deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2012-6632
Published: 2014-01-16
Description: Multiple cross-site scripting (XSS) vulnerabilities in Vessio NetBill 1.2 allow remote attackers to inject arbitrary web script or HTML via the (1) full name or (2) file title to accounts/admin/index.php or (3) comment parameter in the support page to accounts/index2.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/files/112655/NetBill-Billing-System-1.2-CSRF-XSS.html; http://secunia.com/advisories/49109; http://www.osvdb.org/81880
CVE: CVE-2013-7204
Published: 2014-01-17
Description: Cross-site request forgery (CSRF) vulnerability in set_users.cgi in Conceptronic CIPCAMPTIWL Camera 1.0 with firmware 21.37.2.49 allows remote attackers to hijack the authentication of administrators for requests that add arbitrary users.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://osvdb.org/101930; http://www.exploit-db.com/exploits/30914; http://www.securityfocus.com/archive/1/530717/100/0/threaded
CVE: CVE-2013-7243
Published: 2014-01-17
Description: Multiple cross-site scripting (XSS) vulnerabilities in GetSimple CMS 3.1.2 and 3.2.3 allow remote attackers to inject arbitrary web script or HTML via the (1) post-menu field to edit.php or (2) Display name field to settings.php.  NOTE: The Custom Permalink Structure and Email Address fields are already covered by CVE-2012-6621.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/101922; http://packetstormsecurity.com/files/124711; https://exchange.xforce.ibmcloud.com/vulnerabilities/90191
CVE: CVE-2014-0792
Published: 2014-01-17
Description: Sonatype Nexus 1.x and 2.x before 2.7.1 allows remote attackers to create arbitrary objects and execute arbitrary code via unspecified vectors related to unmarshalling of unintended Object types.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://www.sonatype.org/advisories/archive/2014-01-13-Nexus; https://sonatype.zendesk.com/entries/37551958-Configuring-Xstream-Whitelist; https://support.sonatype.com/entries/37828023-Nexus-Security-Vulnerability
CVE: CVE-2013-7295
Published: 2014-01-17
Description: Tor before 0.2.4.20, when OpenSSL 1.x is used in conjunction with a certain HardwareAccel setting on Intel Sandy Bridge and Ivy Bridge platforms, does not properly generate random numbers for (1) relay identity keys and (2) hidden-service identity keys, which might make it easier for remote attackers to bypass cryptographic protection mechanisms via unspecified vectors.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-310
References: http://lists.opensuse.org/opensuse-updates/2014-01/msg00095.html; https://lists.torproject.org/pipermail/tor-talk/2013-December/031483.html; http://lists.opensuse.org/opensuse-updates/2014-01/msg00095.html
CVE: CVE-2014-1207
Published: 2014-01-17
Description: VMware ESXi 4.0 through 5.1 and ESX 4.0 and 4.1 allow remote attackers to cause a denial of service (NULL pointer dereference) by intercepting and modifying Network File Copy (NFC) traffic.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/102196; http://secunia.com/advisories/56499; http://www.securityfocus.com/bid/64995
CVE: CVE-2014-1208
Published: 2014-01-17
Description: VMware Workstation 9.x before 9.0.1, VMware Player 5.x before 5.0.1, VMware Fusion 5.x before 5.0.1, VMware ESXi 4.0 through 5.1, and VMware ESX 4.0 and 4.1 allow guest OS users to cause a denial of service (VMX process disruption) by using an invalid port.
