deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2013-5939
Published: 2014-05-14
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Guestbook module for PHPCMS allow remote attackers to inject arbitrary web script or HTML via the (1) list or (2) introduce parameter to index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/98886; http://packetstormsecurity.com/files/123746/PHPCMS-Guestbook-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2013/Oct/187
CVE: CVE-2013-7376
Published: 2014-05-14
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in OpenX 2.8.10, possibly before revision 82710, allow remote attackers to hijack the authentication of administrators, as demonstrated by requests that conduct directory traversal attacks via the group parameter to (1) plugin-preferences.php or (2) plugin-settings.php in www/admin, a different vulnerability than CVE-2013-3514.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://osvdb.org/94778; http://seclists.org/bugtraq/2013/Jul/27; https://www.htbridge.com/advisory/HTB23155
CVE: CVE-2014-0078
Published: 2014-05-14
Description: The CatalogController in Red Hat CloudForms Management Engine (CFME) before 5.2.3.2 allows remote authenticated users to delete arbitrary catalogs via vectors involving guessing the catalog ID.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://rhn.redhat.com/errata/RHSA-2014-0469.html; https://bugzilla.redhat.com/show_bug.cgi?id=1064556; http://rhn.redhat.com/errata/RHSA-2014-0469.html
CVE: CVE-2014-0137
Published: 2014-05-14
Description: SQL injection vulnerability in the saved_report_delete action in the ReportController in Red Hat CloudForms Management Engine (CFME) before 5.2.3.2 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, related to MiqReportResult.exists.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://rhn.redhat.com/errata/RHSA-2014-0469.html; http://rhn.redhat.com/errata/RHSA-2014-0469.html
CVE: CVE-2014-1603
Published: 2014-05-14
Description: Multiple cross-site scripting (XSS) vulnerabilities in GetSimple CMS 3.3.1 allow remote attackers to inject arbitrary web script or HTML via the (1) param parameter to admin/load.php or (2) user, (3) email, or (4) name parameter in a Save Settings action to admin/settings.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2014/May/53; http://www.securityfocus.com/bid/67337; https://raw.githubusercontent.com/pedrib/PoC/master/getsimplecms-3.3.1.txt
CVE: CVE-2014-3146
Published: 2014-05-14
Description: Incomplete blacklist vulnerability in the lxml.html.clean module in lxml before 3.3.5 allows remote attackers to conduct cross-site scripting (XSS) attacks via control characters in the link scheme to the clean_html function.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://advisories.mageia.org/MGASA-2014-0218.html; http://lists.opensuse.org/opensuse-updates/2014-05/msg00083.html; http://lxml.de/3.3/changes-3.3.5.html
CVE: CVE-2014-3430
Published: 2014-05-14
Description: Dovecot 1.1 before 2.2.13 and dovecot-ee before 2.1.7.7 and 2.2.x before 2.2.12.12 does not properly close old connections, which allows remote attackers to cause a denial of service (resource consumption) via an incomplete SSL/TLS handshake for an IMAP/POP3 connection.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-287
References: http://advisories.mageia.org/MGASA-2014-0223.html; http://dovecot.org/pipermail/dovecot-news/2014-May/000273.html; http://linux.oracle.com/errata/ELSA-2014-0790.html
CVE: CVE-2014-3441
Published: 2014-05-14
