deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-0535
Published: 2014-06-11
Description: Adobe Flash Player before 13.0.0.223 and 14.x before 14.0.0.125 on Windows and OS X and before 11.2.202.378 on Linux, Adobe AIR before 14.0.0.110, Adobe AIR SDK before 14.0.0.110, and Adobe AIR SDK & Compiler before 14.0.0.110 allow attackers to bypass intended access restrictions via unspecified vectors, a different vulnerability than CVE-2014-0534.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://helpx.adobe.com/security/products/flash-player/apsb14-16.html; http://lists.opensuse.org/opensuse-security-announce/2014-06/msg00021.html; http://lists.opensuse.org/opensuse-updates/2014-06/msg00029.html
CVE: CVE-2014-0536
Published: 2014-06-11
Description: Adobe Flash Player before 13.0.0.223 and 14.x before 14.0.0.125 on Windows and OS X and before 11.2.202.378 on Linux, Adobe AIR before 14.0.0.110, Adobe AIR SDK before 14.0.0.110, and Adobe AIR SDK & Compiler before 14.0.0.110 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://helpx.adobe.com/security/products/flash-player/apsb14-16.html; http://lists.opensuse.org/opensuse-security-announce/2014-06/msg00021.html; http://lists.opensuse.org/opensuse-updates/2014-06/msg00029.html
CVE: CVE-2014-1533
Published: 2014-06-11
Description: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 30.0, Firefox ESR 24.x before 24.6, and Thunderbird before 24.6 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
CVSS Score: 10.0 (HIGH)
References: http://linux.oracle.com/errata/ELSA-2014-0741.html; http://linux.oracle.com/errata/ELSA-2014-0742.html; http://lists.opensuse.org/opensuse-security-announce/2014-06/msg00019.html
CVE: CVE-2014-1534
Published: 2014-06-11
Description: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 30.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2014-06/msg00019.html; http://lists.opensuse.org/opensuse-security-announce/2014-06/msg00023.html; http://lists.opensuse.org/opensuse-updates/2014-06/msg00040.html
CVE: CVE-2014-1536
Published: 2014-06-11
Description: The PropertyProvider::FindJustificationRange function in Mozilla Firefox before 30.0 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read) via unspecified vectors.
CVSS Score: 10.0 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2014-06/msg00019.html; http://lists.opensuse.org/opensuse-security-announce/2014-06/msg00023.html; http://lists.opensuse.org/opensuse-updates/2014-06/msg00040.html
CVE: CVE-2014-1537
Published: 2014-06-11
Description: Use-after-free vulnerability in the mozilla::dom::workers::WorkerPrivateParent function in Mozilla Firefox before 30.0 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.
CVSS Score: 10.0 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2014-06/msg00019.html; http://lists.opensuse.org/opensuse-security-announce/2014-06/msg00023.html; http://lists.opensuse.org/opensuse-updates/2014-06/msg00040.html
CVE: CVE-2014-1538
Published: 2014-06-11
Description: Use-after-free vulnerability in the nsTextEditRules::CreateMozBR function in Mozilla Firefox before 30.0, Firefox ESR 24.x before 24.6, and Thunderbird before 24.6 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.
CVSS Score: 10.0 (HIGH)
References: http://linux.oracle.com/errata/ELSA-2014-0741.html; http://linux.oracle.com/errata/ELSA-2014-0742.html; http://lists.opensuse.org/opensuse-security-announce/2014-06/msg00019.html
CVE: CVE-2014-1539
Published: 2014-06-11
Description: Mozilla Firefox before 30.0 and Thunderbird through 24.6 on OS X do not ensure visibility of the cursor after interaction with a Flash object and a DIV element, which makes it easier for remote attackers to conduct clickjacking attacks via JavaScript code that produces a fake cursor image.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-updates/2014-06/msg00040.html; http://lists.opensuse.org/opensuse-updates/2014-07/msg00001.html; http://secunia.com/advisories/59171
CVE: CVE-2014-1540
Published: 2014-06-11
Description: Use-after-free vulnerability in the nsEventListenerManager::CompileEventHandlerInternal function in the Event Listener Manager in Mozilla Firefox before 30.0 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via crafted web content.
