deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-8424
Published: 2014-11-28
Description: ARRIS VAP2500 before FW08.41 does not properly validate passwords, which allows remote attackers to bypass authentication.
CVSS Score: 7.8 (HIGH)
CWE: CWE-287
References: http://www.zerodayinitiative.com/advisories/ZDI-14-388/; http://www.zerodayinitiative.com/advisories/ZDI-14-388/
CVE: CVE-2014-8425
Published: 2014-11-28
Description: The management portal in ARRIS VAP2500 before FW08.41 allows remote attackers to obtain credentials by reading the configuration files.
CVSS Score: 7.8 (HIGH)
CWE: CWE-200
References: http://www.zerodayinitiative.com/advisories/ZDI-14-387/; http://www.zerodayinitiative.com/advisories/ZDI-14-387/
CVE: CVE-2014-8429
Published: 2014-11-28
Description: Cross-site request forgery (CSRF) vulnerability in Xavoc Technocrats xEpan CMS 1.0.4.1, 1.0.4, 1.0.1, and earlier allows remote attackers to hijack the authentication of administrators for requests that create new administrative accounts via a crafted request to the owner/users page.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www.securityfocus.com/archive/1/534096/100/0/threaded; https://www.htbridge.com/advisory/HTB23240; http://www.securityfocus.com/archive/1/534096/100/0/threaded
CVE: CVE-2014-8799
Published: 2014-11-28
Description: Directory traversal vulnerability in the dp_img_resize function in php/dp-functions.php in the DukaPress plugin before 2.5.4 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the src parameter to lib/dp_image.php.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://security.szurek.pl/dukapress-252-path-traversal.html; http://www.exploit-db.com/exploits/35346; https://exchange.xforce.ibmcloud.com/vulnerabilities/98943
CVE: CVE-2014-8801
Published: 2014-11-28
Description: Directory traversal vulnerability in services/getfile.php in the Paid Memberships Pro plugin before 1.7.15 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the QUERY_STRING in a getfile action to wp-admin/admin-ajax.php.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.com/files/129189/Paid-Memberships-Pro-1.7.14.2-Path-Traversal.html; http://security.szurek.pl/paid-memberships-pro-17142-path-traversal.html; http://www.exploit-db.com/exploits/35303
CVE: CVE-2014-8994
Published: 2014-11-28
Description: The check_diskio plugin 3.2.6 and earlier for Nagios and Icinga allows local users to write to arbitrary files via a symlink attack on a temporary file with a predictable name (tmp/check_diskio_status-*-*).
CVSS Score: 3.6 (LOW)
CWE: CWE-18
References: http://seclists.org/oss-sec/2014/q4/679; http://seclists.org/oss-sec/2014/q4/701; http://www.securityfocus.com/bid/71208
CVE: CVE-2014-9089
Published: 2014-11-28
Description: Multiple SQL injection vulnerabilities in view_all_bug_page.php in MantisBT before 1.2.18 allow remote attackers to execute arbitrary SQL commands via the (1) sort or (2) dir parameter to view_all_set.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/62101; http://www.debian.org/security/2015/dsa-3120; http://www.openwall.com/lists/oss-security/2014/11/25/14
CVE: CVE-2010-5313
Published: 2014-11-30
Description: Race condition in arch/x86/kvm/x86.c in the Linux kernel before 2.6.38 allows L2 guest OS users to cause a denial of service (L1 guest OS crash) via a crafted instruction that triggers an L2 emulation failure report, a similar issue to CVE-2014-7842.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-362
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=fc3a9157d3148ab91039c75423da8ef97be3e105; http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00000.html; http://mirror.linux.org.au/linux/kernel/v2.6/ChangeLog-2.6.38
CVE: CVE-2014-3688
Published: 2014-11-30
Description: The SCTP implementation in the Linux kernel before 3.17.4 allows remote attackers to cause a denial of service (memory consumption) by triggering a large number of chunks in an association's output queue, as demonstrated by ASCONF probes, related to net/sctp/inqueue.c and net/sctp/sm_statefuns.c.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=26b87c[PII_REDACTED]828bb0ab271a551a62dcceb4; http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00010.html; http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00025.html