CVSS Score: 3.3 (LOW)
References: http://osvdb.org/102197; http://secunia.com/advisories/56499; http://www.securityfocus.com/bid/64994
CVE: CVE-2014-1211
Published: 2014-01-17
Description: Cross-site request forgery (CSRF) vulnerability in VMware vCloud Director 5.1.x before 5.1.3 allows remote attackers to hijack the authentication of arbitrary users for requests that trigger a logout.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://osvdb.org/102198; http://www.securityfocus.com/bid/64993; http://www.securitytracker.com/id/1029645
CVE: CVE-2013-6424
Published: 2014-01-18
Description: Integer underflow in the xTrapezoidValid macro in render/picture.h in X.Org allows context-dependent attackers to cause a denial of service (crash) via a negative bottom value.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-191
References: http://lists.opensuse.org/opensuse-updates/2013-12/msg00127.html; http://lists.x.org/archives/xorg-devel/2013-October/037996.html; http://rhn.redhat.com/errata/RHSA-2013-1868.html
CVE: CVE-2013-6425
Published: 2014-01-18
Description: Integer underflow in the pixman_trapezoid_valid macro in pixman.h in Pixman before 0.32.0, as used in X.Org server and cairo, allows context-dependent attackers to cause a denial of service (crash) via a negative bottom value.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-191
References: http://cgit.freedesktop.org/pixman/commit/?id=5e14da97f16e421d084a9e735be21b1025150f0c; http://lists.freedesktop.org/archives/pixman/2013-November/003109.html; http://lists.opensuse.org/opensuse-updates/2014-01/msg00001.html
CVE: CVE-2013-2037
Published: 2014-01-18
Description: httplib2 0.7.2, 0.8, and earlier, after an initial connection is made, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVSS Score: 2.6 (LOW)
CWE: CWE-20
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=706602; http://code.google.com/p/httplib2/issues/detail?id=282; http://seclists.org/oss-sec/2013/q2/257
CVE: CVE-2013-1740
Published: 2014-01-18
Description: The ssl_Do1stHandshake function in sslsecur.c in libssl in Mozilla Network Security Services (NSS) before 3.15.4, when the TLS False Start feature is enabled, allows man-in-the-middle attackers to spoof SSL servers by using an arbitrary X.509 certificate during certain handshake traffic.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-310
References: http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00004.html; http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00005.html; http://seclists.org/fulldisclosure/2014/Dec/23
CVE: CVE-2014-1438
Published: 2014-01-18
Description: The restore_fpu_checking function in arch/x86/include/asm/fpu-internal.h in the Linux kernel before 3.12.8 on the AMD K7 and K8 platforms does not clear pending exceptions before proceeding to an EMMS instruction, which allows local users to cause a denial of service (task kill) or possibly gain privileges via a crafted application.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-264
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=26bef1318adc1b3a530ecc807ef99346db2aa8b0; http://lists.fedoraproject.org/pipermail/package-announce/2014-January/126858.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-January/126874.html
CVE: CVE-2014-1444
Published: 2014-01-18
Description: The fst_get_iface function in drivers/net/wan/farsync.c in the Linux kernel before 3.11.7 does not properly initialize a certain data structure, which allows local users to obtain sensitive information from kernel memory by leveraging the CAP_NET_ADMIN capability for an SIOCWANDEV ioctl call.
CVSS Score: 1.7 (LOW)
CWE: CWE-399
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=96b340406724d87e4621284ebac5e059d67b2194; http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.11.7; http://www.openwall.com/lists/oss-security/2014/01/15/3
CVE: CVE-2014-1445
Published: 2014-01-18
Description: The wanxl_ioctl function in drivers/net/wan/wanxl.c in the Linux kernel before 3.11.7 does not properly initialize a certain data structure, which allows local users to obtain sensitive information from kernel memory via an ioctl call.
CVSS Score: 2.1 (LOW)
CWE: CWE-399
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=2b13d06c9584b4eb773f1e80bbaedab9a1c344e1; http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.11.7; http://www.openwall.com/lists/oss-security/2014/01/15/3
CVE: CVE-2014-1446
Published: 2014-01-18
Description: The yam_ioctl function in drivers/net/hamradio/yam.c in the Linux kernel before 3.12.8 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel memory by leveraging the CAP_NET_ADMIN capability for an SIOCYAMGCFG ioctl call.
