deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-1289
Published: 2014-03-14
Description: WebKit, as used in Apple iOS before 7.1 and Apple TV before 6.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2014-1290, CVE-2014-1291, CVE-2014-1292, CVE-2014-1293, and CVE-2014-1294.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2014-04/0009.html; http://support.apple.com/kb/HT6162; http://support.apple.com/kb/HT6163
CVE: CVE-2014-1290
Published: 2014-03-14
Description: WebKit, as used in Apple iOS before 7.1 and Apple TV before 6.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2014-1289, CVE-2014-1291, CVE-2014-1292, CVE-2014-1293, and CVE-2014-1294.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2014-04/0009.html; http://support.apple.com/kb/HT6162; http://support.apple.com/kb/HT6163
CVE: CVE-2014-1291
Published: 2014-03-14
Description: WebKit, as used in Apple iOS before 7.1 and Apple TV before 6.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2014-1289, CVE-2014-1290, CVE-2014-1292, CVE-2014-1293, and CVE-2014-1294.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2014-04/0009.html; http://support.apple.com/kb/HT6162; http://support.apple.com/kb/HT6163
CVE: CVE-2014-1292
Published: 2014-03-14
Description: WebKit, as used in Apple iOS before 7.1 and Apple TV before 6.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2014-1289, CVE-2014-1290, CVE-2014-1291, CVE-2014-1293, and CVE-2014-1294.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2014-04/0009.html; http://support.apple.com/kb/HT6162; http://support.apple.com/kb/HT6163
CVE: CVE-2014-1293
Published: 2014-03-14
Description: WebKit, as used in Apple iOS before 7.1 and Apple TV before 6.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2014-1289, CVE-2014-1290, CVE-2014-1291, CVE-2014-1292, and CVE-2014-1294.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2014-04/0009.html; http://support.apple.com/kb/HT6162; http://support.apple.com/kb/HT6163
CVE: CVE-2014-1294
Published: 2014-03-14
Description: WebKit, as used in Apple iOS before 7.1 and Apple TV before 6.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2014-1289, CVE-2014-1290, CVE-2014-1291, CVE-2014-1292, and CVE-2014-1293.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2014-04/0009.html; http://support.apple.com/kb/HT6162; http://support.apple.com/kb/HT6163
CVE: CVE-2014-2265
Published: 2014-03-14
Description: Rock Lobster Contact Form 7 before 3.7.2 allows remote attackers to bypass the CAPTCHA protection mechanism and submit arbitrary form data by omitting the _wpcf7_captcha_challenge_captcha-719 parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://contactform7.com/2014/02/26/contact-form-7-372/; http://web.archive.org/web/[PII_REDACTED]3642/http://www.hedgehogsecurity.co.uk/2014/02/26/contactform7-vulnerability/; http://wordpress.org/plugins/contact-form-7/changelog
CVE: CVE-2014-2319
Published: 2014-03-14
Description: The Encrypt Files feature in ConeXware PowerArchiver before 14.02.05 uses legacy ZIP encryption even if the AES 256-bit selection is chosen, which makes it easier for context-dependent attackers to obtain sensitive information via a known-plaintext attack.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://int21.de/cve/CVE-2014-2319-powerarchiver.html; http://www.powerarchiver.com/2014/03/12/powerarchiver-2013-14-02-05-released/; http://int21.de/cve/CVE-2014-2319-powerarchiver.html
CVE: CVE-2013-1758
Published: 2014-03-14
Description: Cross-site scripting (XSS) vulnerability in the Marekkis Watermark plugin 0.9.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the pfad parameter to wp-admin/options-general.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2013-02/0084.html; http://osvdb.org/90362; http://packetstormsecurity.com/files/120378/WordPress-Marekkis-Watermark-Cross-Site-Scripting.html
CVE: CVE-2013-1759
Published: 2014-03-14
Description: Cross-site scripting (XSS) vulnerability in the Responsive Logo Slideshow plugin for WordPress allows remote attackers to inject arbitrary web script or HTML via the "URL and Image" field.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2013-02/0085.html; http://osvdb.org/90406; http://packetstormsecurity.com/files/120379/WordPress-Responsive-Logo-Slideshow-Cross-Site-Scripting.html
CVE: CVE-2013-2507
