deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-72038
Published: 2015-01-13
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-2353.  Reason: This candidate is a duplicate of CVE-2014-2353.  The wrong ID was used.  Notes: All CVE users should reference CVE-2014-2353 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2014-9999
Published: 2015-01-13
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: None.  Reason: This ID is frequently used as an example of the 2014 CVE-ID syntax change, which allows more than 4 digits in the sequence number. Notes: See references
CVE: CVE-2014-99999
Published: 2015-01-13
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: None.  Reason: This ID is frequently used as an example of the 2014 CVE-ID syntax change, which allows more than 4 digits in the sequence number. Notes: See references
CVE: CVE-2014-999999
Published: 2015-01-13
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: None.  Reason: This ID is frequently used as an example of the 2014 CVE-ID syntax change, which allows more than 4 digits in the sequence number. Notes: See references
CVE: CVE-2014-100011
Published: 2015-01-13
Description: SQL injection vulnerability in /send-to in Sendy 1.1.9.1 allows remote attackers to execute arbitrary SQL commands via the c parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/32814; http://www.securityfocus.com/archive/1/531798/100/0/threaded; http://www.securityfocus.com/bid/66771
CVE: CVE-2014-100012
Published: 2015-01-13
Description: SQL injection vulnerability in /app in Sendy 1.1.8.4 allows remote attackers to execute arbitrary SQL commands via the i parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/31898; http://www.exploit-db.com/exploits/31898
CVE: CVE-2014-100013
Published: 2015-01-13
Description: Multiple cross-site scripting (XSS) vulnerabilities in clientResponse 4.1 allow remote attackers to inject arbitrary web script or HTML via the (1) Subject or (2) Message field.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.exploit-db.com/exploits/35248; https://exchange.xforce.ibmcloud.com/vulnerabilities/98734; http://www.exploit-db.com/exploits/35248
CVE: CVE-2014-100014
Published: 2015-01-13
Description: Multiple stack-based buffer overflows in pdmwService.exe in SolidWorks Workgroup PDM 2014 SP2 allow remote attackers to execute arbitrary code via a long string in a (1) 2001, (2) 2002, or (3) 2003 opcode to port 3000.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/57037; http://www.exploit-db.com/exploits/31763; https://exchange.xforce.ibmcloud.com/vulnerabilities/91264
CVE: CVE-2014-100015
Published: 2015-01-13
Description: Directory traversal vulnerability in pdmwService.exe in SolidWorks Workgroup PDM 2014 allows remote attackers to write to arbitrary files via a .. (dot dot) in the filename in a file upload.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.com/files/125361; http://www.exploit-db.com/exploits/31831; http://www.exploit-db.com/exploits/32163
CVE: CVE-2014-100016
Published: 2015-01-13
Description: Cross-site scripting (XSS) vulnerability in photocrati-gallery/ecomm-sizes.php in the Photocrati theme for WordPress allows remote attackers to inject arbitrary web script or HTML via the prod_id parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/102717; http://packetstormsecurity.com/files/124986/WordPress-Photocrati-Cross-Site-Scripting.html; http://secunia.com/advisories/56690
CVE: CVE-2014-100017
Published: 2015-01-13
Description: Cross-site scripting (XSS) vulnerability in canned_opr.php in PhpOnlineChat 3.0 allows remote attackers to inject arbitrary web script or HTML via the message field.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/128179/PhpOnlineChat-3.0-Cross-Site-Scripting.html; http://www.exploit-db.com/exploits/34555; http://www.securityfocus.com/bid/69669
CVE: CVE-2014-100018
Published: 2015-01-13
Description: Cross-site scripting (XSS) vulnerability in the Unconfirmed plugin before 1.2.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter in the unconfirmed page to wp-admin/network/users.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/57838; http://www.securityfocus.com/bid/66781; https://security.dxw.com/advisories/xss-in-unconfirmed-1-2-3/