CVSS Score: 1.9 (LOW)
CWE: CWE-399
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=8e3fbf870481eb53b2d3a322d1fc395ad8b367ed; http://lists.fedoraproject.org/pipermail/package-announce/2014-January/126858.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-January/126874.html
CVE: CVE-2013-3482
Published: 2014-01-19
Description: Stack-based buffer overflow in the rf_report_error function in ermapper_u.dll in Intergraph ERDAS ER Viewer before 13.0.1.1301 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a long string in an ERS file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://attrition.org/pipermail/vim/2013-May/002682.html; http://osvdb.org/show/osvdb/93650; http://secunia.com/advisories/53620
CVE: CVE-2013-3483
Published: 2014-01-19
Description: Stack-based buffer overflow in ermapper_u.dll in Intergraph ERDAS ER Viewer before 13.0.1.1301 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted ERS file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://attrition.org/pipermail/vim/2013-May/002682.html; http://secunia.com/advisories/53620; http://attrition.org/pipermail/vim/2013-May/002682.html
CVE: CVE-2013-4231
Published: 2014-01-19
Description: Multiple buffer overflows in libtiff before 4.0.3 allow remote attackers to cause a denial of service (out-of-bounds write) via a crafted (1) extension block in a GIF image or (2) GIF raster image to tools/gif2tiff.c or (3) a long filename for a TIFF image to tools/rgb2ycbcr.c.  NOTE: vectors 1 and 3 are disputed by Red Hat, which states that the input cannot exceed the allocated buffer size.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://bugzilla.maptools.org/show_bug.cgi?id=2450; http://rhn.redhat.com/errata/RHSA-2014-0223.html; http://secunia.com/advisories/54543
CVE: CVE-2013-0244
Published: 2014-01-19
Description: Cross-site scripting (XSS) vulnerability in Drupal 6.x before 6.28 and 7.x before 7.19, when running with older versions of jQuery that are vulnerable to CVE-2011-4969, allows remote attackers to inject arbitrary web script or HTML via vectors involving unspecified Javascript functions that are used to select DOM elements.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://osvdb.org/89306; http://packetstormsecurity.com/files/119598/Drupal-Core-6.x-7.x-Cross-Site-Scripting-Access-Bypass.html; http://seclists.org/fulldisclosure/2013/Jan/120
CVE: CVE-2013-1438
Published: 2014-01-19
Description: Unspecified vulnerability in dcraw 0.8.x through 0.8.9, as used in libraw, ufraw, shotwell, and other products, allows context-dependent attackers to cause a denial of service via a crafted photo file that triggers a (1) divide-by-zero, (2) infinite loop, or (3) NULL pointer dereference.
CVSS Score: 4.3 (MEDIUM)
References: http://www.debian.org/security/2013/dsa-2748; http://www.openwall.com/lists/oss-security/2013/08/29/3; http://www.oracle.com/technetwork/topics/security/bulletinoct2[PII_REDACTED].html
CVE: CVE-2013-2142
Published: 2014-01-19
Description: userpref.c in libimobiledevice 1.1.4, when $HOME and $XDG_CONFIG_HOME are not set, allows local users to overwrite arbitrary files via a symlink attack on (1) HostCertificate.pem, (2) HostPrivateKey.pem, (3) libimobiledevicerc, (4) RootCertificate.pem, or (5) RootPrivateKey.pem in /tmp/root/.config/libimobiledevice/.
CVSS Score: 3.3 (LOW)
CWE: CWE-59
References: http://libiphone.lighthouseapp.com/projects/27916-libiphone/tickets/331-insecure-tmp-directory-use; http://www.openwall.com/lists/oss-security/2013/06/04/11; http://www.ubuntu.com/usn/USN-1927-1
CVE: CVE-2013-2185
Published: 2014-01-19
Description: The readObject method in the DiskFileItem class in Apache Tomcat and JBoss Web, as used in Red Hat JBoss Enterprise Application Platform 6.1.0 and Red Hat JBoss Portal 6.0.0, allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instance, a similar issue to CVE-2013-2186.  NOTE: this issue is reportedly disputed by the Apache Tomcat team, although Red Hat considers it a vulnerability. The dispute appears to regard whether it is the responsibility of applications to avoid providing untrusted data to be deserialized, or whether this class should inherently protect against this issue
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://openwall.com/lists/oss-security/2014/10/24/12; http://rhn.redhat.com/errata/RHSA-2013-1193.html; http://rhn.redhat.com/errata/RHSA-2013-1194.html
CVE: CVE-2013-4375
Published: 2014-01-19
Description: The qdisk PV disk backend in qemu-xen in Xen 4.2.x and 4.3.x before 4.3.1, and qemu 1.1 and other versions, allows local HVM guests to cause a denial of service (domain grant reference consumption) via unspecified vectors.
