deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-3410
Published: 2014-12-20
Description: The syslog-management subsystem in Cisco Adaptive Security Appliance (ASA) Software allows remote attackers to obtain an administrator password by waiting for an administrator to copy a file, and then (1) sniffing the network for a syslog message or (2) reading a syslog message in a file on a syslog server, aka Bug IDs CSCuq22357 and CSCur41860.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3410; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3410
CVE: CVE-2014-8007
Published: 2014-12-20
Description: Cisco Prime Infrastructure allows remote authenticated users to read device-discovery passwords by examining the HTML source code of the Quick Discovery options page, aka Bug ID CSCum00019.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-8007; http://www.securitytracker.com/id/1031416; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-8007
CVE: CVE-2014-8019
Published: 2014-12-20
Description: Directory traversal vulnerability in Cisco Enterprise Content Delivery System (ECDS) allows remote attackers to read arbitrary files via a crafted URL, aka Bug ID CSCuo90148.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-8019; http://www.securitytracker.com/id/1031417; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-8019
CVE: CVE-2014-9193
Published: 2014-12-20
Description: Innominate mGuard with firmware before 7.6.6 and 8.x before 8.1.4 allows remote authenticated admins to obtain root privileges by changing a PPP configuration setting.
CVSS Score: 8.5 (HIGH)
CWE: CWE-269, CWE-264
References: http://www.innominate.com/data/downloads/software/innominate_security_advisory_20141217_001_en.pdf; https://www.cisa.gov/news-events/ics-advisories/icsa-14-352-02; http://www.innominate.com/data/downloads/software/innominate_security_advisory_20141217_001_en.pdf
CVE: CVE-2014-9293
Published: 2014-12-20
Description: The config_auth function in ntpd in NTP before 4.2.7p11, when an auth key is not configured, improperly generates a key, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via a brute-force attack.
CVSS Score: 7.5 (HIGH)
References: http://advisories.mageia.org/MGASA-2014-0541.html; http://bk1.ntp.org/ntp-dev/ntpd/ntp_config.c?PAGE=diffs&REV=4b6089c5KXhXqZqocF0DMXnQQsjOuw; http://bugs.ntp.org/show_bug.cgi?id=2665
CVE: CVE-2014-9294
Published: 2014-12-20
Description: util/ntp-keygen.c in ntp-keygen in NTP before 4.2.7p230 uses a weak RNG seed, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via a brute-force attack.
CVSS Score: 7.5 (HIGH)
References: http://advisories.mageia.org/MGASA-2014-0541.html; http://bk1.ntp.org/ntp-dev/util/ntp-keygen.c?PAGE=diffs&REV=4eae1b72298KRoBQmX-y8URCiRPH5g; http://bugs.ntp.org/show_bug.cgi?id=2666
CVE: CVE-2014-9295
Published: 2014-12-20
Description: Multiple stack-based buffer overflows in ntpd in NTP before 4.2.8 allow remote attackers to execute arbitrary code via a crafted packet, related to (1) the crypto_recv function when the Autokey Authentication feature is used, (2) the ctl_putdata function, and (3) the configure function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://advisories.mageia.org/MGASA-2014-0541.html; http://bk1.ntp.org/ntp-dev/?PAGE=patch&REV=548acc4dN1TbM1tRJrbPcA4yc1aTdA; http://bk1.ntp.org/ntp-dev/?PAGE=patch&REV=548acdf3tUSFizXcv_X4b77Jt_Y-cg
CVE: CVE-2014-9296
Published: 2014-12-20
Description: The receive function in ntp_proto.c in ntpd in NTP before 4.2.8 continues to execute after detecting a certain authentication error, which might allow remote attackers to trigger an unintended association change via crafted packets.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-17
References: http://advisories.mageia.org/MGASA-2014-0541.html; http://bk1.ntp.org/ntp-dev/?PAGE=patch&REV=548ad06feXHK1HlZoY-WZVyynwvwAg; http://bugs.ntp.org/show_bug.cgi?id=2670
CVE: CVE-2014-8142
Published: 2014-12-20
Description: Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.36, 5.5.x before 5.5.20, and 5.6.x before 5.6.4 allows remote attackers to execute arbitrary code via a crafted unserialize call that leverages improper handling of duplicate keys within the serialized properties of an object, a different vulnerability than CVE-2004-1019.
