deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-4574
Published: 2014-07-02
Description: Cross-site scripting (XSS) vulnerability in resize.php in the WebEngage plugin before 2.0.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the height parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://codevigilant.com/disclosure/wp-plugin-webengage-a3-cross-site-scripting-xss; http://wordpress.org/plugins/webengage/changelog; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=844373%40webengage&old=788585%40webengage&sfp_email=&sfph_mail=
CVE: CVE-2014-4576
Published: 2014-07-02
Description: Cross-site scripting (XSS) vulnerability in services/diagnostics.php in the WordPress Social Login plugin 2.0.3 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the xhrurl parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://codevigilant.com/disclosure/wp-plugin-wordpress-social-login-a3-cross-site-scripting-xss; http://codevigilant.com/disclosure/wp-plugin-wordpress-social-login-a3-cross-site-scripting-xss
CVE: CVE-2014-4578
Published: 2014-07-02
Description: Cross-site scripting (XSS) vulnerability in asset-studio/icons-launcher.php in the WP App Maker plugin 1.0.16.4 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the uid parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://codevigilant.com/disclosure/wp-plugin-wp-app-maker-a3-cross-site-scripting-xss; http://codevigilant.com/disclosure/wp-plugin-wp-app-maker-a3-cross-site-scripting-xss
CVE: CVE-2014-4579
Published: 2014-07-02
Description: Cross-site scripting (XSS) vulnerability in js/test.php in the Appointments Scheduler plugin 1.5 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the lang parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://codevigilant.com/disclosure/wp-plugin-wp-appointments-schedules-a3-cross-site-scripting-xss; http://codevigilant.com/disclosure/wp-plugin-wp-appointments-schedules-a3-cross-site-scripting-xss
CVE: CVE-2014-4580
Published: 2014-07-02
Description: Cross-site scripting (XSS) vulnerability in blipbot.ajax.php in the WP BlipBot plugin 3.0.9 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the BlipBotID parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://codevigilant.com/disclosure/wp-plugin-wp-blipbot-a3-cross-site-scripting-xss; http://codevigilant.com/disclosure/wp-plugin-wp-blipbot-a3-cross-site-scripting-xss
CVE: CVE-2014-4582
Published: 2014-07-02
Description: Cross-site scripting (XSS) vulnerability in admin/admin_show_dialogs.php in the WP Consultant plugin 1.0 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the dialog_id parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://codevigilant.com/disclosure/wp-plugin-wp-consultant-a3-cross-site-scripting-xss; http://codevigilant.com/disclosure/wp-plugin-wp-consultant-a3-cross-site-scripting-xss
CVE: CVE-2014-4587
Published: 2014-07-02
Description: Multiple cross-site scripting (XSS) vulnerabilities in the WP GuestMap plugin 1.8 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) zl, (2) mt, or (3) dc parameter to guest-locator.php; the (4) zl, (5) mt, (6) activate, or (7) dc parameter to online-tracker.php; the (8) zl, (9) mt, or (10) dc parameter to stats-map.php; or the (11) zl, (12) mt, (13) activate, or (14) dc parameter to weather-map.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://codevigilant.com/disclosure/wp-plugin-wp-guestmap-a3-cross-site-scripting-xss; http://www.securityfocus.com/bid/68403; http://codevigilant.com/disclosure/wp-plugin-wp-guestmap-a3-cross-site-scripting-xss
CVE: CVE-2014-4588
Published: 2014-07-02
Description: Cross-site scripting (XSS) vulnerability in tpls/editmedia.php in the Hot Files: File Sharing and Download Manager (wphotfiles) plugin 1.0.0 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the mediaid parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://codevigilant.com/disclosure/wp-plugin-wphotfiles-a3-cross-site-scripting-xss; http://codevigilant.com/disclosure/wp-plugin-wphotfiles-a3-cross-site-scripting-xss
CVE: CVE-2014-4589
Published: 2014-07-02
Description: Cross-site scripting (XSS) vulnerability in uploader.php in the WP Silverlight Media Player (wp-media-player) plugin 0.8 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the post_id parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://codevigilant.com/disclosure/wp-plugin-wp-media-player-a3-cross-site-scripting-xss; https://exchange.xforce.ibmcloud.com/vulnerabilities/94398; http://codevigilant.com/disclosure/wp-plugin-wp-media-player-a3-cross-site-scripting-xss
