOX/uniqueId/<MessageID>/filenameOriginal/.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.isecauditors.com/advisories-2013#2013-004; http://www.securityfocus.com/archive/1/530934/100/0/threaded; https://atmail.com/changelog
CVE: CVE-2014-0722
Published: 2014-02-13
Description: The log4jinit web application in Cisco Unified Communications Manager (UCM) does not properly validate authentication, which allows remote attackers to cause a denial of service (performance degradation) via unspecified use of this application, aka Bug ID CSCum05347.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-287
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0722; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0722
CVE: CVE-2014-0723
Published: 2014-02-13
Description: Cross-site scripting (XSS) vulnerability in the IP Manager Assistant (IPMA) interface in Cisco Unified Communications Manager (UCM) allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCum05343.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/103222; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0723; http://www.securityfocus.com/bid/65495
CVE: CVE-2014-0724
Published: 2014-02-13
Description: The bulk administration interface in Cisco Unified Communications Manager (UCM) 10.0(1) and earlier allows remote attackers to bypass authentication and read arbitrary files by using an unspecified prompt, aka Bug ID CSCum05340.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0724; http://tools.cisco.com/security/center/viewAlert.x?alertId=32825; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0724
CVE: CVE-2014-0725
Published: 2014-02-13
Description: Cisco Unified Communications Manager (UCM) does not require authentication for reading WAR files, which allows remote attackers to obtain sensitive information via unspecified access to a "file storage location," aka Bug ID CSCum05337.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-287
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0725; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0725
CVE: CVE-2014-0726
Published: 2014-02-13
Description: SQL injection vulnerability in the IP Manager Assistant (IPMA) interface in Cisco Unified Communications Manager (UCM) 10.0(1) and earlier allows remote attackers to execute arbitrary SQL commands via a crafted URL, aka Bug ID CSCum05326.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/103218; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0726; http://tools.cisco.com/security/center/viewAlert.x?alertId=32843
CVE: CVE-2014-0727
Published: 2014-02-13
Description: SQL injection vulnerability in the CallManager Interactive Voice Response (CMIVR) interface in Cisco Unified Communications Manager (UCM) allows remote attackers to execute arbitrary SQL commands via a crafted URL, aka Bug ID CSCum05318.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/103219; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0727; http://tools.cisco.com/security/center/viewAlert.x?alertId=32844
CVE: CVE-2014-0728
Published: 2014-02-13
Description: SQL injection vulnerability in the Java database interface in Cisco Unified Communications Manager (UCM) 10.0(1) and earlier allows remote attackers to execute arbitrary SQL commands via a crafted URL, aka Bug ID CSCum05313.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/103221; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0728; http://tools.cisco.com/security/center/viewAlert.x?alertId=32834
CVE: CVE-2014-0729
Published: 2014-02-13
Description: SQL injection vulnerability in the Enterprise Mobility Application (EMApp) interface in Cisco Unified Communications Manager (UCM) allows remote attackers to execute arbitrary SQL commands via a crafted URL, aka Bug ID CSCum05302.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/103220; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0729; http://www.securityfocus.com/bid/65501
CVE: CVE-2013-5014
Published: 2014-02-14
Description: The management console in Symantec Endpoint Protection Manager (SEPM) 11.0 before 11.0.7405.1424 and 12.1 before 12.1.4023.4080, and Symantec Protection Center Small Business Edition 12.x before 12.1.4023.4080, allows remote attackers to read arbitrary files via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
CVSS Score: 7.5 (HIGH)
References: http://www.exploit-db.com/exploits/31853; http://www.exploit-db.com/exploits/31917; http://www.securityfocus.com/bid/65466
CVE: CVE-2013-5015
Published: 2014-02-14
Description: SQL injection vulnerability in the management console in Symantec Endpoint Protection Manager (SEPM) 11.0 before 11.0.7405.1424 and 12.1 before 12.1.4023.4080, and Symantec Protection Center Small Business Edition 12.x before 12.1.4023.4080, allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://osvdb.org/103306; http://www.exploit-db.com/exploits/31853; http://www.exploit-db.com/exploits/31917
CVE: CVE-2013-5400
Published: 2014-02-14
Description: An unspecified servlet in IBM Platform Symphony Developer Edition (DE) 5.2 and 6.1.x through 6.1.1 has hardcoded credentials, which allows remote attackers to bypass authentication and obtain "local environment" access via unknown vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-255
References: http://www-01.ibm.com/support/docview.wss?uid=isg3T1020564; https://exchange.xforce.ibmcloud.com/vulnerabilities/87296; http://www-01.ibm.com/support/docview.wss?uid=isg3T1020564
CVE: CVE-2013-6722
Published: 2014-02-14
Description: Unrestricted file upload vulnerability in the Registration/Edit My Profile portlet in IBM WebSphere Portal 7.x before 7.0.0.2 CF27 and 8.x through 8.0.0.1 CF09 allows remote attackers to cause a denial of service or modify data via unspecified vectors.