CVSS Score: 7.5 (HIGH)
References: http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=630f9c33c23639de85c3fd306b209b538b73b4c9; http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00029.html; http://lists.opensuse.org/opensuse-updates/2015-02/msg00079.html
CVE: CVE-2014-7286
Published: 2014-12-22
Description: Buffer overflow in AClient in Symantec Deployment Solution 6.9 and earlier on Windows XP and Server 2003 allows local users to gain privileges via unspecified vectors.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/71727; http://www.securitytracker.com/id/1031421; http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20141219_00
CVE: CVE-2014-8896
Published: 2014-12-22
Description: The Collaboration Server in IBM InfoSphere Master Data Management Server for Product Information Management 9.x through 9.1 and InfoSphere Master Data Management - Collaborative Edition 10.x through 10.1, 11.0 before FP7, and 11.3 and 11.4 before 11.4 FP1 allows remote authenticated users to modify the administrator's credentials and consequently gain privileges via unspecified vectors.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-287
References: http://www-01.ibm.com/support/docview.wss?uid=swg21692176; https://exchange.xforce.ibmcloud.com/vulnerabilities/99049; http://www-01.ibm.com/support/docview.wss?uid=swg21692176
CVE: CVE-2014-8897
Published: 2014-12-22
Description: Cross-site scripting (XSS) vulnerability in the Collaboration Server in IBM InfoSphere Master Data Management Server for Product Information Management 9.x through 9.1 and InfoSphere Master Data Management - Collaborative Edition 10.x through 10.1, 11.0 before FP7, and 11.3 and 11.4 before 11.4 FP1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2014-8898 and CVE-2014-8899.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21692176; https://exchange.xforce.ibmcloud.com/vulnerabilities/99050; http://www-01.ibm.com/support/docview.wss?uid=swg21692176
CVE: CVE-2014-8898
Published: 2014-12-22
Description: Cross-site scripting (XSS) vulnerability in the Collaboration Server in IBM InfoSphere Master Data Management Server for Product Information Management 9.x through 9.1 and InfoSphere Master Data Management - Collaborative Edition 10.x through 10.1, 11.0 before FP7, and 11.3 and 11.4 before 11.4 FP1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2014-8897 and CVE-2014-8899.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21692176; https://exchange.xforce.ibmcloud.com/vulnerabilities/99051; http://www-01.ibm.com/support/docview.wss?uid=swg21692176
CVE: CVE-2014-8899
Published: 2014-12-22
Description: Cross-site scripting (XSS) vulnerability in the Collaboration Server in IBM InfoSphere Master Data Management Server for Product Information Management 9.x through 9.1 and InfoSphere Master Data Management - Collaborative Edition 10.x through 10.1, 11.0 before FP7, and 11.3 and 11.4 before 11.4 FP1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2014-8897 and CVE-2014-8898.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21692176; https://exchange.xforce.ibmcloud.com/vulnerabilities/99052; http://www-01.ibm.com/support/docview.wss?uid=swg21692176
CVE: CVE-2014-5208
Published: 2014-12-22
Description: BKBCopyD.exe in the Batch Management Packages in Yokogawa CENTUM CS 3000 through R3.09.50 and CENTUM VP through R4.03.00 and R5.x through R5.04.00, and Exaopc through R3.72.10, does not require authentication, which allows remote attackers to read arbitrary files via a RETR operation, write to arbitrary files via a STOR operation, or obtain sensitive database-location information via a PMODE operation, a different vulnerability than CVE-2014-0784.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: http://www.yokogawa.com/dcs/security/ysar/YSAR-14-0003E.pdf; https://community.rapid7.com/community/metasploit/blog/2014/08/09/r7-2014-10-disclosure-yokogawa-centum-cs3000-bkbcopydexe-file-system-access; https://ics-cert.us-cert.gov/advisories/ICSA-14-260-01A
CVE: CVE-2014-8015
Published: 2014-12-22
Description: The Sponsor Portal in Cisco Identity Services Engine (ISE) allows remote authenticated users to obtain access to an arbitrary sponsor's guest account via a modified HTTP request, aka Bug ID CSCur64400.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-8015; http://www.securitytracker.com/id/1031423; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-8015
