deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-1262
Published: 2014-02-27
Description: Apple Type Services (ATS) in Apple OS X before 10.9.2 allows attackers to bypass the App Sandbox protection mechanism via crafted Mach messages that trigger memory corruption.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://support.apple.com/kb/HT6150; http://support.apple.com/kb/HT6150
CVE: CVE-2014-1263
Published: 2014-02-27
Description: curl and libcurl 7.27.0 through 7.35.0, when using the SecureTransport/Darwinssl backend, as used in in Apple OS X 10.9.x before 10.9.2, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate when accessing a URL that uses a numerical IP address, which allows man-in-the-middle attackers to spoof servers via an arbitrary valid certificate.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-310
References: http://curl.haxx.se/docs/adv_20140326C.html; http://secunia.com/advisories/57836; http://secunia.com/advisories/57966
CVE: CVE-2014-1264
Published: 2014-02-27
Description: Finder in Apple OS X before 10.9.2 does not ensure ACL integrity after the viewing of file ACL information, which allows local users to bypass intended access restrictions in opportunistic circumstances via standard filesystem operations on a file with a damaged ACL.
CVSS Score: 3.3 (LOW)
CWE: CWE-264
References: http://support.apple.com/kb/HT6150; http://support.apple.com/kb/HT6150
CVE: CVE-2014-1265
Published: 2014-02-27
Description: The systemsetup program in the Date and Time subsystem in Apple OS X before 10.9.2 allows local users to bypass intended access restrictions by changing the current time on the system clock.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-264
References: http://support.apple.com/kb/HT6150; http://support.apple.com/kb/HT6150
CVE: CVE-2014-1268
Published: 2014-02-27
Description: WebKit, as used in Apple Safari before 6.1.2 and 7.x before 7.0.2, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2014-1269 and CVE-2014-1270.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://support.apple.com/kb/HT6145; https://support.apple.com/kb/HT6537; http://support.apple.com/kb/HT6145
CVE: CVE-2014-1269
Published: 2014-02-27
Description: WebKit, as used in Apple Safari before 6.1.2 and 7.x before 7.0.2, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2014-1268 and CVE-2014-1270.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://support.apple.com/kb/HT6145; http://support.apple.com/kb/HT6162; http://support.apple.com/kb/HT6163
CVE: CVE-2014-1270
Published: 2014-02-27
Description: WebKit, as used in Apple Safari before 6.1.2 and 7.x before 7.0.2, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2014-1268 and CVE-2014-1269.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://support.apple.com/kb/HT6145; http://support.apple.com/kb/HT6162; http://support.apple.com/kb/HT6163
CVE: CVE-2014-1967
Published: 2014-02-27
Description: The Denny's application before 2.0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-310
References: http://jvn.jp/en/jp/JVN48810179/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2014-000022; https://play.google.com/store/apps/details?id=jp.denimoba
CVE: CVE-2014-1968
Published: 2014-02-27
Description: Cross-site scripting (XSS) vulnerability in the XooNIps module 3.47 and earlier for XOOPS allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN87797318/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2014-000025; http://www.securityfocus.com/bid/65807
CVE: CVE-2014-2102
Published: 2014-02-27
Description: Cisco Unified Contact Center Express (Unified CCX) does not properly restrict the content of the CCMConfig page, which allows remote authenticated users to obtain sensitive information by examining this content, aka Bug ID CSCum95575.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2102; http://www.securitytracker.com/id/1029842; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2102
CVE: CVE-2014-2075
Published: 2014-02-27
Description: TIBCO Enterprise Administrator 1.0.0 and Enterprise Administrator SDK 1.0.0 do not properly enforce administrative authentication requirements, which allows remote attackers to execute arbitrary commands via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-287
