deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-8441
Published: 2014-11-11
Description: Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR before 15.0.0.356, Adobe AIR SDK before 15.0.0.356, and Adobe AIR SDK & Compiler before 15.0.0.356 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0576, CVE-2014-0581, and CVE-2014-8440.
CVSS Score: 10.0 (HIGH)
References: http://helpx.adobe.com/security/products/flash-player/apsb14-24.html; http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00013.html; http://www.securityfocus.com/bid/71050
CVE: CVE-2014-8442
Published: 2014-11-11
Description: Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR before 15.0.0.356, Adobe AIR SDK before 15.0.0.356, and Adobe AIR SDK & Compiler before 15.0.0.356 allow attackers to complete a transition from Low Integrity to Medium Integrity by leveraging incorrect permissions.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://helpx.adobe.com/security/products/flash-player/apsb14-24.html; http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00013.html; http://www.securityfocus.com/bid/71040
CVE: CVE-2014-1635
Published: 2014-11-12
Description: Buffer overflow in login.cgi in MiniHttpd in Belkin N750 Router with firmware before F9K1103_WW_1.10.17m allows remote attackers to execute arbitrary code via a long string in the jump parameter.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://osvdb.org/show/osvdb/114345; http://www.belkin.com/us/support-article?articleNum=4831; http://www.exploit-db.com/exploits/35184
CVE: CVE-2014-8555
Published: 2014-11-12
Description: Directory traversal vulnerability in report/reportViewAction.jsp in Progress Software OpenEdge 11.2 allows remote attackers to read arbitrary files via a .. (dot dot) in the selection parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.com/files/129052/Progress-OpenEdge-11.2-Directory-Traversal.html; http://www.exploit-db.com/exploits/35127; http://www.exploit-db.com/exploits/35207
CVE: CVE-2014-8734
Published: 2014-11-12
Description: The Organic Groups Menu (aka OG Menu) module before 7.x-2.2 for Drupal allows remote authenticated users with the "access administration pages" permission to change module settings via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-264
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/98445; https://www.drupal.org/node/2365259; https://www.drupal.org/node/2365685
CVE: CVE-2014-8735
Published: 2014-11-12
Description: The Bad Behavior module 6.x-2.x before 6.x-2.2216 and 7.x-2.x before 7.x-2.2216 for Drupal logs usernames and passwords, which allows remote authenticated users with the "administer bad behavior" permission to obtain sensitive information by reading a log file.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: https://www.drupal.org/node/2360953; https://www.drupal.org/node/2360955; https://www.drupal.org/node/2361611
CVE: CVE-2014-8736
Published: 2014-11-12
Description: The Open Atrium Core module for Drupal before 7.x-2.22 allows remote attackers to bypass access restrictions and read file attachments that have been removed from a node by leveraging a previous revision of the node.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: https://www.drupal.org/node/2357279; https://www.drupal.org/node/2357295; https://www.drupal.org/node/2357279
CVE: CVE-2014-3602
Published: 2014-11-13
Description: Red Hat OpenShift Enterprise before 2.2 allows local users to obtain IP address and port number information for remote systems by reading /proc/net/tcp.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://rhn.redhat.com/errata/RHSA-2014-1796.html; http://rhn.redhat.com/errata/RHSA-2014-1906.html; http://rhn.redhat.com/errata/RHSA-2014-1796.html
CVE: CVE-2014-3674
Published: 2014-11-13
Description: Red Hat OpenShift Enterprise before 2.2 does not properly restrict access to gears, which allows remote attackers to access the network resources of arbitrary gears via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://rhn.redhat.com/errata/RHSA-2014-1796.html; http://rhn.redhat.com/errata/RHSA-2014-1906.html; http://rhn.redhat.com/errata/RHSA-2014-1796.html
CVE: CVE-2014-7823
Published: 2014-11-13
Description: The virDomainGetXMLDesc API in Libvirt before 1.2.11 allows remote read-only users to obtain the VNC password by using the VIR_DOMAIN_XML_MIGRATABLE flag, which triggers the use of the VIR_DOMAIN_XML_SECURE flag.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-255
References: http://lists.opensuse.org/opensuse-updates/2014-11/msg00083.html; http://secunia.com/advisories/60010; http://secunia.com/advisories/60895
