deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-6892
Published: 2014-10-02
Description: The kalahari.com Shopping (aka com.kalahari.shop) application 1.4.2.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/141265; http://www.kb.cert.org/vuls/id/582497; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-6893
Published: 2014-10-02
Description: The Pushpins Grocery Coupons (aka com.pushpinsapp.pushpins) application 1.56 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/582497; http://www.kb.cert.org/vuls/id/781025; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-3621
Published: 2014-10-02
Description: The catalog url replacement in OpenStack Identity (Keystone) before 2013.2.3 and 2014.1 before 2014.1.2.1 allows remote authenticated users to read sensitive configuration options via a crafted endpoint, as demonstrated by "$(admin_token)" in the publicurl endpoint field.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://rhn.redhat.com/errata/RHSA-2014-1688.html; http://rhn.redhat.com/errata/RHSA-2014-1789.html; http://rhn.redhat.com/errata/RHSA-2014-1790.html
CVE: CVE-2014-6242
Published: 2014-10-02
Description: Multiple SQL injection vulnerabilities in the All In One WP Security & Firewall plugin before 3.8.3 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the (1) orderby or (2) order parameter in the aiowpsec page to wp-admin/admin.php.  NOTE: this can be leveraged using CSRF to allow remote attackers to execute arbitrary SQL commands.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://packetstormsecurity.com/files/128419/All-In-One-WP-Security-3.8.2-SQL-Injection.html; http://www.exploit-db.com/exploits/34781; http://www.securityfocus.com/archive/1/533519/100/0/threaded
CVE: CVE-2014-6414
Published: 2014-10-02
Description: OpenStack Neutron before 2014.2.4 and 2014.1 before 2014.1.2 allows remote authenticated users to set admin network attributes to default values via unspecified vectors.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://rhn.redhat.com/errata/RHSA-2014-1686.html; http://rhn.redhat.com/errata/RHSA-2014-1785.html; http://rhn.redhat.com/errata/RHSA-2014-1786.html
CVE: CVE-2014-7144
Published: 2014-10-02
Description: OpenStack keystonemiddleware (formerly python-keystoneclient) 0.x before 0.11.0 and 1.x before 1.2.0 disables certification verification when the "insecure" option is set in a paste configuration (paste.ini) file regardless of the value, which allows remote attackers to conduct man-in-the-middle attacks via a crafted certificate.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-310
References: http://rhn.redhat.com/errata/RHSA-2014-1783.html; http://rhn.redhat.com/errata/RHSA-2014-1784.html; http://rhn.redhat.com/errata/RHSA-2015-0020.html
CVE: CVE-2014-7154
Published: 2014-10-02
Description: Race condition in HVMOP_track_dirty_vram in Xen 4.0.0 through 4.4.x does not ensure possession of the guarding lock for dirty video RAM tracking, which allows certain local guest domains to cause a denial of service via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-362
References: http://lists.fedoraproject.org/pipermail/package-announce/2014-October/140418.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-October/140483.html; http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00002.html
CVE: CVE-2014-7155
Published: 2014-10-02
Description: The x86_emulate function in arch/x86/x86_emulate/x86_emulate.c in Xen 4.4.x and earlier does not properly check supervisor mode permissions, which allows local HVM users to cause a denial of service (guest crash) or gain guest kernel mode privileges via vectors involving an (1) HLT, (2) LGDT, (3) LIDT, or (4) LMSW instruction.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-264
References: http://lists.fedoraproject.org/pipermail/package-announce/2014-October/140418.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-October/140483.html; http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00002.html
CVE: CVE-2014-7156
Published: 2014-10-02
Description: The x86_emulate function in arch/x86/x86_emulate/x86_emulate.c in Xen 3.3.x through 4.4.x does not check the supervisor mode permissions for instructions that generate software interrupts, which allows local HVM guest users to cause a denial of service (guest crash) via unspecified vectors.