Description: codec\libpng_plugin.dll in VideoLAN VLC Media Player 2.1.3 allows remote attackers to cause a denial of service (crash) via a crafted .png file, as demonstrated by a png in a .wave file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://packetstormsecurity.com/files/126564/VLC-Player-2.1.3-Memory-Corruption.html; http://www.securityfocus.com/bid/67315; http://packetstormsecurity.com/files/126564/VLC-Player-2.1.3-Memory-Corruption.html
CVE: CVE-2014-3443
Published: 2014-05-14
Description: JetMPAd.ax in JetAudio 8.1.1 and earlier allows remote attackers to cause a denial of service (crash) via a crafted .ogg file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://www.exploit-db.com/exploits/33332; http://www.securityfocus.com/bid/67319; http://www.exploit-db.com/exploits/33332
CVE: CVE-2013-0197
Published: 2014-05-15
Description: Cross-site scripting (XSS) vulnerability in the filter_draw_selection_area2 function in core/filter_api.php in MantisBT 1.2.12 before 1.2.13 allows remote attackers to inject arbitrary web script or HTML via the match_type parameter to bugs/search.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://hauntit.blogspot.de/2013/01/en-mantis-bug-tracker-1212-persistent.html; http://seclists.org/oss-sec/2013/q1/118; http://seclists.org/oss-sec/2013/q1/125
CVE: CVE-2013-1810
Published: 2014-05-15
Description: Multiple cross-site scripting (XSS) vulnerabilities in core/summary_api.php in MantisBT 1.2.12 allow remote authenticated users with manager or administrator permissions to inject arbitrary web script or HTML via a (1) category name in the summary_print_by_category function or (2) project name in the summary_print_by_project function.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://seclists.org/oss-sec/2013/q1/127; http://seclists.org/oss-sec/2013/q1/556; http://secunia.com/advisories/51853
CVE: CVE-2013-4730
Published: 2014-05-15
Description: Buffer overflow in PCMan's FTP Server 2.0.7 allows remote attackers to execute arbitrary code via a long string in a USER command.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://infosec42.blogspot.com/2013/06/unauthenticated-pcman-ftp-207-buffer.html; http://osvdb.org/show/osvdb/94624; http://www.exploit-db.com/exploits/26471
CVE: CVE-2014-0209
Published: 2014-05-15
Description: Multiple integer overflows in the (1) FontFileAddEntry and (2) lexAlias functions in X.Org libXfont before 1.4.8 and 1.4.9x before 1.4.99.901 might allow local users to gain privileges by adding a directory with a large fonts.dir or fonts.alias file to the font path, which triggers a heap-based buffer overflow, related to metadata.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-189
References: http://advisories.mageia.org/MGASA-2014-0278.html; http://lists.opensuse.org/opensuse-updates/2014-05/msg00073.html; http://lists.x.org/archives/xorg-announce/2014-May/002431.html
CVE: CVE-2014-0210
Published: 2014-05-15
Description: Multiple buffer overflows in X.Org libXfont before 1.4.8 and 1.4.9x before 1.4.99.901 allow remote font servers to execute arbitrary code via a crafted xfs protocol reply to the (1) _fs_recv_conn_setup, (2) fs_read_open_font, (3) fs_read_query_info, (4) fs_read_extent_info, (5) fs_read_glyphs, (6) fs_read_list, or (7) fs_read_list_info function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://advisories.mageia.org/MGASA-2014-0278.html; http://lists.opensuse.org/opensuse-updates/2014-05/msg00073.html; http://lists.x.org/archives/xorg-announce/2014-May/002431.html
CVE: CVE-2014-0211
Published: 2014-05-15
Description: Multiple integer overflows in the (1) fs_get_reply, (2) fs_alloc_glyphs, and (3) fs_read_extent_info functions in X.Org libXfont before 1.4.8 and 1.4.9x before 1.4.99.901 allow remote font servers to execute arbitrary code via a crafted xfs reply, which triggers a buffer overflow.
