deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-1640
Published: 2014-01-28
Description: axiom-test.sh in axiom 20100701-1.1 uses tempfile to create a safe temporary file but appends a suffix to the original filename and writes to this new filename, which allows local users to overwrite arbitrary files via a symlink attack on the new filename.
CVSS Score: 3.3 (LOW)
CWE: CWE-59
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=736358; http://www.openwall.com/lists/oss-security/2014/01/22/3; http://www.openwall.com/lists/oss-security/2014/01/22/4
CVE: CVE-2013-6649
Published: 2014-01-28
Description: Use-after-free vulnerability in the RenderSVGImage::paint function in core/rendering/svg/RenderSVGImage.cpp in Blink, as used in Google Chrome before 32.0.1700.102, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving a zero-size SVG image.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://crbug.com/330420; http://googlechromereleases.blogspot.com/2014/01/stable-channel-update_27.html; http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00008.html
CVE: CVE-2013-6650
Published: 2014-01-28
Description: The StoreBuffer::ExemptPopularPages function in store-buffer.cc in Google V8 before 3.22.24.16, as used in Google Chrome before 32.0.1700.102, allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via vectors that trigger incorrect handling of "popular pages."
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://crbug.com/331444; http://googlechromereleases.blogspot.com/2014/01/stable-channel-update_27.html; http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00008.html
CVE: CVE-2014-1681
Published: 2014-01-28
Description: Multiple unspecified vulnerabilities in Google Chrome before 32.0.1700.102 have unknown impact and attack vectors, related to 12 "security fixes [that were not] either contributed by external researchers or particularly interesting."
CVSS Score: 10.0 (HIGH)
References: http://googlechromereleases.blogspot.com/2014/01/stable-channel-update_27.html; http://osvdb.org/102633; https://exchange.xforce.ibmcloud.com/vulnerabilities/90975
CVE: CVE-2013-5094
Published: 2014-01-28
Description: Cross-site scripting (XSS) vulnerability in index.exp in McAfee Vulnerability Manager 7.5 allows remote attackers to inject arbitrary web script or HTML via the cert_cn cookie parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://asheesh2000.blogspot.com/2013/08/mcafee-vulnerability-manager-75-cross.html; http://packetstormsecurity.com/files/120721/McAfee-Vulnerability-Manager-7.5-Cross-Site-Scripting.html; http://www.securityfocus.com/bid/58401
CVE: CVE-2014-0025
Published: 2014-01-28
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2014-1690.  Reason: This candidate is a reservation duplicate of CVE-2014-1690.  Notes: All CVE users should reference CVE-2014-1690 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2013-2974
Published: 2014-01-29
Description: The BIRT viewer in IBM Tivoli Application Dependency Discovery Manager (TADDM) 7.2.1.x before 7.2.1.5 allows remote authenticated users to bypass authorization checks and obtain report-administration privileges, and consequently create or delete reports or conduct SQL injection attacks, via crafted parameters to the BIRT reporting URL.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://www.ibm.com/support/docview.wss?uid=swg21662955; https://exchange.xforce.ibmcloud.com/vulnerabilities/83877; http://www.ibm.com/support/docview.wss?uid=swg21662955
CVE: CVE-2013-6748
Published: 2014-01-29
Description: Buffer overflow in the ActiveX control in qp2.cab in IBM Lotus Quickr for Domino 8.5.1 before 8.5.1.42-001b allows remote attackers to execute arbitrary code via a crafted HTML document, a different vulnerability than CVE-2013-6749.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://osvdb.org/102597; http://secunia.com/advisories/56696; http://www.ibm.com/support/docview.wss?uid=swg21662653
CVE: CVE-2013-6749
Published: 2014-01-29
Description: Buffer overflow in the ActiveX control in qp2.cab in IBM Lotus Quickr for Domino 8.5.1 before 8.5.1.42-001b allows remote attackers to execute arbitrary code via a crafted HTML document, a different vulnerability than CVE-2013-6748.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://osvdb.org/102598; http://secunia.com/advisories/56696; http://www.ibm.com/support/docview.wss?uid=swg21662653
CVE: CVE-2013-6930
Published: 2014-01-29
Description: SQL injection vulnerability in the page-navigation implementation in Cybozu Garoon 2.0.0 through 2.0.6, 2.1.0 through 2.1.3, 2.5.0 through 2.5.4, 3.0.0 through 3.0.3, 3.5.0 through 3.5.5, and 3.7.x before 3.7.3 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, a different vulnerability than CVE-2013-6929.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://cs.cybozu.co.jp/information/20140127up02.php; http://jvn.jp/en/jp/JVN91153528/374951/index.html; http://jvn.jp/en/jp/JVN91153528/index.html
CVE: CVE-2013-6931
Published: 2014-01-29
Description: SQL injection vulnerability in the API in Cybozu Garoon 3.7.x before 3.7.3 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, a different vulnerability than CVE-2013-6929.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://cs.cybozu.co.jp/information/20140127up03.php; http://jvn.jp/en/jp/JVN91153528/374951/index.html; http://jvn.jp/en/jp/JVN91153528/index.html
CVE: CVE-2014-0810
Published: 2014-01-29
Description: Unspecified vulnerability in JustSystems Sanshiro 2007 before update 3, 2008 before update 5, 2009 before update 6, and 2010 before update 6, and Sanshiro Viewer before 2.0.2.0, allows remote attackers to execute arbitrary code via a crafted document.
