deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-0260
Published: 2014-01-15
Description: Microsoft Word 2003 SP3, 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Office Compatibility Pack SP3; Word Viewer; SharePoint Server 2010 SP1 and SP2 and 2013; Office Web Apps 2010 SP1 and SP2; and Office Web Apps Server 2013 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Word Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.securitytracker.com/id/1029598; http://www.securitytracker.com/id/1029599; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-001
CVE: CVE-2014-0261
Published: 2014-01-15
Description: Microsoft Dynamics AX 4.0 SP2, 2009 SP1, 2012, and 2012 R2 allows remote authenticated users to cause a denial of service (instance outage) via crafted data to an Application Object Server (AOS) instance, aka "Query Filter DoS Vulnerability."
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-20
References: http://www.securitytracker.com/id/1029601; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-004; http://www.securitytracker.com/id/1029601
CVE: CVE-2014-0262
Published: 2014-01-15
Description: win32k.sys in the kernel-mode drivers in Microsoft Windows 7 SP1 and Server 2008 R2 SP1 does not properly consider thread-owned objects during the processing of window handles, which allows local users to gain privileges via a crafted application, aka "Win32k Window Handle Vulnerability."
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://www.securityfocus.com/bid/64725; http://www.securitytracker.com/id/1029600; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-003
CVE: CVE-2014-0491
Published: 2014-01-15
Description: Adobe Flash Player before 11.7.700.260 and 11.8.x and 11.9.x before 12.0.0.38 on Windows and Mac OS X and before 11.2.202.335 on Linux, Adobe AIR before 4.0.0.1390, Adobe AIR SDK before 4.0.0.1390, and Adobe AIR SDK & Compiler before 4.0.0.1390 allow attackers to bypass unspecified protection mechanisms via unknown vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://helpx.adobe.com/security/products/flash-player/apsb14-02.html; http://lists.opensuse.org/opensuse-security-announce/2014-01/msg00006.html; http://rhn.redhat.com/errata/RHSA-2014-0028.html
CVE: CVE-2014-0492
Published: 2014-01-15
Description: Adobe Flash Player before 11.7.700.260 and 11.8.x and 11.9.x before 12.0.0.38 on Windows and Mac OS X and before 11.2.202.335 on Linux, Adobe AIR before 4.0.0.1390, Adobe AIR SDK before 4.0.0.1390, and Adobe AIR SDK & Compiler before 4.0.0.1390 allow attackers to defeat the ASLR protection mechanism by leveraging an "address leak."
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://helpx.adobe.com/security/products/flash-player/apsb14-02.html; http://lists.opensuse.org/opensuse-security-announce/2014-01/msg00006.html; http://rhn.redhat.com/errata/RHSA-2014-0028.html
CVE: CVE-2014-0493
Published: 2014-01-15
Description: Adobe Reader and Acrobat 10.x before 10.1.9 and 11.x before 11.0.06 on Windows and Mac OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0495.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://helpx.adobe.com/security/products/acrobat/apsb14-01.html; http://www.securitytracker.com/id/1029604; http://helpx.adobe.com/security/products/acrobat/apsb14-01.html
CVE: CVE-2014-0495
Published: 2014-01-15
Description: Adobe Reader and Acrobat 10.x before 10.1.9 and 11.x before 11.0.06 on Windows and Mac OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0493.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://helpx.adobe.com/security/products/acrobat/apsb14-01.html; http://www.securitytracker.com/id/1029604; http://helpx.adobe.com/security/products/acrobat/apsb14-01.html
CVE: CVE-2014-0496
Published: 2014-01-15
Description: Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.9 and 11.x before 11.0.06 on Windows and Mac OS X allows attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: http://helpx.adobe.com/security/products/acrobat/apsb14-01.html; http://www.securitytracker.com/id/1029604; http://helpx.adobe.com/security/products/acrobat/apsb14-01.html
CVE: CVE-2014-1448
Published: 2014-01-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2014-1447.  Reason: This candidate is a reservation duplicate of CVE-2014-1447.  Only one candidate was needed for the disclosure in question.  Notes: All CVE users should reference CVE-2014-1447 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2013-2139
Published: 2014-01-16
Description: Buffer overflow in srtp.c in libsrtp in srtp 1.4.5 and earlier allows remote attackers to cause a denial of service (crash) via vectors related to a length inconsistency in the crypto_policy_set_from_profile_for_rtp and srtp_protect functions.
