deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-8578
Published: 2014-10-31
Description: Cross-site scripting (XSS) vulnerability in the Groups panel in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 allows remote administrators to inject arbitrary web script or HTML via a user email address, a different vulnerability than CVE-2014-3475.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2014/07/08/6; http://www.securityfocus.com/bid/68456; https://bugs.launchpad.net/horizon/+bug/1320235
CVE: CVE-2014-8243
Published: 2014-11-01
Description: Linksys SMART WiFi firmware on EA2700 and EA3500 devices; before 2.1.41 build 162351 on E4200v2 and EA4500 devices; before 1.1.41 build 162599 on EA6200 devices; before 1.1.40 build 160989 on EA6300, EA6400, EA6500, and EA6700 devices; and before 1.1.42 build 161129 on EA6900 devices allows remote attackers to obtain the administrator's MD5 password hash via a direct request for the /.htpasswd URI.
CVSS Score: 3.3 (LOW)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/447516; http://www.kb.cert.org/vuls/id/447516
CVE: CVE-2014-8244
Published: 2014-11-01
Description: Linksys SMART WiFi firmware on EA2700 and EA3500 devices; before 2.1.41 build 162351 on E4200v2 and EA4500 devices; before 1.1.41 build 162599 on EA6200 devices; before 1.1.40 build 160989 on EA6300, EA6400, EA6500, and EA6700 devices; and before 1.1.42 build 161129 on EA6900 devices allows remote attackers to obtain sensitive information or modify data via a JNAP action in a JNAP/ HTTP request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.kb.cert.org/vuls/id/447516; http://www.kb.cert.org/vuls/id/447516
CVE: CVE-2014-3615
Published: 2014-11-01
Description: The VGA emulator in QEMU allows local guest users to read host memory by setting the display to a high resolution.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=ab9509cceabef28071e41bdfa073083859c949a7; http://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=c1b886c45dc70f247300f549dce9833f3fa2def5; http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00014.html
CVE: CVE-2014-6032
Published: 2014-11-01
Description: Multiple XML External Entity (XXE) vulnerabilities in the Configuration utility in F5 BIG-IP LTM, ASM, GTM, and Link Controller 11.0 through 11.6.0 and 10.0.0 through 10.2.4, AAM 11.4.0 through 11.6.0, ARM 11.3.0 through 11.6.0, Analytics 11.0.0 through 11.6.0, APM and Edge Gateway 11.0.0 through 11.6.0 and 10.1.0 through 10.2.4, PEM 11.3.0 through 11.6.0, PSM 11.0.0 through 11.4.1 and 10.0.0 through 10.2.4, and WOM 11.0.0 through 11.3.0 and 10.0.0 through 10.2.4 and Enterprise Manager 3.0.0 through 3.1.1 and 2.1.0 through 2.3.0 allow remote authenticated users to read arbitrary files and cause a denial of service via a crafted request, as demonstrated using (1) viewList or (2) deal elements.
CVSS Score: 5.5 (MEDIUM)
References: http://packetstormsecurity.com/files/128915/F5-Big-IP-11.3.0.39.0-XML-External-Entity-Injection-1.html; http://seclists.org/fulldisclosure/2014/Oct/128; http://seclists.org/fulldisclosure/2014/Oct/129
CVE: CVE-2014-8582
Published: 2014-11-01
Description: FortiNet FortiADC-E with firmware 3.1.1 before 4.0.5 and Coyote Point Equalizer with firmware 10.2.0a allows remote attackers to obtain access to arbitrary subnets via unspecified vectors.
