deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-1501
Published: 2015-02-16
Description: The factory.loadExtensionFactory function in TSUnicodeGraphEditorControl in SolarWinds Server and Application Monitor (SAM) allow remote attackers to execute arbitrary code via a UNC path to a crafted binary.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://www.zerodayinitiative.com/advisories/ZDI-15-043/; http://www.zerodayinitiative.com/advisories/ZDI-15-043/
CVE: CVE-2015-1613
Published: 2015-02-16
Description: RhodeCode before 2.2.7 allows remote authenticated users to obtain API keys and other sensitive information via the (1) update_repo, (2) get_locks, or (3) get_user_groups API method.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: https://rhodecode.com/blog/rhodecode-enterprise-security-release/; https://rhodecode.com/blog/rhodecode-enterprise-security-release/
CVE: CVE-2014-6102
Published: 2015-02-17
Description: IBM Maximo Asset Management 7.1 through 7.1.1.13 and 7.5.0 before 7.5.0.6 IFIX008, Maximo Asset Management 7.5.0 through 7.5.0.3 and 7.5.1 through 7.5.1.2 for SmartCloud Control Desk, and Maximo Asset Management 7.1 through 7.1.1.13 and 7.2 for Tivoli IT Asset Management for IT and certain other products do not properly handle logout actions, which allows remote attackers to bypass intended Cognos BI Direct Integration access restrictions by leveraging an unattended workstation.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg21695597; https://exchange.xforce.ibmcloud.com/vulnerabilities/96141; http://www-01.ibm.com/support/docview.wss?uid=swg21695597
CVE: CVE-2014-6194
Published: 2015-02-17
Description: Directory traversal vulnerability in an unspecified web form in IBM Maximo Asset Management 7.1 through 7.1.1.13 and 7.5.0 before 7.5.0.6 IFIX007, Maximo Asset Management 7.5.0 through 7.5.0.3 and 7.5.1 through 7.5.1.2 for SmartCloud Control Desk, and Maximo Asset Management 7.1 through 7.1.1.13 and 7.2 for Tivoli IT Asset Management for IT and certain other products allows remote authenticated users to read arbitrary files via a .. (dot dot) in a pathname.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-22
References: http://www-01.ibm.com/support/docview.wss?uid=swg21694035; https://exchange.xforce.ibmcloud.com/vulnerabilities/98605; http://www-01.ibm.com/support/docview.wss?uid=swg21694035
CVE: CVE-2014-8023
Published: 2015-02-17
Description: Cisco Adaptive Security Appliance (ASA) Software 9.2(.3) and earlier, when challenge-response authentication is used, does not properly select tunnel groups, which allows remote authenticated users to bypass intended resource-access restrictions via a crafted tunnel-group parameter, aka Bug ID CSCtz48533.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-8023; http://tools.cisco.com/security/center/viewAlert.x?alertId=37489; http://www.securityfocus.com/bid/72618
CVE: CVE-2014-8757
Published: 2015-02-17
Description: LG On-Screen Phone (OSP) before 4.3.010 allows remote attackers to bypass authorization via a crafted request.
CVSS Score: 8.3 (HIGH)
CWE: CWE-284
References: http://packetstormsecurity.com/files/130286/LG-On-Screen-Phone-Authentication-Bypass.html; http://seclists.org/fulldisclosure/2015/Feb/26; http://www.securityfocus.com/archive/1/534643/100/0/threaded
CVE: CVE-2014-9466
Published: 2015-02-17
Description: Open-Xchange (OX) AppSuite and Server before 7.4.2-rev42, 7.6.0 before 7.6.0-rev36, and 7.6.1 before 7.6.1-rev14 does not properly handle directory permissions, which allows remote authenticated users to read files via unspecified vectors, related to the "folder identifier."