CVSS Score: 7.5 (HIGH)
References: http://jvn.jp/en/jp/JVN28011378/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2014-000011; http://www.justsystems.com/jp/info/js14001.html
CVE: CVE-2014-1692
Published: 2014-01-29
Description: The hash_buffer function in schnorr.c in OpenSSH through 6.4, when Makefile.inc is modified to enable the J-PAKE protocol, does not initialize certain data structures, which might allow remote attackers to cause a denial of service (memory corruption) or have unspecified other impact via vectors that trigger an error condition.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2836&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1375&w=2; http://openwall.com/lists/oss-security/2014/01/29/10
CVE: CVE-2014-0680
Published: 2014-01-29
Description: Cross-site scripting (XSS) vulnerability in the HTTP control interface in the NAC Web Agent component in Cisco Identity Services Engine (ISE) allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCui15038.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/102588; http://secunia.com/advisories/56672; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0680
CVE: CVE-2014-0681
Published: 2014-01-29
Description: Cross-site scripting (XSS) vulnerability in Cisco Identity Services Engine (ISE) 1.2 patch 2 and earlier allows remote attackers to inject arbitrary web script or HTML via a report containing a crafted URL that is not properly handled during generation of report-output pages, aka Bug ID CSCui15064.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/102589; http://secunia.com/advisories/56714; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0681
CVE: CVE-2014-0682
Published: 2014-01-29
Description: Cisco WebEx Meetings Server allows remote authenticated users to bypass authorization checks and (1) join arbitrary meetings, or (2) terminate a meeting without having a host role, via a crafted URL, aka Bug ID CSCuj42346.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/102590; http://secunia.com/advisories/56668; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0682
CVE: CVE-2012-6086
Published: 2014-01-29
Description: libs/zbxmedia/eztexting.c in Zabbix 1.8.x before 1.8.18rc1, 2.0.x before 2.0.8rc1, and 2.1.x before 2.1.2 does not properly set the CURLOPT_SSL_VERIFYHOST option for libcurl, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-310
References: http://www.openwall.com/lists/oss-security/2013/01/03/1; http://www.securityfocus.com/bid/57103; https://support.zabbix.com/browse/ZBX-5924
CVE: CVE-2013-2747
Published: 2014-01-29
Description: The password reset feature in Courion Access Risk Management Suite Version 8 Update 9 allows remote authenticated users to bypass intended Internet Explorer usage restrictions and execute arbitrary commands by using keyboard shortcuts to navigate the file system and open a command prompt.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://blog.securestate.com/courion-authentication-bypass-vulnerability-disclosure-cve-2013-2747/; http://blog.securestate.com/courion-authentication-bypass-vulnerability-disclosure-cve-2013-2747/
CVE: CVE-2013-4661
Published: 2014-01-29
Description: CiviCRM 2.0.0 through 4.2.9 and 4.3.0 through 4.3.3 does not properly enforce role-based access control (RBAC) restrictions for default custom searches, which allows remote authenticated users with the "access CiviCRM" permission to bypass intended access restrictions, as demonstrated by accessing custom contribution data without having the "access CiviContribute" permission.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-264