CVSS Score: 6.4 (MEDIUM)
References: http://docs.fortinet.com/uploaded/files/2164/FortiADC-E-4.0.5-GA-Release-Notes.pdf; http://secunia.com/advisories/61866; http://www.fortiguard.com/advisory/FG-IR-14-032/
CVE: CVE-2014-2015
Published: 2014-11-02
Description: Stack-based buffer overflow in the normify function in the rlm_pap module (modules/rlm_pap/rlm_pap.c) in FreeRADIUS 2.x, possibly 2.2.3 and earlier, and 3.x, possibly 3.0.1 and earlier, might allow attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long password hash, as demonstrated by an SSHA hash.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://lists.freebsd.org/pipermail/freebsd-bugbusters/2014-February/000610.html; http://lists.freebsd.org/pipermail/freebsd-bugbusters/2014-February/000612.html; http://lists.freebsd.org/pipermail/freebsd-bugbusters/2014-February/000616.html
CVE: CVE-2014-3634
Published: 2014-11-02
Description: rsyslog before 7.6.6 and 8.x before 8.4.1 and sysklogd 1.5 and earlier allows remote attackers to cause a denial of service (crash), possibly execute arbitrary code, or have other unspecified impact via a crafted priority (PRI) value that triggers an out-of-bounds array access.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://advisories.mageia.org/MGASA-2014-0411.html; http://linux.oracle.com/errata/ELSA-2014-1654; http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00005.html
CVE: CVE-2014-3683
Published: 2014-11-02
Description: Integer overflow in rsyslog before 7.6.7 and 8.x before 8.4.2 and sysklogd 1.5 and earlier allows remote attackers to cause a denial of service (crash) via a large priority (PRI) value.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-3634.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00005.html; http://lists.opensuse.org/opensuse-updates/2014-10/msg00020.html; http://lists.opensuse.org/opensuse-updates/2014-10/msg00021.html
CVE: CVE-2014-3654
Published: 2014-11-03
Description: Multiple cross-site scripting (XSS) vulnerabilities in spacewalk-java 2.0.2 in Spacewalk and Red Hat Network (RHN) Satellite 5.5 and 5.6 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors to (1) kickstart/cobbler/CustomSnippetList.do, (2) channels/software/Entitlements.do, or (3) admin/multiorg/OrgUsers.do.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00009.html; http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00010.html; http://rhn.redhat.com/errata/RHSA-2014-1762.html
CVE: CVE-2014-3712
Published: 2014-11-03
Description: Katello allows remote attackers to cause a denial of service (memory consumption) via the (1) mode parameter in the setup_utils function in content_search_controller.rb or (2) action parameter in the respond function in api/api_controller.rb in app/controllers/katello/, which is passed to the to_sym method.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://seclists.org/oss-sec/2014/q4/419; http://www.securityfocus.com/bid/70707; https://bugzilla.redhat.com/show_bug.cgi?id=1155708
CVE: CVE-2014-5271
Published: 2014-11-03
Description: Heap-based buffer overflow in the encode_slice function in libavcodec/proresenc_kostya.c in FFMpeg before 1.1.14, 1.2.x before 1.2.8, 2.x before 2.2.7, and 2.3.x before 2.3.3 and Libav before 10.5 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=52b81ff4635c077b2bc8b8d3637d933b6629d803; http://www.osvdb.org/111725; http://www.securityfocus.com/bid/69250
CVE: CVE-2014-5272
Published: 2014-11-03
Description: libavcodec/iff.c in FFMpeg before 1.1.14, 1.2.x before 1.2.8, 2.2.x before 2.2.7, and 2.3.x before 2.3.2 allows remote attackers to have unspecified impact via a crafted iff image, which triggers an out-of-bounds array access, related to the rgb8 and rgbn formats.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=abc1fa7c5a1dca1345b9471b81cfcda00c56220d; http://www.openwall.com/lists/oss-security/2014/08/16/6; https://security.gentoo.org/glsa/201603-06
CVE: CVE-2014-5507
Published: 2014-11-03
Description: iBackup 10.0.0.32 and earlier uses weak permissions (Everyone: Full Control) for ib_service.exe, which allows local users to gain privileges via a Trojan horse file.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://packetstormsecurity.com/files/128806/iBackup-10.0.0.32-Local-Privilege-Escalation.html; http://www.exploit-db.com/exploits/35040; http://www.securityfocus.com/bid/70724
CVE: CVE-2014-8080
Published: 2014-11-03
Description: The REXML parser in Ruby 1.9.x before 1.9.3-p550, 2.0.x before 2.0.0-p594, and 2.1.x before 2.1.4 allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document, aka an XML Entity Expansion (XEE) attack.