CVSS Score: 5.8 (MEDIUM)
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PI07013; http://www-01.ibm.com/support/docview.wss?uid=swg21662873; https://exchange.xforce.ibmcloud.com/vulnerabilities/89235
CVE: CVE-2013-6728
Published: 2014-02-14
Description: The charting component in IBM WebSphere Dashboard Framework (WDF) 6.1.5 and 7.0.1 allows remote attackers to view or delete image files by leveraging incorrect security constraints for a temporary directory.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg1LO78265; http://www-01.ibm.com/support/docview.wss?uid=swg1LO78266; http://www-01.ibm.com/support/docview.wss?uid=swg21663022
CVE: CVE-2014-0855
Published: 2014-02-14
Description: Multiple cross-site scripting (XSS) vulnerabilities in IBM Connections Portlets 4.x before 4.5.1 FP1 for IBM WebSphere Portal 7.0.0.2 and 8.0.0.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21663921; https://exchange.xforce.ibmcloud.com/vulnerabilities/90802; http://www-01.ibm.com/support/docview.wss?uid=swg21663921
CVE: CVE-2014-1467
Published: 2014-02-14
Description: BlackBerry Enterprise Service 10 before 10.2.1, Universal Device Service 6, Enterprise Server Express for Domino through 5.0.4, Enterprise Server Express for Exchange through 5.0.4, Enterprise Server for Domino through 5.0.4 MR6, Enterprise Server for Exchange through 5.0.4 MR6, and Enterprise Server for GroupWise through 5.0.4 MR6 log cleartext credentials during exception handling, which might allow context-dependent attackers to obtain sensitive information by reading a log file.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-255
References: http://www.blackberry.com/btsc/KB35647; http://www.blackberry.com/btsc/KB35647
CVE: CVE-2014-1680
Published: 2014-02-14
Description: Untrusted search path vulnerability in Bandisoft Bandizip before 3.10 allows local users to gain privileges via a Trojan horse dwmapi.dll file in the current working directory.
CVSS Score: 6.9 (MEDIUM)
References: http://osvdb.org/102979; http://packetstormsecurity.com/files/125059; http://www.bandisoft.com/bandizip/history
CVE: CVE-2013-2829
Published: 2014-02-14
Description: MatrikonOPC SCADA DNP3 OPC Server 1.2.2.0 and earlier allows remote attackers to cause a denial of service (infinite loop) via a malformed DNP3 packet.
CVSS Score: 7.1 (HIGH)
CWE: CWE-20
References: http://ics-cert.us-cert.gov/advisories/ICSA-14-010-01; http://ics-cert.us-cert.gov/advisories/ICSA-14-010-01
CVE: CVE-2013-3978
Published: 2014-02-14
Description: The Meeting Server in IBM Sametime 8.5.2 through 8.5.2.1 and 9.x through 9.0.0.1 does not send the appropriate HTTP response headers to prevent unwanted caching by a web browser, which allows remote attackers to obtain sensitive information by leveraging an unattended workstation.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg21662928; https://exchange.xforce.ibmcloud.com/vulnerabilities/84902; http://www-01.ibm.com/support/docview.wss?uid=swg21662928
CVE: CVE-2013-3983
Published: 2014-02-14
Description: The Meeting Server in IBM Sametime 8.5.2 through 8.5.2.1 and 9.x through 9.0.0.1 does not validate URLs in Cookie headers before using them in redirects, which has unspecified impact and remote attack vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www-01.ibm.com/support/docview.wss?uid=swg21662928; https://exchange.xforce.ibmcloud.com/vulnerabilities/84966; http://www-01.ibm.com/support/docview.wss?uid=swg21662928
CVE: CVE-2013-3988
Published: 2014-02-14
Description: The Meeting Server in IBM Sametime 8.5.2 through 8.5.2.1 and 9.x through 9.0.0.1 allows remote attackers to conduct clickjacking attacks via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://www-01.ibm.com/support/docview.wss?uid=swg21662928; https://exchange.xforce.ibmcloud.com/vulnerabilities/84973; http://www-01.ibm.com/support/docview.wss?uid=swg21662928