deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-3127
Published: 2014-05-14
Description: dpkg 1.15.9 on Debian squeeze introduces support for the "C-style encoded filenames" feature without recognizing that the squeeze patch program lacks this feature, which triggers an interaction error that allows remote attackers to conduct directory traversal attacks and modify files outside of the intended directories via a crafted source package.  NOTE: this can be considered a release engineering problem in the effort to fix CVE-2014-0471.
CVSS Score: 7.1 (HIGH)
CWE: CWE-22
References: http://metadata.ftp-master.debian.org/changelogs//main/d/dpkg/dpkg_1.15.10_changelog; http://seclists.org/oss-sec/2014/q2/191; http://seclists.org/oss-sec/2014/q2/227
CVE: CVE-2014-3225
Published: 2014-05-14
Description: Absolute path traversal vulnerability in the web interface in Cobbler 2.4.x through 2.6.x allows remote authenticated users to read arbitrary files via the Kickstart field in a profile.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.com/files/126553/Cobbler-Local-File-Inclusion.html; http://seclists.org/oss-sec/2014/q2/273; http://seclists.org/oss-sec/2014/q2/274
CVE: CVE-2014-0251
Published: 2014-05-14
Description: Microsoft Windows SharePoint Services 3.0 SP3; SharePoint Server 2007 SP3, 2010 SP1 and SP2, and 2013 Gold and SP1; SharePoint Foundation 2010 SP1 and SP2 and 2013 Gold and SP1; Project Server 2010 SP1 and SP2 and 2013 Gold and SP1; Web Applications 2010 SP1 and SP2; Office Web Apps Server 2013 Gold and SP1; SharePoint Server 2013 Client Components SDK; and SharePoint Designer 2007 SP3, 2010 SP1 and SP2, and 2013 Gold and SP1 allow remote authenticated users to execute arbitrary code via crafted page content, aka "SharePoint Page Content Vulnerability."
CVSS Score: 9.0 (HIGH)
CWE: CWE-94
References: http://www.securitytracker.com/id/1030227; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-022; http://www.securitytracker.com/id/1030227
CVE: CVE-2014-0255
Published: 2014-05-14
Description: Microsoft Windows Server 2008 SP2 and R2 SP1 and Server 2012 Gold and R2 allow remote attackers to cause a denial of service (iSCSI service outage) by sending many crafted packets, aka "iSCSI Target Remote Denial of Service Vulnerability."
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-028; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-028
CVE: CVE-2014-0256
Published: 2014-05-14
Description: Microsoft Windows Server 2008 SP2 and R2 SP1 and Server 2012 Gold allow remote attackers to cause a denial of service (iSCSI service outage) by sending many crafted packets, aka "iSCSI Target Remote Denial of Service Vulnerability."
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-028; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-028
CVE: CVE-2014-0310
Published: 2014-05-14
Description: Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1815.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-029; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-029
CVE: CVE-2014-0513
Published: 2014-05-14
Description: Stack-based buffer overflow in Adobe Illustrator CS6 before 16.0.5 and 16.2.x before 16.2.2 allows remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://helpx.adobe.com/security/products/illustrator/apsb14-11.html; http://helpx.adobe.com/security/products/illustrator/apsb14-11.html
CVE: CVE-2014-0516
Published: 2014-05-14
Description: Adobe Flash Player before 13.0.0.214 on Windows and OS X and before 11.2.202.359 on Linux, Adobe AIR SDK before 13.0.0.111, and Adobe AIR SDK & Compiler before 13.0.0.111 allow remote attackers to bypass the Same Origin Policy via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://helpx.adobe.com/security/products/flash-player/apsb14-14.html; http://lists.opensuse.org/opensuse-security-announce/2014-05/msg00008.html; http://lists.opensuse.org/opensuse-updates/2014-05/msg00051.html
CVE: CVE-2014-0517
Published: 2014-05-14