CVSS Score: 9.3 (HIGH)
References: http://lists.opensuse.org/opensuse-updates/2014-06/msg00040.html; http://lists.opensuse.org/opensuse-updates/2014-07/msg00001.html; http://secunia.com/advisories/59052
CVE: CVE-2014-1541
Published: 2014-06-11
Description: Use-after-free vulnerability in the RefreshDriverTimer::TickDriver function in the SMIL Animation Controller in Mozilla Firefox before 30.0, Firefox ESR 24.x before 24.6, and Thunderbird before 24.6 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via crafted web content.
CVSS Score: 10.0 (HIGH)
References: http://linux.oracle.com/errata/ELSA-2014-0741.html; http://linux.oracle.com/errata/ELSA-2014-0742.html; http://lists.opensuse.org/opensuse-security-announce/2014-06/msg00019.html
CVE: CVE-2014-1542
Published: 2014-06-11
Description: Buffer overflow in the Speex resampler in the Web Audio subsystem in Mozilla Firefox before 30.0 allows remote attackers to execute arbitrary code via vectors related to a crafted AudioBuffer channel count and sample rate.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-updates/2014-06/msg00040.html; http://lists.opensuse.org/opensuse-updates/2014-07/msg00001.html; http://secunia.com/advisories/59052
CVE: CVE-2014-1543
Published: 2014-06-11
Description: Multiple heap-based buffer overflows in the navigator.getGamepads function in the Gamepad API in Mozilla Firefox before 30.0 allow remote attackers to execute arbitrary code by using non-contiguous axes with a (1) physical or (2) virtual Gamepad device.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-updates/2014-06/msg00040.html; http://lists.opensuse.org/opensuse-updates/2014-07/msg00001.html; http://secunia.com/advisories/59171
CVE: CVE-2014-1545
Published: 2014-06-11
Description: Mozilla Netscape Portable Runtime (NSPR) before 4.10.6 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds write) via vectors involving the sprintf and console functions.
CVSS Score: 10.0 (HIGH)
References: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761; http://lists.opensuse.org/opensuse-security-announce/2014-06/msg00019.html; http://lists.opensuse.org/opensuse-security-announce/2014-06/msg00023.html
CVE: CVE-2014-3154
Published: 2014-06-11
Description: Use-after-free vulnerability in the ChildThread::Shutdown function in content/child/child_thread.cc in the filesystem API in Google Chrome before 35.0.1916.153 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to a Blink shutdown.
CVSS Score: 7.5 (HIGH)
References: http://googlechromereleases.blogspot.com/2014/06/stable-channel-update.html; http://secunia.com/advisories/58585; http://secunia.com/advisories/59090
CVE: CVE-2014-3155
Published: 2014-06-11
Description: net/spdy/spdy_write_queue.cc in the SPDY implementation in Google Chrome before 35.0.1916.153 allows remote attackers to cause a denial of service (out-of-bounds read) by leveraging incorrect queue maintenance.
CVSS Score: 5.0 (MEDIUM)
References: http://googlechromereleases.blogspot.com/2014/06/stable-channel-update.html; http://secunia.com/advisories/58585; http://secunia.com/advisories/59090
CVE: CVE-2014-3156
Published: 2014-06-11
Description: Buffer overflow in the clipboard implementation in Google Chrome before 35.0.1916.153 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger unexpected bitmap data, related to content/renderer/renderer_clipboard_client.cc and content/renderer/webclipboard_impl.cc.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://googlechromereleases.blogspot.com/2014/06/stable-channel-update.html; http://secunia.com/advisories/58585; http://secunia.com/advisories/59090
CVE: CVE-2014-3157
Published: 2014-06-11
Description: Heap-based buffer overflow in the FFmpegVideoDecoder::GetVideoBuffer function in media/filters/ffmpeg_video_decoder.cc in Google Chrome before 35.0.1916.153 allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging VideoFrame data structures that are too small for proper interaction with an underlying FFmpeg library.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://googlechromereleases.blogspot.com/2014/06/stable-channel-update.html; http://secunia.com/advisories/58585; http://secunia.com/advisories/59090
CVE: CVE-2010-5300
Published: 2014-06-11
Description: Stack-based buffer overflow in Jzip 1.3 through 2.0.0.132900 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long file name in a zip archive.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://osvdb.org/show/osvdb/65041; http://packetstormsecurity.com/files/126216/Jzip-2.0.0.132900-Buffer-Overflow.html; http://seclists.org/fulldisclosure/2010/Apr/79
CVE: CVE-2011-3625
Published: 2014-06-11
Description: Stack-based buffer overflow in the sub_read_line_sami function in subreader.c in MPlayer, as used in SMPlayer 0.6.9, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in a SAMI subtitle file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://git.mplayer2.org/mplayer2/commit/?id=27b88a09c5319deb62221b8cd0ecc14cd1136e4a; http://secunia.com/advisories/55486; http://security.gentoo.org/glsa/glsa-201310-13.xml
CVE: CVE-2014-0249
Published: 2014-06-11
Description: The System Security Services Daemon (SSSD) 1.11.6 does not properly identify group membership when a non-POSIX group is in a group membership chain, which allows local users to bypass access restrictions via unspecified vectors.