CVE: CVE-2014-8017
Published: 2014-12-22
Description: The periodic-backup feature in Cisco Identity Services Engine (ISE) allows remote attackers to discover backup-encryption passwords via a crafted request that triggers inclusion of a password in a reply, aka Bug ID CSCur41673.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-8017; http://www.securityfocus.com/bid/71767; http://www.securitytracker.com/id/1031425
CVE: CVE-2014-8018
Published: 2014-12-22
Description: Multiple cross-site scripting (XSS) vulnerabilities in Business Voice Services Manager (BVSM) pages in the Application Software in Cisco Unified Communications Domain Manager 8 allow remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug IDs CSCur19651, CSCur18555, CSCur19630, and CSCur19661.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-8018; http://www.securityfocus.com/bid/71771; http://www.securitytracker.com/id/1031424
CVE: CVE-2014-8992
Published: 2014-12-22
Description: Cross-site scripting (XSS) vulnerability in manager/assets/fileapi/FileAPI.flash.image.swf in MODX Revolution 2.3.2-pl allows remote attackers to inject arbitrary web script or HTML via the callback parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://github.com/modxcms/revolution/issues/12161; https://github.com/modxcms/revolution/issues/12161
CVE: CVE-2014-6119
Published: 2014-12-23
Description: IBM Security AppScan Enterprise 8.5 before 8.5 IFix 002, 8.6 before 8.6 IFix 004, 8.7 before 8.7 IFix 004, 8.8 before 8.8 iFix 003, 9.0 before 9.0.0.1 iFix 003, and 9.0.1 before 9.0.1 iFix 001 allows remote attackers to execute arbitrary code via a crafted executable file in an archive.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/62012; http://www-01.ibm.com/support/docview.wss?uid=swg21693035; http://www-01.ibm.com/support/docview.wss?uid=swg21693183
CVE: CVE-2014-6121
Published: 2014-12-23
Description: Cross-site scripting (XSS) vulnerability in IBM Security AppScan Enterprise 8.5 before 8.5 IFix 002, 8.6 before 8.6 IFix 004, 8.7 before 8.7 IFix 004, 8.8 before 8.8 iFix 003, 9.0 before 9.0.0.1 iFix 003, and 9.0.1 before 9.0.1 iFix 001 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21693035; http://www.securitytracker.com/id/1031427; https://exchange.xforce.ibmcloud.com/vulnerabilities/96722
CVE: CVE-2014-6122
Published: 2014-12-23
Description: IBM Security AppScan Enterprise 8.5 before 8.5 IFix 002, 8.6 before 8.6 IFix 004, 8.7 before 8.7 IFix 004, 8.8 before 8.8 iFix 003, 9.0 before 9.0.0.1 iFix 003, and 9.0.1 before 9.0.1 iFix 001 allows remote authenticated users to write to arbitrary folders, and consequently execute arbitrary commands, via a modified argument.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg21693035; http://www.securitytracker.com/id/1031427; https://exchange.xforce.ibmcloud.com/vulnerabilities/96723
CVE: CVE-2014-6135
Published: 2014-12-23
Description: IBM Security AppScan Enterprise 8.5 before 8.5 IFix 002, 8.6 before 8.6 IFix 004, 8.7 before 8.7 IFix 004, 8.8 before 8.8 iFix 003, 9.0 before 9.0.0.1 iFix 003, and 9.0.1 before 9.0.1 iFix 001 allows remote attackers to conduct clickjacking attacks via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://www-01.ibm.com/support/docview.wss?uid=swg21693035; http://www.securitytracker.com/id/1031427; https://exchange.xforce.ibmcloud.com/vulnerabilities/96815
CVE: CVE-2014-8024
Published: 2014-12-23
Description: The API in the Guest Server in Cisco Jabber, when the HTML5 CORS feature is used, allows remote attackers to obtain sensitive information by sniffing the network during an HTTP (1) GET or (2) POST request, aka Bug ID CSCus19789.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-8024; http://www.securityfocus.com/bid/71770; http://www.securitytracker.com/id/1031422
CVE: CVE-2014-8025
Published: 2014-12-23
Description: The API in the Guest Server in Cisco Jabber, when HTML5 is used, allows remote attackers to obtain sensitive information by sniffing the network during an HTTP (1) GET or (2) POST response, aka Bug ID CSCus19801.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-8025; http://www.securityfocus.com/bid/71768; http://www.securitytracker.com/id/1031422
CVE: CVE-2014-8026
Published: 2014-12-23
