deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-5081
Published: 2020-01-10
Description: sphider prior to 1.3.6, sphider-pro prior to 3.2, and sphider-plus prior to 3.2 allow authentication bypass
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: http://packetstormsecurity.com/files/127720/Sphider-Search-Engine-Command-Execution-SQL-Injection.html; https://www.exploit-db.com/exploits/34238; http://packetstormsecurity.com/files/127720/Sphider-Search-Engine-Command-Execution-SQL-Injection.html
CVE: CVE-2011-4595
Published: 2020-01-10
Description: Pretty-Link WordPress plugin 1.5.2 has XSS
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/support/topic/plugin-pretty-link-lite-152-xss-vulnerability/; https://www.openwall.com/lists/oss-security/2011/12/08/5; https://wordpress.org/support/topic/plugin-pretty-link-lite-152-xss-vulnerability/
CVE: CVE-2013-6231
Published: 2020-01-10
Description: SpagoBI before 4.1 has Privilege Escalation via an error in the AdapterHTTP script
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: http://www.exploit-db.com/exploits/31990; http://www.securityfocus.com/bid/65925; https://exchange.xforce.ibmcloud.com/vulnerabilities/91495
CVE: CVE-2013-6430
Published: 2020-01-10
Description: The JavaScriptUtils.javaScriptEscape method in web/util/JavaScriptUtils.java in Spring MVC in Spring Framework before 3.2.2 does not properly escape certain characters, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a (1) line separator or (2) paragraph separator Unicode character or (3) left or (4) right angle bracket.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.gopivotal.com/security/cve-2013-6430; https://github.com/spring-projects/spring-framework/commit/7a7df[PII_REDACTED]bef0277bf52a4e0a03e20a248; https://jira.springsource.org/browse/SPR-9983
CVE: CVE-2013-7380
Published: 2020-01-10
Description: The Etherpad Lite ep_imageconvert Plugin has a Remote Command Injection Vulnerability
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-74
References: http://www.openwall.com/lists/oss-security/2014/05/15/2; http://www.securityfocus.com/bid/67351; http://www.openwall.com/lists/oss-security/2014/05/15/2
CVE: CVE-2014-4561
Published: 2020-01-10
Description: The ultimate-weather plugin 1.0 for WordPress has XSS
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://codevigilant.com/disclosure/wp-plugin-ultimate-weather-plugin-a3-cross-site-scripting-xss/; http://codevigilant.com/disclosure/wp-plugin-ultimate-weather-plugin-a3-cross-site-scripting-xss/
CVE: CVE-2014-5092
Published: 2020-01-10
Description: Status2k allows Remote Command Execution in admin/options/editpl.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: http://packetstormsecurity.com/files/127719/Status2k-XSS-SQL-Injection-Command-Execution.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/95112; http://packetstormsecurity.com/files/127719/Status2k-XSS-SQL-Injection-Command-Execution.html
CVE: CVE-2014-5093
Published: 2020-01-10
Description: Status2k does not remove the install directory allowing credential reset.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-522
References: http://packetstormsecurity.com/files/127719/Status2k-XSS-SQL-Injection-Command-Execution.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/95113; http://packetstormsecurity.com/files/127719/Status2k-XSS-SQL-Injection-Command-Execution.html
CVE: CVE-2020-1765
Published: 2020-01-10
Description: An improper control of parameters allows the spoofing of the from fields of the following screens: AgentTicketCompose, AgentTicketForward, AgentTicketBounce and AgentTicketEmailOutbound. This issue affects: ((OTRS)) Community Edition 5.0.x version 5.0.39 and prior versions; 6.0.x version 6.0.24 and prior versions. OTRS 7.0.x version 7.0.13 and prior versions.
