deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2013-6665
Published: 2014-03-05
Description: Heap-based buffer overflow in the ResourceProvider::InitializeSoftware function in cc/resources/resource_provider.cc in Google Chrome before 33.0.1750.146 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a large texture size that triggers improper memory allocation in the software renderer.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://googlechromereleases.blogspot.com/2014/03/stable-channel-update.html; http://www.debian.org/security/2014/dsa-2883; http://www.securityfocus.com/bid/65930
CVE: CVE-2013-6666
Published: 2014-03-05
Description: The PepperFlashRendererHost::OnNavigate function in renderer/pepper/pepper_flash_renderer_host.cc in Google Chrome before 33.0.1750.146 does not verify that all headers are Cross-Origin Resource Sharing (CORS) simple headers before proceeding with a PPB_Flash.Navigate operation, which might allow remote attackers to bypass intended CORS restrictions via an inappropriate header.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-264
References: http://googlechromereleases.blogspot.com/2014/03/stable-channel-update.html; http://www.debian.org/security/2014/dsa-2883; http://www.securityfocus.com/bid/65930
CVE: CVE-2013-6667
Published: 2014-03-05
Description: Multiple unspecified vulnerabilities in Google Chrome before 33.0.1750.146 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://googlechromereleases.blogspot.com/2014/03/stable-channel-update.html; http://www.debian.org/security/2014/dsa-2883; http://www.securityfocus.com/bid/65930
CVE: CVE-2013-6668
Published: 2014-03-05
Description: Multiple unspecified vulnerabilities in Google V8 before 3.24.35.10, as used in Google Chrome before 33.0.1750.146, allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://advisories.mageia.org/MGASA-2014-0516.html; http://googlechromereleases.blogspot.com/2014/03/stable-channel-update.html; http://secunia.com/advisories/61184
CVE: CVE-2014-2234
Published: 2014-03-05
Description: A certain Apple patch for OpenSSL in Apple OS X 10.9.2 and earlier uses a Trust Evaluation Agent (TEA) feature without terminating certain TLS/SSL handshakes as specified in the SSL_CTX_set_verify callback function's documentation, which allows remote attackers to bypass extra verification within a custom application via a crafted certificate chain that is acceptable to TEA but not acceptable to that application.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-20
References: https://hynek.me/articles/apple-openssl-verification-surprises/; https://hynek.me/articles/apple-openssl-verification-surprises/
CVE: CVE-2013-5468
Published: 2014-03-05
Description: IBM Algo One, as used in MetaData Management Tools in UDS 4.7.0 through 5.0.0, ACSWeb in Algo Security Access Control Management 4.7.0 through 4.9.0, and ACSWeb in AlgoWebApps 5.0.0, does not encrypt login requests, which allows remote attackers to obtain sensitive information by sniffing the network.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://www-01.ibm.com/support/docview.wss?uid=swg21666110; https://exchange.xforce.ibmcloud.com/vulnerabilities/88382; http://www-01.ibm.com/support/docview.wss?uid=swg21666110
CVE: CVE-2013-6299
Published: 2014-03-05
Description: Cross-site scripting (XSS) vulnerability in IBM Algo One, as used in MetaData Management Tools in UDS 4.7.0 through 5.0.0, ACSWeb in Algo Security Access Control Management 4.7.0 through 4.9.0, and ACSWeb in AlgoWebApps 5.0.0, allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2013-6300, CVE-2013-6301, CVE-2013-6320, and CVE-2013-6333.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21666110; https://exchange.xforce.ibmcloud.com/vulnerabilities/88525; http://www-01.ibm.com/support/docview.wss?uid=swg21666110
CVE: CVE-2013-6300
Published: 2014-03-05
Description: Cross-site scripting (XSS) vulnerability in IBM Algo One, as used in MetaData Management Tools in UDS 4.7.0 through 5.0.0, ACSWeb in Algo Security Access Control Management 4.7.0 through 4.9.0, and ACSWeb in AlgoWebApps 5.0.0, allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2013-6299, CVE-2013-6301, CVE-2013-6320, and CVE-2013-6333.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21666110; https://exchange.xforce.ibmcloud.com/vulnerabilities/88526; http://www-01.ibm.com/support/docview.wss?uid=swg21666110
CVE: CVE-2013-6301
Published: 2014-03-05
