deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2013-4581
Published: 2014-05-12
Description: GitLab 5.0 before 5.4.2, Community Edition before 6.2.4, Enterprise Edition before 6.2.1 and gitlab-shell before 1.7.8 allows remote attackers to execute arbitrary code via a crafted change using SSH.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://www.openwall.com/lists/oss-security/2013/11/15/4; https://www.gitlab.com/2013/11/14/multiple-critical-vulnerabilities-in-gitlab/; http://www.openwall.com/lists/oss-security/2013/11/15/4
CVE: CVE-2013-4772
Published: 2014-05-12
Description: D-Link DIR-505L SharePort Mobile Companion 1.01 and DIR-826L Wireless N600 Cloud Router 1.02 allows remote attackers to bypass authentication via a direct request when an authorized session is active.
CVSS Score: 9.3 (HIGH)
CWE: CWE-287
References: http://packetstormsecurity.com/files/122314/D-Link-DIR-505L-DIR-826L-Authentication-Bypass.html; http://packetstormsecurity.com/files/122314/D-Link-DIR-505L-DIR-826L-Authentication-Bypass.html
CVE: CVE-2013-5671
Published: 2014-05-12
Description: lib/dragonfly/imagemagickutils.rb in the fog-dragonfly gem 0.8.2 for Ruby allows remote attackers to execute arbitrary commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
References: http://seclists.org/fulldisclosure/2013/Sep/18; http://seclists.org/oss-sec/2013/q3/526; http://seclists.org/oss-sec/2013/q3/528
CVE: CVE-2013-5748
Published: 2014-05-12
Description: Cross-site request forgery (CSRF) vulnerability in management/prioritize_planning.php in SimpleRisk before 20130916-001 allows remote attackers to hijack the authentication of users for requests that add projects via an add_project action.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.com/files/123455/SimpleRisk-20130915-01-Cross-Site-Request-Forgery-Cross-Site-Scripting.html; https://github.com/simplerisk/documentation/raw/master/SimpleRisk%20Release%20Notes%[PII_REDACTED]-001.pdf; http://packetstormsecurity.com/files/123455/SimpleRisk-20130915-01-Cross-Site-Request-Forgery-Cross-Site-Scripting.html
CVE: CVE-2013-5749
Published: 2014-05-12
Description: Cross-site scripting (XSS) vulnerability in management/prioritize_planning.php in SimpleRisk before 20130916-001 allows remote attackers to inject arbitrary web script or HTML via the new_project parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/123455/SimpleRisk-20130915-01-Cross-Site-Request-Forgery-Cross-Site-Scripting.html; https://github.com/simplerisk/documentation/raw/master/SimpleRisk%20Release%20Notes%[PII_REDACTED]-001.pdf; http://packetstormsecurity.com/files/123455/SimpleRisk-20130915-01-Cross-Site-Request-Forgery-Cross-Site-Scripting.html
CVE: CVE-2013-5984
Published: 2014-05-12
Description: Directory traversal vulnerability in userfiles/modules/admin/backup/delete.php in Microweber before 0.830 allows remote attackers to delete arbitrary files via a .. (dot dot) in the file parameter.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.com/files/123652/Microweber-0.8-Arbitrary-File-Deletion.html; https://github.com/microweber/microweber/commit/9177d134960c24cb642d5cf3b42a1fba286219cc; https://www.htbridge.com/advisory/HTB23175
CVE: CVE-2013-6452
Published: 2014-05-12
Description: Cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to inject arbitrary web script or HTML via crafted XSL in an SVG file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-January/000138.html; http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-January/000138.html
CVE: CVE-2013-6453
Published: 2014-05-12
Description: MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 does not properly sanitize SVG files, which allows remote attackers to have unspecified impact via invalid XML.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-January/000138.html; http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-January/000138.html
CVE: CVE-2013-6454
Published: 2014-05-12
Description: Cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to inject arbitrary web script or HTML via a -o-link attribute.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-January/000138.html; http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-January/000138.html
CVE: CVE-2013-6472
Published: 2014-05-12