CVSS Score: 5.0 (MEDIUM)
References: http://advisories.mageia.org/MGASA-2014-0443.html; http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html; http://lists.opensuse.org/opensuse-updates/2014-12/msg00035.html
CVE: CVE-2014-8350
Published: 2014-11-03
Description: Smarty before 3.1.21 allows remote attackers to bypass the secure mode restrictions and execute arbitrary PHP code as demonstrated by "{literal}<{/literal}script language=php>" in a template.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://advisories.mageia.org/MGASA-2014-0468.html; http://seclists.org/oss-sec/2014/q4/420; http://seclists.org/oss-sec/2014/q4/421
CVE: CVE-2014-8494
Published: 2014-11-03
Description: ESTsoft ALUpdate 8.5.1.0.0 uses weak permissions (Users: Full Control) for the (1) AlUpdate folder and (2) AlUpdate.exe, which allows local users to gain privileges via a Trojan horse file.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-264
References: http://packetstormsecurity.com/files/128868/ESTsoft-ALUpdate-8.5.1.0.0-Privilege-Escalation.html; http://www.securityfocus.com/bid/70790; https://exchange.xforce.ibmcloud.com/vulnerabilities/98315
CVE: CVE-2012-5500
Published: 2014-11-03
Description: The batch id change script (renameObjectsByPaths.py) in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to change the titles of content items by leveraging a valid CSRF token in a crafted request.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: http://rhn.redhat.com/errata/RHSA-2014-1194.html; http://www.openwall.com/lists/oss-security/2012/11/10/1; https://github.com/plone/Products.CMFPlone/blob/4.2.3/docs/CHANGES.txt
CVE: CVE-2012-5508
Published: 2014-11-03
Description: The error pages in Plone before 4.2.3 and 4.3 before beta 1 allow remote attackers to obtain random numbers and derive the PRNG state for password resets via unspecified vectors.  NOTE: this identifier was SPLIT per ADT2 due to different vulnerability types. CVE-2012-6661 was assigned for the PRNG reseeding issue in Zope.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www.openwall.com/lists/oss-security/2012/11/10/1; https://bugs.launchpad.net/zope2/+bug/1071067; https://github.com/plone/Products.CMFPlone/blob/4.2.3/docs/CHANGES.txt
CVE: CVE-2012-6661
Published: 2014-11-03
Description: Zope before 2.13.19, as used in Plone before 4.2.3 and 4.3 before beta 1, does not reseed the pseudo-random number generator (PRNG), which makes it easier for remote attackers to guess the value via unspecified vectors.  NOTE: this issue was SPLIT from CVE-2012-5508 due to different vulnerability types (ADT2).
