deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-0028
Published: 2014-01-24
Description: libvirt 1.1.1 through 1.2.0 allows context-dependent attackers to bypass the domain:getattr and connect:search_domains restrictions in ACLs and obtain sensitive domain object information via a request to the (1) virConnectDomainEventRegister and (2) virConnectDomainEventRegisterAny functions in the event registration API.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://libvirt.org/news.html; http://lists.opensuse.org/opensuse-updates/2014-02/msg00060.html; http://secunia.com/advisories/60895
CVE: CVE-2014-1447
Published: 2014-01-24
Description: Race condition in the virNetServerClientStartKeepAlive function in libvirt before 1.2.1 allows remote attackers to cause a denial of service (libvirtd crash) by closing a connection before a keepalive response is sent.
CVSS Score: 3.3 (LOW)
CWE: CWE-362
References: http://libvirt.org/news.html; http://lists.opensuse.org/opensuse-updates/2014-02/msg00060.html; http://lists.opensuse.org/opensuse-updates/2014-02/msg00062.html
CVE: CVE-2014-1475
Published: 2014-01-24
Description: The OpenID module in Drupal 6.x before 6.30 and 7.x before 7.26 allows remote OpenID users to authenticate as other users via unspecified vectors.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/56260; http://secunia.com/advisories/56601; http://www.debian.org/security/2014/dsa-2847
CVE: CVE-2014-1476
Published: 2014-01-24
Description: The Taxonomy module in Drupal 7.x before 7.26, when upgraded from an earlier version of Drupal, does not properly restrict access to unpublished content, which allows remote authenticated users to obtain sensitive information via a listing page.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/56260; http://www.debian.org/security/2014/dsa-2847; http://www.mandriva.com/security/advisories?name=MDVSA-2014:031
CVE: CVE-2014-1202
Published: 2014-01-25
Description: The WSDL/WADL import functionality in SoapUI before 4.6.4 allows remote attackers to execute arbitrary Java code via a crafted request parameter in a WSDL file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://baraktawily.blogspot.com/2014/01/soapui-code-execution-vulnerability-cve.html; http://packetstormsecurity.com/files/124773/SoapUI-Remote-Code-Execution.html; http://www.exploit-db.com/exploits/30908
CVE: CVE-2014-1670
Published: 2014-01-25
Description: The Microsoft Bing application before 4.2.1 for Android allows remote attackers to install arbitrary APK files via vectors involving a crafted DNS response.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://blog.trustlook.com/2014/01/23/trustlook-reported-microsofts-first-ever-android-vulnerability/; http://osvdb.org/102575; http://www.securityfocus.com/bid/65128
CVE: CVE-2014-0673
Published: 2014-01-25
Description: Multiple cross-site scripting (XSS) vulnerabilities in the web interface on Cisco Video Surveillance 5000 HD IP Dome cameras allow remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug IDs CSCud10943 and CSCud10950.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/102557; http://secunia.com/advisories/56552; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0673
CVE: CVE-2014-0678
Published: 2014-01-25
Description: The portal interface in Cisco Secure Access Control System (ACS) does not properly manage sessions, which allows remote authenticated users to hijack sessions and gain privileges via unspecified vectors, aka Bug ID CSCue65951.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/102558; http://secunia.com/advisories/56540; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0678
CVE: CVE-2014-0750
Published: 2014-01-25
Description: Directory traversal vulnerability in gefebt.exe in the WebView CimWeb components in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY through 8.2 SIM 24, and Proficy Process Systems with CIMPLICITY, allows remote attackers to execute arbitrary code via a crafted HTTP request, aka ZDI-CAN-1622.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: http://support.ge-ip.com/support/index?page=kbchannel&id=KB15939; http://www.securityfocus.com/bid/65124; https://www.cisa.gov/news-events/ics-advisories/icsa-14-023-01
CVE: CVE-2014-0751
Published: 2014-01-25
Description: The CIMPLICITY Web-based access component, CimWebServer, does not check 
the location of shell files being loaded into the system. By modifying 
the source location, an attacker could send shell code to the 
CimWebServer which would deploy the nefarious files as part of any SCADA
 project. This could allow the attacker to execute arbitrary code.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22, CWE-22
References: http://support.ge-ip.com/support/index?page=kbchannel&id=KB15939; http://www.securityfocus.com/bid/65124; https://www.cisa.gov/news-events/ics-advisories/icsa-14-023-01
CVE: CVE-2013-5364
Published: 2014-01-26
Description: Secunia CSI Agent 6.0.0.15017 and earlier, 6.0.1.1007 and earlier, and 7.0.0.21 and earlier, when running on Red Hat Linux, uses world-readable and world-writable permissions for /etc/csia_config.xml, which allows local users to change CSI Agent configuration by modifying this file.
