deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-8672
Published: 2014-11-07
Description: Cross-site scripting (XSS) vulnerability in the RewardingYourself application for Android and BlackBerry OS allows remote attackers to inject arbitrary web script or HTML via a crafted QR code.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://arxiv.org/abs/1410.7756; http://arxiv.org/pdf/1410.7756v1.pdf; http://arxiv.org/abs/1410.7756
CVE: CVE-2014-3640
Published: 2014-11-07
Description: The sosendto function in slirp/udp.c in QEMU before 2.1.2 allows local users to cause a denial of service (NULL pointer dereference) by sending a udp packet with a value of 0 in the source port and address, which triggers access of an uninitialized socket.
CVSS Score: 2.1 (LOW)
CWE: CWE-476
References: http://lists.nongnu.org/archive/html/qemu-devel/2014-09/msg03543.html; http://lists.nongnu.org/archive/html/qemu-devel/2014-09/msg04598.html; http://lists.nongnu.org/archive/html/qemu-devel/2014-09/msg04707.html
CVE: CVE-2014-3693
Published: 2014-11-07
Description: Use-after-free vulnerability in the socket manager of Impress Remote in LibreOffice 4.x before 4.2.7 and 4.3.x before 4.3.3 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted request to TCP port 1599.
CVSS Score: 7.5 (HIGH)
References: http://lists.opensuse.org/opensuse-updates/2014-11/msg00049.html; http://rhn.redhat.com/errata/RHSA-2015-0377.html; http://secunia.com/advisories/62111
CVE: CVE-2014-5037
Published: 2014-11-07
Description: Eucalyptus 4.0.0 through 4.0.1, when the log level is set to INFO, logs user and system passwords, which allows local users to obtain sensitive information by reading cloud-requests.log.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://secunia.com/advisories/62055; https://www.eucalyptus.com/resources/security/advisories/esa-25; http://secunia.com/advisories/62055
CVE: CVE-2014-5038
Published: 2014-11-07
Description: Eucalyptus 3.0.0 through 4.0.1, when the log level is set to DEBUG or lower, logs user and system passwords, which allows local users to obtain sensitive information by reading the cloud log files.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: https://www.eucalyptus.com/resources/security/advisories/esa-26; https://www.eucalyptus.com/resources/security/advisories/esa-26
CVE: CVE-2014-6620
Published: 2014-11-07
Description: Cross-site scripting (XSS) vulnerability in Aruba Networks ClearPass before 6.3.6 and 6.4.x before 6.4.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/61916; http://www.arubanetworks.com/support/alerts/aid-10282014.txt; http://secunia.com/advisories/61916
CVE: CVE-2014-6623
Published: 2014-11-07
Description: Cross-site request forgery (CSRF) vulnerability in the Insight module in Aruba Networks ClearPass before 6.3.6 and 6.4.x before 6.4.1 allows remote attackers to hijack the authentication of a logged in user via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/61916; http://www.arubanetworks.com/support/alerts/aid-10282014.txt; http://secunia.com/advisories/61916
CVE: CVE-2014-8510
Published: 2014-11-07
Description: The AdminUI in Trend Micro InterScan Web Security Virtual Appliance (IWSVA) before 6.0 HF build 1244 allows remote authenticated users to read arbitrary files via vectors related to configuration input when saving filters.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-20
References: http://www.zerodayinitiative.com/advisories/ZDI-14-373/; http://www.zerodayinitiative.com/advisories/ZDI-14-373/
CVE: CVE-2014-8580
Published: 2014-11-07
Description: Citrix NetScaler Application Delivery Controller and NetScaler Gateway 10.5.50.10 before 10.5-52.11, 10.1.122.17 before 10.1-129.11, and 10.1-120.1316.e before 10.1-129.1105.e, when using unspecified configurations, allows remote authenticated users to access "network resources" of other users via unknown vectors.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/62114; http://support.citrix.com/article/CTX200254; http://www.securitytracker.com/id/1031212
CVE: CVE-2014-6097
Published: 2014-11-08
Description: IBM DB2 9.7 before FP10 and 9.8 through FP5 on Linux, UNIX, and Windows allows remote authenticated users to cause a denial of service (daemon crash) via a crafted ALTER TABLE statement.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-20
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IT03786; http://www-01.ibm.com/support/docview.wss?uid=swg1IT04034; http://www-01.ibm.com/support/docview.wss?uid=swg21684812
CVE: CVE-2014-6146
Published: 2014-11-08
Description: IBM Sterling B2B Integrator 5.2.x through 5.2.4, when the Connect:Direct Server Adapter is configured, does not properly process the logging configuration, which allows local users to obtain sensitive information by reading log files.