Published: 2014-03-14
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Brother MFC-9970CDW printer with firmware G (1.03) allow remote attackers to inject arbitrary web script or HTML via the (1) id parameter to admin/log_to_net.html or (2) kind parameter to fax/copy_settings.html, a different vulnerability than CVE-2013-2670 and CVE-2013-2671.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/93066; http://osvdb.org/93067; http://osvdb.org/ref/93/brother-mfc-9970cdw-firmware-g-v103-by-hoyt-03072013.html
CVE: CVE-2013-2670
Published: 2014-03-14
Description: Cross-site scripting (XSS) vulnerability in the Brother MFC-9970CDW printer with firmware G (1.03) and L (1.10) allows remote attackers to inject arbitrary web script or HTML via an arbitrary parameter name (QUERY_STRING) to admin/admin_main.html, a different vulnerability than CVE-2013-2507 and CVE-2013-2671.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/93068; http://osvdb.org/ref/93/brother-mfc-9970cdw-firmware-g-v103-by-hoyt-03072013.html; http://osvdb.org/ref/93/brother-mfc9970cdw-firmware-l-110-hoytllc-report.html
CVE: CVE-2013-2671
Published: 2014-03-14
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Brother MFC-9970CDW printer with firmware L (1.10) allow remote attackers to inject arbitrary web script or HTML via the (1) id or (2) val parameter to admin/admin_main.html; (3) id, (4) val, or (5) arbitrary parameter name (QUERY_STRING) to admin/profile_settings_net.html; or (6) kind or (7) arbitrary parameter name (QUERY_STRING) to fax/general_setup.html, a different vulnerability than CVE-2013-2507 and CVE-2013-2670.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/93092; http://osvdb.org/93093; http://osvdb.org/ref/93/brother-mfc9970cdw-firmware-l-110-hoytllc-report.html
CVE: CVE-2014-2024
Published: 2014-03-14
Description: Cross-site scripting (XSS) vulnerability in classes/controller/error.php in Open Classifieds 2 before 2.1.3 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to shared-apartments-rooms/.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/archive/1/531428/100/0/threaded; https://github.com/open-classifieds/openclassifieds2/commit/45ee8fb601a91b8a[PII_REDACTED]a32a4fd8d96ef9; https://github.com/open-classifieds/openclassifieds2/issues/556
CVE: CVE-2014-2325
Published: 2014-03-14
Description: Multiple cross-site scripting (XSS) vulnerabilities in Proxmox Mail Gateway before 3.1-5829 allow remote attackers to inject arbitrary web script or HTML via the (1) state parameter to objects/who/index.htm or (2) User email address to quarantine/spam/manage.htm.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://proxmox.com/news/archive/view/listid-1-proxmox-newsletter/mailid-48-proxmox-newsletter-march-2014-proxmox-ve-3-2-released/tmpl-component; http://seclists.org/fulldisclosure/2014/Mar/110; http://www.securityfocus.com/bid/66169
CVE: CVE-2013-0297
Published: 2014-03-14
Description: Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.12 and 4.5.x before 4.5.7 allow remote authenticated administrators to inject arbitrary web script or HTML via the (1) site_name or (2) site_url parameter to apps/external/ajax/setsites.php.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://owncloud.org/about/security/advisories/oC-SA-2013-003/; http://owncloud.org/about/security/advisories/oC-SA-2013-003/
CVE: CVE-2013-0298
Published: 2014-03-14
Description: Multiple cross-site scripting (XSS) vulnerabilities in ownCloud 4.5.x before 4.5.7 allow remote attackers to inject arbitrary web script or HTML via (1) a crafted iCalendar file to the calendar application, the (2) dir or (3) file parameter to apps/files_pdfviewer/viewer.php, or the (4) mountpoint parameter to /apps/files_external/addMountPoint.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://owncloud.org/about/security/advisories/oC-SA-2013-003/; http://owncloud.org/about/security/advisories/oC-SA-2013-003/
CVE: CVE-2013-0307
Published: 2014-03-14
Description: Cross-site scripting (XSS) vulnerability in settings.php in ownCloud before 4.0.12 and 4.5.x before 4.5.7 allows remote administrators to inject arbitrary web script or HTML via the group input field parameter.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://owncloud.org/about/security/advisories/oC-SA-2013-003/; http://owncloud.org/about/security/advisories/oC-SA-2013-003/
