deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-3191
Published: 2014-10-08
Description: Use-after-free vulnerability in Blink, as used in Google Chrome before 38.0.2125.101, allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code that triggers a widget-position update that improperly interacts with the render tree, related to the FrameView::updateLayoutAndStyleForPainting function in core/frame/FrameView.cpp and the RenderLayerScrollableArea::setScrollOffset function in core/rendering/RenderLayerScrollableArea.cpp.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: http://googlechromereleases.blogspot.com/2014/10/stable-channel-update.html; http://rhn.redhat.com/errata/RHSA-2014-1626.html; http://www.securityfocus.com/bid/70273
CVE: CVE-2014-3192
Published: 2014-10-08
Description: Use-after-free vulnerability in the ProcessingInstruction::setXSLStyleSheet function in core/dom/ProcessingInstruction.cpp in the DOM implementation in Blink, as used in Google Chrome before 38.0.2125.101, allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: http://googlechromereleases.blogspot.com/2014/10/stable-channel-update.html; http://lists.apple.com/archives/security-announce/2015/Jan/msg00000.html; http://lists.apple.com/archives/security-announce/2015/Jan/msg00001.html
CVE: CVE-2014-3193
Published: 2014-10-08
Description: The SessionService::GetLastSession function in browser/sessions/session_service.cc in Google Chrome before 38.0.2125.101 allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via vectors that leverage "type confusion" for callback processing.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: http://googlechromereleases.blogspot.com/2014/10/stable-channel-update.html; http://rhn.redhat.com/errata/RHSA-2014-1626.html; http://www.securityfocus.com/bid/70273
CVE: CVE-2014-3194
Published: 2014-10-08
Description: Use-after-free vulnerability in the Web Workers implementation in Google Chrome before 38.0.2125.101 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: http://googlechromereleases.blogspot.com/2014/10/stable-channel-update.html; http://rhn.redhat.com/errata/RHSA-2014-1626.html; http://www.securityfocus.com/bid/70273
CVE: CVE-2014-3195
Published: 2014-10-08
Description: Google V8, as used in Google Chrome before 38.0.2125.101, does not properly track JavaScript heap-memory allocations as allocations of uninitialized memory and does not properly concatenate arrays of double-precision floating-point numbers, which allows remote attackers to obtain sensitive information via crafted JavaScript code, related to the PagedSpace::AllocateRaw and NewSpace::AllocateRaw functions in heap/spaces-inl.h, the LargeObjectSpace::AllocateRaw function in heap/spaces.cc, and the Runtime_ArrayConcat function in runtime.cc.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://googlechromereleases.blogspot.com/2014/10/stable-channel-update.html; http://rhn.redhat.com/errata/RHSA-2014-1626.html; http://www.securityfocus.com/bid/70273
CVE: CVE-2014-3196
Published: 2014-10-08
Description: base/memory/shared_memory_win.cc in Google Chrome before 38.0.2125.101 on Windows does not properly implement read-only restrictions on shared memory, which allows attackers to bypass a sandbox protection mechanism via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://googlechromereleases.blogspot.com/2014/10/stable-channel-update.html; http://www.securityfocus.com/bid/70273; https://crbug.com/338538
CVE: CVE-2014-3197
Published: 2014-10-08
Description: The NavigationScheduler::schedulePageBlock function in core/loader/NavigationScheduler.cpp in Blink, as used in Google Chrome before 38.0.2125.101, does not properly provide substitute data for pages blocked by the XSS auditor, which allows remote attackers to obtain sensitive information via a crafted web site.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://googlechromereleases.blogspot.com/2014/10/stable-channel-update.html; http://rhn.redhat.com/errata/RHSA-2014-1626.html; http://www.securityfocus.com/bid/70273
CVE: CVE-2014-3198
Published: 2014-10-08
