deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-1266
Published: 2014-02-22
Description: The SSLVerifySignedServerKeyExchange function in libsecurity_ssl/lib/sslKeyExchange.c in the Secure Transport feature in the Data Security component in Apple iOS 6.x before 6.1.6 and 7.x before 7.0.6, Apple TV 6.x before 6.0.2, and Apple OS X 10.9.x before 10.9.2 does not check the signature in a TLS Server Key Exchange message, which allows man-in-the-middle attackers to spoof SSL servers by (1) using an arbitrary private key for the signing step or (2) omitting the signing step.
CVSS Score: 7.4 (HIGH)
CWE: CWE-295
References: http://it.slashdot.org/comments.pl?sid=4821073&cid=46310187; http://support.apple.com/kb/HT6146; http://support.apple.com/kb/HT6147
CVE: CVE-2013-6732
Published: 2014-02-22
Description: Cross-site scripting (XSS) vulnerability in the server in IBM Cognos Business Intelligence (BI) 8.4.1, 10.1 before IF6, 10.1.1 before IF5, 10.2 before IF7, 10.2.1 before IF4, and 10.2.1.1 before IF4 allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21662856; https://exchange.xforce.ibmcloud.com/vulnerabilities/89394; http://www-01.ibm.com/support/docview.wss?uid=swg21662856
CVE: CVE-2013-6734
Published: 2014-02-22
Description: IBM WebSphere eXtreme Scale Client 7.1 through 8.6.0.4 does not properly isolate the cached data of different users, which allows remote authenticated users to obtain sensitive information in opportunistic circumstances by leveraging access to the same web container.
CVSS Score: 3.5 (LOW)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PI06341; http://www-01.ibm.com/support/docview.wss?uid=swg21664641; https://exchange.xforce.ibmcloud.com/vulnerabilities/89397
CVE: CVE-2013-6948
Published: 2014-02-22
Description: The peerAddresses API in the Belkin WeMo Home Automation firmware before 3949 allows remote attackers to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
CVSS Score: 7.8 (HIGH)
CWE: CWE-94
References: http://www.ioactive.com/pdfs/IOActive_Belkin-advisory-lite.pdf; http://www.kb.cert.org/vuls/id/656302; http://www.ioactive.com/pdfs/IOActive_Belkin-advisory-lite.pdf
CVE: CVE-2013-6949
Published: 2014-02-22
Description: The Belkin WeMo Home Automation firmware before 3949 does not properly use the STUN and TURN protocols, which allows remote attackers to hijack connections and possibly have unspecified other impact by leveraging access to a single WeMo device.
CVSS Score: 9.3 (HIGH)
CWE: CWE-264
References: http://www.ioactive.com/pdfs/IOActive_Belkin-advisory-lite.pdf; http://www.kb.cert.org/vuls/id/656302; http://www.ioactive.com/pdfs/IOActive_Belkin-advisory-lite.pdf
CVE: CVE-2013-6950
Published: 2014-02-22
Description: The Belkin WeMo Home Automation firmware before 3949 does not use SSL for the distribution feed, which allows man-in-the-middle attackers to install arbitrary firmware by spoofing a distribution server.
CVSS Score: 7.8 (HIGH)
CWE: CWE-310
References: http://www.ioactive.com/pdfs/IOActive_Belkin-advisory-lite.pdf; http://www.kb.cert.org/vuls/id/656302; http://www.ioactive.com/pdfs/IOActive_Belkin-advisory-lite.pdf
CVE: CVE-2013-6951
Published: 2014-02-22
Description: The Belkin WeMo Home Automation firmware before 3949 does not maintain a set of Certification Authority public keys, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary X.509 certificate.
CVSS Score: 7.1 (HIGH)
CWE: CWE-310
References: http://www.ioactive.com/pdfs/IOActive_Belkin-advisory-lite.pdf; http://www.kb.cert.org/vuls/id/656302; http://www.ioactive.com/pdfs/IOActive_Belkin-advisory-lite.pdf
CVE: CVE-2013-6952
Published: 2014-02-22
Description: The Belkin WeMo Home Automation firmware before 3949 has a hardcoded GPG key, which makes it easier for remote attackers to spoof firmware updates and execute arbitrary code via crafted signed data.
