deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-8547
Published: 2014-11-05
Description: libavcodec/gifdec.c in FFmpeg before 2.4.2 does not properly compute image heights, which allows remote attackers to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via crafted GIF data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=8f1457864be8fb[PII_REDACTED]dea1c6492f1dde57; http://www.ffmpeg.org/security.html; http://www.ubuntu.com/usn/USN-2534-1
CVE: CVE-2014-8548
Published: 2014-11-05
Description: Off-by-one error in libavcodec/smc.c in FFmpeg before 2.4.2 allows remote attackers to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via crafted Quicktime Graphics (aka SMC) video data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=c727401aa9d62335e89d118a5b4e202edf39d905; http://www.ffmpeg.org/security.html; http://www.ubuntu.com/usn/USN-2534-1
CVE: CVE-2014-8549
Published: 2014-11-05
Description: libavcodec/on2avc.c in FFmpeg before 2.4.2 does not constrain the number of channels to at most 2, which allows remote attackers to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via crafted On2 data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-189
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=550f3e9df3410b3dd975e590042c0d83e20a8da3; http://www.ffmpeg.org/security.html; https://security.gentoo.org/glsa/201603-06
CVE: CVE-2014-8622
Published: 2014-11-05
Description: Cross-site scripting (XSS) vulnerability in compfight-search.php in the Compfight plugin 1.4 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the search-value parameter.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://downloads.wordpress.org/plugin/compfight.1.5.zip; http://packetstormsecurity.com/files/127430/WordPress-Compfight-1.4-Cross-Site-Scripting.html; http://wordpress.org/plugins/compfight/changelog/
CVE: CVE-2014-2937
Published: 2014-11-06
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2014-3220.  Reason: This candidate is a reservation duplicate of CVE-2014-3220.  Notes: All CVE users should reference CVE-2014-3220 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2014-0995
Published: 2014-11-06
Description: The Standalone Enqueue Server in SAP Netweaver 7.20, 7.01, and earlier allows remote attackers to cause a denial of service (uncontrolled recursion and crash) via a trace level with a wildcard in the Trace Pattern.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://blog.onapsis.com/analyzing-sap-security-notes-october-2014-edition/; http://packetstormsecurity.com/files/128726/SAP-Netweaver-Enqueue-Server-Trace-Pattern-Denial-Of-Service.html; http://seclists.org/fulldisclosure/2014/Oct/76
CVE: CVE-2014-4664
Published: 2014-11-06
Description: Cross-site scripting (XSS) vulnerability in the Wordfence Security plugin before 5.1.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the whoisval parameter on the WordfenceWhois page to wp-admin/admin.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://hacktivity.websecgeeks.com/word-press-firewall-plugin-xss/; http://www.securityfocus.com/archive/1/533907/100/0/threaded; http://www.securityfocus.com/bid/70911
CVE: CVE-2014-5257
Published: 2014-11-06
Description: Multiple cross-site scripting (XSS) vulnerabilities in Forma Lms before 1.2.1 p01 allow remote attackers to inject arbitrary web script or HTML via the (1) id_custom parameter in an amanmenu request or (2) id_game parameter in an alms/games/edit request to appCore/index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/128978/Forma-Lms-1.2.1-Cross-Site-Scripting.html; http://sourceforge.net/projects/forma/files/version%201.x/formalms-v1.2.1-p01.zip/download; http://www.securityfocus.com/archive/1/533905/100/0/threaded
CVE: CVE-2014-7958
Published: 2014-11-06
Description: Cross-site scripting (XSS) vulnerability in admin/htaccess/bpsunlock.php in the BulletProof Security plugin before .51.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the dbhost parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/128977/WordPress-Bulletproof-Security-.51-XSS-SQL-Injection-SSRF.html; http://www.securityfocus.com/archive/1/533904/100/0/threaded; http://www.securityfocus.com/bid/70916
CVE: CVE-2014-7959
Published: 2014-11-06