CVSS Score: 1.9 (LOW)
CWE: CWE-200
References: http://secunia.com/advisories/62190; http://www-01.ibm.com/support/docview.wss?uid=swg1IT04337; http://www-01.ibm.com/support/docview.wss?uid=swg21689082
CVE: CVE-2014-6159
Published: 2014-11-08
Description: IBM DB2 9.7 before FP10, 9.8 through FP5, 10.1 through FT4, and 10.5 through FP4 on Linux, UNIX, and Windows, when immediate AUTO_REVAL is enabled, allows remote authenticated users to cause a denial of service (daemon crash) via a crafted ALTER TABLE statement.
CVSS Score: 3.5 (LOW)
CWE: CWE-20
References: http://secunia.com/advisories/62092; http://secunia.com/advisories/62093; http://www-01.ibm.com/support/docview.wss?uid=swg1IT04730
CVE: CVE-2014-6161
Published: 2014-11-08
Description: Cross-site scripting (XSS) vulnerability in IBM Tivoli Netcool/Impact 6.1.1 before 6.1.1.1-TIV-NCI-IF0001 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://secunia.com/advisories/62168; http://www-01.ibm.com/support/docview.wss?uid=swg21689130; https://exchange.xforce.ibmcloud.com/vulnerabilities/97710
CVE: CVE-2014-6300
Published: 2014-11-08
Description: Cross-site scripting (XSS) vulnerability in the micro history implementation in phpMyAdmin 4.0.x before 4.0.10.3, 4.1.x before 4.1.14.4, and 4.2.x before 4.2.8.1 allows remote attackers to inject arbitrary web script or HTML, and consequently conduct a cross-site request forgery (CSRF) attack to create a root account, via a crafted URL, related to js/ajax.js.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-updates/2014-09/msg00032.html; http://www.phpmyadmin.net/home_page/security/PMASA-2014-10.php; http://www.securityfocus.com/bid/69790
CVE: CVE-2014-7818
Published: 2014-11-08
Description: Directory traversal vulnerability in actionpack/lib/action_dispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.20, 4.0.x before 4.0.11, 4.1.x before 4.1.7, and 4.2.x before 4.2.0.beta3, when serve_static_assets is enabled, allows remote attackers to determine the existence of files outside the application root via a /..%2F sequence.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: http://lists.opensuse.org/opensuse-updates/2014-11/msg00112.html; https://groups.google.com/forum/message/raw?msg=rubyonrails-security/dCp7duBiQgo/v_R_8PFs5IwJ; https://puppet.com/security/cve/cve-2014-7829
CVE: CVE-2014-7819
Published: 2014-11-08
Description: Multiple directory traversal vulnerabilities in server.rb in Sprockets before 2.0.5, 2.1.x before 2.1.4, 2.2.x before 2.2.3, 2.3.x before 2.3.3, 2.4.x before 2.4.6, 2.5.x before 2.5.1, 2.6.x and 2.7.x before 2.7.1, 2.8.x before 2.8.3, 2.9.x before 2.9.4, 2.10.x before 2.10.2, 2.11.x before 2.11.3, 2.12.x before 2.12.3, and 3.x before 3.0.0.beta.3, as distributed with Ruby on Rails 3.x and 4.x, allow remote attackers to determine the existence of files outside the application root via a ../ (dot dot slash) sequence with (1) double slashes or (2) URL encoding.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://lists.opensuse.org/opensuse-updates/2014-11/msg00103.html; http://lists.opensuse.org/opensuse-updates/2014-11/msg00105.html; http://lists.opensuse.org/opensuse-updates/2014-11/msg00110.html
CVE: CVE-2014-3610
Published: 2014-11-10
Description: The WRMSR processing functionality in the KVM subsystem in the Linux kernel through 3.17.2 does not properly handle the writing of a non-canonical address to a model-specific register, which allows guest OS users to cause a denial of service (host OS crash) by leveraging guest OS privileges, related to the wrmsr_interception function in arch/x86/kvm/svm.c and the handle_wrmsr function in arch/x86/kvm/vmx.c.
