deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-3913
Published: 2014-06-04
Description: Stack-based buffer overflow in AccessServer32.exe in Ericom AccessNow Server allows remote attackers to execute arbitrary code via a request for a non-existent file.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://packetstormsecurity.com/files/127152/Ericom-AccessNow-Server-Buffer-Overflow.html; http://www.ericom.com/security-ERM-2014-610.asp; http://www.exploit-db.com/exploits/33817
CVE: CVE-2014-3948
Published: 2014-06-04
Description: Cross-site scripting (XSS) vulnerability in the HTML export wizard in the backend module in the powermail extension before 1.6.11 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/58909; http://typo3.org/extensions/repository/view/powermail; http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2014-007
CVE: CVE-2014-3949
Published: 2014-06-04
Description: Cross-site scripting (XSS) vulnerability in the layout wizard in the Grid Elements (gridelements) extension before 1.5.1 and 2.0.x before 2.0.3 for TYPO3 allows remote authenticated backend users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://secunia.com/advisories/58592; http://typo3.org/extensions/repository/view/gridelements; http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2014-008
CVE: CVE-2014-3960
Published: 2014-06-04
Description: Multiple cross-site scripting (XSS) vulnerabilities in OpenNMS before 1.12.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/58748; http://www.opennms.org/documentation/ReleaseNotesStable.html#opennms-1.12.7; http://www.securityfocus.com/bid/67774
CVE: CVE-2014-3961
Published: 2014-06-04
Description: SQL injection vulnerability in the Export CSV page in the Participants Database plugin before 1.5.4.9 for WordPress allows remote attackers to execute arbitrary SQL commands via the query parameter in an "output CSV" action to pdb-signup/.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/show/osvdb/107626; http://packetstormsecurity.com/files/126878/WordPress-Participants-Database-1.5.4.8-SQL-Injection.html; http://seclists.org/fulldisclosure/2014/Jun/0
CVE: CVE-2014-3962
Published: 2014-06-04
Description: Multiple SQL injection vulnerabilities in Videos Tube 1.0 allow remote attackers to execute arbitrary SQL commands via the url parameter to (1) videocat.php or (2) single.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/126866/Videos-Tube-1.0-SQL-Injection.html; http://secunia.com/advisories/58844; http://www.exploit-db.com/exploits/33514
CVE: CVE-2014-3963
Published: 2014-06-04
Description: ownCloud Server before 6.0.1 does not properly check permissions, which allows remote authenticated users to access arbitrary preview pictures via unspecified vectors.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://owncloud.org/about/security/advisories/oC-SA-2014-009/; http://owncloud.org/about/security/advisories/oC-SA-2014-009/
CVE: CVE-2012-6141
Published: 2014-06-04
Description: The App::Context module 0.01 through 0.968 for Perl does not properly use the Storable::thaw function, which allows remote attackers to execute arbitrary code via a crafted request to (1) App::Session::Cookie or (2) App::Session::HTMLHidden, which is not properly handled when it is deserialized.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://seclists.org/oss-sec/2013/q2/318; https://exchange.xforce.ibmcloud.com/vulnerabilities/84198; http://seclists.org/oss-sec/2013/q2/318
CVE: CVE-2012-6142
Published: 2014-06-04
Description: Session::Cookie in the HTML::EP module 0.2011 for Perl does not properly use the Storable::thaw function, which allows remote attackers to execute arbitrary code via a crafted request, which is not properly handled when it is deserialized.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://seclists.org/oss-sec/2013/q2/318; http://www.securityfocus.com/bid/59833; https://exchange.xforce.ibmcloud.com/vulnerabilities/84199
CVE: CVE-2012-6143
Published: 2014-06-04
Description: Spoon::Cookie in the Spoon module 0.24 for Perl does not properly use the Storable::thaw function, which allows remote attackers to execute arbitrary code via a crafted request, which is not properly handled when it is deserialized.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://seclists.org/oss-sec/2013/q2/318; http://www.securityfocus.com/bid/59834; https://exchange.xforce.ibmcloud.com/vulnerabilities/84197
CVE: CVE-2013-0302
Published: 2014-06-05
Description: Unspecified vulnerability in ownCloud Server before 4.0.12 allows remote attackers to obtain sensitive information via unspecified vectors related to "inclusion of the Amazon SDK testing suite." NOTE: due to lack of details, it is not clear whether the issue exists in ownCloud itself, or in Amazon SDK.