CVE: CVE-2013-6473
Published: 2014-03-14
Description: Multiple heap-based buffer overflows in the urftopdf filter in cups-filters 1.0.25 before 1.0.47 allow remote attackers to execute arbitrary code via a large (1) page or (2) line in a URF file.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://bzr.linuxfoundation.org/loggerhead/openprinting/cups-filters/revision/7175; http://www.securityfocus.com/bid/66601; http://www.ubuntu.com/usn/USN-2143-1
CVE: CVE-2013-6474
Published: 2014-03-14
Description: Heap-based buffer overflow in the pdftoopvp filter in CUPS and cups-filters before 1.0.47 allows remote attackers to execute arbitrary code via a crafted PDF file.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://bzr.linuxfoundation.org/loggerhead/openprinting/cups-filters/revision/7176; http://www.debian.org/security/2014/dsa-2875; http://www.debian.org/security/2014/dsa-2876
CVE: CVE-2013-6475
Published: 2014-03-14
Description: Multiple integer overflows in (1) OPVPOutputDev.cxx and (2) oprs/OPVPSplash.cxx in the pdftoopvp filter in CUPS and cups-filters before 1.0.47 allow remote attackers to execute arbitrary code via a crafted PDF file, which triggers a heap-based buffer overflow.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-189
References: http://bzr.linuxfoundation.org/loggerhead/openprinting/cups-filters/revision/7176; http://www.debian.org/security/2014/dsa-2875; http://www.debian.org/security/2014/dsa-2876
CVE: CVE-2013-6476
Published: 2014-03-14
Description: The OPVPWrapper::loadDriver function in oprs/OPVPWrapper.cxx in the pdftoopvp filter in CUPS and cups-filters before 1.0.47 allows local users to gain privileges via a Trojan horse driver in the same directory as the PDF file.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-264
References: http://bzr.linuxfoundation.org/loggerhead/openprinting/cups-filters/revision/7176; http://www.debian.org/security/2014/dsa-2875; http://www.debian.org/security/2014/dsa-2876
CVE: CVE-2014-0017
Published: 2014-03-14
Description: The RAND_bytes function in libssh before 0.6.3, when forking is enabled, does not properly reset the state of the OpenSSL pseudo-random number generator (PRNG), which causes the state to be shared between children processes and allows local users to obtain sensitive information by leveraging a pid collision.
CVSS Score: 1.9 (LOW)
CWE: CWE-310
References: http://lists.opensuse.org/opensuse-updates/2014-03/msg00036.html; http://lists.opensuse.org/opensuse-updates/2014-03/msg00040.html; http://secunia.com/advisories/57407
CVE: CVE-2014-0467
Published: 2014-03-14
Description: Buffer overflow in copy.c in Mutt before 1.5.23 allows remote attackers to cause a denial of service (crash) via a crafted RFC2047 header line, related to address expansion.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00001.html; http://lists.opensuse.org/opensuse-updates/2014-03/msg00083.html; http://lists.opensuse.org/opensuse-updates/2014-03/msg00085.html
CVE: CVE-2014-2270
Published: 2014-03-14
Description: softmagic.c in file before 5.17 and libmagic allows context-dependent attackers to cause a denial of service (out-of-bounds memory access and crash) via crafted offsets in the softmagic of a PE executable.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://bugs.gw.com/view.php?id=313; http://lists.opensuse.org/opensuse-updates/2014-03/msg00034.html; http://lists.opensuse.org/opensuse-updates/2014-03/msg00037.html
CVE: CVE-2014-2291
Published: 2014-03-14
Description: Cross-site scripting (XSS) vulnerability in the Pulse Collaboration (Secure Meeting) user pages in Juniper Junos Pulse Secure Access Service (aka SSL VPN) with IVE OS before 7.1r18, 7.3 before 7.3r10, 7.4 before 7.4r8, and 8.0 before 8.0r1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://secunia.com/advisories/57375; https://exchange.xforce.ibmcloud.com/vulnerabilities/91770; https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10617
CVE: CVE-2014-2292
Published: 2014-03-14
Description: Unspecified vulnerability in the Linux Network Connect client in Juniper Junos Pulse Secure Access Service (aka SSL VPN) with IVE OS before 7.1r18, 7.3 before 7.3r10, 7.4 before 7.4r8, and 8.0 before 8.0r1 allows local users to gain privileges via unspecified vectors.
