deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-5905
Published: 2014-09-15
Description: The Grocery List - Tomatoes (aka com.meucarrinho) application 5.1.4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/582497; http://www.kb.cert.org/vuls/id/924905; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-6392
Published: 2014-09-15
Description: Cross-site scripting (XSS) vulnerability in the Facebook app 14.0 and the Facebook Messenger app 10.0 for iOS allows remote attackers to inject arbitrary web script or HTML via a crafted filename extension that is improperly handled during MIME sniffing of chat traffic.  NOTE: the vendor disputes the significance of this report, because the user must accept an interstitial warning before the HTML file content is rendered, and because the HTML content's origin is a sandbox domain
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2014/Sep/13; http://seclists.org/fulldisclosure/2014/Sep/13
CVE: CVE-2014-0560
Published: 2014-09-17
Description: Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.12 and 11.x before 11.0.09 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-399
References: http://helpx.adobe.com/security/products/reader/apsb14-20.html; http://www.securityfocus.com/bid/69823; http://www.securitytracker.com/id/1030853
CVE: CVE-2014-0561
Published: 2014-09-17
Description: Heap-based buffer overflow in Adobe Reader and Acrobat 10.x before 10.1.12 and 11.x before 11.0.09 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2014-0567.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://helpx.adobe.com/security/products/reader/apsb14-20.html; http://www.securityfocus.com/bid/69821; http://www.securitytracker.com/id/1030853
CVE: CVE-2014-0562
Published: 2014-09-17
Description: Cross-site scripting (XSS) vulnerability in Adobe Reader and Acrobat 10.x before 10.1.12 and 11.x before 11.0.09 on OS X allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Universal XSS (UXSS)."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://helpx.adobe.com/security/products/reader/apsb14-20.html; http://www.securityfocus.com/bid/69822; http://www.securitytracker.com/id/1030853
CVE: CVE-2014-0563
Published: 2014-09-17
Description: Adobe Reader and Acrobat 10.x before 10.1.12 and 11.x before 11.0.09 on Windows and OS X allow attackers to cause a denial of service (memory corruption) via unspecified vectors.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://helpx.adobe.com/security/products/reader/apsb14-20.html; http://www.securityfocus.com/bid/69826; http://www.securitytracker.com/id/1030853
CVE: CVE-2014-0565
Published: 2014-09-17
Description: Adobe Reader and Acrobat 10.x before 10.1.12 and 11.x before 11.0.09 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0566.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://helpx.adobe.com/security/products/reader/apsb14-20.html; http://www.securityfocus.com/bid/69824; http://www.securitytracker.com/id/1030853
CVE: CVE-2014-0566
Published: 2014-09-17
Description: Adobe Reader and Acrobat 10.x before 10.1.12 and 11.x before 11.0.09 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0565.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://helpx.adobe.com/security/products/reader/apsb14-20.html; http://www.securityfocus.com/bid/69825; http://www.securitytracker.com/id/1030853
CVE: CVE-2014-0567
Published: 2014-09-17
Description: Heap-based buffer overflow in Adobe Reader and Acrobat 10.x before 10.1.12 and 11.x before 11.0.09 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2014-0561.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://helpx.adobe.com/security/products/reader/apsb14-20.html; http://www.securityfocus.com/bid/69827; http://www.securitytracker.com/id/1030853
CVE: CVE-2014-0568
Published: 2014-09-17
Description: The NtSetInformationFile system call hook feature in Adobe Reader and Acrobat 10.x before 10.1.12 and 11.x before 11.0.09 on Windows allows attackers to bypass a sandbox protection mechanism, and consequently execute native code in a privileged context, via an NTFS junction attack.
CVSS Score: 10.0 (HIGH)
References: http://helpx.adobe.com/security/products/reader/apsb14-20.html; http://www.securityfocus.com/bid/69828; http://www.securitytracker.com/id/1030853
CVE: CVE-2014-4621
Published: 2014-09-17
Description: EMC Documentum Content Server before 6.7 SP2 P17, 7.0 through P15, and 7.1 before P08 does not properly check authorization for subtypes of protected system types, which allows remote authenticated users to obtain super-user privileges for system-object creation, and bypass intended restrictions on data access and server actions, via unspecified vectors.
CVSS Score: 8.5 (HIGH)
CWE: CWE-264
References: http://archives.neohapsis.com/archives/bugtraq/2014-09/0093.html; http://secunia.com/advisories/61251; http://www.securityfocus.com/bid/69817
CVE: CVE-2014-4622
Published: 2014-09-17
Description: EMC Documentum Content Server before 6.7 SP2 P17, 7.0 through P15, and 7.1 before P08 does not properly check authorization for subgroups of privileged groups, which allows remote authenticated sysadmins to gain super-user privileges, and bypass intended restrictions on data access and server actions, via unspecified vectors.
