deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-1371
Published: 2015-01-27
Description: Unrestricted file upload vulnerability in ferretCMS 1.0.4-alpha allows remote administrators to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in custom/uploads/.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://seclists.org/fulldisclosure/2015/Jan/98; http://sroesemann.blogspot.de/2015/01/report-for-advisory-sroeadv-2015-10.html; http://www.openwall.com/lists/oss-security/2015/01/23/3
CVE: CVE-2015-1372
Published: 2015-01-27
Description: SQL injection vulnerability in ferretCMS 1.0.4-alpha allows remote attackers to execute arbitrary SQL commands via the p parameter in an update action to admin.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://seclists.org/fulldisclosure/2015/Jan/98; http://sroesemann.blogspot.de/2015/01/report-for-advisory-sroeadv-2015-10.html; http://www.openwall.com/lists/oss-security/2015/01/23/3
CVE: CVE-2015-1373
Published: 2015-01-27
Description: Multiple cross-site scripting (XSS) vulnerabilities in admin.php in ferretCMS 1.0.4-alpha allow remote attackers to inject arbitrary web script or HTML via the (1) action parameter in a search request, (2) username in a login request, which is not properly handled when logging the event, or (3) page title in an insert action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2015/Jan/98; http://sroesemann.blogspot.de/2015/01/report-for-advisory-sroeadv-2015-10.html; http://www.openwall.com/lists/oss-security/2015/01/23/3
CVE: CVE-2015-1374
Published: 2015-01-27
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in admin.php in ferretCMS 1.0.4-alpha allow remote attackers to hijack the authentication of administrators for requests that conduct (1) cross-site scripting (XSS), (2) SQL injection, or (3) unrestricted file upload attacks.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2015/01/23/3; https://github.com/JRogaishio/ferretCMS/issues/63; http://www.openwall.com/lists/oss-security/2015/01/23/3
CVE: CVE-2014-5211
Published: 2015-01-27
Description: Stack-based buffer overflow in the Attachmate Reflection FTP Client before 14.1.433 allows remote FTP servers to execute arbitrary code via a large PWD response.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://secunia.com/advisories/62467; http://support.attachmate.com/techdocs/1708.html; http://support.attachmate.com/techdocs/2288.html
CVE: CVE-2014-8154
Published: 2015-01-27
Description: The Gst.MapInfo function in Vala 0.26.0 and 0.26.1 uses an incorrect buffer length declaration for the Gstreamer bindings, which allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via unspecified vectors, which trigger a heap-based buffer overflow.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-updates/2015-01/msg00069.html; https://bugzilla.redhat.com/show_bug.cgi?id=1177840; https://bugzilla.redhat.com/show_bug.cgi?id=1181404
CVE: CVE-2015-1182
Published: 2015-01-27
Description: The asn1_get_sequence_of function in library/asn1parse.c in PolarSSL 1.0 through 1.2.12 and 1.3.x through 1.3.9 does not properly initialize a pointer in the asn1_sequence linked list, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted ASN.1 sequence in a certificate.
CVSS Score: 7.5 (HIGH)
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148829.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148903.html; http://lists.opensuse.org/opensuse-updates/2015-02/msg00003.html
CVE: CVE-2015-1375
Published: 2015-01-28
Description: pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress does not properly restrict access to the upload functionality, which allows remote attackers to write to arbitrary files.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://packetstormsecurity.com/files/130017/WordPress-Pixarbay-Images-2.3-XSS-Bypass-Upload-Traversal.html; http://seclists.org/fulldisclosure/2015/Jan/75; http://www.exploit-db.com/exploits/35846
CVE: CVE-2015-1376
Published: 2015-01-28
Description: pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress does not validate hostnames, which allows remote authenticated users to write to arbitrary files via an upload URL with a host other than pixabay.com.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-284
References: http://packetstormsecurity.com/files/130017/WordPress-Pixarbay-Images-2.3-XSS-Bypass-Upload-Traversal.html; http://seclists.org/fulldisclosure/2015/Jan/75; http://www.exploit-db.com/exploits/35846
CVE: CVE-2015-1419
Published: 2015-01-28
Description: Unspecified vulnerability in vsftpd 3.0.2 and earlier allows remote attackers to bypass access restrictions via unknown vectors, related to deny_file parsing.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00023.html; http://lists.opensuse.org/opensuse-updates/2015-01/msg00041.html; http://secunia.com/advisories/62415
CVE: CVE-2015-0235
Published: 2015-01-28
Description: Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18, allows context-dependent attackers to execute arbitrary code via vectors related to the (1) gethostbyname or (2) gethostbyname2 function, aka "GHOST."
CVSS Score: 10.0 (HIGH)
CWE: CWE-787
References: http://blogs.sophos.com/2015/01/29/sophos-products-and-the-ghost-vulnerability-affecting-linux/; http://linux.oracle.com/errata/ELSA-2015-0090.html; http://linux.oracle.com/errata/ELSA-2015-0092.html
CVE: CVE-2014-8917
Published: 2015-01-28
Description: Multiple cross-site scripting (XSS) vulnerabilities in (1) dojox/form/resources/uploader.swf (aka upload.swf), (2) dojox/form/resources/fileuploader.swf (aka fileupload.swf), (3) dojox/av/resources/audio.swf, and (4) dojox/av/resources/video.swf in the IBM Dojo Toolkit, as used in IBM Social Media Analytics 1.3 before IF11 and other products, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/62590; http://secunia.com/advisories/62837; http://www-01.ibm.com/support/docview.wss?uid=swg21694693
CVE: CVE-2014-8920
Published: 2015-01-28
Description: Buffer overflow in the Data Transfer Program in IBM i Access 5770-XE1 5R4, 6.1, and 7.1 on Windows allows local users to gain privileges via unspecified vectors.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/62532; http://www-01.ibm.com/support/docview.wss?uid=nas8N1020518; https://exchange.xforce.ibmcloud.com/vulnerabilities/99311
CVE: CVE-2015-0312
Published: 2015-01-28
Description: Double free vulnerability in Adobe Flash Player before 13.0.0.264 and 14.x through 16.x before 16.0.0.296 on Windows and OS X and before 11.2.202.440 on Linux allows attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 9.3 (HIGH)
CWE: CWE-415
References: http://helpx.adobe.com/security/products/flash-player/apsb15-03.html; http://secunia.com/advisories/62432; http://secunia.com/advisories/62543
CVE: CVE-2015-0581
Published: 2015-01-28
Description: The XML parser in Cisco Prime Service Catalog before 10.1 allows remote authenticated users to read arbitrary files or cause a denial of service (CPU and memory consumption) via an external entity declaration in conjunction with an entity reference, as demonstrated by reading private keys, related to an XML External Entity (XXE) issue, aka Bug ID CSCup92880.
CVSS Score: 7.5 (HIGH)
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150128-psc-xmlee; http://www.securityfocus.com/bid/72350; http://www.securitytracker.com/id/1031658
CVE: CVE-2015-0586
Published: 2015-01-28
Description: The Network-Based Application Recognition (NBAR) protocol implementation in Cisco IOS 15.3(100)M and earlier on Cisco 2900 Integrated Services Router (aka Cisco Internet Router) devices allows remote attackers to cause a denial of service (NBAR process hang) via IPv4 packets, aka Bug ID CSCuo73682.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015-0586; http://tools.cisco.com/security/center/viewAlert.x?alertId=37171; http://www.securityfocus.com/bid/72309
CVE: CVE-2014-8893
Published: 2015-01-29
Description: Multiple cross-site scripting (XSS) vulnerabilities in (1) mainpage.jsp and (2) GetImageServlet.img in IBM TRIRIGA Application Platform 3.2.1.x, 3.3.2 before 3.3.2.3, and 3.4.1 before 3.4.1.1 allow remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://secunia.com/advisories/62674; http://www-01.ibm.com/support/docview.wss?uid=swg21694767; https://exchange.xforce.ibmcloud.com/vulnerabilities/99012
CVE: CVE-2014-8894
Published: 2015-01-29
Description: Open redirect vulnerability in IBM TRIRIGA Application Platform 3.2.1.x, 3.3.2 before 3.3.2.3, and 3.4.1 before 3.4.1.1 allows remote authenticated users to redirect users to arbitrary web sites and conduct phishing attacks via the out parameter.
CVSS Score: 4.9 (MEDIUM)
References: http://secunia.com/advisories/62674; http://www-01.ibm.com/support/docview.wss?uid=swg21694772; http://www.securityfocus.com/bid/72408
CVE: CVE-2014-8895
Published: 2015-01-29
Description: IBM TRIRIGA Application Platform 3.2.1.x, 3.3.2 before 3.3.2.3, and 3.4.1 before 3.4.1.1 allows remote attackers to bypass intended access restrictions and read the image files of arbitrary users via a crafted URL.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/62674; http://www-01.ibm.com/support/docview.wss?uid=swg21694771; http://www.securityfocus.com/bid/72430
CVE: CVE-2015-0236
Published: 2015-01-29
Description: libvirt before 1.2.12 allow remote authenticated users to obtain the VNC password by using the VIR_DOMAIN_XML_SECURE flag with a crafted (1) snapshot to the virDomainSnapshotGetXMLDesc interface or (2) image to the virDomainSaveImageGetXMLDesc interface.
CVSS Score: 3.5 (LOW)
CWE: CWE-200
References: http://advisories.mageia.org/MGASA-2015-0046.html; http://lists.opensuse.org/opensuse-updates/2015-02/msg00028.html; http://rhn.redhat.com/errata/RHSA-2015-0323.html
CVE: CVE-2015-1422
Published: 2015-01-29
Description: Multiple cross-site scripting (XSS) vulnerabilities in Gecko CMS 2.2 and 2.3 allow remote attackers to inject arbitrary web script or HTML via the (1) horder[], (2) jak_catid, (3) jak_content, (4) jak_css, (5) jak_delete_log[], (6) jak_email, (7) jak_extfile, (8) jak_file, (9) jak_hookshow[], (10) jak_img, (11) jak_javascript, (12) jak_lcontent, (13) jak_name, (14) jak_password, (15) jak_showcontact, (16) jak_tags, (17) jak_title, (18) jak_url, (19) jak_username, (20) real_hook_id[], (21) sp, (22) sreal_plugin_id[], (23) ssp, or (24) sssp parameter to admin/index.php or the (25) editor, (26) field_id, (27) fldr, (28) lang, (29) popup, (30) subfolder, or (31) type parameter to js/editor/plugins/filemanager/dialog.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/show/osvdb/116967; http://osvdb.org/show/osvdb/116969; http://osvdb.org/show/osvdb/116970
CVE: CVE-2015-1423
Published: 2015-01-29
Description: Multiple SQL injection vulnerabilities in Gecko CMS 2.2 and 2.3 allow remote administrators to execute arbitrary SQL commands via the (1) jak_delete_log[] or (2) ssp parameter to admin/index.php.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://osvdb.org/show/osvdb/116968; http://packetstormsecurity.com/files/129929/Gecko-CMS-2.2-2.3-CSRF-XSS-SQL-Injection.html; http://www.exploit-db.com/exploits/35767
CVE: CVE-2015-1424
Published: 2015-01-29
Description: Cross-site request forgery (CSRF) vulnerability in Gecko CMS 2.2 and 2.3 allows remote attackers to hijack the authentication of administrators for requests that add an administrator user via a newuser request to admin/index.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://osvdb.org/show/osvdb/116966; http://packetstormsecurity.com/files/129929/Gecko-CMS-2.2-2.3-CSRF-XSS-SQL-Injection.html; http://www.exploit-db.com/exploits/35767
CVE: CVE-2014-8370
Published: 2015-01-29
Description: VMware Workstation 10.x before 10.0.5, VMware Player 6.x before 6.0.5, VMware Fusion 6.x before 6.0.5, and VMware ESXi 5.0 through 5.5 allow host OS users to gain host OS privileges or cause a denial of service (arbitrary write to a file) by modifying a configuration file.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-264
References: http://jvn.jp/en/jp/JVN88252465/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000007; http://secunia.com/advisories/62551
CVE: CVE-2015-1043
Published: 2015-01-29
Description: The Host Guest File System (HGFS) in VMware Workstation 10.x before 10.0.5, VMware Player 6.x before 6.0.5, and VMware Fusion 6.x before 6.0.5 and 7.x before 7.0.1 allows guest OS users to cause a guest OS denial of service via unspecified vectors.
CVSS Score: 3.3 (LOW)
CWE: CWE-20
References: http://secunia.com/advisories/62551; http://www.securityfocus.com/bid/72337; http://www.securitytracker.com/id/1031644
CVE: CVE-2015-1044
Published: 2015-01-29
Description: vmware-authd (aka the Authorization process) in VMware Workstation 10.x before 10.0.5, VMware Player 6.x before 6.0.5, and VMware ESXi 5.0 through 5.5 allows attackers to cause a host OS denial of service via unspecified vectors.