CVE: CVE-2014-8359
Published: 2014-11-13
Description: Untrusted search path vulnerability in Huawei Mobile Partner for Windows 23.009.05.03.1014 allows local users to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse wintab32.dll in the Mobile Partner directory.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://osandamalith.wordpress.com/2014/10/20/escalating-local-privileges-using-mobile-partner/; http://packetstormsecurity.com/files/128767/Huawei-Mobile-Partner-DLL-Hijacking.html; http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-376152.htm
CVE: CVE-2014-8476
Published: 2014-11-13
Description: The setlogin function in FreeBSD 8.4 through 10.1-RC4 does not initialize the buffer used to store the login name, which allows local users to obtain sensitive information from kernel memory via a call to getlogin, which returns the entire buffer.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://secunia.com/advisories/61118; http://secunia.com/advisories/62218; http://www.debian.org/security/2014/dsa-3070
CVE: CVE-2014-8554
Published: 2014-11-13
Description: SQL injection vulnerability in the mc_project_get_attachments function in api/soap/mc_project_api.php in MantisBT before 1.2.18 allows remote attackers to execute arbitrary SQL commands via the project_id parameter.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-1609.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://seclists.org/oss-sec/2014/q4/479; http://seclists.org/oss-sec/2014/q4/487; http://secunia.com/advisories/62101
CVE: CVE-2014-8557
Published: 2014-11-13
Description: Multiple cross-site scripting (XSS) vulnerabilities in JExperts Channel Platform 5.0.33_CCB allow remote attackers to inject arbitrary web script or HTML via the (1) usuario.nome variable in an editarUsuario action to usuario.do or (2) titulo.form variable in a novoChamado action to ticket.do.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/129009/JExperts-Tecnologia-Channel-Software-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2014/Nov/9; http://www.securityfocus.com/bid/70967
CVE: CVE-2014-8564
Published: 2014-11-13
Description: The _gnutls_ecc_ansi_x963_export function in gnutls_ecc.c in GnuTLS 3.x before 3.1.28, 3.2.x before 3.2.20, and 3.3.x before 3.3.10 allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted (1) Elliptic Curve Cryptography (ECC) certificate or (2) certificate signing requests (CSR), related to generating key IDs.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://lists.opensuse.org/opensuse-updates/2014-11/msg00084.html; http://rhn.redhat.com/errata/RHSA-2014-1846.html; http://secunia.com/advisories/59991
CVE: CVE-2014-8770
Published: 2014-11-13
Description: Unrestricted file upload vulnerability in magmi/web/magmi.php in the MAGMI (aka Magento Mass Importer) plugin 0.7.17a and earlier for Magento Community Edition (CE) allows remote authenticated users to execute arbitrary code by uploading a ZIP file that contains a PHP file, then accessing the PHP file via a direct request to it in magmi/plugins/.
CVSS Score: 9.0 (HIGH)
CWE: CWE-94
References: http://osvdb.org/show/osvdb/113848; http://www.exploit-db.com/exploits/35052; http://osvdb.org/show/osvdb/113848
CVE: CVE-2014-5424
Published: 2014-11-14
Description: Rockwell Automation Connected Components Workbench (CCW) before 7.00.00 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an invalid property value to an ActiveX control that was built with an outdated compiler.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: https://ics-cert.us-cert.gov/advisories/ICSA-14-294-01; https://ics-cert.us-cert.gov/advisories/ICSA-14-294-01
CVE: CVE-2014-7246
Published: 2014-11-14
Description: The Core Server in OpenAM 9.5.3 through 9.5.5, 10.0.0 through 10.0.2, 10.1.0-Xpress, and 11.0.0 through 11.0.2, when deployed on a multi-server network, allows remote authenticated users to cause a denial of service (infinite loop) via a crafted cookie in a request.
CVSS Score: 3.5 (LOW)
CWE: CWE-20
References: http://jvn.jp/en/jp/JVN65559247/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2014-000129; http://sources.forgerock.org/changelog/openam/?cs=11248
CVE: CVE-2014-7878
Published: 2014-11-14
Description: The Application Lifecycle Service (ALS) in HP Helion Cloud Development Platform 1.0, when a virtual machine is derived from the Seed Node image, uses the same security keys across different customers' installations, which allows remote attackers to execute arbitrary code by leveraging these keys for a connection.