Description: SQL injection vulnerability in admin/htaccess/bpsunlock.php in the BulletProof Security plugin before .51.1 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the tableprefix parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://packetstormsecurity.com/files/128977/WordPress-Bulletproof-Security-.51-XSS-SQL-Injection-SSRF.html; http://www.securityfocus.com/archive/1/533904/100/0/threaded; http://www.securityfocus.com/bid/70918
CVE: CVE-2014-8351
Published: 2014-11-06
Description: SQL injection vulnerability in info.php in French National Commission on Informatics and Liberty (aka CNIL) CookieViz before 1.0.1 allows remote web servers to execute arbitrary SQL commands via the domain parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/128960/CNIL-CookieViz-Cross-Site-Scripting-SQL-Injection.html; http://seclists.org/fulldisclosure/2014/Nov/3; https://exchange.xforce.ibmcloud.com/vulnerabilities/98454
CVE: CVE-2014-8352
Published: 2014-11-06
Description: Cross-site scripting (XSS) vulnerability in json.php in French National Commission on Informatics and Liberty (aka CNIL) CookieViz allows remote we servers to inject arbitrary web script or HTML via the max_date parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/128960/CNIL-CookieViz-Cross-Site-Scripting-SQL-Injection.html; http://seclists.org/fulldisclosure/2014/Nov/3; https://exchange.xforce.ibmcloud.com/vulnerabilities/98452
CVE: CVE-2014-8483
Published: 2014-11-06
Description: The blowfishECB function in core/cipher.cpp in Quassel IRC 0.10.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a malformed string.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-125
References: http://bugs.quassel-irc.org/issues/1314; http://lists.opensuse.org/opensuse-updates/2014-11/msg00028.html; http://lists.opensuse.org/opensuse-updates/2014-11/msg00046.html
CVE: CVE-2014-8508
Published: 2014-11-06
Description: Cross-site scripting (XSS) vulnerability in s_network.asp in the Denon AVR-3313CI audio/video receiver allows remote attackers to inject arbitrary web script or HTML via unspecified parameters, related to Friendlyname.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/70892; http://www.zerodayinitiative.com/advisories/ZDI-14-371/; http://www.securityfocus.com/bid/70892
CVE: CVE-2014-8653
Published: 2014-11-06
Description: Cross-site scripting (XSS) vulnerability in Compal Broadband Networks (CBN) CH6640E and CG6640E Wireless Gateway 1.0 with firmware CH6640-3.5.11.7-NOSH allows remote attackers to inject arbitrary web script or HTML via the userData cookie.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/show/osvdb/113839; http://packetstormsecurity.com/files/128860/CBN-CH6640E-CG6640E-Wireless-Gateway-XSS-CSRF-DoS-Disclosure.html; http://www.exploit-db.com/exploits/35075
CVE: CVE-2014-8654
Published: 2014-11-06
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in Compal Broadband Networks (CBN) CH6640E and CG6640E Wireless Gateway hardware 1.0 with firmware CH6640-3.5.11.7-NOSH allow remote attackers to hijack the authentication of administrators for requests that (1) have unspecified impact on DDNS configuration via a request to basicDDNS.html, (2) change the wifi password via the psKey parameter to setWirelessSecurity.html, (3) add a static MAC address via the MacAddress parameter in an add_static action to setBasicDHCP1.html, or (4) enable or disable UPnP via the UPnP parameter in an apply action to setAdvancedOptions.html.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://osvdb.org/show/osvdb/113840; http://osvdb.org/show/osvdb/113841; http://osvdb.org/show/osvdb/113842
CVE: CVE-2014-8655
Published: 2014-11-06
Description: The Compal Broadband Networks (CBN) CH6640E and CG6640E Wireless Gateway 1.0 with firmware CH6640-3.5.11.7-NOSH allows remote attackers to bypass authentication and obtain sensitive information via an (a) admin or a (b) root value in the userData cookie in a request to (1) CmgwWirelessSecurity.xml, (2) DocsisConfigFile.xml, or (3) CmgwBasicSetup.xml in xml/ or (4) basicDDNS.html, (5) basicLanUsers.html, or (6) rootDesc.xml.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/show/osvdb/113837; http://packetstormsecurity.com/files/128860/CBN-CH6640E-CG6640E-Wireless-Gateway-XSS-CSRF-DoS-Disclosure.html; http://www.exploit-db.com/exploits/35075
CVE: CVE-2014-8656
Published: 2014-11-06