CVSS Score: 10.0 (HIGH)
CWE: CWE-310
References: http://www.ioactive.com/pdfs/IOActive_Belkin-advisory-lite.pdf; http://www.kb.cert.org/vuls/id/656302; http://www.ioactive.com/pdfs/IOActive_Belkin-advisory-lite.pdf
CVE: CVE-2014-0709
Published: 2014-02-22
Description: Cisco UCS Director (formerly Cloupia) before 4.0.0.3 has a hardcoded password for the root account, which makes it easier for remote attackers to obtain administrative access via an SSH session to the CLI interface, aka Bug ID CSCui73930.
CVSS Score: 9.3 (HIGH)
CWE: CWE-255
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140219-ucsd; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140219-ucsd
CVE: CVE-2014-0710
Published: 2014-02-22
Description: Race condition in the cut-through proxy feature in Cisco Firewall Services Module (FWSM) Software 3.x before 3.2(28) and 4.x before 4.1(15) allows remote attackers to cause a denial of service (device reload) via certain matching traffic, aka Bug ID CSCuj16824.
CVSS Score: 7.1 (HIGH)
CWE: CWE-362
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140219-fwsm; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140219-fwsm
CVE: CVE-2014-0718
Published: 2014-02-22
Description: The produce-verbose-alert feature in Cisco IPS Software 7.1 before 7.1(8)E4 and 7.2 before 7.2(2)E4 allows remote attackers to cause a denial of service (Analysis Engine process outage) via fragmented packets, aka Bug ID CSCui91266.
CVSS Score: 7.1 (HIGH)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140219-ips; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140219-ips
CVE: CVE-2014-0719
Published: 2014-02-22
Description: The control-plane access-list implementation in Cisco IPS Software before 7.1(8p2)E4 and 7.2 before 7.2(2)E4 allows remote attackers to cause a denial of service (MainApp process outage) via crafted packets to TCP port 7000, aka Bug ID CSCui67394.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140219-ips; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140219-ips
CVE: CVE-2014-0720
Published: 2014-02-22
Description: Cisco IPS Software 7.1 before 7.1(8)E4 and 7.2 before 7.2(2)E4 allows remote attackers to cause a denial of service (Analysis Engine process outage) via a flood of jumbo frames, aka Bug ID CSCuh94944.
CVSS Score: 7.1 (HIGH)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140219-ips; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140219-ips
CVE: CVE-2014-0721
Published: 2014-02-22
Description: The Cisco Unified SIP Phone 3905 with firmware before 9.4(1) allows remote attackers to obtain root access via a session on the test interface on TCP port 7870, aka Bug ID CSCuh75574.
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140219-phone; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140219-phone
CVE: CVE-2014-0730
Published: 2014-02-22
Description: Cisco Unified Computing System (UCS) Central Software 1.1 and earlier allows local users to gain privileges via a CLI copy command in a local-mgmt context, aka Bug ID CSCul53128.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0730; http://tools.cisco.com/security/center/viewAlert.x?alertId=32910; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0730
CVE: CVE-2014-0731
Published: 2014-02-22
Description: The administration interface in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier allows remote attackers to bypass authentication and read Java class files via a direct request, aka Bug ID CSCum46497.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0731; http://tools.cisco.com/security/center/viewAlert.x?alertId=32915; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0731
CVE: CVE-2014-0737
Published: 2014-02-22
Description: The Cisco Unified IP Phone 7960G 9.2(1) and earlier allows remote attackers to bypass authentication and change trust relationships by injecting a Certificate Trust List (CTL) file, aka Bug ID CSCuj66795.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-287
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0737; http://tools.cisco.com/security/center/viewAlert.x?alertId=32957; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0737
CVE: CVE-2014-0738
Published: 2014-02-22
Description: The Phone Proxy component in Cisco Adaptive Security Appliance (ASA) Software 9.1(.3) and earlier allows remote attackers to bypass authentication and change trust relationships by injecting a Certificate Trust List (CTL) file, aka Bug ID CSCuj66770.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-287
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0738; http://tools.cisco.com/security/center/viewAlert.x?alertId=32956; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0738
CVE: CVE-2014-0739
Published: 2014-02-22