CVSS Score: 3.5 (LOW)
CWE: CWE-472
References: http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00038.html; http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00066.html; http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00077.html
CVE: CVE-2020-1766
Published: 2020-01-10
Description: Due to improper handling of uploaded images it is possible in very unlikely and rare conditions to force the agents browser to execute malicious javascript from a special crafted SVG file rendered as inline jpg file. This issue affects: ((OTRS)) Community Edition 5.0.x version 5.0.39 and prior versions; 6.0.x version 6.0.24 and prior versions. OTRS 7.0.x version 7.0.13 and prior versions.
CVSS Score: 2.0 (LOW)
CWE: CWE-79, CWE-79
References: http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00038.html; http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00066.html; http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00077.html
CVE: CVE-2020-1767
Published: 2020-01-10
Description: Agent A is able to save a draft (i.e. for customer reply). Then Agent B can open the draft, change the text completely and send it in the name of Agent A. For the customer it will not be visible that the message was sent by another agent. This issue affects: ((OTRS)) Community Edition 6.0.x version 6.0.24 and prior versions. OTRS 7.0.x version 7.0.13 and prior versions.
CVSS Score: 3.5 (LOW)
References: https://lists.debian.org/debian-lts-announce/2020/01/msg00027.html; https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html; https://otrs.com/release-notes/otrs-security-advisory-2020-03/
CVE: CVE-2019-4508
Published: 2020-01-10
Description: IBM QRadar SIEM 7.3.0 through 7.3.3 uses weak credential storage in some instances which could be decrypted by a local attacker. IBM X-Force ID: 164429.
CVSS Score: 7.8 (HIGH)
CWE: CWE-522
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/164429; https://www.ibm.com/support/pages/node/1170334; https://exchange.xforce.ibmcloud.com/vulnerabilities/164429
CVE: CVE-2019-4559
Published: 2020-01-10
Description: IBM QRadar SIEM 7.3.0 through 7.3.3 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force ID: 166355.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/166355; https://www.ibm.com/support/pages/node/1170346; https://exchange.xforce.ibmcloud.com/vulnerabilities/166355
CVE: CVE-2012-3822
Published: 2020-01-10
Description: Arial Campaign Enterprise before 11.0.551 has unauthorized access to the User-Edit.asp page, which allows remote attackers to enumerate users' credentials.
CVSS Score: 7.5 (HIGH)
CWE: CWE-863
References: http://sadgeeksinsnow.blogspot.dk/2012/10/my-first-experiences-bug-hunting-part-2.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/79509; http://sadgeeksinsnow.blogspot.dk/2012/10/my-first-experiences-bug-hunting-part-2.html
CVE: CVE-2012-3823
Published: 2020-01-10
Description: Arial Campaign Enterprise before 11.0.551 stores passwords in clear text and these may be retrieved.
CVSS Score: 7.5 (HIGH)
CWE: CWE-522
References: http://sadgeeksinsnow.blogspot.dk/2012/10/my-first-experiences-bug-hunting-part-2.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/79510; http://sadgeeksinsnow.blogspot.dk/2012/10/my-first-experiences-bug-hunting-part-2.html
CVE: CVE-2012-3824
Published: 2020-01-10
Description: In Arial Campaign Enterprise before 11.0.551, multiple pages are accessible without authentication or authorization.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://sadgeeksinsnow.blogspot.dk/2012/10/my-first-experiences-bug-hunting-part-2.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/79506; http://sadgeeksinsnow.blogspot.dk/2012/10/my-first-experiences-bug-hunting-part-2.html
CVE: CVE-2012-4030
Published: 2020-01-10
Description: Chamilo before 1.8.8.6 does not adequately handle user supplied input by the index.php script, which could allow remote attackers to delete arbitrary files.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/78054; https://exchange.xforce.ibmcloud.com/vulnerabilities/78054
CVE: CVE-2019-19820
Published: 2020-01-10
Description: An invalid pointer vulnerability in IOCTL Handling in the kyrld.sys driver in Kyrol Internet Security 9.0.6.9 allows an attacker to achieve privilege escalation, denial-of-service, and code execution via usermode because 0x9C402405 using METHOD_NEITHER results in a read primitive.