CVSS Score: 3.3 (LOW)
CWE: CWE-264
References: http://lists.fedoraproject.org/pipermail/package-announce/2014-October/140418.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-October/140483.html; http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00002.html
CVE: CVE-2014-7157
Published: 2014-10-02
Description: Cross-site scripting (XSS) vulnerability in Exinda WAN Optimization Suite 7.0.0 (2160) allows remote attackers to inject arbitrary web script or HTML via the tabsel parameter to admin/launch.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/128459/Exinda-WAN-Optimization-Suite-7.0.0-CSRF-XSS.html; http://seclists.org/fulldisclosure/2014/Sep/108; http://www.securityfocus.com/bid/70161
CVE: CVE-2014-7158
Published: 2014-10-02
Description: Cross-site request forgery (CSRF) vulnerability in Exinda WAN Optimization Suite 7.0.0 (2160) allows remote attackers to hijack the authentication of administrators for requests that change the admin password via a request to admin/launch.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.com/files/128459/Exinda-WAN-Optimization-Suite-7.0.0-CSRF-XSS.html; http://seclists.org/fulldisclosure/2014/Sep/108; http://www.securityfocus.com/bid/70161
CVE: CVE-2014-7188
Published: 2014-10-02
Description: The hvm_msr_read_intercept function in arch/x86/hvm/hvm.c in Xen 4.1 through 4.4.x uses an improper MSR range for x2APIC emulation, which allows local HVM guests to cause a denial of service (host crash) or read data from the hypervisor or other guests via unspecified vectors.
CVSS Score: 8.3 (HIGH)
CWE: CWE-399
References: http://lists.fedoraproject.org/pipermail/package-announce/2014-October/140199.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-October/140418.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-October/140483.html
CVE: CVE-2014-4809
Published: 2014-10-03
Description: The WebSEAL component in IBM Security Access Manager for Web 7.x before 7.0.0-ISS-WGA-IF0009 and 8.x before 8.0.0-ISS-WGA-FP0005, when e-community SSO is enabled, allows remote attackers to cause a denial of service (component hang) via unspecified vectors.
CVSS Score: 7.1 (HIGH)
References: http://secunia.com/advisories/61294; http://www-01.ibm.com/support/docview.wss?uid=swg1IV64915; http://www-01.ibm.com/support/docview.wss?uid=swg21685246
CVE: CVE-2014-4823
Published: 2014-10-03
Description: The administration console in IBM Security Access Manager for Web 7.x before 7.0.0-ISS-WGA-IF0009 and 8.x before 8.0.0-ISS-WGA-FP0005, and Security Access Manager for Mobile 8.x before 8.0.0-ISS-ISAM-FP0005, allows remote attackers to inject system commands via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-78
References: http://secunia.com/advisories/61278; http://secunia.com/advisories/61294; http://www-01.ibm.com/support/docview.wss?uid=swg1IV64910
CVE: CVE-2014-6079
Published: 2014-10-03
Description: Cross-site scripting (XSS) vulnerability in the Local Management Interface in IBM Security Access Manager for Web 7.x before 7.0.0-ISS-WGA-IF0009 and 8.x before 8.0.0-ISS-WGA-FP0005, and Security Access Manager for Mobile 8.x before 8.0.0-ISS-ISAM-FP0005, allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/61278; http://secunia.com/advisories/61294; http://www-01.ibm.com/support/docview.wss?uid=swg1IV64910
CVE: CVE-2014-6894
Published: 2014-10-03
Description: The Lucktastic (aka com.lucktastic.scratch) application 1.2.6 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/577041; http://www.kb.cert.org/vuls/id/582497; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-6895
Published: 2014-10-03
Description: The Throne Rush (aka com.progrestar.bft) application 2.3.10 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/531985; http://www.kb.cert.org/vuls/id/582497; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-6896
Published: 2014-10-03
Description: The Yik Yak (aka com.yik.yak) application 2.0.002 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/281009; http://www.kb.cert.org/vuls/id/582497; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-6897
Published: 2014-10-03
Description: The Skyrim Map (aka com.neko.skyrimmap) application 2.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/582497; http://www.kb.cert.org/vuls/id/970665; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-6898
Published: 2014-10-03
Description: The Boopsie MyLibrary (aka com.bredir.boopsie.mylibrary) application 4.5.110 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/582497; http://www.kb.cert.org/vuls/id/670057; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-6899
