deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2013-4380
Published: 2014-05-20
Description: Cross-site scripting (XSS) vulnerability in the MediaFront module 6.x-1.x before 6.x-1.6, 7.x-1.x before 7.x-1.6, and 7.x-2.x before 7.x-2.1 for Drupal allows remote authenticated users with the "administer mediafront" permission to inject arbitrary web script or HTML via the preset settings.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2013/09/27/6; https://drupal.org/node/2086187; https://drupal.org/node/2086189
CVE: CVE-2013-7383
Published: 2014-05-20
Description: x2gocleansessions in X2Go Server before 4.0.0.8 and 4.0.1.x before 4.0.1.10 allows remote authenticated users to gain privileges via unspecified vectors, possibly related to backticks.
CVSS Score: 9.0 (HIGH)
CWE: CWE-264
References: http://permalink.gmane.org/gmane.linux.terminal-server.x2go.announce/83; http://security.gentoo.org/glsa/glsa-201405-26.xml; http://www.openwall.com/lists/oss-security/2014/05/18/1
CVE: CVE-2014-1855
Published: 2014-05-20
Description: Multiple cross-site scripting (XSS) vulnerabilities in Seo Panel before 3.5.0 allow remote attackers to inject arbitrary web script or HTML via the (1) capcheck parameter to directories.php or (2) keyword parameter to proxy.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://forum.seopanel.in/viewtopic.php?f=7&t=10978; http://packetstormsecurity.com/files/126706/Seo-Panel-3.4.0-Cross-Site-Scripting.html; http://secunia.com/advisories/58706
CVE: CVE-2014-3412
Published: 2014-05-20
Description: Unspecified vulnerability in Juniper Junos Space before 13.3R1.8, when the firewall in disabled, allows remote attackers to execute arbitrary commands via unspecified vectors.
CVSS Score: 10.0 (HIGH)
References: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10626; http://www.securityfocus.com/bid/67454; http://www.securitytracker.com/id/1030254
CVE: CVE-2014-3738
Published: 2014-05-20
Description: Cross-site scripting (XSS) vulnerability in Zenoss 4.2.5 allows remote attackers to inject arbitrary web script or HTML via the title of a device.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/127623/Zenoss-Monitoring-System-4.2.5-2108-Cross-Site-Scripting.html; http://www.exploit-db.com/exploits/34165; http://www.openwall.com/lists/oss-security/2014/05/14/5
CVE: CVE-2014-3739
Published: 2014-05-20
Description: Open redirect vulnerability in zport/acl_users/cookieAuthHelper/login_form in Zenoss 4.2.5 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the came_from parameter.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2014/05/14/5; http://www.openwall.com/lists/oss-security/2014/05/15/5; http://www.securityfocus.com/bid/67396
CVE: CVE-2014-3749
Published: 2014-05-20
Description: SQL injection vulnerability in Construtiva CIS Manager allows remote attackers to execute arbitrary SQL commands via the email parameter to autenticar/lembrarlogin.asp.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://seclists.org/fulldisclosure/2014/May/73; http://www.securityfocus.com/archive/1/532155/100/0/threaded; http://www.securityfocus.com/bid/67442
CVE: CVE-2014-3776
Published: 2014-05-20
Description: Buffer overflow in the "read-u8vector!" procedure in the srfi-4 unit in CHICKEN stable 4.8.0.7 and development snapshots before 4.9.1 allows remote attackers to cause a denial of service (memory corruption and application crash) and possibly execute arbitrary code via a "#f" value in the NUM argument.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://code.call-cc.org/cgi-bin/gitweb.cgi?p=chicken-core.git%3Ba=commit%3Bh=1d06ce7e21c7e903ca5dca11fda6fcf2cc52de5e; http://lists.gnu.org/archive/html/chicken-announce/2014-05/msg00001.html; http://lists.gnu.org/archive/html/chicken-hackers/2014-05/msg00032.html
CVE: CVE-2014-3791
Published: 2014-05-20
Description: Stack-based buffer overflow in Easy File Sharing (EFS) Web Server 6.8 allows remote attackers to execute arbitrary code via a long string in a cookie UserID parameter to vfolder.ghp.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://blog.techorganic.com/2014/05/14/from-fuzzing-to-0-day; http://osvdb.org/show/osvdb/106965; http://packetstormsecurity.com/files/126614/Easy-File-Sharing-Web-Server-6.8-Buffer-Overflow.html
