deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-2719
Published: 2014-04-22
Description: Advanced_System_Content.asp in the ASUS RT series routers with firmware before 3.0.0.4.374.5517, when an administrator session is active, allows remote authenticated users to obtain the administrator user name and password by reading the source code.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-200
References: http://dnlongen.blogspot.com/2014/04/CVE-2014-2719-Asus-RT-Password-Disclosure.html; http://seclists.org/fulldisclosure/2014/Apr/225; http://support.asus.com/download.aspx?m=RT-N66U+%28VER.B1%29
CVE: CVE-2014-2735
Published: 2014-04-22
Description: WinSCP before 5.5.3, when FTP with TLS is used, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://winscp.net/eng/docs/history; http://winscp.net/tracker/show_bug.cgi?id=1152; http://www.securityfocus.com/archive/1/531847/100/0/threaded
CVE: CVE-2014-2925
Published: 2014-04-22
Description: Cross-site scripting (XSS) vulnerability in Advanced_Wireless_Content.asp in ASUS RT-AC68U and other RT series routers with firmware before 3.0.0.4.374.5047 allows remote attackers to inject arbitrary web script or HTML via the current_page parameter to apply.cgi.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2014/Apr/59; http://support.asus.com/download.aspx?m=RT-N66U+%28VER.B1%29; http://www.asus.com/Networking/RTAC68U/HelpDesk_Download/
CVE: CVE-2013-1421
Published: 2014-04-22
Description: Cross-site scripting (XSS) vulnerability in Craig Knudsen WebCalendar before 1.2.5, 1.2.6, and other versions before 1.2.7 allows remote attackers to inject arbitrary web script or HTML via the Category Name field to category.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/90669; http://securitymaverick.com/vulnerability-cve-2013-1421-webcalendar-1-2-5-1-2-6-category-name-persistent-xss/; http://sourceforge.net/projects/webcalendar/files/webcalendar%201.2/1.2.7/
CVE: CVE-2013-2105
Published: 2014-04-22
Description: The Show In Browser (show_in_browser) gem 0.0.3 for Ruby allows local users to inject arbitrary web script or HTML via a symlink attack on /tmp/browser.html.
CVSS Score: 3.3 (LOW)
CWE: CWE-59
References: http://vapid.dhs.org/advisories/show_in_browser.html; http://www.openwall.com/lists/oss-security/2013/05/18/4; https://exchange.xforce.ibmcloud.com/vulnerabilities/84378
CVE: CVE-2013-2187
Published: 2014-04-22
Description: Cross-site scripting (XSS) vulnerability in Apache Archiva 1.2 through 1.2.2 and 1.3 before 1.3.8 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters, related to the home page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archiva.apache.org/security.html; http://www.securityfocus.com/archive/1/531884/100/0/threaded; http://www.securityfocus.com/bid/66991
CVE: CVE-2013-4116
Published: 2014-04-22
Description: lib/npm.js in Node Packaged Modules (npm) before 1.3.3 allows local users to overwrite arbitrary files via a symlink attack on temporary files with predictable names that are created when unpacking archives.
CVSS Score: 3.3 (LOW)
CWE: CWE-59
References: http://www.openwall.com/lists/oss-security/2013/07/10/17; http://www.openwall.com/lists/oss-security/2013/07/11/9; http://www.securityfocus.com/bid/61083
CVE: CVE-2013-4472
Published: 2014-04-22
Description: The openTempFile function in goo/gfile.cc in Xpdf and Poppler 0.24.3 and earlier, when running on a system other than Unix, allows local users to overwrite arbitrary files via a symlink attack on temporary files with predictable names.
CVSS Score: 3.3 (LOW)
CWE: CWE-59
References: http://osvdb.org/99064; http://poppler.freedesktop.org/releases.html; http://seclists.org/oss-sec/2013/q4/181
CVE: CVE-2013-7338
Published: 2014-04-22
Description: Python before 3.3.4 RC1 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a file size value larger than the size of the zip file to the (1) ZipExtFile.read, (2) ZipExtFile.read(n), (3) ZipExtFile.readlines, (4) ZipFile.extract, or (5) ZipFile.extractall function.
