deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-4667
Published: 2014-07-03
Description: The sctp_association_free function in net/sctp/associola.c in the Linux kernel before 3.15.2 does not properly manage a certain backlog value, which allows remote attackers to cause a denial of service (socket outage) via a crafted SCTP packet.
CVSS Score: 5.0 (MEDIUM)
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=d3217b15a19a4779c39b212358a5c71d725822ee; http://linux.oracle.com/errata/ELSA-2014-3068.html; http://linux.oracle.com/errata/ELSA-2014-3069.html
CVE: CVE-2014-4715
Published: 2014-07-03
Description: Yann Collet LZ4 before r119, when used on certain 32-bit platforms that allocate memory beyond 0x80000000, does not properly detect integer overflows, which allows context-dependent attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted Literal Run, a different vulnerability than CVE-2014-4611.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://blog.securitymouse.com/2014/07/i-was-wrong-proving-lz4-exploitable.html; http://fastcompression.blogspot.fr/2014/07/software-vulnerabilities-how-it-works.html; http://secunia.com/advisories/59770
CVE: CVE-2014-0325
Published: 2014-07-03
Description: Use-after-free vulnerability in Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site that triggers improper processing of CElement objects, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1751 and CVE-2014-1755.  NOTE: MS14-018 originally had a typo of CVE-2014-0235 for this.
CVSS Score: 9.3 (HIGH)
References: http://www.securityfocus.com/bid/66646; http://zerodayinitiative.com/advisories/ZDI-14-078/; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-018
CVE: CVE-2014-2965
Published: 2014-07-03
Description: Cross-site scripting (XSS) vulnerability in auth-settings-x.php in SpamTitan before 6.04 allows remote attackers to inject arbitrary web script or HTML via the sortdir parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/127184/SpamTitan-6.01-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2014/Jun/113; http://www.kb.cert.org/vuls/id/849500
CVE: CVE-2014-3149
Published: 2014-07-03
Description: Cross-site scripting (XSS) vulnerability in Invision Power IP.Board (aka IPB or Power Board) 3.3.x and 3.4.x through 3.4.6, as downloaded before 20140424, or IP.Nexus 1.5.x through 1.5.9, as downloaded before 20140424, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://community.invisionpower.com/topic/399747-ipboard-33x-34x-security-update; http://packetstormsecurity.com/files/127328/IP.Board-3.4.x-3.3.x-Cross-Site-Scripting.html; http://www.christian-schneider.net/advisories/CVE-2014-3149.txt
CVE: CVE-2014-3538
Published: 2014-07-03
Description: file before 5.19 does not properly restrict the amount of data read during a regex search, which allows remote attackers to cause a denial of service (CPU consumption) via a crafted file that triggers backtracking during processing of an awk rule.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7345.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html; http://mx.gw.com/pipermail/file/2014/001553.html; http://openwall.com/lists/oss-security/2014/06/30/7
CVE: CVE-2014-3857
Published: 2014-07-03
Description: Multiple SQL injection vulnerabilities in Kerio Control Statistics in Kerio Control (formerly WinRoute Firewall) before 8.3.2 allow remote authenticated users to execute arbitrary SQL commands via the (1) x_16 or (2) x_17 parameter to print.php.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://fereidani.com/articles/show/76_kerio_control_8_3_1_boolean_based_blind_sql_injection; http://osvdb.org/show/osvdb/108584; http://packetstormsecurity.com/files/127320/Kerio-Control-8.3.1-Blind-SQL-Injection.html
CVE: CVE-2014-3920
Published: 2014-07-03
Description: Cross-site request forgery (CSRF) vulnerability in Kanboard before 1.0.6 allows remote attackers to hijack the authentication of administrators for requests that add an administrative user via a save action to the default URI.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://kanboard.net/news; http://www.securityfocus.com/archive/1/532619/100/0/threaded; https://www.htbridge.com/advisory/HTB23217
CVE: CVE-2014-4002
Published: 2014-07-03
Description: Multiple cross-site scripting (XSS) vulnerabilities in Cacti 0.8.8b allow remote attackers to inject arbitrary web script or HTML via the (1) drp_action parameter to cdef.php, (2) data_input.php, (3) data_queries.php, (4) data_sources.php, (5) data_templates.php, (6) graph_templates.php, (7) graphs.php, (8) host.php, or (9) host_templates.php or the (10) graph_template_input_id or (11) graph_template_id parameter to graph_templates_inputs.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-updates/2015-03/msg00034.html; http://secunia.com/advisories/59203; http://secunia.com/advisories/59517
CVE: CVE-2014-4195
Published: 2014-07-03