Description: MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to obtain information about deleted page via the (1) log API, (2) enhanced RecentChanges, and (3) user watchlists.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-January/000138.html; http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-January/000138.html
CVE: CVE-2014-2301
Published: 2014-05-12
Description: OrbiTeam BSCW before 5.0.8 allows remote attackers to obtain sensitive metadata via the inf operations (op=inf) to an object in pub/bscw.cgi/.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www.bscw.de/english/news.html; http://www.securityfocus.com/archive/1/532055/100/0/threaded; https://www.redteam-pentesting.de/en/advisories/rt-sa-2014-003/-metadata-information-disclosure-in-orbiteam-bscw
CVE: CVE-2014-2928
Published: 2014-05-12
Description: The iControl API in F5 BIG-IP LTM, APM, ASM, GTM, Link Controller, and PSM 10.0.0 through 10.2.4 and 11.0.0 through 11.5.1, BIG-IP AAM 11.4.0 through 11.5.1, BIG-IP AFM and PEM 11.3.0 through 11.5.1, BIG-IP Analytics 11.0.0 through 11.5.1, BIG-IP Edge Gateway, WebAccelerator, WOM 10.1.0 through 10.2.4 and 11.0.0 through 11.3.0, Enterprise Manager 2.1.0 through 2.3.0 and 3.0.0 through 3.1.1, and BIG-IQ Cloud, Device, and Security 4.0.0 through 4.3.0 allows remote administrators to execute arbitrary commands via shell metacharacters in the hostname element in a SOAP request.
CVSS Score: 7.1 (HIGH)
References: http://seclists.org/fulldisclosure/2014/May/32; http://support.f5.com/kb/en-us/solutions/public/15000/200/sol15220.html; http://www.exploit-db.com/exploits/34927
CVE: CVE-2014-3242
Published: 2014-05-12
Description: SOAPpy 0.12.5 allows remote attackers to read arbitrary files via a SOAP request containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://seclists.org/fulldisclosure/2014/May/20; http://www.openwall.com/lists/oss-security/2014/05/06/1; http://www.openwall.com/lists/oss-security/2014/05/06/9
CVE: CVE-2014-3243
Published: 2014-05-12
Description: SOAPpy 0.12.5 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted SOAP request containing a large number of nested entity references.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://seclists.org/fulldisclosure/2014/May/20; http://www.openwall.com/lists/oss-security/2014/05/06/1; http://www.openwall.com/lists/oss-security/2014/05/06/9
CVE: CVE-2014-3454
Published: 2014-05-12
Description: Cross-site request forgery (CSRF) vulnerability in Special:CreateCategory in the SemanticForms extension for MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to hijack the authentication of users for requests that create categories via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-January/000138.html; https://bugzilla.wikimedia.org/show_bug.cgi?id=57025; http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-January/000138.html
CVE: CVE-2014-3455
Published: 2014-05-12
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the (1) CreateProperty, (2) CreateTemplate, (3) CreateForm, and (4) CreateClass special pages in the SemanticForms extension for MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allow remote attackers to hijack the authentication of users for requests that have unspecified impact and vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-January/000138.html; https://bugzilla.wikimedia.org/show_bug.cgi?id=57025; http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-January/000138.html
CVE: CVE-2011-4970
Published: 2014-05-13
Description: Multiple SQL injection vulnerabilities in LCG Disk Pool Manager (DPM) before 1.8.6, as used in EGI UDM, allow remote attackers to execute arbitrary SQL commands via the (1) r_token variable in the dpm_get_pending_req_by_token, (2) dpm_get_cpr_by_fullid, (3) dpm_get_cpr_by_surl, (4) dpm_get_cpr_by_surls, (5) dpm_get_gfr_by_fullid, (6) dpm_get_gfr_by_surl, (7) dpm_get_pfr_by_fullid, (8) dpm_get_pfr_by_surl, (9) dpm_get_req_by_token, (10) dpm_insert_cpr_entry, (11) dpm_insert_gfr_entry, (12) dpm_insert_pending_entry, (13) dpm_insert_pfr_entry, (14) dpm_insert_xferreq_entry, (15) dpm_list_cpr_entry, (16) dpm_list_gfr_entry, or (17) dpm_list_pfr_entry function; the (18) surl variable in the dpm_get_cpr_by_surl function; the (19) to_surl variable in the