deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-1489
Published: 2014-02-06
Description: Mozilla Firefox before 27.0 does not properly restrict access to about:home buttons by script on other pages, which allows user-assisted remote attackers to cause a denial of service (session restore) via a crafted web site.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00004.html; http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00010.html; http://osvdb.org/102874
CVE: CVE-2014-1490
Published: 2014-02-06
Description: Race condition in libssl in Mozilla Network Security Services (NSS) before 3.15.4, as used in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, SeaMonkey before 2.24, and other products, allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via vectors involving a resumption handshake that triggers incorrect replacement of a session ticket.
CVSS Score: 9.3 (HIGH)
CWE: CWE-362
References: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761; http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127966.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-February/129218.html
CVE: CVE-2014-1491
Published: 2014-02-06
Description: Mozilla Network Security Services (NSS) before 3.15.4, as used in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, SeaMonkey before 2.24, and other products, does not properly restrict public values in Diffie-Hellman key exchanges, which makes it easier for remote attackers to bypass cryptographic protection mechanisms in ticket handling by leveraging use of a certain value.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-326
References: http://hg.mozilla.org/projects/nss/rev/12c42006aed8; http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761; http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127966.html
CVE: CVE-2012-6152
Published: 2014-02-06
Description: The Yahoo! protocol plugin in libpurple in Pidgin before 2.10.8 does not properly validate UTF-8 data, which allows remote attackers to cause a denial of service (application crash) via crafted byte sequences.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://hg.pidgin.im/pidgin/main/rev/b0345c25f886; http://lists.opensuse.org/opensuse-updates/2014-02/msg00039.html; http://lists.opensuse.org/opensuse-updates/2014-03/msg00005.html
CVE: CVE-2013-5983
Published: 2014-02-06
Description: Multiple cross-site scripting (XSS) vulnerabilities in GuppY before 4.6.28 allow remote attackers to inject arbitrary web script or HTML via the (1) "an" parameter to agenda.php or (2) cat parameter to mobile/thread.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2013-10/0111.html; http://osvdb.org/98841; http://osvdb.org/98880
CVE: CVE-2013-6477
Published: 2014-02-06
Description: Multiple integer signedness errors in libpurple in Pidgin before 2.10.8 allow remote attackers to cause a denial of service (application crash) via a crafted timestamp value in an XMPP message.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://hg.pidgin.im/pidgin/main/rev/852014ae74a0; http://lists.opensuse.org/opensuse-updates/2014-02/msg00039.html; http://lists.opensuse.org/opensuse-updates/2014-03/msg00005.html
CVE: CVE-2013-6478
Published: 2014-02-06
Description: gtkimhtml.c in Pidgin before 2.10.8 does not properly interact with underlying library support for wide Pango layouts, which allows user-assisted remote attackers to cause a denial of service (application crash) via a long URL that is examined with a tooltip.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://hg.pidgin.im/pidgin/main/rev/2bb66ef1475e; http://lists.opensuse.org/opensuse-updates/2014-02/msg00039.html; http://lists.opensuse.org/opensuse-updates/2014-03/msg00005.html
CVE: CVE-2013-6479
Published: 2014-02-06
Description: util.c in libpurple in Pidgin before 2.10.8 does not properly allocate memory for HTTP responses that are inconsistent with the Content-Length header, which allows remote HTTP servers to cause a denial of service (application crash) via a crafted response.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://hg.pidgin.im/pidgin/main/rev/cd529e1158d3; http://lists.opensuse.org/opensuse-updates/2014-02/msg00039.html; http://lists.opensuse.org/opensuse-updates/2014-03/msg00005.html
CVE: CVE-2013-6483
Published: 2014-02-06
Description: The XMPP protocol plugin in libpurple in Pidgin before 2.10.8 does not properly determine whether the from address in an iq reply is consistent with the to address in an iq request, which allows remote attackers to spoof iq traffic or cause a denial of service (NULL pointer dereference and application crash) via a crafted reply.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-20
References: http://hg.pidgin.im/pidgin/main/rev/93d4bff19574; http://lists.opensuse.org/opensuse-updates/2014-02/msg00039.html; http://lists.opensuse.org/opensuse-updates/2014-03/msg00005.html
CVE: CVE-2013-6484
Published: 2014-02-06
Description: The STUN protocol implementation in libpurple in Pidgin before 2.10.8 allows remote STUN servers to cause a denial of service (out-of-bounds write operation and application crash) by triggering a socket read error.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://hg.pidgin.im/pidgin/main/rev/932b985540e9; http://lists.opensuse.org/opensuse-updates/2014-02/msg00039.html; http://lists.opensuse.org/opensuse-updates/2014-03/msg00005.html
CVE: CVE-2013-6485
Published: 2014-02-06