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://packetstormsecurity.com/files/130379/Open-Xchange-Server-6-OX-AppSuite-7.6.1-Exposure.html; http://www.securityfocus.com/archive/1/534695/100/0/threaded; http://www.securityfocus.com/bid/72587
CVE: CVE-2015-0247
Published: 2015-02-17
Description: Heap-based buffer overflow in openfs.c in the libext2fs library in e2fsprogs before 1.42.12 allows local users to execute arbitrary code via crafted block group descriptor data in a filesystem image.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-119
References: http://advisories.mageia.org/MGASA-2015-0061.html; http://git.kernel.org/cgit/fs/ext2/e2fsprogs.git/commit/?id=f66e6ce4; http://lists.fedoraproject.org/pipermail/package-announce/2015-February/149434.html
CVE: CVE-2015-1427
Published: 2015-02-17
Description: The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script.
CVSS Score: 9.8 (CRITICAL)
References: http://packetstormsecurity.com/files/130368/Elasticsearch-1.3.7-1.4.2-Sandbox-Escape-Command-Execution.html; http://packetstormsecurity.com/files/130784/ElasticSearch-Unauthenticated-Remote-Code-Execution.html; http://www.elasticsearch.com/blog/elasticsearch-1-4-3-1-3-8-released/
CVE: CVE-2015-1494
Published: 2015-02-17
Description: The FancyBox for WordPress plugin before 3.0.3 for WordPress does not properly restrict access, which allows remote attackers to conduct cross-site scripting (XSS) attacks via an mfbfw[*] parameter in an update action to wp-admin/admin-post.php, as demonstrated by the mfbfw[padding] parameter and exploited in the wild in February 2015.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://blog.sucuri.net/2015/02/zero-day-in-the-fancybox-for-wordpress-plugin.html; http://osvdb.org/show/osvdb/118543; http://www.exploit-db.com/exploits/36087
CVE: CVE-2015-1616
Published: 2015-02-17
Description: SQL injection vulnerability in the ePO extension in McAfee Data Loss Prevention Endpoint (DLPe) before 9.3.400 allows remote authenticated ePO users to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10098; https://kc.mcafee.com/corporate/index?page=content&id=SB10098
CVE: CVE-2015-1617
Published: 2015-02-17
Description: Cross-site scripting (XSS) vulnerability in the ePO extension in McAfee Data Loss Prevention Endpoint (DLPe) before 9.3.400 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10098; https://kc.mcafee.com/corporate/index?page=content&id=SB10098
CVE: CVE-2015-1618
Published: 2015-02-17
Description: The ePO extension in McAfee Data Loss Prevention Endpoint (DLPe) before 9.3.400 allows remote authenticated users to obtain sensitive password information via a crafted URL.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10098; https://kc.mcafee.com/corporate/index?page=content&id=SB10098
CVE: CVE-2015-1619
Published: 2015-02-17
Description: Cross-site scripting (XSS) vulnerability in the Secure Web Mail Client user interface in McAfee Email Gateway (MEG) 7.6.x before 7.6.3.2, 7.5.x before 75.6, 7.0.x through 7.0.5, 5.6, and earlier allows remote authenticated users to inject arbitrary web script or HTML via unspecified tokens in Digest messages.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10099; https://kc.mcafee.com/corporate/index?page=content&id=SB10099
CVE: CVE-2015-1621
Published: 2015-02-17
Description: Cross-site scripting (XSS) vulnerability in the Webform prepopulate block module before 7.x-3.1 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2015/02/13/12; https://www.drupal.org/node/2423681; https://www.drupal.org/node/2424405
CVE: CVE-2015-0108
Published: 2015-02-18
Description: Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 7.1 through 7.1.1.8, and Maximo Asset Management 7.1 through 7.1.1.8 and 7.2 for Tivoli IT Asset Management for IT and certain other products, allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-0104, CVE-2015-0107, and CVE-2015-0109.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21694974; https://exchange.xforce.ibmcloud.com/vulnerabilities/99605; http://www-01.ibm.com/support/docview.wss?uid=swg21694974
CVE: CVE-2015-0109
Published: 2015-02-18
Description: Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 7.1 through 7.1.1.8, and Maximo Asset Management 7.1 through 7.1.1.8 and 7.2 for Tivoli IT Asset Management for IT and certain other products, allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-0104, CVE-2015-0107, and CVE-2015-0108.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21694974; https://exchange.xforce.ibmcloud.com/vulnerabilities/99606; http://www-01.ibm.com/support/docview.wss?uid=swg21694974
CVE: CVE-2015-0617
Published: 2015-02-18
Description: Cisco ASR 5500 System Architecture Evolution (SAE) Gateway devices allow remote attackers to cause a denial of service (CPU consumption and SNMP outage) via malformed SNMP packets, aka Bug ID CSCur13393.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015-0617; http://www.securitytracker.com/id/1031754; https://exchange.xforce.ibmcloud.com/vulnerabilities/100923
CVE: CVE-2015-0620
Published: 2015-02-18
Description: The XML parser in Cisco TelePresence Management Suite (TMS) 14.3(.2) and earlier does not properly handle external entities, which allows remote authenticated users to cause a denial of service via POST requests, aka Bug ID CSCus51494.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015-0620; http://tools.cisco.com/security/center/viewAlert.x?alertId=37491; http://www.securitytracker.com/id/1031753
CVE: CVE-2015-0621
Published: 2015-02-18
Description: Cisco TelePresence MCU devices with software 4.5(1.45) allow remote attackers to cause a denial of service (device reload) via an unspecified series of TCP packets, aka Bug ID CSCur50347.
