deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2013-4099
Published: 2014-06-13
Description: Multiple unspecified vulnerabilities in OpenAL32.dll in JOAL 2.0-rc11, as used in JOGAMP, allow context-dependent attackers to execute arbitrary code via a crafted parameter to the (1) alAuxiliaryEffectSlotf1, (2) alBuffer3f1, (3) alBufferfv1, (4) alDeleteEffects1, (5) alEffectf1, (6) alEffectfv1, (7) alEffectiv1, (8) alEnable1, (9) alFilterfv1, (10) alFilteriv1, (11) alGenAuxiliaryEffectSlots1, (12) alGenEffects1, (13) alGenFilters1, (14) alGenSources1, (15) alGetAuxiliaryEffectSlotiv1, (16) alGetBuffer3f1, (17) alGetBuffer3i1, (18) alGetBufferf1, (19) alGetBufferiv1, (20) alGetDoublev1, (21) alGetEffectf1, (22) alGetEffectfv1, (23) alGetEffectiv1, (24) alGetEnumValue1, (25) alGetFilteri1, (26) alGetFilteriv1, (27) alGetFloat1, (28) alGetFloatv1, (29) alGetListener3f1, (30) alGetListener3i1, (31) alGetListenerf1, (32) alGetListeneri1, (33) alGetListeneriv1, (34) alGetProcAddress1, (35) alGetProcAddressStatic, (36) alGetSource3f1, (37) alGetSource3i1, (38) alGetSourcef1, (39) alGetSourcefv1, (40) alGetSourcei1, (41) alGetSourceiv1, (42) alGetString1java/lang/String;, (43) alIsAuxiliaryEffectSlot1, (44) alIsBuffer1, (45) alIsEffect1, (46) alIsExtensionPresent1, (47) alIsFilter1, (48) alListener3f1, (49) alListener3i1, (50) alListenerf1, (51) alListenerfv1, (52) alListeneri1, (53) alListeneriv1, (54) alSource3f1, (55) alSource3i1, (56) alSourcef1, (57) alSourcefv1, (58) alSourcei1, (59) alSourceiv1, (60) alSourcePause1, (61) alSourcePausev1, (62) alSourcePlay1, (63) alSourcePlayv1, (64) alSourceQueueBuffers1, (65) alSourceRewindv1, (66) alSourceStop1, (67) alSourceStopv1, (68) alSourceUnqueueBuffers1, or (69) alSpeedOfSound1 method in jogamp.openal.ALImpl.dispatch.
CVSS Score: 10.0 (HIGH)
References: http://labb.zafena.se/?p=799; http://osvdb.org/96582; http://www.fuzzmyapp.com/advisories/FMA-2012-038/FMA-2012-038-EN.xml
CVE: CVE-2013-5352
Published: 2014-06-13
Description: Sharetronix 3.1.1.3, 3.1.1, and earlier allows remote attackers to execute arbitrary PHP code via the (1) activities_text parameter to services/activities/set or (2) comments_text parameter to services/comments/set, which is not properly handled when executing the preg_replace function with the e modifier.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://osvdb.org/100605; http://secunia.com/advisories/53936; http://secunia.com/secunia_research/2013-8/
CVE: CVE-2013-5353
Published: 2014-06-13
Description: Unrestricted file upload vulnerability in system/controllers/ajax/attachments.php in Sharetronix 3.1.1.3, 3.1.1, and earlier allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in an unspecified directory.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/100604; http://secunia.com/advisories/53936; http://secunia.com/secunia_research/2013-9/
CVE: CVE-2013-5356
Published: 2014-06-13
Description: Sharetronix 3.1.1.3, 3.1.1, and earlier does not properly restrict access to unspecified AJAX functionality, which allows remote attackers to bypass authentication via unknown vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://osvdb.org/100607; http://secunia.com/advisories/53936; http://secunia.com/secunia_research/2013-12/
CVE: CVE-2014-2303
Published: 2014-06-13
Description: Multiple SQL injection vulnerabilities in the file browser component (we_fs.php) in webEdition CMS before 6.2.7-s1.2 and 6.3.x through 6.3.8 before -s1 allow remote attackers to execute arbitrary SQL commands via the (1) table or (2) order parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/126862/webEdition-CMS-6.3.8.0-svn6985-SQL-Injection.html; http://seclists.org/fulldisclosure/2014/May/148; http://www.securityfocus.com/archive/1/532231/100/0/threaded
CVE: CVE-2014-3804
Published: 2014-06-13
Description: The av-centerd SOAP service in AlienVault OSSIM before 4.7.0 allows remote attackers to execute arbitrary commands via a crafted (1) update_system_info_debian_package, (2) ossec_task, (3) set_ossim_setup admin_ip, (4) sync_rserver, or (5) set_ossim_setup framework_ip request, a different vulnerability than CVE-2014-3805.