Description: Buffer overflow in util.c in libpurple in Pidgin before 2.10.8 allows remote HTTP servers to cause a denial of service (application crash) or possibly have unspecified other impact via an invalid chunk-size field in chunked transfer-coding data.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://hg.pidgin.im/pidgin/main/rev/c9e5aba2dafd; http://lists.opensuse.org/opensuse-updates/2014-02/msg00039.html; http://lists.opensuse.org/opensuse-updates/2014-03/msg00005.html
CVE: CVE-2013-6486
Published: 2014-02-06
Description: gtkutils.c in Pidgin before 2.10.8 on Windows allows user-assisted remote attackers to execute arbitrary programs via a message containing a file: URL that is improperly handled during construction of an explorer.exe command.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-3185.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://hg.pidgin.im/pidgin/main/rev/b2571530fa8b; http://lists.opensuse.org/opensuse-updates/2014-02/msg00039.html; http://lists.opensuse.org/opensuse-updates/2014-03/msg00005.html
CVE: CVE-2013-7319
Published: 2014-02-06
Description: Cross-site scripting (XSS) vulnerability in the Download Manager plugin before 2.5.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via the title field.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/55969; http://wordpress.org/plugins/download-manager/changelog; http://www.exploit-db.com/exploits/30105
CVE: CVE-2013-7320
Published: 2014-02-06
Description: Cross-site request forgery (CSRF) vulnerability in D-Link DAP-2253 Access Point (Rev. A1) with firmware before 1.30 allows remote attackers to hijack the authentication of administrators for requests that modify configuration settings via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://secunia.com/advisories/56022; http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10006; http://www.securityfocus.com/bid/64297
CVE: CVE-2013-7321
Published: 2014-02-06
Description: Cross-site scripting (XSS) vulnerability in D-Link DAP-2253 Access Point (Rev. A1) with firmware before 1.30 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/56022; http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10006; http://www.securityfocus.com/bid/64297
CVE: CVE-2014-0020
Published: 2014-02-06
Description: The IRC protocol plugin in libpurple in Pidgin before 2.10.8 does not validate argument counts, which allows remote IRC servers to cause a denial of service (application crash) via a crafted message.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://hg.pidgin.im/pidgin/main/rev/4d9be297d399; http://hg.pidgin.im/pidgin/main/rev/5845d9fa7084; http://hg.pidgin.im/pidgin/main/rev/6b0e0566af20
CVE: CVE-2010-4226
Published: 2014-02-06
Description: cpio, as used in build 2007.05.10, 2010.07.28, and possibly other versions, allows remote attackers to overwrite arbitrary files via a symlink within an RPM package archive.
CVSS Score: 7.2 (HIGH)
CWE: CWE-59, CWE-59
References: http://lists.opensuse.org/opensuse-security-announce/2011-04/msg00000.html; http://lists.opensuse.org/opensuse-updates/2011-03/msg00008.html; http://support.novell.com/security/cve/CVE-2010-4226.html
CVE: CVE-2012-1095
Published: 2014-02-06
Description: osc before 0.134 might allow remote OBS repository servers or package maintainers to execute arbitrary commands via a crafted (1) build log or (2) build status that contains an escape sequence for a terminal emulator.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-updates/2012-03/msg00035.html; http://www.openwall.com/lists/oss-security/2012/02/28/15; http://www.openwall.com/lists/oss-security/2012/02/28/9
CVE: CVE-2013-2038
Published: 2014-02-06
Description: The NMEA0183 driver in gpsd before 3.9 allows remote attackers to cause a denial of service (daemon termination) and possibly execute arbitrary code via a GPS packet with a malformed $GPGGA interpreted sentence that lacks certain fields and a terminator.  NOTE: a separate issue in the AIS driver was also reported, but it might not be a vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://git.savannah.gnu.org/cgit/gpsd.git/commit/?id=dd9c3c2830cb8f8fd8491ce68c82698dc5538f50; http://lists.nongnu.org/archive/html/gpsd-dev/2013-05/msg00000.html; http://openwall.com/lists/oss-security/2013/05/02/20
CVE: CVE-2013-6481
Published: 2014-02-06
Description: libpurple/protocols/yahoo/libymsg.c in Pidgin before 2.10.8 allows remote attackers to cause a denial of service (crash) via a Yahoo! P2P message with a crafted length field, which triggers a buffer over-read.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://hg.pidgin.im/pidgin/main/rev/4d139ce8f7ec; http://lists.opensuse.org/opensuse-updates/2014-02/msg00039.html; http://lists.opensuse.org/opensuse-updates/2014-03/msg00005.html
CVE: CVE-2013-6482
Published: 2014-02-06
Description: Pidgin before 2.10.8 allows remote MSN servers to cause a denial of service (NULL pointer dereference and crash) via a crafted (1) SOAP response, (2) OIM XML response, or (3) Content-Length header.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-updates/2014-02/msg00039.html; http://lists.opensuse.org/opensuse-updates/2014-03/msg00005.html; http://www.debian.org/security/2014/dsa-2859
CVE: CVE-2013-6487
Published: 2014-02-06
Description: Integer overflow in libpurple/protocols/gg/lib/http.c in the Gadu-Gadu (gg) parser in Pidgin before 2.10.8 allows remote attackers to have an unspecified impact via a large Content-Length value, which triggers a buffer overflow.