Description: Cross-site scripting (XSS) vulnerability in zero_view_article.php in ZeroCMS 1.0 allows remote attackers to inject arbitrary web script or HTML via the article_id parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/127262/ZeroCMS-1.0-Cross-Site-Scripting.html; http://www.securityfocus.com/bid/68246; http://packetstormsecurity.com/files/127262/ZeroCMS-1.0-Cross-Site-Scripting.html
CVE: CVE-2014-4716
Published: 2014-07-03
Description: Cross-site request forgery (CSRF) vulnerability in Thomson TWG87OUIR allows remote attackers to hijack the authentication of unspecified victims for requests that change passwords via the Password and PasswordReEnter parameters to goform/RgSecurity.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://osvdb.org/show/osvdb/108397; http://packetstormsecurity.com/files/127244/Thomson-TWG87OUIR-Cross-Site-Request-Forgery.html; http://www.exploit-db.com/exploits/33866
CVE: CVE-2014-4717
Published: 2014-07-03
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the Simple Share Buttons Adder plugin before 4.5 for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) ssba_share_text parameter in a save action to wp-admin/options-general.php, which is not properly handled in the homepage, and unspecified vectors related to (2) Pages, (3) Posts, (4) Category/Archive pages or (5) post Excerpts.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.com/files/127238/WordPress-Simple-Share-Buttons-Adder-4.4-CSRF-XSS.html; http://seclists.org/fulldisclosure/2014/Jun/138; https://security.dxw.com/advisories/csrf-and-stored-xss-in-simple-share-buttons-adder
CVE: CVE-2014-4718
Published: 2014-07-03
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in Lunar CMS before 3.3-3 allow remote attackers to hijack the authentication of administrators for requests that (1) add Super users via a request to admin/user_create.php or conduct cross-site scripting (XSS) attacks via the (2) email or (3) subject parameter in contact_form.ext.php to admin/extensions.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://lunarcms.com/Get.html; http://osvdb.org/show/osvdb/108350; http://osvdb.org/show/osvdb/108351
CVE: CVE-2014-4719
Published: 2014-07-03
Description: Cross-site scripting (XSS) vulnerability in the login panel (svn/login/) in User-Friendly SVN (aka USVN) before 1.0.7 allows remote attackers to inject arbitrary web script or HTML via the username field.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/127177/User-Friendly-SVN-Cross-Site-Scripting.html; http://www.securityfocus.com/bid/68155; http://packetstormsecurity.com/files/127177/User-Friendly-SVN-Cross-Site-Scripting.html
CVE: CVE-2014-0247
Published: 2014-07-03
Description: LibreOffice 4.2.4 executes unspecified VBA macros automatically, which has unspecified impact and attack vectors, possibly related to doc/docmacromode.cxx.
CVSS Score: 10.0 (HIGH)
References: http://lists.fedoraproject.org/pipermail/package-announce/2014-July/135020.html; http://lists.opensuse.org/opensuse-updates/2014-07/msg00006.html; http://people.canonical.com/~ubuntu-security/cve/2014/CVE-2014-0247.html
CVE: CVE-2014-0477
Published: 2014-07-03
Description: The parse function in Email::Address module before 1.905 for Perl uses an inefficient regular expression, which allows remote attackers to cause a denial of service (CPU consumption) via an empty quoted string in an RFC 2822 address.
CVSS Score: 5.0 (MEDIUM)
References: http://seclists.org/oss-sec/2014/q2/563; http://secunia.com/advisories/59212; http://secunia.com/advisories/59333
CVE: CVE-2014-3497
Published: 2014-07-03
Description: Cross-site scripting (XSS) vulnerability in OpenStack Swift 1.11.0 through 1.13.1 allows remote attackers to inject arbitrary web script or HTML via the WWW-Authenticate header.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.openstack.org/pipermail/openstack-announce/2014-June/000243.html; http://secunia.com/advisories/59532; http://www.openwall.com/lists/oss-security/2014/06/19/10
CVE: CVE-2014-4168
Published: 2014-07-03
Description: (1) iodined.c and (2) user.c in iodine before 0.7.0 allows remote attackers to bypass authentication by continuing execution after an error has been triggering.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-287
References: http://secunia.com/advisories/59417; http://www.debian.org/security/2014/dsa-2964; http://www.openwall.com/lists/oss-security/2014/06/16/5
CVE: CVE-2014-4672
Published: 2014-07-03
Description: The CDetailView widget in Yii PHP Framework 1.1.14 allows remote attackers to execute arbitrary PHP scripts via vectors related to the value property.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://www.yiiframework.com/news/78/yii-1-1-15-is-released-security-fix/; http://www.yiiframework.com/news/78/yii-1-1-15-is-released-security-fix/
CVE: CVE-2014-4720
Published: 2014-07-06
Description: Email::Address module before 1.904 for Perl uses an inefficient regular expression, which allows remote attackers to cause a denial of service (CPU consumption) via vectors related to "backtracking into the phrase," a different vulnerability than CVE-2014-0477.