dpm_get_cpr_by_surls function; the (20) u_token variable in the dpm_get_pending_reqs_by_u_desc, (21) dpm_get_reqs_by_u_desc, (22) dpm_get_spcmd_by_u_desc, (23) dpm_insert_pending_entry, (24) dpm_insert_spcmd_entry, or (25) dpm_insert_xferreq_entry function; the (26) s_token variable in the dpm_get_spcmd_by_token, (27) dpm_insert_cpr_entry, (28) dpm_insert_gfr_entry, (29) dpm_insert_pfr_entry, (30) dpm_insert_spcmd_entry, (31) dpm_update_cpr_entry, (32) dpm_update_gfr_entry, or (33) dpm_update_pfr_entry function; or remote administrators to execute arbitrary SQL commands via the (34) poolname variable in the dpm_get_pool_entry, (35) dpm_insert_fs_entry, (36) dpm_insert_pool_entry, (37) dpm_insert_spcmd_entry, (38) dpm_list_fs_entry, or (39) dpm_update_spcmd_entry function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://blog.pi3.com.pl/?p=402; http://secunia.com/advisories/52487; http://site.pi3.com.pl/adv/disk_pool_manager_1.txt
CVE: CVE-2012-6342
Published: 2014-05-13
Description: Cross-site request forgery (CSRF) vulnerability in logout.action in Atlassian Confluence 3.4.6 allows remote attackers to hijack the authentication of administrators for requests that logout the user via a comment.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://archives.neohapsis.com/archives/bugtraq/2013-01/0066.html; http://packetstormsecurity.com/files/116829/Atlassian-Confluence-3.0-Cross-Site-Request-Forgery.html; http://www.halock.com/blog/cve-2012-6342-atlassian-confluence-multiple-cross-site-request-forgery-csrf-vulnerabilities
CVE: CVE-2013-1407
Published: 2014-05-13
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Events Manager plugin before 5.3.5 and Events Manager Pro plugin before 2.2.9 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) scope parameter to index.php; (2) user_name, (3) dbem_phone, (4) user_email, or (5) booking_comment parameter to an event with registration enabled; or the (6) _wpnonce parameter to wp-admin/edit.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2013-03/0034.html; http://wp-events-plugin.com/blog/2013/01/22/5-3-5-released-includes-a-security-update; https://www.htbridge.com/advisory/HTB23139
CVE: CVE-2013-2692
Published: 2014-05-13
Description: Cross-site request forgery (CSRF) vulnerability in the Admin web interface in OpenVPN Access Server before 1.8.5 allows remote attackers to hijack the authentication of administrators for requests that create administrative users.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://openvpn.net/index.php/access-server/download-openvpn-as-sw/531-release-notes-v185.html; http://osvdb.org/93111; http://secunia.com/advisories/52802
CVE: CVE-2013-2705
Published: 2014-05-13
Description: Cross-site request forgery (CSRF) vulnerability in the WordPress Simple Paypal Shopping Cart plugin before 3.6 for WordPress allows remote attackers to hijack the authentication of administrators for requests that change plugin settings.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://osvdb.org/93953; http://secunia.com/advisories/52963; http://www.tipsandtricks-hq.com/ecommerce/wordpress-shopping-cart-change-log-319
CVE: CVE-2014-2989
Published: 2014-05-13
Description: Cross-site request forgery (CSRF) vulnerability in Open Assessment Technologies TAO 2.5.6 allows remote attackers to hijack the authentication of administrators for requests that create administrative accounts via a request to Users/add.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://secunia.com/advisories/58539; http://www.securityfocus.com/bid/67291; https://www.htbridge.com/advisory/HTB23211
CVE: CVE-2014-3246
Published: 2014-05-13
Description: SQL injection vulnerability in Collabtive 1.2 allows remote authenticated users to execute arbitrary SQL commands via the folder parameter in a fileview_list action to manageajax.php.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/33249; http://www.securityfocus.com/bid/67287; http://www.exploit-db.com/exploits/33249
CVE: CVE-2013-4490
Published: 2014-05-13
Description: The SSH key upload feature (lib/gitlab_keys.rb) in gitlab-shell before 1.7.3, as used in GitLab 5.0 before 5.4.1 and 6.x before 6.2.3, allows remote authenticated users to execute arbitrary commands via shell metacharacters in the public key.