Description: The Instance::HandleInputEvent function in pdf/instance.cc in the PDFium component in Google Chrome before 38.0.2125.101 interprets a certain -1 value as an index instead of a no-visible-page error code, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://googlechromereleases.blogspot.com/2014/10/stable-channel-update.html; http://rhn.redhat.com/errata/RHSA-2014-1626.html; http://www.securityfocus.com/bid/70273
CVE: CVE-2014-3199
Published: 2014-10-08
Description: The wrap function in bindings/core/v8/custom/V8EventCustom.cpp in the V8 bindings in Blink, as used in Google Chrome before 38.0.2125.101, has an erroneous fallback outcome for wrapper-selection failures, which allows remote attackers to cause a denial of service via vectors that trigger stopping a worker process that had been handling an Event object.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://googlechromereleases.blogspot.com/2014/10/stable-channel-update.html; http://rhn.redhat.com/errata/RHSA-2014-1626.html; http://www.securityfocus.com/bid/70273
CVE: CVE-2014-3200
Published: 2014-10-08
Description: Multiple unspecified vulnerabilities in Google Chrome before 38.0.2125.101 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://googlechromereleases.blogspot.com/2014/10/stable-channel-update.html; http://rhn.redhat.com/errata/RHSA-2014-1626.html; http://www.securityfocus.com/bid/70273
CVE: CVE-2014-7967
Published: 2014-10-08
Description: Multiple unspecified vulnerabilities in Google V8 before 3.28.71.15, as used in Google Chrome before 38.0.2125.101, allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://googlechromereleases.blogspot.com/2014/10/stable-channel-update.html; http://googlechromereleases.blogspot.com/2014/10/stable-channel-update.html
CVE: CVE-2014-5308
Published: 2014-10-08
Description: Multiple SQL injection vulnerabilities in TestLink 1.9.11 allow remote authenticated users to execute arbitrary SQL commands via the (1) name parameter in a Search action to lib/project/projectView.php or (2) id parameter to lib/events/eventinfo.php.
CVSS Score: 9.0 (HIGH)
CWE: CWE-89
References: http://osvdb.org/show/osvdb/112524; http://packetstormsecurity.com/files/128521/TestLink-1.9.11-SQL-Injection.html; http://seclists.org/fulldisclosure/2014/Oct/11
CVE: CVE-2014-6394
Published: 2014-10-08
Description: visionmedia send before 0.8.4 for Node.js uses a partial comparison for verifying whether a directory is within the document root, which allows remote attackers to access restricted directories, as demonstrated using "public-restricted" under a "public" directory.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://lists.apple.com/archives/security-announce/2015/Sep/msg00002.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-October/139938.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-October/140020.html
CVE: CVE-2014-7185
Published: 2014-10-08
Description: Integer overflow in bufferobject.c in Python before 2.7.8 allows context-dependent attackers to obtain sensitive information from process memory via a large size and offset in a "buffer" function.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-189
References: http://bugs.python.org/issue21831; http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-October/139663.html
CVE: CVE-2014-7205
Published: 2014-10-08
Description: Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for the hapi server framework for Node.js allows remote attackers to execute arbitrary Javascript code via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-94
References: http://www.openwall.com/lists/oss-security/2014/09/30/10; http://www.securityfocus.com/bid/70180; https://exchange.xforce.ibmcloud.com/vulnerabilities/96730
CVE: CVE-2014-7978
Published: 2014-10-08
Description: Cross-site scripting (XSS) vulnerability in the BlueMasters theme 7.x-2.x before 7.x-2.1 for Drupal allows remote authenticated users with the "administer themes" permission to inject arbitrary web script or HTML via vectors related to theme settings.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://secunia.com/advisories/57829; http://www.securityfocus.com/bid/66782; https://exchange.xforce.ibmcloud.com/vulnerabilities/92537
CVE: CVE-2014-7979
Published: 2014-10-08