Description: Cross-site scripting (XSS) vulnerability in IBM Algo One, as used in MetaData Management Tools in UDS 4.7.0 through 5.0.0, ACSWeb in Algo Security Access Control Management 4.7.0 through 4.9.0, and ACSWeb in AlgoWebApps 5.0.0, allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2013-6299, CVE-2013-6300, CVE-2013-6320, and CVE-2013-6333.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21666110; https://exchange.xforce.ibmcloud.com/vulnerabilities/88527; http://www-01.ibm.com/support/docview.wss?uid=swg21666110
CVE: CVE-2013-6302
Published: 2014-03-05
Description: SQL injection vulnerability in IBM Algo One, as used in MetaData Management Tools in UDS 4.7.0 through 5.0.0, ACSWeb in Algo Security Access Control Management 4.7.0 through 4.9.0, and ACSWeb in AlgoWebApps 5.0.0, allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, a different vulnerability than CVE-2013-6331.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://www-01.ibm.com/support/docview.wss?uid=swg21666110; https://exchange.xforce.ibmcloud.com/vulnerabilities/88532; http://www-01.ibm.com/support/docview.wss?uid=swg21666110
CVE: CVE-2013-6303
Published: 2014-03-05
Description: Directory traversal vulnerability in IBM Algo One, as used in MetaData Management Tools in UDS 4.7.0 through 5.0.0, ACSWeb in Algo Security Access Control Management 4.7.0 through 4.9.0, and ACSWeb in AlgoWebApps 5.0.0, allows remote authenticated users to read arbitrary files via unspecified vectors.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-22
References: http://www-01.ibm.com/support/docview.wss?uid=swg21666110; https://exchange.xforce.ibmcloud.com/vulnerabilities/88534; http://www-01.ibm.com/support/docview.wss?uid=swg21666110
CVE: CVE-2013-6318
Published: 2014-03-05
Description: Cross-site scripting (XSS) vulnerability in IBM Algo One, as used in MetaData Management Tools in UDS 4.7.0 through 5.0.0, ACSWeb in Algo Security Access Control Management 4.7.0 through 4.9.0, and ACSWeb in AlgoWebApps 5.0.0, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21666110; https://exchange.xforce.ibmcloud.com/vulnerabilities/88599; http://www-01.ibm.com/support/docview.wss?uid=swg21666110
CVE: CVE-2013-6319
Published: 2014-03-05
Description: IBM Algo One, as used in MetaData Management Tools in UDS 4.7.0 through 5.0.0, ACSWeb in Algo Security Access Control Management 4.7.0 through 4.9.0, and ACSWeb in AlgoWebApps 5.0.0, allows remote authenticated users to bypass intended access restrictions and read content via unspecified vectors.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg21666110; https://exchange.xforce.ibmcloud.com/vulnerabilities/88602; http://www-01.ibm.com/support/docview.wss?uid=swg21666110
CVE: CVE-2013-6320
Published: 2014-03-05
Description: Cross-site scripting (XSS) vulnerability in IBM Algo One, as used in MetaData Management Tools in UDS 4.7.0 through 5.0.0, ACSWeb in Algo Security Access Control Management 4.7.0 through 4.9.0, and ACSWeb in AlgoWebApps 5.0.0, allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2013-6299, CVE-2013-6300, CVE-2013-6301, and CVE-2013-6333.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21666110; https://exchange.xforce.ibmcloud.com/vulnerabilities/88603; http://www-01.ibm.com/support/docview.wss?uid=swg21666110
CVE: CVE-2013-6331
Published: 2014-03-05
Description: SQL injection vulnerability in IBM Algo One, as used in MetaData Management Tools in UDS 4.7.0 through 5.0.0, ACSWeb in Algo Security Access Control Management 4.7.0 through 4.9.0, and ACSWeb in AlgoWebApps 5.0.0, allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, a different vulnerability than CVE-2013-6302.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://www-01.ibm.com/support/docview.wss?uid=swg21666110; https://exchange.xforce.ibmcloud.com/vulnerabilities/89022; http://www-01.ibm.com/support/docview.wss?uid=swg21666110
CVE: CVE-2013-6333
Published: 2014-03-05
Description: Cross-site scripting (XSS) vulnerability in IBM Algo One, as used in MetaData Management Tools in UDS 4.7.0 through 5.0.0, ACSWeb in Algo Security Access Control Management 4.7.0 through 4.9.0, and ACSWeb in AlgoWebApps 5.0.0, allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2013-6299, CVE-2013-6300, CVE-2013-6301, and CVE-2013-6320.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21666110; https://exchange.xforce.ibmcloud.com/vulnerabilities/89024; http://www-01.ibm.com/support/docview.wss?uid=swg21666110