CVSS Score: 6.5 (MEDIUM)
References: https://www.gitlab.com/2013/11/04/gitlab-ce-6-2-and-5-4-security-release/; https://www.gitlab.com/2013/11/04/gitlab-ce-6-2-and-5-4-security-release/
CVE: CVE-2013-4500
Published: 2014-05-13
Description: The Quiz module 6.x-4.x before 6.x-4.5 for Drupal allows remote authenticated users with the "view any quiz results" or "view results for own quiz" permission to delete arbitrary results via the delete option.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-264
References: http://seclists.org/oss-sec/2013/q4/210; https://drupal.org/node/2123727; https://drupal.org/node/2123995
CVE: CVE-2013-4501
Published: 2014-05-13
Description: The default views in the Quiz module 6.x-4.x before 6.x-4.5 for Drupal allows remote attackers to obtain sensitive quiz results via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://seclists.org/oss-sec/2013/q4/210; https://drupal.org/node/2123727; https://drupal.org/node/2123995
CVE: CVE-2013-4502
Published: 2014-05-13
Description: The FileField Sources module 6.x-1.x before 6.x-1.9 and 7.x-1.x before 7.x-1.9 for Drupal does not properly check file permissions, which allows remote authenticated users to read arbitrary files by attaching a file.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://seclists.org/oss-sec/2013/q4/210; https://drupal.org/node/2124217; https://drupal.org/node/2124219
CVE: CVE-2013-4503
Published: 2014-05-13
Description: Cross-site scripting (XSS) vulnerability in the Feed Element Mapper module for Drupal allows remote authenticated users with the "administer taxonomy" permission to inject arbitrary web script or HTML via vectors related to options.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://seclists.org/oss-sec/2013/q4/210; https://drupal.org/node/2124279; http://seclists.org/oss-sec/2013/q4/210
CVE: CVE-2013-4504
Published: 2014-05-13
Description: The Monster Menus module 7.x-1.x before 7.x-1.15 allows remote attackers to read arbitrary node comments via a crafted URL.
CVSS Score: 2.6 (LOW)
CWE: CWE-264
References: http://seclists.org/oss-sec/2013/q4/210; https://drupal.org/node/2123287; https://drupal.org/node/2124289
CVE: CVE-2013-4546
Published: 2014-05-13
Description: The repository import feature in gitlab-shell before 1.7.4, as used in GitLab, allows remote authenticated users to execute arbitrary commands via the import URL.