CVSS Score: 7.2 (HIGH)
References: https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10616; https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10616
CVE: CVE-2014-2323
Published: 2014-03-14
Description: SQL injection vulnerability in mod_mysql_vhost.c in lighttpd before 1.4.35 allows remote attackers to execute arbitrary SQL commands via the host name, related to request_check_hostname.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2014_01.txt; http://jvn.jp/en/jp/JVN37417423/index.html; http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00023.html
CVE: CVE-2014-2324
Published: 2014-03-14
Description: Multiple directory traversal vulnerabilities in (1) mod_evhost and (2) mod_simple_vhost in lighttpd before 1.4.35 allow remote attackers to read arbitrary files via a .. (dot dot) in the host name, related to request_check_hostname.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2014_01.txt; http://jvn.jp/en/jp/JVN37417423/index.html; http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00023.html
CVE: CVE-2012-0891
Published: 2014-03-14
Description: Multiple cross-site scripting (XSS) vulnerabilities in Puppet Dashboard 1.0 before 1.2.5 and Enterprise 1.0 before 1.2.5 and 2.x before 2.0.1 allow remote attackers to inject arbitrary web script or HTML via unspecified fields.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://puppetlabs.com/security/cve/cve-2012-0891; http://puppetlabs.com/security/cve/cve-2012-0891
CVE: CVE-2012-5158
Published: 2014-03-14
Description: Puppet Enterprise (PE) before 2.6.1 does not properly invalidate sessions when the session secret has changed, which allows remote authenticated users to retain access via unspecified vectors.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-287
References: http://puppetlabs.com/security/cve/cve-2012-5158; http://puppetlabs.com/security/cve/cve-2012-5158
CVE: CVE-2013-1398
Published: 2014-03-14
Description: The pe_mcollective module in Puppet Enterprise (PE) before 2.7.1 does not properly restrict access to a catalog of private SSL keys, which allows remote authenticated users to obtain sensitive information and gain privileges by leveraging root access to a node, related to the master role.
CVSS Score: 8.5 (HIGH)
CWE: CWE-310
References: http://puppetlabs.com/security/cve/cve-2013-1398; http://puppetlabs.com/security/cve/cve-2013-1398
CVE: CVE-2013-1399
Published: 2014-03-14
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the (1) node request management, (2) live management, and (3) user administration components in the console in Puppet Enterprise (PE) before 2.7.1 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: https://puppetlabs.com/security/cve/cve-2013-1399; https://puppetlabs.com/security/cve/cve-2013-1399
CVE: CVE-2013-1822
Published: 2014-03-14
Description: Multiple cross-site scripting (XSS) vulnerabilities in ownCloud 4.5.x before 4.5.8 allow remote authenticated users with administrator privileges to inject arbitrary web script or HTML via the (1) quota parameter to /core/settings/ajax/setquota.php, or remote authenticated users with group admin privileges to inject arbitrary web script or HTML via the (2) group field to settings.php or (3) "share with" field.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://owncloud.org/about/security/advisories/oC-SA-2013-008/; http://owncloud.org/about/security/advisories/oC-SA-2013-008/
CVE: CVE-2013-1850
Published: 2014-03-14
Description: Multiple incomplete blacklist vulnerabilities in (1) import.php and (2) ajax/uploadimport.php in apps/contacts/ in ownCloud before 4.0.13 and 4.5.x before 4.5.8 allow remote authenticated users to execute arbitrary PHP code by uploading a .htaccess file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-94
References: http://owncloud.org/about/security/advisories/oC-SA-2013-009/; http://owncloud.org/about/security/advisories/oC-SA-2013-009/
CVE: CVE-2013-1851
Published: 2014-03-14
Description: Incomplete blacklist vulnerability in lib/migrate.php in ownCloud before 4.0.13 and 4.5.x before 4.5.8, when the user_migrate application is enabled, allows remote authenticated users to import arbitrary files to the user's account via unspecified vectors.
