deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-9528
Published: 2015-01-06
Description: SQL injection vulnerability in the actionIndex function in protected/modules_core/notification/controllers/ListController.php in HumHub 0.10.0-rc.1 and earlier allows remote authenticated users to execute arbitrary SQL commands via the from parameter to index.php. NOTE: this can be leveraged for cross-site scripting (XSS) attacks via a request that causes an error.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/129440/Humhub-0.10.0-rc.1-Cross-Site-Scripting-SQL-Injection.html; http://seclists.org/fulldisclosure/2014/Dec/31; http://www.exploit-db.com/exploits/35510
CVE: CVE-2014-4635
Published: 2015-01-07
Description: Multiple cross-site scripting (XSS) vulnerabilities in EMC Documentum Web Development Kit (WDK) before 6.8 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2015-01/0009.html; http://packetstormsecurity.com/files/129822/EMC-Documentum-Web-Development-Kit-XSS-CSRF-Redirection-Injection.html; http://www.securitytracker.com/id/1031497
CVE: CVE-2014-4636
Published: 2015-01-07
Description: Cross-site request forgery (CSRF) vulnerability in EMC Documentum Web Development Kit (WDK) before 6.8 allows remote attackers to hijack the authentication of arbitrary users for requests that perform Docbase operations.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://archives.neohapsis.com/archives/bugtraq/2015-01/0009.html; http://packetstormsecurity.com/files/129822/EMC-Documentum-Web-Development-Kit-XSS-CSRF-Redirection-Injection.html; http://www.securitytracker.com/id/1031497
CVE: CVE-2014-4637
Published: 2015-01-07
Description: Open redirect vulnerability in EMC Documentum Web Development Kit (WDK) before 6.8 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via an unspecified parameter.
CVSS Score: 6.4 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2015-01/0009.html; http://packetstormsecurity.com/files/129822/EMC-Documentum-Web-Development-Kit-XSS-CSRF-Redirection-Injection.html; http://www.securitytracker.com/id/1031497
CVE: CVE-2014-4638
Published: 2015-01-07
Description: EMC Documentum Web Development Kit (WDK) before 6.8 allows remote attackers to conduct frame-injection attacks and obtain sensitive information via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://archives.neohapsis.com/archives/bugtraq/2015-01/0009.html; http://packetstormsecurity.com/files/129822/EMC-Documentum-Web-Development-Kit-XSS-CSRF-Redirection-Injection.html; http://www.securitytracker.com/id/1031497
CVE: CVE-2014-4639
Published: 2015-01-07
Description: EMC Documentum Web Development Kit (WDK) before 6.8 does not properly generate random numbers for a certain parameter related to Webtop components, which makes it easier for remote attackers to conduct phishing attacks via brute-force attempts to predict the parameter value.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://archives.neohapsis.com/archives/bugtraq/2015-01/0009.html; http://packetstormsecurity.com/files/129822/EMC-Documentum-Web-Development-Kit-XSS-CSRF-Redirection-Injection.html; http://www.securitytracker.com/id/1031497
CVE: CVE-2014-0631
Published: 2015-01-07
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2014.  Notes: none
CVE: CVE-2014-4640
Published: 2015-01-07
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2014.  Notes: none
CVE: CVE-2014-4641
Published: 2015-01-07
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2014.  Notes: none
CVE: CVE-2014-4642
Published: 2015-01-07
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2014.  Notes: none
CVE: CVE-2014-9486
Published: 2015-01-07
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2014-9447.  Reason: This candidate is a duplicate of CVE-2014-9447.  Notes: All CVE users should reference CVE-2014-9447 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2014-3779