CVSS Score: 3.6 (LOW)
CWE: CWE-264
References: http://osvdb.org/101901; http://secunia.com/advisories/56380; http://secunia.com/vulnerability_scanning/corporate/release-history/
CVE: CVE-2013-6853
Published: 2014-01-26
Description: Cross-site scripting (XSS) vulnerability in clickstream.js in Y! Toolbar plugin for FireFox 3.1.0[PII_REDACTED]4103 for Mac, and 2.5.9[PII_REDACTED]420 for Windows, allows remote attackers to inject arbitrary web script or HTML via a crafted URL that is stored by the victim.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/102175; http://packetstormsecurity.com/files/124800/Y-Toolbar-Cross-Site-Scripting.html; http://www.cloudscan.me/2014/01/cve-2013-6853-stored-xss-in-y-toolbar.html
CVE: CVE-2013-6891
Published: 2014-01-26
Description: lppasswd in CUPS before 1.7.1, when running with setuid privileges, allows local users to read portions of arbitrary files via a modified HOME environment variable and a symlink attack involving .cups/client.conf.
CVSS Score: 1.2 (LOW)
CWE: CWE-59
References: http://advisories.mageia.org/MGASA-2014-0021.html; http://secunia.com/advisories/56531; http://www.cups.org/blog.php?L704
CVE: CVE-2013-7137
Published: 2014-01-26
Description: The "remember me" functionality in login.php in Burden before 1.8.1 allows remote attackers to bypass authentication and gain privileges by setting the burden_user_rememberme cookie to 1.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: http://www.exploit-db.com/exploits/30916; http://www.securityfocus.com/archive/1/530703/100/0/threaded; https://github.com/joshf/Burden/commit/edaa1bb8f73d6f3c8b2e78b67f1b40e02fccd0c1
CVE: CVE-2013-7247
Published: 2014-01-26
Description: cgi-bin/tsaws.cgi in Franklin Fueling Systems TS-550 evo with firmware 2.0.0.6833 and other versions before 2.4.0 allows remote attackers to discover sensitive information (user names and password hashes) via the cmdWebGetConfiguration action in a TSA_REQUEST.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: https://www.trustwave.com/spiderlabs/advisories/TWSL2014-001.txt; https://www.trustwave.com/spiderlabs/advisories/TWSL2014-001.txt
CVE: CVE-2013-7248
Published: 2014-01-26
Description: Franklin Fueling Systems TS-550 evo with firmware 2.0.0.6833 and other versions before 2.4.0 has a hardcoded password for the roleDiag account, which allows remote attackers to gain root privileges, as demonstrated using a cmdWebCheckRole action in a TSA_REQUEST.
CVSS Score: 10.0 (HIGH)
CWE: CWE-255
References: https://www.trustwave.com/spiderlabs/advisories/TWSL2014-001.txt; https://www.trustwave.com/spiderlabs/advisories/TWSL2014-001.txt
CVE: CVE-2013-7296
Published: 2014-01-26
Description: The JBIG2Stream::readSegments method in JBIG2Stream.cc in Poppler before 0.24.5 does not use the correct specifier within a format string, which allows context-dependent attackers to cause a denial of service (segmentation fault and application crash) via a crafted PDF file.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://cgit.freedesktop.org/poppler/poppler/commit/?id=58e04a08afee39370283c494ee2e4e392fd3b684; http://lists.fedoraproject.org/pipermail/package-announce/2014-January/125710.html; http://seclists.org/oss-sec/2014/q1/105
CVE: CVE-2014-0027
Published: 2014-01-26
Description: The play_wave_from_socket function in audio/auserver.c in Flite 1.4 allows local users to modify arbitrary files via a symlink attack on /tmp/awb.wav.  NOTE: some of these details are obtained from third party information.