CVSS Score: 5.5 (MEDIUM)
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=854e8bb1aa06c578c2c9145fa6bfe3680ef63b23; http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00010.html; http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00025.html
CVE: CVE-2014-3611
Published: 2014-11-10
Description: Race condition in the __kvm_migrate_pit_timer function in arch/x86/kvm/i8254.c in the KVM subsystem in the Linux kernel through 3.17.2 allows guest OS users to cause a denial of service (host OS crash) by leveraging incorrect PIT emulation.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-362
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=2febc839133280d5a5e8e1179c94ea674489dae2; http://rhn.redhat.com/errata/RHSA-2015-0126.html; http://rhn.redhat.com/errata/RHSA-2015-0284.html
CVE: CVE-2014-3645
Published: 2014-11-10
Description: arch/x86/kvm/vmx.c in the KVM subsystem in the Linux kernel before 3.12 does not have an exit handler for the INVEPT instruction, which allows guest OS users to cause a denial of service (guest OS crash) via a crafted application.
CVSS Score: 2.1 (LOW)
CWE: CWE-20
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=bfd0a56b90005f8c8a004baf407ad90045c2b11e; http://rhn.redhat.com/errata/RHSA-2015-0126.html; http://rhn.redhat.com/errata/RHSA-2015-0284.html
CVE: CVE-2014-3646
Published: 2014-11-10
Description: arch/x86/kvm/vmx.c in the KVM subsystem in the Linux kernel through 3.17.2 does not have an exit handler for the INVVPID instruction, which allows guest OS users to cause a denial of service (guest OS crash) via a crafted application.
CVSS Score: 5.5 (MEDIUM)
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=a642fc305053cc1c6e47e4f4df327895747ab485; http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00010.html; http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00025.html
CVE: CVE-2014-3647
Published: 2014-11-10
Description: arch/x86/kvm/emulate.c in the KVM subsystem in the Linux kernel through 3.17.2 does not properly perform RIP changes, which allows guest OS users to cause a denial of service (guest OS crash) via a crafted application.
CVSS Score: 5.5 (MEDIUM)
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=234f3ce485d54017f15cf5e0699cff[PII_REDACTED]; http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=d1442d85cc30ea75f7d399474ca738e0bc96f715; http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00010.html
CVE: CVE-2014-3673
Published: 2014-11-10
Description: The SCTP implementation in the Linux kernel through 3.17.2 allows remote attackers to cause a denial of service (system crash) via a malformed ASCONF chunk, related to net/sctp/sm_make_chunk.c and net/sctp/sm_statefuns.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=9de7922bc709eee2f609cd01d98aaedc4cf5ea74; http://linux.oracle.com/errata/ELSA-2014-3087.html; http://linux.oracle.com/errata/ELSA-2014-3088.html
CVE: CVE-2014-3687
Published: 2014-11-10
Description: The sctp_assoc_lookup_asconf_ack function in net/sctp/associola.c in the SCTP implementation in the Linux kernel through 3.17.2 allows remote attackers to cause a denial of service (panic) via duplicate ASCONF chunks that trigger an incorrect uncork within the side-effect interpreter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=b69040d8e39f20d5215a03502a8e8b4c6ab78395; http://linux.oracle.com/errata/ELSA-2014-3087.html; http://linux.oracle.com/errata/ELSA-2014-3088.html
CVE: CVE-2014-3690
Published: 2014-11-10
Description: arch/x86/kvm/vmx.c in the KVM subsystem in the Linux kernel before 3.17.2 on Intel processors does not ensure that the value in the CR4 control register remains the same after a VM entry, which allows host OS users to kill arbitrary processes or cause a denial of service (system disruption) by leveraging /dev/kvm access, as demonstrated by PR_SET_TSC prctl calls within a modified copy of QEMU.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=d974baa398f34393db76be45f7d4d04fbdbb4a0a; http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00035.html; http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00010.html
CVE: CVE-2014-7207
Published: 2014-11-10
Description: A certain Debian patch to the IPv6 implementation in the Linux kernel 3.2.x through 3.2.63 does not properly validate arguments in ipv6_select_ident function calls, which allows local users to cause a denial of service (NULL pointer dereference and system crash) by leveraging (1) tun or (2) macvtap device access.
