deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-6254
Published: 2014-12-15
Description: Multiple cross-site scripting (XSS) vulnerabilities in Zenoss Core through 5 Beta 3 allow remote attackers to inject arbitrary web script or HTML via an attribute in a (1) device name, (2) device detail, (3) report name, (4) report detail, or (5) portlet name, or (6) a string to a helper method, aka ZEN-15381 and ZEN-15410.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.kb.cert.org/vuls/id/449452; https://docs.google.com/spreadsheets/d/1dHAc4PxUbs-4Dxzm1wSCE0sMz5UCMY6SW3PlMHSyuuQ/edit?usp=sharing; http://www.kb.cert.org/vuls/id/449452
CVE: CVE-2014-6255
Published: 2014-12-15
Description: Open redirect vulnerability in the login form in Zenoss Core before 4.2.5 SP161 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the came_from parameter, aka ZEN-11998.
CVSS Score: 6.4 (MEDIUM)
References: http://www.kb.cert.org/vuls/id/449452; https://docs.google.com/spreadsheets/d/1dHAc4PxUbs-4Dxzm1wSCE0sMz5UCMY6SW3PlMHSyuuQ/edit?usp=sharing; http://www.kb.cert.org/vuls/id/449452
CVE: CVE-2014-6256
Published: 2014-12-15
Description: Zenoss Core through 5 Beta 3 allows remote attackers to bypass intended access restrictions and place files in a directory with public (1) read or (2) execute access via a move action, aka ZEN-15386.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://www.kb.cert.org/vuls/id/449452; https://docs.google.com/spreadsheets/d/1dHAc4PxUbs-4Dxzm1wSCE0sMz5UCMY6SW3PlMHSyuuQ/edit?usp=sharing; http://www.kb.cert.org/vuls/id/449452
CVE: CVE-2014-6257
Published: 2014-12-15
Description: Zenoss Core through 5 Beta 3 allows remote attackers to bypass intended access restrictions by using a web-endpoint URL to invoke an object helper method, aka ZEN-15407.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://www.kb.cert.org/vuls/id/449452; https://docs.google.com/spreadsheets/d/1dHAc4PxUbs-4Dxzm1wSCE0sMz5UCMY6SW3PlMHSyuuQ/edit?usp=sharing; http://www.kb.cert.org/vuls/id/449452
CVE: CVE-2014-6258
Published: 2014-12-15
Description: An unspecified endpoint in Zenoss Core through 5 Beta 3 allows remote attackers to cause a denial of service (CPU consumption) by triggering an arbitrary regular-expression match attempt, aka ZEN-15411.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://www.kb.cert.org/vuls/id/449452; https://docs.google.com/spreadsheets/d/1dHAc4PxUbs-4Dxzm1wSCE0sMz5UCMY6SW3PlMHSyuuQ/edit?usp=sharing; http://www.kb.cert.org/vuls/id/449452
CVE: CVE-2014-6259
Published: 2014-12-15
Description: Zenoss Core through 5 Beta 3 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, aka ZEN-15414, a similar issue to CVE-2003-1564.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://www.kb.cert.org/vuls/id/449452; https://docs.google.com/spreadsheets/d/1dHAc4PxUbs-4Dxzm1wSCE0sMz5UCMY6SW3PlMHSyuuQ/edit?usp=sharing; http://www.kb.cert.org/vuls/id/449452
CVE: CVE-2014-6260
Published: 2014-12-15
Description: Zenoss Core through 5 Beta 3 does not require a password for modifying the pager command string, which allows remote attackers to execute arbitrary commands or cause a denial of service (paging outage) by leveraging an unattended workstation, aka ZEN-15412.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-77
References: http://www.kb.cert.org/vuls/id/449452; https://docs.google.com/spreadsheets/d/1dHAc4PxUbs-4Dxzm1wSCE0sMz5UCMY6SW3PlMHSyuuQ/edit?usp=sharing; http://www.kb.cert.org/vuls/id/449452
CVE: CVE-2014-6261
Published: 2014-12-15