Description: Race condition in the Phone Proxy component in Cisco Adaptive Security Appliance (ASA) Software 9.1(.3) and earlier allows remote attackers to bypass sec_db authentication and provide certain pass-through services to untrusted devices via a crafted configuration-file TFTP request, aka Bug ID CSCuj66766.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-287
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0739; http://tools.cisco.com/security/center/viewAlert.x?alertId=32955; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0739
CVE: CVE-2014-0811
Published: 2014-02-22
Description: Cross-site scripting (XSS) vulnerability in Blackboard Vista/CE 8.0 SP6 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN24730765/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2014-000012; http://www.securityfocus.com/bid/65742
CVE: CVE-2014-0818
Published: 2014-02-22
Description: Untrusted search path vulnerability in Autodesk AutoCAD before 2014 allows local users to gain privileges and execute arbitrary VBScript code via a Trojan horse FAS file in the FAS file search path.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://jvn.jp/en/jp/JVN33382534/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2014-000019; http://jvn.jp/en/jp/JVN33382534/index.html
CVE: CVE-2014-0819
Published: 2014-02-22
Description: Untrusted search path vulnerability in Autodesk AutoCAD before 2014 allows local users to gain privileges via a Trojan horse DLL in the current working directory.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-20
References: http://jvn.jp/en/jp/JVN43254599/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2014-000020; http://jvn.jp/en/jp/JVN43254599/index.html
CVE: CVE-2014-0854
Published: 2014-02-22
Description: The server in IBM Cognos Business Intelligence (BI) 8.4.1, 10.1 before IF6, 10.1.1 before IF5, 10.2 before IF7, 10.2.1 before IF4, and 10.2.1.1 before IF4 allows remote authenticated users to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg21662856; https://exchange.xforce.ibmcloud.com/vulnerabilities/90794; http://www-01.ibm.com/support/docview.wss?uid=swg21662856
CVE: CVE-2014-0861
Published: 2014-02-22
Description: Cross-site scripting (XSS) vulnerability in the server in IBM Cognos Business Intelligence (BI) 8.4.1, 10.1 before IF6, 10.1.1 before IF5, 10.2 before IF7, 10.2.1 before IF4, and 10.2.1.1 before IF4 allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter that is not properly handled during use of the Back button.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21662856; http://www-01.ibm.com/support/docview.wss?uid=swg21662856
CVE: CVE-2013-2817
Published: 2014-02-24
Description: An ActiveX control in IcoLaunch.dll in Mitsubishi Electric Automation MC-WorX Suite 8.02 allows user-assisted remote attackers to execute arbitrary programs via a crafted HTML document in conjunction with a Login Client button click.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://ics-cert.us-cert.gov/advisories/ICSA-14-051-02; http://www.meau.com/eprise/main/sites/public/Products/Software/-MC_Works; http://ics-cert.us-cert.gov/advisories/ICSA-14-051-02
CVE: CVE-2013-6202
Published: 2014-02-24
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in HP Service Manager 9.30, 9.31, 9.32, and 9.33 allow remote attackers to hijack the authentication of unspecified victims for requests that (1) insert XSS sequences or (2) execute arbitrary code.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://h20565.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?docId=emr_na-c04117626; http://www.securitytracker.com/id/1029803; http://h20565.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?docId=emr_na-c04117626
CVE: CVE-2013-6652
Published: 2014-02-24
Description: Directory traversal vulnerability in sandbox/win/src/named_pipe_dispatcher.cc in Google Chrome before 33.0.1750.117 on Windows allows attackers to bypass intended named-pipe policy restrictions in the sandbox via vectors related to (1) lack of checks for .. (dot dot) sequences or (2) lack of use of the \\?\ protection mechanism.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://googlechromereleases.blogspot.com/2014/02/stable-channel-update_20.html; https://code.google.com/p/chromium/issues/detail?id=334897; https://src.chromium.org/viewvc/chrome?revision=247511&view=revision
CVE: CVE-2013-6653
Published: 2014-02-24
Description: Use-after-free vulnerability in the web contents implementation in Google Chrome before 33.0.1750.117 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving attempted conflicting access to the color chooser.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://googlechromereleases.blogspot.com/2014/02/stable-channel-update_20.html; http://lists.opensuse.org/opensuse-updates/2014-03/msg00006.html; http://www.debian.org/security/2014/dsa-2883
CVE: CVE-2013-6654
Published: 2014-02-24