CVSS Score: 7.5 (HIGH)
CWE: CWE-189
References: http://advisories.mageia.org/MGASA-2014-0278.html; http://lists.opensuse.org/opensuse-updates/2014-05/msg00073.html; http://lists.x.org/archives/xorg-announce/2014-May/002431.html
CVE: CVE-2014-3247
Published: 2014-05-15
Description: Cross-site scripting (XSS) vulnerability in Collabtive 1.2 allows remote authenticated users to inject arbitrary web script or HTML via the desc parameter in an Add project (addpro) action to admin.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.exploit-db.com/exploits/33250; http://www.securityfocus.com/bid/67343; http://www.exploit-db.com/exploits/33250
CVE: CVE-2014-3757
Published: 2014-05-15
Description: SQL injection vulnerability in sorter.php in the phpManufaktur kitForm extension 0.43 and earlier for the KeepInTouch (KIT) module allows remote attackers to execute arbitrary SQL commands via the sorter_value parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://seclists.org/fulldisclosure/2014/Apr/249; http://www.securityfocus.com/bid/67000; http://seclists.org/fulldisclosure/2014/Apr/249
CVE: CVE-2014-0643
Published: 2014-05-16
Description: EMC RSA NetWitness before 9.8.5.19 and RSA Security Analytics before 10.2.4 and 10.3.x before 10.3.2, when Kerberos PAM is enabled, do not require a password, which allows remote attackers to bypass authentication by leveraging knowledge of a valid account name.
CVSS Score: 7.6 (HIGH)
CWE: CWE-287
References: http://archives.neohapsis.com/archives/bugtraq/2014-05/0052.html; http://archives.neohapsis.com/archives/bugtraq/2014-05/0052.html
CVE: CVE-2014-0782
Published: 2014-05-16
Description: Stack-based buffer overflow in BKESimmgr.exe in the Expanded Test Functions package in Yokogawa CENTUM CS 1000, CENTUM CS 3000 Entry Class R3.09.50 and earlier, CENTUM VP R5.03.00 and earlier, CENTUM VP Entry Class R5.03.00 and earlier, Exaopc R3.71.02 and earlier, B/M9000CS R5.05.01 and earlier, and B/M9000 VP R7.03.01 and earlier allows remote attackers to execute arbitrary code via a crafted packet.
CVSS Score: 8.3 (HIGH)
CWE: CWE-121, CWE-119
References: http://www.securityfocus.com/bid/66130; http://www.yokogawa.com/dcs/security/ysar/dcs-ysar-index-en.htm.; https://community.rapid7.com/community/metasploit/blog/2014/03/10/yokogawa-centum-cs3000-vulnerabilities
CVE: CVE-2014-0917
Published: 2014-05-16
Description: Cross-site scripting (XSS) vulnerability in IBM Eclipse Help System (IEHS) in IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0 through 7.0.0.2 CF27, and 8.0 before 8.0.0.1 CF06 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PI14125; http://www-01.ibm.com/support/docview.wss?uid=swg21670753; http://www.securityfocus.com/bid/67339
CVE: CVE-2014-0918
Published: 2014-05-16
Description: Directory traversal vulnerability in IBM Eclipse Help System (IEHS) in IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0 through 7.0.0.2 CF27, and 8.0 before 8.0.0.1 CF06 allows remote attackers to read arbitrary files via a crafted URL.
CVSS Score: 7.1 (HIGH)
CWE: CWE-22
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PI14125; http://www-01.ibm.com/support/docview.wss?uid=swg21670753; http://www.securityfocus.com/bid/67340
CVE: CVE-2014-0933
Published: 2014-05-16
Description: Cross-site request forgery (CSRF) vulnerability in IBM InfoSphere Information Server Metadata Workbench 8.1 through 9.1 allows remote attackers to hijack the authentication of arbitrary users.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www-01.ibm.com/support/docview.wss?uid=swg1JR49605; http://www-01.ibm.com/support/docview.wss?uid=swg21671141; https://exchange.xforce.ibmcloud.com/vulnerabilities/92273
CVE: CVE-2014-0964
Published: 2014-05-16
Description: IBM WebSphere Application Server (WAS) 6.1.0.0 through 6.1.0.47 and 6.0.2.0 through 6.0.2.43 allows remote attackers to cause a denial of service via crafted TLS traffic, as demonstrated by traffic from a CVE-2014-0160 vulnerability-assessment tool.