CVSS Score: 3.3 (LOW)
CWE: CWE-59
References: http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127748.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127776.html; http://seclists.org/oss-sec/2014/q1/59
CVE: CVE-2014-1626
Published: 2014-01-26
Description: XML External Entity (XXE) vulnerability in MARC::File::XML module before 1.0.2 for Perl, as used in Evergreen, Koha, perl4lib, and possibly other products, allows context-dependent attackers to read arbitrary files via a crafted XML file.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://libmail.georgialibraries.org/pipermail/open-ils-general/2014-January/009442.html; http://lists.katipo.co.nz/pipermail/koha/2014-January/038430.html; http://osvdb.org/102367
CVE: CVE-2014-1671
Published: 2014-01-26
Description: Multiple SQL injection vulnerabilities in Dell KACE K1000 5.4.76847 and possibly earlier allow remote attackers or remote authenticated users to execute arbitrary SQL commands via the macAddress element in a (1) getUploadPath or (2) getKBot SOAP request to service/kbot_service.php; the ID parameter to (3) userui/advisory_detail.php or (4) userui/ticket.php; and the (5) ORDER[] parameter to userui/ticket_list.php.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/56396; http://www.baesystemsdetica.com.au/Research/Advisories/Dell-KACE-K1000-SQL-Injection-%28DS-2014-001%29; http://www.securityfocus.com/bid/65029
CVE: CVE-2014-1672
Published: 2014-01-26
Description: Check Point R75.47 Security Gateway and Management Server does not properly enforce Anti-Spoofing when the routing table is modified and the "Get - Interfaces with Topology" action is performed, which allows attackers to bypass intended access restrictions.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/90976; https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk98087; https://exchange.xforce.ibmcloud.com/vulnerabilities/90976
CVE: CVE-2014-1673
Published: 2014-01-26
Description: Check Point Session Authentication Agent allows remote attackers to obtain sensitive information (user credentials) via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/102418; http://packetstormsecurity.com/files/124967; http://seclists.org/fulldisclosure/2014/Jan/185
CVE: CVE-2013-6429
Published: 2014-01-26
Description: The SourceHttpMessageConverter in Spring MVC in Spring Framework before 3.2.5 and 4.0.0.M1 through 4.0.0.RC1 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue, and a different vulnerability than CVE-2013-4152 and CVE-2013-7315.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352, CWE-611
References: http://rhn.redhat.com/errata/RHSA-2014-0400.html; http://secunia.com/advisories/57915; http://www.gopivotal.com/security/cve-2013-6429
CVE: CVE-2014-0022
Published: 2014-01-26
Description: The installUpdates function in yum-cron/yum-cron.py in yum 3.4.3 and earlier does not properly check the return value of the sigCheckPkg function, which allows remote attackers to bypass the RMP package signing restriction via an unsigned package.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/56637; http://www.securityfocus.com/bid/65119; http://yum.baseurl.org/gitweb?p=yum.git%3Ba=commitdiff%3Bh=9df69e5794
CVE: CVE-2014-1642
Published: 2014-01-26
Description: The IRQ setup in Xen 4.2.x and 4.3.x, when using device passthrough and configured to support a large number of CPUs, frees certain memory that may still be intended for use, which allows local guest administrators to cause a denial of service (memory corruption and hypervisor crash) and possibly execute arbitrary code via vectors related to an out-of-memory error that triggers a (1) use-after-free or (2) double free.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-399
References: http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127580.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127607.html; http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00011.html
CVE: CVE-2014-1666
Published: 2014-01-26
Description: The do_physdev_op function in Xen 4.1.5, 4.1.6.1, 4.2.2 through 4.2.3, and 4.3.x does not properly restrict access to the (1) PHYSDEVOP_prepare_msix and (2) PHYSDEVOP_release_msix operations, which allows local PV guests to cause a denial of service (host or guest malfunction) or possibly gain privileges via unspecified vectors.
CVSS Score: 8.3 (HIGH)
CWE: CWE-264
References: http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127580.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127607.html; http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00010.html
CVE: CVE-2013-4304
Published: 2014-01-26
Description: The CentralAuth extension for MediaWiki 1.19.x before 1.19.8, 1.20.x before 1.20.7, and 1.21.x before 1.21.2 caches a valid CentralAuthUser object in the centralauth_User cookie even when a user has not successfully logged in, which allows remote attackers to bypass authentication without a password.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-September/000133.html; http://osvdb.org/96910; http://seclists.org/oss-sec/2013/q3/553
CVE: CVE-2013-6466
Published: 2014-01-26
Description: Openswan 2.6.39 and earlier allows remote attackers to cause a denial of service (NULL pointer dereference and IKE daemon restart) via IKEv2 packets that lack expected payloads.