CVSS Score: 7.8 (HIGH)
CWE: CWE-763
References: https://github.com/nafiez/nafiez.github.io/blob/master/_posts/2019-12-04-kyrol-internet-security-invalid-pointer-vulnerability.md; https://nafiez.github.io/security/vulnerability/2019/12/04/kyrol-internet-security-invalid-pointer-vulnerability.html; https://github.com/nafiez/nafiez.github.io/blob/master/_posts/2019-12-04-kyrol-internet-security-invalid-pointer-vulnerability.md
CVE: CVE-2020-6162
Published: 2020-01-10
Description: An issue was discovered in Bftpd 5.3. Under certain circumstances, an out-of-bounds read is triggered due to an uninitialized value. The daemon crashes at startup in the hidegroups_init function in dirlist.c.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-125
References: http://bftpd.sourceforge.net/news.html; https://fossies.org/linux/bftpd/CHANGELOG; http://bftpd.sourceforge.net/news.html
CVE: CVE-2019-14301
Published: 2020-01-10
Description: Ricoh SP C250DN 1.06 devices have Incorrect Access Control (issue 1 of 2).
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://jvn.jp/en/jp/JVN52962201/index.html; https://www.ricoh.com/info/2019/0823_1/; http://jvn.jp/en/jp/JVN52962201/index.html
CVE: CVE-2019-14302
Published: 2020-01-10
Description: On Ricoh SP C250DN 1.06 devices, a debug port can be used.
CVSS Score: 6.8 (MEDIUM)
References: http://jvn.jp/en/jp/JVN52962201/index.html; https://www.ricoh.com/info/2019/0823_1/; http://jvn.jp/en/jp/JVN52962201/index.html
CVE: CVE-2019-14304
Published: 2020-01-10
Description: Ricoh SP C250DN 1.06 devices allow CSRF.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://jvn.jp/en/jp/JVN52962201/index.html; https://www.ricoh.com/info/2019/0823_1/; http://jvn.jp/en/jp/JVN52962201/index.html
CVE: CVE-2019-14306
Published: 2020-01-10
Description: Ricoh SP C250DN 1.06 devices have Incorrect Access Control (issue 2 of 2).
CVSS Score: 7.5 (HIGH)
References: http://jvn.jp/en/jp/JVN52962201/index.html; https://www.ricoh.com/info/2019/0823_1/; http://jvn.jp/en/jp/JVN52962201/index.html
CVE: CVE-2019-18194
Published: 2020-01-10
Description: TotalAV 2020 4.14.31 has a quarantine flaw that allows privilege escalation. Exploitation uses an NTFS directory junction to restore a malicious DLL from quarantine into the system32 folder.
CVSS Score: 7.8 (HIGH)
References: https://bogner.sh/2017/11/avgater-getting-local-admin-by-abusing-the-anti-virus-quarantine/; https://www.youtube.com/watch?v=88qeaLq98Gc; https://bogner.sh/2017/11/avgater-getting-local-admin-by-abusing-the-anti-virus-quarantine/
CVE: CVE-2019-19817
Published: 2020-01-10
Description: The JBIG2Decode library in npdf.dll in Nitro Free PDF Reader 12.0.0.112 has a CAPPDAnnotHandlerUtils::PDAnnotHandlerDestroyData2+0x2e8a Out-of-Bounds Read via crafted Unicode content.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://github.com/nafiez/nafiez.github.io/blob/master/_posts/2019-12-12-multiple-nitro-pdf-vulnerability.md; https://nafiez.github.io/security/vulnerability/remote/2019/12/12/multiple-nitro-pdf-vulnerability.html; https://github.com/nafiez/nafiez.github.io/blob/master/_posts/2019-12-12-multiple-nitro-pdf-vulnerability.md
CVE: CVE-2019-19819
Published: 2020-01-10
Description: The JBIG2Globals library in npdf.dll in Nitro Free PDF Reader 12.0.0.112 has a CAPPDAnnotHandlerUtils::PDAnnotHandlerDestroyData2+0x90ec NULL Pointer Dereference via crafted Unicode content.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/nafiez/nafiez.github.io/blob/master/_posts/2019-12-12-multiple-nitro-pdf-vulnerability.md; https://nafiez.github.io/security/vulnerability/remote/2019/12/12/multiple-nitro-pdf-vulnerability.html; https://github.com/nafiez/nafiez.github.io/blob/master/_posts/2019-12-12-multiple-nitro-pdf-vulnerability.md
CVE: CVE-2011-5020
Published: 2020-01-10