CVE: CVE-2014-4590
Published: 2014-07-02
Description: Cross-site scripting (XSS) vulnerability in get.php in the WP Microblogs plugin 0.4.0 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the oauth_verifier parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://codevigilant.com/disclosure/wp-plugin-wp-microblogs-a3-cross-site-scripting-xss; http://codevigilant.com/disclosure/wp-plugin-wp-microblogs-a3-cross-site-scripting-xss
CVE: CVE-2014-4593
Published: 2014-07-02
Description: Cross-site scripting (XSS) vulnerability in wp-plugins-net/index.php in the WP Plugin Manager (wppm) plugin 1.6.4.b and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the filter parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://codevigilant.com/disclosure/wp-plugin-wppm-a3-cross-site-scripting-xss; http://codevigilant.com/disclosure/wp-plugin-wppm-a3-cross-site-scripting-xss
CVE: CVE-2014-4594
Published: 2014-07-02
Description: Cross-site scripting (XSS) vulnerability in index.php in the WordPress Responsive Preview plugin before 1.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the url parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://codevigilant.com/disclosure/wp-plugin-wp-responsive-preview-a3-cross-site-scripting-xss; http://wordpress.org/plugins/wp-responsive-preview/changelog; http://www.securityfocus.com/bid/68408
CVE: CVE-2014-4595
Published: 2014-07-02
Description: Multiple cross-site scripting (XSS) vulnerabilities in the WP RESTful plugin 0.1 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) oauth_callback parameter to html_api_authorize.php or the (2) oauth_token_temp or (3) oauth_callback_temp parameter to html_api_login.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://codevigilant.com/disclosure/wp-plugin-wp-restful-a3-cross-site-scripting-xss; http://codevigilant.com/disclosure/wp-plugin-wp-restful-a3-cross-site-scripting-xss
CVE: CVE-2014-4596
Published: 2014-07-02
Description: Multiple cross-site scripting (XSS) vulnerabilities in js/button-snapapp.php in the SnapApp plugin 1.5 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) msg or (2) act parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://codevigilant.com/disclosure/wp-plugin-wpsnapapp-a3-cross-site-scripting-xss; http://www.securityfocus.com/bid/68433; http://codevigilant.com/disclosure/wp-plugin-wpsnapapp-a3-cross-site-scripting-xss
CVE: CVE-2014-4598
Published: 2014-07-02
Description: Cross-site scripting (XSS) vulnerability in wp-tmkm-amazon-search.php in the wp-tmkm-amazon plugin 1.5b and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the AID parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://codevigilant.com/disclosure/wp-plugin-wp-tmkm-amazon-a3-cross-site-scripting-xss; http://www.securityfocus.com/bid/68448; https://plugins.trac.wordpress.org/changeset/846043
CVE: CVE-2014-4599
Published: 2014-07-02
Description: Multiple cross-site scripting (XSS) vulnerabilities in forms/search.php in the WP-Business Directory (wp-ttisbdir) plugin 1.0.2 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) edit, (2) search_term, (3) page_id, (4) page, or (5) page_links parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://codevigilant.com/disclosure/wp-plugin-wp-ttisbdir-a3-cross-site-scripting-xss; http://codevigilant.com/disclosure/wp-plugin-wp-ttisbdir-a3-cross-site-scripting-xss
CVE: CVE-2014-4600
Published: 2014-07-02
Description: Multiple cross-site scripting (XSS) vulnerabilities in contact/edit.php in the WP Ultimate Email Marketer plugin 1.1.0 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) listname or (2) contact parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://codevigilant.com/disclosure/wp-plugin-wp-ultimate-email-marketer-a3-cross-site-scripting-xss; http://plugins.svn.wordpress.org/wp-ultimate-email-marketer/trunk/Readme.txt; http://codevigilant.com/disclosure/wp-plugin-wp-ultimate-email-marketer-a3-cross-site-scripting-xss
CVE: CVE-2014-4601
Published: 2014-07-02
Description: Cross-site scripting (XSS) vulnerability in wu-ratepost.php in the Wu-Rating plugin 1.0 12319 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the v parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://codevigilant.com/disclosure/wp-plugin-wu-rating-a3-cross-site-scripting-xss; http://codevigilant.com/disclosure/wp-plugin-wu-rating-a3-cross-site-scripting-xss