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://www.openwall.com/lists/oss-security/2012/11/10/1; https://bugs.launchpad.net/zope2/+bug/1071067; https://github.com/plone/Products.CMFPlone/blob/4.2.3/docs/CHANGES.txt
CVE: CVE-2014-0487
Published: 2014-11-03
Description: APT before 1.0.9 does not verify downloaded files if they have been modified as indicated using the If-Modified-Since header, which has unspecified impact and attack vectors.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/61275; http://secunia.com/advisories/61286; http://ubuntu.com/usn/usn-2348-1
CVE: CVE-2014-0488
Published: 2014-11-03
Description: APT before 1.0.9 does not "invalidate repository data" when moving from an unauthenticated to authenticated state, which allows remote attackers to have unspecified impact via crafted repository data.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/61275; http://secunia.com/advisories/61286; http://ubuntu.com/usn/usn-2348-1
CVE: CVE-2014-0489
Published: 2014-11-03
Description: APT before 1.0.9, when the Acquire::GzipIndexes option is enabled, does not validate checksums, which allows remote attackers to execute arbitrary code via a crafted package.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://secunia.com/advisories/61275; http://secunia.com/advisories/61286; http://ubuntu.com/usn/usn-2348-1
CVE: CVE-2014-0490
Published: 2014-11-03
Description: The apt-get download command in APT before 1.0.9 does not properly validate signatures for packages, which allows remote attackers to execute arbitrary code via a crafted package.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://secunia.com/advisories/61275; http://secunia.com/advisories/61286; http://ubuntu.com/usn/usn-2348-1
CVE: CVE-2014-7228
Published: 2014-11-03
Description: Akeeba Restore (restore.php), as used in Joomla! 2.5.4 through 2.5.25, 3.x through 3.2.5, and 3.3.0 through 3.3.4; Akeeba Backup for Joomla! Professional 3.0.0 through 4.0.2; Backup Professional for WordPress 1.0.b1 through 1.1.3; Solo 1.0.b1 through 1.1.2; Admin Tools Core and Professional 2.0.0 through 2.4.4; and CMS Update 1.0.a1 through 1.0.1, when performing a backup or update for an archive, does not delete parameters from $_GET and $_POST when it is cleansing $_REQUEST, but later accesses $_GET and $_POST using the getQueryParam function, which allows remote attackers to bypass encryption and execute arbitrary code via a command message that extracts a crafted archive.
CVSS Score: 7.5 (HIGH)
CWE: CWE-310
References: http://developer.joomla.org/security/[PII_REDACTED]3-core-remote-file-inclusion.html; http://websec.wordpress.com/2014/10/05/joomla-3-3-4-akeeba-kickstart-remote-code-execution-cve-2014-7228/; https://www.akeebabackup.com/home/news/1605-security-update-sep-2014.html
CVE: CVE-2013-0336
Published: 2014-11-03
Description: The ipapwd_chpwop function in daemons/ipa-slapi-plugins/ipa-pwd-extop/ipa_pwd_extop.c in the directory server (dirsrv) in FreeIPA before 3.2.0 allows remote attackers to cause a denial of service (crash) via a connection request without a username/dn, related to the 389 directory server.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/52763; http://www.securityfocus.com/bid/58747; https://bugzilla.redhat.com/show_bug.cgi?id=913751
CVE: CVE-2014-0204
Published: 2014-11-03
Description: OpenStack Identity (Keystone) before 2014.1.1 does not properly handle when a role is assigned to a group that has the same ID as a user, which allows remote authenticated users to gain privileges that are assigned to a group with the same ID.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-269
References: http://www.openwall.com/lists/oss-security/2014/05/21/3; https://bugs.launchpad.net/keystone/+bug/1309228; https://review.openstack.org/#/c/94396/
CVE: CVE-2014-4311
Published: 2014-11-04
Description: Epicor Enterprise 7.4 before FS74SP6_HotfixTL054181 allows attackers to obtain the (1) Database Connection and (2) E-mail Connection passwords by reading HTML source code of the database connection and email settings page.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://packetstormsecurity.com/files/128511/Epicor-Password-Disclosure-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2014/Oct/2; http://www.exploit-db.com/exploits/34864
CVE: CVE-2013-7057
Published: 2014-11-04
Description: Cross-site request forgery (CSRF) vulnerability in Axway SecureTransport 5.1 SP2 and earlier allows remote attackers to hijack the authentication of unspecified users for requests that upload arbitrary files via a crafted request to api/v1.0/files/.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://osvdb.org/show/osvdb/113851; http://www.exploit-db.com/exploits/35046; https://exchange.xforce.ibmcloud.com/vulnerabilities/98320