CVSS Score: 7.1 (HIGH)
CWE: CWE-20
References: http://bugs.python.org/issue20078; http://hg.python.org/cpython/rev/79ea4ce431b1; http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html
CVE: CVE-2014-1615
Published: 2014-04-22
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in Carbon Black before 4.1.0 allow remote attackers to hijack the authentication of administrators for requests that add new administrative users and have other unspecified action, as demonstrated by a request to api/user.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://secunia.com/advisories/57645; http://www.secureworks.com/advisories/SWRX-2014-007/SWRX-2014-007.pdf; http://secunia.com/advisories/57645
CVE: CVE-2014-2654
Published: 2014-04-22
Description: Multiple SQL injection vulnerabilities in MobFox mAdserve 2.0 and earlier allow remote authenticated users to execute arbitrary SQL commands via the id parameter to (1) edit_ad_unit.php, (2) view_adunits.php, or (3) edit_campaign.php in www/cp/.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/58003; http://www.securityfocus.com/archive/1/531848/100/0/threaded; http://www.securityfocus.com/bid/66661
CVE: CVE-2014-2659
Published: 2014-04-22
Description: Cross-site request forgery (CSRF) vulnerability in the admin UI in Papercut MF and NG before 14.1 (Build 26983) allows remote attackers to hijack the authentication of administrators via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://secunia.com/advisories/58037; http://www.papercut-mf.com/release-history/; http://www.papercut.com/release-history/
CVE: CVE-2014-2737
Published: 2014-04-22
Description: SQL injection vulnerability in the get_active_session function in the KTAPI_UserSession class in webservice/clienttools/services/mdownload.php in KnowledgeTree 3.7.0.2 and earlier allows remote attackers to execute arbitrary SQL commands via the u parameter, related to the getFileName function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/archive/1/531886/100/0/threaded; http://www.securityfocus.com/bid/66988; http://www.securityfocus.com/archive/1/531886/100/0/threaded
CVE: CVE-2014-2890
Published: 2014-04-22
Description: Cross-site scripting (XSS) vulnerability in the wrap_html function in MyID.php in phpMyID 0.9 allows remote attackers to inject arbitrary web script or HTML via the openid_error parameter to MyID.config.php when the openid.mode parameter is set to error, which is not properly handled in an error message.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/oss-sec/2014/q2/122; http://seclists.org/oss-sec/2014/q2/141; http://www.securityfocus.com/bid/66665
CVE: CVE-2014-2892
Published: 2014-04-22
Description: Heap-based buffer overflow in the get_answer function in mmsh.c in libmms before 0.6.4 allows remote attackers to execute arbitrary code via a long line in an MMS over HTTP (MMSH) server response.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-updates/2014-05/msg00001.html; http://secunia.com/advisories/57875; http://sourceforge.net/p/libmms/code/ci/03bcfccc22919c72742b7338d[PII_REDACTED]1e0e8
CVE: CVE-2014-2899
Published: 2014-04-22
Description: wolfSSL CyaSSL before 2.9.4 allows remote attackers to cause a denial of service (NULL pointer dereference) via (1) a request for the peer certificate when a certificate parsing failure occurs or (2) a client_key_exchange message when the ephemeral key is not found.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://seclists.org/oss-sec/2014/q2/126; http://seclists.org/oss-sec/2014/q2/130; http://secunia.com/advisories/57743
CVE: CVE-2014-2900
Published: 2014-04-22
Description: wolfSSL CyaSSL before 2.9.4 does not properly validate X.509 certificates with unknown critical extensions, which allows man-in-the-middle attackers to spoof servers via crafted X.509 certificate.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-310
References: http://seclists.org/oss-sec/2014/q2/126; http://seclists.org/oss-sec/2014/q2/130; http://secunia.com/advisories/57743
CVE: CVE-2012-0360
Published: 2014-04-23
Description: Memory leak in Cisco IOS before 15.1(1)SY, when IKEv2 debugging is enabled, allows remote attackers to cause a denial of service (memory consumption) via crafted packets, aka Bug ID CSCtn22376.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/15-1SY/release_notes.pdf; http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/15-1SY/release_notes.pdf
CVE: CVE-2012-1317
Published: 2014-04-23
Description: The multicast implementation in Cisco IOS before 15.1(1)SY allows remote attackers to cause a denial of service (Route Processor crash) by sending packets at a high rate, aka Bug ID CSCts37717.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-119
References: http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/15-1SY/release_notes.pdf; http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/15-1SY/release_notes.pdf
CVE: CVE-2012-1366
Published: 2014-04-23
Description: Cisco IOS before 15.1(1)SY on ASR 1000 devices, when Multicast Listener Discovery (MLD) tracking is enabled for IPv6, allows remote attackers to cause a denial of service (device reload) via crafted MLD packets, aka Bug ID CSCtz28544.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-20
References: http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/15-1SY/release_notes.pdf; http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/15-1SY/release_notes.pdf
CVE: CVE-2012-3062
Published: 2014-04-23
Description: Cisco IOS before 15.1(1)SY, when Multicast Listener Discovery (MLD) snooping is enabled, allows remote attackers to cause a denial of service (CPU consumption or device crash) via MLD packets on a network that contains many IPv6 hosts, aka Bug ID CSCtr88193.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-20
References: http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/15-1SY/release_notes.pdf; http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/15-1SY/release_notes.pdf
CVE: CVE-2012-3918
Published: 2014-04-23
Description: Cisco IOS before 15.3(1)T on Cisco 2900 devices, when a VWIC2-2MFT-T1/E1 card is configured for TDM/HDLC mode, allows remote attackers to cause a denial of service (serial-interface outage) via certain Frame Relay traffic, aka Bug ID CSCub13317.