Published: 2014-10-03
Description: The Jazeera Airways (aka com.winit.jazeeraairways) application 2.7 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/582497; http://www.kb.cert.org/vuls/id/905193; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-6900
Published: 2014-10-03
Description: The EAGE Amsterdam 2014 (aka com.coreapps.android.followme.eage_2014) application 6.1.1.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/363289; http://www.kb.cert.org/vuls/id/582497; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-6901
Published: 2014-10-03
Description: The RADIOS DEL ECUADOR (aka com.nobexinc.wls_87612622.rc) application 3.2.4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/582497; http://www.kb.cert.org/vuls/id/857145; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-6902
Published: 2014-10-03
Description: The Anjuke (aka com.anjuke.android.app) application 7.1.7 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/582497; http://www.kb.cert.org/vuls/id/968289; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-6903
Published: 2014-10-03
Description: The Gulf Power Mobile Bill Pay (aka com.tionetworks.gulf) application 1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/215273; http://www.kb.cert.org/vuls/id/582497; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-6905
Published: 2014-10-03
Description: The H2O Human Harmony Organization (aka com.netpia.ha.theh2o) application 1.6.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/582497; http://www.kb.cert.org/vuls/id/895249; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-7217
Published: 2014-10-03
Description: Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.4, 4.1.x before 4.1.14.5, and 4.2.x before 4.2.9.1 allow remote authenticated users to inject arbitrary web script or HTML via a crafted ENUM value that is improperly handled during rendering of the (1) table search or (2) table structure page, related to libraries/TableSearch.class.php and libraries/Util.class.php.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-updates/2014-10/msg00009.html; http://secunia.com/advisories/61777; http://www.phpmyadmin.net/home_page/security/PMASA-2014-11.php
CVE: CVE-2014-3947
Published: 2014-10-03
Description: Unrestricted file upload vulnerability in the powermail extension before 1.6.11 and 2.x before 2.0.14 for TYPO3 allows remote attackers to execute arbitrary code by uploading a file with a crafted extension, then accessing it via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://typo3.org/extensions/repository/view/powermail; http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2014-007/; http://typo3.org/extensions/repository/view/powermail
CVE: CVE-2014-6288
Published: 2014-10-03
Description: The powermail extension 2.x before 2.0.11 for TYPO3 allows remote attackers to bypass the CAPTCHA protection mechanism via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://typo3.org/extensions/repository/view/powermail; http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2014-006/; http://typo3.org/extensions/repository/view/powermail
CVE: CVE-2014-6289
Published: 2014-10-03
Description: The Ajax dispatcher for Extbase in the Yet Another Gallery (yag) extension before 3.0.1 and Tools for Extbase development (pt_extbase) extension before 1.5.1 allows remote attackers to bypass access restrictions and execute arbitrary controller actions via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://typo3.org/extensions/repository/view/pt_extbase; http://typo3.org/extensions/repository/view/yag; http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2014-005/
CVE: CVE-2014-6290
Published: 2014-10-03
Description: The News (tt_news) extension before 3.5.2 for TYPO3 allows remote attackers to have unspecified impact via vectors related to an "insecure unserialize" issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://typo3.org/extensions/repository/view/tt_news; http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2014-003/; http://typo3.org/extensions/repository/view/tt_news
CVE: CVE-2014-6291
Published: 2014-10-03
Description: Cross-site scripting (XSS) vulnerability in the Alphabetic Sitemap (alpha_sitemap) extension 0.0.3 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2014-002/; http://www.securityfocus.com/bid/69689; https://exchange.xforce.ibmcloud.com/vulnerabilities/95799
CVE: CVE-2014-6292
Published: 2014-10-03
Description: The femanager extension before 1.0.9 for TYPO3 allows remote frontend users to modify or delete the records of other frontend users via unspecified vectors.