CVSS Score: 2.7 (LOW)
CWE: CWE-399
References: http://security.gentoo.org/glsa/glsa-201407-03.xml; http://www.openwall.com/lists/oss-security/2013/10/10/14; http://www.ubuntu.com/usn/USN-2092-1
CVE: CVE-2013-7078
Published: 2014-01-19
Description: Cross-site scripting (XSS) vulnerability in the errorAction method in the ActionController base class in the Extbase Framework in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6, when the Rewritten Property Mapper is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified input, which is returned in an error message.  NOTE: this might be the same vulnerability as CVE-2013-7072.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://osvdb.org/100885; http://seclists.org/oss-sec/2013/q4/473; http://seclists.org/oss-sec/2013/q4/487
CVE: CVE-2013-2169
Published: 2014-01-20
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not a security issue.  Notes: none
CVE: CVE-2013-2170
Published: 2014-01-20
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not a security issue.  Notes: none
CVE: CVE-2013-3594
Published: 2014-01-20
Description: The SSH service on Dell PowerConnect 3348 1.2.1.3, 3524p 2.0.0.48, and 5324 2.0.1.4 switches allows remote attackers to cause a denial of service (device reset) or possibly execute arbitrary code by sending many packets to TCP port 22.
CVSS Score: 10.0 (HIGH)
CWE: CWE-20
References: http://www.kb.cert.org/vuls/id/122582; https://exchange.xforce.ibmcloud.com/vulnerabilities/90595; http://www.kb.cert.org/vuls/id/122582
CVE: CVE-2013-3595
Published: 2014-01-20
Description: The OpenManage web application 2.5 build 1.19 on Dell PowerConnect 3348 1.2.1.3, 3524p 2.0.0.48, and 5324 2.0.1.4 switches allows remote authenticated users to cause a denial of service (device reset) via a direct request to an unspecified OSPF URL.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://www.kb.cert.org/vuls/id/122582; https://exchange.xforce.ibmcloud.com/vulnerabilities/90597; http://www.kb.cert.org/vuls/id/122582
CVE: CVE-2013-3606
Published: 2014-01-20
Description: The login page in the GoAhead web server on Dell PowerConnect 3348 1.2.1.3, 3524p 2.0.0.48, and 5324 2.0.1.4 switches allows remote attackers to cause a denial of service (device outage) via a long username.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://www.kb.cert.org/vuls/id/122582; https://exchange.xforce.ibmcloud.com/vulnerabilities/90598; http://www.kb.cert.org/vuls/id/122582
CVE: CVE-2013-6488
Published: 2014-01-20
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2013-0328. Reason: This candidate is a reservation duplicate of CVE-2013-0328. Notes: All CVE users should reference CVE-2013-0328 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2014-0668
Published: 2014-01-20
Description: Cross-site scripting (XSS) vulnerability in the portal in Cisco Secure Access Control System (ACS) allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCue65949.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/102256; http://secunia.com/advisories/56543; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0668
CVE: CVE-2014-0008
Published: 2014-01-20
Description: lib/adminlib.php in Moodle through 2.3.11, 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 logs cleartext passwords, which allows remote authenticated administrators to obtain sensitive information by reading the Config Changes Report.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-255
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-36721; http://lists.fedoraproject.org/pipermail/package-announce/2014-January/127510.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-January/127533.html
CVE: CVE-2014-0009
Published: 2014-01-20
Description: course/loginas.php in Moodle through 2.2.11, 2.3.x before 2.3.11, 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 does not enforce the moodle/site:accessallgroups capability requirement for outside-group users in a SEPARATEGROUPS configuration, which allows remote authenticated users to perform "login as" actions via a direct request.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-264
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-42643; http://lists.fedoraproject.org/pipermail/package-announce/2014-January/127510.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-January/127533.html
CVE: CVE-2014-0010
Published: 2014-01-20
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in user/profile/index.php in Moodle through 2.2.11, 2.3.x before 2.3.11, 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 allow remote attackers to hijack the authentication of administrators for requests that delete (1) categories or (2) fields.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-42883; http://lists.fedoraproject.org/pipermail/package-announce/2014-January/127510.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-January/127533.html
CVE: CVE-2010-5293
Published: 2014-01-21
