deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2012-6619
Published: 2014-03-06
Description: The default configuration for MongoDB before 2.3.2 does not validate objects, which allows remote authenticated users to cause a denial of service (crash) or read system memory via a crafted BSON object in the column name in an insert command, which triggers a buffer over-read.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-20
References: http://blog.ptsecurity.com/2012/11/attacking-mongodb.html; http://rhn.redhat.com/errata/RHSA-2014-0230.html; http://rhn.redhat.com/errata/RHSA-2014-0440.html
CVE: CVE-2013-6437
Published: 2014-03-06
Description: The libvirt driver in OpenStack Compute (Nova) before 2013.2.2 and icehouse before icehouse-2 allows remote authenticated users to cause a denial of service (disk consumption) by creating and deleting instances with unique os_type settings, which triggers the creation of a new ephemeral disk backing file.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-399
References: http://lists.openstack.org/pipermail/openstack-announce/2013-December/000179.html; http://rhn.redhat.com/errata/RHSA-2014-0231.html; https://bugs.launchpad.net/nova/+bug/1253980
CVE: CVE-2014-1906
Published: 2014-03-06
Description: Multiple cross-site scripting (XSS) vulnerabilities in the VideoWhisper Live Streaming Integration plugin before 4.29.5 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) m parameter to lb_status.php; (2) msg parameter to vc_chatlog.php; n parameter to (3) channel.php, (4) htmlchat.php, (5) video.php, or (6) videotext.php; (7) message parameter to lb_logout.php; or ct parameter to (8) lb_status.php or (9) v_status.php in ls/.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/125454; https://exchange.xforce.ibmcloud.com/vulnerabilities/91477; https://www.htbridge.com/advisory/HTB23199
CVE: CVE-2014-1907
Published: 2014-03-06
Description: Multiple directory traversal vulnerabilities in the VideoWhisper Live Streaming Integration plugin before 4.29.5 for WordPress allow remote attackers to (1) read arbitrary files via a .. (dot dot) in the s parameter to ls/rtmp_login.php or (2) delete arbitrary files via a .. (dot dot) in the s parameter to ls/rtmp_logout.php.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.com/files/125454; https://exchange.xforce.ibmcloud.com/vulnerabilities/91478; https://www.htbridge.com/advisory/HTB23199
CVE: CVE-2009-5138
Published: 2014-03-07
Description: GnuTLS before 2.7.6, when the GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT flag is not enabled, treats version 1 X.509 certificates as intermediate CAs, which allows remote attackers to bypass intended restrictions by leveraging a X.509 V1 certificate from a trusted CA to issue new certificates, a different vulnerability than CVE-2014-1959.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-264
References: http://article.gmane.org/gmane.comp.security.oss.general/12223; http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00000.html; http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00001.html
CVE: CVE-2014-0092
Published: 2014-03-07
Description: lib/x509/verify.c in GnuTLS before 3.1.22 and 3.2.x before 3.2.12 does not properly handle unspecified errors when verifying X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers via a crafted certificate.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-310
References: http://gnutls.org/security.html#GNUTLS-SA-2014-2; http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00000.html; http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00001.html
CVE: CVE-2014-1959
Published: 2014-03-07
Description: lib/x509/verify.c in GnuTLS before 3.1.21 and 3.2.x before 3.2.11 treats version 1 X.509 certificates as intermediate CAs, which allows remote attackers to bypass intended restrictions by leveraging a X.509 V1 certificate from a trusted CA to issue new certificates.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-264
References: http://seclists.org/oss-sec/2014/q1/344; http://seclists.org/oss-sec/2014/q1/345; http://www.debian.org/security/2014/dsa-2866
CVE: CVE-2013-1890
Published: 2014-03-09
Description: Multiple cross-site scripting (XSS) vulnerabilities in ownCloud Server before 5.0.1 allow remote attackers to inject arbitrary web script or HTML via the (1) new_name parameter to apps/bookmarks/ajax/renameTag.php or (2) multiple unspecified parameters to unknown files in apps/contacts/ajax/.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://owncloud.org/about/security/advisories/oC-SA-2013-011; http://www.securityfocus.com/bid/58852; https://exchange.xforce.ibmcloud.com/vulnerabilities/83245