CVSS Score: 3.3 (LOW)
CWE: CWE-264
References: https://bugzilla.redhat.com/show_bug.cgi?id=1101751; https://lists.fedorahosted.org/pipermail/sssd-devel/2014-May/019495.html; https://bugzilla.redhat.com/show_bug.cgi?id=1101751
CVE: CVE-2014-2977
Published: 2014-06-11
Description: Multiple integer signedness errors in the Dispatch_Write function in proxy/dispatcher/idirectfbsurface_dispatcher.c in DirectFB 1.4.13 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via the Voodoo interface, which triggers a stack-based buffer overflow.
CVSS Score: 10.0 (HIGH)
CWE: CWE-189
References: http://advisories.mageia.org/MGASA-2015-0176.html; http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00019.html; http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00003.html
CVE: CVE-2014-2978
Published: 2014-06-11
Description: The Dispatch_Write function in proxy/dispatcher/idirectfbsurface_dispatcher.c in DirectFB 1.4.4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via the Voodoo interface, which triggers an out-of-bounds write.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://advisories.mageia.org/MGASA-2015-0176.html; http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00019.html; http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00003.html
CVE: CVE-2014-3004
Published: 2014-06-11
Description: The default configuration for the Xerces SAX Parser in Castor before 1.3.3 allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XML document.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-611
References: http://lists.opensuse.org/opensuse-updates/2014-06/msg00043.html; http://packetstormsecurity.com/files/126854/Castor-Library-XXE-Disclosure.html; http://seclists.org/fulldisclosure/2014/May/142
CVE: CVE-2014-3781
Published: 2014-06-11
Description: The dcXmlRpc::setUser method in nc/core/class.dc.xmlrpc.php in Dotclear before 2.6.3 allows remote attackers to bypass authentication via an empty password in an XML-RPC request.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-287
References: http://dotclear.org/blog/post/2014/05/16/Dotclear-2.6.3; http://karmainsecurity.com/KIS-2014-05; http://packetstormsecurity.com/files/126766/Dotclear-2.6.2-Authentication-Bypass.html
CVE: CVE-2014-3782
Published: 2014-06-11
Description: Multiple incomplete blacklist vulnerabilities in the filemanager::isFileExclude method in the Media Manager in Dotclear before 2.6.3 allow remote authenticated users to execute arbitrary PHP code by uploading a file with a (1) double extension or (2) .php5, (3) .phtml, or some other PHP file extension.