CVSS Score: 6.4 (MEDIUM)
References: http://typo3.org/extensions/repository/view/femanager; http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2014-002/; http://typo3.org/extensions/repository/view/femanager
CVE: CVE-2014-6293
Published: 2014-10-03
Description: SQL injection vulnerability in the Statistics (ke_stats) extension before 1.1.2 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, as exploited in the wild in February 2014.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://typo3.org/extensions/repository/view/ke_stats; http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2014-002/; http://typo3.org/extensions/repository/view/ke_stats
CVE: CVE-2014-6294
Published: 2014-10-03
Description: Cross-site scripting (XSS) vulnerability in the External links click statistics (outstats) extension 0.0.3 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2014-002/; http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2014-002/
CVE: CVE-2014-6295
Published: 2014-10-03
Description: SQL injection vulnerability in the WEC Map (wec_map) extension before 3.0.3 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://typo3.org/extensions/repository/view/wec_map; http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2014-002/; http://typo3.org/extensions/repository/view/wec_map
CVE: CVE-2014-6296
Published: 2014-10-03
Description: Cross-site scripting (XSS) vulnerability in the WEC Map (wec_map) extension before 3.0.3 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://typo3.org/extensions/repository/view/wec_map; http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2014-002/; http://typo3.org/extensions/repository/view/wec_map
CVE: CVE-2014-6297
Published: 2014-10-03
Description: Cross-site scripting (XSS) vulnerability in the mm_forum extension before 1.9.3 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://typo3.org/extensions/repository/view/mm_forum; http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2014-001/; http://typo3.org/extensions/repository/view/mm_forum
CVE: CVE-2014-6298
Published: 2014-10-03
Description: Unrestricted file upload vulnerability in the mm_forum extension before 1.9.3 for TYPO3 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://typo3.org/extensions/repository/view/mm_forum; http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2014-001/; http://typo3.org/extensions/repository/view/mm_forum
CVE: CVE-2014-6299
Published: 2014-10-03
Description: Cross-site request forgery (CSRF) vulnerability in the mm_forum extension before 1.9.3 for TYPO3 allows remote attackers to hijack the authentication of users for requests that create posts via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://typo3.org/extensions/repository/view/mm_forum; http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2014-001/; http://typo3.org/extensions/repository/view/mm_forum
CVE: CVE-2014-0754
Published: 2014-10-03
Description: Directory traversal vulnerability in SchneiderWEB on Schneider Electric Modicon PLC Ethernet modules 140CPU65x Exec before 5.5, 140NOC78x Exec before 1.62, 140NOE77x Exec before 6.2, BMXNOC0401 before 2.05, BMXNOE0100 before 2.9, BMXNOE0110x Exec before 6.0, TSXETC101 Exec before 2.04, TSXETY4103x Exec before 5.7, TSXETY5103x Exec before 5.9, TSXP57x ETYPort Exec before 5.7, and TSXP57x Ethernet Copro Exec before 5.5 allows remote attackers to visit arbitrary resources via a crafted HTTP request.
CVSS Score: 10.0 (HIGH)
CWE: CWE-22
References: http://www.securityfocus.com/bid/70193; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2014-260-01; https://www.cisa.gov/news-events/ics-advisories/icsa-14-273-01
CVE: CVE-2014-5410
Published: 2014-10-03
Description: The DNP3 feature on Rockwell Automation Allen-Bradley MicroLogix 1400 1766-Lxxxxx A FRN controllers 7 and earlier and 1400 1766-Lxxxxx B FRN controllers before 15.001 allows remote attackers to cause a denial of service (process disruption) via malformed packets over (1) an Ethernet network or (2) a serial line.
CVSS Score: 7.1 (HIGH)
CWE: CWE-20, CWE-399
References: https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2014/icsa-14-254-02.json; https://rockwellautomation.custhelp.com/app/answers/detail/a_id/620295; https://www.cisa.gov/news-events/ics-advisories/icsa-14-254-02
CVE: CVE-2014-7227
Published: 2014-10-03
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2014-6271, CVE-2014-6277, CVE-2014-6278, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187.  Reason: This candidate is a duplicate of CVE-2014-6271, CVE-2014-6277, CVE-2014-6278, CVE-2014-7169, CVE-2014-7186, and CVE-2014-7187.  Notes: All CVE users should reference CVE-2014-6271, CVE-2014-6277, CVE-2014-6278, CVE-2014-7169, CVE-2014-7186, and CVE-2014-7187 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2014-6906
Published: 2014-10-04
Description: The Loli Chocolate Cake (aka com.alison.kang.chocolatecake) application 1.0.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/438969; http://www.kb.cert.org/vuls/id/582497; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing