deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-7830
Published: 2014-11-24
Description: Cross-site scripting (XSS) vulnerability in mod/feedback/mapcourse.php in the Feedback module in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 allows remote authenticated users to inject arbitrary web script or HTML by leveraging the mod/feedback:mapcourse capability to provide a searchcourse parameter.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-47865; http://openwall.com/lists/oss-security/2014/11/17/11; http://www.securityfocus.com/bid/71119
CVE: CVE-2014-7831
Published: 2014-11-24
Description: lib/classes/grades_external.php in Moodle 2.7.x before 2.7.3 does not consider the moodle/grade:viewhidden capability before displaying hidden grades, which allows remote authenticated users to obtain sensitive information by leveraging the student role to access the get_grades web service.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-47766; http://openwall.com/lists/oss-security/2014/11/17/11; http://www.securitytracker.com/id/1031215
CVE: CVE-2014-7832
Published: 2014-11-24
Description: mod/lti/launch.php in the LTI module in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 performs access control at the course level rather than at the activity level, which allows remote authenticated users to bypass the mod/lti:view capability requirement by viewing an activity instance.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-47921; http://openwall.com/lists/oss-security/2014/11/17/11; http://www.securitytracker.com/id/1031215
CVE: CVE-2014-7833
Published: 2014-11-24
Description: mod/data/edit.php in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 sets a certain group ID to zero upon a database-entry change, which allows remote authenticated users to obtain sensitive information by accessing the database after an edit by a teacher.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-47697; http://openwall.com/lists/oss-security/2014/11/17/11; http://www.securitytracker.com/id/1031215
CVE: CVE-2014-7834
Published: 2014-11-24
Description: mod/forum/externallib.php in Moodle 2.6.x before 2.6.6 and 2.7.x before 2.7.3 does not verify group permissions, which allows remote authenticated users to access a forum via the forum_get_discussions web service.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-45303; http://openwall.com/lists/oss-security/2014/11/17/11; http://www.securitytracker.com/id/1031215
CVE: CVE-2014-7835
Published: 2014-11-24
Description: webservice/upload.php in Moodle 2.6.x before 2.6.6 and 2.7.x before 2.7.3 does not ensure that a file upload is for a private or draft area, which allows remote authenticated users to upload files containing JavaScript, and consequently conduct cross-site scripting (XSS) attacks, by specifying the profile-picture area.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-47868; http://openwall.com/lists/oss-security/2014/11/17/11; http://www.securitytracker.com/id/1031215
CVE: CVE-2014-7836
Published: 2014-11-24
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the LTI module in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 allow remote attackers to hijack the authentication of arbitrary users for a (1) mod/lti/request_tool.php or (2) mod/lti/instructor_edit_tool_type.php request.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-47924; http://openwall.com/lists/oss-security/2014/11/17/11; http://www.securitytracker.com/id/1031215
CVE: CVE-2014-7837
Published: 2014-11-24
Description: mod/wiki/admin.php in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 allows remote authenticated users to remove wiki pages by leveraging delete access within a different subwiki.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-264
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-47949; http://openwall.com/lists/oss-security/2014/11/17/11; http://www.securitytracker.com/id/1031215
CVE: CVE-2014-7838
Published: 2014-11-24
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the Forum module in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 allow remote attackers to hijack the authentication of arbitrary users for requests that set a tracking preference within (1) mod/forum/deprecatedlib.php, (2) mod/forum/forum.js, (3) mod/forum/index.php, or (4) mod/forum/lib.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-48019; http://openwall.com/lists/oss-security/2014/11/17/11; http://www.securitytracker.com/id/1031215
CVE: CVE-2014-7845
Published: 2014-11-24
Description: The generate_password function in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 does not provide a sufficient number of possible temporary passwords, which allows remote attackers to obtain access via a brute-force attack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-255