CVSS Score: 6.5 (MEDIUM)
References: http://www.openwall.com/lists/oss-security/2013/11/11/2; https://gitlab.com/gitlab-org/gitlab-shell/blob/master/CHANGELOG; https://www.gitlab.com/2013/11/08/security-vulnerability-in-gitlab-shell/
CVE: CVE-2013-4552
Published: 2014-05-13
Description: lib/Auth/Source/External.php in the drupalauth module before 1.2.2 for simpleSAMLphp allows remote attackers to authenticate as an arbitrary user via the user name (uid) in a cookie.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://www.openwall.com/lists/oss-security/2013/11/05/1; http://www.openwall.com/lists/oss-security/2013/11/08/6; https://code.google.com/p/drupalauth/issues/detail?id=9
CVE: CVE-2013-4562
Published: 2014-05-13
Description: The omniauth-facebook gem 1.4.1 before 1.5.0 does not properly store the session parameter, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks via the state parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://osvdb.org/ref/99/omniauth-facebook_gem.txt; http://seclists.org/oss-sec/2013/q4/264; http://seclists.org/oss-sec/2013/q4/267
CVE: CVE-2014-3456
Published: 2014-05-13
Description: Cross-site scripting (XSS) vulnerability in GitLab Enterprise Edition (EE) 6.6.0 before 6.6.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://www.gitlab.com/2014/02/27/gitlab-ee-6-6-2-security-release/; https://www.gitlab.com/2014/02/27/gitlab-ee-6-6-2-security-release/
CVE: CVE-2010-4832
Published: 2014-05-14
Description: Android OS before 2.2 does not display the correct SSL certificate in certain cases, which might allow remote attackers to spoof trusted web sites via a web page containing references to external sources in which (1) the certificate of the last loaded resource is checked, instead of for the main page, or (2) later certificates are not checked when the HTTPS connection is reused.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-310
References: http://android.git.kernel.org/?p=platform/frameworks/base.git%3Ba=commit%3Bh=dba8cb[PII_REDACTED]7e91b31fa396478f809a5a34; http://jvn.jp/en/jp/JVN43105011/index.html; http://jvndb.jvn.jp/ja/contents/2011/JVNDB-2011-000053.html
CVE: CVE-2011-2513
Published: 2014-05-14
Description: The Java Network Launching Protocol (JNLP) implementation in IcedTea6 1.9.x before 1.9.9 and before 1.8.9, and IcedTea-Web 1.1.x before 1.1.1 and before 1.0.4, allows remote attackers to obtain the username and full path of the home and cache directories by accessing properties of the ClassLoader.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://icedtea.classpath.org/hg/release/icedtea-web-1.0/rev/b29fdd0f4d04; http://icedtea.classpath.org/hg/release/icedtea-web-1.1/rev/c7ce6c0e6227; http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2011-July/015170.html
CVE: CVE-2011-2514
Published: 2014-05-14
Description: The Java Network Launching Protocol (JNLP) implementation in IcedTea6 1.9.x before 1.9.9 and before 1.8.9, and IcedTea-Web 1.1.x before 1.1.1 and before 1.0.4, allows remote attackers to trick victims into granting access to local files by modifying the content of the Java Web Start Security Warning dialog box to represent a different filename than the file for which access will be granted.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://icedtea.classpath.org/hg/release/icedtea-web-1.0/rev/b99f9a9769e0; http://icedtea.classpath.org/hg/release/icedtea-web-1.1/rev/512de5d90388; http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2011-July/015170.html
CVE: CVE-2011-4407
Published: 2014-05-14
Description: ppa.py in Software Properties before 0.81.13.3 does not validate the server certificate when downloading PPA GPG key fingerprints, which allows man-in-the-middle (MITM) attackers to spoof GPG keys for a package repository.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://www.ubuntu.com/usn/USN-1352-1; https://bugs.launchpad.net/ubuntu/%2Bsource/software-properties/%2Bbug/915210; http://www.ubuntu.com/usn/USN-1352-1
CVE: CVE-2012-1600
Published: 2014-05-14
Description: Multiple cross-site scripting (XSS) vulnerabilities in functions.php in phpPgAdmin before 5.0.4 allow remote attackers to inject arbitrary web script or HTML via the (1) name or (2) type of a function.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-updates/2012-04/msg00033.html; http://secunia.com/advisories/48574; http://sourceforge.net/p/phppgadmin/mailman/message/28783470/
CVE: CVE-2014-0462
Published: 2014-05-14
Description: Unspecified vulnerability in OpenJDK 6 before 6b31 on Debian GNU/Linux and Ubuntu 12.04 LTS and 10.04 LTS has unknown impact and attack vectors, a different vulnerability than CVE-2014-2405.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/58415; http://www.debian.org/security/2014/dsa-2912; http://www.ubuntu.com/usn/USN-2191-1
CVE: CVE-2014-1849
Published: 2014-05-14
Description: Foscam IP camera 11.37.2.49 and other versions, when using the Foscam DynDNS option, generates credentials based on predictable camera subdomain names, which allows remote attackers to spoof or hijack arbitrary cameras and conduct other attacks by modifying arbitrary camera records in the Foscam DNS server.