Description: Zenoss Core through 5 Beta 3 does not properly implement the Check For Updates feature, which allows remote attackers to execute arbitrary code by (1) spoofing the callhome server or (2) deploying a crafted web site that is visited during a login session, aka ZEN-12657.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://www.kb.cert.org/vuls/id/449452; https://docs.google.com/spreadsheets/d/1dHAc4PxUbs-4Dxzm1wSCE0sMz5UCMY6SW3PlMHSyuuQ/edit?usp=sharing; http://www.kb.cert.org/vuls/id/449452
CVE: CVE-2014-7911
Published: 2014-12-15
Description: luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.0 does not verify that deserialization will result in an object that met the requirements for serialization, which allows attackers to execute arbitrary code via a crafted finalize method for a serialized object in an ArrayMap Parcel within an intent sent to system_service, as demonstrated by the finalize method of android.os.BinderProxy, aka Bug 15874291.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://seclists.org/fulldisclosure/2014/Nov/51; https://android.googlesource.com/platform/libcore/+/738c833d38d41f8f76eb7e77ab39add82b1ae1e2; http://seclists.org/fulldisclosure/2014/Nov/51
CVE: CVE-2014-8507
Published: 2014-12-15
Description: Multiple SQL injection vulnerabilities in the queryLastApp method in packages/WAPPushManager/src/com/android/smspush/WapPushManager.java in the WAPPushManager module in Android before 5.0.0 allow remote attackers to execute arbitrary SQL commands, and consequently launch an activity or service, via the (1) wapAppId or (2) contentType field of a PDU for a malformed WAPPush message, aka Bug 17969135.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/129283/Android-WAPPushManager-SQL-Injection.html; http://seclists.org/fulldisclosure/2014/Nov/86; http://www.securityfocus.com/bid/71310
CVE: CVE-2014-8609
Published: 2014-12-15
Description: The addAccount method in src/com/android/settings/accounts/AddAccountSettings.java in the Settings application in Android before 5.0.0 does not properly create a PendingIntent, which allows attackers to use the SYSTEM uid for broadcasting an intent with arbitrary component, action, or category information via a third-party authenticator in a crafted application, aka Bug 17356824.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://packetstormsecurity.com/files/129281/Android-Settings-Pendingintent-Leak.html; http://seclists.org/fulldisclosure/2014/Nov/81; http://xteam.baidu.com/?p=158
CVE: CVE-2014-8610
Published: 2014-12-15
Description: AndroidManifest.xml in Android before 5.0.0 does not require the SEND_SMS permission for the SmsReceiver receiver, which allows attackers to send stored SMS messages, and consequently transmit arbitrary new draft SMS messages or trigger additional per-message charges from a network operator for old messages, via a crafted application that broadcasts an intent with the com.android.mms.transaction.MESSAGE_SENT action, aka Bug 17671795.
CVSS Score: 3.3 (LOW)
CWE: CWE-264
References: http://packetstormsecurity.com/files/129282/Android-SMS-Resend.html; http://seclists.org/fulldisclosure/2014/Dec/8; http://seclists.org/fulldisclosure/2014/Nov/85
CVE: CVE-2014-8967
Published: 2014-12-15
Description: Use-after-free vulnerability in Microsoft Internet Explorer allows remote attackers to execute arbitrary code via a crafted HTML document in conjunction with a Cascading Style Sheets (CSS) token sequence specifying the run-in value for the display property, leading to improper CElement reference counting.