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-47050; http://openwall.com/lists/oss-security/2014/11/17/11; http://www.securitytracker.com/id/1031215
CVE: CVE-2014-7846
Published: 2014-11-24
Description: tag/tag_autocomplete.php in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 does not consider the moodle/tag:edit capability before adding a tag, which allows remote authenticated users to bypass intended access restrictions via an AJAX request.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-47965; http://openwall.com/lists/oss-security/2014/11/17/11; http://www.securitytracker.com/id/1031215
CVE: CVE-2014-7847
Published: 2014-11-24
Description: iplookup/index.php in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 allows remote attackers to cause a denial of service (resource consumption) by triggering the calculation of an estimated latitude and longitude for an IP address.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-47321; http://openwall.com/lists/oss-security/2014/11/17/11; http://www.securitytracker.com/id/1031215
CVE: CVE-2014-7848
Published: 2014-11-24
Description: lib/phpunit/bootstrap.php in Moodle 2.6.x before 2.6.6 and 2.7.x before 2.7.3 allows remote attackers to obtain sensitive information via a direct request, which reveals the full path in an error message.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-47287; http://openwall.com/lists/oss-security/2014/11/17/11; http://www.securitytracker.com/id/1031215
CVE: CVE-2014-9059
Published: 2014-11-24
Description: lib/setup.php in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 does not provide charset information in HTTP headers, which might allow remote attackers to conduct cross-site scripting (XSS) attacks via UTF-7 characters during interaction with AJAX scripts.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-47966; http://openwall.com/lists/oss-security/2014/11/17/11; http://www.securityfocus.com/bid/71133
CVE: CVE-2014-9060
Published: 2014-11-24
Description: The LTI module in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 does not properly restrict the parameters used in a return URL, which allows remote attackers to trigger the generation of arbitrary messages via a modified URL, related to mod/lti/locallib.php and mod/lti/return.php.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-47927; http://openwall.com/lists/oss-security/2014/11/17/11; http://www.securitytracker.com/id/1031215
CVE: CVE-2014-1424
Published: 2014-11-24
Description: apparmor_parser in the apparmor package before 2.8.95~2430-0ubuntu5.1 in Ubuntu 14.04 allows attackers to bypass AppArmor policies via unspecified vectors, related to a "miscompilation flaw."
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-264
References: http://www.ubuntu.com/usn/USN-2413-1; http://www.ubuntu.com/usn/USN-2413-1
CVE: CVE-2014-7817
Published: 2014-11-24
Description: The wordexp function in GNU C Library (aka glibc) 2.21 does not enforce the WRDE_NOCMD flag, which allows context-dependent attackers to execute arbitrary commands, as demonstrated by input containing "$((`...`))".
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-20
References: http://linux.oracle.com/errata/ELSA-2015-0016.html; http://linux.oracle.com/errata/ELSA-2015-0092.html; http://lists.opensuse.org/opensuse-updates/2015-02/msg00089.html
CVE: CVE-2014-7821
Published: 2014-11-24
Description: OpenStack Neutron before 2014.1.4 and 2014.2.x before 2014.2.1 allows remote authenticated users to cause a denial of service (crash) via a crafted dns_nameservers value in the DNS configuration.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-20, CWE-399
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155351.html; http://lists.openstack.org/pipermail/openstack-announce/2014-November/000303.html; http://rhn.redhat.com/errata/RHSA-2014-1938.html
CVE: CVE-2014-8412
Published: 2014-11-24
Description: The (1) VoIP channel drivers, (2) DUNDi, and (3) Asterisk Manager Interface (AMI) in Asterisk Open Source 1.8.x before 1.8.32.1, 11.x before 11.14.1, 12.x before 12.7.1, and 13.x before 13.0.1 and Certified Asterisk 1.8.28 before 1.8.28-cert3 and 11.6 before 11.6-cert8 allows remote attackers to bypass the ACL restrictions via a packet with a source IP that does not share the address family as the first ACL entry.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://downloads.asterisk.org/pub/security/AST-2014-012.html; http://downloads.asterisk.org/pub/security/AST-2014-012.html
CVE: CVE-2014-8413
Published: 2014-11-24