CVSS Score: 7.1 (HIGH)
CWE: CWE-399
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PI14306; http://www-01.ibm.com/support/docview.wss?uid=swg1PI16981; http://www-01.ibm.com/support/docview.wss?uid=swg1PI17128
CVE: CVE-2014-1649
Published: 2014-05-16
Description: The server in Symantec Workspace Streaming (SWS) before 7.5.0.749 allows remote attackers to access files and functionality by sending a crafted XMLRPC request over HTTPS.
CVSS Score: 7.9 (HIGH)
CWE: CWE-264
References: http://www.exploit-db.com/exploits/33521; http://www.securityfocus.com/bid/67189; http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20140512_00
CVE: CVE-2014-3262
Published: 2014-05-16
Description: The Locator/ID Separation Protocol (LISP) implementation in Cisco IOS 15.3(3)S and earlier and IOS XE does not properly validate parameters in ITR control messages, which allows remote attackers to cause a denial of service (CEF outage and packet drops) via malformed messages, aka Bug ID CSCun73782.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3262; http://tools.cisco.com/security/center/viewAlert.x?alertId=34233; http://www.securitytracker.com/id/1030243
CVE: CVE-2014-3263
Published: 2014-05-16
Description: The ScanSafe module in Cisco IOS 15.3(3)M allows remote attackers to cause a denial of service (device reload) via HTTPS packets that require tower processing, aka Bug ID CSCum97038.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3263; http://tools.cisco.com/security/center/viewAlert.x?alertId=34234; http://www.securitytracker.com/id/1030244
CVE: CVE-2014-3750
Published: 2014-05-16
Description: The Bilyoner application before 2.3.1 for Android and before 4.6.2 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-310
References: http://sceptive.com/p/bilyoner-mobile-apps-prone-to-various-ssltls-attacks; http://sceptive.com/p/bilyoner-mobile-apps-prone-to-various-ssltls-attacks
CVE: CVE-2014-0749
Published: 2014-05-16
Description: Stack-based buffer overflow in lib/Libdis/disrsi_.c in Terascale Open-Source Resource and Queue Manager (aka TORQUE Resource Manager) 2.5.x through 2.5.13 allows remote attackers to execute arbitrary code via a large count value.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://osvdb.org/show/osvdb/107024; http://packetstormsecurity.com/files/126651/Torque-2.5.13-Buffer-Overflow.html; http://packetstormsecurity.com/files/126855/TORQUE-Resource-Manager-2.5.13-Buffer-Overflow.html
CVE: CVE-2014-3758
Published: 2014-05-16
Description: Cross-site scripting (XSS) vulnerability in the BibTex Publications (si_bibtex) extension 0.2.3 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via vectors related to the import functionality.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2014/Apr/314; http://www.securityfocus.com/archive/1/531980/100/0/threaded; http://www.securityfocus.com/bid/67145
CVE: CVE-2014-3759
Published: 2014-05-16
Description: Multiple SQL injection vulnerabilities in the BibTex Publications (si_bibtex) extension 0.2.3 for TYPO3 allow remote attackers to execute arbitrary SQL commands via vectors related to the (1) search or (2) list functionality.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://seclists.org/fulldisclosure/2014/Apr/314; http://www.securityfocus.com/archive/1/531980/100/0/threaded; http://www.securityfocus.com/bid/67145
CVE: CVE-2014-3760
Published: 2014-05-16
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in D-Link DAP 1150 with firmware 1.2.94 allow remote attackers to hijack the authentication of administrators for requests that (1) enable or (2) disable the DMZ in the Firewall/DMZ section via a request to index.cgi or (3) add, (4) modify, or (5) delete URL-filter settings in the Control/URL-filter section via a request to index.cgi, as demonstrated by adding a rule that blocks access to google.com.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://seclists.org/fulldisclosure/2014/Apr/246; http://websecurity.com.ua/7112; http://seclists.org/fulldisclosure/2014/Apr/246
CVE: CVE-2014-3761
Published: 2014-05-16
Description: Cross-site scripting (XSS) vulnerability in D-Link DAP 1150 with firmware 1.2.94 allows remote attackers to inject arbitrary web script or HTML via the res_buf parameter to index.cgi in the Control/URL-filter section.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2014/Apr/246; http://websecurity.com.ua/7112; http://seclists.org/fulldisclosure/2014/Apr/246
CVE: CVE-2013-7379
Published: 2014-05-16
Description: The admin API in the tomato module before 0.0.6 for Node.js does not properly check the access key when it is set to a string, which allows remote attackers to bypass authentication via a string in the access-key header that partially matches config.master.api.access_key.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287
References: http://www.openwall.com/lists/oss-security/2014/05/13/1; http://www.openwall.com/lists/oss-security/2014/05/15/2; https://github.com/leizongmin/tomato/commit/9e427d524e04a905312a3294c85e939ed7d57b8c
CVE: CVE-2014-1418
Published: 2014-05-16
Description: Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly include the (1) Vary: Cookie or (2) Cache-Control header in responses, which allows remote attackers to obtain sensitive information or poison the cache via a request from certain browsers.