CVSS Score: 2.6 (LOW)
CWE: CWE-119
References: http://advisories.mageia.org/MGASA-2014-0465.html; http://lists.opensuse.org/opensuse-updates/2013-07/msg00083.html; http://lists.opensuse.org/opensuse-updates/2014-09/msg00059.html
CVE: CVE-2013-7294
Published: 2014-01-16
Description: The ikev2parent_inI1outR1 function in pluto/ikev2_parent.c in libreswan before 3.7 allows remote attackers to cause a denial of service (restart) via an IKEv2 I1 notification without a KE payload.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/56276; http://secunia.com/advisories/56915; http://www.osvdb.org/101573
CVE: CVE-2014-1472
Published: 2014-01-16
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Enterprise Manager in McAfee Vulnerability Manager (MVM) 7.5.5 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/101940; http://secunia.com/advisories/56394; http://www.securityfocus.com/bid/64795
CVE: CVE-2014-1473
Published: 2014-01-16
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the Enterprise Manager in McAfee Vulnerability Manager (MVM) 7.5.5 and earlier allow remote attackers to hijack the authentication of users for requests that modify HTML via unspecified vectors related to the "response web page."
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://osvdb.org/101939; http://secunia.com/advisories/56394; http://www.securityfocus.com/bid/64795
CVE: CVE-2013-6641
Published: 2014-01-16
Description: Use-after-free vulnerability in the FormAssociatedElement::formRemovedFromTree function in core/html/FormAssociatedElement.cpp in Blink, as used in Google Chrome before 32.0.1700.76 on Windows and before 32.0.1700.77 on Mac OS X and Linux, allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging improper handling of the past names map of a FORM element.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: http://googlechromereleases.blogspot.com/2014/01/stable-channel-update.html; http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00008.html; http://www.debian.org/security/2014/dsa-2862
CVE: CVE-2013-6642
Published: 2014-01-16
Description: Google Chrome through 32.0.1700.23 on Android allows remote attackers to spoof the address bar via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://googlechromereleases.blogspot.com/2014/01/stable-channel-update.html; https://code.google.com/p/chromium/issues/detail?id=324969; http://googlechromereleases.blogspot.com/2014/01/stable-channel-update.html
CVE: CVE-2013-6643
Published: 2014-01-16
Description: The OneClickSigninBubbleView::WindowClosing function in browser/ui/views/sync/one_click_signin_bubble_view.cc in Google Chrome before 32.0.1700.76 on Windows and before 32.0.1700.77 on Mac OS X and Linux allows attackers to trigger a sync with an arbitrary Google account by leveraging improper handling of the closing of an untrusted signin confirm dialog.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://googlechromereleases.blogspot.com/2014/01/stable-channel-update.html; http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00008.html; http://www.debian.org/security/2014/dsa-2862
CVE: CVE-2013-6644
Published: 2014-01-16
Description: Multiple unspecified vulnerabilities in Google Chrome before 32.0.1700.76 on Windows and before 32.0.1700.77 on Mac OS X and Linux allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: http://googlechromereleases.blogspot.com/2014/01/stable-channel-update.html; http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00008.html; http://www.debian.org/security/2014/dsa-2862
CVE: CVE-2013-6645
Published: 2014-01-16