Description: An SQL Injection vulnerability exists in the ID parameter in Online TV Database 2011.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://www.cloudscan.me/2012/02/cve-2011-5020-online-tv-database-sql.html; http://www.cloudscan.me/2012/02/cve-2011-5020-online-tv-database-sql.html
CVE: CVE-2019-18588
Published: 2020-01-10
Description: Dell EMC Unisphere for PowerMax versions prior to 9.1.0.9, Dell EMC Unisphere for PowerMax versions prior to 9.0.2.16, and Dell EMC PowerMax OS 5978.221.221 and 5978.479.479 contain a Cross-Site Scripting (XSS) vulnerability. An authenticated malicious user may potentially exploit this vulnerability to inject javascript code and affect other authenticated users' sessions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.dell.com/support/security/en-us/details/539808/DSA-2019-193-Dell-EMC-Unisphere-for-PowerMax-and-Dell-EMC-PowerMax-Embedded-Management-Cross-Site; https://www.dell.com/support/security/en-us/details/539808/DSA-2019-193-Dell-EMC-Unisphere-for-PowerMax-and-Dell-EMC-PowerMax-Embedded-Management-Cross-Site
CVE: CVE-2012-3821
Published: 2020-01-10
Description: A Security Bypass vulnerability exists in the activate.asp page in Arial Software Campaign Enterprise 11.0.551, which could let a remote malicious user modify the SerialNumber field.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: http://archives.neohapsis.com/archives/bugtraq/2012-10/0103.html; http://sadgeeksinsnow.blogspot.dk/2012/10/my-first-experiences-bug-hunting-part-2.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/79508
CVE: CVE-2012-4284
Published: 2020-01-10
Description: A Privilege Escalation vulnerability exists in Viscosity 1.4.1 on Mac OS X due to a path name validation issue in the setuid-set ViscosityHelper binary, which could let a remote malicious user execute arbitrary code
CVSS Score: 9.8 (CRITICAL)
References: http://www.exploit-db.com/exploits/24579; http://www.securityfocus.com/bid/55002; https://packetstormsecurity.com/files/120643/Viscosity-setuid-set-ViscosityHelper-Privilege-Escalation.html
CVE: CVE-2012-4603
Published: 2020-01-10
Description: Citrix XenApp Online Plug-in for Windows 12.1 and earlier, and Citrix Receiver for Windows 3.2 and earlier could allow remote attackers to execute arbitrary code by convincing a target to open a specially crafted file from an SMB or WebDAV fileserver.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/55518; http://www.securitytracker.com/id?1027521; http://www.securitytracker.com/id?1027522
CVE: CVE-2020-6835
Published: 2020-01-10
Description: An issue was discovered in Bftpd before 5.4. There is a heap-based off-by-one error during file-transfer error checking.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-193
References: http://bftpd.sourceforge.net/news.html#302460; https://fossies.org/linux/bftpd/CHANGELOG; http://bftpd.sourceforge.net/news.html#302460
CVE: CVE-2019-13767
Published: 2020-01-10
Description: Use after free in media picker in Google Chrome prior to 79.0.3945.88 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00005.html; http://packetstormsecurity.com/files/156563/Chrome-DesktopMediaPickerController-WebContentsDestroyed-Use-After-Free.html; https://chromereleases.googleblog.com/2019/12/stable-channel-update-for-desktop_17.html
CVE: CVE-2019-19475
Published: 2020-01-10
Description: An issue was discovered in ManageEngine Applications Manager 14 with Build 14360. Integrated PostgreSQL which is built-in in Applications Manager is prone to attack due to lack of file permission security. The malicious users who are in “Authenticated Users” group can exploit privilege escalation and modify PostgreSQL configuration to execute arbitrary command to escalate and gain full system privilege user access and rights over the system.