CVSS Score: 5.0 (MEDIUM)
References: http://rhn.redhat.com/errata/RHSA-2014-0185.html; http://www.debian.org/security/2014/dsa-2893; http://www.securityfocus.com/bid/65155
CVE: CVE-2013-6467
Published: 2014-01-26
Description: Libreswan 3.7 and earlier allows remote attackers to cause a denial of service (NULL pointer dereference and IKE daemon restart) via IKEv2 packets that lack expected payloads.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/102172; http://secunia.com/advisories/56420; http://www.securityfocus.com/bid/64987
CVE: CVE-2013-7140
Published: 2014-01-26
Description: XML External Entity (XXE) vulnerability in the CalDAV interface in Open-Xchange (OX) AppSuite 7.4.1 and earlier allows remote authenticated users to read portions of arbitrary files via vectors related to the SAX builder and the WebDAV interface.  NOTE: this issue has been labeled as both absolute path traversal and XXE, but the root cause may be XXE, since XXE can be exploited to conduct absolute path traversal and other attacks.
CVSS Score: 4.0 (MEDIUM)
References: http://seclists.org/bugtraq/2014/Jan/57; http://www.osvdb.org/102194; http://www.securityfocus.com/bid/65015
CVE: CVE-2013-7141
Published: 2014-01-26
Description: Cross-site scripting (XSS) vulnerability in Open-Xchange (OX) AppSuite 7.4.1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to crafted "<%" tags.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/102192; http://seclists.org/bugtraq/2014/Jan/57; http://www.securityfocus.com/bid/65009
CVE: CVE-2013-7142
Published: 2014-01-26
Description: Cross-site scripting (XSS) vulnerability in Open-Xchange (OX) AppSuite 7.4.1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified oAuth API functions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/102193; http://seclists.org/bugtraq/2014/Jan/57; http://www.securityfocus.com/bid/65012
CVE: CVE-2013-7143
Published: 2014-01-26
Description: Cross-site scripting (XSS) vulnerability in Open-Xchange (OX) AppSuite 7.4.1 allows remote attackers to inject arbitrary web script or HTML via the title in a mail filter rule.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/bugtraq/2014/Jan/57; http://www.osvdb.org/102195; http://www.securityfocus.com/bid/65013
CVE: CVE-2013-7298
Published: 2014-01-26
Description: query_params.cpp in cxxtools before 2.2.1 allows remote attackers to cause a denial of service (infinite recursion and crash) via an HTTP query that contains %% (double percent) characters.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://lists.fedoraproject.org/pipermail/package-announce/2014-January/127445.html; http://seclists.org/oss-sec/2014/q1/112; http://seclists.org/oss-sec/2014/q1/116
CVE: CVE-2013-7299
Published: 2014-01-26
Description: framework/common/messageheaderparser.cpp in Tntnet before 2.2.1 allows remote attackers to obtain sensitive information via a header that ends in \n instead of \r\n, which prevents a null terminator from being added and causes Tntnet to include headers from other requests.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127746.html; http://seclists.org/oss-sec/2014/q1/112; http://seclists.org/oss-sec/2014/q1/116
CVE: CVE-2014-0794
Published: 2014-01-26
Description: SQL injection vulnerability in the JV Comment (com_jvcomment) component before 3.0.3 for Joomla! allows remote authenticated users to execute arbitrary SQL commands via the id parameter in a comment.like action to index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://extensions.joomla.org/extensions/contacts-and-feedback/articles-comments/23394; http://www.exploit-db.com/exploits/31175; http://www.osvdb.org/101960
CVE: CVE-2014-1607
Published: 2014-01-26
Description: Cross-site scripting (XSS) vulnerability in the EventCalendar module for Drupal 7.14 allows remote attackers to inject arbitrary web script or HTML via the year parameter to eventcalander/. NOTE: this issue has been disputed by the Drupal Security Team; it may be site-specific.  If so, then this CVE will be REJECTed in the future
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/102574; http://www.securityfocus.com/archive/1/530876/100/0/threaded; https://groups.drupal.org/node/402023
CVE: CVE-2014-1664
Published: 2014-01-26
Description: The Citrix GoToMeeting application 5.0.799.1238 for Android logs HTTP requests containing sensitive information, which allows attackers to obtain user IDs, meeting details, and authentication tokens via an application that reads the system log file.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://osvdb.org/102559; http://www.securityfocus.com/archive/1/530879/100/0/threaded; http://www.securityfocus.com/bid/65123
CVE: CVE-2013-6747
Published: 2014-01-27
Description: IBM GSKit 7.x before 7.0.4.48 and 8.x before 8.0.50.16, as used in IBM Security Directory Server (ISDS) and Tivoli Directory Server (TDS), allows remote attackers to cause a denial of service (application crash or hang) via a malformed X.509 certificate chain.
