deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-6887
Published: 2014-10-11
Description: The EXPRESS (aka com.gpshopper.express.android) application 2.5.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/582497; http://www.kb.cert.org/vuls/id/898329; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-6891
Published: 2014-10-11
Description: The Vodafone Avantaj Cepte (aka com.vodafone.avantajcepte.main) application 1.4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/582497; http://www.kb.cert.org/vuls/id/589977; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-6904
Published: 2014-10-11
Description: The Safe Browser - The Web Filter (aka com.cloudacl) application 1.2.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/479537; http://www.kb.cert.org/vuls/id/582497; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-6934
Published: 2014-10-11
Description: The Physics Chemistry Biology Quiz (aka com.pdevsmcqs.pcbmcqseries) application 1.8 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/398577; http://www.kb.cert.org/vuls/id/582497; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-6935
Published: 2014-10-11
Description: The ColorMania - Color Quiz Game (aka com.ColormaniaColoringGames) application 1.4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/582497; http://www.kb.cert.org/vuls/id/768793; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-6936
Published: 2014-10-11
Description: The IDS 2013 (aka de.mobileeventguide.ids2013) application 1.21 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/112753; http://www.kb.cert.org/vuls/id/582497; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-6937
Published: 2014-10-11
Description: The China CITIC Bank Credit Card (aka com.citiccard.mobilebank) application 3.3.6 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/582497; http://www.kb.cert.org/vuls/id/907041; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-6938
Published: 2014-10-11
Description: The Apostilas musicais (aka com.apostilas) application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/242289; http://www.kb.cert.org/vuls/id/582497; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-6939
Published: 2014-10-11
Description: The Sketch W Friends FREE -Tablets (aka air.com.xlabz.SketchWFriendsFree) application 5.0.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/556625; http://www.kb.cert.org/vuls/id/582497; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-6940
Published: 2014-10-11
Description: The Absolute Lending Solutions (aka com.soln.S008F6C05EC0B63264B429F6D76286562) application 1.0073.b0073 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/253289; http://www.kb.cert.org/vuls/id/582497; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-6941
Published: 2014-10-11
Description: The NOS Alive (aka pt.optimus.optimusalive2011) application 5.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/220641; http://www.kb.cert.org/vuls/id/582497; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-5327
Published: 2014-10-12
Description: Buffer overflow in the Webserver component on the Huawei E5332 router before 21.344.27.00.1080 allows remote authenticated users to cause a denial of service (reboot) via a long URI.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-399
References: http://jvn.jp/en/jp/JVN58417930/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2014-000120; http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-373056.htm
CVE: CVE-2014-5328
Published: 2014-10-12
Description: Buffer overflow in the Webserver component on the Huawei E5332 router before 21.344.27.00.1080 allows remote authenticated users to cause a denial of service (reboot) via a long parameter in an API service request message.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-399
References: http://jvn.jp/en/jp/JVN63587560/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2014-000119; http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-373056.htm
CVE: CVE-2014-1571
Published: 2014-10-13
Description: Bugzilla 2.x through 4.0.x before 4.0.15, 4.1.x and 4.2.x before 4.2.11, 4.3.x and 4.4.x before 4.4.6, and 4.5.x before 4.5.6 allows remote authenticated users to obtain sensitive private-comment information by leveraging a role as a flag recipient, related to Bug.pm, Flag.pm, and a mail template.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://advisories.mageia.org/MGASA-2014-0412.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-November/142524.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-October/141309.html
CVE: CVE-2014-1572
Published: 2014-10-13
Description: The confirm_create_account function in the account-creation feature in token.cgi in Bugzilla 2.x through 4.0.x before 4.0.15, 4.1.x and 4.2.x before 4.2.11, 4.3.x and 4.4.x before 4.4.6, and 4.5.x before 4.5.6 does not specify a scalar context for the realname parameter, which allows remote attackers to create accounts with unverified e-mail addresses by sending three realname values with realname=login_name as the second, as demonstrated by selecting an e-mail address with a domain name for which group privileges are automatically granted.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://advisories.mageia.org/MGASA-2014-0412.html; http://blog.gerv.net/2014/10/new-class-of-vulnerability-in-perl-web-applications/; http://lists.fedoraproject.org/pipermail/package-announce/2014-November/142524.html