CVSS Score: 8.8 (HIGH)
CWE: CWE-276
References: https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2019-19475.html; https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2019-19475.html
CVE: CVE-2020-6377
Published: 2020-01-10
Description: Use after free in audio in Google Chrome prior to 79.0.3945.117 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00004.html; http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00007.html; http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00023.html
CVE: CVE-2020-6836
Published: 2020-01-11
Description: grammar-parser.jison in the hot-formula-parser package before 3.0.1 for Node.js is vulnerable to arbitrary code injection. The package fails to sanitize values passed to the parse function and concatenates them in an eval call. If a value of the formula is taken from user-controlled input, it may allow attackers to run arbitrary commands on the server.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://blog.truesec.com/2020/01/17/reverse-shell-through-a-node-js-math-parser/; https://github.com/handsontable/formula-parser/commit/396b089738d4bf30eb570a4fe6a188affa95cd5e; https://www.npmjs.com/advisories/1439
CVE: CVE-2019-20378
Published: 2020-01-11
Description: ganglia-web (aka Ganglia Web Frontend) through 3.7.5 allows XSS via the header.php ce parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/ganglia/ganglia-web/issues/351; https://github.com/ganglia/ganglia-web/issues/351
CVE: CVE-2019-20379
Published: 2020-01-11
Description: ganglia-web (aka Ganglia Web Frontend) through 3.7.5 allows XSS via the header.php cs parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/ganglia/ganglia-web/issues/351; https://github.com/ganglia/ganglia-web/issues/351
CVE: CVE-2020-6838
Published: 2020-01-11
Description: In mruby 2.1.0, there is a use-after-free in hash_values_at in mrbgems/mruby-hash-ext/src/hash-ext.c.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: https://github.com/mruby/mruby/issues/4926; https://github.com/mruby/mruby/issues/4926
CVE: CVE-2020-6839
Published: 2020-01-11
Description: In mruby 2.1.0, there is a stack-based buffer overflow in mrb_str_len_to_dbl in string.c.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/mruby/mruby/issues/4929; https://github.com/mruby/mruby/issues/4929
CVE: CVE-2020-6840
Published: 2020-01-11
Description: In mruby 2.1.0, there is a use-after-free in hash_slice in mrbgems/mruby-hash-ext/src/hash-ext.c.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: https://github.com/mruby/mruby/issues/4927; https://github.com/mruby/mruby/issues/4927
CVE: CVE-2019-20377
Published: 2020-01-11
Description: TopList before 2019-09-03 allows XSS via a title.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/tophubs/TopList/issues/32; https://github.com/tophubs/TopList/issues/32
CVE: CVE-2020-6847
Published: 2020-01-11
Description: OpenTrade through 0.2.0 has a DOM-based XSS vulnerability that is executed when an administrator attempts to delete a message that contains JavaScript.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/Marshall-Hallenbeck/bf6a4a4f408bb7a5e0a47cb39dc1dbbe; https://github.com/3s3s/opentrade/blob/4f[PII_REDACTED]9da30533453e1ff6800ef2ef3c6b/static_pages/js/index.js#L473; https://github.com/3s3s/opentrade/pull/337
CVE: CVE-2020-6848
Published: 2020-01-13
Description: Axper Vision II 4 devices allow XSS via the DEVICE_NAME (aka Device Name) parameter to the configWebParams.cgi URI.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://sku11army.blogspot.com/2020/01/flir-brickstream-recuento-y-seguimiento.html; https://sku11army.blogspot.com/2020/01/flir-brickstream-recuento-y-seguimiento.html
CVE: CVE-2020-6851
Published: 2020-01-13