CVE: CVE-2014-7841
Published: 2014-11-30
Description: The sctp_process_param function in net/sctp/sm_make_chunk.c in the SCTP implementation in the Linux kernel before 3.17.4, when ASCONF is used, allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) via a malformed INIT chunk.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=e40607cbe270a9e8360907cb1e62ddf0736e4864; http://linux.oracle.com/errata/ELSA-2015-3004.html; http://linux.oracle.com/errata/ELSA-2015-3005.html
CVE: CVE-2014-7842
Published: 2014-11-30
Description: Race condition in arch/x86/kvm/x86.c in the Linux kernel before 3.17.4 allows guest OS users to cause a denial of service (guest OS crash) via a crafted application that performs an MMIO transaction or a PIO transaction to trigger a guest userspace emulation error report, a similar issue to CVE-2010-5313.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-362
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=a2b9e6c1a35afcc0973acb72e591c714e78885ff; http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00010.html; http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00025.html
CVE: CVE-2014-7843
Published: 2014-11-30
Description: The __clear_user function in arch/arm64/lib/clear_user.S in the Linux kernel before 3.17.4 on the ARM64 platform allows local users to cause a denial of service (system crash) by reading one byte beyond a /dev/zero page boundary.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-17
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=97fc15436b36ee3956efad83e22a557991f7d19d; http://secunia.com/advisories/62305; http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.17.4
CVE: CVE-2014-8884
Published: 2014-11-30
Description: Stack-based buffer overflow in the ttusbdecfe_dvbs_diseqc_send_master_cmd function in drivers/media/usb/ttusb-dec/ttusbdecfe.c in the Linux kernel before 3.17.4 allows local users to cause a denial of service (system crash) or possibly gain privileges via a large message length in an ioctl call.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-119
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=f2e323ec96077642d397bb1c355def536d489d16; http://rhn.redhat.com/errata/RHSA-2015-0290.html; http://rhn.redhat.com/errata/RHSA-2015-0782.html
CVE: CVE-2014-8989
Published: 2014-11-30
Description: The Linux kernel through 3.17.4 does not properly restrict dropping of supplemental group memberships in certain namespace scenarios, which allows local users to bypass intended file permissions by leveraging a POSIX ACL containing an entry for the group category that is more restrictive than the entry for the other category, aka a "negative groups" issue, related to kernel/groups.c, kernel/uid16.c, and kernel/user_namespace.c.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-264
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-January/147864.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-January/147973.html; http://thread.gmane.org/gmane.linux.man/7385/
CVE: CVE-2014-9090
Published: 2014-11-30
Description: The do_double_fault function in arch/x86/kernel/traps.c in the Linux kernel through 3.17.4 does not properly handle faults associated with the Stack Segment (SS) segment register, which allows local users to cause a denial of service (panic) via a modify_ldt system call, as demonstrated by sigreturn_32 in the linux-clock-tests test suite.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-17
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=6f442be2fb22be02cafa606f1769fa1e6f894441; http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00025.html; http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00015.html
CVE: CVE-2014-9150
Published: 2014-11-30
Description: Race condition in the MoveFileEx call hook feature in Adobe Reader and Acrobat 11.x before 11.0.09 on Windows allows attackers to bypass a sandbox protection mechanism, and consequently write to files in arbitrary locations, via an NTFS junction attack, a similar issue to CVE-2014-0568.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-362
References: http://helpx.adobe.com/security/products/reader/apsb14-28.html; https://code.google.com/p/google-security-research/issues/detail?id=103; http://helpx.adobe.com/security/products/reader/apsb14-28.html