References: http://civicrm.org/advisory/civi-sa-2013-003; http://civicrm.org/advisory/civi-sa-2013-003-custom-search-permissions; http://issues.civicrm.org/jira/browse/CRM-12747
CVE: CVE-2013-4662
Published: 2014-01-29
Description: The Quick Search API in CiviCRM 4.2.0 through 4.2.9 and 4.3.0 through 4.3.3 allows remote authenticated users to bypass the validation layer and conduct SQL injection attacks via a direct request to the "second layer" of the API, related to contact.getquick.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://issues.civicrm.org/jira/browse/CRM-12765; https://civicrm.org/advisory/civi-sa-2013-004-limited-sql-injection-quick-search-api; http://issues.civicrm.org/jira/browse/CRM-12765
CVE: CVE-2013-4887
Published: 2014-01-29
Description: SQL injection vulnerability in index.php in Digital Signage Xibo 1.4.2 allows remote attackers to execute arbitrary SQL commands via the displayid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://infosec42.blogspot.com/2013/08/exploit-xibo-digital-signage-sql.html; http://www.securityfocus.com/bid/62071; https://exchange.xforce.ibmcloud.com/vulnerabilities/86777
CVE: CVE-2013-4888
Published: 2014-01-29
Description: Cross-site scripting (XSS) vulnerability in index.php in Digital Signage Xibo 1.4.2 allows remote attackers to inject arbitrary web script or HTML via the layout parameter in the layout page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://infosec42.blogspot.com/2013/08/exploit-xibo-digital-signage-sql.html; http://infosec42.blogspot.com/2013/08/exploit-xibo-digital-signage-sql.html
CVE: CVE-2013-4889
Published: 2014-01-29
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in index.php in Digital Signage Xibo 1.4.2 allow remote attackers to hijack the authentication of administrators for requests that (1) add a new administrator via the AddUser action or (2) conduct cross-site scripting (XSS) attacks, as demonstrated by CVE-2013-4888.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://infosec42.blogspot.com/2013/08/exploit-xibo-digital-signage-sql.html; http://infosec42.blogspot.com/2013/08/exploit-xibo-digital-signage-sql.html
CVE: CVE-2013-4898
Published: 2014-01-29
Description: Unrestricted file upload vulnerability in the user profile page feature in the Timeline Plugin 4.2.5p9 for SocialEngine allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in public/temporary/timeline/.
CVSS Score: 6.5 (MEDIUM)
References: http://www.exploit-db.com/exploits/27272/; http://www.securityfocus.com/archive/1/527791; http://www.exploit-db.com/exploits/27272/
CVE: CVE-2013-5005
Published: 2014-01-29
Description: Multiple cross-site scripting (XSS) vulnerabilities in ajaxRequest/methodCall.do in Tripwire Enterprise 8.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) m_target_class_name, (2) m_target_method_name, or (3) m_request_context_params parameters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/65242; http://www.zerodaylab.com/zdl-advisories/2013-5005.html; http://www.securityfocus.com/bid/65242
CVE: CVE-2013-5092
Published: 2014-01-29
Description: Cross-site scripting (XSS) vulnerability in afa/php/Login.php in AlgoSec Firewall Analyzer 6.1-b86 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/122737/algosec-xss.txt; http://www.osvdb.org/96806; http://www.securityfocus.com/bid/61733
CVE: CVE-2013-6141
Published: 2014-01-29
Description: Unspecified vulnerability in op5 Monitor before 6.1.3 allows attackers to read arbitrary files via unknown vectors related to lack of authorization.