CVSS Score: 7.5 (HIGH)
CWE: CWE-189
References: http://advisories.mageia.org/MGASA-2014-0074.html; http://hg.pidgin.im/pidgin/main/rev/ec15aa187aa0; http://libgadu.net/releases/1.11.3.html
CVE: CVE-2013-6489
Published: 2014-02-06
Description: Integer signedness error in the MXit functionality in Pidgin before 2.10.8 allows remote attackers to cause a denial of service (segmentation fault) via a crafted emoticon value, which triggers an integer overflow and a buffer overflow.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://hg.pidgin.im/pidgin/main/rev/4c897372b5a4; http://www.debian.org/security/2014/dsa-2859; http://www.pidgin.im/news/security/?id=83
CVE: CVE-2013-6490
Published: 2014-02-06
Description: The SIMPLE protocol functionality in Pidgin before 2.10.8 allows remote attackers to have an unspecified impact via a negative Content-Length header, which triggers a buffer overflow.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://hg.pidgin.im/pidgin/main/rev/6bd2dd10e5da; http://www.debian.org/security/2014/dsa-2859; http://www.pidgin.im/news/security/?id=84
CVE: CVE-2013-7130
Published: 2014-02-06
Description: The i_create_images_and_backing (aka create_images_and_backing) method in libvirt driver in OpenStack Compute (Nova) Grizzly, Havana, and Icehouse, when using KVM live block migration, does not properly create all expected files, which allows attackers to obtain snapshot root disk contents of other users via ephemeral storage.
CVSS Score: 7.1 (HIGH)
CWE: CWE-200
References: http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127732.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127735.html; http://osvdb.org/102416
CVE: CVE-2014-1663
Published: 2014-02-06
Description: Unspecified vulnerability in Citrix XenMobile Device Manager server (formerly Zenprise Device Manager server) 8.5, 8.6, and MDM 8.0.1 allows remote attackers to obtain sensitive information via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/102884; http://secunia.com/advisories/56438; http://support.citrix.com/article/CTX140044
CVE: CVE-2013-6393
Published: 2014-02-06
Description: The yaml_parser_scan_tag_uri function in scanner.c in LibYAML before 0.1.5 performs an incorrect cast, which allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted tags in a YAML document, which triggers a heap-based buffer overflow.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://advisories.mageia.org/MGASA-2014-0040.html; http://archives.neohapsis.com/archives/bugtraq/2014-04/0134.html; http://archives.neohapsis.com/archives/bugtraq/2014-10/0103.html
CVE: CVE-2014-0038
Published: 2014-02-06
Description: The compat_sys_recvmmsg function in net/compat.c in the Linux kernel before 3.13.2, when CONFIG_X86_X32 is enabled, allows local users to gain privileges via a recvmmsg system call with a crafted timeout pointer parameter.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-20
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=2def2ef2ae5f3990aabdbe8a[PII_REDACTED]07d268; http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00002.html; http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00003.html
CVE: CVE-2014-0622
Published: 2014-02-06
Description: The web service in EMC Documentum Foundation Services (DFS) 6.5 through 6.7 before 6.7 SP1 P22, 6.7 SP2 before P08, 7.0 before P12, and 7.1 before P01 does not properly implement content uploading, which allows remote authenticated users to bypass intended content access restrictions via unspecified vectors.