Published: 2015-01-07
Description: Cross-site scripting (XSS) vulnerability in ZOHO ManageEngine ADSelfService Plus before 5.2 Build 5202 allows remote attackers to inject arbitrary web script or HTML via the name parameter to GroupSubscription.do.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/129803/ADSelfservice-Plus-5.1-Cross-Site-Scripting.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/99612; http://packetstormsecurity.com/files/129803/ADSelfservice-Plus-5.1-Cross-Site-Scripting.html
CVE: CVE-2014-8993
Published: 2015-01-07
Description: Cross-site scripting (XSS) vulnerability in the backend in Open-Xchange (OX) AppSuite before 7.4.2-rev40, 7.6.0 before 7.6.0-rev32, and 7.6.1 before 7.6.1-rev11 allows remote attackers to inject arbitrary web script or HTML via a crafted XHTML file with the application/xhtml+xml MIME type.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/129811/Open-Xchange-Server-6-OX-AppSuite-7.6.1-Cross-Site-Scripting.html; http://secunia.com/advisories/62031; http://www.securityfocus.com/archive/1/534383/100/0/threaded
CVE: CVE-2014-9567
Published: 2015-01-07
Description: Unrestricted file upload vulnerability in process-upload.php in ProjectSend (formerly cFTP) r100 through r561 allows remote attackers to execute arbitrary PHP code by uploading a file with a PHP extension, then accessing it via a direct request to the file in the upload/files/ or upload/temp/ directory.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://osvdb.org/show/osvdb/116469; http://packetstormsecurity.com/files/129759/ProjectSend-Arbitrary-File-Upload.html; http://www.exploit-db.com/exploits/35424
CVE: CVE-2014-1425
Published: 2015-01-07
Description: cmanager 0.32 does not properly enforce nesting when modifying cgroup properties, which allows local users to set cgroup values for all cgroups via unspecified vectors.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://www.ubuntu.com/usn/USN-2451-1; http://www.ubuntu.com/usn/USN-2451-1
CVE: CVE-2014-9221
Published: 2015-01-07
Description: strongSwan 4.5.x through 5.2.x before 5.2.1 allows remote attackers to cause a denial of service (invalid pointer dereference) via a crafted IKEv2 Key Exchange (KE) message with Diffie-Hellman (DH) group 1025.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-19
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-March/153825.html; http://lists.opensuse.org/opensuse-updates/2015-01/msg00054.html; http://secunia.com/advisories/62071
CVE: CVE-2014-9493
Published: 2015-01-07
Description: The V2 API in OpenStack Image Registry and Delivery Service (Glance) before 2014.2.2 and 2014.1.4 allows remote authenticated users to read or delete arbitrary files via a full pathname in a file: URL in the image location property.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-264
References: http://lists.openstack.org/pipermail/openstack-announce/2014-December/000317.html; http://rhn.redhat.com/errata/RHSA-2015-0246.html; http://www.oracle.com/technetwork/topics/security/bulletinjan2[PII_REDACTED].html
CVE: CVE-2014-9569
Published: 2015-01-07
Description: Multiple cross-site scripting (XSS) vulnerabilities in SAP NetWeaver Business Client (NWBC) for HTML 3.0 allow remote attackers to inject arbitrary web script or HTML via the (1) title or (2) roundtrips parameter, aka SAP Security Note 2051285.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/62017; http://www.securitytracker.com/id/1031509; http://www.senseofsecurity.com.au/advisories/SOS-14-005
CVE: CVE-2015-0361
Published: 2015-01-07
Description: Use-after-free vulnerability in Xen 4.2.x, 4.3.x, and 4.4.x allows remote domains to cause a denial of service (system crash) via a crafted hypercall during HVM guest teardown.