CVE: CVE-2014-3792
Published: 2014-05-20
Description: Cross-site request forgery (CSRF) vulnerability in Beetel 450TC2 Router with firmware TX6-0Q-005_retail allows remote attackers to hijack the authentication of administrators for requests that change the administrator password via the uiViewTools_Password and uiViewTools_PasswordConfirm parameters to Forms/tools_admin_1.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://osvdb.org/show/osvdb/106468; http://packetstormsecurity.com/files/126426/Beetel-450TC2-Cross-Site-Request-Forgery.html; http://secunia.com/advisories/58365
CVE: CVE-2014-3802
Published: 2014-05-20
Description: msdia.dll in Microsoft Debug Interface Access (DIA) SDK, as distributed in Microsoft Visual Studio before 2013, does not properly validate an unspecified variable before use in calculating a dynamic-call address, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted PDB file.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/67398; http://zerodayinitiative.com/advisories/ZDI-14-129/; http://www.securityfocus.com/bid/67398
CVE: CVE-2014-1743
Published: 2014-05-21
Description: Use-after-free vulnerability in the StyleElement::removedFromDocument function in core/dom/StyleElement.cpp in Blink, as used in Google Chrome before 35.0.1916.114, allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via crafted JavaScript code that triggers tree mutation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://googlechromereleases.blogspot.com/2014/05/stable-channel-update_20.html; http://lists.opensuse.org/opensuse-updates/2014-06/msg00023.html; http://secunia.com/advisories/58920
CVE: CVE-2014-1744
Published: 2014-05-21
Description: Integer overflow in the AudioInputRendererHost::OnCreateStream function in content/browser/renderer_host/media/audio_input_renderer_host.cc in Google Chrome before 35.0.1916.114 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger a large shared-memory allocation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-189
References: http://googlechromereleases.blogspot.com/2014/05/stable-channel-update_20.html; http://lists.opensuse.org/opensuse-updates/2014-06/msg00023.html; http://secunia.com/advisories/58920
CVE: CVE-2014-1745
Published: 2014-05-21
Description: Use-after-free vulnerability in the SVG implementation in Blink, as used in Google Chrome before 35.0.1916.114, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger removal of an SVGFontFaceElement object, related to core/svg/SVGFontFaceElement.cpp.
CVSS Score: 7.1 (HIGH)
CWE: CWE-399, CWE-399
References: http://googlechromereleases.blogspot.com/2014/05/stable-channel-update_20.html; http://lists.opensuse.org/opensuse-updates/2014-06/msg00023.html; http://secunia.com/advisories/58920
CVE: CVE-2014-1746
Published: 2014-05-21
Description: The InMemoryUrlProtocol::Read function in media/filters/in_memory_url_protocol.cc in Google Chrome before 35.0.1916.114 relies on an insufficiently large integer data type, which allows remote attackers to cause a denial of service (out-of-bounds read) via vectors that trigger use of a large buffer.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://googlechromereleases.blogspot.com/2014/05/stable-channel-update_20.html; http://lists.opensuse.org/opensuse-updates/2014-06/msg00023.html; http://secunia.com/advisories/58920
CVE: CVE-2014-1747
Published: 2014-05-21
Description: Cross-site scripting (XSS) vulnerability in the DocumentLoader::maybeCreateArchive function in core/loader/DocumentLoader.cpp in Blink, as used in Google Chrome before 35.0.1916.114, allows remote attackers to inject arbitrary web script or HTML via crafted MHTML content, aka "Universal XSS (UXSS)."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://googlechromereleases.blogspot.com/2014/05/stable-channel-update_20.html; http://lists.opensuse.org/opensuse-updates/2014-06/msg00023.html; http://secunia.com/advisories/58920
CVE: CVE-2014-1748
Published: 2014-05-21
Description: The ScrollView::paint function in platform/scroll/ScrollView.cpp in Blink, as used in Google Chrome before 35.0.1916.114, allows remote attackers to spoof the UI by extending scrollbar painting into the parent frame.