CVSS Score: 6.0 (MEDIUM)
References: http://dotclear.org/blog/post/2014/05/16/Dotclear-2.6.3; http://karmainsecurity.com/KIS-2014-06; http://seclists.org/fulldisclosure/2014/May/108
CVE: CVE-2014-3850
Published: 2014-06-11
Description: Cross-site request forgery (CSRF) vulnerability in the Member Approval plugin 131109 for WordPress allows remote attackers to hijack the authentication of administrators for requests that change plugin settings to their default and disable registration approval via a request to wp-admin/options-general.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://seclists.org/fulldisclosure/2014/Jun/63; https://security.dxw.com/advisories/csrf-in-member-approval-131109-permits-unapproved-registrations; http://seclists.org/fulldisclosure/2014/Jun/63
CVE: CVE-2014-3911
Published: 2014-06-11
Description: Samsung iPOLiS Device Manager before 1.8.7 allow remote attackers to execute arbitrary code via unspecified values to the (1) Start, (2) ChangeControlLocalName, (3) DeleteDeviceProfile, (4) FrameAdvanceReader, or other unknown method in the XNSSDKDEVICE.XnsSdkDeviceCtrlForIpInstaller.1 ActiveX control.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://update.websamsung.net/Tools/iPOLiS%20Device%20Manager/iPOLiS%20Device%20Manager_v1.8.7_setup_Full.zip; http://www.securityfocus.com/bid/67822; http://www.zerodayinitiative.com/advisories/ZDI-14-167/
CVE: CVE-2014-3915
Published: 2014-06-11
Description: The userRequest servlet in the Admin Center for Tivoli Storage Manager in Rocket Servergraph allows remote attackers to execute arbitrary commands via a (1) auth, (2) auth_session, (3) auth_simple, (4) add, (5) add_flat, (6) remove, (7) set_pwd, (8) add_permissions, (9) revoke_permissions, (10) runAsync, or (11) tsmRequest command.
CVSS Score: 10.0 (HIGH)
CWE: CWE-94
References: http://www.securityfocus.com/bid/67780; http://www.zerodayinitiative.com/advisories/ZDI-14-164/; http://www.securityfocus.com/bid/67780
CVE: CVE-2014-3970
Published: 2014-06-11
Description: The pa_rtp_recv function in modules/rtp/rtp.c in the module-rtp-recv module in PulseAudio 5.0 and earlier allows remote attackers to cause a denial of service (assertion failure and abort) via an empty UDP packet.
CVSS Score: 2.9 (LOW)
References: http://advisories.mageia.org/MGASA-2014-0440.html; http://lists.freedesktop.org/archives/pulseaudio-discuss/2014-May/020740.html; http://seclists.org/oss-sec/2014/q2/429
CVE: CVE-2014-3980
Published: 2014-06-11
Description: libfep 0.0.5 before 0.1.0 does not properly use UNIX domain sockets in the abstract namespace, which allows local users to gain privileges via unspecified vectors.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-264
References: http://www.openwall.com/lists/oss-security/2014/06/05/16; http://www.openwall.com/lists/oss-security/2014/06/06/11; http://www.securityfocus.com/bid/67903
CVE: CVE-2014-4032
Published: 2014-06-11
Description: Cross-site scripting (XSS) vulnerability in apps/app_comment/form_comment.php in Fiyo CMS 1.5.7 allows remote attackers to inject arbitrary web script or HTML via the Nama field.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/126856/Fiyo-CMS-1.5.7-Cross-Site-Scripting.html; http://secunia.com/advisories/58833; http://www.securityfocus.com/bid/67729
CVE: CVE-2014-4033
Published: 2014-06-11
Description: Cross-site scripting (XSS) vulnerability in libraries/includes/personal/profile.php in Epignosis eFront 3.6.14.4 allows remote attackers to inject arbitrary web script or HTML via the surname parameter to student.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/127006/eFront-3.6.14.4-Cross-Site-Scripting.html; http://www.exploit-db.com/exploits/33697; http://www.securityfocus.com/bid/67946
CVE: CVE-2014-4034
Published: 2014-06-11
Description: SQL injection vulnerability in zero_view_article.php in ZeroCMS 1.0 allows remote attackers to execute arbitrary SQL commands via the article_id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/127005/ZeroCMS-1.0-SQL-Injection.html; http://packetstormsecurity.com/files/130192/ZeroCMS-1.3.3-SQL-Injection.html; http://seclists.org/fulldisclosure/2015/Feb/4
CVE: CVE-2014-4035
Published: 2014-06-11
Description: Cross-site scripting (XSS) vulnerability in booking_details.php in Best Soft Inc. (BSI) Advance Hotel Booking System 2.0 allows remote attackers to inject arbitrary web script or HTML via the title parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/126949/BSI-Advance-Hotel-Booking-System-2.0-Cross-Site-Scripting.html; http://packetstormsecurity.com/files/154024/BSI-Advance-Hotel-Booking-System-2.0-Cross-Site-Scripting.html; http://www.securityfocus.com/bid/67914