Description: The SVGAnimateElement::calculateAnimatedValue function in core/svg/SVGAnimateElement.cpp in Blink, as used in Google Chrome before 33.0.1750.117, does not properly handle unexpected data types, which allows remote attackers to cause a denial of service (incorrect cast) or possibly have unspecified other impact via unknown vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://googlechromereleases.blogspot.com/2014/02/stable-channel-update_20.html; http://lists.opensuse.org/opensuse-updates/2014-03/msg00006.html; http://www.debian.org/security/2014/dsa-2883
CVE: CVE-2013-6655
Published: 2014-02-24
Description: Use-after-free vulnerability in Blink, as used in Google Chrome before 33.0.1750.117, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to improper handling of overflowchanged DOM events during interaction between JavaScript and layout.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://googlechromereleases.blogspot.com/2014/02/stable-channel-update_20.html; http://lists.opensuse.org/opensuse-updates/2014-03/msg00006.html; http://www.debian.org/security/2014/dsa-2883
CVE: CVE-2013-6656
Published: 2014-02-24
Description: The XSSAuditor::init function in core/html/parser/XSSAuditor.cpp in the XSS auditor in Blink, as used in Google Chrome before 33.0.1750.117, processes POST requests by using the body of a redirecting page instead of the body of a redirect target, which allows remote attackers to obtain sensitive information via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://googlechromereleases.blogspot.com/2014/02/stable-channel-update_20.html; http://lists.opensuse.org/opensuse-updates/2014-03/msg00006.html; http://www.debian.org/security/2014/dsa-2883
CVE: CVE-2013-6657
Published: 2014-02-24
Description: core/html/parser/XSSAuditor.cpp in the XSS auditor in Blink, as used in Google Chrome before 33.0.1750.117, inserts the about:blank URL during certain blocking of FORM elements within HTTP requests, which allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via unspecified vectors.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-264
References: http://googlechromereleases.blogspot.com/2014/02/stable-channel-update_20.html; http://lists.opensuse.org/opensuse-updates/2014-03/msg00006.html; http://www.debian.org/security/2014/dsa-2883
CVE: CVE-2013-6658
Published: 2014-02-24
Description: Multiple use-after-free vulnerabilities in the layout implementation in Blink, as used in Google Chrome before 33.0.1750.117, allow remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving (1) running JavaScript code during execution of the updateWidgetPositions function or (2) making a call into a plugin during execution of the updateWidgetPositions function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://googlechromereleases.blogspot.com/2014/02/stable-channel-update_20.html; http://lists.opensuse.org/opensuse-updates/2014-03/msg00006.html; http://www.debian.org/security/2014/dsa-2883
CVE: CVE-2013-6659
Published: 2014-02-24
Description: The SSLClientSocketNSS::Core::OwnAuthCertHandler function in net/socket/ssl_client_socket_nss.cc in Google Chrome before 33.0.1750.117 does not prevent changes to server X.509 certificates during renegotiations, which allows remote SSL servers to trigger use of a new certificate chain, inconsistent with the user's expectations, by initiating a TLS renegotiation.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-310
References: http://googlechromereleases.blogspot.com/2014/02/stable-channel-update_20.html; http://lists.opensuse.org/opensuse-updates/2014-03/msg00006.html; http://www.debian.org/security/2014/dsa-2883
CVE: CVE-2013-6660
Published: 2014-02-24
Description: The drag-and-drop implementation in Google Chrome before 33.0.1750.117 does not properly restrict the information in WebDropData data structures, which allows remote attackers to discover full pathnames via a crafted web site.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://googlechromereleases.blogspot.com/2014/02/stable-channel-update_20.html; http://lists.opensuse.org/opensuse-updates/2014-03/msg00006.html; http://www.debian.org/security/2014/dsa-2883
CVE: CVE-2013-6661
Published: 2014-02-24
Description: Multiple unspecified vulnerabilities in Google Chrome before 33.0.1750.117 allow attackers to bypass the sandbox protection mechanism after obtaining renderer access, or have other impact, via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://googlechromereleases.blogspot.com/2014/02/stable-channel-update_20.html; http://lists.opensuse.org/opensuse-updates/2014-03/msg00006.html; http://www.debian.org/security/2014/dsa-2883
CVE: CVE-2014-0758
Published: 2014-02-24
Description: An ActiveX control in GenLaunch.htm in ICONICS GENESIS32 8.0, 8.02, 8.04, and 8.05 allows remote attackers to execute arbitrary programs via a crafted HTML document.