CVSS Score: 4.3 (MEDIUM)
References: http://www.cisco.com/c/en/us/td/docs/ios/15_3m_and_t/release/notes/15_3m_and_t.pdf; http://www.cisco.com/c/en/us/td/docs/ios/15_3m_and_t/release/notes/15_3m_and_t.pdf
CVE: CVE-2012-4638
Published: 2014-04-23
Description: Cisco IOS before 15.1(1)SY allows local users to cause a denial of service (device reload) by establishing an outbound SSH session, aka Bug ID CSCto00318.
CVSS Score: 4.9 (MEDIUM)
References: http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/15-1SY/release_notes.pdf; http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/15-1SY/release_notes.pdf
CVE: CVE-2012-4651
Published: 2014-04-23
Description: Cisco IOS before 15.3(2)T, when scansafe is enabled, allows remote attackers to cause a denial of service (latency) via SYN packets that are not accompanied by SYN-ACK packets from the Scan Safe Tower, aka Bug ID CSCub85451.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-189
References: http://www.cisco.com/c/en/us/td/docs/ios/15_3m_and_t/release/notes/15_3m_and_t.pdf; http://www.cisco.com/c/en/us/td/docs/ios/15_3m_and_t/release/notes/15_3m_and_t.pdf
CVE: CVE-2012-4658
Published: 2014-04-23
Description: The ios-authproxy implementation in Cisco IOS before 15.1(1)SY3 allows remote attackers to cause a denial of service (webauth and HTTP service outage) via vectors that trigger incorrectly terminated HTTP sessions, aka Bug ID CSCtz99447.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-287
References: http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/15-1SY/release_notes.pdf; http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/15-1SY/release_notes.pdf
CVE: CVE-2012-5014
Published: 2014-04-23
Description: Cisco IOS before 15.1(2)SY allows remote authenticated users to cause a denial of service (device crash) by establishing an SSH session from a client and then placing this client into a (1) slow or (2) idle state, aka Bug ID CSCto87436.
CVSS Score: 6.3 (MEDIUM)
References: http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/15-1SY/release_notes.pdf; http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/15-1SY/release_notes.pdf
CVE: CVE-2012-5017
Published: 2014-04-23
Description: Cisco IOS before 15.1(1)SY1 allows remote authenticated users to cause a denial of service (device reload) by establishing a VPN session and then sending malformed IKEv2 packets, aka Bug ID CSCub39268.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/15-1SY/release_notes.pdf; http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/15-1SY/release_notes.pdf
CVE: CVE-2012-5032
Published: 2014-04-23
Description: The Flex-VPN load-balancing feature in the ipsec-ikev2 implementation in Cisco IOS before 15.1(1)SY3 does not require authentication, which allows remote attackers to trigger the forwarding of VPN traffic to an attacker-controlled destination, or the discarding of this traffic, by arranging for an arbitrary device to become a cluster member, aka Bug ID CSCub93641.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-287
References: http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/15-1SY/release_notes.pdf; http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/15-1SY/release_notes.pdf
CVE: CVE-2012-5036
Published: 2014-04-23
Description: Cisco IOS before 12.2(50)SY1 allows remote authenticated users to cause a denial of service (memory consumption) via a sequence of VTY management sessions (aka exec sessions), aka Bug ID CSCtn43662.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-399
References: http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SY/release/notes/ol_20679.html; http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SY/release/notes/ol_20679.html
CVE: CVE-2012-5037
Published: 2014-04-23