Description: The res_pjsip_acl module in Asterisk Open Source 12.x before 12.7.1 and 13.x before 13.0.1 does not properly create and load ACLs defined in pjsip.conf at startup, which allows remote attackers to bypass intended PJSIP ACL rules.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://downloads.asterisk.org/pub/security/AST-2014-013.html; http://downloads.asterisk.org/pub/security/AST-2014-013.html
CVE: CVE-2014-8414
Published: 2014-11-24
Description: ConfBridge in Asterisk 11.x before 11.14.1 and Certified Asterisk 11.6 before 11.6-cert8 does not properly handle state changes, which allows remote attackers to cause a denial of service (channel hang and memory consumption) by causing transitions to be delayed, which triggers a state change from hung up to waiting for media.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://downloads.asterisk.org/pub/security/AST-2014-014.html; http://seclists.org/fulldisclosure/2014/Nov/67; http://downloads.asterisk.org/pub/security/AST-2014-014.html
CVE: CVE-2014-8415
Published: 2014-11-24
Description: Race condition in the chan_pjsip channel driver in Asterisk Open Source 12.x before 12.7.1 and 13.x before 13.0.1 allows remote attackers to cause a denial of service (assertion failure and crash) via a cancel request for a SIP session with a queued action to (1) answer a session or (2) send ringing.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://downloads.asterisk.org/pub/security/AST-2014-015.html; http://downloads.asterisk.org/pub/security/AST-2014-015.html
CVE: CVE-2014-8416
Published: 2014-11-24
Description: Use-after-free vulnerability in the PJSIP channel driver in Asterisk Open Source 12.x before 12.7.1 and 13.x before 13.0.1, when using the res_pjsip_refer module, allows remote attackers to cause a denial of service (crash) via an in-dialog INVITE with Replaces message, which triggers the channel to be hung up.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://downloads.asterisk.org/pub/security/AST-2014-016.html; http://downloads.asterisk.org/pub/security/AST-2014-016.html
CVE: CVE-2014-8417
Published: 2014-11-24
Description: ConfBridge in Asterisk 11.x before 11.14.1, 12.x before 12.7.1, and 13.x before 13.0.1 and Certified Asterisk 11.6 before 11.6-cert8 allows remote authenticated users to (1) gain privileges via vectors related to an external protocol to the CONFBRIDGE dialplan function or (2) execute arbitrary system commands via a crafted ConfbridgeStartRecord AMI action.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://downloads.asterisk.org/pub/security/AST-2014-017.html; http://downloads.asterisk.org/pub/security/AST-2014-017.html
CVE: CVE-2014-8418
Published: 2014-11-24
Description: The DB dialplan function in Asterisk Open Source 1.8.x before 1.8.32, 11.x before 11.1.4.1, 12.x before 12.7.1, and 13.x before 13.0.1 and Certified Asterisk 1.8 before 1.8.28-cert8 and 11.6 before 11.6-cert8 allows remote authenticated users to gain privileges via a call from an external protocol, as demonstrated by the AMI protocol.
CVSS Score: 9.0 (HIGH)
CWE: CWE-264
References: http://downloads.asterisk.org/pub/security/AST-2014-018.html; http://downloads.asterisk.org/pub/security/AST-2014-018.html
CVE: CVE-2014-8627
Published: 2014-11-24
Description: PolarSSL 1.3.8 does not properly negotiate the signature algorithm to use, which allows remote attackers to conduct downgrade attacks via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://lists.opensuse.org/opensuse-updates/2014-11/msg00079.html; http://secunia.com/advisories/61220; https://polarssl.org/tech-updates/releases/polarssl-1.3.9-released
CVE: CVE-2014-8986
Published: 2014-11-24
Description: Cross-site scripting (XSS) vulnerability in the selection list in the filters in the Configuration Report page (adm_config_report.php) in MantisBT 1.2.13 through 1.2.17 allows remote administrators to inject arbitrary web script or HTML via a crafted config option, a different vulnerability than CVE-2014-8987.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://secunia.com/advisories/62101; http://www.debian.org/security/2015/dsa-3120; http://www.openwall.com/lists/oss-security/2014/11/15/1
CVE: CVE-2014-8988
Published: 2014-11-24
Description: MantisBT before 1.2.18 allows remote authenticated users to bypass the $g_download_attachments_threshold and $g_view_attachments_threshold restrictions and read attachments for private projects by leveraging access to a project that does not restrict access to attachments and a request to the download URL.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://seclists.org/oss-sec/2014/q4/693; http://secunia.com/advisories/62101; http://www.debian.org/security/2015/dsa-3120
CVE: CVE-2014-8991
Published: 2014-11-24
Description: pip 1.3 through 1.5.6 allows local users to cause a denial of service (prevention of package installation) by creating a /tmp/pip-build-* file for another user.