CVSS Score: 10.0 (HIGH)
CWE: CWE-310
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/98636; https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04500238; https://exchange.xforce.ibmcloud.com/vulnerabilities/98636
CVE: CVE-2014-7991
Published: 2014-11-14
Description: The Remote Mobile Access Subsystem in Cisco Unified Communications Manager (CM) 10.0(1) and earlier does not properly validate the Subject Alternative Name (SAN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof VCS core devices via a crafted certificate issued by a legitimate Certification Authority, aka Bug ID CSCuq86376.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-310
References: http://secunia.com/advisories/62267; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-7991; http://tools.cisco.com/security/center/viewAlert.x?alertId=36381
CVE: CVE-2014-3689
Published: 2014-11-14
Description: The vmware-vga driver (hw/display/vmware_vga.c) in QEMU allows local guest users to write to qemu memory locations and gain privileges via unspecified parameters related to rectangle handling.
CVSS Score: 7.2 (HIGH)
CWE: CWE-269
References: http://secunia.com/advisories/60923; http://secunia.com/advisories/62143; http://secunia.com/advisories/62144
CVE: CVE-2014-7815
Published: 2014-11-14
Description: The set_pixel_format function in ui/vnc.c in QEMU allows remote attackers to cause a denial of service (crash) via a small bytes_per_pixel value.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=e6908bfe8e07f2b452e78e677da1b45b1c0f6829; http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00019.html; http://rhn.redhat.com/errata/RHSA-2015-0349.html
CVE: CVE-2014-8567
Published: 2014-11-14
Description: The mod_auth_mellon module before 0.8.1 allows remote attackers to cause a denial of service (Apache HTTP server crash) via a crafted logout request that triggers a read of uninitialized data.
CVSS Score: 9.4 (HIGH)
CWE: CWE-399
References: http://linux.oracle.com/errata/ELSA-2014-1803.html; http://rhn.redhat.com/errata/RHSA-2014-1803.html; http://secunia.com/advisories/62094
CVE: CVE-2014-7248
Published: 2014-11-15
Description: Cross-site scripting (XSS) vulnerability in IPA iLogScanner 4.0 allows remote attackers to inject arbitrary web script or HTML by triggering a crafted entry in a log file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN89852154/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2014-000133; http://www.ipa.go.jp/security/vuln/iLogScanner/
CVE: CVE-2014-7997
Published: 2014-11-15
Description: The DHCP implementation in Cisco IOS on Aironet access points does not properly handle error conditions with short leases and unsuccessful lease-renewal attempts, which allows remote attackers to cause a denial of service (device restart) by triggering a transition into a recovery state that was intended to involve a network-interface restart but actually involves a full device restart, aka Bug ID CSCtn16281.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-7997; http://www.securitytracker.com/id/1031218; https://exchange.xforce.ibmcloud.com/vulnerabilities/98691
CVE: CVE-2014-7998
Published: 2014-11-15
Description: Cisco IOS on Aironet access points, when "dot11 aaa authenticator" debugging is enabled, allows remote attackers to cause a denial of service via a malformed EAP packet, aka Bug ID CSCul15509.
CVSS Score: 7.1 (HIGH)
CWE: CWE-264
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-7998; http://www.securitytracker.com/id/1031219; https://exchange.xforce.ibmcloud.com/vulnerabilities/98692
CVE: CVE-2014-3707
Published: 2014-11-15
Description: The curl_easy_duphandle function in libcurl 7.17.1 through 7.38.0, when running with the CURLOPT_COPYPOSTFIELDS option, does not properly copy HTTP POST data for an easy handle, which triggers an out-of-bounds read that allows remote web servers to read sensitive memory information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://curl.haxx.se/docs/adv_20141105.html; http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10743; http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html
CVE: CVE-2014-4975
Published: 2014-11-15
Description: Off-by-one error in the encodes function in pack.c in Ruby 1.9.3 and earlier, and 2.x through 2.1.2, when using certain format string specifiers, allows context-dependent attackers to cause a denial of service (segmentation fault) via vectors that trigger a stack-based buffer overflow.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://advisories.mageia.org/MGASA-2014-0472.html; http://rhn.redhat.com/errata/RHSA-2014-1912.html; http://rhn.redhat.com/errata/RHSA-2014-1913.html
CVE: CVE-2014-3158
Published: 2014-11-15
Description: Integer overflow in the getword function in options.c in pppd in Paul's PPP Package (ppp) before 2.4.7 allows attackers to "access privileged options" via a long word in an options file, which triggers a heap-based buffer overflow that "[corrupts] security-relevant variables."