Description: Use-after-free vulnerability in the OnWindowRemovingFromRootWindow function in content/browser/web_contents/web_contents_view_aura.cc in Google Chrome before 32.0.1700.76 on Windows and before 32.0.1700.77 on Mac OS X and Linux allows user-assisted remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving certain print-preview and tab-switch actions that interact with a speech input element.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-416
References: http://code.google.com/p/chromium/issues/detail?id=320183; http://googlechromereleases.blogspot.com/2014/01/stable-channel-update.html; http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00008.html
CVE: CVE-2013-6646
Published: 2014-01-16
Description: Use-after-free vulnerability in the Web Workers implementation in Google Chrome before 32.0.1700.76 on Windows and before 32.0.1700.77 on Mac OS X and Linux allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the shutting down of a worker process.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: http://googlechromereleases.blogspot.com/2014/01/stable-channel-update.html; http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00008.html; http://www.debian.org/security/2014/dsa-2862
CVE: CVE-2013-6687
Published: 2014-01-16
Description: The web portal in the Enterprise License Manager component in Cisco WebEx Meetings Server allows remote authenticated users to discover the cleartext administrative password by reading HTML source code, aka Bug ID CSCul33876.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-255
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-6687; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-6687
CVE: CVE-2013-6786
Published: 2014-01-16
Description: Cross-site scripting (XSS) vulnerability in Allegro RomPager before 4.51, as used on the ZyXEL P660HW-D1, Huawei MT882, Sitecom WL-174, TP-LINK TD-8816, and D-Link DSL-2640R and DSL-2641R, when the "forbidden author header" protection mechanism is bypassed, allows remote attackers to inject arbitrary web script or HTML by requesting a nonexistent URI in conjunction with a crafted HTTP Referer header that is not properly handled in a 404 page.  NOTE: there is no CVE for a "URL redirection" issue that some sources list separately.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://antoniovazquezblanco.github.io/docs/advisories/Advisory_RomPagerXSS.pdf; http://osvdb.org/99694; http://osvdb.org/ref/99/rompager407.pdf
CVE: CVE-2014-0648
Published: 2014-01-16
Description: The RMI interface in Cisco Secure Access Control System (ACS) 5.x before 5.5 does not properly enforce authentication and authorization requirements, which allows remote attackers to obtain administrative access via a request to this interface, aka Bug ID CSCud75187.
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://osvdb.org/102117; http://secunia.com/advisories/56213; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140115-csacs
CVE: CVE-2014-0649
Published: 2014-01-16
Description: The RMI interface in Cisco Secure Access Control System (ACS) 5.x before 5.5 does not properly enforce authorization requirements, which allows remote authenticated users to obtain superadmin access via a request to this interface, aka Bug ID CSCud75180.
CVSS Score: 9.0 (HIGH)
CWE: CWE-264
References: http://osvdb.org/102116; http://secunia.com/advisories/56213; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140115-csacs
CVE: CVE-2014-0650
Published: 2014-01-16
Description: The web interface in Cisco Secure Access Control System (ACS) 5.x before 5.4 Patch 3 allows remote attackers to execute arbitrary operating-system commands via a request to this interface, aka Bug ID CSCue65962.