Description: OpenJPEG through 2.3.1 has a heap-based buffer overflow in opj_t1_clbl_decode_processor in openjp2/t1.c because of lack of opj_j2k_update_image_dimensions validation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://access.redhat.com/errata/RHSA-2020:0262; https://access.redhat.com/errata/RHSA-2020:0274; https://access.redhat.com/errata/RHSA-2020:0296
CVE: CVE-2020-6860
Published: 2020-01-13
Description: libmysofa 0.9.1 has a stack-based buffer overflow in readDataVar in hdf/dataobject.c during the reading of a header message attribute.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://github.com/hoene/libmysofa/issues/96; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PGQ45S4RH7MC42NHTAGOIHYR4C5IRTMZ/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WGY7TAZX2M4NYXXGNHIBBKKN5XMSMKQ4/
CVE: CVE-2014-5380
Published: 2020-01-13
Description: Grand MA 300 allows retrieval of the access PIN from sniffed data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-319
References: http://packetstormsecurity.com/files/128003/Grand-MA-300-Fingerprint-Reader-Weak-PIN-Verification.html; http://seclists.org/fulldisclosure/2014/Aug/70; http://www.securityfocus.com/bid/69390
CVE: CVE-2014-5381
Published: 2020-01-13
Description: Grand MA 300 allows a brute-force attack on the PIN.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-522
References: http://packetstormsecurity.com/files/128003/Grand-MA-300-Fingerprint-Reader-Weak-PIN-Verification.html; http://seclists.org/fulldisclosure/2014/Aug/70; http://www.securityfocus.com/bid/69390
CVE: CVE-2014-6038
Published: 2020-01-13
Description: Zoho ManageEngine EventLog Analyzer versions 7 through 9.9 build 9002 have a database Information Disclosure Vulnerability. Fixed in EventLog Analyzer 10.0 Build 10000.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://packetstormsecurity.com/files/128996/ManageEngine-EventLog-Analyzer-SQL-Credential-Disclosure.html; http://seclists.org/fulldisclosure/2014/Nov/12; http://www.securityfocus.com/bid/70959
CVE: CVE-2014-6039
Published: 2020-01-13
Description: ManageEngine EventLog Analyzer version 7 through 9.9 build 9002 has a Credentials Disclosure Vulnerability. Fixed version 10 Build 10000.
CVSS Score: 7.5 (HIGH)
CWE: CWE-522
References: http://packetstormsecurity.com/files/128996/ManageEngine-EventLog-Analyzer-SQL-Credential-Disclosure.html; http://seclists.org/fulldisclosure/2014/Nov/12; http://www.securityfocus.com/bid/70960
CVE: CVE-2014-6059
Published: 2020-01-13
Description: WordPress Advanced Access Manager Plugin before 2.8.2 has an Arbitrary File Overwrite Vulnerability
CVSS Score: 7.2 (HIGH)
References: http://packetstormsecurity.com/files/128137/WordPress-Advanced-Access-Manager-2.8.2-File-Write-Code-Execution.html; http://www.securityfocus.com/bid/69549; https://exchange.xforce.ibmcloud.com/vulnerabilities/95694
CVE: CVE-2011-2670
Published: 2020-01-13
Description: Mozilla Firefox before 3.6 is vulnerable to XSS via the rendering of Cascading Style Sheets
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN74649877/index.html; http://jvn.jp/en/jp/JVN74649877/index.html
CVE: CVE-2013-6225
Published: 2020-01-13
Description: LiveZilla 5.0.1.4 has a Remote Code Execution vulnerability
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: http://www.exploit-db.com/exploits/29672; https://curesec.com/de/veroeffentlichungen/advisories.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/89051
CVE: CVE-2014-9382
Published: 2020-01-13
Description: Freebox OS Web interface 3.0.2 has CSRF which can allow VPN user account creation
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.com/files/132121/FreeBox-3.0.2-Cross-Site-Request-Forgery-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2015/Jun/1; http://www.securityfocus.com/bid/74936