CVSS Score: 10.0 (HIGH)
CWE: CWE-94
References: http://forums.alienvault.com/discussion/2690; http://zerodayinitiative.com/advisories/ZDI-14-196/; http://zerodayinitiative.com/advisories/ZDI-14-197/
CVE: CVE-2014-3805
Published: 2014-06-13
Description: The av-centerd SOAP service in AlienVault OSSIM before 4.7.0 allows remote attackers to execute arbitrary commands via a crafted (1) get_license, (2) get_log_line, or (3) update_system/upgrade_pro_web request, a different vulnerability than CVE-2014-3804.
CVSS Score: 10.0 (HIGH)
CWE: CWE-94
References: http://forums.alienvault.com/discussion/2690; http://zerodayinitiative.com/advisories/ZDI-14-198/; http://zerodayinitiative.com/advisories/ZDI-14-199/
CVE: CVE-2014-3812
Published: 2014-06-13
Description: The Juniper Junos Pulse Secure Access Service (SSL VPN) devices with IVE OS before 7.4r5 and 8.x before 8.0r1 and Junos Pulse Access Control Service (UAC) before 4.4r5 and 5.x before 5.0r1 enable cipher suites with weak encryption algorithms, which make it easier for remote attackers to obtain sensitive information by sniffing the network.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10628; http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10628
CVE: CVE-2014-3813
Published: 2014-06-13
Description: Unspecified vulnerability in the Juniper Networks NetScreen Firewall products with ScreenOS before 6.3r17, when configured to use the internal DNS lookup client, allows remote attackers to cause a denial of service (crash and reboot) via vectors related to a DNS lookup.
CVSS Score: 7.8 (HIGH)
References: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10631; http://secunia.com/advisories/59026; http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10631
CVE: CVE-2014-3814
Published: 2014-06-13
Description: The Juniper Networks NetScreen Firewall devices with ScreenOS before 6.3r17, when configured to use the internal DNS lookup client, allows remote attackers to cause a denial of service (crash and reboot) via a sequence of malformed packets to the device IP.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10632; http://secunia.com/advisories/59026; http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10632
CVE: CVE-2014-4158
Published: 2014-06-13
Description: Stack-based buffer overflow in Kolibri 2.0 allows remote attackers to execute arbitrary code via a long URI in a GET request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://osvdb.org/show/osvdb/108090; http://osvdb.org/show/osvdb/70808; http://packetstormsecurity.com/files/126332/Kolibri-2.0-Stack-Buffer-Overflow.html
CVE: CVE-2014-4159
Published: 2014-06-13
Description: Open redirect vulnerability in in la/umTestSSO.jsp in SAP Supplier  Relationship Management (SRM) allows remote attackers to redirect  users to arbitrary web sites and conduct phishing attacks via a URL in the url parameter.
CVSS Score: 5.8 (MEDIUM)
References: http://blog.emaze.net/2014/05/sap-multiple-vulnerabilities.html; http://scn.sap.com/docs/DOC-8218; http://www.securityfocus.com/bid/67997
CVE: CVE-2014-4160
Published: 2014-06-13
Description: Multiple cross-site scripting (XSS) vulnerabilities in the testcanvas node in SAP NetWeaver Business Client (NWBC) allow remote attackers to inject arbitrary web script or HTML via the (1) title or (2) sap-accessibility parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://blog.emaze.net/2014/05/sap-multiple-vulnerabilities.html; http://scn.sap.com/docs/DOC-8218; http://www.securityfocus.com/bid/67995
CVE: CVE-2014-4161
Published: 2014-06-13
Description: Cross-site scripting (XSS) vulnerability in la/umTestSSO.jsp in SAP Supplier Relationship Management (SRM) allows remote attackers to inject arbitrary web script or HTML via the url parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://blog.emaze.net/2014/05/sap-multiple-vulnerabilities.html; http://scn.sap.com/docs/DOC-8218; http://secunia.com/advisories/58889
CVE: CVE-2014-3295
Published: 2014-06-14
Description: The HSRP implementation in Cisco NX-OS 6.2(2a) and earlier allows remote attackers to bypass authentication and cause a denial of service (group-member state modification and traffic blackholing) via malformed HSRP packets, aka Bug ID CSCup11309.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-287
References: http://secunia.com/advisories/59158; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3295; http://tools.cisco.com/security/center/viewAlert.x?alertId=34585
CVE: CVE-2014-0186
Published: 2014-06-14
Description: A certain tomcat7 package for Apache Tomcat 7 in Red Hat Enterprise Linux (RHEL) 7 allows remote attackers to cause a denial of service (CPU consumption) via a crafted request.  NOTE: this vulnerability exists because of an unspecified regression.