CVSS Score: 6.4 (MEDIUM)
References: http://lists.opensuse.org/opensuse-updates/2014-09/msg00023.html; http://secunia.com/advisories/61281; http://ubuntu.com/usn/usn-2212-1
CVE: CVE-2014-1613
Published: 2014-05-16
Description: Dotclear before 2.6.2 allows remote attackers to execute arbitrary PHP code via a serialized object in the dc_passwd cookie to a password-protected page, which is not properly handled by (1) inc/public/lib.urlhandlers.php or (2) plugins/pages/_public.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://dotclear.org/blog/post/2014/01/20/Dotclear-2.6.2; https://labs.mwrinfosecurity.com/advisories/2014/05/14/dotclear-php-object-injection/; http://dotclear.org/blog/post/2014/01/20/Dotclear-2.6.2
CVE: CVE-2014-3452
Published: 2014-05-16
Description: Filters\LAV\avfilter-lav-4.dll in K-lite Codec 10.4.5 and earlier allows remote attackers to cause a denial of service (crash) via a crafted .jpg file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://packetstormsecurity.com/files/126613/klite1045-corrupt.txt; http://www.securityfocus.com/bid/67403; http://packetstormsecurity.com/files/126613/klite1045-corrupt.txt
CVE: CVE-2014-3730
Published: 2014-05-16
Description: The django.util.http.is_safe_url function in Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly validate URLs, which allows remote attackers to conduct open redirect attacks via a malformed URL, as demonstrated by "http:\\\djangoproject.com."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-updates/2014-09/msg00023.html; http://secunia.com/advisories/61281; http://ubuntu.com/usn/usn-2212-1
CVE: CVE-2014-3742
Published: 2014-05-16
Description: The hapi server framework 2.0.x and 2.1.x before 2.2.0 for Node.js allows remote attackers to cause a denial of service (file descriptor consumption and process crash) via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://www.openwall.com/lists/oss-security/2014/05/13/1; http://www.openwall.com/lists/oss-security/2014/05/15/2; https://github.com/spumko/hapi/issues/1427
CVE: CVE-2013-7382
Published: 2014-05-17
Description: VICIDIAL dialer (aka Asterisk GUI client) 2.8-403a, 2.7, 2.7RC1, and earlier has a hardcoded password of donotedit for the (1) VDAD and (2) VDCL users, which makes it easier for remote attackers to obtain access.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-255
References: http://www.exploit-db.com/exploits/29513; http://www.openwall.com/lists/oss-security/2013/10/23/10; http://www.openwall.com/lists/oss-security/2013/10/25/1
CVE: CVE-2014-2084
Published: 2014-05-17
Description: Skybox View Appliances with ISO 6.3.33-2.14, 6.3.31-2.14, 6.4.42-2.54, 6.4.45-2.56, and 6.4.46-2.57 does not properly restrict access to the Admin interface, which allows remote attackers to obtain sensitive information via a request to (1) scripts/commands/getSystemInformation or (2) scripts/commands/getNetworkConfigurationInfo, cause a denial of service (reboot) via a request to scripts/commands/reboot, or cause a denial of service (shutdown) via a request to scripts/commands/shutdown.