Description: Cross-site scripting (XSS) vulnerability in the SimpleCorp theme 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with the "administer themes" permission to inject arbitrary web script or HTML via vectors related to theme settings.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://secunia.com/advisories/57828; http://www.securityfocus.com/bid/66768; https://drupal.org/node/2236811
CVE: CVE-2014-7980
Published: 2014-10-08
Description: Multiple cross-site scripting (XSS) vulnerabilities in template.php in Zen theme 7.x-3.x before 7.x-3.3 and 7.x-5.x before 7.x-5.5 for Drupal allow remote authenticated users with the "administer themes" permission to inject arbitrary web script or HTML via the skip_link_text setting and unspecified other theme settings.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://drupal.org/node/2254925; http://secunia.com/advisories/58318; http://www.securityfocus.com/bid/67175
CVE: CVE-2014-3641
Published: 2014-10-08
Description: The (1) GlusterFS and (2) Linux Smbfs drivers in OpenStack Cinder before 2014.1.3 allows remote authenticated users to obtain file data from the Cinder-volume host by cloning and attaching a volume with a crafted qcow2 header.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://rhn.redhat.com/errata/RHSA-2014-1787.html; http://rhn.redhat.com/errata/RHSA-2014-1788.html; http://seclists.org/oss-sec/2014/q4/78
CVE: CVE-2014-5300
Published: 2014-10-08
Description: Adaptive Computing Moab before 7.2.9 and 8 before 8.0.0 allows remote attackers to bypass the signature check, impersonate arbitrary users, and execute commands via a message without a signature.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-287
References: http://packetstormsecurity.com/files/128483/Moab-Dynamic-Configuration-Authentication-Bypass.html; http://www.adaptivecomputing.com/security-advisory/; http://www.exploit-db.com/exploits/34865
CVE: CVE-2014-5375
Published: 2014-10-08
Description: The server in Adaptive Computing Moab before 7.2.9 and 8 before 8.0.0 does not properly validate the message owner matches the submitting user, which allows remote authenticated users to impersonate arbitrary users via the UserId and Owner tags.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-20
References: http://packetstormsecurity.com/files/128484/Moab-User-Impersonation.html; http://www.adaptivecomputing.com/security-advisory/; http://www.securityfocus.com/archive/1/533576/100/0/threaded
CVE: CVE-2014-5376
Published: 2014-10-08
Description: Adaptive Computing Moab before 7.2.9 and 8 before 8.0.0, when a pre-generated key is used, does not validate that the requesting user matches the actor in the message, which allows remote authenticated users to impersonate arbitrary users via the actor field in a message.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-20
References: http://packetstormsecurity.com/files/128485/Moab-Insecure-Message-Signing-Authentication-Bypass.html; http://www.adaptivecomputing.com/security-advisory/; http://www.securityfocus.com/archive/1/533577/100/0/threaded
CVE: CVE-2014-6631
Published: 2014-10-08
Description: Cross-site scripting (XSS) vulnerability in com_media in Joomla! 3.2.x before 3.2.5 and 3.3.x before 3.3.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://developer.joomla.org/security/[PII_REDACTED]1-core-xss-vulnerability.html; http://secunia.com/advisories/61606; http://developer.joomla.org/security/[PII_REDACTED]1-core-xss-vulnerability.html
CVE: CVE-2014-6632
Published: 2014-10-08
Description: Joomla! 2.5.x before 2.5.25, 3.x before 3.2.4, and 3.3.x before 3.3.4 allows remote attackers to authenticate and bypass intended access restrictions via vectors involving LDAP authentication.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://developer.joomla.org/security/[PII_REDACTED]2-core-unauthorised-logins.html; http://secunia.com/advisories/61606; http://secunia.com/advisories/61638
CVE: CVE-2014-7202
Published: 2014-10-08
Description: stream_engine.cpp in libzmq (aka ZeroMQ/C++)) 4.0.5 before 4.0.5 allows man-in-the-middle attackers to conduct downgrade attacks via a crafted connection request.