CVSS Score: 10.0 (HIGH)
CWE: CWE-20
References: http://osvdb.org/102115; http://secunia.com/advisories/56213; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140115-csacs
CVE: CVE-2014-0666
Published: 2014-01-16
Description: Directory traversal vulnerability in the Send Screen Capture implementation in Cisco Jabber 9.2(.1) and earlier on Windows allows remote attackers to upload arbitrary types of files, and consequently execute arbitrary code, via modified packets, aka Bug ID CSCug48056.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/102122; http://secunia.com/advisories/56331; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0666
CVE: CVE-2014-0667
Published: 2014-01-16
Description: The RMI interface in Cisco Secure Access Control System (ACS) does not properly enforce authorization requirements, which allows remote authenticated users to read arbitrary files via a request to this interface, aka Bug ID CSCud75169.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/102168; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0667; http://tools.cisco.com/security/center/viewAlert.x?alertId=32468
CVE: CVE-2013-3698
Published: 2014-01-16
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2013-6346.  Reason: This candidate is a duplicate of CVE-2013-6346.  Notes: All CVE users should reference CVE-2013-6346 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2013-3699
Published: 2014-01-16
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not a security issue.  Notes: none
CVE: CVE-2013-3701
Published: 2014-01-16
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2013-6345.  Reason: This candidate is a duplicate of CVE-2013-6345.  Notes: All CVE users should reference CVE-2013-6345 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2013-3702
Published: 2014-01-16
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2013-6344.  Reason: This candidate is a duplicate of CVE-2013-6344.  Notes: All CVE users should reference CVE-2013-6344 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2013-6325
Published: 2014-01-16
Description: IBM WebSphere Application Server 7.x before 7.0.0.31, 8.0.x before 8.0.0.8, and 8.5.x before 8.5.5.2 allows remote attackers to cause a denial of service (resource consumption) via a crafted request to a web services endpoint.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PM99450; http://www-01.ibm.com/support/docview.wss?uid=swg21661323; http://www-01.ibm.com/support/docview.wss?uid=swg21661325
CVE: CVE-2013-6330
Published: 2014-01-16
Description: IBM WebSphere Application Server 7.x before 7.0.0.31, when simpleFileServlet static file caching is enabled, allows remote authenticated users to obtain sensitive information via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PM98624; http://www-01.ibm.com/support/docview.wss?uid=swg21661323; https://exchange.xforce.ibmcloud.com/vulnerabilities/88905
CVE: CVE-2013-6725
Published: 2014-01-16
Description: Cross-site scripting (XSS) vulnerability in the Administrative Console in IBM WebSphere Application Server 7.x before 7.0.0.31, 8.0.x before 8.0.0.8, and 8.5.x before 8.5.5.2 allows remote authenticated administrators to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://osvdb.org/102119; http://www-01.ibm.com/support/docview.wss?uid=swg1PM98132; http://www-01.ibm.com/support/docview.wss?uid=swg21661323
CVE: CVE-2012-6620
Published: 2014-01-16
Description: Multiple cross-site scripting (XSS) vulnerabilities in the (1) tasks and (2) search views in Horde Kronolith H4 before 3.0.17 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://bugs.horde.org/ticket/11189; http://lists.horde.org/archives/announce/2012/000766.html; http://secunia.com/advisories/49147
CVE: CVE-2012-6621
Published: 2014-01-16
Description: Multiple cross-site scripting (XSS) vulnerabilities in GetSimple CMS 3.1, 3.1.2, 3.2.3, and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) Email Address or (2) Custom Permalink Structure fields in admin/settings.php; (3) path parameter to admin/upload.php; (4) err parameter to admin/theme.php; (5) error parameter to admin/pages.php; or (6) success or (7) err parameter to admin/index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/124711; http://packetstormsecurity.org/files/112643/GetSimple-CMS-3.1-Cross-Site-Scripting.html; http://secunia.com/advisories/49137
CVE: CVE-2012-6622
Published: 2014-01-16
Description: Multiple cross-site scripting (XSS) vulnerabilities in fs-admin/fs-admin.php in the ForumPress WP Forum Server plugin before 1.7.4 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) groupid parameter in an editgroup action or (2) usergroup_id parameter in an edit_usergroup action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/files/112703/WordPress-WP-Forum-Server-1.7.3-SQL-Injection-Cross-Site-Scripting.html; http://secunia.com/advisories/49155; http://wordpress.org/extend/plugins/forum-server/changelog/