Description: Adobe Flash Player before 13.0.0.214 on Windows and OS X and before 11.2.202.359 on Linux, Adobe AIR SDK before 13.0.0.111, and Adobe AIR SDK & Compiler before 13.0.0.111 allow attackers to bypass intended access restrictions via unspecified vectors, a different vulnerability than CVE-2014-0518, CVE-2014-0519, and CVE-2014-0520.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://helpx.adobe.com/security/products/flash-player/apsb14-14.html; http://lists.opensuse.org/opensuse-security-announce/2014-05/msg00008.html; http://lists.opensuse.org/opensuse-updates/2014-05/msg00051.html
CVE: CVE-2014-0518
Published: 2014-05-14
Description: Adobe Flash Player before 13.0.0.214 on Windows and OS X and before 11.2.202.359 on Linux, Adobe AIR SDK before 13.0.0.111, and Adobe AIR SDK & Compiler before 13.0.0.111 allow attackers to bypass intended access restrictions via unspecified vectors, a different vulnerability than CVE-2014-0517, CVE-2014-0519, and CVE-2014-0520.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://helpx.adobe.com/security/products/flash-player/apsb14-14.html; http://lists.opensuse.org/opensuse-security-announce/2014-05/msg00008.html; http://lists.opensuse.org/opensuse-updates/2014-05/msg00051.html
CVE: CVE-2014-0519
Published: 2014-05-14
Description: Adobe Flash Player before 13.0.0.214 on Windows and OS X and before 11.2.202.359 on Linux, Adobe AIR SDK before 13.0.0.111, and Adobe AIR SDK & Compiler before 13.0.0.111 allow attackers to bypass intended access restrictions via unspecified vectors, a different vulnerability than CVE-2014-0517, CVE-2014-0518, and CVE-2014-0520.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://helpx.adobe.com/security/products/flash-player/apsb14-14.html; http://lists.opensuse.org/opensuse-security-announce/2014-05/msg00008.html; http://lists.opensuse.org/opensuse-updates/2014-05/msg00051.html
CVE: CVE-2014-0520
Published: 2014-05-14
Description: Adobe Flash Player before 13.0.0.214 on Windows and OS X and before 11.2.202.359 on Linux, Adobe AIR SDK before 13.0.0.111, and Adobe AIR SDK & Compiler before 13.0.0.111 allow attackers to bypass intended access restrictions via unspecified vectors, a different vulnerability than CVE-2014-0517, CVE-2014-0518, and CVE-2014-0519.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://helpx.adobe.com/security/products/flash-player/apsb14-14.html; http://lists.opensuse.org/opensuse-security-announce/2014-05/msg00008.html; http://lists.opensuse.org/opensuse-updates/2014-05/msg00051.html
CVE: CVE-2014-0521
Published: 2014-05-14
Description: Adobe Reader and Acrobat 10.x before 10.1.10 and 11.x before 11.0.07 on Windows and OS X do not properly implement JavaScript APIs, which allows remote attackers to obtain sensitive information via a crafted PDF document.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://helpx.adobe.com/security/products/reader/apsb14-15.html; http://helpx.adobe.com/security/products/reader/apsb14-15.html
CVE: CVE-2014-0522
Published: 2014-05-14
Description: Adobe Reader and Acrobat 10.x before 10.1.10 and 11.x before 11.0.07 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0523, CVE-2014-0524, and CVE-2014-0526.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://helpx.adobe.com/security/products/reader/apsb14-15.html; http://helpx.adobe.com/security/products/reader/apsb14-15.html
CVE: CVE-2014-0523
Published: 2014-05-14
Description: Adobe Reader and Acrobat 10.x before 10.1.10 and 11.x before 11.0.07 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0522, CVE-2014-0524, and CVE-2014-0526.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://helpx.adobe.com/security/products/reader/apsb14-15.html; https://www.verisign.com/en_US/security-services/security-intelligence/vulnerability-reports/articles/index.xhtml?id=1074; http://helpx.adobe.com/security/products/reader/apsb14-15.html
CVE: CVE-2014-0524
Published: 2014-05-14
Description: Adobe Reader and Acrobat 10.x before 10.1.10 and 11.x before 11.0.07 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0522, CVE-2014-0523, and CVE-2014-0526.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://helpx.adobe.com/security/products/reader/apsb14-15.html; http://helpx.adobe.com/security/products/reader/apsb14-15.html
CVE: CVE-2014-0525
Published: 2014-05-14
Description: The API in Adobe Reader and Acrobat 10.x before 10.1.10 and 11.x before 11.0.07 on Windows and OS X does not prevent access to unmapped memory, which allows attackers to execute arbitrary code via unspecified API calls.