CVE: CVE-2014-5387
Published: 2014-11-04
Description: Multiple SQL injection vulnerabilities in EllisLab ExpressionEngine before 2.9.1 allow remote authenticated users to execute arbitrary SQL commands via the (1) column_filter or (2) category[] parameter to system/index.php or the (3) tbl_sort[0][] parameter in the comment module to system/index.php.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://packetstormsecurity.com/files/128946/EllisLab-ExpressionEngine-Core-SQL-Injection.html; http://seclists.org/fulldisclosure/2014/Nov/2; http://www.securityfocus.com/bid/70875
CVE: CVE-2014-7176
Published: 2014-11-04
Description: SQL injection vulnerability in Enalean Tuleap before 7.5.99.4 allows remote authenticated users to execute arbitrary SQL commands via the lobal_txt parameter to plugins/docman.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://packetstormsecurity.com/files/128875/Tuleap-7.4.99.5-Blind-SQL-Injection.html; http://seclists.org/fulldisclosure/2014/Oct/119; http://www.exploit-db.com/exploits/35098
CVE: CVE-2014-8339
Published: 2014-11-04
Description: SQL injection vulnerability in midroll.php in Nuevolab Nuevoplayer for ClipShare 8.0 and earlier allows remote attackers to execute arbitrary SQL commands via the ch parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/128909/Nuevolabs-Nuevoplayer-For-Clipshare-SQL-Injection.html; http://www.securityfocus.com/archive/1/533847/100/0/threaded; http://www.securityfocus.com/bid/70833
CVE: CVE-2014-8584
Published: 2014-11-04
Description: Cross-site scripting (XSS) vulnerability in the Web Dorado Spider Video Player (aka WordPress Video Player) plugin before 1.5.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/player/changelog; https://wordpress.org/plugins/player/changelog
CVE: CVE-2014-8585
Published: 2014-11-04
Description: Directory traversal vulnerability in the WordPress Download Manager plugin for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the fname parameter to (1) views/file_download.php or (2) file_download.php.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-59
References: http://packetstormsecurity.com/files/128852/WordPress-Download-Manager-Arbitrary-File-Download.html; http://www.securityfocus.com/bid/70764; https://exchange.xforce.ibmcloud.com/vulnerabilities/98318
CVE: CVE-2014-8586
Published: 2014-11-04
Description: SQL injection vulnerability in the CP Multi View Event Calendar plugin 1.01 for WordPress allows remote attackers to execute arbitrary SQL commands via the calid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/show/osvdb/113670; http://packetstormsecurity.com/files/128814/WordPress-CP-Multi-View-Event-Calendar-1.01-SQL-Injection.html; http://www.exploit-db.com/exploits/35073
CVE: CVE-2014-8587
Published: 2014-11-04
Description: SAPCRYPTOLIB before 5.555.38, SAPSECULIB, and CommonCryptoLib before 8.4.30, as used in SAP NetWeaver AS for ABAP and SAP HANA, allows remote attackers to spoof Digital Signature Algorithm (DSA) signatures via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-310
References: http://blog.onapsis.com/sap-security-note-2067859-potential-exposure-to-digital-signature-spoofing/; http://secunia.com/advisories/57606; http://service.sap.com/sap/support/notes/2067859
CVE: CVE-2014-8588
Published: 2014-11-04
Description: SQL injection vulnerability in metadata.xsjs in SAP HANA 1.00.60.379371 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://erpscan.io/advisories/erpscan-14-013-sap-hana-metadata-xsjs-sql-injection/; https://erpscan.io/press-center/blog/sap-critical-patch-update-october-2014/; https://exchange.xforce.ibmcloud.com/vulnerabilities/98579
CVE: CVE-2014-8589
Published: 2014-11-04
Description: Integer overflow in SAP Network Interface Router (SAProuter) 40.4 allows remote attackers to cause a denial of service (resource consumption) via crafted requests.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://blog.onapsis.com/analyzing-sap-security-notes-october-2014-edition/; https://erpscan.io/advisories/erpscan-14-014-saprouter-integer-overflow-dos/; https://erpscan.io/press-center/blog/sap-critical-patch-update-october-2014/
CVE: CVE-2014-8590
Published: 2014-11-04
Description: XML external entity (XXE) vulnerability in the Web Service Navigator in SAP NetWeaver Application Server (AS) Java allows remote attackers to access arbitrary files via a crafted request.