CVE: CVE-2012-6623
Published: 2014-01-16
Description: Cross-site scripting (XSS) vulnerability in fs-admin/wpf-add-forum.php in the ForumPress WP Forum Server plugin before 1.7.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the groupid parameter in an addforum action to wp-admin/admin.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/files/112703/WordPress-WP-Forum-Server-1.7.3-SQL-Injection-Cross-Site-Scripting.html; http://secunia.com/advisories/49167; http://wordpress.org/extend/plugins/forum-server/changelog/
CVE: CVE-2012-6624
Published: 2014-01-16
Description: Cross-site scripting (XSS) vulnerability in the SoundCloud Is Gold plugin 2.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the width parameter in a soundcloud_is_gold_player_preview action to wp-admin/admin-ajax.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/files/112689/WordPress-Soundcloud-Is-Gold-2.1-Cross-Site-Scripting.html; http://secunia.com/advisories/49188; http://www.securityfocus.com/bid/53537
CVE: CVE-2012-6625
Published: 2014-01-16
Description: SQL injection vulnerability in fs-admin/fs-admin.php in the ForumPress WP Forum Server plugin before 1.7.4 for WordPress allows remote attackers to execute arbitrary SQL commands via the groupid parameter in an editgroup action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/files/112703/WordPress-WP-Forum-Server-1.7.3-SQL-Injection-Cross-Site-Scripting.html; http://wordpress.org/extend/plugins/forum-server/changelog/; http://www.securityfocus.com/bid/53530
CVE: CVE-2012-6626
Published: 2014-01-16
Description: SQL injection vulnerability in verify-user.php in b2ePMS 1.0 allows remote attackers to execute arbitrary SQL commands via the username field.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://archives.neohapsis.com/archives/bugtraq/2012-05/0065.html; http://www.exploit-db.com/exploits/18882; http://www.securityfocus.com/bid/53505
CVE: CVE-2012-6627
Published: 2014-01-16
Description: Cross-site scripting (XSS) vulnerability in admin/test_mail.php in the Newsletter Manager plugin 1.0.2 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the id parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/files/112694/WordPress-Newsletter-Manager-1.0-Cross-Site-Scripting.html; http://secunia.com/advisories/49152; http://packetstormsecurity.org/files/112694/WordPress-Newsletter-Manager-1.0-Cross-Site-Scripting.html
CVE: CVE-2012-6628
Published: 2014-01-16
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Newsletter Manager plugin before 1.0.2 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) xyz_em_campName to admin/create_campaign.php or (2) admin/edit_campaign.php, (3) xyz_em_email parameter to admin/edit_email.php, (4) xyz_em_exportbatchSize parameter to import_export.php, or (5) pagination limit in the Newsletter Manager options.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/files/112694/WordPress-Newsletter-Manager-1.0-Cross-Site-Scripting.html; http://secunia.com/advisories/49183; https://plugins.trac.wordpress.org/changeset/533904
CVE: CVE-2012-6629
Published: 2014-01-16
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the Newsletter Manager plugin 1.0.2 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change an email address or (2) conduct script insertion attacks.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://secunia.com/advisories/49152; http://secunia.com/advisories/49152
CVE: CVE-2012-6630
Published: 2014-01-16
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Media Library Categories plugin 1.1.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) bulk parameter to media-library-categories/add.php or (2) q parameter to media-library-categories/view.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/files/112697/WordPress-Media-Categories-1.1.1-Cross-Site-Scripting.html; http://secunia.com/advisories/49170; http://packetstormsecurity.org/files/112697/WordPress-Media-Categories-1.1.1-Cross-Site-Scripting.html
CVE: CVE-2012-6631
Published: 2014-01-16
Description: Cross-site request forgery (CSRF) vulnerability in accounts/admin/index.php in Vessio NetBill 1.2 allows remote attackers to hijack the authentication of administrators for requests that add accounts via a new-client action.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.org/files/112655/NetBill-Billing-System-1.2-CSRF-XSS.html; http://secunia.com/advisories/49109; http://www.osvdb.org/81881