CVE: CVE-2014-100019
Published: 2015-01-13
Description: SQL injection vulnerability in the LTree converter in Pomm before 1.1.5 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/56986; http://www.pomm-project.org/news/pomm-1-1-5-is-out.html; http://www.securityfocus.com/bid/65711
CVE: CVE-2014-100020
Published: 2015-01-13
Description: SQL injection vulnerability in ChangeEmail.php in iTechClassifieds 3.03.057 allows remote attackers to execute arbitrary SQL commands via the PreviewNum parameter.  NOTE: the CatID parameter is already covered by CVE-2008-0685.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/102457; http://www.exploit-db.com/exploits/31140; http://www.securityfocus.com/bid/65089
CVE: CVE-2014-100021
Published: 2015-01-13
Description: Cross-site scripting (XSS) vulnerability in symfony/web/index.php/pim/viewEmployeeList in OrangeHRM before 3.1.2 allows remote attackers to inject arbitrary web script or HTML via the empsearch[employee_name][empId] parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://hauntit.blogspot.com/2014/02/en-xss-in-orangehrm.html; http://secunia.com/advisories/57206; http://sourceforge.net/projects/orangehrm/files/stable/3.1.2/
CVE: CVE-2014-100022
Published: 2015-01-13
Description: SQL injection vulnerability in question.php in the mTouch Quiz before 3.0.7 for WordPress allows remote attackers to execute arbitrary SQL commands via the quiz parameter to wp-admin/edit.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/57491; https://exchange.xforce.ibmcloud.com/vulnerabilities/91950; https://security.dxw.com/advisories/admin-xss-and-sqli-in-mtouch-quiz-3-0-6/
CVE: CVE-2014-100023
Published: 2015-01-13
Description: Multiple cross-site scripting (XSS) vulnerabilities in question.php in the mTouch Quiz before 3.0.7 for WordPress allow remote attackers to inject arbitrary web script or HTML via the quiz parameter to wp-admin/edit.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/57491; https://exchange.xforce.ibmcloud.com/vulnerabilities/91949; https://exchange.xforce.ibmcloud.com/vulnerabilities/91950
CVE: CVE-2014-100024
Published: 2015-01-13
Description: Cross-site scripting (XSS) vulnerability in Seo Panel before 3.4.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://blog.seopanel.in/2014/01/seo-panel-3-4-0-released/; http://osvdb.org/102462; http://secunia.com/advisories/56510
CVE: CVE-2014-100025
Published: 2015-01-13
Description: Cross-site request forgery (CSRF) vulnerability in index.php/user_data/insert_user in Savsoft Quiz allows remote attackers to hijack the authentication of administrators for requests that create an administrator account via a crafted request.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.com/files/125379; http://secunia.com/advisories/57102; http://www.securityfocus.com/bid/66287
CVE: CVE-2014-100026
Published: 2015-01-13
Description: Cross-site scripting (XSS) vulnerability in readme.php in the April's Super Functions Pack plugin before 1.4.8 for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/101807; http://secunia.com/advisories/55576; http://www.securityfocus.com/bid/64699
CVE: CVE-2014-100027
Published: 2015-01-13
Description: Cross-site scripting (XSS) vulnerability in the WP SlimStat plugin before 3.5.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/57305; http://www.securityfocus.com/bid/66146; https://exchange.xforce.ibmcloud.com/vulnerabilities/91840
CVE: CVE-2014-100028
Published: 2015-01-13
Description: Cross-site scripting (XSS) vulnerability in /signup in WEBCrafted allows remote attackers to inject arbitrary web script or HTML via the username.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/124682; http://secunia.com/advisories/56307; http://www.securityfocus.com/bid/64681
CVE: CVE-2014-100029
Published: 2015-01-13
Description: Multiple directory traversal vulnerabilities in class/session.php in Ganesha Digital Library (GDL) 4.2 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) newlang or (2) newtheme parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.com/files/125464; https://exchange.xforce.ibmcloud.com/vulnerabilities/91555; http://packetstormsecurity.com/files/125464