CVE: CVE-2013-3478
Published: 2014-03-05
Description: SQL injection vulnerability in Apptha WordPress Video Gallery 2.0, 1.6, and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the playid parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/51344; http://www.securityfocus.com/bid/59845; https://exchange.xforce.ibmcloud.com/vulnerabilities/84239
CVE: CVE-2014-2206
Published: 2014-03-05
Description: Stack-based buffer overflow in GetGo Download Manager 4.9.0.1982, 4.8.2.1346, 4.4.5.502, and earlier allows remote attackers to cause a denial of service (crash) and execute arbitrary code via a long HTTP Response Header.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://www.rcesecurity.com/2014/03/cve-2014-2206-getgo-download-manager-http-response-header-buffer-overflow-remote-code-execution; http://www.securityfocus.com/archive/1/531326/100/0/threaded; http://www.securityfocus.com/bid/65913
CVE: CVE-2014-2235
Published: 2014-03-05
Description: Cross-site scripting (XSS) vulnerability in Askbot before 0.7.49 allows remote attackers to inject arbitrary web script or HTML via vectors related to the question search form.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/57163; http://www.openwall.com/lists/oss-security/2014/02/28/8; http://www.securityfocus.com/bid/65885
CVE: CVE-2014-2236
Published: 2014-03-05
Description: Multiple cross-site scripting (XSS) vulnerabilities in Askbot before 0.7.49 allow remote attackers to inject arbitrary web script or HTML via vectors related to the (1) tag or (2) user search forms.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/57163; http://www.openwall.com/lists/oss-security/2014/02/28/8; http://www.securityfocus.com/bid/65885
CVE: CVE-2014-2238
Published: 2014-03-05
Description: SQL injection vulnerability in the manage configuration page (adm_config_report.php) in MantisBT 1.2.13 through 1.2.16 allows remote authenticated administrators to execute arbitrary SQL commands via the filter_config_id parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://mantisbt.domainunion.de/bugs/view.php?id=17055; http://seclists.org/oss-sec/2014/q1/456; http://seclists.org/oss-sec/2014/q1/490
CVE: CVE-2014-2245
Published: 2014-03-05
Description: SQL injection vulnerability in the News module in CMS Made Simple (CMSMS) before 1.11.10 allows remote authenticated users with the "Modify News" permission to execute arbitrary SQL commands via the sortby parameter to admin/moduleinterface.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-89
References: http://dev.cmsmadesimple.org/project/changelog/4602; http://seclists.org/oss-sec/2014/q1/467; http://secunia.com/advisories/56996
CVE: CVE-2013-3706
Published: 2014-03-06
Description: Directory traversal vulnerability in the PreBoot service in Novell ZENworks Configuration Management (ZCM) 11.2 allows remote attackers to read arbitrary files via a .. (dot dot) in a preboot update pathname, aka ZDI-CAN-1595.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://www.novell.com/support/kb/doc.php?id=7014663; http://www.securityfocus.com/bid/65912; http://www.novell.com/support/kb/doc.php?id=7014663
CVE: CVE-2013-6201
Published: 2014-03-06
Description: Unspecified vulnerability in HP Security Management System 3.3.0, 3.5.0 before patch 1, and 3.6.0 before patch 2 allows remote attackers to execute arbitrary code via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04156626; https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04156626
CVE: CVE-2013-6304
Published: 2014-03-06
Description: Multiple directory traversal vulnerabilities in Algo Risk Application (ARA) 2.4.0.1 through 4.9.1 in IBM Algo One allow remote authenticated users to bypass intended access restrictions via a crafted pathname for a (1) configuration or (2) JAR file.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-22
References: http://www-01.ibm.com/support/docview.wss?uid=swg21666093; http://www.securityfocus.com/bid/65929; https://exchange.xforce.ibmcloud.com/vulnerabilities/88535
CVE: CVE-2013-6314
Published: 2014-03-06
Description: Cross-site scripting (XSS) vulnerability in IBM InfoSphere Enterprise Records 4.5.1 before 4.5.1.7-IER-IF001 and Enterprise Records 5.1.1 before 5.1.1.1-IER-IF003 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21662911; http://www.securityfocus.com/bid/65922; https://exchange.xforce.ibmcloud.com/vulnerabilities/88595
CVE: CVE-2013-6315