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://advisories.mageia.org/MGASA-2014-0368.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136932.html; http://marc.info/?l=linux-ppp&m=[PII_REDACTED]0764
CVE: CVE-2014-3500
Published: 2014-11-15
Description: Apache Cordova Android before 3.5.1 allows remote attackers to change the start page via a crafted intent URL.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-17
References: http://cordova.apache.org/announcements/2014/08/04/android-351.html; http://www.securityfocus.com/bid/69038; http://cordova.apache.org/announcements/2014/08/04/android-351.html
CVE: CVE-2014-3501
Published: 2014-11-15
Description: Apache Cordova Android before 3.5.1 allows remote attackers to bypass the HTTP whitelist and connect to arbitrary servers by using JavaScript to open WebSocket connections through WebView.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-254
References: http://cordova.apache.org/announcements/2014/08/04/android-351.html; http://www.securityfocus.com/bid/69041; http://cordova.apache.org/announcements/2014/08/04/android-351.html
CVE: CVE-2014-3502
Published: 2014-11-15
Description: Apache Cordova Android before 3.5.1 allows remote attackers to open and send data to arbitrary applications via a URL with a crafted URI scheme for an Android intent.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://cordova.apache.org/announcements/2014/08/04/android-351.html; http://cordova.apache.org/announcements/2014/08/06/android-351-update.html; http://www.securityfocus.com/bid/69046
CVE: CVE-2014-5388
Published: 2014-11-15
Description: Off-by-one error in the pci_read function in the ACPI PCI hotplug interface (hw/acpi/pcihp.c) in QEMU allows local guest users to obtain sensitive information and have other unspecified impact related to a crafted PCI device that triggers memory corruption.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-193
References: http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=fa365d7cd[PII_REDACTED]823a5a33d36765454e16; http://seclists.org/oss-sec/2014/q3/438; http://seclists.org/oss-sec/2014/q3/440
CVE: CVE-2014-8565
Published: 2014-11-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2014-8518.  Reason: This candidate is a duplicate of CVE-2014-8518.  Notes: All CVE users should reference CVE-2014-8518 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2014-8566
Published: 2014-11-15
Description: The mod_auth_mellon module before 0.8.1 allows remote attackers to obtain sensitive information or cause a denial of service (segmentation fault) via unspecified vectors related to a "session overflow" involving "sessions overlapping in memory."
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-200
References: http://linux.oracle.com/errata/ELSA-2014-1803.html; http://rhn.redhat.com/errata/RHSA-2014-1803.html; http://secunia.com/advisories/62094
CVE: CVE-2014-2681
Published: 2014-11-16
Description: Zend Framework 1 (ZF1) before 1.12.4, Zend Framework 2 before 2.1.6 and 2.2.x before 2.2.6, ZendOpenId, ZendRest, ZendService_AudioScrobbler, ZendService_Nirvanix, ZendService_SlideShare, ZendService_Technorati, and ZendService_WindowsAzure before 2.0.2, ZendService_Amazon before 2.0.3, and ZendService_Api before 1.0.0 allow remote attackers to read arbitrary files, send HTTP requests to intranet servers, and possibly cause a denial of service (CPU and memory consumption) via an XML External Entity (XXE) attack.  NOTE: this issue exists because of an incomplete fix for CVE-2012-5657.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-19
References: http://advisories.mageia.org/MGASA-2014-0151.html; http://framework.zend.com/security/advisory/ZF2014-01; http://seclists.org/oss-sec/2014/q2/0
CVE: CVE-2014-2682
Published: 2014-11-16
Description: Zend Framework 1 (ZF1) before 1.12.4, Zend Framework 2 before 2.1.6 and 2.2.x before 2.2.6, ZendOpenId, ZendRest, ZendService_AudioScrobbler, ZendService_Nirvanix, ZendService_SlideShare, ZendService_Technorati, and ZendService_WindowsAzure before 2.0.2, ZendService_Amazon before 2.0.3, and ZendService_Api before 1.0.0, when PHP-FPM is used, does not properly share the libxml_disable_entity_loader setting between threads, which might allow remote attackers to conduct XML External Entity (XXE) attacks via an XML external entity declaration in conjunction with an entity reference.  NOTE: this issue exists because of an incomplete fix for CVE-2012-5657.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-19
References: http://advisories.mageia.org/MGASA-2014-0151.html; http://framework.zend.com/security/advisory/ZF2014-01; http://seclists.org/oss-sec/2014/q2/0