CVSS Score: 6.8 (MEDIUM)
References: http://www.securityfocus.com/bid/71483; http://zerodayinitiative.com/advisories/ZDI-14-403/; http://www.securityfocus.com/bid/71483
CVE: CVE-2014-9245
Published: 2014-12-15
Description: Zenoss Core through 5 Beta 3 allows remote attackers to obtain sensitive information by attempting a product-rename action with an invalid new name and then reading a stack trace, as demonstrated by internal URL information, aka ZEN-15382.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www.kb.cert.org/vuls/id/449452; https://docs.google.com/spreadsheets/d/1dHAc4PxUbs-4Dxzm1wSCE0sMz5UCMY6SW3PlMHSyuuQ/edit?usp=sharing; http://www.kb.cert.org/vuls/id/449452
CVE: CVE-2014-9246
Published: 2014-12-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2014-9385, CVE-2014-9386.  Reason: this ID was intended for one issue, but was assigned to two issues by a CNA.  Notes: All CVE users should consult CVE-2014-9385 and CVE-2014-9386 to determine which ID is appropriate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2014-9247
Published: 2014-12-15
Description: Zenoss Core through 5 Beta 3 allows remote authenticated users to obtain sensitive (1) user account, (2) e-mail address, and (3) role information by visiting the ZenUsers (aka User Manager) page, aka ZEN-15389.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://www.kb.cert.org/vuls/id/449452; https://docs.google.com/spreadsheets/d/1dHAc4PxUbs-4Dxzm1wSCE0sMz5UCMY6SW3PlMHSyuuQ/edit?usp=sharing; http://www.kb.cert.org/vuls/id/449452
CVE: CVE-2014-9248
Published: 2014-12-15
Description: Zenoss Core through 5 Beta 3 does not require complex passwords, which makes it easier for remote attackers to obtain access via a brute-force attack, aka ZEN-15406.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-255
References: http://www.kb.cert.org/vuls/id/449452; https://docs.google.com/spreadsheets/d/1dHAc4PxUbs-4Dxzm1wSCE0sMz5UCMY6SW3PlMHSyuuQ/edit?usp=sharing; http://www.kb.cert.org/vuls/id/449452
CVE: CVE-2014-9249
Published: 2014-12-15
Description: The default configuration of Zenoss Core before 5 allows remote attackers to read or modify database information by connecting to unspecified open ports, aka ZEN-15408.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://www.kb.cert.org/vuls/id/449452; https://docs.google.com/spreadsheets/d/1dHAc4PxUbs-4Dxzm1wSCE0sMz5UCMY6SW3PlMHSyuuQ/edit?usp=sharing; http://www.kb.cert.org/vuls/id/449452
CVE: CVE-2014-9250
Published: 2014-12-15
Description: Zenoss Core through 5 Beta 3 does not include the HTTPOnly flag in a Set-Cookie header for the authentication cookie, which makes it easier for remote attackers to obtain credential information via script access to this cookie, aka ZEN-10418.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www.kb.cert.org/vuls/id/449452; https://docs.google.com/spreadsheets/d/1dHAc4PxUbs-4Dxzm1wSCE0sMz5UCMY6SW3PlMHSyuuQ/edit?usp=sharing; http://www.kb.cert.org/vuls/id/449452
CVE: CVE-2014-9251
Published: 2014-12-15
Description: Zenoss Core through 5 Beta 3 uses a weak algorithm to hash passwords, which makes it easier for context-dependent attackers to obtain cleartext values via a brute-force attack on hash values in the database, aka ZEN-15413.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-255
References: http://www.kb.cert.org/vuls/id/449452; https://docs.google.com/spreadsheets/d/1dHAc4PxUbs-4Dxzm1wSCE0sMz5UCMY6SW3PlMHSyuuQ/edit?usp=sharing; http://www.kb.cert.org/vuls/id/449452
CVE: CVE-2014-9252
Published: 2014-12-15
Description: Zenoss Core through 5 Beta 3 stores cleartext passwords in the session database, which might allow local users to obtain sensitive information by reading database entries, aka ZEN-15416.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://www.kb.cert.org/vuls/id/449452; https://docs.google.com/spreadsheets/d/1dHAc4PxUbs-4Dxzm1wSCE0sMz5UCMY6SW3PlMHSyuuQ/edit?usp=sharing; http://www.kb.cert.org/vuls/id/449452
CVE: CVE-2014-9385
Published: 2014-12-15
Description: Cross-site request forgery (CSRF) vulnerability in Zenoss Core through 5 Beta 3 allows remote attackers to hijack the authentication of arbitrary users for requests that trigger arbitrary code execution via a ZenPack upload, aka ZEN-15388.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www.kb.cert.org/vuls/id/449452; https://docs.google.com/spreadsheets/d/1dHAc4PxUbs-4Dxzm1wSCE0sMz5UCMY6SW3PlMHSyuuQ/edit?usp=sharing; http://www.kb.cert.org/vuls/id/449452
CVE: CVE-2014-9386
Published: 2014-12-15
Description: Zenoss Core before 4.2.5 SP161 sets an infinite lifetime for the session ID cookie, which makes it easier for remote attackers to hijack sessions by leveraging an unattended workstation, aka ZEN-12691.