CVSS Score: 7.8 (HIGH)
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148103.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148241.html; http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00005.html
CVE: CVE-2014-9473
Published: 2015-01-08
Description: Unrestricted file upload vulnerability in lib_nonajax.php in the CformsII plugin 14.7 and earlier for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension via the cf_uploadfile2[] parameter, then accessing the file via a direct request to the file in the default upload directory.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/archive/1/534349/30/0/threaded; https://wordpress.org/plugins/cforms2/changelog/; http://www.securityfocus.com/archive/1/534349/30/0/threaded
CVE: CVE-2012-5853
Published: 2015-01-08
Description: SQL injection vulnerability in the "the_search_function" function in cardoza_ajax_search.php in the AJAX Post Search (cardoza-ajax-search) plugin before 1.3 for WordPress allows remote attackers to execute arbitrary SQL commands via the srch_txt parameter in a "the_search_text" action to wp-admin/admin-ajax.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://seclists.org/bugtraq/2012/Nov/33; https://wordpress.org/plugins/cardoza-ajax-search/changelog/; http://seclists.org/bugtraq/2012/Nov/33
CVE: CVE-2012-6684
Published: 2015-01-08
Description: Cross-site scripting (XSS) vulnerability in the RedCloth library 4.2.9 for Ruby and earlier allows remote attackers to inject arbitrary web script or HTML via a javascript: URI.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://co3k.org/blog/redcloth-unfixed-xss-en; http://jgarber.lighthouseapp.com/projects/13054-redcloth/tickets/243-xss; http://seclists.org/fulldisclosure/2014/Dec/50
CVE: CVE-2014-9575
Published: 2015-01-08
Description: VDG Security SENSE (formerly DIVA) before 2.3.15 allows remote attackers to bypass authentication, and consequently read and modify arbitrary plugin settings, via an encoded : (colon) character in the Authorization HTTP header.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-264
References: http://packetstormsecurity.com/files/129656/VDG-Security-SENSE-2.3.13-File-Disclosure-Bypass-Buffer-Overflow.html; http://seclists.org/fulldisclosure/2014/Dec/76; https://vdgsecurity.com/downloads/software/?file=1.+DIVA+2.3%2F2.+Changelog+2.3.16.txt
CVE: CVE-2014-9576
Published: 2015-01-08
Description: VDG Security SENSE (formerly DIVA) 2.3.13 has a hardcoded password of (1) ArpaRomaWi for the root Postgres account and !DVService for the (2) postgres and (3) NTP Windows user accounts, which allows remote attackers to obtain access.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://packetstormsecurity.com/files/129656/VDG-Security-SENSE-2.3.13-File-Disclosure-Bypass-Buffer-Overflow.html; http://seclists.org/fulldisclosure/2014/Dec/76; https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20141218-0_VDG_Security_SENSE_Multiple_critical_vulnerabilities_v10.txt
CVE: CVE-2014-9577
Published: 2015-01-08
Description: VDG Security SENSE (formerly DIVA) 2.3.13 sends the user database when a user logs in, which allows remote authenticated users to obtain usernames and password hashes by logging in to TCP port 51410 and reading the response.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://packetstormsecurity.com/files/129656/VDG-Security-SENSE-2.3.13-File-Disclosure-Bypass-Buffer-Overflow.html; http://seclists.org/fulldisclosure/2014/Dec/76; https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20141218-0_VDG_Security_SENSE_Multiple_critical_vulnerabilities_v10.txt
CVE: CVE-2014-9578
Published: 2015-01-08
Description: VDG Security SENSE (formerly DIVA) 2.3.13 performs authentication with a password hash instead of a password, which allows remote attackers to gain login access by leveraging knowledge of a password hash.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-287
References: http://packetstormsecurity.com/files/129656/VDG-Security-SENSE-2.3.13-File-Disclosure-Bypass-Buffer-Overflow.html; http://seclists.org/fulldisclosure/2014/Dec/76; https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20141218-0_VDG_Security_SENSE_Multiple_critical_vulnerabilities_v10.txt
CVE: CVE-2014-9579
Published: 2015-01-08