CVSS Score: 3.3 (LOW)
References: http://secunia.com/advisories/62551; http://secunia.com/advisories/62569; http://secunia.com/advisories/62669
CVE: CVE-2014-4467
Published: 2015-01-30
Description: WebKit, as used in Apple iOS before 8.1.3, does not properly determine scrollbar boundaries during the rendering of FRAME elements, which allows remote attackers to spoof the UI via a crafted web site.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-17
References: http://lists.apple.com/archives/security-announce/2015/Jan/msg00001.html; http://support.apple.com/HT204245; http://lists.apple.com/archives/security-announce/2015/Jan/msg00001.html
CVE: CVE-2014-4476
Published: 2015-01-30
Description: WebKit, as used in Apple iOS before 8.1.3; Apple Safari before 6.2.3, 7.x before 7.1.3, and 8.x before 8.0.3; and Apple TV before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2014-4477 and CVE-2014-4479.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2015/Jan/msg00000.html; http://lists.apple.com/archives/security-announce/2015/Jan/msg00001.html; http://lists.apple.com/archives/security-announce/2015/Jan/msg00002.html
CVE: CVE-2014-4477
Published: 2015-01-30
Description: WebKit, as used in Apple iOS before 8.1.3; Apple Safari before 6.2.3, 7.x before 7.1.3, and 8.x before 8.0.3; and Apple TV before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2014-4476 and CVE-2014-4479.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2015/Jan/msg00000.html; http://lists.apple.com/archives/security-announce/2015/Jan/msg00001.html; http://lists.apple.com/archives/security-announce/2015/Jan/msg00002.html
CVE: CVE-2014-4479
Published: 2015-01-30
Description: WebKit, as used in Apple iOS before 8.1.3; Apple Safari before 6.2.3, 7.x before 7.1.3, and 8.x before 8.0.3; and Apple TV before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2014-4476 and CVE-2014-4477.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2015/Jan/msg00000.html; http://lists.apple.com/archives/security-announce/2015/Jan/msg00001.html; http://lists.apple.com/archives/security-announce/2015/Jan/msg00002.html
CVE: CVE-2014-4480
Published: 2015-01-30
Description: Directory traversal vulnerability in afc in AppleFileConduit in Apple iOS before 8.1.3 and Apple TV before 7.0.3 allows attackers to access unintended filesystem locations by creating a symlink.
CVSS Score: 10.0 (HIGH)
CWE: CWE-59
References: http://lists.apple.com/archives/security-announce/2015/Jan/msg00000.html; http://lists.apple.com/archives/security-announce/2015/Jan/msg00001.html; http://support.apple.com/HT204245
CVE: CVE-2014-4481
Published: 2015-01-30
Description: Integer overflow in CoreGraphics in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted PDF document.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-189
References: http://lists.apple.com/archives/security-announce/2015/Jan/msg00000.html; http://lists.apple.com/archives/security-announce/2015/Jan/msg00001.html; http://lists.apple.com/archives/security-announce/2015/Jan/msg00003.html
CVE: CVE-2014-4483
Published: 2015-01-30
Description: Buffer overflow in FontParser in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted font file in a PDF document.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2015/Jan/msg00000.html; http://lists.apple.com/archives/security-announce/2015/Jan/msg00001.html; http://lists.apple.com/archives/security-announce/2015/Jan/msg00003.html
CVE: CVE-2014-4484
Published: 2015-01-30
Description: FontParser in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted .dfont file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-19
References: http://lists.apple.com/archives/security-announce/2015/Jan/msg00000.html; http://lists.apple.com/archives/security-announce/2015/Jan/msg00001.html; http://lists.apple.com/archives/security-announce/2015/Jan/msg00003.html
CVE: CVE-2014-4485
Published: 2015-01-30
Description: Buffer overflow in the XML parser in Foundation in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted XML document.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2015/Jan/msg00000.html; http://lists.apple.com/archives/security-announce/2015/Jan/msg00001.html; http://lists.apple.com/archives/security-announce/2015/Jan/msg00003.html
CVE: CVE-2014-4486
Published: 2015-01-30
Description: IOAcceleratorFamily in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 does not properly handle resource lists and IOService userclient types, which allows attackers to execute arbitrary code or cause a denial of service (NULL pointer dereference) via a crafted app.