CVSS Score: 6.8 (MEDIUM)
References: http://www.kb.cert.org/vuls/id/449452; https://docs.google.com/spreadsheets/d/1dHAc4PxUbs-4Dxzm1wSCE0sMz5UCMY6SW3PlMHSyuuQ/edit?usp=sharing; http://www.kb.cert.org/vuls/id/449452
CVE: CVE-2013-6435
Published: 2014-12-16
Description: Race condition in RPM 4.11.1 and earlier allows remote attackers to execute arbitrary code via a crafted RPM file whose installation extracts the contents to temporary files before validating the signature, as demonstrated by installing a file in the /etc/cron.d directory.
CVSS Score: 7.6 (HIGH)
CWE: CWE-74
References: http://advisories.mageia.org/MGASA-2014-0529.html; http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705; http://rhn.redhat.com/errata/RHSA-2014-1974.html
CVE: CVE-2014-4936
Published: 2014-12-16
Description: The upgrade functionality in Malwarebytes Anti-Malware (MBAM) consumer before 2.0.3 and Malwarebytes Anti-Exploit (MBAE) consumer 1.04.1.1012 and earlier allow man-in-the-middle attackers to execute arbitrary code by spoofing the update server and uploading an executable.
CVSS Score: 9.3 (HIGH)
CWE: CWE-345
References: http://blog.0x3a.com/post/[PII_REDACTED]9/cve-2014-4936-malwarebytes-anti-malware-and; http://packetstormsecurity.com/files/130244/Malwarebytes-Anti-Malware-Anti-Exploit-Update-Remote-Code-Execution.html; http://blog.0x3a.com/post/[PII_REDACTED]9/cve-2014-4936-malwarebytes-anti-malware-and
CVE: CVE-2014-5359
Published: 2014-12-16
Description: Directory traversal vulnerability in SafeNet Authentication Service (SAS) Outlook Web Access Agent (formerly CRYPTOCard) before 1.03.30109 allows remote attackers to read arbitrary files via a .. (dot dot) in the GetFile parameter to owa/owa.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: http://appcheck-ng.com/safenet-sas-owa-agent-directory-traversal-vulnerability/; http://www.safenet-inc.com/technical-support/security-updates/; http://appcheck-ng.com/safenet-sas-owa-agent-directory-traversal-vulnerability/
CVE: CVE-2014-5466
Published: 2014-12-16
Description: Cross-site scripting (XSS) vulnerability in the Dashboard in Splunk Web in Splunk Enterprise 6.1.x before 6.1.4, 6.0.x before 6.0.7, and 5.0.x before 5.0.10 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.splunk.com/view/SP-CAAANST; http://www.splunk.com/view/SP-CAAANST
CVE: CVE-2014-8118
Published: 2014-12-16
Description: Integer overflow in RPM 4.12 and earlier allows remote attackers to execute arbitrary code via a crafted CPIO header in the payload section of an RPM file, which triggers a stack-based buffer overflow.