Description: wp-includes/comment.php in WordPress before 3.0.2 does not properly whitelist trackbacks and pingbacks in the blogroll, which allows remote attackers to bypass intended spam restrictions via a crafted URL, as demonstrated by a URL that triggers a substring match.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-264
References: http://codex.wordpress.org/Version_3.0.2; https://core.trac.wordpress.org/changeset/16637; https://core.trac.wordpress.org/ticket/13887
CVE: CVE-2010-5294
Published: 2014-01-21
Description: Multiple cross-site scripting (XSS) vulnerabilities in the request_filesystem_credentials function in wp-admin/includes/file.php in WordPress before 3.0.2 allow remote servers to inject arbitrary web script or HTML by providing a crafted error message for a (1) FTP or (2) SSH connection attempt.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://codex.wordpress.org/Version_3.0.2; https://core.trac.wordpress.org/changeset/16367; http://codex.wordpress.org/Version_3.0.2
CVE: CVE-2010-5295
Published: 2014-01-21
Description: Cross-site scripting (XSS) vulnerability in wp-admin/plugins.php in WordPress before 3.0.2 might allow remote attackers to inject arbitrary web script or HTML via a plugin's author field, which is not properly handled during a Delete Plugin action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://codex.wordpress.org/Version_3.0.2; https://core.trac.wordpress.org/changeset/16373; http://codex.wordpress.org/Version_3.0.2
CVE: CVE-2010-5296
Published: 2014-01-21
Description: wp-includes/capabilities.php in WordPress before 3.0.2, when a Multisite configuration is used, does not require the Super Admin role for the delete_users capability, which allows remote authenticated administrators to bypass intended access restrictions via a delete action.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-264
References: http://codex.wordpress.org/Version_3.0.2; https://core.trac.wordpress.org/changeset/15562; http://codex.wordpress.org/Version_3.0.2
CVE: CVE-2010-5297
Published: 2014-01-21
Description: WordPress before 3.0.1, when a Multisite installation is used, permanently retains the "site administrators can add users" option once changed, which might allow remote authenticated administrators to bypass intended access restrictions in opportunistic circumstances via an add action after a temporary change.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://codex.wordpress.org/Changelog/3.0.1; http://core.trac.wordpress.org/query?status=closed&group=resolution&order=priority&milestone=3.0.1&resolution=fixed; https://core.trac.wordpress.org/changeset/15342
CVE: CVE-2011-5270
Published: 2014-01-21
Description: wp-admin/press-this.php in WordPress before 3.0.6 does not enforce the publish_posts capability requirement, which allows remote authenticated users to perform publish actions by leveraging the Contributor role.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://codex.wordpress.org/Version_3.0.6; https://core.trac.wordpress.org/changeset/17710; http://codex.wordpress.org/Version_3.0.6
CVE: CVE-2012-6633
Published: 2014-01-21
Description: Cross-site scripting (XSS) vulnerability in wp-includes/default-filters.php in WordPress before 3.3.3 allows remote attackers to inject arbitrary web script or HTML via an editable slug field.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://codex.wordpress.org/Version_3.3.3; https://core.trac.wordpress.org/changeset/21083; http://codex.wordpress.org/Version_3.3.3
CVE: CVE-2012-6634
Published: 2014-01-21
Description: wp-admin/media-upload.php in WordPress before 3.3.3 allows remote attackers to obtain sensitive information or bypass intended media-attachment restrictions via a post_id value.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-264
References: http://codex.wordpress.org/Version_3.3.3; https://core.trac.wordpress.org/changeset/21087; http://codex.wordpress.org/Version_3.3.3
CVE: CVE-2012-6635
Published: 2014-01-21
Description: wp-admin/includes/class-wp-posts-list-table.php in WordPress before 3.3.3 does not properly restrict excerpt-view access, which allows remote authenticated users to obtain sensitive information by visiting a draft.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://codex.wordpress.org/Version_3.3.3; https://core.trac.wordpress.org/changeset/21086; http://codex.wordpress.org/Version_3.3.3
CVE: CVE-2013-4030
Published: 2014-01-21
Description: Integrated Management Module (IMM) 2 1.00 through 2.00 on IBM System X and Flex System servers supports SSL cipher suites with short keys, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via a brute-force attack against (1) SSL or (2) TLS traffic.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-310
References: http://www.ibm.com/connections/blogs/PSIRT/entry/security_bulletin_avoiding_weak_ssl_tls_encryption_in_ibm_system_x_and_flex_systems_cve_2013_40301; https://exchange.xforce.ibmcloud.com/vulnerabilities/86068; http://www.ibm.com/connections/blogs/PSIRT/entry/security_bulletin_avoiding_weak_ssl_tls_encryption_in_ibm_system_x_and_flex_systems_cve_2013_40301