CVSS Score: 7.8 (HIGH)
CWE: CWE-19
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015-0621; http://tools.cisco.com/security/center/viewAlert.x?alertId=37495; http://www.securityfocus.com/bid/72635
CVE: CVE-2015-1355
Published: 2015-02-18
Description: Siemens SIMATIC STEP 7 (TIA Portal) before 13 SP1 uses a weak password-hash algorithm, which makes it easier for local users to determine cleartext passwords by reading a project file and conducting a brute-force attack.
CVSS Score: 2.1 (LOW)
CWE: CWE-310
References: http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-234789.pdf; http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-234789.pdf
CVE: CVE-2015-1356
Published: 2015-02-18
Description: Siemens SIMATIC STEP 7 (TIA Portal) before 13 SP1 determines a user's privileges on the basis of project-file fields that lack integrity protection, which allows remote attackers to establish arbitrary authorization data via a modified file.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-264
References: http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-234789.pdf; http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-234789.pdf
CVE: CVE-2015-1358
Published: 2015-02-18
Description: The remote-management module in the (1) Multi Panels, (2) Comfort Panels, and (3) RT Advanced functionality in Siemens SIMATIC WinCC (TIA Portal) before 13 SP1 and in the (4) panels and (5) runtime functionality in SIMATIC WinCC flexible before 2008 SP3 Up7 does not properly encrypt credentials in transit, which makes it easier for remote attackers to determine cleartext credentials by sniffing the network and conducting a decryption attack.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://www.securityfocus.com/bid/72625; http://www.securitytracker.com/id/1036090; http://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-526760.pdf
CVE: CVE-2015-0622
Published: 2015-02-19
Description: The Wireless Intrusion Detection (aka WIDS) functionality on Cisco Wireless LAN Controller (WLC) devices allows remote attackers to cause a denial of service (device outage) via crafted packets that are improperly handled during rendering of the Signature Events Summary page, aka Bug ID CSCus46861.