CVSS Score: 7.1 (HIGH)
CWE: CWE-264
References: http://archives.neohapsis.com/archives/bugtraq/2014-09/0093.html; http://secunia.com/advisories/61251; http://www.securityfocus.com/bid/69819
CVE: CVE-2014-5906
Published: 2014-09-17
Description: The Lil Wayne Slots: FREE SLOTS (aka com.lilwayneslots.slots.android) application 1.138 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/582497; http://www.kb.cert.org/vuls/id/779969; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-5907
Published: 2014-09-17
Description: The Pet Salon (aka com.libiitech.petsalon) application 1.0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/549057; http://www.kb.cert.org/vuls/id/582497; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-5908
Published: 2014-09-17
Description: The Kmart (aka com.kmart.android) application @7F0C00EF for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/582497; http://www.kb.cert.org/vuls/id/871489; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-5909
Published: 2014-09-17
Description: The watcha (aka com.frograms.watcha) application 2.0.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/582497; http://www.kb.cert.org/vuls/id/894985; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-5910
Published: 2014-09-17
Description: The Dog Whistle (aka com.dogwhistle.dogtrainingandroidapp) application 1.9 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/532865; http://www.kb.cert.org/vuls/id/582497; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-5911
Published: 2014-09-17
Description: The Free App Icons & Icon Packs (aka com.jellytap.cooliconfinder) application 1.4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/582497; http://www.kb.cert.org/vuls/id/809889; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-5912
Published: 2014-09-17
Description: The InNote (aka com.intsig.notes) application 1.0.3.20131119 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/582497; http://www.kb.cert.org/vuls/id/744505; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-5913
Published: 2014-09-17
Description: The Allies in War (aka com.gamelion.aiw) application 1.3.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/582497; http://www.kb.cert.org/vuls/id/972337; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-5914
Published: 2014-09-17
Description: The Finansbank Cep Subesi (aka com.finansbank.mobile.cepsube) application 1.1.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/201633; http://www.kb.cert.org/vuls/id/582497; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-5915
Published: 2014-09-17
Description: The Tigo Copa Mundial FIFA 2014 (aka com.fwc2014.millicom.and) application 3.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/179897; http://www.kb.cert.org/vuls/id/582497; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-5916
Published: 2014-09-17
Description: The Minha Oi (aka br.com.mobicare.minhaoi) application 1.15.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/485081; http://www.kb.cert.org/vuls/id/582497; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-5917
Published: 2014-09-17
Description: The Slideshow 365 (aka com.Slideshow) application 3.6 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/133081; http://www.kb.cert.org/vuls/id/582497; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-5918
Published: 2014-09-17
Description: The Secret Circle - talk freely (aka com.easyxapp.secret) application 2.2.00.26 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/582497; http://www.kb.cert.org/vuls/id/673841; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2012-1032
Published: 2014-09-17
Description: Cross-site scripting (XSS) vulnerability in the Euroling SiteSeeker module 3.x before 3.4.5 for EPiServer allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/show/osvdb/81013; http://secunia.com/advisories/48696; http://www.securityfocus.com/bid/52874
CVE: CVE-2012-1417
Published: 2014-09-17
Description: Multiple cross-site scripting (XSS) vulnerabilities in Local Phone book and Blacklist form in Yealink VOIP Phones allow remote authenticated users to inject arbitrary web script or HTML via the user field to cgi-bin/ConfigManApp.com.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2012-03/0056.html; http://packetstormsecurity.org/files/110320/yealink-xss.txt; http://secunia.com/advisories/48194