CVE: CVE-2013-1893
Published: 2014-03-09
Description: SQL injection vulnerability in addressbookprovider.php in ownCloud Server before 5.0.1 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, related to the contacts application.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://owncloud.org/about/security/advisories/oC-SA-2013-012; http://www.securityfocus.com/bid/58855; https://exchange.xforce.ibmcloud.com/vulnerabilities/83253
CVE: CVE-2013-2045
Published: 2014-03-09
Description: SQL injection vulnerability in lib/db.php in ownCloud Server 5.0.x before 5.0.6 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://osvdb.org/93384; http://owncloud.org/about/security/advisories/oC-SA-2013-019; http://seclists.org/oss-sec/2013/q2/324
CVE: CVE-2013-2046
Published: 2014-03-09
Description: SQL injection vulnerability in lib/bookmarks.php in ownCloud Server 4.5.x before 4.5.11 and 5.x before 5.0.6 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://osvdb.org/93383; http://owncloud.org/about/security/advisories/oC-SA-2013-019; http://seclists.org/oss-sec/2013/q2/324
CVE: CVE-2013-2270
Published: 2014-03-09
Description: Cross-site scripting (XSS) vulnerability in the administration page in Airvana HubBub C1-600-RT and Sprint AIRAVE 2.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2013-02/0155.html; http://osvdb.org/90732; http://packetstormsecurity.com/files/120594/Airvana-HubBub-C1-600-RT-Cross-Site-Scripting.html
CVE: CVE-2013-4966
Published: 2014-03-09
Description: The master external node classification script in Puppet Enterprise before 3.2.0 does not verify the identity of consoles, which allows remote attackers to create arbitrary classifications on the master by spoofing a console.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-287
References: http://puppetlabs.com/security/cve/cve-2013-4966; http://www.securitytracker.com/id/1029873; http://puppetlabs.com/security/cve/cve-2013-4966
CVE: CVE-2013-4971
Published: 2014-03-09
Description: Puppet Enterprise before 3.2.0 does not properly restrict access to node endpoints in the console, which allows remote attackers to obtain sensitive information via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://puppetlabs.com/security/cve/cve-2013-4971; http://www.securitytracker.com/id/1029873; http://puppetlabs.com/security/cve/cve-2013-4971
CVE: CVE-2013-6232
Published: 2014-03-09
Description: Cross-site scripting (XSS) vulnerability in SpagoBI before 4.1 allows remote authenticated users to inject arbitrary web script or HTML via a document note in the execution page.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://packetstormsecurity.com/files/125495; http://www.exploit-db.com/exploits/32038; http://www.securityfocus.com/archive/1/531321/100/0/threaded
CVE: CVE-2013-6233
Published: 2014-03-09
Description: Cross-site scripting (XSS) vulnerability in SpagoBI before 4.1 allows remote authenticated users to inject arbitrary web script or HTML via the Description field in the "Short document metadata."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/125496; http://www.exploit-db.com/exploits/32039; http://www.securityfocus.com/archive/1/531322/100/0/threaded
CVE: CVE-2013-7322
Published: 2014-03-09
Description: usersfile.c in liboath in OATH Toolkit before 2.4.1 does not properly handle lines containing an invalid one-time-password (OTP) type and a user name in /etc/users.oath, which causes the wrong line to be updated when invalidating an OTP and allows context-dependent attackers to conduct replay attacks, as demonstrated by a commented out line when using libpam-oath.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-287
References: http://lists.nongnu.org/archive/html/oath-toolkit-help/2013-12/msg00000.html; http://lists.nongnu.org/archive/html/oath-toolkit-help/2013-12/msg00002.html; http://lists.nongnu.org/archive/html/oath-toolkit-help/2013-12/msg00003.html
CVE: CVE-2014-1599
Published: 2014-03-09
Description: Multiple cross-site scripting (XSS) vulnerabilities in the SFR Box router with firmware NB6-MAIN-R3.3.4 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters to (1) dns, (2) dhcp, (3) nat, (4) route, or (5) lan in network/; or (6) wifi/config.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/archive/1/531349/100/0/threaded; http://www.securityfocus.com/bid/65973; http://www.securityfocus.com/archive/1/531349/100/0/threaded