Published: 2014-03-06
Description: IBM InfoSphere Enterprise Records 4.5.1 before 4.5.1.7-IER-IF001 and Enterprise Records 5.1.1 before 5.1.1.1-IER-IF003 do not properly restrict use of FRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://www-01.ibm.com/support/docview.wss?uid=swg21662911; https://exchange.xforce.ibmcloud.com/vulnerabilities/88596; http://www-01.ibm.com/support/docview.wss?uid=swg21662911
CVE: CVE-2013-6719
Published: 2014-03-06
Description: delivery.php in the Passive Capture Application (PCA) web console in IBM Tealeaf CX 7.x, 8.x through 8.6, 8.7 before FP2, and 8.8 before FP2 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the testconn_host parameter.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-78
References: http://www.exploit-db.com/exploits/32546; https://exchange.xforce.ibmcloud.com/vulnerabilities/89228; https://tealeaf.support.ibmcloud.com/FileManagement/Download/19eb90ffb8334b398684b4350edc4b7a
CVE: CVE-2013-6720
Published: 2014-03-06
Description: Directory traversal vulnerability in download.php in the Passive Capture Application (PCA) web console in IBM Tealeaf CX 7.x, 8.x through 8.6, 8.7 before FP2, and 8.8 before FP2 allows remote authenticated users to bypass intended access restrictions via a .. (dot dot) in the log parameter, as demonstrated using a crafted request for a customer-support file, as demonstrated by a log file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-22
References: http://www.exploit-db.com/exploits/32546; https://exchange.xforce.ibmcloud.com/vulnerabilities/89229; https://tealeaf.support.ibmcloud.com/FileManagement/Download/19eb90ffb8334b398684b4350edc4b7a
CVE: CVE-2014-0335
Published: 2014-03-06
Description: Multiple cross-site scripting (XSS) vulnerabilities in the web client in Serena Dimensions CM 12.2 build 7.199.0 allow remote attackers to inject arbitrary web script or HTML via the (1) DB_CONN, (2) DB_NAME, (3) DM_HOST, (4) MAN_DB_NAME, (5) framecmd, (6) identifier, (7) merant.adm.adapters.AdmDialogPropertyMgr, (8) nav_frame, (9) nav_jsp, (10) target_frame, (11) id, or (12) type parameter to the dimensions/ URI.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.kb.cert.org/vuls/id/823452; http://www.kb.cert.org/vuls/id/823452
CVE: CVE-2014-0336
Published: 2014-03-06
Description: Cross-site request forgery (CSRF) vulnerability in the web client in Serena Dimensions CM 12.2 build 7.199.0 allows remote attackers to hijack the authentication of administrators for requests that use the user_new_master parameter to the adminconsole/ URI.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www.kb.cert.org/vuls/id/823452; http://www.kb.cert.org/vuls/id/823452
CVE: CVE-2014-0624
Published: 2014-03-06
Description: EMC RSA Data Loss Prevention (DLP) 9.x before 9.6-SP2 does not properly manage sessions, which allows remote authenticated users to gain privileges and bypass intended content-reading restrictions via unspecified vectors.
CVSS Score: 2.7 (LOW)
References: http://seclists.org/bugtraq/2014/Mar/8; http://seclists.org/bugtraq/2014/Mar/8
CVE: CVE-2014-0629
Published: 2014-03-06
Description: EMC Documentum TaskSpace (TSP) 6.7SP1 before P25 and 6.7SP2 before P11 does not properly handle the interaction between the dm_world group and the dm_superusers_dynamic group, which allows remote authenticated users to obtain sensitive information and gain privileges in opportunistic circumstances by leveraging an incorrect group-addition implementation.
CVSS Score: 8.5 (HIGH)
CWE: CWE-264
References: http://seclists.org/bugtraq/2014/Mar/33; http://seclists.org/bugtraq/2014/Mar/33
CVE: CVE-2014-0630
Published: 2014-03-06
Description: EMC Documentum TaskSpace (TSP) 6.7SP1 before P25 and 6.7SP2 before P11 allows remote authenticated users to read arbitrary files via a modified imaging-service URL.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://seclists.org/bugtraq/2014/Mar/33; http://seclists.org/bugtraq/2014/Mar/33
CVE: CVE-2014-0683
Published: 2014-03-06
Description: The web management interface on the Cisco RV110W firewall with firmware 1.2.0.9 and earlier, RV215W router with firmware 1.1.0.5 and earlier, and CVR100W router with firmware 1.0.1.19 and earlier does not prevent replaying of modified authentication requests, which allows remote attackers to obtain administrative access by leveraging the ability to intercept requests, aka Bug IDs CSCul94527, CSCum86264, and CSCum86275.