CVE: CVE-2014-4603
Published: 2014-07-02
Description: Multiple cross-site scripting (XSS) vulnerabilities in yupdates_application.php in the Yahoo! Updates for WordPress plugin 1.0 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) secret, (2) key, or (3) appid parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://codevigilant.com/disclosure/wp-plugin-yahoo-updates-for-wordpress-a3-cross-site-scripting-xss; http://www.securityfocus.com/bid/68401; http://codevigilant.com/disclosure/wp-plugin-yahoo-updates-for-wordpress-a3-cross-site-scripting-xss
CVE: CVE-2014-4604
Published: 2014-07-02
Description: Cross-site scripting (XSS) vulnerability in settings/pwsettings.php in the Your Text Manager plugin 0.3.0 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the ytmpw parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://codevigilant.com/disclosure/wp-plugin-your-text-manager-a3-cross-site-scripting-xss; http://codevigilant.com/disclosure/wp-plugin-your-text-manager-a3-cross-site-scripting-xss
CVE: CVE-2014-4605
Published: 2014-07-02
Description: Cross-site scripting (XSS) vulnerability in cal/test.php in the ZdStatistics (zdstats) plugin 2.0.1 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the lang parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://codevigilant.com/disclosure/wp-plugin-zdstats-a3-cross-site-scripting-xss; http://codevigilant.com/disclosure/wp-plugin-zdstats-a3-cross-site-scripting-xss
CVE: CVE-2014-3737
Published: 2014-07-02
Description: Cross-site scripting (XSS) vulnerability in templates/defaultheader.php in Lamp Design Storesprite before 7 - 19-06-14, when using the currency selection dropdown, allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to brand.php, related to the currencyUrl function.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://packetstormsecurity.com/files/127221/Storesprite-7-Cross-Site-Scripting.html; http://secunia.com/advisories/59524; http://www.securityfocus.com/archive/1/532552/100/0/threaded
CVE: CVE-2014-4534
Published: 2014-07-02
Description: Multiple cross-site scripting (XSS) vulnerabilities in videoplayer/autoplay.php in the HTML5 Video Player with Playlist plugin 2.4.0 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) theme or (2) playlistmod parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://codevigilant.com/disclosure/wp-plugin-html5-video-player-with-playlist-a3-cross-site-scripting-xss; http://codevigilant.com/disclosure/wp-plugin-html5-video-player-with-playlist-a3-cross-site-scripting-xss
CVE: CVE-2014-4546
Published: 2014-07-02
Description: Cross-site scripting (XSS) vulnerability in book_ajax.php in the Rezgo plugin 1.4.2 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the response parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://codevigilant.com/disclosure/wp-plugin-rezgo-a3-cross-site-scripting-xss; http://codevigilant.com/disclosure/wp-plugin-rezgo-a3-cross-site-scripting-xss
CVE: CVE-2014-4549
Published: 2014-07-02
Description: Multiple cross-site scripting (XSS) vulnerabilities in pages/3DComplete.php in the WooCommerce SagePay Direct Payment Gateway plugin before 0.1.6.7 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) MD or (2) PARes parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://codevigilant.com/disclosure/wp-plugin-sagepay-direct-for-woocommerce-payment-gateway-a3-cross-site-scripting-xss; http://wordpress.org/plugins/sagepay-direct-for-woocommerce-payment-gateway/changelog; http://www.securityfocus.com/bid/65355
CVE: CVE-2014-4554
Published: 2014-07-02
Description: Cross-site scripting (XSS) vulnerability in templates/download.php in the SS Downloads plugin before 1.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the title parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://codevigilant.com/disclosure/wp-plugin-ss-downloads-a3-cross-site-scripting-xss; http://wordpress.org/plugins/ss-downloads/changelog; http://www.securityfocus.com/bid/65141
CVE: CVE-2014-4555
Published: 2014-07-02
Description: Cross-site scripting (XSS) vulnerability in fonts/font-form.php in the Style It plugin 1.0 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the mode parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://codevigilant.com/disclosure/wp-plugin-style-it-a3-cross-site-scripting-xss; http://codevigilant.com/disclosure/wp-plugin-style-it-a3-cross-site-scripting-xss