CVE: CVE-2014-1573
Published: 2014-10-13
Description: Bugzilla 2.x through 4.0.x before 4.0.15, 4.1.x and 4.2.x before 4.2.11, 4.3.x and 4.4.x before 4.4.6, and 4.5.x before 4.5.6 does not ensure that a scalar context is used for certain CGI parameters, which allows remote attackers to conduct cross-site scripting (XSS) attacks by sending three values for a single parameter name.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://advisories.mageia.org/MGASA-2014-0412.html; http://blog.gerv.net/2014/10/new-class-of-vulnerability-in-perl-web-applications/; http://lists.fedoraproject.org/pipermail/package-announce/2014-November/142524.html
CVE: CVE-2014-3091
Published: 2014-10-13
Description: Cross-site scripting (XSS) vulnerability in IBM Security QRadar SIEM 7.1.x and 7.2.x allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21686480; http://www.securityfocus.com/bid/70379; https://exchange.xforce.ibmcloud.com/vulnerabilities/94257
CVE: CVE-2014-7283
Published: 2014-10-13
Description: The xfs_da3_fixhashpath function in fs/xfs/xfs_da_btree.c in the xfs implementation in the Linux kernel before 3.14.2 does not properly compare btree hash values, which allows local users to cause a denial of service (filesystem corruption, and OOPS or panic) via operations on directories that have hash collisions, as demonstrated by rmdir operations.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-399
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=c88547a8119e3b581318ab65e9b72f27f23e641d; http://marc.info/?l=linux-xfs&m=[PII_REDACTED]2926&w=2; http://rhn.redhat.com/errata/RHSA-2014-1943.html
CVE: CVE-2014-7284
Published: 2014-10-13
Description: The net_get_random_once implementation in net/core/utils.c in the Linux kernel 3.13.x and 3.14.x before 3.14.5 on certain Intel processors does not perform the intended slow-path operation to initialize random seeds, which makes it easier for remote attackers to spoof or disrupt IP communication by leveraging the predictability of TCP sequence numbers, TCP and UDP port numbers, and IP ID values.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-200
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=3d4405226d27b3a215e4d03cfa51f536244e5de7; http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.5; http://www.openwall.com/lists/oss-security/2014/10/01/19
CVE: CVE-2014-7297
Published: 2014-10-13
Description: Unspecified vulnerability in the folder framework in the Enfold theme before 3.0.1 for WordPress has unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://themeforest.net/item/enfold-responsive-multipurpose-theme/4519990; https://wpvulndb.com/vulnerabilities/9809; http://themeforest.net/item/enfold-responsive-multipurpose-theme/4519990
CVE: CVE-2014-7970
Published: 2014-10-13
Description: The pivot_root implementation in fs/namespace.c in the Linux kernel through 3.17 does not properly interact with certain locations of a chroot directory, which allows local users to cause a denial of service (mount-tree loop) via . (dot) values in both arguments to the pivot_root system call.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400
References: http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00015.html; http://secunia.com/advisories/60174; http://secunia.com/advisories/61142
CVE: CVE-2014-7975
Published: 2014-10-13
Description: The do_umount function in fs/namespace.c in the Linux kernel through 3.17 does not require the CAP_SYS_ADMIN capability for do_remount_sb calls that change the root filesystem to read-only, which allows local users to cause a denial of service (loss of writability) by making certain unshare system calls, clearing the / MNT_LOCKED flag, and making an MNT_FORCE umount system call.
CVSS Score: 5.5 (MEDIUM)
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=0ef3a56b1c466629cd0bf482b09c7b0e5a085bb5; http://secunia.com/advisories/60174; http://secunia.com/advisories/61145
CVE: CVE-2014-8086
Published: 2014-10-13
Description: Race condition in the ext4_file_write_iter function in fs/ext4/file.c in the Linux kernel through 3.17 allows local users to cause a denial of service (file unavailability) via a combination of a write action and an F_SETFL fcntl operation for the O_DIRECT flag.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-362
References: http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00004.html; http://rhn.redhat.com/errata/RHSA-2015-0290.html; http://rhn.redhat.com/errata/RHSA-2015-0694.html
CVE: CVE-2014-3671
Published: 2014-10-13