Description: VDG Security SENSE (formerly DIVA) 2.3.13 stores administrator credentials in cleartext, which allows attackers to obtain sensitive information by reading the plugin configuration files.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://packetstormsecurity.com/files/129656/VDG-Security-SENSE-2.3.13-File-Disclosure-Bypass-Buffer-Overflow.html; http://seclists.org/fulldisclosure/2014/Dec/76; https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20141218-0_VDG_Security_SENSE_Multiple_critical_vulnerabilities_v10.txt
CVE: CVE-2015-0917
Published: 2015-01-08
Description: Cross-site scripting (XSS) vulnerability in the backend in Kajona before 4.6.3 allows remote attackers to inject arbitrary web script or HTML via the action parameter to index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/129826/Kajona-CMS-4.6-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2015/Jan/11; http://sroesemann.blogspot.de/2015/01/report-for-advisory-sroeadv-2015-01.html
CVE: CVE-2015-0918
Published: 2015-01-08
Description: Cross-site scripting (XSS) vulnerability in the administrative backend in Sefrengo before 1.6.1 allows remote attackers to inject arbitrary web script or HTML via the searchterm parameter to backend/main.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://forum.sefrengo.org/index.php?showtopic=3360; http://packetstormsecurity.com/files/129825/Sefrengo-CMS-1.6.0-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2015/Jan/10
CVE: CVE-2015-0919
Published: 2015-01-08
Description: Multiple SQL injection vulnerabilities in the administrative backend in Sefrengo before 1.6.1 allow remote administrators to execute arbitrary SQL commands via the (1) idcat or (2) idclient parameter to backend/main.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://forum.sefrengo.org/index.php?showtopic=3360; http://packetstormsecurity.com/files/129824/Sefrengo-CMS-1.6.0-SQL-Injection.html; http://seclists.org/fulldisclosure/2015/Jan/9
CVE: CVE-2015-0920
Published: 2015-01-08
Description: Cross-site request forgery (CSRF) vulnerability in the Banner Effect Header plugin 1.2.6 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the banner_effect_email parameter in the BannerEffectOptions page to wp-admin/options-general.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.com/files/129804/WordPress-Banner-Effect-Header-1.2.6-XSS-CSRF.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/99613; https://exchange.xforce.ibmcloud.com/vulnerabilities/99614
CVE: CVE-2014-9580
Published: 2015-01-08
Description: Cross-site scripting (XSS) vulnerability in ProjectSend (formerly cFTP) r561 allows remote attackers to inject arbitrary web script or HTML via the Description field in a file upload.  NOTE: this issue was originally incorrectly mapped to CVE-2014-1155; see CVE-2014-1155 for more information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/129666; http://www.exploit-db.com/exploits/35582; https://exchange.xforce.ibmcloud.com/vulnerabilities/99550
CVE: CVE-2014-9581
Published: 2015-01-08
Description: Directory traversal vulnerability in components/filemanager/download.php in Codiad 2.4.3 allows remote attackers to read arbitrary files via a .. (dot dot) in the path parameter.  NOTE: this issue was originally incorrectly mapped to CVE-2014-1137; see CVE-2014-1137 for more information.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://www.exploit-db.com/exploits/35585; http://www.exploit-db.com/exploits/35585
CVE: CVE-2014-9582
Published: 2015-01-08
Description: Cross-site scripting (XSS) vulnerability in components/filemanager/dialog.php in Codiad 2.4.3 allows remote attackers to inject arbitrary web script or HTML via the short_name parameter in a rename action.  NOTE: this issue was originally incorrectly mapped to CVE-2014-1137; see CVE-2014-1137 for more information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.exploit-db.com/exploits/35585; http://www.exploit-db.com/exploits/35585
CVE: CVE-2014-9583
Published: 2015-01-08
Description: common.c in infosvr in ASUS WRT firmware 3.0.0.4.376_1071, 3.0.0.376.2524-g0013f52, and other versions, as used in RT-AC66U, RT-N66U, and other routers, does not properly check the MAC address for a request, which allows remote attackers to bypass authentication and execute arbitrary commands via a NET_CMD_ID_MANU_CMD packet to UDP port 9999.  NOTE: this issue was incorrectly mapped to CVE-2014-10000, but that ID is invalid due to its use as an example of the 2014 CVE ID syntax change.