CVSS Score: 7.1 (HIGH)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015-0622; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015-0622
CVE: CVE-2015-0623
Published: 2015-02-19
Description: Cross-site scripting (XSS) vulnerability in the Administrator report page on Cisco Web Security Appliance (WSA) devices allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug ID CSCus40627.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015-0623; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015-0623
CVE: CVE-2015-0626
Published: 2015-02-19
Description: The SOAP interface in Cisco Hosted Collaboration Solution (HCS) allows remote attackers to obtain access to system-management tools via crafted Challenge SOAP calls, aka Bug ID CSCuc38114.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015-0626; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015-0626
CVE: CVE-2014-5286
Published: 2015-02-19
Description: The ActiveMatrix Policy Manager Authentication module in TIBCO ActiveMatrix Policy Agent 3.x before 3.1.2, ActiveMatrix Policy Manager 3.x before 3.1.2, ActiveMatrix Management Agent 1.x before 1.2.1 for WCF, and ActiveMatrix Management Agent 1.x before 1.2.1 for WebSphere allows remote attackers to gain privileges and obtain sensitive information via unspecified vectors.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-264
References: http://www.tibco.com/assets/blt1b18947cad32d1c4/2014-007-advisory.txt; http://www.tibco.com/mk/advisory.jsp; http://www.tibco.com/services/support/advisories/activematrix-advisory_20150218
CVE: CVE-2014-6147
Published: 2015-02-19
Description: IBM Flex System Manager (FSM) 1.1.x.x, 1.2.0.x, 1.2.1.x, 1.3.0.0, 1.3.1.0, and 1.3.2.0 allows local users to obtain sensitive information, and consequently gain privileges or conduct impersonation attacks, via unspecified vectors.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IT05310; http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5097120; https://exchange.xforce.ibmcloud.com/vulnerabilities/96917
CVE: CVE-2015-1349
Published: 2015-02-19
Description: named in ISC BIND 9.7.0 through 9.9.6 before 9.9.6-P2 and 9.10.x before 9.10.1-P2, when DNSSEC validation and the managed-keys feature are enabled, allows remote attackers to cause a denial of service (assertion failure and daemon exit, or daemon crash) by triggering an incorrect trust-anchor management scenario in which no key is ready for use.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-399
References: http://advisories.mageia.org/MGASA-2015-0082.html; http://lists.apple.com/archives/security-announce/2015/Sep/msg00004.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-March/150904.html
CVE: CVE-2014-5352
Published: 2015-02-19
Description: The krb5_gss_process_context_token function in lib/gssapi/krb5/process_context_token.c in the libgssapi_krb5 library in MIT Kerberos 5 (aka krb5) through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before 1.13.1 does not properly maintain security-context handles, which allows remote authenticated users to cause a denial of service (use-after-free and double free, and daemon crash) or possibly execute arbitrary code via crafted GSSAPI traffic, as demonstrated by traffic to kadmind.
CVSS Score: 9.0 (HIGH)
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151103.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151437.html; http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00011.html
CVE: CVE-2014-6301
Published: 2015-02-19
Description: Multiple cross-site scripting (XSS) vulnerabilities in the tables-management module in PNMsoft Sequence Kinetics before 7.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://licensing.pnmsoft.com/documents/Security%20Bulletins/Security%20Bulletin%202014-1.htm; http://twitter.com/d_gianni/statuses/[PII_REDACTED]48270849/photo/1; http://licensing.pnmsoft.com/documents/Security%20Bulletins/Security%20Bulletin%202014-1.htm
CVE: CVE-2014-6302
Published: 2015-02-19
Description: The Monitoring Administration pages in PNMsoft Sequence Kinetics before 7.7 allow remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
CVSS Score: 5.0 (MEDIUM)
References: http://licensing.pnmsoft.com/documents/Security%20Bulletins/Security%20Bulletin%202014-1.htm; http://twitter.com/d_gianni/statuses/[PII_REDACTED]48270849/photo/1; http://licensing.pnmsoft.com/documents/Security%20Bulletins/Security%20Bulletin%202014-1.htm
CVE: CVE-2014-6303
Published: 2015-02-19
Description: The Monitoring Administration pages in PNMsoft Sequence Kinetics before 7.7 do not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (resource consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://licensing.pnmsoft.com/documents/Security%20Bulletins/Security%20Bulletin%202014-1.htm; http://twitter.com/d_gianni/statuses/[PII_REDACTED]48270849/photo/1; http://licensing.pnmsoft.com/documents/Security%20Bulletins/Security%20Bulletin%202014-1.htm
CVE: CVE-2014-6304
Published: 2015-02-19
Description: The Form Controls CSS file in PNMsoft Sequence Kinetics before 7.7 allows remote attackers to obtain sensitive source-code information via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://licensing.pnmsoft.com/documents/Security%20Bulletins/Security%20Bulletin%202014-1.htm; http://twitter.com/d_gianni/statuses/[PII_REDACTED]48270849/photo/1; http://licensing.pnmsoft.com/documents/Security%20Bulletins/Security%20Bulletin%202014-1.htm
CVE: CVE-2014-9421
Published: 2015-02-19
Description: The auth_gssapi_unwrap_data function in lib/rpc/auth_gssapi_misc.c in MIT Kerberos 5 (aka krb5) through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before 1.13.1 does not properly handle partial XDR deserialization, which allows remote authenticated users to cause a denial of service (use-after-free and double free, and daemon crash) or possibly execute arbitrary code via malformed XDR data, as demonstrated by data sent to kadmind.