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://helpx.adobe.com/security/products/reader/apsb14-15.html; http://helpx.adobe.com/security/products/reader/apsb14-15.html
CVE: CVE-2014-0526
Published: 2014-05-14
Description: Adobe Reader and Acrobat 10.x before 10.1.10 and 11.x before 11.0.07 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0522, CVE-2014-0523, and CVE-2014-0524.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://helpx.adobe.com/security/products/reader/apsb14-15.html; http://helpx.adobe.com/security/products/reader/apsb14-15.html
CVE: CVE-2014-0527
Published: 2014-05-14
Description: Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.10 and 11.x before 11.0.07 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-399
References: http://helpx.adobe.com/security/products/reader/apsb14-15.html; http://helpx.adobe.com/security/products/reader/apsb14-15.html
CVE: CVE-2014-0528
Published: 2014-05-14
Description: Double free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.10 and 11.x before 11.0.07 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-399
References: http://helpx.adobe.com/security/products/reader/apsb14-15.html; http://helpx.adobe.com/security/products/reader/apsb14-15.html
CVE: CVE-2014-0529
Published: 2014-05-14
Description: Buffer overflow in Adobe Reader and Acrobat 10.x before 10.1.10 and 11.x before 11.0.07 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://helpx.adobe.com/security/products/reader/apsb14-15.html; http://www.securityfocus.com/bid/67362; http://helpx.adobe.com/security/products/reader/apsb14-15.html
CVE: CVE-2014-1740
Published: 2014-05-14
Description: Multiple use-after-free vulnerabilities in net/websockets/websocket_job.cc in the WebSockets implementation in Google Chrome before 34.0.1847.137 allow remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to WebSocketJob deletion.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://googlechromereleases.blogspot.com/2014/05/stable-channel-update.html; http://lists.opensuse.org/opensuse-updates/2014-06/msg00023.html; http://secunia.com/advisories/59155
CVE: CVE-2014-1741
Published: 2014-05-14
Description: Multiple integer overflows in the replace-data functionality in the CharacterData interface implementation in core/dom/CharacterData.cpp in Blink, as used in Google Chrome before 34.0.1847.137, allow remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to ranges.
CVSS Score: 7.5 (HIGH)
CWE: CWE-189
References: http://googlechromereleases.blogspot.com/2014/05/stable-channel-update.html; http://lists.opensuse.org/opensuse-updates/2014-06/msg00023.html; http://secunia.com/advisories/59155
CVE: CVE-2014-1742
Published: 2014-05-14
Description: Use-after-free vulnerability in the FrameSelection::updateAppearance function in core/editing/FrameSelection.cpp in Blink, as used in Google Chrome before 34.0.1847.137, allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging improper RenderObject handling.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://googlechromereleases.blogspot.com/2014/05/stable-channel-update.html; http://lists.opensuse.org/opensuse-updates/2014-06/msg00023.html; http://secunia.com/advisories/59155
CVE: CVE-2014-1754
Published: 2014-05-14
Description: Cross-site scripting (XSS) vulnerability in Microsoft SharePoint Server 2013 Gold and SP1, SharePoint Foundation 2013 Gold and SP1, Office Web Apps Server 2013 Gold and SP1, and SharePoint Server 2013 Client Components SDK allows remote attackers to inject arbitrary web script or HTML via a crafted request, aka "SharePoint XSS Vulnerability."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/67288; http://www.securitytracker.com/id/1030227; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-022
CVE: CVE-2014-1756
Published: 2014-05-14
Description: Untrusted search path vulnerability in Microsoft Office 2007 SP3, 2010 SP1 and SP2, and 2013 Gold, SP1, RT, and RT SP1, when the Simplified Chinese Proofing Tool is enabled, allows local users to gain privileges via a Trojan horse DLL in the current working directory, as demonstrated by a directory that contains a .docx file, aka "Microsoft Office Chinese Grammar Checking Vulnerability."