Description: The Compal Broadband Networks (CBN) CH6640E and CG6640E Wireless Gateway 1.0 with firmware CH6640-3.5.11.7-NOSH have a default password of (1) admin for the admin account and (2) compalbn for the root account, which makes it easier for remote attackers to obtain access to certain sensitive information via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-255
References: http://osvdb.org/show/osvdb/113836; http://packetstormsecurity.com/files/128860/CBN-CH6640E-CG6640E-Wireless-Gateway-XSS-CSRF-DoS-Disclosure.html; http://www.exploit-db.com/exploits/35075
CVE: CVE-2014-8657
Published: 2014-11-06
Description: The Compal Broadband Networks (CBN) CH6640E and CG6640E Wireless Gateway 1.0 with firmware CH6640-3.5.11.7-NOSH allows remote attackers to cause a denial of service (disconnect all wifi clients) via a request to wirelessChannelStatus.html.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-16
References: http://osvdb.org/show/osvdb/113838; http://packetstormsecurity.com/files/128860/CBN-CH6640E-CG6640E-Wireless-Gateway-XSS-CSRF-DoS-Disclosure.html; http://www.exploit-db.com/exploits/35075
CVE: CVE-2014-8658
Published: 2014-11-06
Description: Cross-site scripting (XSS) vulnerability in RefinedWiki Original Theme 3.x before 3.5.13 and 4.x before 4.0.12 for Confluence allows remote authenticated users with permissions to create or edit content to inject arbitrary web script or HTML via the versionComment parameter to pages/doeditpage.action.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-79
References: http://demo.refinedwiki.com/display/rwot/Version+4.0.12; http://packetstormsecurity.com/files/128907/Confluence-RefinedWiki-Original-Theme-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2014/Oct/126
CVE: CVE-2014-8659
Published: 2014-11-06
Description: Directory traversal vulnerability in SAP Environment, Health, and Safety allows remote attackers to read arbitrary files via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://blog.onapsis.com/analyzing-sap-security-notes-october-2014-edition/; http://service.sap.com/sap/support/notes/[PII_REDACTED]; https://erpscan.io/press-center/blog/sap-critical-patch-update-october-2014/
CVE: CVE-2014-8660
Published: 2014-11-06
Description: SAP Document Management Services allows local users to execute arbitrary commands via unspecified vectors.
CVSS Score: 7.2 (HIGH)
CWE: CWE-94
References: http://blog.onapsis.com/analyzing-sap-security-notes-october-2014-edition/; https://erpscan.io/press-center/blog/sap-critical-patch-update-october-2014/; https://service.sap.com/sap/support/notes/1906212
CVE: CVE-2014-8661
Published: 2014-11-06
Description: The SAP CRM Internet Sales module allows remote attackers to execute arbitrary commands via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-94
References: http://blog.onapsis.com/analyzing-sap-security-notes-october-2014-edition/; http://service.sap.com/sap/support/notes/[PII_REDACTED]; http://blog.onapsis.com/analyzing-sap-security-notes-october-2014-edition/
CVE: CVE-2014-8662
Published: 2014-11-06
Description: Unspecified vulnerability in SAP Payroll Process allows remote attackers to cause a denial of service via vectors related to session handling.
CVSS Score: 7.8 (HIGH)
References: http://blog.onapsis.com/analyzing-sap-security-notes-october-2014-edition/; http://service.sap.com/sap/support/notes/[PII_REDACTED]; http://blog.onapsis.com/analyzing-sap-security-notes-october-2014-edition/
CVE: CVE-2014-8663
Published: 2014-11-06
Description: SQL injection vulnerability in Data Basis (BW-WHM-DBA) in SAP NetWeaver Business Warehouse allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://blog.onapsis.com/analyzing-sap-security-notes-october-2014-edition/; http://service.sap.com/sap/support/notes/[PII_REDACTED]; http://blog.onapsis.com/analyzing-sap-security-notes-october-2014-edition/
CVE: CVE-2014-8664
Published: 2014-11-06
Description: SQL injection vulnerability in Product Safety (EHS-SAF) component in SAP Environment, Health, and Safety Management allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://blog.onapsis.com/analyzing-sap-security-notes-october-2014-edition/; http://service.sap.com/sap/support/notes/[PII_REDACTED]; http://www.securityfocus.com/bid/71025
CVE: CVE-2014-8665
Published: 2014-11-06