CVSS Score: 5.0 (MEDIUM)
References: https://bugs.op5.com/view.php?id=7677; https://bugs.op5.com/view.php?id=7677
CVE: CVE-2013-7318
Published: 2014-01-29
Description: Cross-site scripting (XSS) vulnerability in BusinessFlow/login in AlgoSec Firewall Analyzer 6.4 allows remote attackers to inject arbitrary web script or HTML via the message parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/122899/algosec64-xss.txt; http://www.osvdb.org/96807; http://packetstormsecurity.com/files/122899/algosec64-xss.txt
CVE: CVE-2014-1683
Published: 2014-01-29
Description: The bashMail function in cms/data/skins/techjunkie/fragments/contacts/functions.php in SkyBlueCanvas CMS before 1.1 r248-04, when the pid parameter is 4, allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) name, (2) email, (3) subject, or (4) message parameter to index.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-134
References: http://packetstormsecurity.com/files/124948/SkyBlueCanvas-CMS-1.1-r248-03-Command-Injection.html; http://seclists.org/fulldisclosure/2014/Jan/159; http://secunia.com/advisories/56646
CVE: CVE-2014-0835
Published: 2014-01-30
Description: Cross-site request forgery (CSRF) vulnerability in IBM Security QRadar SIEM 7.2 MR1 and earlier allows remote attackers to hijack the authentication of administrators for requests that modify console Auto Update settings.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://osvdb.org/102554; http://seclists.org/fulldisclosure/2014/Jan/166; http://secunia.com/advisories/56653
CVE: CVE-2014-0836
Published: 2014-01-30
Description: Cross-site scripting (XSS) vulnerability in IBM Security QRadar SIEM 7.2 MR1 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/102555; http://seclists.org/fulldisclosure/2014/Jan/166; http://secunia.com/advisories/56653
CVE: CVE-2014-0837
Published: 2014-01-30
Description: The AutoUpdate process in IBM Security QRadar SIEM 7.2 MR1 and earlier does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers via a crafted certificate.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-310
References: http://osvdb.org/102552; http://seclists.org/fulldisclosure/2014/Jan/166; http://secunia.com/advisories/56653
CVE: CVE-2014-0838
Published: 2014-01-30
Description: The AutoUpdate package before 6.4 for IBM Security QRadar SIEM 7.2 MR1 and earlier allows remote attackers to execute arbitrary console commands by leveraging control of the server.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/102553; http://www-01.ibm.com/support/docview.wss?uid=swg21663066; http://www.securityfocus.com/bid/65127
CVE: CVE-2012-3000
Published: 2014-01-30
Description: Multiple SQL injection vulnerabilities in sam/admin/reports/php/saveSettings.php in the (1) APM WebGUI in F5 BIG-IP LTM, GTM, ASM, Link Controller, PSM, APM, Edge Gateway, and Analytics and (2) AVR WebGUI in WebAccelerator and WOM 11.2.x before 11.2.0-HF3 and 11.2.x before 11.2.1-HF3 allow remote authenticated users to execute arbitrary SQL commands via the defaultQuery parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://archives.neohapsis.com/archives/bugtraq/2013-01/0094.html; http://osvdb.org/89446; http://packetstormsecurity.com/files/119739/F5-BIG-IP-11.2.0-SQL-Injection.html
CVE: CVE-2013-0177
Published: 2014-01-30
Description: Multiple cross-site scripting (XSS) vulnerabilities in widget/screen/ModelScreenWidget.java in Apache Open For Business Project (aka OFBiz) 10.04.x before 10.04.05, 11.04.01, and possibly 09.04.x allow remote authenticated users to inject arbitrary web script or HTML via the (1) Screenlet.title or (2) Image.alt Widget attribute, as demonstrated by the parentPortalPageId parameter to exampleext/control/ManagePortalPages.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://ofbiz.apache.org/download.html#vulnerabilities; http://osvdb.org/89452; http://osvdb.org/89453
CVE: CVE-2013-1376
Published: 2014-01-30
Description: Buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.3, 10.x before 10.1.5, and 11.x before 11.0.1 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2013-0606, CVE-2013-0612, CVE-2013-0615, CVE-2013-0617, and CVE-2013-0621.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://www.adobe.com/support/security/bulletins/apsb13-02.html; http://www.adobe.com/support/security/bulletins/apsb13-02.html
CVE: CVE-2013-3084
Published: 2014-01-30
Description: Multiple cross-site scripting (XSS) vulnerabilities in Belkin Model F5D8236-4 v2 router allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://securityevaluators.com/content/case-studies/routers/Vulnerability_Catalog.pdf; https://exchange.xforce.ibmcloud.com/vulnerabilities/83839; http://securityevaluators.com/content/case-studies/routers/Vulnerability_Catalog.pdf
CVE: CVE-2013-3087
Published: 2014-01-30