Description: The ACL implementation in Cisco IOS before 15.1(1)SY on Catalyst 6500 and 7600 devices allows local users to cause a denial of service (device reload) via a "no object-group" command followed by an object-group command, aka Bug ID CSCts16133.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-264
References: http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/15-1SY/release_notes.pdf; http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/15-1SY/release_notes.pdf
CVE: CVE-2012-5039
Published: 2014-04-23
Description: The BGP Router process in Cisco IOS before 12.2(50)SY1 allows remote attackers to cause a denial of service (memory consumption) via vectors involving BGP path attributes, aka Bug ID CSCsw63003.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-399
References: http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SY/release/notes/ol_20679.html; http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SY/release/notes/ol_20679.html
CVE: CVE-2012-5044
Published: 2014-04-23
Description: Cisco IOS before 15.3(1)T, when media flow-around is not used, allows remote attackers to cause a denial of service (media loops and stack memory corruption) via VoIP traffic, aka Bug ID CSCub45809.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-119
References: http://www.cisco.com/c/en/us/td/docs/ios/15_3m_and_t/release/notes/15_3m_and_t.pdf; http://www.cisco.com/c/en/us/td/docs/ios/15_3m_and_t/release/notes/15_3m_and_t.pdf
CVE: CVE-2012-5422
Published: 2014-04-23
Description: Unspecified vulnerability in Cisco IOS before 15.3(2)T on AS5400 devices allows remote authenticated users to cause a denial of service (spurious errors) via unknown vectors, aka Bug ID CSCub61009.
CVSS Score: 6.8 (MEDIUM)
References: http://www.cisco.com/c/en/us/td/docs/ios/15_3m_and_t/release/notes/15_3m_and_t.pdf; http://www.cisco.com/c/en/us/td/docs/ios/15_3m_and_t/release/notes/15_3m_and_t.pdf
CVE: CVE-2012-5427
Published: 2014-04-23
Description: Cisco IOS Unified Border Element (CUBE) in Cisco IOS before 15.3(2)T allows remote authenticated users to cause a denial of service (input queue wedge) via a crafted series of RTCP packets, aka Bug ID CSCuc42518.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-20
References: http://www.cisco.com/c/en/us/td/docs/ios/15_3m_and_t/release/notes/15_3m_and_t.pdf; http://www.cisco.com/c/en/us/td/docs/ios/15_3m_and_t/release/notes/15_3m_and_t.pdf
CVE: CVE-2014-1295
Published: 2014-04-23
Description: Secure Transport in Apple iOS before 7.1.1, Apple OS X 10.8.x and 10.9.x through 10.9.2, and Apple TV before 6.1.1 does not ensure that a server's X.509 certificate is the same during renegotiation as it was before renegotiation, which allows man-in-the-middle attackers to obtain sensitive information or modify TLS session data via a "triple handshake attack."
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287
References: http://archives.neohapsis.com/archives/bugtraq/2014-04/0134.html; http://archives.neohapsis.com/archives/bugtraq/2014-04/0135.html; http://archives.neohapsis.com/archives/bugtraq/2014-04/0136.html
CVE: CVE-2014-1296
Published: 2014-04-23
Description: CFNetwork in Apple iOS before 7.1.1, Apple OS X through 10.9.2, and Apple TV before 6.1.1 does not ensure that a Set-Cookie HTTP header is complete before interpreting the header's value, which allows remote attackers to bypass intended access restrictions by triggering the closing of a TCP connection during transmission of a header, as demonstrated by an HTTPOnly restriction.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://archives.neohapsis.com/archives/bugtraq/2014-04/0134.html; http://archives.neohapsis.com/archives/bugtraq/2014-04/0135.html; http://archives.neohapsis.com/archives/bugtraq/2014-04/0136.html
CVE: CVE-2014-1314
Published: 2014-04-23
Description: WindowServer in Apple OS X through 10.9.2 does not prevent session creation by a sandboxed application, which allows attackers to bypass the sandbox protection mechanism and execute arbitrary code via a crafted application.