CVE: CVE-2014-4563
Published: 2014-07-02
Description: Cross-site scripting (XSS) vulnerability in go.php in the URL Cloak & Encrypt (url-cloak-encrypt) plugin 2.0 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the url parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://codevigilant.com/disclosure/wp-plugin-url-cloak-encrypt-a3-cross-site-scripting-xss; http://codevigilant.com/disclosure/wp-plugin-url-cloak-encrypt-a3-cross-site-scripting-xss
CVE: CVE-2014-4565
Published: 2014-07-02
Description: Multiple cross-site scripting (XSS) vulnerabilities in vcc.js.php in the Verification Code for Comments plugin 2.1.0 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) vp, (2) vs, (3) l, (4) vu, or (5) vm parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://codevigilant.com/disclosure/wp-plugin-verification-code-for-comments-a3-cross-site-scripting-xss; http://codevigilant.com/disclosure/wp-plugin-verification-code-for-comments-a3-cross-site-scripting-xss
CVE: CVE-2014-4571
Published: 2014-07-02
Description: Multiple cross-site scripting (XSS) vulnerabilities in vncal.js.php in the VN-Calendar plugin 1.0 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) fs or (2) w parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://codevigilant.com/disclosure/wp-plugin-vn-calendar-a3-cross-site-scripting-xss; http://www.securityfocus.com/bid/68359; http://codevigilant.com/disclosure/wp-plugin-vn-calendar-a3-cross-site-scripting-xss
CVE: CVE-2014-4581
Published: 2014-07-02
Description: Cross-site scripting (XSS) vulnerability in facture.php in the WPCB plugin 2.4.8 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the id parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://codevigilant.com/disclosure/wp-plugin-wpcb-a3-cross-site-scripting-xss; http://codevigilant.com/disclosure/wp-plugin-wpcb-a3-cross-site-scripting-xss
CVE: CVE-2014-4591
Published: 2014-07-02
Description: Cross-site scripting (XSS) vulnerability in picasa_upload.php in the WP-Picasa-Image plugin 1.0 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the post_id parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://codevigilant.com/disclosure/wp-plugin-wp-picasa-image-a3-cross-site-scripting-xss; http://codevigilant.com/disclosure/wp-plugin-wp-picasa-image-a3-cross-site-scripting-xss
CVE: CVE-2014-4597
Published: 2014-07-02
Description: Cross-site scripting (XSS) vulnerability in test.php in the WP Social Invitations plugin before 1.4.4.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the xhrurl parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://codevigilant.com/disclosure/wp-plugin-wp-social-invitations-a3-cross-site-scripting-xss; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=848497%40wp-social-invitations&old=829444%40wp-social-invitations&sfp_email=&sfph_mail=#file239; http://codevigilant.com/disclosure/wp-plugin-wp-social-invitations-a3-cross-site-scripting-xss
CVE: CVE-2014-4606
Published: 2014-07-02
Description: Cross-site scripting (XSS) vulnerability in redirect_to_zeenshare.php in the ZeenShare plugin 1.0.1 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the zs_sid parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://codevigilant.com/disclosure/wp-plugin-zeenshare-a3-cross-site-scripting-xss; http://codevigilant.com/disclosure/wp-plugin-zeenshare-a3-cross-site-scripting-xss
CVE: CVE-2014-4614
Published: 2014-07-02
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in Piwigo before 2.6.2 allow remote attackers to hijack the authentication of administrators for requests that use the (1) pwg.groups.addUser, (2) pwg.groups.deleteUser, (3) pwg.groups.setInfo, (4) pwg.users.setInfo, (5) pwg.permissions.add, or (6) pwg.permissions.remove method.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://piwigo.org/bugs/view.php?id=0003055; http://piwigo.org/releases/2.6.2; http://seclists.org/oss-sec/2014/q2/623
CVE: CVE-2014-4608
Published: 2014-07-03
Description: Multiple integer overflows in the lzo1x_decompress_safe function in lib/lzo/lzo1x_decompress_safe.c in the LZO decompressor in the Linux kernel before 3.15.2 allow context-dependent attackers to cause a denial of service (memory corruption) via a crafted Literal Run.  NOTE: the author of the LZO algorithms says "the Linux kernel is *not* affected; media hype.