CVSS Score: 5.0 (MEDIUM)
References: http://owncloud.org/about/security/advisories/oC-SA-2013-005/; http://owncloud.org/about/security/advisories/oC-SA-2013-005/
CVE: CVE-2013-0304
Published: 2014-06-05
Description: ownCloud Server before 4.5.7 does not properly check ownership of calendars, which allows remote authenticated users to read arbitrary calendars via the calid parameter to /apps/calendar/export.php.  NOTE: this issue has been reported as a cross-site request forgery (CSRF) vulnerability, but due to lack of details, it is uncertain what the root cause is.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://owncloud.org/about/security/advisories/oC-SA-2013-007/; http://securite.intrinsec.com/wp-content/uploads/2013/02/ISEC-V2013-01-v-1.0-Owncloud-4.5.4-Arbitrary-calendar-export.pdf; http://owncloud.org/about/security/advisories/oC-SA-2013-007/
CVE: CVE-2014-2051
Published: 2014-06-05
Description: ownCloud Server before 5.0.15 and 6.0.x before 6.0.2 allows remote attackers to conduct an LDAP injection attack via unspecified vectors, as demonstrated using a "login query."
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://owncloud.org/about/security/advisories/oC-SA-2014-005/; http://owncloud.org/about/security/advisories/oC-SA-2014-005/
CVE: CVE-2014-1997
Published: 2014-06-05
Description: The ATEN CN8000 remote-access unit with firmware 1.6.154 and earlier allows remote attackers to cause a denial of service via unspecified vectors.
CVSS Score: 7.8 (HIGH)
References: http://jvn.jp/en/jp/JVN78136804/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2014-000046; http://www.securityfocus.com/bid/67816
CVE: CVE-2014-1998
Published: 2014-06-05
Description: Cross-site scripting (XSS) vulnerability in Nippon Institute of Agroinformatics SOY CMS 1.4.0c and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN54650130/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2014-000047; http://jvn.jp/en/jp/JVN54650130/index.html
CVE: CVE-2014-2345
Published: 2014-06-05
Description: COPA-DATA zenon DNP3 NG driver (DNP3 master) 7.10 and 7.11 through 7.11 SP0 build 10238 and zenon DNP3 Process Gateway (DNP3 outstation) 7.11 SP0 build 10238 and earlier allow remote attackers to cause a denial of service (infinite loop and process crash) by sending a crafted DNP3 packet over TCP.
CVSS Score: 7.1 (HIGH)
CWE: CWE-20, CWE-20
References: http://www.copadata.com/no_cache/en/support/knowledge-base-faq.html?tx_hrfaq_pi1%5Bknowledgebase%5D=813&tx_hrfaq_pi1%5Baction%5D=show&tx_hrfaq_pi1%5Bcontroller%5D=knowledgebase; http://www.copadata.com/no_cache/en/support/knowledge-base-faq.html?tx_hrfaq_pi1%5Bknowledgebase%5D=814&tx_hrfaq_pi1%5Baction%5D=show&tx_hrfaq_pi1%5Bcontroller%5D=knowledgebase; https://www.cisa.gov/news-events/ics-advisories/icsa-14-154-01
CVE: CVE-2014-2346
Published: 2014-06-05
Description: COPA-DATA zenon DNP3 NG driver (DNP3 master) 7.10 and 7.11 through 7.11 SP0 build 10238 and zenon DNP3 Process Gateway (DNP3 outstation) 7.11 SP0 build 10238 and earlier allow physically proximate attackers to cause a denial of service (infinite loop and process crash) via crafted input over a serial line.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-20, CWE-20
References: http://www.copadata.com/no_cache/en/support/knowledge-base-faq.html?tx_hrfaq_pi1%5Bknowledgebase%5D=813&tx_hrfaq_pi1%5Baction%5D=show&tx_hrfaq_pi1%5Bcontroller%5D=knowledgebase; http://www.copadata.com/no_cache/en/support/knowledge-base-faq.html?tx_hrfaq_pi1%5Bknowledgebase%5D=814&tx_hrfaq_pi1%5Baction%5D=show&tx_hrfaq_pi1%5Bcontroller%5D=knowledgebase; https://www.cisa.gov/news-events/ics-advisories/icsa-14-154-01
CVE: CVE-2014-2577
Published: 2014-06-05
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Transform Content Center in Bottomline Technologies Transform Foundation Server before 4.3.1 Patch 8 and 5.x before 5.2 Patch 7 allow remote attackers to inject arbitrary web script or HTML via the (1) pn parameter to index.fsp/document.pdf, (2) db or (3) referer parameter to index.fsp/index.fsp, or (4) PATH_INFO to the default URI.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/126907/Transform-Foundation-Server-4.3.1-5.2-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2014/Jun/15; http://www.pdf-archive.com/2014/06/03/tf431patch8releasenotes/preview/page/9
CVE: CVE-2014-3878
Published: 2014-06-05