CVE: CVE-2014-100030
Published: 2015-01-13
Description: Cross-site scripting (XSS) vulnerability in module/search/function.php in Ganesha Digital Library (GDL) 4.2 allows remote attackers to inject arbitrary web script or HTML via the keyword parameter in a ByEge action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/125464; http://secunia.com/advisories/57171; https://exchange.xforce.ibmcloud.com/vulnerabilities/91553
CVE: CVE-2014-100031
Published: 2015-01-13
Description: Multiple SQL injection vulnerabilities in Ganesha Digital Library (GDL) 4.2 allow remote attackers to execute arbitrary SQL commands via the id parameter in (1) download.php or (2) main.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/125464; http://secunia.com/advisories/57171; https://exchange.xforce.ibmcloud.com/vulnerabilities/91554
CVE: CVE-2014-100032
Published: 2015-01-13
Description: Cross-site scripting (XSS) vulnerability in top.html in the Airties Air 6372 modem allows remote attackers to inject arbitrary web script or HTML via the productboardtype parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/128213/Airties-Air6372SO-Modem-Web-Interface-Cross-Site-Scripting.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/95957; http://packetstormsecurity.com/files/128213/Airties-Air6372SO-Modem-Web-Interface-Cross-Site-Scripting.html
CVE: CVE-2014-100033
Published: 2015-01-13
Description: Directory traversal vulnerability in LicensePal ArcticDesk before 1.2.5 allows remote attackers to read arbitrary files via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/57299; http://www.arcticdesk.com/support/announcements/arcticdesk-v1-2-5-maintenance-release-18.html; https://blog.rack911.com/security-advisories/arcticdesk-custom-module-local-file-inclusion-vulnerability-r911-0132/
CVE: CVE-2014-100034
Published: 2015-01-13
Description: Cross-site scripting (XSS) vulnerability in the frontend interface in LicensePal ArcticDesk before 1.2.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/57299; http://www.arcticdesk.com/support/announcements/arcticdesk-v1-2-5-maintenance-release-18.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/91792
CVE: CVE-2014-100035
Published: 2015-01-13
Description: SQL injection vulnerability in the ticket grid in the admin interface in LicensePal ArcticDesk before 1.2.5 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.arcticdesk.com/support/announcements/arcticdesk-v1-2-5-maintenance-release-18.html; http://www.arcticdesk.com/support/announcements/arcticdesk-v1-2-5-maintenance-release-18.html
CVE: CVE-2014-100036
Published: 2015-01-13
Description: Cross-site scripting (XSS) vulnerability in FlatPress 1.0.2 allows remote attackers to inject arbitrary web script or HTML via the content parameter to the default URI.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/57808; https://exchange.xforce.ibmcloud.com/vulnerabilities/92538; https://github.com/evacchi/flatpress/issues/14
CVE: CVE-2014-100037
Published: 2015-01-13
Description: Cross-site scripting (XSS) vulnerability in Storytlr 1.3.dev and earlier allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to archives/.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/57182; https://www.netsparker.com/xss-vulnerability-in-storytlr/; http://secunia.com/advisories/57182
CVE: CVE-2014-100038
Published: 2015-01-13
Description: Cross-site scripting (XSS) vulnerability in Storytlr 1.3.dev and earlier allows remote attackers to inject arbitrary web script or HTML via the search parameter to search/.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/57182; https://exchange.xforce.ibmcloud.com/vulnerabilities/91762; https://www.netsparker.com/critical-xss-vulnerabilities-in-storytlr/
CVE: CVE-2014-100039
Published: 2015-01-13
Description: mbae.sys in Malwarebytes Anti-Exploit before 1.05.1.2014 allows local users to cause a denial of service (crash) via a crafted size in an unspecified IOCTL call, which triggers an out-of-bounds read.  NOTE: some of these details are obtained from third party information.