CVSS Score: 10.0 (HIGH)
CWE: CWE-189
References: http://advisories.mageia.org/MGASA-2014-0529.html; http://rhn.redhat.com/errata/RHSA-2014-1976.html; http://www.debian.org/security/2015/dsa-3129
CVE: CVE-2014-8340
Published: 2014-12-16
Description: SQL injection vulnerability in Php/Functions/log_function.php in phpTrafficA 2.3 and earlier allows remote attackers to execute arbitrary SQL commands via a User-Agent HTTP header.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/129445/phpTrafficA-2.3-SQL-Injection.html; http://www.securityfocus.com/archive/1/534184/100/0/threaded; http://packetstormsecurity.com/files/129445/phpTrafficA-2.3-SQL-Injection.html
CVE: CVE-2014-8583
Published: 2014-12-16
Description: mod_wsgi before 4.2.4 for Apache, when creating a daemon process group, does not properly handle when group privileges cannot be dropped, which might allow attackers to gain privileges via unspecified vectors.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-254
References: http://advisories.mageia.org/MGASA-2014-0513.html; http://lists.opensuse.org/opensuse-updates/2014-12/msg00036.html; http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.2.4.html
CVE: CVE-2014-8751
Published: 2014-12-16
Description: Multiple cross-site scripting (XSS) vulnerabilities in goYWP WebPress 13.00.06 allow remote attackers to inject arbitrary web script or HTML via the (1) search_param parameter to search.php or (2) name, (3) address, or (4) comment parameter to forms.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/129443/goYWP-WebPress-13.00.06-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2014/Dec/34; http://packetstormsecurity.com/files/129443/goYWP-WebPress-13.00.06-Cross-Site-Scripting.html
CVE: CVE-2014-8964
Published: 2014-12-16
Description: Heap-based buffer overflow in PCRE 8.36 and earlier allows remote attackers to cause a denial of service (crash) or have other unspecified impact via a crafted regular expression, related to an assertion that allows zero repeats.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://advisories.mageia.org/MGASA-2014-0534.html; http://bugs.exim.org/show_bug.cgi?id=1546; http://lists.fedoraproject.org/pipermail/package-announce/2014-December/145843.html
CVE: CVE-2014-9057
Published: 2014-12-16
Description: SQL injection vulnerability in the XML-RPC interface in Movable Type before 5.18, 5.2.x before 5.2.11, and 6.x before 6.0.6 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/61227; https://movabletype.org/documentation/appendices/release-notes/6.0.6.html; https://movabletype.org/news/2014/12/6.0.6.html
CVE: CVE-2014-9323
Published: 2014-12-16
Description: The xdr_status_vector function in Firebird before 2.1.7 and 2.5.x before 2.5.3 SU1 allows remote attackers to cause a denial of service (NULL pointer dereference, segmentation fault, and crash) via an op_response action with a non-empty status.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-476
References: http://advisories.mageia.org/MGASA-2014-0523.html; http://lists.opensuse.org/opensuse-security-announce/2014-12/msg00012.html; http://tracker.firebirdsql.org/browse/CORE-4630
CVE: CVE-2014-9357
Published: 2014-12-16
Description: Docker 1.3.2 allows remote attackers to execute arbitrary code with root privileges via a crafted (1) image or (2) build in a Dockerfile in an LZMA (.xz) archive, related to the chroot for archive extraction.
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://www.securityfocus.com/archive/1/534215/100/0/threaded; https://groups.google.com/forum/#%21msg/docker-user/nFAz-B-n4Bw/0wr3wvLsnUwJ; http://www.securityfocus.com/archive/1/534215/100/0/threaded
CVE: CVE-2014-9358
Published: 2014-12-16
Description: Docker before 1.3.3 does not properly validate image IDs, which allows remote attackers to conduct path traversal attacks and spoof repositories via a crafted image in a (1) "docker load" operation or (2) "registry communications."
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/archive/1/534215/100/0/threaded; https://groups.google.com/forum/#%21msg/docker-user/nFAz-B-n4Bw/0wr3wvLsnUwJ; http://www.securityfocus.com/archive/1/534215/100/0/threaded
CVE: CVE-2014-9371
Published: 2014-12-16
Description: The NativeAppServlet in ManageEngine Desktop Central MSP before 90075 allows remote attackers to execute arbitrary code via a crafted JSON object.