Description: Multiple cross-site scripting (XSS) vulnerabilities in the web client interface in Ipswitch IMail Server 12.3 and 12.4, possibly before 12.4.1.15, allow remote attackers to inject arbitrary web script or HTML via (1) the Name field in an add new contact action in the Contacts section or unspecified vectors in (2) an Add Group task in the Contacts section, (3) an add new event action in the Calendar section, or (4) the Task section.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/126948/IPSwitch-IMail-12.4-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2014/Jun/19; http://www.exploit-db.com/exploits/33633
CVE: CVE-2014-3912
Published: 2014-06-05
Description: Stack-based buffer overflow in the FindConfigChildeKeyList method in the XNSSDKDEVICE.XnsSdkDeviceCtrlForIpInstaller.1 ActiveX control in Samsung iPOLiS Device Manager before 1.8.7 allows remote attackers to execute arbitrary code via a long value.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/67823; http://www.zerodayinitiative.com/advisories/ZDI-14-169; http://www.securityfocus.com/bid/67823
CVE: CVE-2014-3917
Published: 2014-06-05
Description: kernel/auditsc.c in the Linux kernel through 3.14.5, when CONFIG_AUDITSYSCALL is enabled with certain syscall rules, allows local users to obtain potentially sensitive single-bit values from kernel memory or cause a denial of service (OOPS) via a large value of a syscall number.
CVSS Score: 3.3 (LOW)
CWE: CWE-200
References: http://article.gmane.org/gmane.linux.kernel/1713179; http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00020.html; http://rhn.redhat.com/errata/RHSA-2014-1143.html
CVE: CVE-2014-3940
Published: 2014-06-05
Description: The Linux kernel through 3.14.5 does not properly consider the presence of hugetlb entries, which allows local users to cause a denial of service (memory corruption or system crash) by accessing certain memory locations, as demonstrated by triggering a race condition via numa_maps read operations during hugepage migration, related to fs/proc/task_mmu.c and mm/mempolicy.c.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-362
References: http://rhn.redhat.com/errata/RHSA-2015-0290.html; http://rhn.redhat.com/errata/RHSA-2015-1272.html; http://secunia.com/advisories/59011
CVE: CVE-2014-3973
Published: 2014-06-05
Description: Multiple SQL injection vulnerabilities in FrontAccounting (FA) before 2.3.21 allow remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://frontaccounting.com/wb3/pages/posts/release-2.3.21201.php; http://secunia.com/advisories/58848; http://sourceforge.net/p/frontaccounting/mercurial/ci/7ab9e443a8eb9d1b03cbed33006b7665bda9383e
CVE: CVE-2014-3974
Published: 2014-06-05
Description: Cross-site scripting (XSS) vulnerability in filemanager.php in AuraCMS 3.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the viewdir parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://bot24.blogspot.com/2014/05/auracms-30-cross-site-scripting-local.html; http://osvdb.org/show/osvdb/107554; http://packetstormsecurity.com/files/126843/AuraCMS-3.0-Cross-Site-Scripting-Local-File-Inclusion.html
CVE: CVE-2014-3975
Published: 2014-06-05
Description: Absolute path traversal vulnerability in filemanager.php in AuraCMS 3.0 allows remote attackers to list a directory via a full pathname in the viewdir parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://bot24.blogspot.com/2014/05/auracms-30-cross-site-scripting-local.html; http://osvdb.org/show/osvdb/107555; http://packetstormsecurity.com/files/126843/AuraCMS-3.0-Cross-Site-Scripting-Local-File-Inclusion.html
CVE: CVE-2014-3976
Published: 2014-06-05
Description: Buffer overflow in A10 Networks Advanced Core Operating System (ACOS) before 2.7.0-p6 and 2.7.1 before 2.7.1-P1_55 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long session id in the URI to sys_reboot.html.  NOTE: some of these details are obtained from third party information.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://osvdb.org/show/osvdb/105354; http://packetstormsecurity.com/files/125979/A10-Networks-ACOS-2.7.0-P2-Buffer-Overflow.html; http://seclists.org/fulldisclosure/2014/Apr/16
CVE: CVE-2012-4728
Published: 2014-06-05
Description: The (1) QProGetNotebookWindowHandle and (2) Ordinal132 functions in QPW160.dll in Corel Quattro Pro X6 Standard Edition 16.0.0.388 and earlier allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted QPW file.