CVSS Score: 9.0 (HIGH)
CWE: CWE-264
References: http://archives.neohapsis.com/archives/bugtraq/2014-02/0007.html; http://osvdb.org/102949; http://secunia.com/advisories/56845
CVE: CVE-2014-0815
Published: 2014-02-06
Description: The intent: URL implementation in Opera before 18 on Android allows attackers to read local files by leveraging an interaction error, as demonstrated by reading stored cookies.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://blogs.opera.com/security/2014/01/security-changes-features-opera-19/; http://jvn.jp/en/jp/JVN23256725/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2014-000014
CVE: CVE-2013-2962
Published: 2014-02-06
Description: Buffer overflow in the Launcher in IBM WebSphere Transformation Extender 8.4.x before 8.4.0.4 allows local users to cause a denial of service (process crash or Admin Console command-stream outage) via unspecified vectors.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-119
References: http://www-01.ibm.com/support/docview.wss?uid=swg21662870; https://exchange.xforce.ibmcloud.com/vulnerabilities/83722; http://www-01.ibm.com/support/docview.wss?uid=swg21662870
CVE: CVE-2013-6332
Published: 2014-02-06
Description: Unrestricted file upload vulnerability in IBM Algo One UDS 4.7.0 through 5.0.0 allows remote authenticated users to execute arbitrary code by uploading a .jsp file and then launching it.
CVSS Score: 8.5 (HIGH)
References: http://www.ibm.com/support/docview.wss?uid=swg21663820; https://exchange.xforce.ibmcloud.com/vulnerabilities/89023; http://www.ibm.com/support/docview.wss?uid=swg21663820
CVE: CVE-2014-0330
Published: 2014-02-06
Description: Cross-site scripting (XSS) vulnerability in adminui/user_list.php on the Dell KACE K1000 management appliance 5.5.90545 allows remote attackers to inject arbitrary web script or HTML via the LABEL_ID parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/102855; http://www.kb.cert.org/vuls/id/813382; http://www.securityfocus.com/bid/65333
CVE: CVE-2014-0822
Published: 2014-02-06
Description: The IMAP server in IBM Domino 8.5.x before 8.5.3 FP6 IF1 and 9.0.x before 9.0.1 FP1 allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors, aka SPR KLYH9F4S2Z.
CVSS Score: 7.8 (HIGH)
References: http://osvdb.org/102912; http://secunia.com/advisories/56791; http://www-01.ibm.com/support/docview.wss?uid=swg21663023
CVE: CVE-2014-1870
Published: 2014-02-06
Description: Opera before 19 on Mac OS X allows user-assisted remote attackers to spoof the address bar via vectors involving a drag-and-drop operation.
CVSS Score: 4.3 (MEDIUM)
References: http://blogs.opera.com/security/2014/01/security-changes-features-opera-19/; http://blogs.opera.com/security/2014/01/security-changes-features-opera-19/
CVE: CVE-2014-1643
Published: 2014-02-07
Description: The Web Email Protection component in Symantec Encryption Management Server (aka PGP Universal Server) before 3.3.2 allows remote authenticated users to read the stored outbound e-mail messages of arbitrary users via a modified URL.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://www.securityfocus.com/bid/65300; http://www.securitytracker.com/id/1029729; http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20140205_00
CVE: CVE-2014-1696
Published: 2014-02-07
Description: Siemens SIMATIC WinCC OA before 3.12 P002 January uses a weak hash algorithm for passwords, which makes it easier for remote attackers to obtain access via a brute-force attack.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://ics-cert.us-cert.gov/advisories/ICSA-14-035-01; http://osvdb.org/102809; http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-342587.pdf
CVE: CVE-2014-1697
Published: 2014-02-07
Description: The integrated web server in Siemens SIMATIC WinCC OA before 3.12 P002 January allows remote attackers to execute arbitrary code via crafted packets to TCP port 4999.