CVSS Score: 10.0 (HIGH)
CWE: CWE-255
References: http://blog.shekyan.com/2014/05/cve-2014-1849-foscam-dynamic-dns-predictable-credentials-vulnerability.html; http://seclists.org/fulldisclosure/2014/May/35; https://github.com/artemharutyunyan/getmecamtool/blob/master/src/dnsmod.c
CVE: CVE-2014-1909
Published: 2014-05-14
Description: Integer signedness error in system/core/adb/adb_client.c in Android Debug Bridge (ADB) for Android 4.4 in the Android SDK Platform Tools 18.0.1 allows ADB servers to execute arbitrary code via a negative length value, which bypasses a signed comparison and triggers a stack-based buffer overflow.
CVSS Score: 7.5 (HIGH)
CWE: CWE-189
References: http://lists.opensuse.org/opensuse-updates/2014-05/msg00038.html; http://lists.opensuse.org/opensuse-updates/2014-05/msg00039.html; http://seclists.org/oss-sec/2014/q1/291
CVE: CVE-2014-2046
Published: 2014-05-14
Description: cgi-bin/rpcBridge in the web interface 1.1 on Broadcom Ltd PIPA C211 rev2 does not properly restrict access, which allows remote attackers to (1) obtain credentials and other sensitive information via a certain request to the config.getValuesHashExcludePaths method or (2) modify the firmware via unspecified vectors.
CVSS Score: 9.7 (HIGH)
CWE: CWE-310
References: http://seclists.org/fulldisclosure/2014/May/58; https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-2046/; http://seclists.org/fulldisclosure/2014/May/58
CVE: CVE-2014-2405
Published: 2014-05-14
Description: Unspecified vulnerability in OpenJDK 6 before 6b31 on Debian GNU/Linux and Ubuntu 12.04 LTS and 10.04 LTS has unknown impact and attack vectors, a different vulnerability than CVE-2014-0462.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/58415; http://www.debian.org/security/2014/dsa-2912; http://www.ubuntu.com/usn/USN-2191-1
CVE: CVE-2014-2591
Published: 2014-05-14
Description: Untrusted search path vulnerability in BMC Patrol for AIX 3.9.00 allows local users to gain privileges via a crafted library, related to an incorrect RPATH setting.
CVSS Score: 6.9 (MEDIUM)
References: http://seclists.org/fulldisclosure/2014/Apr/199; https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-2591/; http://seclists.org/fulldisclosure/2014/Apr/199
CVE: CVE-2014-3121
Published: 2014-05-14
Description: rxvt-unicode before 9.20 does not properly handle OSC escape sequences, which allows user-assisted remote attackers to manipulate arbitrary X window properties and execute arbitrary commands.
CVSS Score: 7.6 (HIGH)
CWE: CWE-78
References: http://dist.schmorp.de/rxvt-unicode/Changes; http://lists.opensuse.org/opensuse-security-announce/2014-06/msg00026.html; http://lists.opensuse.org/opensuse-updates/2014-06/msg00038.html