CVSS Score: 2.1 (LOW)
CWE: CWE-20
References: http://www.osvdb.org/114249; https://www.malwarebytes.org/support/releasehistory/; http://www.osvdb.org/114249
CVE: CVE-2014-10031
Published: 2015-01-13
Description: Buffer overflow in the IMAPd service in Qualcomm Eudora WorldMail 9.0.333.0 allows remote attackers to execute arbitrary code via a long string in a UID command.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://osvdb.org/show/osvdb/104071; http://www.exploit-db.com/exploits/31694; https://exchange.xforce.ibmcloud.com/vulnerabilities/91833
CVE: CVE-2014-10032
Published: 2015-01-13
Description: SQL injection vulnerability in news_popup.php in Taboada MacroNews 1.0 allows remote authenticated users to execute arbitrary SQL commands via the id parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://osvdb.org/show/osvdb/102207; http://www.exploit-db.com/exploits/30689; https://exchange.xforce.ibmcloud.com/vulnerabilities/90459
CVE: CVE-2014-10033
Published: 2015-01-13
Description: SQL injection vulnerability in the update_zone function in catalog/admin/geo_zones.php in osCommerce Online Merchant 2.3.3.4 and earlier allows remote administrators to execute arbitrary SQL commands via the zID parameter in a list action.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://osvdb.org/show/osvdb/103365; http://www.exploit-db.com/exploits/31515; http://www.secgeek.net/oscommerce-v2x-sql-injection-vulnerability/
CVE: CVE-2014-10034
Published: 2015-01-13
Description: Multiple SQL injection vulnerabilities in the admin area in couponPHP before 1.2.0 allow remote administrators to execute arbitrary SQL commands via the (1) iDisplayLength or (2) iDisplayStart parameter to (a) comments_paginate.php or (b) stores_paginate.php in admin/ajax/.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://couponphp.com/changelog; http://osvdb.org/show/osvdb/103895; http://osvdb.org/show/osvdb/103896
CVE: CVE-2014-10035
Published: 2015-01-13
Description: Multiple cross-site scripting (XSS) vulnerabilities in the admin area in couponPHP before 1.2.0 allow remote administrators to inject arbitrary web script or HTML via the (1) sEcho parameter to comments_paginate.php or (2) stores_paginate.php or the (3) affiliate_url, (4) description, (5) domain, (6) seo[description], (7) seo[heading], (8) seo[title], (9) seo[keywords], (10) setting[logo], (11) setting[perpage], or (12) setting[sitename] to admin/index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://couponphp.com/changelog; http://osvdb.org/show/osvdb/103886; http://osvdb.org/show/osvdb/103887
CVE: CVE-2014-10036
Published: 2015-01-13
Description: Cross-site scripting (XSS) vulnerability in JetBrains TeamCity before 8.1 allows remote attackers to inject arbitrary web script or HTML via the cameFromUrl parameter to feed/generateFeedUrl.html.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://confluence.jetbrains.com/display/TCD8/What%27s+New+in+TeamCity+8.1; http://secunia.com/advisories/57221; https://exchange.xforce.ibmcloud.com/vulnerabilities/91768
CVE: CVE-2014-10037
Published: 2015-01-13
Description: Directory traversal vulnerability in DomPHP 0.83 and earlier allows remote attackers to have unspecified impact via a .. (dot dot) in the url parameter to photoalbum/index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://osvdb.org/show/osvdb/102204; http://www.exploit-db.com/exploits/30865; https://exchange.xforce.ibmcloud.com/vulnerabilities/90582
CVE: CVE-2014-10038
Published: 2015-01-13
Description: SQL injection vulnerability in agenda/indexdate.php in DomPHP 0.83 and earlier allows remote attackers to execute arbitrary SQL commands via the ids parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/show/osvdb/102180; http://packetstormsecurity.com/files/124801; http://www.exploit-db.com/exploits/30872
CVE: CVE-2015-0001
Published: 2015-01-13
Description: The Windows Error Reporting (WER) component in Microsoft Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to bypass the Protected Process Light protection mechanism and read the contents of arbitrary process-memory locations by leveraging administrative privileges, aka "Windows Error Reporting Security Feature Bypass Vulnerability."
CVSS Score: 1.9 (LOW)
CWE: CWE-264
References: http://packetstormsecurity.com/files/134392/Microsoft-Windows-8.1-Ahcache.sys-NtApphelpCacheControl-Privilege-Escalation.html; http://secunia.com/advisories/62134; http://www.securityfocus.com/bid/71927
CVE: CVE-2015-0002
Published: 2015-01-13
Description: The AhcVerifyAdminContext function in ahcache.sys in the Application Compatibility component in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not verify that an impersonation token is associated with an administrative account, which allows local users to gain privileges by running AppCompatCache.exe with a crafted DLL file, aka MSRC ID 20544 or "Microsoft Application Compatibility Infrastructure Elevation of Privilege Vulnerability."