References: http://www.tibco.com/mk/advisory.jsp; http://www.tibco.com/multimedia/enterprise_administator_advisory_20140226_tcm8-20533.txt; http://www.tibco.com/mk/advisory.jsp
CVE: CVE-2014-0046
Published: 2014-02-27
Description: Cross-site scripting (XSS) vulnerability in the link-to helper in Ember.js 1.2.x before 1.2.2, 1.3.x before 1.3.2, and 1.4.x before 1.4.0-beta.6, when used in non-block form, allows remote attackers to inject arbitrary web script or HTML via the title attribute.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://emberjs.com/blog/2014/02/07/ember-security-releases.html; http://secunia.com/advisories/56965; http://www.openwall.com/lists/oss-security/2014/02/14/6
CVE: CVE-2014-1223
Published: 2014-02-27
Description: Cross-site scripting (XSS) vulnerability in controlpanel/loading.aspx in Telligent Evolution before 6.1.19.36103, 7.x before 7.1.12.36162, 7.5.x, and 7.6.x before 7.6.7.36651 allows remote attackers to inject arbitrary web script or HTML via the msg parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/56779; http://www.securityfocus.com/archive/1/531223/100/0/threaded; http://www.securityfocus.com/bid/65739
CVE: CVE-2014-1597
Published: 2014-02-27
Description: SQL injection vulnerability in the CMDB web application in synetics i-doit pro before 1.2.5 and i-doit open allows remote attackers to execute arbitrary SQL commands via the objID parameter to the default URI.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://archives.neohapsis.com/archives/fulldisclosure/2014-02/0154.html; http://secunia.com/advisories/56931; http://www.csnc.ch/misc/files/advisories/CVE-2014-1597_i-doit_SQL_Injection.txt
CVE: CVE-2014-1854
Published: 2014-02-27
Description: SQL injection vulnerability in library/clicktracker.php in the AdRotate Pro plugin 3.9 through 3.9.5 and AdRotate Free plugin 3.9 through 3.9.4 for WordPress allows remote attackers to execute arbitrary SQL commands via the track parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/57079; http://www.adrotateplugin.com/2014/01/adrotate-pro-3-9-6-and-adrotate-free-3-9-5; http://www.exploit-db.com/exploits/31834
CVE: CVE-2014-2035
Published: 2014-02-27
Description: Cross-site scripting (XSS) vulnerability in xhr.php in InterWorx Web Control Panel (aka InterWorx Hosting Control Panel and InterWorx-CP) before 5.0.13 build 574 allows remote attackers to inject arbitrary web script or HTML via the i parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.interworx.com/developers/changelog/version-5-0-13-build-574-2014-02-19; http://www.securityfocus.com/archive/1/531191/100/0/threaded; http://www.securityfocus.com/bid/65734
CVE: CVE-2014-2231
Published: 2014-02-27
Description: Cross-site scripting (XSS) vulnerability in the API in synetics i-doit pro before 1.2.5 allows remote attackers to inject arbitrary web script or HTML via a property title.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/56931; http://www.i-doit.com/en/company/news/single-news/?tx_ttnews%5Btt_news%5D=141; http://secunia.com/advisories/56931
CVE: CVE-2014-0333
Published: 2014-02-27
Description: The png_push_read_chunk function in pngpread.c in the progressive decoder in libpng 1.6.x through 1.6.9 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via an IDAT chunk with a length of zero.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: ftp://ftp.simplesystems.org/pub/png/src/libpng16/patch-libpng16-vu684412.diff; http://lists.opensuse.org/opensuse-updates/2014-03/msg00029.html; http://www.kb.cert.org/vuls/id/684412
CVE: CVE-2014-0679
Published: 2014-02-27
Description: Cisco Prime Infrastructure 1.2 and 1.3 before 1.3.0.20-2, 1.4 before 1.4.0.45-2, and 2.0 before 2.0.0.0.294-2 allows remote authenticated users to execute arbitrary commands with root privileges via an unspecified URL, aka Bug ID CSCum71308.
CVSS Score: 9.0 (HIGH)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140226-pi; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140226-pi
CVE: CVE-2014-0858
Published: 2014-02-27
Description: IBM Content Navigator 2.x before 2.0.2.2-ICN-FP002 allows remote authenticated users to bypass intended access restrictions and conduct deleteAction attacks via a modified URL.
CVSS Score: 3.5 (LOW)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg21665358; https://exchange.xforce.ibmcloud.com/vulnerabilities/90864; http://www-01.ibm.com/support/docview.wss?uid=swg21665358
CVE: CVE-2014-2103
Published: 2014-02-27
Description: Cisco Intrusion Prevention System (IPS) Software allows remote attackers to cause a denial of service (MainApp process outage) via malformed SNMP packets, aka Bug IDs CSCum52355 and CSCul49309.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2103; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2103
CVE: CVE-2014-0069
Published: 2014-02-28
Description: The cifs_iovec_write function in fs/cifs/file.c in the Linux kernel through 3.13.5 does not properly handle uncached write operations that copy fewer than the requested number of bytes, which allows local users to obtain sensitive information from kernel memory, cause a denial of service (memory corruption and system crash), or possibly gain privileges via a writev system call with a crafted pointer.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://article.gmane.org/gmane.linux.kernel.cifs/9401; http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=5d81de8e8667da7135d3a32a964087c0faf5483f; http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00026.html
CVE: CVE-2014-0759
Published: 2014-02-28
Description: Unquoted Windows search path vulnerability in Schneider Electric Floating License Manager 1.0.0 through 1.4.0 allows local users to gain privileges via a Trojan horse application with a name composed of an initial substring of a path that contains a space character.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-428
References: http://download.schneider-electric.com/files?p_Doc_Ref=SEVD%202014-015-01; https://www.cisa.gov/news-events/ics-advisories/icsa-14-058-01; http://download.schneider-electric.com/files?p_Doc_Ref=SEVD%202014-015-01
CVE: CVE-2014-0774
Published: 2014-02-28
Description: Stack-based buffer overflow in the C++ sample client in Schneider Electric OPC Factory Server (OFS) TLXCDSUOFS33 - 3.35, TLXCDSTOFS33 - 3.35, TLXCDLUOFS33 - 3.35, TLXCDLTOFS33 - 3.35, and TLXCDLFOFS33 - 3.35 allows local users to gain privileges via vectors involving a malformed configuration file.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-121, CWE-119
References: http://www.securityfocus.com/bid/65871; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD%202014-031-01; https://www.cisa.gov/news-events/ics-advisories/icsa-14-058-02
CVE: CVE-2014-0874
Published: 2014-02-28
Description: Cross-site scripting (XSS) vulnerability in IBM Content Navigator 2.x before 2.0.2.2-ICN-FP002 allows remote authenticated users to inject arbitrary web script or HTML via an unspecified parameter.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21665362; http://www-01.ibm.com/support/docview.wss?uid=swg21668907; http://www.securityfocus.com/bid/65852
CVE: CVE-2014-1690
Published: 2014-02-28
Description: The help function in net/netfilter/nf_nat_irc.c in the Linux kernel before 3.12.8 allows remote attackers to obtain sensitive information from kernel memory by establishing an IRC DCC session in which incorrect packet data is transmitted during use of the NAT mangle feature.
CVSS Score: 2.6 (LOW)
CWE: CWE-200
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=2690d97ade05c5325cbf7c72b94b90d265659886; http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.12.8; http://www.openwall.com/lists/oss-security/2014/01/28/3
CVE: CVE-2014-1874
Published: 2014-02-28
Description: The security_context_to_sid_core function in security/selinux/ss/services.c in the Linux kernel before 3.13.4 allows local users to cause a denial of service (system crash) by leveraging the CAP_MAC_ADMIN capability to set a zero-length security context.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-20
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=2172fa709ab32ca60e86179dc67d0857be8e2c98; http://linux.oracle.com/errata/ELSA-2014-0771.html; http://linux.oracle.com/errata/ELSA-2014-3043.html
CVE: CVE-2014-2038
Published: 2014-02-28
Description: The nfs_can_extend_write function in fs/nfs/write.c in the Linux kernel before 3.13.3 relies on a write delegation to extend a write operation without a certain up-to-date verification, which allows local users to obtain sensitive information from kernel memory in opportunistic circumstances by writing to a file in an NFS filesystem and then reading the same file.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=263b4509ec4d47e0da3e753f85a39ea12d1eff24; http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.13.3; http://www.openwall.com/lists/oss-security/2014/02/20/16
CVE: CVE-2014-2039
Published: 2014-02-28
Description: arch/s390/kernel/head64.S in the Linux kernel before 3.13.5 on the s390 platform does not properly handle attempted use of the linkage stack, which allows local users to cause a denial of service (system crash) by executing a crafted instruction.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-20
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=8d7f6690cedb83456edd41c9bd583783f0703bf0; http://linux.oracle.com/errata/ELSA-2014-0771.html; http://secunia.com/advisories/59262
CVE: CVE-2014-1878
Published: 2014-02-28
Description: Stack-based buffer overflow in the cmd_submitf function in cgi/cmd.c in Nagios Core, possibly 4.0.3rc1 and earlier, and Icinga before 1.8.6, 1.9 before 1.9.5, and 1.10 before 1.10.3 allows remote attackers to cause a denial of service (segmentation fault) via a long message to cmd.cgi.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-updates/2014-04/msg00033.html; http://secunia.com/advisories/57024; http://www.securityfocus.com/bid/65605
CVE: CVE-2013-2498
Published: 2014-03-01
Description: SQL injection vulnerability in the login page in flexycms/modules/user/user_manager.php in SimpleHRM 2.3, 2.2, and earlier allows remote attackers to execute arbitrary SQL commands via the username parameter to index.php/user/setLogin.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/92538; http://www.openwall.com/lists/oss-security/2013/04/17/1; https://exchange.xforce.ibmcloud.com/vulnerabilities/83628
CVE: CVE-2014-1456
Published: 2014-03-01
Description: Cross-site scripting (XSS) vulnerability in the login page in Open Web Analytics (OWA) before 1.5.6 allows remote attackers to inject arbitrary web script or HTML via the owa_user_id parameter to index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/56885; http://www.openwebanalytics.com/?p=384; http://www.secureworks.com/cyber-threat-intelligence/advisories/SWRX-2014-004
CVE: CVE-2014-1695
Published: 2014-03-01
Description: Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) 3.1.x before 3.1.20, 3.2.x before 3.2.15, and 3.3.x before 3.3.5 allows remote attackers to inject arbitrary web script or HTML via a crafted HTML email.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://adamziaja.com/poc/201401-xss-otrs.html; http://lists.opensuse.org/opensuse-updates/2014-03/msg00030.html; http://packetstormsecurity.com/files/131654/OTRS-3.x-Cross-Site-Scripting.html
CVE: CVE-2014-1888
Published: 2014-03-01
Description: Cross-site scripting (XSS) vulnerability in the BuddyPress plugin before 1.9.2 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the name field to groups/create/step/group-details.  NOTE: this can be exploited without authentication by leveraging CVE-2014-1889.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://buddypress.org/2014/02/buddypress-1-9-2; http://osvdb.org/103307; http://packetstormsecurity.com/files/125212/WordPress-Buddypress-1.9.1-Cross-Site-Scripting.html
CVE: CVE-2014-2059
Published: 2014-03-01
Description: Directory traversal vulnerability in the CLI job creation (hudson/cli/CreateJobCommand.java) in Jenkins before 1.551 and LTS before 1.532.2 allows remote authenticated users to overwrite arbitrary files via the job name.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: http://seclists.org/oss-sec/2014/q1/421; https://exchange.xforce.ibmcloud.com/vulnerabilities/91346; https://github.com/jenkinsci/jenkins/commit/ad38d8480f20ce3cbf8fec3e2003bc83efda4f7d
CVE: CVE-2014-2067
Published: 2014-03-01
Description: Cross-site scripting (XSS) vulnerability in java/hudson/model/Cause.java in Jenkins before 1.551 and LTS before 1.532.2 allows remote authenticated users to inject arbitrary web script or HTML via a "remote cause note."
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://seclists.org/oss-sec/2014/q1/421; https://exchange.xforce.ibmcloud.com/vulnerabilities/91354; https://github.com/jenkinsci/jenkins/commit/5d57c855f3147bfc5e7fda9252317b428a700014
CVE: CVE-2014-2080
Published: 2014-03-01
Description: Cross-site scripting (XSS) vulnerability in manager/templates/default/header.tpl in ModX Revolution before 2.2.11 allows remote attackers to inject arbitrary web script or HTML via the "a" parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://modx.com/blog/2014/01/21/revolution-2.2.11%E2%80%94security-fixes-and-prevent-change-loss; http://seclists.org/oss-sec/2014/q1/431; http://secunia.com/advisories/57038
CVE: CVE-2011-3634
Published: 2014-03-01
Description: methods/https.cc in apt before 0.8.11 accepts connections when the certificate host name fails validation and Verify-Host is enabled, which allows man-in-the-middle attackers to obtain repository credentials via unspecified vectors.