CVSS Score: 5.0 (MEDIUM)
References: http://googlechromereleases.blogspot.com/2014/05/stable-channel-update_20.html; http://lists.apple.com/archives/security-announce/2014/Dec/msg00000.html; http://lists.opensuse.org/opensuse-updates/2014-06/msg00023.html
CVE: CVE-2014-1749
Published: 2014-05-21
Description: Multiple unspecified vulnerabilities in Google Chrome before 35.0.1916.114 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://googlechromereleases.blogspot.com/2014/05/stable-channel-update_20.html; http://lists.opensuse.org/opensuse-updates/2014-06/msg00023.html; http://secunia.com/advisories/58920
CVE: CVE-2014-3152
Published: 2014-05-21
Description: Integer underflow in the LCodeGen::PrepareKeyedOperand function in arm/lithium-codegen-arm.cc in Google V8 before 3.25.28.16, as used in Google Chrome before 35.0.1916.114, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger a negative key value.
CVSS Score: 7.5 (HIGH)
CWE: CWE-189
References: http://googlechromereleases.blogspot.com/2014/05/stable-channel-update_20.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157338.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157357.html
CVE: CVE-2014-3803
Published: 2014-05-21
Description: The SpeechInput feature in Blink, as used in Google Chrome before 35.0.1916.114, allows remote attackers to enable microphone access and obtain speech-recognition text without indication via an INPUT element with a -x-webkit-speech attribute.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://blog.guya.net/2014/04/07/to-listen-without-consent-abusing-the-html5-speech/; http://googlechromereleases.blogspot.com/2014/05/stable-channel-update_20.html; http://secunia.com/advisories/60372
CVE: CVE-2011-2198
Published: 2014-05-21
Description: The "insert-blank-characters" capability in caps.c in gnome-terminal (vte) before 0.28.1 allows remote authenticated users to cause a denial of service (CPU and memory consumption and crash) via a crafted file, as demonstrated by a file containing the string "\033[[PII_REDACTED]0000000@".
CVSS Score: 3.5 (LOW)
CWE: CWE-20, CWE-399
References: http://lists.opensuse.org/opensuse-updates/2012-08/msg00001.html; http://www.openwall.com/lists/oss-security/2011/06/09/3; http://www.openwall.com/lists/oss-security/2011/06/13/10
CVE: CVE-2012-1166
Published: 2014-05-21
Description: The default keybindings for wwm in LTSP Display Manager (ldm) 2.2.x before 2.2.7 allow remote attackers to execute arbitrary commands via the KP_RETURN keybinding, which launches a terminal window.
CVSS Score: 10.0 (HIGH)
CWE: CWE-78
References: http://irclogs.ltsp.org/?d=2012-03-12; http://www.ubuntu.com/usn/USN-1398-1; https://bugs.launchpad.net/ubuntu/%2Bsource/ldm/%2Bbug/953340
CVE: CVE-2014-3806
Published: 2014-05-21
Description: Directory traversal vulnerability in cgi-bin/help/doIt.cgi in VMTurbo Operations Manager before 4.6 allows remote attackers to read arbitrary files via a .. (dot dot) in the xml_path parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/show/osvdb/106776; http://packetstormsecurity.com/files/126550/VM-Turbo-Operations-Manager-4.5.x-Directory-Traversal.html; http://www.exploit-db.com/exploits/33334
CVE: CVE-2014-3807
Published: 2014-05-21
Description: Multiple cross-site scripting (XSS) vulnerabilities in BarracudaDrive 6.7.2 allow remote attackers to inject arbitrary web script or HTML via the (1) blog, (2) bloggeruser, or (3) bloggerpasswd parameter to private/manage/.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/126645/BarracudaDrive-6.7.2-Cross-Site-Scripting.html; http://secunia.com/advisories/58712; http://www.securityfocus.com/bid/67428
CVE: CVE-2014-3808
Published: 2014-05-21
Description: Multiple cross-site scripting (XSS) vulnerabilities in BarracudaDrive before 6.7.2 allow remote attackers to inject arbitrary web script or HTML via the (1) role parameter to roles.lsp, (2) name parameter to user.lsp, (3) path parameter to wizard/setuser.lsp, (4) host parameter to tunnelconstr.lsp, or (5) newpath parameter to wfsconstr.lsp in rtl/protected/admin/.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secpod.org/advisories/SecPod_Advistory_BarracudaDrive_6.7.1_Mult_XSS_Vuln.txt; http://secpod.org/blog/?p=2309; http://secunia.com/advisories/58309
CVE: CVE-2014-0949
Published: 2014-05-22