CVSS Score: 5.0 (MEDIUM)
References: http://www.osvdb.org/108060; https://bugzilla.redhat.com/show_bug.cgi?id=1089884; https://rhn.redhat.com/errata/RHSA-2014-0686.html
CVE: CVE-2014-0960
Published: 2014-06-14
Description: IBM PureApplication System 1.0 before 1.0.0.4 cfix8 and 1.1 before 1.1.0.4 IF1 allows remote authenticated users to bypass intended access restrictions by establishing an SSH session from a deployed virtual machine.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/59254; http://www-01.ibm.com/support/docview.wss?uid=swg21675216; https://exchange.xforce.ibmcloud.com/vulnerabilities/92743
CVE: CVE-2014-2002
Published: 2014-06-14
Description: Cross-site scripting (XSS) vulnerability in C-BOARD Moyuku 1.01b6 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN58029817/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2014-000051; http://jvn.jp/en/jp/JVN58029817/index.html
CVE: CVE-2014-2176
Published: 2014-06-14
Description: Cisco IOS XR 4.1.2 through 5.1.1 on ASR 9000 devices, when a Trident-based line card is used, allows remote attackers to cause a denial of service (NP chip and line card reload) via malformed IPv6 packets, aka Bug ID CSCun71928.
CVSS Score: 7.1 (HIGH)
CWE: CWE-399
References: http://secunia.com/advisories/58722; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140611-ipv6; http://www.securityfocus.com/bid/68005
CVE: CVE-2014-3290
Published: 2014-06-14
Description: The mDNS implementation in Cisco IOS XE 3.12S does not properly interact with autonomic networking, which allows remote attackers to obtain sensitive networking-services information by sniffing the network or overwrite networking-services data via a crafted mDNS response, aka Bug ID CSCun64867.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/58715; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3290; http://tools.cisco.com/security/center/viewAlert.x?alertId=34613
CVE: CVE-2014-2003
Published: 2014-06-16
Description: JustSystems JUST Online Update, as used in Ichitaro through 2014 and other products, does not properly validate signatures of update modules, which allows remote attackers to spoof modules and execute arbitrary code via a crafted signature.
CVSS Score: 7.6 (HIGH)
CWE: CWE-20
References: http://jvn.jp/en/jp/JVN50129191/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2014-000053; http://www.ipa.go.jp/security/ciadr/vul/20140611-jvn.html
CVE: CVE-2014-2004
Published: 2014-06-16
Description: The PPP Access Concentrator (PPPAC) on SEIL SEIL/x86 routers 1.00 through 3.10, SEIL/X1 routers 1.00 through 4.50, SEIL/X2 routers 1.00 through 4.50, SEIL/B1 routers 1.00 through 4.50, SEIL/Turbo routers 1.80 through 2.17, and SEIL/neu 2FE Plus routers 1.80 through 2.17 allows remote attackers to cause a denial of service (session termination or concentrator outage) via a crafted TCP packet.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://jvn.jp/en/jp/JVN10724763/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2014-000055; http://www.seil.jp/support/security/a01443.html
CVE: CVE-2010-5111
Published: 2014-06-16
Description: Multiple buffer overflows in readline.c in Echoping 6.0.2 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted reply in the (1) TLS_readline or (2) SSL_readline function, related to the EchoPingHttps Smokeping probe.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://security.gentoo.org/glsa/glsa-201406-07.xml; http://sourceforge.net/p/echoping/bugs/55; http://www.openwall.com/lists/oss-security/2013/10/17/1
CVE: CVE-2014-3428
Published: 2014-06-16
Description: Cross-site scripting (XSS) vulnerability in Yealink VoIP Phones with firmware 28.72.0.2 allows remote attackers to inject arbitrary web script or HTML via the model parameter to servlet.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/127081/Yealink-VoIP-Phones-XSS-CRLF-Injection.html; http://seclists.org/fulldisclosure/2014/Jun/74; http://www.securityfocus.com/archive/1/532410/100/0/threaded
CVE: CVE-2014-3994
Published: 2014-06-16
Description: Cross-site scripting (XSS) vulnerability in util/templatetags/djblets_js.py in Djblets before 0.7.30 and 0.8.x before 0.8.3 for Django, as used in Review Board, allows remote attackers to inject arbitrary web script or HTML via a JSON object, as demonstrated by the name field when changing a user name.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/oss-sec/2014/q2/494; http://seclists.org/oss-sec/2014/q2/498; http://secunia.com/advisories/58691
CVE: CVE-2014-3995
Published: 2014-06-16
Description: Cross-site scripting (XSS) vulnerability in gravatars/templatetags/gravatars.py in Djblets before 0.7.30 and 0.8.x before 0.8.3 for Django allows remote attackers to inject arbitrary web script or HTML via a user display name.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/oss-sec/2014/q2/494; http://seclists.org/oss-sec/2014/q2/498; http://secunia.com/advisories/58691
CVE: CVE-2014-4162
Published: 2014-06-16