CVE: CVE-2012-1506
Published: 2014-09-17
Description: SQL injection vulnerability in the updateStatus function in lib/models/benefits/Hsp.php in OrangeHRM before 2.7 allows remote authenticated users to execute arbitrary SQL commands via the hspSummaryId parameter to plugins/ajaxCalls/haltResumeHsp.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://blog.orangehrm.com/2012/04/24/orangehrm-27-stable-release-with-complete-localization/; http://osvdb.org/81743; http://secunia.com/advisories/49072
CVE: CVE-2012-1507
Published: 2014-09-17
Description: Multiple cross-site scripting (XSS) vulnerabilities in OrangeHRM before 2.7 allow remote attackers to inject arbitrary web script or HTML via the (1) newHspStatus parameter to plugins/ajaxCalls/haltResumeHsp.php, (2) sortOrder1 parameter to templates/hrfunct/emppop.php, or (3) uri parameter to index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://blog.orangehrm.com/2012/04/24/orangehrm-27-stable-release-with-complete-localization/; http://osvdb.org/81744; http://osvdb.org/81745
CVE: CVE-2012-2583
Published: 2014-09-17
Description: Cross-site scripting (XSS) vulnerability in Mini Mail Dashboard Widget plugin 1.42 for WordPress allows remote attackers to inject arbitrary web script or HTML via the body of an email.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/show/osvdb/85135; http://www.exploit-db.com/exploits/20358; http://www.securityfocus.com/bid/54888
CVE: CVE-2014-5234
Published: 2014-09-17
Description: Cross-site scripting (XSS) vulnerability in the backend in Open-Xchange (OX) AppSuite before 7.4.2-rev33 and 7.6.x before 7.6.0-rev16 allows remote attackers to inject arbitrary web script or HTML via a folder publication name.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/128257/Open-Xchange-7.6.0-XSS-SSRF-Traversal.html; http://secunia.com/advisories/61080; http://software.open-xchange.com/OX6/doc/Release_Notes_for_Patch_Release_2112_7.6.0_2014-08-25.pdf
CVE: CVE-2014-5235
Published: 2014-09-17
Description: Cross-site scripting (XSS) vulnerability in the frontend in Open-Xchange (OX) AppSuite before 7.4.2-rev33 and 7.6.x before 7.6.0-rev16 allows remote attackers to inject arbitrary web script or HTML via vectors related to unspecified fields in RSS feeds.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/128257/Open-Xchange-7.6.0-XSS-SSRF-Traversal.html; http://secunia.com/advisories/61080; http://software.open-xchange.com/OX6/doc/Release_Notes_for_Patch_Release_2112_7.6.0_2014-08-25.pdf
CVE: CVE-2012-2956
Published: 2014-09-17
Description: SQL injection vulnerability in SpiceWorks 5.3.75941 allows remote authenticated users to execute arbitrary SQL commands via the id parameter to api_v2.json.  NOTE: this entry was SPLIT per ADT2 due to different vulnerability types. CVE-2012-6658 is for the XSS.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://osvdb.org/84113; http://www.exploit-db.com/exploits/20063; http://www.securityfocus.com/bid/54647
CVE: CVE-2012-6658
Published: 2014-09-17
Description: Multiple cross-site scripting (XSS) vulnerabilities in SpiceWorks 5.3.75941 allow remote attackers to inject arbitrary web script or HTML via the (1) syslocation, (2) syscontact, or (3) sysName configuration in snmpd.conf.  NOTE: this entry was SPLIT from CVE-2012-2956 per ADT2 due to different vulnerability types.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/84112; http://secunia.com/advisories/49978/; http://www.exploit-db.com/exploits/20063
CVE: CVE-2014-2886
Published: 2014-09-18
Description: GKSu 2.0.2, when sudo-mode is not enabled, uses " (double quote) characters in a gksu-run-helper argument, which allows attackers to execute arbitrary commands in certain situations involving an untrusted substring within this argument, as demonstrated by an untrusted filename encountered during installation of a VirtualBox extension pack.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://savannah.nongnu.org/bugs/?40023; https://community.rapid7.com/community/metasploit/blog/2014/07/07/virtualbox-filename-command-execution-via-gksu; https://launchpad.net/bugs/1186676
CVE: CVE-2014-4352
Published: 2014-09-18
Description: Address Book in Apple iOS before 8 relies on the hardware UID for its encryption key, which makes it easier for physically proximate attackers to obtain sensitive information by obtaining this UID.