Description: Cross-site scripting (XSS) vulnerability in the Guest Server in Cisco Jabber allows remote attackers to inject arbitrary web script or HTML via a (1) GET or (2) POST parameter, aka Bug ID CSCus08074.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-8026; http://www.securityfocus.com/bid/71769; http://www.securitytracker.com/id/1031422
CVE: CVE-2014-5214
Published: 2014-12-23
Description: nps/servlet/webacc in iManager in the Administration Console server in NetIQ Access Manager (NAM) 4.x before 4.0.1 HF3 allows remote authenticated novlwww users to read arbitrary files via a query parameter containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
CVSS Score: 4.0 (MEDIUM)
References: http://packetstormsecurity.com/files/129658/NetIQ-Access-Manager-4.0-SP1-XSS-CSRF-XXE-Injection-Disclosure.html; http://seclists.org/fulldisclosure/2014/Dec/78; https://www.novell.com/support/kb/doc.php?id=7015993
CVE: CVE-2014-5215
Published: 2014-12-23
Description: NetIQ Access Manager (NAM) 4.x before 4.0.1 HF3 allows remote authenticated administrators to discover service-account passwords via a request to (1) roma/jsp/volsc/monitoring/dev_services.jsp or (2) roma/jsp/debug/debug.jsp.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://packetstormsecurity.com/files/129658/NetIQ-Access-Manager-4.0-SP1-XSS-CSRF-XXE-Injection-Disclosure.html; http://seclists.org/fulldisclosure/2014/Dec/78; https://www.novell.com/support/kb/doc.php?id=7015995
CVE: CVE-2014-5216
Published: 2014-12-23
Description: Multiple cross-site scripting (XSS) vulnerabilities in NetIQ Access Manager (NAM) 4.x before 4.0.1 HF3 allow remote attackers to inject arbitrary web script or HTML via (1) the location parameter in a dev.Empty action to nps/servlet/webacc, (2) the error parameter to nidp/jsp/x509err.jsp, (3) the lang parameter to sslvpn/applet_agent.jsp, or (4) the secureLoggingServersA parameter to roma/system/cntl, a different issue than CVE-2014-9412.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/129658/NetIQ-Access-Manager-4.0-SP1-XSS-CSRF-XXE-Injection-Disclosure.html; http://seclists.org/fulldisclosure/2014/Dec/78; https://www.novell.com/support/kb/doc.php?id=7015994
CVE: CVE-2014-5217
Published: 2014-12-23
Description: Cross-site request forgery (CSRF) vulnerability in nps/servlet/webacc in the Administration Console server in NetIQ Access Manager (NAM) 4.x before 4.1 allows remote attackers to hijack the authentication of administrators for requests that change the administrative password via an fw.SetPassword action.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.com/files/129658/NetIQ-Access-Manager-4.0-SP1-XSS-CSRF-XXE-Injection-Disclosure.html; http://seclists.org/fulldisclosure/2014/Dec/78; https://www.novell.com/support/kb/doc.php?id=7015997
CVE: CVE-2014-9115
Published: 2014-12-23
Description: SQL injection vulnerability in the rate_picture function in include/functions_rate.inc.php in Piwigo before 2.5.5, 2.6.x before 2.6.4, and 2.7.x before 2.7.2 allows remote attackers to execute arbitrary SQL commands via the rate parameter to picture.php, related to an improper data type in a comparison of a non-numeric value that begins with a digit.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://piwigo.org/dev/changeset/30563/trunk/include/functions_rate.inc.php; http://piwigo.org/forum/viewtopic.php?id=24850; http://piwigo.org/releases/2.7.2
CVE: CVE-2014-9412
Published: 2014-12-23
Description: Multiple cross-site scripting (XSS) vulnerabilities in NetIQ Access Manager (NAM) 4.x before 4.1 allow remote attackers to inject arbitrary web script or HTML via (1) an arbitrary parameter to roma/jsp/debug/debug.jsp or (2) an arbitrary parameter in a debug.DumpAll action to nps/servlet/webacc, a different issue than CVE-2014-5216.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/129658/NetIQ-Access-Manager-4.0-SP1-XSS-CSRF-XXE-Injection-Disclosure.html; http://seclists.org/fulldisclosure/2014/Dec/78; https://www.novell.com/support/kb/doc.php?id=7015994
CVE: CVE-2014-7993
Published: 2014-12-24
Description: Cisco-Meraki MS, MR, and MX devices with firmware before 2014-09-24 allow remote attackers to obtain sensitive credential information by leveraging unspecified HTTP handler access on the local network, aka Cisco-Meraki defect ID 00302012.