CVSS Score: 9.3 (HIGH)
CWE: CWE-749, CWE-20
References: https://www.cisa.gov/news-events/ics-advisories/icsa-14-051-01; http://ics-cert.us-cert.gov/advisories/ICSA-14-051-01
CVE: CVE-2014-1966
Published: 2014-02-24
Description: The SNMP implementation in Siemens RuggedCom ROS before 3.11, ROS 3.11 for RS950G, ROS 3.12 before 3.12.4, and ROS 4.0 for RSG2488 allows remote attackers to cause a denial of service (device outage) via crafted packets.
CVSS Score: 7.8 (HIGH)
References: http://ics-cert.us-cert.gov/advisories/ICSA-14-051-03; http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-892342.pdf; http://ics-cert.us-cert.gov/advisories/ICSA-14-051-03
CVE: CVE-2013-6047
Published: 2014-02-25
Description: Multiple cross-site scripting (XSS) vulnerabilities in the site creation interface in ikiwiki-hosting before 0.20131025 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/99012; http://packages.qa.debian.org/i/ikiwiki-hosting/news/20131025T224825Z.html; http://seclists.org/oss-sec/2013/q4/180
CVE: CVE-2014-0839
Published: 2014-02-26
Description: IBM Rational Focal Point 6.4.x and 6.5.x before 6.5.2.3 and 6.6.x before 6.6.1 allows remote authenticated users to modify data via vectors involving a direct object reference.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg21665005; https://exchange.xforce.ibmcloud.com/vulnerabilities/90696; http://www-01.ibm.com/support/docview.wss?uid=swg21665005
CVE: CVE-2014-0840
Published: 2014-02-26
Description: Multiple cross-site scripting (XSS) vulnerabilities in IBM Rational Focal Point 6.4.x and 6.5.x before 6.5.2.3 and 6.6.x before 6.6.1 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21665005; http://www.securityfocus.com/bid/65737; https://exchange.xforce.ibmcloud.com/vulnerabilities/90698
CVE: CVE-2014-0842
Published: 2014-02-26
Description: The account-creation functionality in IBM Rational Focal Point 6.4.x and 6.5.x before 6.5.2.3 and 6.6.x before 6.6.1 places the new user's default password within the creation page, which allows remote attackers to obtain sensitive information by reading the HTML source code.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-255
References: http://www-01.ibm.com/support/docview.wss?uid=swg21665005; https://exchange.xforce.ibmcloud.com/vulnerabilities/90706; http://www-01.ibm.com/support/docview.wss?uid=swg21665005
CVE: CVE-2014-0843
Published: 2014-02-26
Description: Cross-site scripting (XSS) vulnerability in IBM Rational Focal Point 6.4.x and 6.5.x before 6.5.2.3 and 6.6.x before 6.6.1 allows remote authenticated users to inject arbitrary web script or HTML by uploading a file.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21665005; http://www.securityfocus.com/bid/65730; https://exchange.xforce.ibmcloud.com/vulnerabilities/90714
CVE: CVE-2014-0853
Published: 2014-02-26
Description: Multiple cross-site scripting (XSS) vulnerabilities in the (1) ForwardController and (2) AttributeEditor scripts in IBM Rational Focal Point 6.4.x and 6.5.x before 6.5.2.3 and 6.6.x before 6.6.1 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21665005; http://www.securityfocus.com/bid/65726; https://exchange.xforce.ibmcloud.com/vulnerabilities/90754
CVE: CVE-2013-2824
Published: 2014-02-26
Description: Schneider Electric StruxureWare SCADA Expert Vijeo Citect 7.40, Vijeo Citect 7.20 through 7.30SP1, CitectSCADA 7.20 through 7.30SP1, StruxureWare PowerSCADA Expert 7.30 through 7.30SR1, and PowerLogic SCADA 7.20 through 7.20SR1 do not properly handle exceptions, which allows remote attackers to cause a denial of service via a crafted packet.
CVSS Score: 7.8 (HIGH)
References: http://ics-cert.us-cert.gov/advisories/ICSA-13-350-01; http://www.citect.schneider-electric.com/security-DoS; http://ics-cert.us-cert.gov/advisories/ICSA-13-350-01