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2014-6271, CVE-2014-6277, CVE-2014-6278, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187.  Reason: This candidate is a duplicate of CVE-2014-6271, CVE-2014-6277, CVE-2014-6278, CVE-2014-7169, CVE-2014-7186, and CVE-2014-7187.  Notes: All CVE users should reference CVE-2014-6271, CVE-2014-6277, CVE-2014-6278, CVE-2014-7169, CVE-2014-7186, and CVE-2014-7187 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2014-6388
Published: 2014-10-13
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2014-3634.  Reason: This candidate is a reservation duplicate of CVE-2014-3634.  Notes: All CVE users should reference CVE-2014-3634 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2014-6915
Published: 2014-10-13
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2014-7046, CVE-2014-7047.  Reason: this ID was intended for one issue, but was assigned to two issues by a CNA.  Notes: All CVE users should consult CVE-2014-7046 and CVE-2014-7047 to determine which ID is appropriate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2014-8743
Published: 2014-10-13
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Maestro module 7.x-1.x before 7.x-1.4 for Drupal allow remote authenticated users with certain permissions to inject arbitrary web script or HTML via a (1) Role or (2) Organic Group name.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://secunia.com/advisories/56790; http://www.securityfocus.com/bid/65677; https://drupal.org/node/2200453
CVE: CVE-2014-8744
Published: 2014-10-13
Description: Cross-site scripting (XSS) vulnerability in the Nivo Slider module 7.x-2.x before 7.x-1.11 for Drupal allows remote authenticated users with the "administer nivo slider" permission to inject arbitrary web script or HTML via an image title.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://secunia.com/advisories/57459; http://www.securityfocus.com/bid/66327; https://exchange.xforce.ibmcloud.com/vulnerabilities/92009
CVE: CVE-2014-8745
Published: 2014-10-13
Description: Cross-site scripting (XSS) vulnerability in the Custom Search module 6.x-1.x before 6.x-1.13 and 7.x-1.x before 7.x-1.15 for Drupal allows remote authenticated users with the "administer taxonomy" permission to inject arbitrary web script or HTML via a taxonomy vocabulary label.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://drupal.org/node/2248077; http://secunia.com/advisories/58209; http://www.securityfocus.com/bid/67062
CVE: CVE-2014-8746
Published: 2014-10-13
Description: Cross-site scripting (XSS) vulnerability in the Skeleton theme 7.x-1.2 through 7.x-1.3 before 7.x-1.4, for Drupal allows remote authenticated users with the "administer themes" permission to inject arbitrary web script or HTML via vectors related to theme settings.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://secunia.com/advisories/57831; https://exchange.xforce.ibmcloud.com/vulnerabilities/92529; https://www.drupal.org/node/2236259
CVE: CVE-2014-8747
Published: 2014-10-13
Description: Cross-site scripting (XSS) vulnerability in the Drupal Commons module 7.x-3.x before 7.x-3.9 for Drupal allows remote attackers to inject arbitrary web script or HTML via vectors related to content creation and activity stream messages.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/103288; http://secunia.com/advisories/56861; http://www.securityfocus.com/bid/65524
CVE: CVE-2014-8748
Published: 2014-10-13
Description: Cross-site scripting (XSS) vulnerability in the Google Doubleclick for Publishers (DFP) module 7.x-1.x before 7.x-1.2 for Drupal allows remote authenticated users with the "administer dfp" permission to inject arbitrary web script or HTML via a slot name.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://osvdb.org/102354; http://secunia.com/advisories/56521; https://drupal.org/node/2179085
CVE: CVE-2014-3818
Published: 2014-10-14
Description: Juniper Junos OS 9.1 through 11.4 before 11.4R11, 12.1 before R10, 12.1X44 before D40, 12.1X46 before D30, 12.1X47 before D11 and 12.147-D15, 12.1X48 before D41 and D62, 12.2 before R8, 12.2X50 before D70, 12.3 before R6, 13.1 before R4-S2, 13.1X49 before D49, 13.1X50 before 30, 13.2 before R4, 13.2X50 before D20, 13.2X51 before D25, 13.2X52 before D15, 13.3 before R2, and 14.1 before R1, when supporting 4-byte AS numbers and a BGP peer does not, allows remote attackers to cause a denial of service (memory corruption and RDP routing process crash and restart) via crafted transitive attributes in a BGP UPDATE.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securitytracker.com/id/1031009; https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10653; http://www.securitytracker.com/id/1031009
CVE: CVE-2014-3825
Published: 2014-10-14
Description: The Juniper SRX Series devices with Junos 11.4 before 11.4R12-S4, 12.1X44 before 12.1X44-D40, 12.1X45 before 12.1X45-D30, 12.1X46 before 12.1X46-D25, and 12.1X47 before 12.1X47-D10, when an Application Layer Gateway (ALG) is enabled, allows remote attackers to cause a denial of service (flowd crash) via a crafted packet.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://www.securitytracker.com/id/1031007; https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10650; http://www.securitytracker.com/id/1031007