Description: The SAP Business Intelligence Development Workbench allows remote attackers to obtain sensitive information by reading unspecified files.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://blog.onapsis.com/analyzing-sap-security-notes-october-2014-edition/; http://service.sap.com/sap/support/notes/[PII_REDACTED]; http://blog.onapsis.com/analyzing-sap-security-notes-october-2014-edition/
CVE: CVE-2014-8666
Published: 2014-11-06
Description: The User & Server configuration, InfoView refresh, user rights (BI-BIP-ADM) component in SAP Business Intellignece allows remote attackers to obtain audit event details via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://blog.onapsis.com/analyzing-sap-security-notes-october-2014-edition/; http://service.sap.com/sap/support/notes/[PII_REDACTED]; http://blog.onapsis.com/analyzing-sap-security-notes-october-2014-edition/
CVE: CVE-2014-8667
Published: 2014-11-06
Description: Cross-site scripting (XSS) vulnerability in SAP HANA Web-based Development Workbench allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://blog.onapsis.com/analyzing-sap-security-notes-october-2014-edition/; http://service.sap.com/sap/support/notes/[PII_REDACTED]; http://blog.onapsis.com/analyzing-sap-security-notes-october-2014-edition/
CVE: CVE-2014-8668
Published: 2014-11-06
Description: SQL injection vulnerability in SAP Contract Accounting allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://blog.onapsis.com/analyzing-sap-security-notes-october-2014-edition/; http://service.sap.com/sap/support/notes/[PII_REDACTED]; http://www.securityfocus.com/bid/71032
CVE: CVE-2014-8669
Published: 2014-11-06
Description: The SAP Promotion Guidelines (CRM-MKT-MPL-TPM-PPG) module for SAP CRM allows remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-94
References: http://blog.onapsis.com/analyzing-sap-security-notes-october-2014-edition/; http://service.sap.com/sap/support/notes/[PII_REDACTED]; http://service.sap.com/sap/support/notes/[PII_REDACTED]
CVE: CVE-2014-8670
Published: 2014-11-06
Description: Open redirect vulnerability in go.php in vBulletin 4.2.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the url parameter.
CVSS Score: 5.8 (MEDIUM)
References: http://packetstormsecurity.com/files/128958/vBulletin-4.2.1-Open-Redirect.html; http://www.securityfocus.com/bid/70906; https://exchange.xforce.ibmcloud.com/vulnerabilities/98476
CVE: CVE-2014-5258
Published: 2014-11-06
Description: Directory traversal vulnerability in showTempFile.php in webEdition CMS before 6.3.9.0 Beta allows remote authenticated users to read arbitrary files via a .. (dot dot) in the file parameter.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.com/files/128301/webEdition-6.3.8.0-Path-Traversal.html; http://www.securityfocus.com/archive/1/533465/100/0/threaded; http://www.webedition.org/de/aktuelles/webedition-cms/webEdition-6.3.9-Beta-erschienen
CVE: CVE-2014-5451
Published: 2014-11-06
Description: Cross-site scripting (XSS) vulnerability in manager/templates/default/header.tpl in MODX Revolution 2.3.1-pl and earlier allows remote attackers to inject arbitrary web script or HTML via the "a" parameter to manager/.  NOTE: this issue exists because of a CVE-2014-2080 regression.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/128302/MODX-Revolution-2.3.1-pl-Cross-Site-Scripting.html; http://www.securityfocus.com/archive/1/533466/100/0/threaded; http://www.securityfocus.com/bid/69884
CVE: CVE-2014-6030
Published: 2014-11-06
Description: Multiple SQL injection vulnerabilities in ClassApps SelectSurvey.NET before 4.125.002 allow (1) remote attackers to execute arbitrary SQL commands via the SurveyID parameter to survey/ReviewReadOnlySurvey.aspx or (2) remote authenticated users to execute arbitrary SQL commands via the SurveyID parameter to survey/UploadImagePopupToDb.aspx.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://packetstormsecurity.com/files/128296/ClassApps-SelectSurvey.net-4.124.004-SQL-Injection.html; http://seclists.org/fulldisclosure/2014/Sep/62; http://packetstormsecurity.com/files/128296/ClassApps-SelectSurvey.net-4.124.004-SQL-Injection.html
CVE: CVE-2014-2177
Published: 2014-11-07
Description: The network-diagnostics administration interface in the Cisco RV router firmware on RV220W devices, before 1.0.5.9 on RV120W devices, and before 1.0.4.14 on RV180 and RV180W devices allows remote authenticated users to execute arbitrary commands via a crafted HTTP request, aka Bug ID CSCuh87126.