CVE: CVE-2014-8958
Published: 2014-11-30
Description: Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.6, 4.1.x before 4.1.14.7, and 4.2.x before 4.2.12 allow remote authenticated users to inject arbitrary web script or HTML via a crafted (1) database, (2) table, or (3) column name that is improperly handled during rendering of the table browse page; a crafted ENUM value that is improperly handled during rendering of the (4) table print view or (5) zoom search page; or (6) a crafted pma_fontsize cookie that is improperly handled during rendering of the home page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-updates/2014-12/msg00017.html; http://www.debian.org/security/2015/dsa-3382; http://www.mandriva.com/security/advisories?name=MDVSA-2014:228
CVE: CVE-2014-8959
Published: 2014-11-30
Description: Directory traversal vulnerability in libraries/gis/GIS_Factory.class.php in the GIS editor in phpMyAdmin 4.0.x before 4.0.10.6, 4.1.x before 4.1.14.7, and 4.2.x before 4.2.12 allows remote authenticated users to include and execute arbitrary local files via a crafted geometry-type parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: http://lists.opensuse.org/opensuse-updates/2014-12/msg00017.html; http://www.mandriva.com/security/advisories?name=MDVSA-2014:228; http://www.phpmyadmin.net/home_page/security/PMASA-2014-14.php
CVE: CVE-2014-8960
Published: 2014-11-30
Description: Cross-site scripting (XSS) vulnerability in libraries/error_report.lib.php in the error-reporting feature in phpMyAdmin 4.1.x before 4.1.14.7 and 4.2.x before 4.2.12 allows remote authenticated users to inject arbitrary web script or HTML via a crafted filename.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-updates/2014-12/msg00017.html; http://www.mandriva.com/security/advisories?name=MDVSA-2014:228; http://www.phpmyadmin.net/home_page/security/PMASA-2014-15.php
CVE: CVE-2014-8961
Published: 2014-11-30
Description: Directory traversal vulnerability in libraries/error_report.lib.php in the error-reporting feature in phpMyAdmin 4.1.x before 4.1.14.7 and 4.2.x before 4.2.12 allows remote authenticated users to obtain potentially sensitive information about a file's line count via a crafted parameter.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-22
References: http://lists.opensuse.org/opensuse-updates/2014-12/msg00017.html; http://www.mandriva.com/security/advisories?name=MDVSA-2014:228; http://www.phpmyadmin.net/home_page/security/PMASA-2014-16.php
CVE: CVE-2013-6497
Published: 2014-12-01
Description: clamscan in ClamAV before 0.98.5, when using -a option, allows remote attackers to cause a denial of service (crash) as demonstrated by the jwplayer.js file.
CVSS Score: 2.1 (LOW)
CWE: CWE-17
References: http://blog.clamav.net/2014/11/clamav-0985-has-been-released.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-November/144754.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-November/144979.html
CVE: CVE-2014-2232
Published: 2014-12-01
Description: Absolute path traversal vulnerability in the MapAPI in Infoware MapSuite before 1.0.36 and 1.1.x before 1.1.49 allows remote attackers to read arbitrary files via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-21
References: http://iw.mapandroute.de/MapAPI-1.0/releaseHistory.jsp; http://iw.mapandroute.de/MapAPI-1.1/releaseHistory.jsp; http://www.christian-schneider.net/advisories/CVE-2014-2232.txt
CVE: CVE-2014-2233
Published: 2014-12-01
Description: Server-side request forgery (SSRF) vulnerability in the MapAPI in Infoware MapSuite before 1.0.36 and 1.1.x before 1.1.49 allows remote attackers to trigger requests to intranet servers via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://iw.mapandroute.de/MapAPI-1.0/releaseHistory.jsp; http://iw.mapandroute.de/MapAPI-1.1/releaseHistory.jsp; http://www.christian-schneider.net/advisories/CVE-2014-2233.txt
CVE: CVE-2014-5237
Published: 2014-12-01
Description: Server-side request forgery (SSRF) vulnerability in the documentconverter component in Open-Xchange (OX) AppSuite before 7.4.2-rev10 and 7.6.x before 7.6.0-rev10 allows remote attackers to trigger requests to arbitrary servers and embed arbitrary images via a URL in an embedded image in a Text document, which is not properly handled by the image preview.