Description: Multiple cross-site scripting (XSS) vulnerabilities in Belkin N900 router allow remote attackers to inject arbitrary web script or HTML via the (1) ssid2 parameter to wl_channel.html or (2) guest_psk parameter to wl_guest.html.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://securityevaluators.com/content/case-studies/routers/Vulnerability_Catalog.pdf; http://securityevaluators.com/knowledge/case_studies/routers/belkin_n900.php; https://exchange.xforce.ibmcloud.com/vulnerabilities/83831
CVE: CVE-2013-3090
Published: 2014-01-30
Description: Multiple cross-site scripting (XSS) vulnerabilities in Belkin N300 router allow remote attackers to inject arbitrary web script or HTML via the Guest Access PSK field to wireless_guest2_print.stm or other unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://securityevaluators.com/content/case-studies/routers/Vulnerability_Catalog.pdf; http://securityevaluators.com/knowledge/case_studies/routers/belkin_n900.php; https://exchange.xforce.ibmcloud.com/vulnerabilities/83837
CVE: CVE-2013-7246
Published: 2014-01-30
Description: Buffer overflow in the IconCreate method in an ActiveX control in the DaumGame ActiveX plugin 1.1.0.4 and 1.1.0.5 allows remote attackers to execute arbitrary code via a long string, as exploited in the wild in January 2014.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://blog.spiderlabs.com/2014/01/daumgame-activex-0day.html; http://packetstormsecurity.com/files/124886; http://seclists.org/fulldisclosure/2014/Jan/132
CVE: CVE-2014-0793
Published: 2014-01-30
Description: Multiple cross-site scripting (XSS) vulnerabilities in the StackIdeas Komento (com_komento) component before 1.7.3 for Joomla! allow remote attackers to inject arbitrary web script or HTML via the (1) website or (2) latitude parameter in a comment to the default URI.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://stackideas.com/downloads/changelog/komento; http://www.exploit-db.com/exploits/31174; http://www.securityfocus.com/archive/1/530873/100/0/threaded
CVE: CVE-2014-1611
Published: 2014-01-30
Description: Cross-site scripting (XSS) vulnerability in the Anonymous Posting module 7.x-1.2 and 7.x-1.3 for Drupal allows remote attackers to inject arbitrary web script or HTML via the contact name field.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/102126; http://packetstormsecurity.com/files/124803/Drupal-Anonymous-Posting-7.x-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2014/Jan/77
CVE: CVE-2014-1612
Published: 2014-01-30
Description: Cross-site scripting (XSS) vulnerability in login.esp in the Web Management Interface in Media5 Mediatrix 4402 VoIP Gateway with firmware Dgw 1.1.13.186 and earlier allows remote attackers to inject arbitrary web script or HTML via the username parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/102415; http://packetstormsecurity.com/files/124931/Mediatrix-4402-Cross-Site-Scripting.html; http://secunia.com/advisories/56638
CVE: CVE-2014-1837
Published: 2014-01-30
Description: Cross-site scripting (XSS) vulnerability in the StackIdeas Komento (com_komento) component before 1.7.4 for Joomla! allows remote attackers to inject arbitrary web script or HTML via vectors related to "checking new comments."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/102563; http://secunia.com/advisories/56577; http://stackideas.com/downloads/changelog/komento
CVE: CVE-2013-7303
Published: 2014-01-30
Description: Multiple cross-site scripting (XSS) vulnerabilities in (1) squelettes-dist/formulaires/inscription.php and (2) prive/forms/editer_auteur.php in SPIP before 2.1.25 and 3.0.x before 3.0.13 allow remote attackers to inject arbitrary web script or HTML via the author name field.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://core.spip.org/projects/spip/repository/revisions/20902; http://seclists.org/oss-sec/2014/q1/123; http://seclists.org/oss-sec/2014/q1/128
CVE: CVE-2014-1610
Published: 2014-01-30
Description: MediaWiki 1.22.x before 1.22.2, 1.21.x before 1.21.5, and 1.19.x before 1.19.11, when DjVu or PDF file upload support is enabled, allows remote attackers to execute arbitrary commands via shell metacharacters in (1) the page parameter to includes/media/DjVu.php; (2) the w parameter (aka width field) to thumb.php, which is not properly handled by includes/media/PdfHandler_body.php; and possibly unspecified vectors in (3) includes/media/Bitmap.php and (4) includes/media/ImageHandler.php.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-20
References: http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127942.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127948.html; http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-January/000140.html
CVE: CVE-2013-6727
Published: 2014-01-31
Description: The Connect client in IBM Sametime 8.5.2 through 8.5.2.1 and 9.0 before HF1 does not properly restrict unsigned Java plugins, which allows remote attackers to obtain sensitive information via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg21662725; https://exchange.xforce.ibmcloud.com/vulnerabilities/89282; http://www-01.ibm.com/support/docview.wss?uid=swg21662725