CVSS Score: 4.3 (MEDIUM)
References: http://lists.opensuse.org/opensuse-updates/2014-11/msg00027.html; http://lists.opensuse.org/opensuse-updates/2014-11/msg00101.html; http://seclists.org/oss-sec/2014/q3/754
CVE: CVE-2014-7203
Published: 2014-10-08
Description: libzmq (aka ZeroMQ/C++) 4.0.x before 4.0.5 does not ensure that nonces are unique, which allows man-in-the-middle attackers to conduct replay attacks via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
References: http://lists.opensuse.org/opensuse-updates/2014-11/msg00027.html; http://lists.opensuse.org/opensuse-updates/2014-11/msg00101.html; http://seclists.org/oss-sec/2014/q3/754
CVE: CVE-2014-7229
Published: 2014-10-08
Description: Unspecified vulnerability in Joomla! before 2.5.4 before 2.5.26, 3.x before 3.2.6, and 3.3.x before 3.3.5 allows attackers to cause a denial of service via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://developer.joomla.org/security/596; http://developer.joomla.org/security/596
CVE: CVE-2014-7230
Published: 2014-10-08
Description: The processutils.execute function in OpenStack oslo-incubator, Cinder, Nova, and Trove before 2013.2.4 and 2014.1 before 2014.1.3 allows local users to obtain passwords from commands that cause a ProcessExecutionError by reading the log.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://rhn.redhat.com/errata/RHSA-2014-1939.html; http://seclists.org/oss-sec/2014/q3/853; http://www.securityfocus.com/bid/70185
CVE: CVE-2014-7231
Published: 2014-10-08
Description: The strutils.mask_password function in the OpenStack Oslo utility library, Cinder, Nova, and Trove before 2013.2.4 and 2014.1 before 2014.1.3 does not properly mask passwords when logging commands, which allows local users to obtain passwords by reading the log.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://rhn.redhat.com/errata/RHSA-2014-1939.html; http://seclists.org/oss-sec/2014/q3/853; http://www.securityfocus.com/bid/70184
CVE: CVE-2014-7296
Published: 2014-10-08
Description: The default configuration in the accessibility engine in SpagoBI 5.0.0 does not set FEATURE_SECURE_PROCESSING, which allows remote authenticated users to execute arbitrary Java code via a crafted XSL document.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://spagoworld.org/jira/browse/SPAGOBI-1885; http://www.securityfocus.com/bid/70240; http://spagoworld.org/jira/browse/SPAGOBI-1885
CVE: CVE-2014-7981
Published: 2014-10-08
Description: SQL injection vulnerability in Joomla! CMS 3.1.x and 3.2.x before 3.2.3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://developer.joomla.org/security/[PII_REDACTED]1-core-sql-injection.html; http://developer.joomla.org/security/[PII_REDACTED]1-core-sql-injection.html
CVE: CVE-2014-7982
Published: 2014-10-08
Description: Cross-site scripting (XSS) vulnerability in Joomla! CMS 2.5.x before 2.5.19 and 3.x before 3.2.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://developer.joomla.org/security/[PII_REDACTED]3-core-xss-vulnerability.html; http://developer.joomla.org/security/[PII_REDACTED]3-core-xss-vulnerability.html
CVE: CVE-2014-7983
Published: 2014-10-08
Description: Cross-site scripting (XSS) vulnerability in com_contact in Joomla! CMS 3.1.2 through 3.2.x before 3.2.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://developer.joomla.org/security/[PII_REDACTED]2-core-xss-vulnerability.html; http://developer.joomla.org/security/[PII_REDACTED]2-core-xss-vulnerability.html
CVE: CVE-2014-7984
Published: 2014-10-08
Description: Joomla! CMS 2.5.x before 2.5.19 and 3.x before 3.2.3 allows remote attackers to authenticate and bypass intended restrictions via vectors involving GMail authentication.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://developer.joomla.org/security/[PII_REDACTED]4-core-unauthorised-logins.html; http://developer.joomla.org/security/[PII_REDACTED]4-core-unauthorised-logins.html
CVE: CVE-2014-8068
Published: 2014-10-09
Description: Adobe Digital Editions (DE) 4 does not use encryption for transmission of data to adelogs.adobe.com, which allows remote attackers to obtain sensitive information by sniffing the network, as demonstrated by book-navigation information.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://arstechnica.com/security/2014/10/adobes-e-book-reader-sends-your-reading-logs-back-to-adobe-in-plain-text/; http://secunia.com/advisories/61551; http://the-digital-reader.com/2014/10/06/adobe-spying-users-collecting-data-ebook-libraries/
CVE: CVE-2014-8075
Published: 2014-10-09
Description: Cross-site scripting (XSS) vulnerability in the Tribune module 6.x-1.x and 7.x-3.x for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a node title.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://osvdb.org/102655; http://www.securityfocus.com/bid/65236; https://exchange.xforce.ibmcloud.com/vulnerabilities/90830
CVE: CVE-2014-8076
Published: 2014-10-09