CVSS Score: 9.3 (HIGH)
References: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-023; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-023
CVE: CVE-2014-1806
Published: 2014-05-14
Description: The .NET Remoting implementation in Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, 4.5, and 4.5.1 does not properly restrict memory access, which allows remote attackers to execute arbitrary code via vectors involving malformed objects, aka "TypeFilterLevel Vulnerability."
CVSS Score: 10.0 (HIGH)
CWE: CWE-94
References: http://www.securityfocus.com/bid/67286; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-026; http://www.securityfocus.com/bid/67286
CVE: CVE-2014-1807
Published: 2014-05-14
Description: The ShellExecute API in Windows Shell in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly implement file associations, which allows local users to gain privileges via a crafted application, as exploited in the wild in May 2014, aka "Windows Shell File Association Vulnerability."
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://www.securityfocus.com/bid/67276; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-027; http://www.securityfocus.com/bid/67276
CVE: CVE-2014-1808
Published: 2014-05-14
Description: Microsoft Office 2013 Gold, SP1, RT, and RT SP1 allows remote attackers to obtain sensitive token information via a web site that sends a crafted response during opening of an Office document, aka "Token Reuse Vulnerability."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-023; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-023
CVE: CVE-2014-1809
Published: 2014-05-14
Description: The MSCOMCTL library in Microsoft Office 2007 SP3, 2010 SP1 and SP2, and 2013 Gold, SP1, RT, and RT SP1 makes it easier for remote attackers to bypass the ASLR protection mechanism via a crafted web site, as exploited in the wild in May 2014, aka "MSCOMCTL ASLR Vulnerability."
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-024; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-024
CVE: CVE-2014-1812
Published: 2014-05-14
Description: The Group Policy implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 does not properly handle distribution of passwords, which allows remote authenticated users to obtain sensitive credential information and consequently gain privileges by leveraging access to the SYSVOL share, as exploited in the wild in May 2014, aka "Group Policy Preferences Password Elevation of Privilege Vulnerability."
CVSS Score: 8.8 (HIGH)
CWE: CWE-255, CWE-522
References: http://blogs.technet.com/b/srd/archive/2014/05/13/ms14-025-an-update-for-group-policy-preferences.aspx; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-025; http://blogs.technet.com/b/srd/archive/2014/05/13/ms14-025-an-update-for-group-policy-preferences.aspx
CVE: CVE-2014-1813
Published: 2014-05-14
Description: Microsoft Web Applications 2010 SP1 and SP2 allows remote authenticated users to execute arbitrary code via crafted page content, aka "Web Applications Page Content Vulnerability."
CVSS Score: 8.5 (HIGH)
CWE: CWE-94
References: http://www.securitytracker.com/id/1030227; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-022; http://www.securitytracker.com/id/1030227
CVE: CVE-2014-1815
Published: 2014-05-14
Description: Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, as exploited in the wild in May 2014, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0310.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-029; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-029
CVE: CVE-2011-5249
Published: 2014-05-14
Description: Cross-site scripting (XSS) vulnerability in the events page in the System iNtrusion Analysis and Reporting Environment (SNARE) for Linux agent before 1.7.0 allows remote attackers to inject arbitrary web script or HTML via a logged shell command.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2012-12/0077.html; http://rpmfind.net/linux/RPM/sourceforge/s/sn/snare/Snare%20for%20Linux/1.7.0/SnareLinux-1.7.0-0.i386.html; http://archives.neohapsis.com/archives/bugtraq/2012-12/0077.html
CVE: CVE-2013-1765
Published: 2014-05-14
Description: Multiple cross-site scripting (XSS) vulnerabilities in jwplayer.swf in the smart-flv plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) link or (2) playerready parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/90606; http://seclists.org/oss-sec/2013/q1/446; http://www.securityfocus.com/bid/58135
CVE: CVE-2013-2034
Published: 2014-05-14