CVSS Score: 2.1 (LOW)
References: http://www.openwall.com/lists/oss-security/2014/11/19/17; http://www.openwall.com/lists/oss-security/2014/11/20/6; http://www.oracle.com/technetwork/topics/security/bulletinjul2[PII_REDACTED].html
CVE: CVE-2014-9015
Published: 2014-11-24
Description: Drupal 6.x before 6.34 and 7.x before 7.34 allows remote attackers to hijack sessions via a crafted request, as demonstrated by a crafted request to a server that supports both HTTP and HTTPS sessions.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/59164; http://secunia.com/advisories/59814; http://www.debian.org/security/2014/dsa-3075
CVE: CVE-2014-9016
Published: 2014-11-24
Description: The password hashing API in Drupal 7.x before 7.34 and the Secure Password Hashes (aka phpass) module 6.x-2.x before 6.x-2.1 for Drupal allows remote attackers to cause a denial of service (CPU and memory consumption) via a crafted request.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/59164; http://secunia.com/advisories/59814; http://www.debian.org/security/2014/dsa-3075
CVE: CVE-2014-9030
Published: 2014-11-24
Description: The do_mmu_update function in arch/x86/mm.c in Xen 3.2.x through 4.4.x does not properly manage page references, which allows remote domains to cause a denial of service by leveraging control over an HVM guest and a crafted MMU_MACHPHYS_UPDATE.
CVSS Score: 7.1 (HIGH)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00010.html; http://secunia.com/advisories/62672
CVE: CVE-2010-5312
Published: 2014-11-24
Description: Cross-site scripting (XSS) vulnerability in jquery.ui.dialog.js in the Dialog widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML via the title option.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://bugs.jqueryui.com/ticket/6016; http://rhn.redhat.com/errata/RHSA-2015-0442.html; http://rhn.redhat.com/errata/RHSA-2015-1462.html
CVE: CVE-2012-6662
Published: 2014-11-24
Description: Cross-site scripting (XSS) vulnerability in the default content option in jquery.ui.tooltip.js in the Tooltip widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML via the title attribute, which is not properly handled in the autocomplete combo box demo.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://bugs.jqueryui.com/ticket/8859; http://bugs.jqueryui.com/ticket/8861; http://rhn.redhat.com/errata/RHSA-2015-0442.html
CVE: CVE-2014-8349
Published: 2014-11-24
Description: Cross-site scripting (XSS) vulnerability in Liferay Portal Enterprise Edition (EE) 6.2 SP8 and earlier allows remote authenticated users to inject arbitrary web script or HTML via the _20_body parameter in the comment field in an uploaded file.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://packetstormsecurity.com/files/129199/Liferay-Portal-6.2-EE-SP8-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2014/Nov/61; http://www.securitytracker.com/id/1031255
CVE: CVE-2014-1421
Published: 2014-11-25
Description: mountall 1.54, as used in Ubuntu 14.10, does not properly handle the umask when using the mount utility, which allows local users to bypass intended access restrictions via unspecified vectors.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://www.ubuntu.com/usn/USN-2411-1; http://www.ubuntu.com/usn/USN-2411-1
CVE: CVE-2014-7839
Published: 2014-11-25
Description: DocumentProvider in RESTEasy 2.3.7 and 3.0.9 does not configure the (1) external-general-entities or (2) external-parameter-entities features, which allows remote attackers to conduct XML external entity (XXE) attacks via unspecified vectors.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-20
References: http://rhn.redhat.com/errata/RHSA-2015-0675.html; http://rhn.redhat.com/errata/RHSA-2015-0773.html; http://rhn.redhat.com/errata/RHSA-2015-0850.html
CVE: CVE-2014-8367
Published: 2014-11-25
Description: SQL injection vulnerability in Aruba Networks ClearPass Policy Manager (CPPM) 6.2.x, 6.3.x before 6.3.6, and 6.4.x before 6.4.2 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/62602; http://www.arubanetworks.com/support/alerts/aid-11192014.txt; https://exchange.xforce.ibmcloud.com/vulnerabilities/98870
CVE: CVE-2014-8368
Published: 2014-11-25
Description: The web interface in Aruba Networks AirWave before 7.7.14 and 8.x before 8.0.5 allows remote authenticated users to gain privileges and execute arbitrary commands via unspecified vectors.