CVE: CVE-2014-1944
Published: 2014-03-09
Description: Cross-site scripting (XSS) vulnerability in Ilch CMS 2.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the text parameter to index.php/guestbook/index/newentry.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.exploit-db.com/exploits/32076; http://www.securityfocus.com/archive/1/531350/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/91538
CVE: CVE-2014-1945
Published: 2014-03-09
Description: SQL injection vulnerability in ajax_udf.php in OpenDocMan before 1.2.7.2 allows remote attackers to execute arbitrary SQL commands via the add_value parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/56189; http://www.opendocman.com/opendocman-v1-2-7-1-release; http://www.opendocman.com/opendocman-v1-2-7-2-released
CVE: CVE-2014-2313
Published: 2014-03-09
Description: Directory traversal vulnerability in the Importers plugin in Atlassian JIRA before 6.0.5 allows remote attackers to create arbitrary files via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: https://confluence.atlassian.com/display/JIRA/JIRA+Security+Advisory+2014-02-26; https://confluence.atlassian.com/display/JIRA/JIRA+Security+Advisory+2014-02-26
CVE: CVE-2014-2314
Published: 2014-03-09
Description: Directory traversal vulnerability in the Issue Collector plugin in Atlassian JIRA before 6.0.4 allows remote attackers to create arbitrary files via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: http://blog.h3xstream.com/2014/02/jira-path-traversal-explained.html; http://www.exploit-db.com/exploits/32725; https://confluence.atlassian.com/display/JIRA/JIRA+Security+Advisory+2014-02-26
CVE: CVE-2014-2315
Published: 2014-03-09
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Thank You Counter Button plugin 1.8.7 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) thanks_caption, (2) thanks_caption_style, or (3) thanks_style parameter to wp-admin/options.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/125397; http://www.securityfocus.com/bid/65805; https://exchange.xforce.ibmcloud.com/vulnerabilities/91474
CVE: CVE-2014-2316
Published: 2014-03-09
Description: SQL injection vulnerability in se_search_default in the Search Everything plugin before 7.0.3 for WordPress allows remote attackers to execute arbitrary SQL commands via the s parameter to index.php. NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/56820; http://wordpress.org/plugins/search-everything/changelog/; http://www.securityfocus.com/bid/65765
CVE: CVE-2014-2317
Published: 2014-03-09
Description: SQL injection vulnerability in ajax_udf.php in OpenDocMan before 1.2.7.2 allows remote attackers to execute arbitrary SQL commands via the table parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/56189; http://www.opendocman.com/opendocman-v1-2-7-2-released; http://www.securityfocus.com/bid/65775
CVE: CVE-2013-6938
Published: 2014-03-11
Description: Unspecified vulnerability in the Service VM in Citrix NetScaler SDX 9.3 before 9.3-64.4 and 10.0 before 10.0-77.5 and Application Delivery Controller (ADC) 9.3.x before 9.3-64.4, 10.0 before 10.0-77.5, and 10.1 before 10.1-118.7 allows attackers to cause a denial of service via unknown vectors, related to the "Virtual Machine Daemon."
CVSS Score: 5.0 (MEDIUM)
References: http://support.citrix.com/article/CTX139049; http://support.citrix.com/article/CTX140113; http://support.citrix.com/article/CTX139049
CVE: CVE-2013-6939
Published: 2014-03-11
Description: Unspecified vulnerability in Citrix NetScaler Application Delivery Controller (ADC) 9.3.x before 9.3-64.4, 10.0 before 10.0-77.5, and 10.1 before 10.1-118.7 allows attackers to cause a denial of service via unknown vectors, related to "RADIUS authentication."
CVSS Score: 5.0 (MEDIUM)
References: http://support.citrix.com/article/CTX139049; http://support.citrix.com/article/CTX139049
CVE: CVE-2013-6940
Published: 2014-03-11
Description: Citrix NetScaler Application Delivery Controller (ADC) 9.3.x before 9.3-64.4, 10.0 before 10.0-77.5, and 10.1 before 10.1-118.7 logs user credentials, which allows attackers to obtain sensitive information via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-255
References: http://support.citrix.com/article/CTX139049; http://support.citrix.com/article/CTX139049
CVE: CVE-2013-6941
Published: 2014-03-11
Description: Unspecified vulnerability in Citrix NetScaler Application Delivery Controller (ADC) 9.3.x before 9.3-64.4, 10.0 before 10.0-77.5, and 10.1 before 10.1-118.7 allows users to "breakout" of the shell via unknown vectors.