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://packetstormsecurity.com/files/129815/ASUSWRT-3.0.0.4.376_1071-LAN-Backdoor-Command-Execution.html; http://www.exploit-db.com/exploits/35688; https://github.com/jduck/asus-cmd
CVE: CVE-2014-3570
Published: 2015-01-09
Description: The BN_sqr implementation in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k does not properly calculate the square of a BIGNUM value, which might make it easier for remote attackers to defeat cryptographic protection mechanisms via unspecified vectors, related to crypto/bn/asm/mips.pl, crypto/bn/asm/x86_64-gcc.c, and crypto/bn/bn_asm.c.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10679; http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-January/147938.html
CVE: CVE-2014-3571
Published: 2015-01-09
Description: OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted DTLS message that is processed with a different read operation for the handshake header than for the handshake body, related to the dtls1_get_record function in d1_pkt.c and the ssl3_read_n function in s3_pkt.c.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-January/147938.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148363.html
CVE: CVE-2014-3572
Published: 2015-01-09
Description: The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k allows remote SSL servers to conduct ECDHE-to-ECDH downgrade attacks and trigger a loss of forward secrecy by omitting the ServerKeyExchange message.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10679; http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00021.html
CVE: CVE-2014-8027
Published: 2015-01-09
Description: The RBAC component in Cisco Secure Access Control System (ACS) allows remote authenticated users to obtain Network Device Administrator privileges for Create, Delete, Read, and Update operations via crafted HTTP requests, aka Bug ID CSCuq79034.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/62159; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-8027; http://www.securityfocus.com/bid/71944
CVE: CVE-2014-8028
Published: 2015-01-09
Description: Multiple cross-site scripting (XSS) vulnerabilities in the web framework in Cisco Secure Access Control System (ACS) allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug ID CSCuq79019.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/62159; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-8028; http://www.securityfocus.com/bid/71946
CVE: CVE-2014-8029
Published: 2015-01-09
Description: Open redirect vulnerability in the web interface in Cisco Secure Access Control System (ACS) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via an unspecified parameter, aka Bug ID CSCuq74150.
CVSS Score: 5.8 (MEDIUM)
References: http://secunia.com/advisories/62159; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-8029; http://www.securityfocus.com/bid/71948
CVE: CVE-2014-8030
Published: 2015-01-09
Description: Cross-site scripting (XSS) vulnerability in sendPwMail.do in Cisco WebEx Meetings Server allows remote attackers to inject arbitrary web script or HTML via the email parameter, aka Bug ID CSCuj40381.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/62163; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-8030; http://www.securityfocus.com/bid/71945
CVE: CVE-2014-8031
Published: 2015-01-09
Description: Cross-site request forgery (CSRF) vulnerability in Cisco WebEx Meetings Server allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuj40456.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://secunia.com/advisories/62173; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-8031; http://www.securityfocus.com/bid/71943
CVE: CVE-2014-8032
Published: 2015-01-09
Description: The OutlookAction LI in Cisco WebEx Meetings Server allows remote authenticated users to obtain sensitive encrypted-password information via unspecified vectors, aka Bug IDs CSCuj40453 and CSCuj40449.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-8032; http://www.securityfocus.com/bid/71947; http://www.securitytracker.com/id/1031517
CVE: CVE-2014-8033
Published: 2015-01-09
Description: The play/modules component in Cisco WebEx Meetings Server allows remote attackers to obtain administrator access via crafted API requests, aka Bug ID CSCuj40421.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-287
References: http://secunia.com/advisories/60279; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-8033; http://www.securityfocus.com/bid/71950
CVE: CVE-2014-8275
Published: 2015-01-09
Description: OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k does not enforce certain constraints on certificate data, which allows remote attackers to defeat a fingerprint-based certificate-blacklist protection mechanism by including crafted data within a certificate's unsigned portion, related to crypto/asn1/a_verify.c, crypto/dsa/dsa_asn1.c, crypto/ecdsa/ecs_vrf.c, and crypto/x509/x_all.c.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10679; http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148363.html