Description: Cross-site scripting (XSS) vulnerability in the Professional theme 7.x before 7.x-2.04 for Drupal allows remote authenticated users with the "administer themes" permission to inject arbitrary web script or HTML via vectors related to custom copyright information.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://drupal.org/node/2248145; http://secunia.com/advisories/58233; https://exchange.xforce.ibmcloud.com/vulnerabilities/92755
CVE: CVE-2014-8077
Published: 2014-10-09
Description: Cross-site scripting (XSS) vulnerability in the NewsFlash theme 6.x-1.x before 6.x-1.7 and 7.x-1.x before 7.x-2.5 for Drupal allows remote authenticated users with the "administer themes" permission to inject arbitrary web script or HTML via vectors related to font family CSS property.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://secunia.com/advisories/54611; http://www.securityfocus.com/bid/65998; https://exchange.xforce.ibmcloud.com/vulnerabilities/91740
CVE: CVE-2014-8078
Published: 2014-10-09
Description: Cross-site scripting (XSS) vulnerability in the Print (aka Printer, e-mail and PDF versions) module 6.x-1.x before 6.x-1.19, 7.x-1.x before 7.x-1.3, and 7.x-2.x before 7.x-2.0 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via vectors related to nodes.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://secunia.com/advisories/57402; https://drupal.org/node/2231671; https://exchange.xforce.ibmcloud.com/vulnerabilities/92349
CVE: CVE-2014-8079
Published: 2014-10-09
Description: Cross-site scripting (XSS) vulnerability in the MAYO theme 7.x-1.x before 7.x-1.3 for Drupal allows remote authenticated users with the "administer themes" permission to inject arbitrary web script or HTML via vectors related to header background setting.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/103261; http://secunia.com/advisories/56876; http://www.securityfocus.com/bid/65523
CVE: CVE-2013-4488
Published: 2014-10-10
Description: libgadu before 1.12.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-310
References: http://www.mail-archive.com/libgadu-devel%40lists.ziew.org/msg01017.html; http://www.mandriva.com/security/advisories?name=MDVSA-2014:185; http://www.openwall.com/lists/oss-security/2013/10/31/5
CVE: CVE-2014-2635
Published: 2014-10-10
Description: Unspecified vulnerability in HP Sprinter 12.01 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-2343.
CVSS Score: 7.5 (HIGH)
References: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04454636; https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04454636
CVE: CVE-2014-2636
Published: 2014-10-10
Description: Unspecified vulnerability in HP Sprinter 12.01 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-2336.
CVSS Score: 7.5 (HIGH)
References: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04454636; https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04454636
CVE: CVE-2014-2637
Published: 2014-10-10
Description: Unspecified vulnerability in HP Sprinter 12.01 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-2342.
CVSS Score: 7.5 (HIGH)
References: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04454636; https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04454636
CVE: CVE-2014-2638
Published: 2014-10-10
Description: Unspecified vulnerability in HP Sprinter 12.01 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-2344.
CVSS Score: 7.5 (HIGH)
References: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04454636; https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04454636
CVE: CVE-2014-2646
Published: 2014-10-10
Description: Unspecified vulnerability in HP Network Automation 9.10 and 9.20 allows local users to bypass intended access restrictions via unknown vectors.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04470581; https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04470581
CVE: CVE-2014-2648
Published: 2014-10-10
Description: Unspecified vulnerability in HP Operations Manager 9.10 and 9.11 on UNIX allows remote attackers to execute arbitrary code via unknown vectors.
CVSS Score: 10.0 (HIGH)
References: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04472866; https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04472866
CVE: CVE-2014-2649
Published: 2014-10-10
Description: Unspecified vulnerability in HP Operations Manager 9.20 on UNIX allows remote attackers to execute arbitrary code via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04472866; https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04472866
CVE: CVE-2014-3147
Published: 2014-10-10
Description: Cross-site scripting (XSS) vulnerability in the auto-complete feature in Splunk Enterprise before 6.0.4 allows remote authenticated users to inject arbitrary web script or HTML via a CSV file.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://securitytracker.com/id?1030800; http://www.splunk.com/view/SP-CAAAMSH; http://securitytracker.com/id?1030800