Description: IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0 through 7.0.0.2 CF28, and 8.0 before 8.0.0.1 CF12 allows remote attackers to cause a denial of service (resource consumption and daemon crash) via a crafted web request.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PI15692; http://www-01.ibm.com/support/docview.wss?uid=swg21672572; https://exchange.xforce.ibmcloud.com/vulnerabilities/92622
CVE: CVE-2014-0951
Published: 2014-05-22
Description: Cross-site scripting (XSS) vulnerability in FilterForm.jsp in IBM WebSphere Portal 7.0 before 7.0.0.2 CF28 and 8.0 before 8.0.0.1 CF12 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PI15690; http://www-01.ibm.com/support/docview.wss?uid=swg21672572; https://exchange.xforce.ibmcloud.com/vulnerabilities/92624
CVE: CVE-2014-0952
Published: 2014-05-22
Description: Cross-site scripting (XSS) vulnerability in boot_config.jsp in IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF28, 7.0 through 7.0.0.2 CF28, and 8.0 before 8.0.0.1 CF12 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PI16041; http://www-01.ibm.com/support/docview.wss?uid=swg21672572; https://exchange.xforce.ibmcloud.com/vulnerabilities/92625
CVE: CVE-2014-0954
Published: 2014-05-22
Description: IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0 through 7.0.0.2 CF28, and 8.0 before 8.0.0.1 CF12 does not validate JSP includes, which allows remote attackers to obtain sensitive information, bypass intended request-dispatcher access restrictions, or cause a denial of service (memory consumption) via a crafted URL.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PI15723; http://www-01.ibm.com/support/docview.wss?uid=swg21672572; https://exchange.xforce.ibmcloud.com/vulnerabilities/92627
CVE: CVE-2014-0955
Published: 2014-05-22
Description: Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 8.0 before 8.0.0.1 CF12, when Social Rendering in Connections integration is enabled, allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PI15583; http://www-01.ibm.com/support/docview.wss?uid=swg21672572; https://exchange.xforce.ibmcloud.com/vulnerabilities/92628
CVE: CVE-2014-0956
Published: 2014-05-22
Description: Cross-site scripting (XSS) vulnerability in googlemap.jsp in IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0 through 7.0.0.2 CF28, and 8.0 before 8.0.0.1 CF12 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PI16040; http://www-01.ibm.com/support/docview.wss?uid=swg21672572; https://exchange.xforce.ibmcloud.com/vulnerabilities/92629
CVE: CVE-2014-0958
Published: 2014-05-22
Description: Open redirect vulnerability in IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0 through 7.0.0.2 CF28, and 8.0 before 8.0.0.1 CF12 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
CVSS Score: 5.8 (MEDIUM)
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PI15689; http://www-01.ibm.com/support/docview.wss?uid=swg21672572; https://exchange.xforce.ibmcloud.com/vulnerabilities/92739
CVE: CVE-2014-0959
Published: 2014-05-22
Description: IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0 through 7.0.0.2 CF28, and 8.0 before 8.0.0.1 CF12 allows remote authenticated users to cause a denial of service (infinite loop) via a login redirect.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-20
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PI16462; http://www-01.ibm.com/support/docview.wss?uid=swg21672572; https://exchange.xforce.ibmcloud.com/vulnerabilities/92741
CVE: CVE-2014-1770
Published: 2014-05-22
Description: Use-after-free vulnerability in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code via crafted JavaScript code that interacts improperly with a CollectGarbage function call on a CMarkup object allocated by the CMarkup::CreateInitialMarkup function.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://www.kb.cert.org/vuls/id/239151; http://www.securityfocus.com/bid/67544; http://www.securitytracker.com/id/1030266
CVE: CVE-2014-2604
Published: 2014-05-22
Description: Unspecified vulnerability in HP IceWall SSO 10.0 Dfw and IceWall MCRP 2.1 and 3.0 allows remote attackers to cause a denial of service via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://www.securitytracker.com/id/1030264; https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04278900; http://www.securitytracker.com/id/1030264
CVE: CVE-2014-3775
Published: 2014-05-22
Description: libgadu before 1.11.4 and 1.12.0 before 1.12.0-rc3, as used in Pidgin and other products, allows remote Gadu-Gadu file relay servers to cause a denial of service (memory overwrite) or possibly execute arbitrary code via a crafted message.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://lists.ziew.org/pipermail/libgadu-devel/2014-May/001171.html; http://lists.ziew.org/pipermail/libgadu-devel/2014-May/001180.html; http://secunia.com/advisories/58668