CVSS Score: 9.0 (HIGH)
CWE: CWE-94
References: http://packetstormsecurity.com/files/128992/Cisco-RV-Overwrite-CSRF-Command-Execution.html; http://seclists.org/fulldisclosure/2014/Nov/6; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20141105-rv
CVE: CVE-2014-2178
Published: 2014-11-07
Description: Cross-site request forgery (CSRF) vulnerability in the administrative web interface in the Cisco RV router firmware on RV220W devices, before 1.0.5.9 on RV120W devices, and before 1.0.4.14 on RV180 and RV180W devices allows remote attackers to hijack the authentication of administrators, aka Bug ID CSCuh87145.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.com/files/128992/Cisco-RV-Overwrite-CSRF-Command-Execution.html; http://seclists.org/fulldisclosure/2014/Nov/6; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20141105-rv
CVE: CVE-2014-2179
Published: 2014-11-07
Description: The Cisco RV router firmware on RV220W devices, before 1.0.5.9 on RV120W devices, and before 1.0.4.14 on RV180 and RV180W devices allows remote attackers to upload files to arbitrary locations via a crafted HTTP request, aka Bug ID CSCuh86998.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://packetstormsecurity.com/files/128992/Cisco-RV-Overwrite-CSRF-Command-Execution.html; http://seclists.org/fulldisclosure/2014/Nov/6; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20141105-rv
CVE: CVE-2014-3437
Published: 2014-11-07
Description: The management console in Symantec Endpoint Protection Manager (SEPM) 12.1 before RU5 allows remote attackers to read arbitrary files or send TCP requests to intranet servers via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
CVSS Score: 7.5 (HIGH)
References: http://seclists.org/fulldisclosure/2014/Nov/7; http://www.securityfocus.com/archive/1/533918/100/0/threaded; http://www.securityfocus.com/bid/70843
CVE: CVE-2014-3438
Published: 2014-11-07
Description: Multiple cross-site scripting (XSS) vulnerabilities in console interface scripts in Symantec Endpoint Protection Manager (SEPM) 12.1 before RU5 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2014/Nov/7; http://www.securityfocus.com/archive/1/533918/100/0/threaded; http://www.securityfocus.com/bid/70844
CVE: CVE-2014-3439
Published: 2014-11-07
Description: ConsoleServlet in Symantec Endpoint Protection Manager (SEPM) 12.1 before RU5 allows remote attackers to write to arbitrary files via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
References: http://seclists.org/fulldisclosure/2014/Nov/7; http://www.securityfocus.com/archive/1/533918/100/0/threaded; http://www.securityfocus.com/bid/70845
CVE: CVE-2014-4627
Published: 2014-11-07
Description: SQL injection vulnerability in EMC RSA Web Threat Detection 4.x before 4.6.1.1 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: http://archives.neohapsis.com/archives/bugtraq/2014-11/0028.html; http://packetstormsecurity.com/files/128986/RSA-Web-Threat-Detection-SQL-Injection.html; http://www.securityfocus.com/bid/70955
CVE: CVE-2014-5430
Published: 2014-11-07
Description: Untrusted search path vulnerability in ABB RobotStudio 5.6x before 5.61.02 and Test Signal Viewer 1.5 allows local users to gain privileges via a Trojan horse DLL that is accessed as a result of incorrect DLL configuration by an optional installation program.
CVSS Score: 6.9 (MEDIUM)
References: https://ics-cert.us-cert.gov/advisories/ICSA-14-308-01; https://ics-cert.us-cert.gov/advisories/ICSA-14-308-01
CVE: CVE-2014-7988
Published: 2014-11-07
Description: The Unified Messaging Service (UMS) in Cisco Unity Connection 10.5 and earlier allows remote authenticated users to obtain sensitive information by reading log files, aka Bug ID CSCur06493.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://secunia.com/advisories/62106; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-7988; http://tools.cisco.com/security/center/viewAlert.x?alertId=36340
CVE: CVE-2014-7989
Published: 2014-11-07
Description: Cisco Unified Computing System on B-Series blade servers allows local users to gain shell privileges via a crafted (1) ping6 or (2) traceroute6 command, aka Bug ID CSCuq38176.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-7989; http://www.securityfocus.com/bid/70969; http://www.securitytracker.com/id/1031178
CVE: CVE-2014-7990
Published: 2014-11-07
Description: Cisco IOS XE 3.5E and earlier on WS-C3850, WS-C3860, and AIR-CT5760 devices does not properly parse the "request system shell" challenge response, which allows local users to obtain Linux root access by leveraging administrative privilege, aka Bug ID CSCur09815.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-7990; http://tools.cisco.com/security/center/viewAlert.x?alertId=36351; http://www.securityfocus.com/bid/70968
CVE: CVE-2014-8671
Published: 2014-11-07
Description: Cross-site scripting (XSS) vulnerability in the GWT Mobile PhoneGap Showcase application for Android allows remote attackers to inject arbitrary web script or HTML via a crafted Bluetooth Device Name field.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://arxiv.org/abs/1410.7756; http://arxiv.org/pdf/1410.7756v1.pdf; http://arxiv.org/abs/1410.7756