CVE: CVE-2014-6313
Published: 2014-10-14
Description: Cross-site scripting (XSS) vulnerability in the WooCommerce plugin before 2.2.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the range parameter on the wc-reports page to wp-admin/admin.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2014/Sep/59; http://secunia.com/advisories/61377; https://security.dxw.com/advisories/reflected-xss-in-woocommerce-excelling-ecommerce-allows-attackers-ability-to-do-almost-anything-an-admin-user-can-do
CVE: CVE-2014-6377
Published: 2014-10-14
Description: Juniper JunosE before 13.3.3p0-1, 14.x before 14.3.2, and 15.x before 15.1.0, when DEBUG severity icmpTraffic logging is enabled, allows remote attackers to cause a denial of service (SRP reset) via a crafted ICMP packet to the (1) interface or (2) loopback IP address, which triggers a processor exception in ip_RxData_8.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://www.securityfocus.com/bid/70368; http://www.securitytracker.com/id/1031006; https://exchange.xforce.ibmcloud.com/vulnerabilities/96907
CVE: CVE-2014-6378
Published: 2014-10-14
Description: Juniper Junos 11.4 before R12-S4, 12.1X44 before D35, 12.1X45 before D30, 12.1X46 before D25, 12.1X47 before D10, 12.2 before R9, 12.2X50 before D70, 12.3 before R7, 13.1 before R4 before S3, 13.1X49 before D55, 13.1X50 before D30, 13.2 before R5, 13.2X50 before D20, 13.2X51 before D26 and D30, 13.2X52 before D15, 13.3 before R3, and 14.1 before R1 allows remote attackers to cause a denial of service (router protocol daemon crash) via a crafted RSVP PATH message.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://www.securityfocus.com/bid/70363; http://www.securitytracker.com/id/1031008; https://exchange.xforce.ibmcloud.com/vulnerabilities/96906
CVE: CVE-2014-6379
Published: 2014-10-14
Description: Juniper Junos 11.4 before R12, 12.1 before R10, 12.1X44 before D35, 12.1X45 before D25, 12.1X46 before D20, 12.1X47 before D10, 12.2 before R8, 12.2X50 before D70, 12.3 before R6, 13.1 before R4-S3, 13.1X49 before D55, 13.1X50 before D30, 13.2 before R4, 13.2X50 before D20, 13.2X51 before D26 and D30, 13.2X52 before D15, 13.3 before R2, and 14.1 before R1, when a RADIUS accounting server is configured as [system accounting destination radius], creates an entry in /var/etc/pam_radius.conf, which might allow remote attackers to bypass authentication via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://www.securityfocus.com/bid/70365; http://www.securitytracker.com/id/1031010; https://exchange.xforce.ibmcloud.com/vulnerabilities/96905
CVE: CVE-2014-6380
Published: 2014-10-14
Description: Juniper Junos 11.4 before R11, 12.1 before R9, 12.1X44 before D30, 12.1X45 before D20, 12.1X46 before D15, 12.1X47 before D10, 12.2 before R8, 12.2X50 before D70, 12.3 before R6, 13.1 before R4, 13.1X49 before D55, 13.1X50 before D30, 13.2 before R4, 13.2X50 before D20, 13.2X51 before D15, 13.2X52 before D15, 13.3 before R1, when using an em interface to connect to a certain internal network, allows remote attackers to cause a denial of service (em driver bock and FPC reset or "go offline") via a series of crafted (1) CLNP fragmented packets, when clns-routing or ESIS is configured, or (2) IPv4 or (3) IPv6 fragmented packets.
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/bid/70369; http://www.securitytracker.com/id/1031011; https://exchange.xforce.ibmcloud.com/vulnerabilities/96904
CVE: CVE-2014-8069
Published: 2014-10-14
Description: Multiple cross-site scripting (XSS) vulnerabilities in YOOtheme Pagekit CMS 0.8.7 allow remote attackers to inject arbitrary web script or HTML via the (1) HTTP Referer header to index.php/user or (2) PATH_INFO to index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/128641/Pagekit-0.8.7-Cross-Site-Scripting-Open-Redirect.html; http://packetstormsecurity.com/files/128641/Pagekit-0.8.7-Cross-Site-Scripting-Open-Redirect.html
CVE: CVE-2014-8070
Published: 2014-10-14
Description: Open redirect vulnerability in YOOtheme Pagekit CMS 0.8.7 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the redirect parameter to index.php/user/logout.
CVSS Score: 6.8 (MEDIUM)
References: http://packetstormsecurity.com/files/128641/Pagekit-0.8.7-Cross-Site-Scripting-Open-Redirect.html; http://packetstormsecurity.com/files/128641/Pagekit-0.8.7-Cross-Site-Scripting-Open-Redirect.html
CVE: CVE-2014-8765
Published: 2014-10-14
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Project Issue File Review module (PIFR) module 6.x-2.x before 6.x-2.17 for Drupal allow (1) remote attackers to inject arbitrary web script or HTML via a crafted patch, which triggers a PIFR client to test the patch and return the results to the PIFR_Server test results page or (2) remote authenticated users with the "manage PIFR environments" permission to inject arbitrary web script or HTML via vectors involving a PIFR_Server administrative page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/57030; http://www.securityfocus.com/bid/65830; https://www.drupal.org/node/2205755