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the Zyxel P-660HW-T1 (v3) wireless router allow remote attackers to hijack the authentication of administrators for requests that change the (1) wifi password or (2) SSID via a request to Forms/WLAN_General_1.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://osvdb.org/show/osvdb/107449; http://packetstormsecurity.com/files/126812/Zyxel-P-660HW-T1-Cross-Site-Request-Forgery.html; http://secunia.com/advisories/58513
CVE: CVE-2014-4163
Published: 2014-06-16
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the Featured Comments plugin 1.2.1 for WordPress allow remote attackers to hijack the authentication of administrators for requests that change the (1) buried or (2) featured status of a comment via a request to wp-admin/admin-ajax.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://seclists.org/fulldisclosure/2014/Jun/62; http://seclists.org/fulldisclosure/2014/Jun/62
CVE: CVE-2014-4164
Published: 2014-06-16
Description: Cross-site scripting (XSS) vulnerability in AlgoSec FireFlow 6.3-b230 allows remote attackers to inject arbitrary web script or HTML via a user signature to SelfService/Prefs.html.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/127001/AlogoSec-FireFlow-6.3-Cross-Site-Scripting.html; http://packetstormsecurity.com/files/127001/AlogoSec-FireFlow-6.3-Cross-Site-Scripting.html
CVE: CVE-2014-4165
Published: 2014-06-16
Description: Cross-site scripting (XSS) vulnerability in ntop allows remote attackers to inject arbitrary web script or HTML via the title parameter in a list action to plugins/rrdPlugin.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://advisories.mageia.org/MGASA-2015-0168.html; http://lists.opensuse.org/opensuse-updates/2015-04/msg00029.html; http://packetstormsecurity.com/files/127043/ntop-xss.txt
CVE: CVE-2014-4166
Published: 2014-06-16
Description: Cross-site scripting (XSS) vulnerability in the song history in SHOUTcast DNAS 2.2.1 allows remote attackers to inject arbitrary web script or HTML via the mp3 title field.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/show/osvdb/108052; http://packetstormsecurity.com/files/127074/SHOUTcast-DNAS-2.2.1-Cross-Site-Scripting.html; http://www.exploit-db.com/exploits/33714
CVE: CVE-2013-7072
Published: 2014-06-16
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not a unique security issue, and some vulnerability databases had associated inapplicable details with this ID.  Notes: none
CVE: CVE-2014-0478
Published: 2014-06-17
Description: APT before 1.0.4 does not properly validate source packages, which allows man-in-the-middle attackers to download and install Trojan horse packages by removing the Release signature.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/58843; http://secunia.com/advisories/59358; http://www.debian.org/security/2014/dsa-2958
CVE: CVE-2014-3249
Published: 2014-06-17
Description: Puppet Enterprise 2.8.x before 2.8.7 allows remote attackers to obtain sensitive information via vectors involving hiding and unhiding nodes.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://puppetlabs.com/security/cve/cve-2014-3249; http://secunia.com/advisories/59197; http://puppetlabs.com/security/cve/cve-2014-3249
CVE: CVE-2014-3476
Published: 2014-06-17
Description: OpenStack Identity (Keystone) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 does not properly handle chained delegation, which allows remote authenticated users to gain privileges by leveraging a (1) trust or (2) OAuth token with impersonation enabled to create a new token with additional roles.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-269
References: http://lists.opensuse.org/opensuse-security-announce/2014-06/msg00031.html; http://secunia.com/advisories/57886; http://secunia.com/advisories/59547
CVE: CVE-2014-4044
Published: 2014-06-17
Description: OpenAFS 1.6.8 does not properly clear the fields in the host structure, which allows remote attackers to cause a denial of service (uninitialized memory access and crash) via unspecified vectors related to TMAY requests.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://gerrit.openafs.org/#change%2C11283; http://www.openwall.com/lists/oss-security/2014/06/12/1; http://www.openwall.com/lists/oss-security/2014/06/13/3
CVE: CVE-2014-4045
Published: 2014-06-17
Description: The Publish/Subscribe Framework in the PJSIP channel driver in Asterisk Open Source 12.x before 12.3.1, when sub_min_expiry is set to zero, allows remote attackers to cause a denial of service (assertion failure and crash) via an unsubscribe request when not subscribed to the device.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-189
References: http://downloads.asterisk.org/pub/security/AST-2014-005.html; http://packetstormsecurity.com/files/127087/Asterisk-Project-Security-Advisory-AST-2014-005.html; http://www.securityfocus.com/archive/1/532414/100/0/threaded
CVE: CVE-2014-4046
Published: 2014-06-17
Description: Asterisk Open Source 11.x before 11.10.1 and 12.x before 12.3.1 and Certified Asterisk 11.6 before 11.6-cert3 allows remote authenticated Manager users to execute arbitrary shell commands via a MixMonitor action.