CVSS Score: 9.0 (HIGH)
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151103.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151437.html; http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00011.html
CVE: CVE-2014-9422
Published: 2015-02-19
Description: The check_rpcsec_auth function in kadmin/server/kadm_rpc_svc.c in kadmind in MIT Kerberos 5 (aka krb5) through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before 1.13.1 allows remote authenticated users to bypass a kadmin/* authorization check and obtain administrative access by leveraging access to a two-component principal with an initial "kadmind" substring, as demonstrated by a "ka/x" principal.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-284
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151103.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151437.html; http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00011.html
CVE: CVE-2014-9423
Published: 2015-02-19
Description: The svcauth_gss_accept_sec_context function in lib/rpc/svc_auth_gss.c in MIT Kerberos 5 (aka krb5) 1.11.x through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before 1.13.1 transmits uninitialized interposer data to clients, which allows remote attackers to obtain sensitive information from process heap memory by sniffing the network for data in a handle field.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151103.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151437.html; http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00011.html
CVE: CVE-2012-6687
Published: 2015-02-19
Description: FastCGI (aka fcgi and libfcgi) 2.4.0 allows remote attackers to cause a denial of service (segmentation fault and crash) via a large number of connections.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://advisories.mageia.org/MGASA-2015-0184.html; http://www.openwall.com/lists/oss-security/2015/02/06/4; http://www.openwall.com/lists/oss-security/2015/02/07/4
CVE: CVE-2014-1831
Published: 2015-02-19
Description: Phusion Passenger before 4.0.37 allows local users to write to certain files and directories via a symlink attack on (1) control_process.pid or a (2) generation-* file.
CVSS Score: 2.1 (LOW)
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-February/149032.html; http://openwall.com/lists/oss-security/2014/01/28/8; http://openwall.com/lists/oss-security/2014/01/30/3
CVE: CVE-2014-1832
Published: 2015-02-19
Description: Phusion Passenger 4.0.37 allows local users to write to certain files and directories via a symlink attack on (1) control_process.pid or a (2) generation-* file.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-1831.
CVSS Score: 2.1 (LOW)
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-February/149032.html; http://openwall.com/lists/oss-security/2014/01/29/6; http://openwall.com/lists/oss-security/2014/01/30/3
CVE: CVE-2014-8165
Published: 2015-02-19
Description: scripts/amsvis/powerpcAMS/amsnet.py in powerpc-utils-python uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object.
CVSS Score: 10.0 (HIGH)
CWE: CWE-345
References: http://rhn.redhat.com/errata/RHSA-2016-2607.html; http://sourceforge.net/p/powerpc-utils/mailman/message/32884230/; http://www.openwall.com/lists/oss-security/2015/02/09/4
CVE: CVE-2014-8690
Published: 2015-02-19
Description: Multiple cross-site scripting (XSS) vulnerabilities in Exponent CMS before 2.1.4 patch 6, 2.2.x before 2.2.3 patch 9, and 2.3.x before 2.3.1 patch 4 allow remote attackers to inject arbitrary web script or HTML via the (1) PATH_INFO, the (2) src parameter in a none action to index.php, or the (3) "First Name" or (4) "Last Name" field to users/edituser.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://exponentcms.lighthouseapp.com/projects/61783/tickets/1230-universal-cross-site-scripting-in-exponent-cms-231-and-prior; http://osvdb.org/show/osvdb/118263; http://osvdb.org/show/osvdb/118345
CVE: CVE-2014-9465
Published: 2015-02-19
Description: senddocument.php in Zarafa WebApp before 2.0 beta 3 and WebAccess in Zarafa Collaboration Platform (ZCP) 7.x before 7.1.12 beta 1 and 7.2.x before 7.2.0 beta 1 allows remote attackers to cause a denial of service (/tmp disk consumption) by uploading a large number of files.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://advisories.mageia.org/MGASA-2015-0049.html; http://download.zarafa.com/community/beta/7.1/changelog-7.1.txt; http://download.zarafa.com/community/beta/7.2/changelog-7.2.txt