CVSS Score: 10.0 (HIGH)
CWE: CWE-20
References: http://www.zerodayinitiative.com/advisories/ZDI-14-420/; http://www.zerodayinitiative.com/advisories/ZDI-14-420/
CVE: CVE-2014-9372
Published: 2014-12-16
Description: Directory traversal vulnerability in the UploadAccountActivities servlet in ManageEngine Password Manager Pro (PMP) before 7103 allows remote attackers to delete arbitrary files via a .. (dot dot) in a filename.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-22
References: http://www.manageengine.com/products/passwordmanagerpro/release-notes.html; http://www.zerodayinitiative.com/advisories/ZDI-14-421/; http://www.manageengine.com/products/passwordmanagerpro/release-notes.html
CVE: CVE-2014-9373
Published: 2014-12-16
Description: Directory traversal vulnerability in the CollectorConfInfoServlet servlet in ManageEngine NetFlow Analyzer allows remote attackers to execute arbitrary code via a .. (dot dot) in the filename.
CVSS Score: 10.0 (HIGH)
CWE: CWE-22
References: http://www.zerodayinitiative.com/advisories/ZDI-14-422/; http://www.zerodayinitiative.com/advisories/ZDI-14-422/
CVE: CVE-2014-5353
Published: 2014-12-16
Description: The krb5_ldap_get_password_policy_from_dn function in plugins/kdb/ldap/libkdb_ldap/ldap_pwd_policy.c in MIT Kerberos 5 (aka krb5) before 1.13.1, when the KDC uses LDAP, allows remote authenticated users to cause a denial of service (daemon crash) via a successful LDAP query with no results, as demonstrated by using an incorrect object type for a password policy.
CVSS Score: 3.5 (LOW)
CWE: CWE-476
References: http://advisories.mageia.org/MGASA-2014-0536.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155828.html; http://lists.opensuse.org/opensuse-updates/2015-03/msg00061.html
CVE: CVE-2014-5354
Published: 2014-12-16
Description: plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in MIT Kerberos 5 (aka krb5) 1.12.x and 1.13.x before 1.13.1, when the KDC uses LDAP, allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) by creating a database entry for a keyless principal, as demonstrated by a kadmin "add_principal -nokey" or "purgekeys -all" command.
CVSS Score: 3.5 (LOW)
References: http://lists.opensuse.org/opensuse-updates/2015-03/msg00061.html; http://www.securityfocus.com/bid/71680; http://www.securitytracker.com/id/1031376
CVE: CVE-2014-6176
Published: 2014-12-16
Description: IBM WebSphere Process Server 7.0, WebSphere Enterprise Service Bus 7.0, and Business Process Manager Advanced 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, and 8.5.x through 8.5.5 disregard the SSL setting in the SCA module HTTP import binding and unconditionally select the SSLv3 protocol, which makes it easier for remote attackers to hijack sessions or obtain sensitive information by leveraging the use of a weak cipher.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-310
References: http://www-01.ibm.com/support/docview.wss?uid=swg1JR51593; http://www-01.ibm.com/support/docview.wss?uid=swg21690780; http://www.securitytracker.com/id/1031382
CVE: CVE-2014-8246
Published: 2014-12-16
Description: Cross-site request forgery (CSRF) vulnerability in CA Release Automation (formerly iTKO LISA Release Automation) before 4.7.1 b448 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://seclists.org/fulldisclosure/2014/Dec/55; http://securitytracker.com/id?1031375; http://www.ca.com/us/support/ca-support-online/product-content/recommended-reading/security-notices/ca20141215-01-security-notice-for-ca-lisa-release-automation.aspx
CVE: CVE-2014-8247
Published: 2014-12-16
Description: Cross-site scripting (XSS) vulnerability in CA Release Automation (formerly iTKO LISA Release Automation) before 4.7.1 b448 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2014/Dec/55; http://securitytracker.com/id?1031375; http://www.ca.com/us/support/ca-support-online/product-content/recommended-reading/security-notices/ca20141215-01-security-notice-for-ca-lisa-release-automation.aspx
CVE: CVE-2014-8248
Published: 2014-12-16
Description: SQL injection vulnerability in CA Release Automation (formerly iTKO LISA Release Automation) before 4.7.1 b448 allows remote authenticated users to execute arbitrary SQL commands via a crafted query.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://seclists.org/fulldisclosure/2014/Dec/55; http://securitytracker.com/id?1031375; http://www.ca.com/us/support/ca-support-online/product-content/recommended-reading/security-notices/ca20141215-01-security-notice-for-ca-lisa-release-automation.aspx