CVSS Score: 2.6 (LOW)
CWE: CWE-200
References: http://people.canonical.com/~ubuntu-security/cve/2011/CVE-2011-3634.html; http://www.ubuntu.com/usn/USN-1283-1; https://alioth.debian.org/plugins/scmgit/cgi-bin/gitweb.cgi?p=apt/apt.git%3Ba=blob%3Bf=debian/changelog%3Bhb=HEAD
CVE: CVE-2014-1912
Published: 2014-03-01
Description: Buffer overflow in the socket.recvfrom_into function in Modules/socketmodule.c in Python 2.5 before 2.7.7, 3.x before 3.3.4, and 3.4.x before 3.4rc1 allows remote attackers to execute arbitrary code via a crafted string.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://bugs.python.org/issue20246; http://hg.python.org/cpython/rev/87673659d8f7; http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html
CVE: CVE-2014-2262
Published: 2014-03-01
Description: Buffer overflow in the client application in Base SAS 9.2 TS2M3, SAS 9.3 TS1M1 and TS1M2, and SAS 9.4 TS1M0 allows user-assisted remote attackers to execute arbitrary code via a crafted SAS program.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/57029; http://support.sas.com/kb/51/701.html; http://www.securityfocus.com/archive/1/531283/100/0/threaded
CVE: CVE-2014-2263
Published: 2014-03-01
Description: The mpegts_write_pmt function in the MPEG2 transport stream (aka DVB) muxer (libavformat/mpegtsenc.c) in FFmpeg, possibly 2.1 and earlier, allows remote attackers to have unspecified impact and vectors, which trigger an out-of-bounds write.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=842b6c14bc; http://secunia.com/advisories/56971; http://www.securityfocus.com/bid/65560
CVE: CVE-2013-4054
Published: 2014-03-02
Description: Directory traversal vulnerability in WMQ Telemetry in IBM WebSphere MQ 7.5 before 7.5.0.3 allows remote attackers to read arbitrary files via a crafted URI.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: http://www-01.ibm.com/support/docview.wss?uid=swg21664550; https://exchange.xforce.ibmcloud.com/vulnerabilities/86506; http://www-01.ibm.com/support/docview.wss?uid=swg21664550
CVE: CVE-2014-0862
Published: 2014-03-02
Description: Unspecified vulnerability in Jazz Team Server in IBM Rational Collaborative Lifecycle Management (CLM) 3.x before 3.0.1.6 iFix 2 and 4.x before 4.0.6 allows remote attackers to execute arbitrary code via unknown vectors.
CVSS Score: 10.0 (HIGH)
References: http://www-01.ibm.com/support/docview.wss?uid=swg21664566; https://exchange.xforce.ibmcloud.com/vulnerabilities/90895; http://www-01.ibm.com/support/docview.wss?uid=swg21664566
CVE: CVE-2014-2097
Published: 2014-03-02
Description: The tak_decode_frame function in libavcodec/takdec.c in FFmpeg before 2.1.4 does not properly validate a certain bits-per-sample value, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted TAK (aka Tom's lossless Audio Kompressor) data.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=f58eab151214d2d35ff0973f2b3e51c5eb372da4; https://security.gentoo.org/glsa/201603-06; http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=f58eab151214d2d35ff0973f2b3e51c5eb372da4
CVE: CVE-2014-2098
Published: 2014-03-02
Description: libavcodec/wmalosslessdec.c in FFmpeg before 2.1.4 uses an incorrect data-structure size for certain coefficients, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via crafted WMA data.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=ec9578d54d09b64bf112c2bf7a34b1ef3b93dbd3; https://security.gentoo.org/glsa/201603-06; http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=ec9578d54d09b64bf112c2bf7a34b1ef3b93dbd3
CVE: CVE-2014-2099
Published: 2014-03-02
Description: The msrle_decode_frame function in libavcodec/msrle.c in FFmpeg before 2.1.4 does not properly calculate line sizes, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted Microsoft RLE video data.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-189
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=c919e1ca2ecfc47d796382973ba0e48b8f6f92a2; http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=c919e1ca2ecfc47d796382973ba0e48b8f6f92a2
CVE: CVE-2014-2104
Published: 2014-03-02
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Business Voice Services Manager (BVSM) page in Cisco Unified Communications Domain Manager 9.0(.1) allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug IDs CSCum78536, CSCum78526, CSCum69809, and CSCum63113.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2104; http://tools.cisco.com/security/center/viewAlert.x?alertId=33111; http://www.securityfocus.com/bid/65869