CVSS Score: 3.3 (LOW)
CWE: CWE-200
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=36797; https://dashboard.meraki.com/firmware_security; http://tools.cisco.com/security/center/viewAlert.x?alertId=36797
CVE: CVE-2014-7994
Published: 2014-12-24
Description: Cisco-Meraki MS, MR, and MX devices with firmware before 2014-09-24 allow remote attackers to execute arbitrary commands by leveraging knowledge of a cross-device secret and a per-device secret, and sending a request to an unspecified HTTP handler on the local network, aka Cisco-Meraki defect ID 00301991.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-20
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=36798; https://dashboard.meraki.com/firmware_security; http://tools.cisco.com/security/center/viewAlert.x?alertId=36798
CVE: CVE-2014-7995
Published: 2014-12-24
Description: Cisco-Meraki MS, MR, and MX devices with firmware before 2014-09-24 allow physically proximate attackers to obtain shell access by opening a device's case and connecting a cable to a serial port, aka Cisco-Meraki defect ID 00302077.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=36799; https://dashboard.meraki.com/firmware_security; http://tools.cisco.com/security/center/viewAlert.x?alertId=36799
CVE: CVE-2014-7999
Published: 2014-12-24
Description: Cisco-Meraki MS, MR, and MX devices with firmware before 2014-09-24 allow remote authenticated users to install arbitrary firmware by leveraging unspecified HTTP handler access on the local network, aka Cisco-Meraki defect ID 00478565.
CVSS Score: 7.7 (HIGH)
CWE: CWE-264
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=36800; https://dashboard.meraki.com/firmware_security; http://tools.cisco.com/security/center/viewAlert.x?alertId=36800
CVE: CVE-2014-3569
Published: 2014-12-24
Description: The ssl23_get_client_hello function in s23_srvr.c in OpenSSL 0.9.8zc, 1.0.0o, and 1.0.1j does not properly handle attempts to use unsupported protocols, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an unexpected handshake, as demonstrated by an SSLv3 handshake to a no-ssl3 application with certain error handling.  NOTE: this issue became relevant after the CVE-2014-3568 fix.
CVSS Score: 5.0 (MEDIUM)
References: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10679; http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00021.html
CVE: CVE-2014-6132
Published: 2014-12-24
Description: Cross-site scripting (XSS) vulnerability in the Web UI in IBM WebSphere Service Registry and Repository (WSRR) 6.3 through 6.3.0.5, 7.0.x through 7.0.0.5, 7.5.x through 7.5.0.4, 8.0.x before 8.0.0.3, and 8.5.x before 8.5.0.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://secunia.com/advisories/61805; http://www-01.ibm.com/support/docview.wss?uid=swg1IV64000; http://www.ibm.com/support/docview.wss?uid=swg21693379
CVE: CVE-2014-6153
Published: 2014-12-24
Description: The Web UI in IBM WebSphere Service Registry and Repository (WSRR) 6.3.x through 6.3.0.5, 7.0.x through 7.0.0.5, 7.5.x through 7.5.0.4, 8.0.x before 8.0.0.3, and 8.5.x before 8.5.0.1 does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-310
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IV64010; http://www.ibm.com/support/docview.wss?uid=swg21693379; http://www.ibm.com/support/docview.wss?uid=swg21693381
CVE: CVE-2014-6155
Published: 2014-12-24
Description: Multiple directory traversal vulnerabilities in the ServiceRegistry UI in IBM WebSphere Service Registry and Repository (WSRR) 7.5.x through 7.5.0.4, 8.0.x before 8.0.0.3, and 8.5.x before 8.5.0.1 allow remote authenticated users to read arbitrary files via unspecified vectors.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/61805; http://www-01.ibm.com/support/docview.wss?uid=swg1IV63585; http://www.ibm.com/support/docview.wss?uid=swg21693384
CVE: CVE-2014-6177
Published: 2014-12-24
Description: IBM WebSphere Service Registry and Repository (WSRR) 7.0.x before 7.0.0.5 and 7.5.x before 7.5.0.3 does not perform access-control checks for depth-0 retrieve operations, which allows remote authenticated users to obtain sensitive information via unspecified vectors.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IV24386; http://www.ibm.com/support/docview.wss?uid=swg21693381; http://www.ibm.com/support/docview.wss?uid=swg21693384
CVE: CVE-2014-6178
Published: 2014-12-24
Description: Cross-site scripting (XSS) vulnerability in the widgets in IBM WebSphere Service Registry and Repository (WSRR) 7.5.x before 7.5.0.4 and 8.0.x before 8.0.0.3 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IV51765; http://www.ibm.com/support/docview.wss?uid=swg21693384; http://www.ibm.com/support/docview.wss?uid=swg21693387