CVSS Score: 10.0 (HIGH)
CWE: CWE-255
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140305-rpd; https://www.exploit-db.com/exploits/45986/; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140305-rpd
CVE: CVE-2014-0701
Published: 2014-03-06
Description: Cisco Wireless LAN Controller (WLC) devices 7.0 before 7.0.250.0, 7.2, 7.3, and 7.4 before 7.4.110.0 do not properly deallocate memory, which allows remote attackers to cause a denial of service (reboot) by sending WebAuth login requests at a high rate, aka Bug ID CSCuf52361.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140305-wlc; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140305-wlc
CVE: CVE-2014-0703
Published: 2014-03-06
Description: Cisco Wireless LAN Controller (WLC) devices 7.4 before 7.4.110.0 distribute Aironet IOS software with a race condition in the status of the administrative HTTP server, which allows remote attackers to bypass intended access restrictions by connecting to an Aironet access point on which this server had been disabled ineffectively, aka Bug ID CSCuf66202.
CVSS Score: 10.0 (HIGH)
CWE: CWE-362
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140305-wlc; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140305-wlc
CVE: CVE-2014-0704
Published: 2014-03-06
Description: The IGMP implementation on Cisco Wireless LAN Controller (WLC) devices 4.x, 5.x, 6.x, 7.0 before 7.0.250.0, 7.1, 7.2, and 7.3, when IGMPv3 Snooping is enabled, allows remote attackers to cause a denial of service (memory over-read and device restart) via a crafted field in an IGMPv3 message, aka Bug ID CSCuh33240.
CVSS Score: 7.1 (HIGH)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140305-wlc; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140305-wlc
CVE: CVE-2014-0705
Published: 2014-03-06
Description: The multicast listener discovery (MLD) service on Cisco Wireless LAN Controller (WLC) devices 7.2, 7.3, 7.4 before 7.4.121.0, and 7.5, when MLDv2 Snooping is enabled, allows remote attackers to cause a denial of service (device restart) via a malformed IPv6 MLDv2 packet, aka Bug ID CSCuh74233.
CVSS Score: 7.1 (HIGH)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140305-wlc; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140305-wlc
CVE: CVE-2014-0706
Published: 2014-03-06
Description: Cisco Wireless LAN Controller (WLC) devices 7.2 before 7.2.115.2, 7.3, and 7.4 before 7.4.110.0 allow remote attackers to cause a denial of service (device restart) via a crafted 802.11 Ethernet frame, aka Bug ID CSCue87929.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140305-wlc; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140305-wlc
CVE: CVE-2014-0707
Published: 2014-03-06
Description: Cisco Wireless LAN Controller (WLC) devices 7.2, 7.3, and 7.4 before 7.4.110.0 allow remote attackers to cause a denial of service (device restart) via a crafted 802.11 Ethernet frame, aka Bug ID CSCuf80681.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140305-wlc; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140305-wlc
CVE: CVE-2014-0890
Published: 2014-03-06
Description: The Connect client in IBM Sametime 8.5.1, 8.5.1.1, 8.5.1.2, 8.5.2, 8.5.2.1, 9.0, and 9.0.0.1, when a certain com.ibm.collaboration.realtime.telephony.*.level setting is used, logs cleartext passwords during Audio/Video chat sessions, which allows local users to obtain sensitive information by reading a log file.
CVSS Score: 1.9 (LOW)
CWE: CWE-255
References: http://www-01.ibm.com/support/docview.wss?uid=swg21665658; https://exchange.xforce.ibmcloud.com/vulnerabilities/91282; http://www-01.ibm.com/support/docview.wss?uid=swg21665658
CVE: CVE-2014-1911
Published: 2014-03-06
Description: The Foscam FI8910W camera with firmware before 11.37.2.55 allows remote attackers to obtain sensitive video and image data via a blank username and password.
CVSS Score: 7.8 (HIGH)
CWE: CWE-287
References: http://foscam.us/forum/mjpeg-54-firmware-bug-user-logon-bypass-t8442.html; http://www.kb.cert.org/vuls/id/525132; http://foscam.us/forum/mjpeg-54-firmware-bug-user-logon-bypass-t8442.html
CVE: CVE-2011-3153
Published: 2014-03-06
Description: dmrc.c in Light Display Manager (aka LightDM) before 1.1.1 allows local users to read arbitrary files via a symlink attack on ~/.dmrc.
CVSS Score: 1.9 (LOW)
CWE: CWE-59
References: http://bazaar.launchpad.net/~lightdm-team/lightdm/trunk/revision/1299; http://www.ubuntu.com/usn/USN-1262-1; https://bugs.launchpad.net/ubuntu/%2Bsource/lightdm/%2Bbug/883865