CVSS Score: 4.3 (MEDIUM)
References: http://packetstormsecurity.com/files/128257/Open-Xchange-7.6.0-XSS-SSRF-Traversal.html; http://software.open-xchange.com/OX6/doc/Release_Notes_for_Patch_Release_2112_7.6.0_2014-08-25.pdf; http://www.securityfocus.com/archive/1/533443/100/0/threaded
CVE: CVE-2014-7291
Published: 2014-12-01
Description: Multiple cross-site scripting (XSS) vulnerabilities in api_events.php in Springshare LibCal 2.0 allow remote attackers to inject arbitrary web script or HTML via the (1) m or (2) cid parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2014/Nov/90; http://tetraph.com/security/cves/cve-2014-7291-springshare-libcal-xss-cross-site-scripting-vulnerability/; https://exchange.xforce.ibmcloud.com/vulnerabilities/99000
CVE: CVE-2014-7816
Published: 2014-12-01
Description: Directory traversal vulnerability in JBoss Undertow 1.0.x before 1.0.17, 1.1.x before 1.1.0.CR5, and 1.2.x before 1.2.0.Beta3, when running on Windows, allows remote attackers to read arbitrary files via a .. (dot dot) in a resource URI.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://seclists.org/oss-sec/2014/q4/830; http://www.securityfocus.com/bid/71328; https://bugzilla.redhat.com/show_bug.cgi?id=1157478
CVE: CVE-2014-8749
Published: 2014-12-01
Description: Server-side request forgery (SSRF) vulnerability in admin/htaccess/bpsunlock.php in the BulletProof Security plugin before .51.1 for WordPress allows remote attackers to trigger outbound requests that authenticate to arbitrary databases via the dbhost parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://seclists.org/fulldisclosure/2014/Nov/13; https://wordpress.org/plugins/bulletproof-security/changelog/; http://seclists.org/fulldisclosure/2014/Nov/13
CVE: CVE-2014-8866
Published: 2014-12-01
Description: The compatibility mode hypercall argument translation in Xen 3.3.x through 4.4.x, when running on a 64-bit hypervisor, allows local 32-bit HVM guests to cause a denial of service (host crash) via vectors involving altering the high halves of registers while in 64-bit mode.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-17
References: http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00010.html; http://secunia.com/advisories/59937
CVE: CVE-2014-8867
Published: 2014-12-01
Description: The acceleration support for the "REP MOVS" instruction in Xen 4.4.x, 3.2.x, and earlier lacks properly bounds checking for memory mapped I/O (MMIO) emulated in the hypervisor, which allows local HVM guests to cause a denial of service (host crash) via unspecified vectors.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-17
References: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705; http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00010.html
CVE: CVE-2014-9050
Published: 2014-12-01
Description: Heap-based buffer overflow in the cli_scanpe function in libclamav/pe.c in ClamAV before 0.98.5 allows remote attackers to cause a denial of service (crash) via a crafted y0da Crypter PE file.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://blog.clamav.net/2014/11/clamav-0985-has-been-released.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-November/144979.html; http://lists.opensuse.org/opensuse-security-announce/2014-12/msg00003.html
CVE: CVE-2014-9087
Published: 2014-12-01
Description: Integer underflow in the ksba_oid_to_str function in Libksba before 1.3.2, as used in GnuPG, allows remote attackers to cause a denial of service (crash) via a crafted OID in a (1) S/MIME message or (2) ECC based OpenPGP data, which triggers a buffer overflow.
CVSS Score: 7.5 (HIGH)
CWE: CWE-191
References: http://advisories.mageia.org/MGASA-2014-0498.html; http://lists.gnupg.org/pipermail/gnupg-announce/2014q4/000359.html; http://secunia.com/advisories/60073
CVE: CVE-2014-5268
Published: 2014-12-01
Description: The Fasttoggle module 7.x-1.3 and 7.x-1.4 for Drupal allows remote attackers to block or unblock an account via a crafted user status link.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-264
References: https://www.drupal.org/node/2316065; https://www.drupal.org/node/2316747; https://www.drupal.org/node/2316065
CVE: CVE-2014-9151
Published: 2014-12-01
Description: The Services module 7.x-3.x before 7.x-3.10 for Drupal does not properly limit the rate of authentication attempts, which makes it easier for remote attackers to obtain access via a brute-force attack on the administrative password.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://www.drupal.org/node/2344389; https://www.drupal.org/node/2344423; https://www.drupal.org/node/2344389
CVE: CVE-2014-9152
Published: 2014-12-01
Description: The _user_resource_create function in the Services module 7.x-3.x before 7.x-3.10 for Drupal uses a password of 1 when creating new user accounts, which makes it easier for remote attackers to guess the password via a brute force attack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-255
References: http://cgit.drupalcode.org/services/commit/?id=809aafa; https://www.drupal.org/node/2344389; https://www.drupal.org/node/2344423
CVE: CVE-2014-9153
Published: 2014-12-01
Description: Cross-site scripting (XSS) vulnerability in the Services module 7.x-3.x before 7.x-3.10 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via the callback parameter in a JSONP response.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://www.drupal.org/node/2344389; https://www.drupal.org/node/2344423; https://www.drupal.org/node/2344389
CVE: CVE-2014-9154
Published: 2014-12-01
Description: The Notify module 7.x-1.x before 7.x-1.1 for Drupal does not properly restrict access to (1) new or (2) modified nodes or (3) their fields, which allows remote authenticated users to obtain node titles, teasers, and fields by reading a notification email.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: https://www.drupal.org/node/2320693; https://www.drupal.org/node/2320741; https://www.drupal.org/node/2320693
CVE: CVE-2014-9155
Published: 2014-12-01
Description: Directory traversal vulnerability in the Avatar Uploader module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.0-beta6 for Drupal allows remote authenticated users to read arbitrary files via a .. (dot dot) in the path of a cropped picture in the uploader panel.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-22
References: https://www.drupal.org/node/2330759; https://www.drupal.org/node/2330763; https://www.drupal.org/node/2332169
CVE: CVE-2014-9156
Published: 2014-12-01
Description: The FileField module 6.x-3.x before 6.x-3.13 for Drupal does not properly check permissions to view files, which allows remote authenticated users with permission to create or edit content to read private files by attaching an uploaded file.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://cgit.drupalcode.org/filefield/commit/?id=3a97fe1; https://www.drupal.org/node/2304517; https://www.drupal.org/node/2304561
CVE: CVE-2013-6494
Published: 2014-12-02
Description: fedup 0.9.0 in Fedora 19, 20, and 21 uses a temporary directory with a static name for its download cache, which allows local users to cause a denial of service (prevention of system updates).