CVSS Score: 4.3 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2013-03/0048.html; http://osvdb.org/91039; http://osvdb.org/91040
CVE: CVE-2013-0733
Published: 2014-06-05
Description: Untrusted search path vulnerability in Corel PaintShop Pro X5 and X6 16.0.0.113, 15.2.0.2, and earlier allows local users to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse dwmapi.dll that is located in the same folder as a .jpg file.
CVSS Score: 9.3 (HIGH)
References: http://osvdb.org/98163; http://secunia.com/advisories/53618; http://www.securityfocus.com/bid/62836
CVE: CVE-2013-2130
Published: 2014-06-05
Description: ZNC 1.0 allows remote authenticated users to cause a denial of service (NULL pointer reference and crash) via a crafted request to the (1) editnetwork, (2) editchan, (3) addchan, or (4) delchan page in modules/webadmin.cpp.
CVSS Score: 4.0 (MEDIUM)
References: http://advisories.mageia.org/MGASA-2013-0257.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-August/114144.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-August/114172.html
CVE: CVE-2013-2618
Published: 2014-06-05
Description: Cross-site scripting (XSS) vulnerability in editor.php in Network Weathermap before 0.97b allows remote attackers to inject arbitrary web script or HTML via the map_title parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/91869; http://packetstormsecurity.com/files/121034/Network-Weathermap-0.97a-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2013/Apr/1
CVE: CVE-2013-3739
Published: 2014-06-05
Description: Directory traversal vulnerability in editor.php in Network Weathermap 0.97c and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the mapname parameter in a show_config action.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://archives.neohapsis.com/archives/bugtraq/2013-06/0035.html; http://osvdb.org/94078; http://www.exploit-db.com/exploits/26125
CVE: CVE-2013-4860
Published: 2014-06-05
Description: Radio Thermostat CT80 And CT50 with firmware 1.4.64 and earlier does not restrict access to the API, which allows remote attackers to change the operation mode, wifi connection settings, temperature thresholds, and other settings via unspecified vectors.
CVSS Score: 8.3 (HIGH)
CWE: CWE-264
References: http://packetstormsecurity.com/files/122657/Radio-Thermostat-Of-America-Inc-Lack-Of-Authentication.html; http://www.securityfocus.com/bid/61581; https://exchange.xforce.ibmcloud.com/vulnerabilities/86197
CVE: CVE-2014-3467
Published: 2014-06-05
Description: Multiple unspecified vulnerabilities in the DER decoder in GNU Libtasn1 before 3.6, as used in GnuTLS, allow remote attackers to cause a denial of service (out-of-bounds read) via crafted ASN.1 data.
CVSS Score: 5.0 (MEDIUM)
References: http://advisories.mageia.org/MGASA-2014-0247.html; http://linux.oracle.com/errata/ELSA-2014-0594.html; http://linux.oracle.com/errata/ELSA-2014-0596.html
CVE: CVE-2014-3468
Published: 2014-06-05
Description: The asn1_get_bit_der function in GNU Libtasn1 before 3.6 does not properly report an error when a negative bit length is identified, which allows context-dependent attackers to cause out-of-bounds access via crafted ASN.1 data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-131
References: http://advisories.mageia.org/MGASA-2014-0247.html; http://git.savannah.gnu.org/cgit/libtasn1.git/commit/?id=1c3ccb3e040bf13e342ee60bc23b21b97b11923f; http://linux.oracle.com/errata/ELSA-2014-0594.html
CVE: CVE-2014-3469
Published: 2014-06-05
Description: The (1) asn1_read_value_type and (2) asn1_read_value functions in GNU Libtasn1 before 3.6 allows context-dependent attackers to cause a denial of service (NULL pointer dereference and crash) via a NULL value in an ivalue argument.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-476
References: http://advisories.mageia.org/MGASA-2014-0247.html; http://linux.oracle.com/errata/ELSA-2014-0594.html; http://linux.oracle.com/errata/ELSA-2014-0596.html
CVE: CVE-2014-3967
Published: 2014-06-05
Description: The HVMOP_inject_msi function in Xen 4.2.x, 4.3.x, and 4.4.x does not properly check the return value from the IRQ setup check, which allows local HVM guest administrators to cause a denial of service (NULL pointer dereference and crash) via unspecified vectors.