CVSS Score: 6.5 (MEDIUM)
References: http://downloads.asterisk.org/pub/security/AST-2014-006.html; http://packetstormsecurity.com/files/127088/Asterisk-Project-Security-Advisory-AST-2014-006.html; http://www.securityfocus.com/archive/1/532419/100/0/threaded
CVE: CVE-2014-4047
Published: 2014-06-17
Description: Asterisk Open Source 1.8.x before 1.8.28.1, 11.x before 11.10.1, and 12.x before 12.3.1 and Certified Asterisk 1.8.15 before 1.8.15-cert6 and 11.6 before 11.6-cert3 allows remote attackers to cause a denial of service (connection consumption) via a large number of (1) inactive or (2) incomplete HTTP connections.
CVSS Score: 5.0 (MEDIUM)
References: http://downloads.asterisk.org/pub/security/AST-2014-007.html; http://packetstormsecurity.com/files/127089/Asterisk-Project-Security-Advisory-AST-2014-007.html; http://www.securityfocus.com/archive/1/532415/100/0/threaded
CVE: CVE-2014-4048
Published: 2014-06-17
Description: The PJSIP Channel Driver in Asterisk Open Source before 12.3.1 allows remote attackers to cause a denial of service (deadlock) by terminating a subscription request before it is complete, which triggers a SIP transaction timeout.
CVSS Score: 4.3 (MEDIUM)
References: http://downloads.asterisk.org/pub/security/AST-2014-008.html; http://packetstormsecurity.com/files/127090/Asterisk-Project-Security-Advisory-AST-2014-008.html; http://www.securityfocus.com/archive/1/532416/100/0/threaded
CVE: CVE-2014-4187
Published: 2014-06-17
Description: Cross-site scripting (XSS) vulnerability in signup.php in ClipBucket allows remote attackers to inject arbitrary web script or HTML via the Username field.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/127098/ClipBucket-CMS-Cross-Site-Scripting.html; http://www.securityfocus.com/archive/1/532432/100/0/threaded; http://packetstormsecurity.com/files/127098/ClipBucket-CMS-Cross-Site-Scripting.html
CVE: CVE-2014-4188
Published: 2014-06-17
Description: Cross-site request forgery (CSRF) vulnerability in Hitachi Tuning Manager before 7.6.1-06 and 8.x before 8.0.0-04 and JP1/Performance Management - Manager Web Option 07-00 through 07-54 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://secunia.com/advisories/58528; http://secunia.com/advisories/58899; http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS14-013/index.html
CVE: CVE-2014-4189
Published: 2014-06-17
Description: Cross-site scripting (XSS) vulnerability in Hitachi Tuning Manager before 7.6.1-06 and 8.x before 8.0.0-04 and JP1/Performance Management - Manager Web Option 07-00 through 07-54 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/58528; http://secunia.com/advisories/58899; http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS14-013/index.html
CVE: CVE-2014-4190
Published: 2014-06-17
Description: Multiple heap-based buffer overflows in Huawei Campus Series Switches S3700HI, S5700, S6700, S3300HI, S5300, S6300, S9300, S7700, and LSW S9700 with software V200R001 before V200R001SPH013; S5700, S6700, S5300, and S6300 with software V200R002 before V200R002SPH005; S7700, S9300, S9300E, S5300, S5700, S6300, S6700, S2350, S2750, and LSW S9700 with software V200R003 before V200R003SPH005; and S7700, S9300, S9300E, and LSW S9700 with software V200R005 before V200R005C00SPC300 allow remote attackers to cause a denial of service (device restart) via a crafted length field in a packet.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-343218.htm; http://www.securityfocus.com/bid/67907; http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-343218.htm