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/61277; http://twitter.com/sambowne/statuses/[PII_REDACTED]83520512; http://www.securityfocus.com/bid/71972
CVE: CVE-2015-0004
Published: 2015-01-13
Description: The User Profile Service (aka ProfSvc) in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges by conducting a junction attack to load another user's UsrClass.dat registry hive, aka MSRC ID 20674 or "Microsoft User Profile Service Elevation of Privilege Vulnerability."
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/61927; http://www.securityfocus.com/bid/71967; https://code.google.com/p/google-security-research/issues/detail?id=123
CVE: CVE-2015-0006
Published: 2015-01-13
Description: The Network Location Awareness (NLA) service in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 does not perform mutual authentication to determine a domain connection, which allows remote attackers to trigger an unintended permissive configuration by spoofing DNS and LDAP responses on a local network, aka "NLA Security Feature Bypass Vulnerability."
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/62098; http://secunia.com/advisories/62184; http://www.securityfocus.com/bid/71930
CVE: CVE-2015-0011
Published: 2015-01-13
Description: mrxdav.sys (aka the WebDAV driver) in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to bypass an impersonation protection mechanism, and obtain privileges for redirection of WebDAV requests, via a crafted application, aka "WebDAV Elevation of Privilege Vulnerability."
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/62154; http://www.securityfocus.com/bid/71960; http://www.securitytracker.com/id/1031531
CVE: CVE-2015-0014
Published: 2015-01-13
Description: Buffer overflow in the Telnet service in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via crafted packets, aka "Windows Telnet Service Buffer Overflow Vulnerability."
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/61580; http://www.securityfocus.com/bid/71968; http://www.securitytracker.com/id/1031523
CVE: CVE-2015-0015
Published: 2015-01-13
Description: Microsoft Windows Server 2003 SP2, Server 2008 SP2 and R2 SP1, and Server 2012 Gold and R2 allow remote attackers to cause a denial of service (system hang and RADIUS outage) via crafted username strings to (1) Internet Authentication Service (IAS) or (2) Network Policy Server (NPS), aka "Network Policy Server RADIUS Implementation Denial of Service Vulnerability."
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://secunia.com/advisories/62148; http://www.securityfocus.com/bid/71933; http://www.securitytracker.com/id/1031532
CVE: CVE-2015-0016
Published: 2015-01-13
Description: Directory traversal vulnerability in the TS WebProxy (aka TSWbPrxy) component in Microsoft Windows Vista SP2, Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to gain privileges via a crafted pathname in an executable file, as demonstrated by a transition from Low Integrity to Medium Integrity, aka "Directory Traversal Elevation of Privilege Vulnerability."
CVSS Score: 7.8 (HIGH)
CWE: CWE-22, CWE-22
References: http://blog.trendmicro.com/trendlabs-security-intelligence/cve-2015-0016-escaping-the-internet-explorer-sandbox/; http://packetstormsecurity.com/files/130201/MS15-004-Microsoft-Remote-Desktop-Services-Web-Proxy-IE-Sandbox-Escape.html; http://secunia.com/advisories/62076
CVE: CVE-2015-0301
Published: 2015-01-13
Description: Adobe Flash Player before 13.0.0.260 and 14.x through 16.x before 16.0.0.257 on Windows and OS X and before 11.2.202.429 on Linux, Adobe AIR before 16.0.0.245 on Windows and OS X and before 16.0.0.272 on Android, Adobe AIR SDK before 16.0.0.272, and Adobe AIR SDK & Compiler before 16.0.0.272 do not properly validate files, which has unspecified impact and attack vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-20
References: http://helpx.adobe.com/security/products/flash-player/apsb15-01.html; http://secunia.com/advisories/62177; http://secunia.com/advisories/62187