CVSS Score: 9.0 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/62578; http://www.arubanetworks.com/support/alerts/aid-11192014.txt; https://exchange.xforce.ibmcloud.com/vulnerabilities/98871
CVE: CVE-2014-8420
Published: 2014-11-25
Description: The ViewPoint web application in Dell SonicWALL Global Management System (GMS) before 7.2 SP2, SonicWALL Analyzer before 7.2 SP2, and SonicWALL UMA before 7.2 SP2 allows remote authenticated users to execute arbitrary code via unspecified vectors.
CVSS Score: 9.0 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/71241; http://www.zerodayinitiative.com/advisories/ZDI-14-385/; https://exchange.xforce.ibmcloud.com/vulnerabilities/98911
CVE: CVE-2014-8558
Published: 2014-11-25
Description: JExperts Channel Platform 5.0.33_CCB allows remote authenticated users to bypass access restrictions via crafted action and key parameters.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://packetstormsecurity.com/files/129010/JExperts-Tecnologia-Channel-Software-Privilege-Escalation.html; http://seclists.org/fulldisclosure/2014/Nov/10; http://packetstormsecurity.com/files/129010/JExperts-Tecnologia-Channel-Software-Privilege-Escalation.html
CVE: CVE-2014-8678
Published: 2014-11-25
Description: The ConfigSaveServlet servlet in ManageEngine OpUtils before build 71024 allows remote attackers to "disclose" files via a crafted filename, related to "saveFile."
CVSS Score: 7.8 (HIGH)
CWE: CWE-200
References: http://www.zerodayinitiative.com/advisories/ZDI-14-386/; http://www.zerodayinitiative.com/advisories/ZDI-14-386/
CVE: CVE-2014-8001
Published: 2014-11-25
Description: Buffer overflow in decode.cpp in Cisco OpenH264 1.2.0 and earlier allows remote attackers to execute arbitrary code via an encoded media file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=36500; https://github.com/cisco/openh264/pull/1088/files; http://tools.cisco.com/security/center/viewAlert.x?alertId=36500
CVE: CVE-2014-8002
Published: 2014-11-25
Description: Use-after-free vulnerability in decode_slice.cpp in Cisco OpenH264 1.2.0 and earlier allows remote attackers to execute arbitrary code via an encoded media file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=36501; https://github.com/cisco/openh264/pull/1096/files; http://tools.cisco.com/security/center/viewAlert.x?alertId=36501
CVE: CVE-2014-8004
Published: 2014-11-25
Description: Cisco IOS XR allows remote attackers to cause a denial of service (LISP process reload) by establishing many LISP TCP sessions, aka Bug ID CSCuq90378.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-8004; http://www.securitytracker.com/id/1031258; https://exchange.xforce.ibmcloud.com/vulnerabilities/98923
CVE: CVE-2014-3605
Published: 2014-11-25
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-6407. Reason: This candidate is a reservation duplicate of CVE-2014-6407. Notes: All CVE users should reference CVE-2014-6407 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2014-8439
Published: 2014-11-25
Description: Adobe Flash Player before 13.0.0.258 and 14.x and 15.x before 15.0.0.239 on Windows and OS X and before 11.2.202.424 on Linux, Adobe AIR before 15.0.0.293, Adobe AIR SDK before 15.0.0.302, and Adobe AIR SDK & Compiler before 15.0.0.302 allow attackers to execute arbitrary code or cause a denial of service (invalid pointer dereference) via unspecified vectors.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-416
References: http://helpx.adobe.com/security/products/flash-player/apsb14-22.html; http://helpx.adobe.com/security/products/flash-player/apsb14-26.html; http://lists.opensuse.org/opensuse-security-announce/2014-11/msg00020.html