CVSS Score: 3.5 (LOW)
References: http://owncloud.org/about/security/advisories/oC-SA-2013-010/; http://owncloud.org/about/security/advisories/oC-SA-2013-010/
CVE: CVE-2013-1939
Published: 2014-03-14
Description: The HTML\Browser plugin in SabreDAV before 1.6.9, 1.7.x before 1.7.7, and 1.8.x before 1.8.5, as used in ownCloud, when running on Windows, does not properly check path separators in the base path, which allows remote attackers to read arbitrary files via a \ (backslash) character.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://owncloud.org/about/security/advisories/oC-SA-2013-016/; https://groups.google.com/forum/?fromgroups=#%21topic/sabredav-discuss/ehOUu7wTSGQ; http://owncloud.org/about/security/advisories/oC-SA-2013-016/
CVE: CVE-2013-1963
Published: 2014-03-14
Description: The contacts application in ownCloud before 4.5.10 and 5.x before 5.0.5 does not properly check the ownership of contacts, which allows remote authenticated users to download arbitrary contacts via unspecified vectors.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://owncloud.org/about/security/advisories/oC-SA-2013-018/; http://owncloud.org/about/security/advisories/oC-SA-2013-018/
CVE: CVE-2013-2039
Published: 2014-03-14
Description: Directory traversal vulnerability in lib/files/view.php in ownCloud before 4.0.15, 4.5.x 4.5.11, and 5.x before 5.0.6 allows remote authenticated users to access arbitrary files via unspecified vectors.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-22
References: http://owncloud.org/about/security/advisories/oC-SA-2013-020/; http://owncloud.org/about/security/advisories/oC-SA-2013-020/
CVE: CVE-2013-2040
Published: 2014-03-14
Description: Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.15, 4.5.x before 4.5.11, and 5.0.x before 5.0.6 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://owncloud.org/about/security/advisories/oC-SA-2013-021/; http://owncloud.org/about/security/advisories/oC-SA-2013-021/
CVE: CVE-2013-2041
Published: 2014-03-14
Description: Multiple cross-site scripting (XSS) vulnerabilities in ownCloud 5.0.x before 5.0.6 allow remote authenticated users to inject arbitrary web script or HTML via the (1) tag parameter to apps/bookmarks/ajax/addBookmark.php or (2) dir parameter to apps/files/ajax/newfile.php, which is passed to apps/files/js/files.js.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://owncloud.org/about/security/advisories/oC-SA-2013-021/; http://owncloud.org/about/security/advisories/oC-SA-2013-021/
CVE: CVE-2013-2042
Published: 2014-03-14
Description: Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.15, 4.5.x before 4.5.11, and 5.0.x before 5.0.6 allow remote authenticated users to inject arbitrary web script or HTML via the url parameter to (1) apps/bookmarks/ajax/addBookmark.php or (2) apps/bookmarks/ajax/editBookmark.php.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://owncloud.org/about/security/advisories/oC-SA-2013-021/; http://owncloud.org/about/security/advisories/oC-SA-2013-021/
CVE: CVE-2013-2043
Published: 2014-03-14
Description: apps/calendar/ajax/events.php in ownCloud before 4.5.11 and 5.x before 5.0.6 does not properly check the ownership of a calendar, which allows remote authenticated users to download arbitrary calendars via the calendar_id parameter.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://owncloud.org/about/security/advisories/oC-SA-2013-024/; http://owncloud.org/about/security/advisories/oC-SA-2013-024/
CVE: CVE-2013-2044
Published: 2014-03-14
Description: Open redirect vulnerability in the Login Page (index.php) in ownCloud before 5.0.6 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the redirect_url parameter.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://owncloud.org/about/security/advisories/oC-SA-2013-022/; http://owncloud.org/about/security/advisories/oC-SA-2013-022/
CVE: CVE-2013-2047
Published: 2014-03-14
Description: The login page (aka index.php) in ownCloud before 5.0.6 does not disable the autocomplete setting for the password parameter, which makes it easier for physically proximate attackers to guess the password.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://owncloud.org/about/security/advisories/oC-SA-2013-023/; http://owncloud.org/about/security/advisories/oC-SA-2013-023/
CVE: CVE-2013-2048
Published: 2014-03-14
Description: ownCloud before 5.0.6 does not properly check permissions, which allows remote authenticated users to execute arbitrary API commands via unspecified vectors.  NOTE: this can be leveraged using CSRF to allow remote attackers to execute arbitrary API commands.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://owncloud.org/about/security/advisories/oC-SA-2013-025/; http://owncloud.org/about/security/advisories/oC-SA-2013-025/
CVE: CVE-2013-2085
Published: 2014-03-14
Description: Directory traversal vulnerability in apps/files_trashbin/index.php in ownCloud Server before 5.0.6 allows remote authenticated users to access arbitrary files via a .. (dot dot) in the dir parameter.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-22
References: http://owncloud.org/about/security/advisories/oC-SA-2013-020/; http://owncloud.org/about/security/advisories/oC-SA-2013-020/