CVSS Score: 7.3 (HIGH)
CWE: CWE-190, CWE-190
References: http://blog.securitymouse.com/2014/06/raising-lazarus-20-year-old-bug-that.html; http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=206a81c18401c0cde6e579164f752c4b147324ce; http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00010.html
CVE: CVE-2014-4611
Published: 2014-07-03
Description: Integer overflow in the LZ4 algorithm implementation, as used in Yann Collet LZ4 before r118 and in the lz4_uncompress function in lib/lz4/lz4_decompress.c in the Linux kernel before 3.15.2, on 32-bit platforms might allow context-dependent attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted Literal Run that would be improperly handled by programs not complying with an API limitation, a different vulnerability than CVE-2014-4715.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://blog.securitymouse.com/2014/06/raising-lazarus-20-year-old-bug-that.html; http://fastcompression.blogspot.fr/2014/06/debunking-lz4-20-years-old-bug-myth.html; http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=206204a1162b995e[PII_REDACTED]b22468c00d6b36
CVE: CVE-2014-4652
Published: 2014-07-03
Description: Race condition in the tlv handler functionality in the snd_ctl_elem_user_tlv function in sound/core/control.c in the ALSA control implementation in the Linux kernel before 3.15.2 allows local users to obtain sensitive information from kernel memory by leveraging /dev/snd/controlCX access.
CVSS Score: 1.9 (LOW)
CWE: CWE-362
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=07f4d9d74a04aa7c72c5dae0ef97565f28f17b92; http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00020.html; http://rhn.redhat.com/errata/RHSA-2014-1083.html
CVE: CVE-2014-4653
Published: 2014-07-03
Description: sound/core/control.c in the ALSA control implementation in the Linux kernel before 3.15.2 does not ensure possession of a read/write lock, which allows local users to cause a denial of service (use-after-free) and obtain sensitive information from kernel memory by leveraging /dev/snd/controlCX access.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-416
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=fd9f26e4eca5d08a27d12c0933fceef76ed9663d; http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00020.html; http://rhn.redhat.com/errata/RHSA-2014-1083.html
CVE: CVE-2014-4654
Published: 2014-07-03
Description: The snd_ctl_elem_add function in sound/core/control.c in the ALSA control implementation in the Linux kernel before 3.15.2 does not check authorization for SNDRV_CTL_IOCTL_ELEM_REPLACE commands, which allows local users to remove kernel controls and cause a denial of service (use-after-free and system crash) by leveraging /dev/snd/controlCX access for an ioctl call.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-416
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=82262a46627bebb0febcc26664746c25cef08563; http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00020.html; http://rhn.redhat.com/errata/RHSA-2014-1083.html
CVE: CVE-2014-4655
Published: 2014-07-03
Description: The snd_ctl_elem_add function in sound/core/control.c in the ALSA control implementation in the Linux kernel before 3.15.2 does not properly maintain the user_ctl_count value, which allows local users to cause a denial of service (integer overflow and limit bypass) by leveraging /dev/snd/controlCX access for a large number of SNDRV_CTL_IOCTL_ELEM_REPLACE ioctl calls.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-190
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=82262a46627bebb0febcc26664746c25cef08563; http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00020.html; http://rhn.redhat.com/errata/RHSA-2014-1083.html
CVE: CVE-2014-4656
Published: 2014-07-03
Description: Multiple integer overflows in sound/core/control.c in the ALSA control implementation in the Linux kernel before 3.15.2 allow local users to cause a denial of service by leveraging /dev/snd/controlCX access, related to (1) index values in the snd_ctl_add function and (2) numid values in the snd_ctl_remove_numid_conflict function.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-190
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=883a1d49f0d77d30012f114b2e19fc141beb3e8e; http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=ac902c112d90a89e59916f751c2745f4dbdbb4bd; http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00020.html