CVSS Score: 5.5 (MEDIUM)
References: http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134710.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134739.html; http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00002.html
CVE: CVE-2014-3968
Published: 2014-06-05
Description: The HVMOP_inject_msi function in Xen 4.2.x, 4.3.x, and 4.4.x allows local guest HVM administrators to cause a denial of service (host crash) via a large number of crafted requests, which trigger an error messages to be logged.
CVSS Score: 5.5 (MEDIUM)
References: http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134710.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134739.html; http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00002.html
CVE: CVE-2014-3969
Published: 2014-06-05
Description: Xen 4.4.x, when running on an ARM system, does not properly check write permissions on virtual addresses, which allows local guest administrators to gain privileges via unspecified vectors.
CVSS Score: 7.4 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/58975; http://www.openwall.com/lists/oss-security/2014/06/04/14; http://www.securityfocus.com/bid/67819
CVE: CVE-2014-0195
Published: 2014-06-05
Description: The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly validate fragment lengths in DTLS ClientHello messages, which allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) via a long non-initial fragment.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-120
References: http://aix.software.ibm.com/aix/efixes/security/openssl_advisory9.asc; http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Once-Bled-Twice-Shy-OpenSSL-CVE-2014-0195/ba-p/6501048; http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/ZDI-14-173-CVE-2014-0195-OpenSSL-DTLS-Fragment-Out-of-Bounds/ba-p/6501002
CVE: CVE-2014-0221
Published: 2014-06-05
Description: The dtls1_get_message_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h allows remote attackers to cause a denial of service (recursion and client crash) via a DTLS hello message in an invalid DTLS handshake.
CVSS Score: 4.3 (MEDIUM)
References: http://aix.software.ibm.com/aix/efixes/security/openssl_advisory9.asc; http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10629; http://linux.oracle.com/errata/ELSA-2014-1053.html
CVE: CVE-2014-0224
Published: 2014-06-05
Description: OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows man-in-the-middle attackers to trigger use of a zero-length master key in certain OpenSSL-to-OpenSSL communications, and consequently hijack sessions or obtain sensitive information, via a crafted TLS handshake, aka the "CCS Injection" vulnerability.
CVSS Score: 7.4 (HIGH)
CWE: CWE-326
References: http://aix.software.ibm.com/aix/efixes/security/openssl_advisory9.asc; http://ccsinjection.lepidum.co.jp; http://dev.mysql.com/doc/relnotes/workbench/en/wb-news-6-1-7.html
CVE: CVE-2014-3470
Published: 2014-06-05
Description: The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h, when an anonymous ECDH cipher suite is used, allows remote attackers to cause a denial of service (NULL pointer dereference and client crash) by triggering a NULL certificate value.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-476
References: http://aix.software.ibm.com/aix/efixes/security/openssl_advisory9.asc; http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10629; http://kb.juniper.net/InfoCenter/index?page=content&id=KB29195
CVE: CVE-2014-2503
Published: 2014-06-06
Description: The thumbnail proxy server in EMC Documentum Digital Asset Manager (DAM) 6.5 SP3, 6.5 SP4, 6.5 SP5, and 6.5 SP6 before P13 allows remote attackers to conduct Documentum Query Language (DQL) injection attacks and bypass intended restrictions on querying objects via a crafted parameter in a query string.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://archives.neohapsis.com/archives/bugtraq/2014-06/0037.html; http://packetstormsecurity.com/files/126947/EMC-Documentum-Digital-Asset-Manager-Blind-DQL-Injection.html; http://www.securityfocus.com/bid/67868
CVE: CVE-2012-5390
Published: 2014-06-06
Description: The standard universe shadow (condor_shadow.std) component in Condor 7.7.3 through 7.7.6, 7.8.0 before 7.8.5, and 7.9.0 does no properly check privileges, which allows remote attackers to gain privileges via a crafted standard universe job.
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://research.cs.wisc.edu/htcondor/security/vulnerabilities/CONDOR-2012-0003.html; http://secunia.com/advisories/51862; http://www.securityfocus.com/bid/57328
CVE: CVE-2012-5583
Published: 2014-06-06
Description: phpCAS before 1.3.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-310
References: http://secunia.com/advisories/51818; https://exchange.xforce.ibmcloud.com/vulnerabilities/81208; https://github.com/Jasig/phpCAS/blob/master/docs/ChangeLog