CVE: CVE-2014-3210
Published: 2014-05-22
Description: SQL injection vulnerability in dopbs-backend-forms.php in the Booking System (Booking Calendar) plugin before 1.3 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the booking_form_id parameter to wp-admin/admin-ajax.php.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://packetstormsecurity.com/files/126762/WordPress-Booking-System-SQL-Injection.html; http://wordpress.org/plugins/booking-system/changelog; http://www.securityfocus.com/archive/1/532168/100/0/threaded
CVE: CVE-2014-3783
Published: 2014-05-22
Description: SQL injection vulnerability in admin/categories.php in Dotclear before 2.6.3 allows remote authenticated users with the manage categories permission to execute arbitrary SQL commands via the categories_order parameter.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-89
References: http://dotclear.org/blog/post/2014/05/16/Dotclear-2.6.3; http://karmainsecurity.com/KIS-2014-07; http://packetstormsecurity.com/files/126768/Dotclear-2.6.2-SQL-Injection.html
CVE: CVE-2014-3841
Published: 2014-05-22
Description: Cross-site scripting (XSS) vulnerability in the Contact Bank plugin before 2.0.20 for WordPress allows remote attackers to inject arbitrary web script or HTML via the Label field, related to form layout configuration.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/58300; http://wordpress.org/plugins/contact-bank/changelog; http://www.securityfocus.com/bid/67334
CVE: CVE-2014-3842
Published: 2014-05-22
Description: Multiple cross-site scripting (XSS) vulnerabilities in the iMember360 plugin 3.8.012 through 3.9.001 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) decrypt or (2) encrypt parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/show/osvdb/106299; http://packetstormsecurity.com/files/126324/WordPress-iMember360is-3.9.001-XSS-Disclosure-Code-Execution.html; http://seclists.org/fulldisclosure/2014/Apr/265
CVE: CVE-2014-3843
Published: 2014-05-22
Description: Cross-site request forgery (CSRF) vulnerability in the Search Everything plugin before 8.1.1 for WordPress allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://secunia.com/advisories/58502; http://wordpress.org/plugins/search-everything/changelog; http://secunia.com/advisories/58502
CVE: CVE-2014-3844
Published: 2014-05-22
Description: The TinyMCE Color Picker plugin before 1.2 for WordPress does not properly check permissions, which allows remote attackers to modify plugin settings via unspecified vectors.  NOTE: some of these details are obtained from third party information.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/58095; http://wordpress.org/plugins/tinymce-colorpicker/changelog; http://secunia.com/advisories/58095
CVE: CVE-2014-3845
Published: 2014-05-22
Description: Cross-site request forgery (CSRF) vulnerability in the TinyMCE Color Picker plugin before 1.2 for WordPress allows remote attackers to hijack the authentication of unspecified users for requests that change plugin settings via unknown vectors.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://secunia.com/advisories/58095; http://wordpress.org/plugins/tinymce-colorpicker/changelog; http://secunia.com/advisories/58095
CVE: CVE-2014-3846
Published: 2014-05-22
Description: Cross-site scripting (XSS) vulnerability in Flying Cart allows remote attackers to inject arbitrary web script or HTML via the p parameter to index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/126735/flyingcart-xss.txt; http://www.securityfocus.com/bid/67529; http://packetstormsecurity.com/files/126735/flyingcart-xss.txt
CVE: CVE-2014-1323
Published: 2014-05-22
Description: WebKit, as used in Apple Safari before 6.1.4 and 7.x before 7.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-05-21-1.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2014-05/0128.html; http://archives.neohapsis.com/archives/bugtraq/2014-06/0174.html; http://archives.neohapsis.com/archives/bugtraq/2014-06/0175.html
CVE: CVE-2014-1324
Published: 2014-05-22
Description: WebKit, as used in Apple Safari before 6.1.4 and 7.x before 7.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-05-21-1.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2014-05/0128.html; http://support.apple.com/kb/HT6254; http://www.securityfocus.com/bid/67553