CVSS Score: 4.3 (MEDIUM)
References: http://blog.onapsis.com/analyzing-sap-security-notes-october-2014-edition/; http://www.securityfocus.com/bid/71023; https://erpscan.io/advisories/erpscan-14-015-sap-netweaver-as-java-xxe/
CVE: CVE-2014-8591
Published: 2014-11-04
Description: Unspecified vulnerability in SAP Internet Communication Manager (ICM), as used in SAP NetWeaver 7.02 and 7.3, allows remote attackers to cause a denial of service (process termination) via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://blog.onapsis.com/analyzing-sap-security-notes-october-2014-edition/; http://www.securityfocus.com/bid/71030; https://erpscan.io/advisories/erpscan-14-016-sap-netweaver-httpd-partial-http-post-requests-dos/
CVE: CVE-2014-8592
Published: 2014-11-04
Description: Unspecified vulnerability in SAP Host Agent, as used in SAP NetWeaver 7.02 and 7.3, allows remote attackers to cause a denial of service (process termination) via a crafted request.
CVSS Score: 5.0 (MEDIUM)
References: http://blog.onapsis.com/analyzing-sap-security-notes-october-2014-edition/; https://erpscan.io/advisories/erpscan-14-017-sap-netweaver-http-partial-http-post-requests-dos/; https://erpscan.io/advisories/erpscan-14-018-sap-netweaver-j2ee-engine-partial-http-post-requests-dos/
CVE: CVE-2014-3660
Published: 2014-11-04
Description: parser.c in libxml2 before 2.9.2 does not properly prevent entity expansion even when entity substitution has been disabled, which allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted XML document containing a large number of nested entity references, a variant of the "billion laughs" attack.
CVSS Score: 5.0 (MEDIUM)
References: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705; http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html; http://lists.apple.com/archives/security-announce/2015/Aug/msg00002.html
CVE: CVE-2014-4974
Published: 2014-11-04
Description: The ESET Personal Firewall NDIS filter (EpFwNdis.sys) kernel mode driver, aka Personal Firewall module before Build 1212 (20140609), as used in multiple ESET products 5.0 through 7.0, allows local users to obtain sensitive information from kernel memory via crafted IOCTL calls.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://packetstormsecurity.com/files/128874/ESET-7.0-Kernel-Memory-Leak.html; http://seclists.org/fulldisclosure/2014/Oct/118; http://www.securityfocus.com/bid/70770
CVE: CVE-2014-8593
Published: 2014-11-04
Description: Multiple cross-site scripting (XSS) vulnerabilities in Allomani Weblinks 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) default URI to admin.php or the (2) id parameter to admin.php or (3) go.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/128565/Allomani-Weblinks-1.0-Cross-Site-Scripting-SQL-Injection.html; http://www.securityfocus.com/bid/70255; https://exchange.xforce.ibmcloud.com/vulnerabilities/96841
CVE: CVE-2014-6130
Published: 2014-11-04
Description: The IBM Notes Traveler application before 9.0.1.3 for Android lacks a warning message during selection of an HTTP session, which makes it easier for remote attackers to obtain sensitive information by sniffing the network during a session in which the user had intended to use HTTPS.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg21688840; http://www.kb.cert.org/vuls/id/432608; http://www.securityfocus.com/bid/70871