CVSS Score: 10.0 (HIGH)
References: http://lists.apple.com/archives/security-announce/2015/Jan/msg00000.html; http://lists.apple.com/archives/security-announce/2015/Jan/msg00001.html; http://lists.apple.com/archives/security-announce/2015/Jan/msg00003.html
CVE: CVE-2014-4487
Published: 2015-01-30
Description: Buffer overflow in IOHIDFamily in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 allows attackers to execute arbitrary code in a privileged context via a crafted app.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2015/Jan/msg00000.html; http://lists.apple.com/archives/security-announce/2015/Jan/msg00001.html; http://lists.apple.com/archives/security-announce/2015/Jan/msg00003.html
CVE: CVE-2014-4488
Published: 2015-01-30
Description: IOHIDFamily in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 does not properly validate resource-queue metadata, which allows attackers to execute arbitrary code in a privileged context via a crafted app.
CVSS Score: 10.0 (HIGH)
CWE: CWE-19
References: http://lists.apple.com/archives/security-announce/2015/Jan/msg00000.html; http://lists.apple.com/archives/security-announce/2015/Jan/msg00001.html; http://lists.apple.com/archives/security-announce/2015/Jan/msg00003.html
CVE: CVE-2014-4489
Published: 2015-01-30
Description: IOHIDFamily in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 does not properly initialize event queues, which allows attackers to execute arbitrary code in a privileged context or cause a denial of service (NULL pointer dereference) via a crafted app.
CVSS Score: 10.0 (HIGH)
References: http://lists.apple.com/archives/security-announce/2015/Jan/msg00000.html; http://lists.apple.com/archives/security-announce/2015/Jan/msg00001.html; http://lists.apple.com/archives/security-announce/2015/Jan/msg00003.html
CVE: CVE-2014-4491
Published: 2015-01-30
Description: The extension APIs in the kernel in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 do not prevent the presence of addresses within an OSBundleMachOHeaders key in a response, which makes it easier for attackers to bypass the ASLR protection mechanism via a crafted app.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://lists.apple.com/archives/security-announce/2015/Jan/msg00000.html; http://lists.apple.com/archives/security-announce/2015/Jan/msg00001.html; http://lists.apple.com/archives/security-announce/2015/Jan/msg00003.html
CVE: CVE-2014-4492
Published: 2015-01-30
Description: libnetcore in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 does not verify that certain values have the expected data type, which allows attackers to execute arbitrary code in an _networkd context via a crafted XPC message from a sandboxed app, as demonstrated by lack of verification of the XPC dictionary data type.
CVSS Score: 7.5 (HIGH)
CWE: CWE-19
References: http://lists.apple.com/archives/security-announce/2015/Jan/msg00000.html; http://lists.apple.com/archives/security-announce/2015/Jan/msg00001.html; http://lists.apple.com/archives/security-announce/2015/Jan/msg00003.html
CVE: CVE-2014-4493
Published: 2015-01-30
Description: The app-installation functionality in MobileInstallation in Apple iOS before 8.1.3 allows attackers to obtain control of the local app container by leveraging access to an enterprise distribution certificate for signing a crafted app.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce/2015/Jan/msg00001.html; http://support.apple.com/HT204245; http://www.securitytracker.com/id/1031652
CVE: CVE-2014-4494
Published: 2015-01-30
Description: Springboard in Apple iOS before 8.1.3 does not properly validate signatures when determining whether to solicit an app trust decision from the user, which allows attackers to bypass intended first-launch restrictions by leveraging access to an enterprise distribution certificate for signing a crafted app.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://lists.apple.com/archives/security-announce/2015/Jan/msg00001.html; http://support.apple.com/HT204245; http://www.securitytracker.com/id/1031652
CVE: CVE-2014-4495
Published: 2015-01-30
Description: The kernel in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 does not enforce the read-only attribute of a shared memory segment during use of a custom cache mode, which allows attackers to bypass intended access restrictions via a crafted app.
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce/2015/Jan/msg00000.html; http://lists.apple.com/archives/security-announce/2015/Jan/msg00001.html; http://lists.apple.com/archives/security-announce/2015/Jan/msg00003.html