CVSS Score: 8.5 (HIGH)
CWE: CWE-264
References: http://www.exploit-db.com/exploits/33327; http://www.exploit-db.com/exploits/33328; http://www.osvdb.org/106842
CVE: CVE-2014-2085
Published: 2014-05-17
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-2084. Reason: This issue was MERGED into CVE-2014-2084 in accordance with CVE content decisions, because it is the same type of vulnerability and affects the same versions.  Notes: All CVE users should reference CVE-2014-2084 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2014-3453
Published: 2014-05-17
Description: Eval injection vulnerability in the flag_import_form_validate function in includes/flag.export.inc in the Flag module 7.x-3.0, 7.x-3.5, and earlier for Drupal allows remote authenticated administrators to execute arbitrary PHP code via the "Flag import code" text area to admin/structure/flags/import.  NOTE: this issue could also be exploited by other attackers if the administrator ignores a security warning on the permissions assignment page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-94
References: http://seclists.org/fulldisclosure/2014/May/44; http://www.openwall.com/lists/oss-security/2014/05/12/2; http://www.securityfocus.com/bid/67318
CVE: CVE-2013-4489
Published: 2014-05-17
Description: The Grit gem for Ruby, as used in GitLab 5.2 before 5.4.1 and 6.x before 6.2.3, allows remote authenticated users to execute arbitrary commands, as demonstrated by the search box for the GitLab code search feature.
CVSS Score: 6.5 (MEDIUM)
References: https://www.gitlab.com/2013/11/04/gitlab-ce-6-2-and-5-4-security-release/; https://www.gitlab.com/2013/11/04/gitlab-ce-6-2-and-5-4-security-release/
CVE: CVE-2013-4498
Published: 2014-05-17
Description: The Spaces OG submodule in the Spaces module 6.x-3.x before 6.x-3.7 for Drupal does not properly delete organic group group spaces content when using the option to move to a new group, which causes the content to be "orphaned" and allows remote authenticated users with the "access content" permission to obtain sensitive information via vectors involving a rebuild access for the site or content.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://seclists.org/oss-sec/2013/q4/210; https://drupal.org/node/2118717; https://drupal.org/node/2118745
CVE: CVE-2014-1347
Published: 2014-05-18
Description: Apple iTunes before 11.2.1 on OS X sets world-writable permissions for /Users and /Users/Shared during reboots, which allows local users to modify files, and consequently obtain access to arbitrary user accounts, via standard filesystem operations.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-264
References: http://support.apple.com/kb/HT6251; http://support.apple.com/kb/HT6251
CVE: CVE-2013-4406
Published: 2014-05-19
Description: The Quick Tabs module 6.x-2.x before 6.x-2.2, 6.x-3.x before 6.x-3.2, and 7.x-3.x before 7.x-3.6 for Drupal does not properly check block permissions, which allows remote attackers to obtain sensitive information by reading a Quick Tab.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://www.openwall.com/lists/oss-security/2013/10/04/14; http://www.openwall.com/lists/oss-security/2013/10/05/1; https://drupal.org/node/2103113
CVE: CVE-2013-4426
Published: 2014-05-19
Description: pyxtrlock before 0.1 uses an incorrect variable name, which allows physically proximate attackers to bypass the lock screen via multiple failed authentication attempts, which trigger a crash.
CVSS Score: 3.6 (LOW)
References: http://seclists.org/oss-sec/2013/q4/109; https://github.com/leonnnn/pyxtrlock/blob/master/CHANGELOG; https://github.com/leonnnn/pyxtrlock/issues/8