CVSS Score: 10.0 (HIGH)
References: http://support.citrix.com/article/CTX139049; http://support.citrix.com/article/CTX139049
CVE: CVE-2013-6942
Published: 2014-03-11
Description: Cross-site request forgery (CSRF) vulnerability in Citrix NetScaler Application Delivery Controller (ADC) 9.3.x before 9.3-64.4, 10.0 before 10.0-77.5, and 10.1 before 10.1-118.7 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://support.citrix.com/article/CTX139049; http://support.citrix.com/article/CTX139049
CVE: CVE-2013-6943
Published: 2014-03-11
Description: Citrix NetScaler Application Delivery Controller (ADC) 9.3.x before 9.3-64.4, 10.0 before 10.0-77.5, and 10.1 before 10.1-118.7 allows remote attackers to conduct an LDAP injection attack via vectors related to SSH and Web management usernames.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-94
References: http://support.citrix.com/article/CTX139049; http://support.citrix.com/article/CTX139049
CVE: CVE-2013-6944
Published: 2014-03-11
Description: Cross-site scripting (XSS) vulnerability in the user interface in the AAA TM vServer in Citrix NetScaler Application Delivery Controller (ADC) 9.3.x before 9.3-64.4, 10.0 before 10.0-77.5, and 10.1 before 10.1-118.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://support.citrix.com/article/CTX139049; http://support.citrix.com/article/CTX139049
CVE: CVE-2014-0094
Published: 2014-03-11
Description: The ParametersInterceptor in Apache Struts before 2.3.16.2 allows remote attackers to "manipulate" the ClassLoader via the class parameter, which is passed to the getClass method.
CVSS Score: 5.0 (MEDIUM)
References: http://jvn.jp/en/jp/JVN19294237/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2014-000045; http://packetstormsecurity.com/files/127215/VMware-Security-Advisory-2014-0007.html
CVE: CVE-2014-2318
Published: 2014-03-11
Description: SQL injection vulnerability in ATCOM Netvolution 3 allows remote attackers to execute arbitrary SQL commands via the m parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/125507; http://www.securityfocus.com/bid/65942; https://exchange.xforce.ibmcloud.com/vulnerabilities/91543
CVE: CVE-2013-6031
Published: 2014-03-11
Description: The Huawei E355 adapter with firmware 21.157.37.01.910 does not require authentication for API pages, which allows remote attackers to change passwords and settings, or obtain sensitive information, via a direct request to (1) api/wlan/security-settings, (2) api/device/information, (3) api/wlan/basic-settings, (4) api/wlan/mac-filter, (5) api/monitoring/status, or (6) api/dhcp/settings.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-287
References: http://www.kb.cert.org/vuls/id/341526; https://github.com/aczire/huawei-csrf-info_disclosure/blob/master/huawei_wifi_info.rb; http://www.kb.cert.org/vuls/id/341526
CVE: CVE-2013-6037
Published: 2014-03-11
Description: Cross-site scripting (XSS) vulnerability in index.php in Aker Secure Mail Gateway 2.5.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the msg_id parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.kb.cert.org/vuls/id/687278; http://www.securityfocus.com/bid/66024; http://www.kb.cert.org/vuls/id/687278
CVE: CVE-2013-6200
Published: 2014-03-11
Description: Unspecified vulnerability in m4 in HP HP-UX B.11.23 and B.11.31 allows local users to obtain sensitive information or modify data via unknown vectors.
CVSS Score: 6.2 (MEDIUM)
References: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04103553; https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04103553
CVE: CVE-2013-6207
Published: 2014-03-11
Description: Unspecified vulnerability in the loadFileContents function in the SOAP implementation in HP SiteScope 10.1x, 11.1x, and 11.21 allows remote attackers to read arbitrary files or cause a denial of service via unknown vectors, aka ZDI-CAN-2084.
CVSS Score: 9.4 (HIGH)
References: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03969435; https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c03969435; https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03969435
CVE: CVE-2014-0049
Published: 2014-03-11
Description: Buffer overflow in the complete_emulated_mmio function in arch/x86/kvm/x86.c in the Linux kernel before 3.13.6 allows guest OS users to execute arbitrary code on the host OS by leveraging a loop that triggers an invalid memory copy affecting certain cancel_work_item data.
CVSS Score: 7.4 (HIGH)
CWE: CWE-120
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=a08d3b3b99efd[PII_REDACTED]56531cdf8f3a0c09b; http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.13.6; http://www.openwall.com/lists/oss-security/2014/03/03/1
CVE: CVE-2014-0100
Published: 2014-03-11
Description: Race condition in the inet_frag_intern function in net/ipv4/inet_fragment.c in the Linux kernel through 3.13.6 allows remote attackers to cause a denial of service (use-after-free error) or possibly have unspecified other impact via a large series of fragmented ICMP Echo Request packets to a system with a heavy CPU load.