CVSS Score: 4.9 (MEDIUM)
References: http://www.debian.org/security/2014/dsa-3060; http://www.openwall.com/lists/oss-security/2014/11/02/1; http://www.securityfocus.com/bid/70867
CVE: CVE-2014-7825
Published: 2014-11-10
Description: kernel/trace/trace_syscalls.c in the Linux kernel through 3.17.2 does not properly handle private syscall numbers during use of the perf subsystem, which allows local users to cause a denial of service (out-of-bounds read and OOPS) or bypass the ASLR protection mechanism via a crafted application.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=086ba77a6db00ed858ff07451bedee197df868c9; http://rhn.redhat.com/errata/RHSA-2014-1943.html; http://rhn.redhat.com/errata/RHSA-2015-0290.html
CVE: CVE-2014-7826
Published: 2014-11-10
Description: kernel/trace/trace_syscalls.c in the Linux kernel through 3.17.2 does not properly handle private syscall numbers during use of the ftrace subsystem, which allows local users to gain privileges or cause a denial of service (invalid pointer dereference) via a crafted application.
CVSS Score: 7.8 (HIGH)
CWE: CWE-476
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=086ba77a6db00ed858ff07451bedee197df868c9; http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00010.html; http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00025.html
CVE: CVE-2014-8369
Published: 2014-11-10
Description: The kvm_iommu_map_pages function in virt/kvm/iommu.c in the Linux kernel through 3.17.2 miscalculates the number of pages during the handling of a mapping failure, which allows guest OS users to cause a denial of service (host OS page unpinning) or possibly have unspecified other impact by leveraging guest OS privileges.  NOTE: this vulnerability exists because of an incorrect fix for CVE-2014-3601.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=3d32e4dbe71374a6780eaf51d719d76f9a9bf22f; http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00010.html; http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00025.html
CVE: CVE-2014-8480
Published: 2014-11-10
Description: The instruction decoder in arch/x86/kvm/emulate.c in the KVM subsystem in the Linux kernel before 3.18-rc2 lacks intended decoder-table flags for certain RIP-relative instructions, which allows guest OS users to cause a denial of service (NULL pointer dereference and host OS crash) via a crafted application.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-399
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=3f6f1480d86bf9fc16c160d803ab1d006e3058d5; http://thread.gmane.org/gmane.comp.emulators.kvm.devel/128427; http://www.openwall.com/lists/oss-security/2014/10/23/7
CVE: CVE-2014-8481
Published: 2014-11-10
Description: The instruction decoder in arch/x86/kvm/emulate.c in the KVM subsystem in the Linux kernel before 3.18-rc2 does not properly handle invalid instructions, which allows guest OS users to cause a denial of service (NULL pointer dereference and host OS crash) via a crafted application that triggers (1) an improperly fetched instruction or (2) an instruction that occupies too many bytes.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-8480.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-399
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=a430c9166312e1aa3d80bce32374233bdbfeba32; http://secunia.com/advisories/62042; http://thread.gmane.org/gmane.comp.emulators.kvm.devel/128427
CVE: CVE-2014-8559
Published: 2014-11-10
Description: The d_walk function in fs/dcache.c in the Linux kernel through 3.17.2 does not properly maintain the semantics of rename_lock, which allows local users to cause a denial of service (deadlock and system hang) via a crafted application.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400
References: http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00035.html; http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00010.html; http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00020.html
CVE: CVE-2014-8652
Published: 2014-11-10
Description: Elipse E3 3.x and earlier allows remote attackers to cause a denial of service (application crash and plant outage) via a rapid series of HTTP requests to index.html on TCP port 1681.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-16
References: http://firebitsbr.wordpress.com/2014/07/16/vsla-security-advisory-fire-scada-dos-2013-001-http-dos-requests-flooding-crash-device-vulnerabilities-elipse-e3-scada-plc/; http://seclists.org/fulldisclosure/2014/Jul/69; http://firebitsbr.wordpress.com/2014/07/16/vsla-security-advisory-fire-scada-dos-2013-001-http-dos-requests-flooding-crash-device-vulnerabilities-elipse-e3-scada-plc/
CVE: CVE-2014-8709
Published: 2014-11-10
Description: The ieee80211_fragment function in net/mac80211/tx.c in the Linux kernel before 3.13.5 does not properly maintain a certain tail pointer, which allows remote attackers to obtain sensitive cleartext information by reading packets.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=338f977f4eb441e69bb9a46eaa0ac715c931a67f; http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00010.html; http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00025.html
CVE: CVE-2014-4076
Published: 2014-11-11
Description: Microsoft Windows Server 2003 SP2 allows local users to gain privileges via a crafted IOCTL call to (1) tcpip.sys or (2) tcpip6.sys, aka "TCP/IP Elevation of Privilege Vulnerability."