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://archives.neohapsis.com/archives/bugtraq/2014-04/0134.html; http://archives.neohapsis.com/archives/bugtraq/2014-04/0134.html
CVE: CVE-2014-1315
Published: 2014-04-23
Description: Format string vulnerability in CoreServicesUIAgent in Apple OS X 10.9.x through 10.9.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via format string specifiers in a URL.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-134
References: http://archives.neohapsis.com/archives/bugtraq/2014-04/0134.html; http://archives.neohapsis.com/archives/bugtraq/2014-04/0134.html
CVE: CVE-2014-1316
Published: 2014-04-23
Description: Heimdal, as used in Apple OS X through 10.9.2, allows remote attackers to cause a denial of service (abort and daemon exit) via ASN.1 data encountered in the Kerberos 5 protocol.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://archives.neohapsis.com/archives/bugtraq/2014-04/0134.html; http://archives.neohapsis.com/archives/bugtraq/2014-04/0134.html
CVE: CVE-2014-1318
Published: 2014-04-23
Description: The Intel Graphics Driver in Apple OS X through 10.9.2 does not properly validate a certain pointer, which allows attackers to execute arbitrary code via a crafted application.
CVSS Score: 10.0 (HIGH)
CWE: CWE-20
References: http://archives.neohapsis.com/archives/bugtraq/2014-04/0134.html; http://archives.neohapsis.com/archives/bugtraq/2014-04/0134.html
CVE: CVE-2014-1319
Published: 2014-04-23
Description: Buffer overflow in ImageIO in Apple OS X 10.9.x through 10.9.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted JPEG image.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2014-04/0134.html; http://archives.neohapsis.com/archives/bugtraq/2014-04/0134.html
CVE: CVE-2014-1320
Published: 2014-04-23
Description: IOKit in Apple iOS before 7.1.1, Apple OS X through 10.9.2, and Apple TV before 6.1.1 places kernel pointers into an object data structure, which makes it easier for local users to bypass the ASLR protection mechanism by reading unspecified attributes of the object.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-200
References: http://archives.neohapsis.com/archives/bugtraq/2014-04/0134.html; http://archives.neohapsis.com/archives/bugtraq/2014-04/0135.html; http://archives.neohapsis.com/archives/bugtraq/2014-04/0136.html
CVE: CVE-2014-1321
Published: 2014-04-23
Description: Power Management in Apple OS X 10.9.x through 10.9.2 allows physically proximate attackers to bypass an intended transition into the locked-screen state by touching (1) a key or (2) the trackpad during a lid-close action.
CVSS Score: 3.3 (LOW)
CWE: CWE-264
References: http://archives.neohapsis.com/archives/bugtraq/2014-04/0134.html; http://archives.neohapsis.com/archives/bugtraq/2014-04/0134.html
CVE: CVE-2014-1322
Published: 2014-04-23
Description: The kernel in Apple OS X through 10.9.2 places a kernel pointer into an XNU object data structure accessible from user space, which makes it easier for local users to bypass the ASLR protection mechanism by reading an unspecified attribute of the object.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-200
References: http://archives.neohapsis.com/archives/bugtraq/2014-04/0134.html; http://archives.neohapsis.com/archives/bugtraq/2014-04/0134.html
CVE: CVE-2014-1648
Published: 2014-04-23
Description: Cross-site scripting (XSS) vulnerability in brightmail/setting/compliance/DlpConnectFlow$view.flo in the management console in Symantec Messaging Gateway 10.x before 10.5.2 allows remote attackers to inject arbitrary web script or HTML via the displayTab parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2014/Apr/256; http://www.securityfocus.com/bid/66966; http://www.securitytracker.com/id/1030136
CVE: CVE-2014-2154
Published: 2014-04-23
Description: Memory leak in the SIP inspection engine in Cisco Adaptive Security Appliance (ASA) Software allows remote attackers to cause a denial of service (memory consumption and instability) via crafted SIP packets, aka Bug ID CSCuf67469.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2154; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2154
CVE: CVE-2014-0472
Published: 2014-04-23
Description: The django.core.urlresolvers.reverse function in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 allows remote attackers to import and execute arbitrary Python modules by leveraging a view that constructs URLs using user input and a "dotted Python path."
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-94
References: http://lists.opensuse.org/opensuse-updates/2014-09/msg00023.html; http://rhn.redhat.com/errata/RHSA-2014-0456.html; http://rhn.redhat.com/errata/RHSA-2014-0457.html
CVE: CVE-2014-0473
Published: 2014-04-23
Description: The caching framework in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 reuses a cached CSRF token for all anonymous users, which allows remote attackers to bypass CSRF protections by reading the CSRF cookie for anonymous users.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-updates/2014-09/msg00023.html; http://rhn.redhat.com/errata/RHSA-2014-0456.html; http://rhn.redhat.com/errata/RHSA-2014-0457.html