CVSS Score: 2.1 (LOW)
CWE: CWE-17
References: http://lists.fedoraproject.org/pipermail/package-announce/2014-November/141698.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-November/142698.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-November/142933.html
CVE: CVE-2014-3065
Published: 2014-12-02
Description: Unspecified vulnerability in IBM Java Runtime Environment (JRE) 7 R1 before SR2 (7.1.2.0), 7 before SR8 (7.0.8.0), 6 R1 before SR8 FP2 (6.1.8.2), 6 before SR16 FP2 (6.0.16.2), and before SR16 FP8 (5.0.16.8) allows local users to execute arbitrary code via vectors related to the shared classes cache.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-94
References: http://lists.opensuse.org/opensuse-security-announce/2014-11/msg00021.html; http://lists.opensuse.org/opensuse-security-announce/2014-12/msg00002.html; http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00026.html
CVE: CVE-2014-3068
Published: 2014-12-02
Description: IBM Java Runtime Environment (JRE) 7 R1 before SR1 FP1 (7.1.1.1), 7 before SR7 FP1 (7.0.7.1), 6 R1 before SR8 FP1 (6.1.8.1), 6 before SR16 FP1 (6.0.16.1), and before 5.0 SR16 FP7 (5.0.16.7) allows attackers to obtain the private key from a Certificate Management System (CMS) keystore via a brute force attack.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-255
References: http://rhn.redhat.com/errata/RHSA-2015-0264.html; http://www-01.ibm.com/support/docview.wss?uid=swg1IV66876; http://www-01.ibm.com/support/docview.wss?uid=swg1IV66894
CVE: CVE-2014-3703
Published: 2014-12-02
Description: OpenStack PackStack 2012.2.1, when the Open vSwitch (OVS) monolithic plug-in is not used, does not properly set the libvirt_vif_driver configuration option when generating the nova.conf configuration, which causes the firewall to be disabled and allows remote attackers to bypass intended access restrictions.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://rhn.redhat.com/errata/RHSA-2014-1691.html; http://rhn.redhat.com/errata/RHSA-2014-1691.html
CVE: CVE-2014-5284
Published: 2014-12-02
Description: host-deny.sh in OSSEC before 2.8.1 writes to temporary files with predictable filenames without verifying ownership, which allows local users to modify access restrictions in hosts.deny and gain root privileges by creating the temporary files before automatic IP blocking is performed.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://packetstormsecurity.com/files/129111/OSSEC-2.8-Privilege-Escalation.html; http://www.exploit-db.com/exploits/35234; https://github.com/ossec/ossec-hids/releases/tag/2.8.1
CVE: CVE-2014-8791
Published: 2014-12-02
Description: project/register.php in Tuleap before 7.7, when sys_create_project_in_one_step is disabled, allows remote authenticated users to conduct PHP object injection attacks and execute arbitrary PHP code via the data parameter.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-94
References: http://karmainsecurity.com/KIS-2014-13; http://packetstormsecurity.com/files/129309/Tuleap-7.6-4-PHP-Object-Injection.html; http://seclists.org/fulldisclosure/2014/Nov/101
CVE: CVE-2014-8728
Published: 2014-12-02
Description: SQL injection vulnerability in the login page (login/login) in Subex ROC Fraud Management (aka Fraud Management System and FMS) 7.4 and earlier allows remote attackers to execute arbitrary SQL commands via the ranger_user[name] parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/35214; http://www.exploit-db.com/exploits/35214