CVSS Score: 7.5 (HIGH)
References: http://ics-cert.us-cert.gov/advisories/ICSA-14-035-01; http://osvdb.org/102810; http://secunia.com/advisories/56651
CVE: CVE-2014-1698
Published: 2014-02-07
Description: Directory traversal vulnerability in Siemens SIMATIC WinCC OA before 3.12 P002 January allows remote attackers to read arbitrary files via crafted packets to TCP port 4999.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://ics-cert.us-cert.gov/advisories/ICSA-14-035-01; http://osvdb.org/102811; http://secunia.com/advisories/56651
CVE: CVE-2014-1699
Published: 2014-02-07
Description: Siemens SIMATIC WinCC OA before 3.12 P002 January allows remote attackers to cause a denial of service (monitoring-service outage) via malformed HTTP requests to port 4999.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://ics-cert.us-cert.gov/advisories/ICSA-14-035-01; http://osvdb.org/102812; http://secunia.com/advisories/56651
CVE: CVE-2014-1914
Published: 2014-02-07
Description: Multiple cross-site scripting (XSS) vulnerabilities in Command School Student Management System 1.06.01 allow remote attackers to inject arbitrary web script or HTML via the (1) topic parameter to sw/add_topic.php or (2) nick parameter to sw/chat/message.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/101891; http://osvdb.org/101892; http://packetstormsecurity.com/files/124708/Command-School-Student-Management-System-1.06.01-SQL-Injection-CSRF-XSS.html
CVE: CVE-2014-1915
Published: 2014-02-07
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in Command School Student Management System 1.06.01 allow remote attackers to hijack the authentication of (1) administrators for requests that change the administrator password via an update action to sw/admin_change_password.php or (2) unspecified victims for requests that add a topic or blog entry to sw/add_topic.php.  NOTE: vector 2 can be leveraged to bypass the authentication requirements for exploiting vector 1 in CVE-2014-1914.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://osvdb.org/101889; http://osvdb.org/101890; http://packetstormsecurity.com/files/124708/Command-School-Student-Management-System-1.06.01-SQL-Injection-CSRF-XSS.html
CVE: CVE-2011-1773
Published: 2014-02-08
Description: virt-v2v before 0.8.4 does not preserve the VNC console password when converting a guest, which allows local users to bypass the intended VNC authentication by connecting without a password.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-255
References: http://rhn.redhat.com/errata/RHSA-2011-1615.html; http://secunia.com/advisories/47086; http://www.osvdb.org/77558
CVE: CVE-2011-4099
Published: 2014-02-08
Description: The capsh program in libcap before 2.22 does not change the current working directory when the --chroot option is specified, which allows local users to bypass the chroot restrictions via unspecified vectors.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-264
References: http://rhn.redhat.com/errata/RHSA-2011-1694.html; https://bugzilla.redhat.com/show_bug.cgi?id=722694; https://sites.google.com/site/fullycapable/release-notes-for-libcap/releasenotesfor222
CVE: CVE-2012-5524
Published: 2014-02-08
Description: The _ssl_verify_callback function in tls_nb.py in Gajim before 0.15.3 does not properly verify SSL certificates, which allows remote attackers to conduct man-in-the-middle (MITM) attacks and spoof servers via an arbitrary certificate from a trusted CA.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://security.gentoo.org/glsa/glsa-201401-02.xml; http://www.openwall.com/lists/oss-security/2012/11/11/6; https://trac.gajim.org/query?status=closed&group=resolution&milestone=0.15.3
CVE: CVE-2013-1904
Published: 2014-02-08
Description: Absolute path traversal vulnerability in steps/mail/sendmail.inc in Roundcube Webmail before 0.7.3 and 0.8.x before 0.8.6 allows remote attackers to read arbitrary files via a full pathname in the _value parameter for the generic_message_footer setting in a save-perf action to index.php, as exploited in the wild in March 2013.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://habrahabr.ru/post/174423/; http://lists.opensuse.org/opensuse-updates/2013-04/msg00080.html; http://lists.roundcube.net/pipermail/dev/2013-March/022328.html
CVE: CVE-2013-2191
Published: 2014-02-08
Description: python-bugzilla before 0.9.0 does not validate X.509 certificates, which allows man-in-the-middle attackers to spoof Bugzilla servers via a crafted certificate.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-updates/2013-07/msg00025.html; http://lists.opensuse.org/opensuse-updates/2013-07/msg00026.html; http://www.openwall.com/lists/oss-security/2013/06/19/6
CVE: CVE-2014-0039
Published: 2014-02-08
Description: Untrusted search path vulnerability in fwsnort before 1.6.4, when not running as root, allows local users to execute arbitrary code via a Trojan horse fwsnort.conf in the current working directory.
CVSS Score: 4.4 (MEDIUM)
References: http://lists.fedoraproject.org/pipermail/package-announce/2014-February/128188.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-February/128205.html; http://osvdb.org/102822