CVSS Score: 7.1 (HIGH)
CWE: CWE-20
References: http://osvdb.org/102556; http://secunia.com/advisories/56698; http://secunia.com/advisories/56699
CVE: CVE-2012-5192
Published: 2014-01-28
Description: Directory traversal vulnerability in gmap/view_overlay.php in Bitweaver 2.8.1 and earlier allows remote attackers to read arbitrary files via "''%2F" (dot dot encoded slash) sequences in the overlay_type parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: https://www.trustwave.com/spiderlabs/advisories/TWSL2012-016.txt; https://www.trustwave.com/spiderlabs/advisories/TWSL2012-016.txt
CVE: CVE-2013-6838
Published: 2014-01-28
Description: An unspecified Enghouse Interactive Professional Services "addon product" in Enghouse Interactive IVR Pro (VIP2000) 9.0.3 (rel903), when using OpenVZ and fallback customization, uses the same SSH private key across different customers' installations, which allows remote attackers to gain privileges by leveraging knowledge of this key.
CVSS Score: 10.0 (HIGH)
CWE: CWE-310
References: http://seclists.org/fulldisclosure/2014/Jan/103; https://xpd.se/advisories/XPD-2013-001.txt; http://seclists.org/fulldisclosure/2014/Jan/103
CVE: CVE-2013-7135
Published: 2014-01-28
Description: The Proc::Daemon module 0.14 for Perl uses world-writable permissions for a file that stores a process ID, which allows local users to have an unspecified impact by modifying this file.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://www.mandriva.com/security/advisories?name=MDVSA-2014:021; http://www.openwall.com/lists/oss-security/2013/12/16/5; http://www.openwall.com/lists/oss-security/2013/12/18/2
CVE: CVE-2014-0647
Published: 2014-01-28
Description: The Starbucks 2.6.1 application for iOS stores sensitive information in plaintext in the Crashlytics log file (/Library/Caches/com.crashlytics.data/com.starbucks.mystarbucks/session.clslog), which allows attackers to discover usernames, passwords, and e-mail addresses via an application that reads session.clslog.
CVSS Score: 2.1 (LOW)
CWE: CWE-255
References: http://seclists.org/fulldisclosure/2014/Jan/123; http://seclists.org/fulldisclosure/2014/Jan/64; http://www.osvdb.org/102514
CVE: CVE-2014-1604
Published: 2014-01-28
Description: The parser cache functionality in parsergenerator.py in RPLY (aka python-rply) before 0.7.1 allows local users to spoof cache data by pre-creating a temporary rply-*.json file with a predictable name.
CVSS Score: 2.1 (LOW)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=735263; http://secunia.com/advisories/56429; http://www.openwall.com/lists/oss-security/2014/01/17/8
CVE: CVE-2014-1624
Published: 2014-01-28
Description: Race condition in the xdg.BaseDirectory.get_runtime_dir function in python-xdg 0.25 allows local users to overwrite arbitrary files by pre-creating /tmp/pyxdg-runtime-dir-fallback-victim to point to a victim-owned location, then replacing it with a symlink to an attacker-controlled location once the get_runtime_dir function is called.
CVSS Score: 3.3 (LOW)
CWE: CWE-59
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=736247; http://www.openwall.com/lists/oss-security/2014/01/21/3; http://www.openwall.com/lists/oss-security/2014/01/21/4
CVE: CVE-2014-1638
Published: 2014-01-28
Description: (1) debian/postrm and (2) debian/localepurge.config in localepurge before 0.7.3.2 use tempfile to create a safe temporary file but appends a suffix to the original filename and writes to this new filename, which allows local users to overwrite arbitrary files via a symlink attack on the new filename.
CVSS Score: 3.3 (LOW)
CWE: CWE-59
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=736359; http://www.openwall.com/lists/oss-security/2014/01/22/3; http://www.openwall.com/lists/oss-security/2014/01/22/4
CVE: CVE-2014-1639
Published: 2014-01-28
Description: syncevo/installcheck-local.sh in syncevolution before 1.3.99.7 uses mktemp to create a safe temporary file but appends a suffix to the original filename and writes to this new filename, which allows local users to overwrite arbitrary files via a symlink attack on the new filename.
CVSS Score: 3.3 (LOW)
CWE: CWE-59
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=736357; http://www.openwall.com/lists/oss-security/2014/01/22/3; http://www.openwall.com/lists/oss-security/2014/01/22/4