CVSS Score: 2.1 (LOW)
CWE: CWE-310
References: http://archives.neohapsis.com/archives/bugtraq/2014-09/0106.html; http://support.apple.com/kb/HT6441; http://www.securityfocus.com/bid/69882
CVE: CVE-2014-4353
Published: 2014-09-18
Description: Race condition in iMessage in Apple iOS before 8 allows attackers to obtain sensitive information by leveraging the presence of an attachment after the deletion of its parent (1) iMessage or (2) MMS.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-362
References: http://archives.neohapsis.com/archives/bugtraq/2014-09/0106.html; http://support.apple.com/kb/HT6441; http://www.securityfocus.com/bid/69882
CVE: CVE-2014-4354
Published: 2014-09-18
Description: Apple iOS before 8 enables Bluetooth during all upgrade actions, which makes it easier for remote attackers to bypass intended access restrictions via a Bluetooth session.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-264
References: http://archives.neohapsis.com/archives/bugtraq/2014-09/0106.html; http://support.apple.com/kb/HT6441; http://www.securityfocus.com/bid/69882
CVE: CVE-2014-4356
Published: 2014-09-18
Description: Apple iOS before 8 does not follow the intended configuration setting for text-message preview on the lock screen, which allows physically proximate attackers to obtain sensitive information by reading this screen.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://archives.neohapsis.com/archives/bugtraq/2014-09/0106.html; http://support.apple.com/kb/HT6441; http://www.securityfocus.com/bid/69882
CVE: CVE-2014-4357
Published: 2014-09-18
Description: Accounts Framework in Apple iOS before 8 and Apple TV before 7 allows attackers to obtain sensitive information by reading log data that was not intended to be present in a log.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://archives.neohapsis.com/archives/bugtraq/2014-09/0106.html; http://archives.neohapsis.com/archives/bugtraq/2014-09/0107.html; http://support.apple.com/kb/HT6441
CVE: CVE-2014-4361
Published: 2014-09-18
Description: The Home & Lock Screen subsystem in Apple iOS before 8 does not properly restrict the private API for app prominence, which allows attackers to determine the frontmost app by leveraging access to a crafted background app.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://archives.neohapsis.com/archives/bugtraq/2014-09/0106.html; http://support.apple.com/kb/HT6441; http://www.securityfocus.com/bid/69882
CVE: CVE-2014-4362
Published: 2014-09-18
Description: The Sandbox Profiles implementation in Apple iOS before 8 does not properly restrict the third-party app sandbox profile, which allows attackers to obtain sensitive Apple ID information via a crafted app.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://archives.neohapsis.com/archives/bugtraq/2014-09/0106.html; http://support.apple.com/kb/HT6441; http://www.securityfocus.com/bid/69882
CVE: CVE-2014-4363
Published: 2014-09-18
Description: Safari in Apple iOS before 8 does not properly restrict the autofilling of passwords in forms, which allows remote attackers to obtain sensitive information via (1) an http web site, (2) an https web site with an unacceptable X.509 certificate, or (3) an IFRAME element.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-255
References: http://archives.neohapsis.com/archives/bugtraq/2014-09/0106.html; http://secunia.com/advisories/61306; http://support.apple.com/kb/HT6440
CVE: CVE-2014-4364
Published: 2014-09-18
Description: The 802.1X subsystem in Apple iOS before 8 and Apple TV before 7 does not require strong authentication methods, which allows remote attackers to calculate credentials by offering LEAP authentication from a crafted Wi-Fi AP and then performing a cryptographic attack against the MS-CHAPv1 hash.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-310
References: http://archives.neohapsis.com/archives/bugtraq/2014-09/0106.html; http://archives.neohapsis.com/archives/bugtraq/2014-09/0107.html; http://archives.neohapsis.com/archives/bugtraq/2014-10/0101.html
CVE: CVE-2014-4366
Published: 2014-09-18
Description: Mail in Apple iOS before 8 does not prevent sending a LOGIN command to a LOGINDISABLED IMAP server, which allows remote attackers to obtain sensitive cleartext information by sniffing the network.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-255
References: http://archives.neohapsis.com/archives/bugtraq/2014-09/0106.html; http://support.apple.com/kb/HT6441; http://www.securityfocus.com/bid/69882
CVE: CVE-2014-4367
Published: 2014-09-18
Description: Apple iOS before 8 enables Voice Dial during all upgrade actions, which makes it easier for physically proximate attackers to launch unintended calls by speaking a telephone number.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://archives.neohapsis.com/archives/bugtraq/2014-09/0106.html; http://support.apple.com/kb/HT6441; http://www.securityfocus.com/bid/69882
CVE: CVE-2014-4368
Published: 2014-09-18
Description: The Accessibility subsystem in Apple iOS before 8 allows attackers to interfere with screen locking via vectors related to AssistiveTouch events.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-264
References: http://archives.neohapsis.com/archives/bugtraq/2014-09/0106.html; http://support.apple.com/kb/HT6441; http://www.securityfocus.com/bid/69882
CVE: CVE-2014-4369
Published: 2014-09-18
Description: The IOAcceleratorFamily API implementation in Apple iOS before 8 and Apple TV before 7 allows attackers to cause a denial of service (NULL pointer dereference and device crash) via an application that uses crafted arguments.
CVSS Score: 7.8 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2014-09/0106.html; http://archives.neohapsis.com/archives/bugtraq/2014-09/0107.html; http://support.apple.com/kb/HT6441