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in Jenkins before 1.514, LTS before 1.509.1, and Enterprise 1.466.x before 1.466.14.1 and 1.480.x before 1.480.4.1 allow remote attackers to hijack the authentication of administrators for requests that (1) execute arbitrary code or (2) initiate deployment of binaries to a Maven repository via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://osvdb.org/92981; http://www.cloudbees.com/jenkins-advisory/jenkins-security-advisory-2013-05-02.cb; http://osvdb.org/92981
CVE: CVE-2013-2087
Published: 2014-05-14
Description: Multiple cross-site scripting (XSS) vulnerabilities in Gallery 3 before 3.0.7 allow remote attackers to inject arbitrary web script or HTML via the (1) movie title to modules/gallery/controllers/movies.php or (2) key variable to modules/gallery/views/error_admin.html.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://galleryproject.org/gallery_3_0_7; http://osvdb.org/92691; http://osvdb.org/92740
CVE: CVE-2013-2226
Published: 2014-05-14
Description: Multiple SQL injection vulnerabilities in GLPI before 0.83.9 allow remote attackers to execute arbitrary SQL commands via the (1) users_id_assign parameter to ajax/ticketassigninformation.php, (2) filename parameter to front/document.form.php, or (3) table parameter to ajax/comments.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.glpi-project.org/spip.php?page=annonce&id_breve=297&lang=en&debut_autres_breves=; http://www.securityfocus.com/bid/60693; http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5146.php
CVE: CVE-2013-2700
Published: 2014-05-14
Description: Cross-site request forgery (CSRF) vulnerability in the Add/Edit page (adminmenus.php) in the WP125 plugin before 1.5.0 for WordPress allows remote attackers to hijack the authentication of administrators for requests that add or edit an ad via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://osvdb.org/92113; http://secunia.com/advisories/52876; http://wordpress.org/plugins/wp125/changelog
CVE: CVE-2013-3514
Published: 2014-05-14
Description: Multiple directory traversal vulnerabilities in OpenX before 2.8.10 revision 82710 allow remote administrators to read arbitrary files via a .. (dot dot) in the group parameter to (1) plugin-preferences.php or (2) plugin-settings.php in www/admin, a different vulnerability than CVE-2013-7376.  NOTE: this can be leveraged using CSRF to allow remote unauthenticated attackers to read arbitrary files.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/94778; http://seclists.org/bugtraq/2013/Jul/27; https://www.htbridge.com/advisory/HTB23155
CVE: CVE-2013-4455
Published: 2014-05-14
Description: Katello Installer before 0.0.18 uses world-readable permissions for /etc/pki/tls/private/katello-node.key when deploying a child Pulp node, which allows local users to obtain the private key by reading the file.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: https://bugzilla.redhat.com/show_bug.cgi?id=1021784; https://github.com/Katello/katello-installer/commit/15e01086bcb3f5d42525730e8b162bca11bec85e; https://bugzilla.redhat.com/show_bug.cgi?id=1021784
CVE: CVE-2013-4468
Published: 2014-05-14
Description: VICIDIAL dialer (aka Asterisk GUI client) 2.8-403a, 2.7, 2.7RC1, and earlier allows remote authenticated users to execute arbitrary commands via shell metacharacters in the extension parameter in an OriginateVDRelogin action to manager_send.php.
CVSS Score: 6.5 (MEDIUM)
References: http://www.exploit-db.com/exploits/29513; http://www.openwall.com/lists/oss-security/2013/10/23/10; http://www.openwall.com/lists/oss-security/2013/10/25/1
CVE: CVE-2013-4471
Published: 2014-05-14
Description: The Identity v3 API in OpenStack Dashboard (Horizon) before 2013.2 does not require the current password when changing passwords for user accounts, which makes it easier for remote attackers to change a user password by leveraging the authentication token for that user.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-287
References: http://lists.openstack.org/pipermail/openstack/2013-November/003299.html; https://bugs.launchpad.net/horizon/+bug/1237989; http://lists.openstack.org/pipermail/openstack/2013-November/003299.html
CVE: CVE-2013-5655
Published: 2014-05-14
Description: Directory traversal vulnerability in the FTP server in YingZhi Python Programming Language for iOS 1.9 allows remote attackers to read and possibly write arbitrary files via a .. (dot dot) in the default URI.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/96719; http://www.openwall.com/lists/oss-security/2013/08/29/8; http://www.openwall.com/lists/oss-security/2013/08/30/2