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://www.exploit-db.com/exploits/35936; http://www.osvdb.org/114532; http://www.securityfocus.com/bid/70976
CVE: CVE-2014-4077
Published: 2014-11-11
Description: Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, and Office 2007 SP3, when IMJPDCT.EXE (aka IME for Japanese) is installed, allow remote attackers to bypass a sandbox protection mechanism via a crafted PDF document, aka "Microsoft IME (Japanese) Elevation of Privilege Vulnerability," as exploited in the wild in 2014.
CVSS Score: 7.8 (HIGH)
References: http://blogs.technet.com/b/srd/archive/2014/11/11/assessing-risk-for-the-november-2014-security-updates.aspx; http://www.securitytracker.com/id/1031196; http://www.securitytracker.com/id/1031197
CVE: CVE-2014-4078
Published: 2014-11-11
Description: The IP Security feature in Microsoft Internet Information Services (IIS) 8.0 and 8.5 does not properly process wildcard allow and deny rules for domains within the "IP Address and Domain Restrictions" list, which makes it easier for remote attackers to bypass an intended rule set via an HTTP request, aka "IIS Security Feature Bypass Vulnerability."
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-264
References: http://www.securityfocus.com/bid/70937; http://www.securitytracker.com/id/1031194; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-076
CVE: CVE-2014-4116
Published: 2014-11-11
Description: Cross-site scripting (XSS) vulnerability in Microsoft SharePoint Foundation 2010 SP2 allows remote authenticated users to inject arbitrary web script or HTML via a modified list, aka "SharePoint Elevation of Privilege Vulnerability."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securitytracker.com/id/1031192; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-073; http://www.securitytracker.com/id/1031192
CVE: CVE-2014-4118
Published: 2014-11-11
Description: XML Core Services (aka MSXML) 3.0 in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code or cause a denial of service (system-state corruption) via crafted XML content, aka "MSXML Remote Code Execution Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://www.securitytracker.com/id/1031187; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-067; http://www.securitytracker.com/id/1031187
CVE: CVE-2014-4143
Published: 2014-11-11
Description: Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-6341.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://www.securitytracker.com/id/1031185; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-065; http://www.securitytracker.com/id/1031185
CVE: CVE-2014-4149
Published: 2014-11-11
Description: Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2 does not properly perform TypeFilterLevel checks, which allows remote attackers to execute arbitrary code via crafted data to a .NET Remoting endpoint, aka "TypeFilterLevel Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://blogs.technet.com/b/srd/archive/2014/11/11/ms14-072-net-remoting-elevation-of-privilege-vulnerability.aspx; http://www.securitytracker.com/id/1031188; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-072
CVE: CVE-2014-6317
Published: 2014-11-11
Description: Array index error in win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to cause a denial of service (reboot) via a crafted TrueType font, aka "Denial of Service in Windows Kernel Mode Driver Vulnerability."
CVSS Score: 7.1 (HIGH)
CWE: CWE-129
References: http://blogs.technet.com/b/srd/archive/2014/11/11/assessing-risk-for-the-november-2014-security-updates.aspx; http://www.securityfocus.com/bid/70949; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-079