CVE: CVE-2014-2683
Published: 2014-11-16
Description: Zend Framework 1 (ZF1) before 1.12.4, Zend Framework 2 before 2.1.6 and 2.2.x before 2.2.6, ZendOpenId, ZendRest, ZendService_AudioScrobbler, ZendService_Nirvanix, ZendService_SlideShare, ZendService_Technorati, and ZendService_WindowsAzure before 2.0.2, ZendService_Amazon before 2.0.3, and ZendService_Api before 1.0.0 allow remote attackers to cause a denial of service (CPU consumption) via (1) recursive or (2) circular references in an XML entity definition in an XML DOCTYPE declaration, aka an XML Entity Expansion (XEE) attack.  NOTE: this issue exists because of an incomplete fix for CVE-2012-6532.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-17
References: http://advisories.mageia.org/MGASA-2014-0151.html; http://framework.zend.com/security/advisory/ZF2014-01; http://seclists.org/oss-sec/2014/q2/0
CVE: CVE-2014-2684
Published: 2014-11-16
Description: The GenericConsumer class in the Consumer component in ZendOpenId before 2.0.2 and the Zend_OpenId_Consumer class in Zend Framework 1 before 1.12.4 does not verify that the openid_op_endpoint value identifies the same Identity Provider as the provider used in the association handle, which allows remote attackers to bypass authentication and spoof arbitrary OpenID identities by using a malicious OpenID Provider that generates OpenID tokens with arbitrary identifier and claimed_id values.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-264
References: http://advisories.mageia.org/MGASA-2014-0151.html; http://framework.zend.com/security/advisory/ZF2014-02; http://seclists.org/oss-sec/2014/q2/0
CVE: CVE-2014-2268
Published: 2014-11-16
Description: views/Index.php in the Install module in vTiger 6.0 before Security Patch 2 does not properly restrict access, which allows remote attackers to re-install the application via a request that sets the X-Requested-With HTTP header, as demonstrated by executing arbitrary PHP code via the db_name parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://vtiger-crm.2324883.n4.nabble.com/Vtigercrm-developers-IMP-forgot-password-and-re-installation-security-fix-tt9786.html; http://www.exploit-db.com/exploits/32794; http://www.securityfocus.com/bid/66757
CVE: CVE-2014-2667
Published: 2014-11-16
Description: Race condition in the _get_masked_mode function in Lib/os.py in Python 3.2 through 3.5, when exist_ok is set to true and multiple threads are used, might allow local users to bypass intended file permissions by leveraging a separate application vulnerability before the umask has been set to the expected value.
CVSS Score: 3.3 (LOW)
CWE: CWE-362
References: http://bugs.python.org/issue21082; http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html; http://lists.opensuse.org/opensuse-updates/2014-05/msg00007.html
CVE: CVE-2014-3209
Published: 2014-11-16
Description: The ldns-keygen tool in ldns 1.6.x uses the current umask to set the privileges of the private key, which might allow local users to obtain the private key by reading the file.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://www.openwall.com/lists/oss-security/2014/05/03/2; http://www.openwall.com/lists/oss-security/2014/05/05/4; http://www.securityfocus.com/bid/67200
CVE: CVE-2012-2301
Published: 2014-11-16
Description: The Ubercart module 6.x-2.x before 6.x-2.8 for Drupal allows remote authenticated users with the "administer product classes" permission to execute arbitrary PHP code via unspecified vectors.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-94
References: http://drupal.org/node/1547506; http://drupal.org/node/1547508; http://drupal.org/node/1547674
CVE: CVE-2013-3737
Published: 2014-11-16
Description: The MobileUI (aka RT-Extension-MobileUI) extension before 1.04 in Request Tracker (RT) 4.0.0 before 4.0.13, when using the file-based session store (Apache::Session::File) and certain authentication extensions, allows remote attackers to reuse unauthorized sessions and obtain user preferences and caches via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://lists.bestpractical.com/pipermail/rt-announce/2013-June/000230.html; http://secunia.com/advisories/53799; http://www.osvdb.org/94280
CVE: CVE-2013-0347
Published: 2014-11-16
Description: The Gentoo init script for webfs uses world-readable permissions for /var/log/webfsd.log, which allows local users to have unspecified impact by reading the file.
CVSS Score: 7.2 (HIGH)
CWE: CWE-200
References: http://osvdb.org/90585; http://seclists.org/oss-sec/2013/q1/404; http://seclists.org/oss-sec/2013/q1/405