CVE: CVE-2014-4036
Published: 2014-06-11
Description: Cross-site scripting (XSS) vulnerability in modules/system/admin.php in ImpressCMS 1.3.6.1 allows remote attackers to inject arbitrary web script or HTML via the query parameter in a listimg action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/126909/ImpressCMS-1.3.6.1-Cross-Site-Scripting.html; http://packetstormsecurity.com/files/126909/ImpressCMS-1.3.6.1-Cross-Site-Scripting.html
CVE: CVE-2014-4037
Published: 2014-06-11
Description: Cross-site scripting (XSS) vulnerability in editor/dialog/fck_spellerpages/spellerpages/server-scripts/spellchecker.php in FCKeditor before 2.6.11 and earlier allows remote attackers to inject arbitrary web script or HTML via an array key in the textinputs[] parameter, a different issue than CVE-2012-4000.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://ckeditor.com/blog/FCKeditor-2.6.11-Released; http://packetstormsecurity.com/files/126902/FCKeditor-2.6.10-Cross-Site-Scripting.html; http://www.securitytracker.com/id/1030413
CVE: CVE-2014-3859
Published: 2014-06-13
Description: libdns in ISC BIND 9.10.0 before P2 does not properly handle EDNS options, which allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via a crafted packet, as demonstrated by an attack against named, dig, or delv.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/58946; http://www.securityfocus.com/bid/68193; http://www.securitytracker.com/id/1030414
CVE: CVE-2010-5301
Published: 2014-06-13
Description: Stack-based buffer overflow in Kolibri 2.0 allows remote attackers to execute arbitrary code via a long URI in a HEAD request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://osvdb.org/show/osvdb/70808; http://www.exploit-db.com/exploits/15834; http://www.securityfocus.com/bid/45579
CVE: CVE-2012-3521
Published: 2014-06-13
Description: Multiple directory traversal vulnerabilities in the cssgen contrib module in GeSHi before 1.0.8.11 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) geshi-path or (2) geshi-lang-path parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105247.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105273.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105317.html
CVE: CVE-2012-3522
Published: 2014-06-13
Description: Cross-site scripting (XSS) vulnerability in contrib/langwiz.php in GeSHi before 1.0.8.11 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105247.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105273.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105317.html
CVE: CVE-2013-1841
Published: 2014-06-13
Description: Net-Server, when the reverse-lookups option is enabled, does not check if the hostname resolves to the source IP address, which might allow remote attackers to bypass ACL restrictions via the hostname parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://www.openwall.com/lists/oss-security/2013/03/04/10; http://www.openwall.com/lists/oss-security/2013/03/12/2; http://www.securityfocus.com/bid/58309
CVE: CVE-2013-2163
Published: 2014-06-13
Description: Monkey HTTP Daemon (monkeyd) before 1.2.2 allows remote attackers to cause a denial of service (infinite loop) via an offset equal to the file size in the Range HTTP header.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2013/06/10/8; http://www.securityfocus.com/bid/60425; https://exchange.xforce.ibmcloud.com/vulnerabilities/85125
CVE: CVE-2013-2182
Published: 2014-06-13
Description: The Mandril security plugin in Monkey HTTP Daemon (monkeyd) before 1.5.0 allows remote attackers to bypass access restrictions via a crafted URI, as demonstrated by an encoded forward slash.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-264
References: http://bugs.monkey-project.com/ticket/186; http://osvdb.org/94287; http://secunia.com/advisories/53638
CVE: CVE-2013-3663
Published: 2014-06-13
Description: Heap-based buffer overflow in paintlib, as used in Trimble SketchUp (formerly Google SketchUp) before 8 Maintenance 3, allows remote attackers to execute arbitrary code via a crafted RLE8 compressed BMP.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2013-06/0007.html; http://blog.binamuse.com/2013/05/multiple-vulnerabilities-on-sketchup.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/84721
CVE: CVE-2013-3843
Published: 2014-06-13
Description: Stack-based buffer overflow in the mk_request_header_process function in mk_request.c in Monkey HTTP Daemon (monkeyd) before 1.2.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted HTTP header.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2013-06/0015.html; http://bugs.monkey-project.com/ticket/182; http://monkey-project.com/Announcements/v1.2.1