CVSS Score: 9.3 (HIGH)
CWE: CWE-362, CWE-416
References: http://patchwork.ozlabs.org/patch/325844/; http://www.openwall.com/lists/oss-security/2014/03/04/4; https://bugzilla.redhat.com/show_bug.cgi?id=1070618
CVE: CVE-2014-0101
Published: 2014-03-11
Description: The sctp_sf_do_5_1D_ce function in net/sctp/sm_statefuns.c in the Linux kernel through 3.13.6 does not validate certain auth_enable and auth_capable fields before making an sctp_sf_authenticate call, which allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) via an SCTP handshake with a modified INIT chunk and a crafted AUTH chunk before a COOKIE_ECHO chunk.
CVSS Score: 7.8 (HIGH)
CWE: CWE-476
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=ec0223ec48a90cb605244b45f7c62de856403729; http://rhn.redhat.com/errata/RHSA-2014-0328.html; http://rhn.redhat.com/errata/RHSA-2014-0419.html
CVE: CVE-2014-0102
Published: 2014-03-11
Description: The keyring_detect_cycle_iterator function in security/keys/keyring.c in the Linux kernel through 3.13.6 does not properly determine whether keyrings are identical, which allows local users to cause a denial of service (OOPS) via crafted keyctl commands.
CVSS Score: 5.2 (MEDIUM)
CWE: CWE-310
References: http://lkml.org/lkml/2014/2/27/507; http://www.kernelhub.org/?msg=425013&p=2; http://www.openwall.com/lists/oss-security/2014/03/04/21
CVE: CVE-2014-0899
Published: 2014-03-11
Description: ftpd in IBM AIX 7.1.1 before SP10 and 7.1.2 before SP5, when a Workload Partition (aka WPAR) for AIX 5.2 or 5.3 is used, allows remote authenticated users to bypass intended permission settings and modify arbitrary files via FTP commands.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://aix.software.ibm.com/aix/efixes/security/wparcre_advisory.asc; http://www.ibm.com/support/docview.wss?uid=isg1IV51420; http://www.ibm.com/support/docview.wss?uid=isg1IV51421
CVE: CVE-2014-2281
Published: 2014-03-11
Description: The nfs_name_snoop_add_name function in epan/dissectors/packet-nfs.c in the NFS dissector in Wireshark 1.8.x before 1.8.13 and 1.10.x before 1.10.6 does not validate a certain length value, which allows remote attackers to cause a denial of service (memory corruption and application crash) via a crafted NFS packet.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-nfs.c?r1=54875&r2=54874&pathrev=54875; http://anonsvn.wireshark.org/viewvc?view=revision&revision=54875; http://lists.opensuse.org/opensuse-updates/2014-03/msg00046.html
CVE: CVE-2014-2282
Published: 2014-03-11
Description: The dissect_protocol_data_parameter function in epan/dissectors/packet-m3ua.c in the M3UA dissector in Wireshark 1.10.x before 1.10.6 does not properly allocate memory, which allows remote attackers to cause a denial of service (application crash) via a crafted SS7 MTP3 packet.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-m3ua.c?r1=51608&r2=51607&pathrev=51608; http://anonsvn.wireshark.org/viewvc?view=revision&revision=51608; http://lists.opensuse.org/opensuse-updates/2014-03/msg00046.html
CVE: CVE-2014-2283
Published: 2014-03-11
Description: epan/dissectors/packet-rlc in the RLC dissector in Wireshark 1.8.x before 1.8.13 and 1.10.x before 1.10.6 uses inconsistent memory-management approaches, which allows remote attackers to cause a denial of service (use-after-free error and application crash) via a crafted UMTS Radio Link Control packet.
CVSS Score: 4.3 (MEDIUM)
References: http://lists.opensuse.org/opensuse-updates/2014-03/msg00046.html; http://lists.opensuse.org/opensuse-updates/2014-03/msg00047.html; http://rhn.redhat.com/errata/RHSA-2014-0342.html
CVE: CVE-2014-2299
Published: 2014-03-11
Description: Buffer overflow in the mpeg_read function in wiretap/mpeg.c in the MPEG parser in Wireshark 1.8.x before 1.8.13 and 1.10.x before 1.10.6 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a large record in MPEG data.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-updates/2014-03/msg00046.html; http://lists.opensuse.org/opensuse-updates/2014-03/msg00047.html; http://osvdb.org/show/osvdb/104199