CVSS Score: 5.0 (MEDIUM)
References: http://seclists.org/oss-sec/2014/q2/563; https://github.com/rjbs/Email-Address/blob/master/Changes; http://seclists.org/oss-sec/2014/q2/563
CVE: CVE-2014-4721
Published: 2014-07-06
Description: The phpinfo implementation in ext/standard/info.c in PHP before 5.4.30 and 5.5.x before 5.5.14 does not ensure use of the string data type for the PHP_AUTH_PW, PHP_AUTH_TYPE, PHP_AUTH_USER, and PHP_SELF variables, which might allow context-dependent attackers to obtain sensitive information from process memory by using the integer data type with crafted values, related to a "type confusion" vulnerability, as demonstrated by reading a private SSL key in an Apache HTTP Server web-hosting environment with mod_ssl and a PHP 5.3.x mod_php.
CVSS Score: 2.6 (LOW)
CWE: CWE-200
References: http://lists.opensuse.org/opensuse-updates/2014-07/msg00035.html; http://lists.opensuse.org/opensuse-updates/2014-09/msg00046.html; http://rhn.redhat.com/errata/RHSA-2014-1765.html
CVE: CVE-2013-3993
Published: 2014-07-07
Description: IBM InfoSphere BigInsights before 2.1.0.3 allows remote authenticated users to bypass intended file and directory restrictions, or access untrusted data or code, via crafted parameters in unspecified API calls.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22, CWE-22
References: http://secunia.com/advisories/59676; http://www-01.ibm.com/support/docview.wss?uid=swg21677445; http://www.securityfocus.com/bid/68449
CVE: CVE-2013-5423
Published: 2014-07-07
Description: IBM Flex System Manager (FSM) 1.1 through 1.3 before 1.3.2.0 allows remote attackers to enumerate user accounts via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://secunia.com/advisories/58948; http://www-01.ibm.com/support/docview.wss?uid=swg1IT00278; http://www.ibm.com/support/entry/portal/docdisplay?lndocid=migr-5095891
CVE: CVE-2014-0602
Published: 2014-07-07
Description: Directory traversal vulnerability in the DumpToFile method in the NQMcsVarSet ActiveX control in NetIQ Security Manager through 6.5.4 allows remote attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2014-3460.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: https://www.netiq.com/support/kb/doc.php?id=7015309; https://www.netiq.com/support/kb/doc.php?id=7015309
CVE: CVE-2014-0860
Published: 2014-07-07
Description: The firmware before 3.66E in IBM BladeCenter Advanced Management Module (AMM), the firmware before 1.43 in IBM Integrated Management Module (IMM), and the firmware before 4.15 in IBM Integrated Management Module II (IMM2) contains cleartext IPMI credentials, which allows attackers to execute arbitrary IPMI commands, and consequently establish a blade remote-control session, by leveraging access to (1) the chassis internal network or (2) the Ethernet-over-USB interface.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095840; https://exchange.xforce.ibmcloud.com/vulnerabilities/90880; http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095840
CVE: CVE-2014-0864
Published: 2014-07-07
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in Executer in RICOS in IBM Algo Credit Limits (aka ACLM) 4.5.0 through 4.7.0 before 4.7.0.03 FP5 in IBM Algorithmics allow remote attackers to hijack the authentication of arbitrary users for requests that change (1) a deal's currency or (2) a limit via a crafted XML document.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.com/files/127304/IBM-Algorithmics-RICOS-Disclosure-XSS-CSRF.html; http://seclists.org/fulldisclosure/2014/Jun/173; http://secunia.com/advisories/59296
CVE: CVE-2014-0865
Published: 2014-07-07
Description: RICOS in IBM Algo Credit Limits (aka ACLM) 4.5.0 through 4.7.0 before 4.7.0.03 FP5 in IBM Algorithmics relies on client-side input validation, which allows remote authenticated users to bypass intended dual-control restrictions and modify data via crafted serialized objects, as demonstrated by limit manipulations.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-20
References: http://packetstormsecurity.com/files/127304/IBM-Algorithmics-RICOS-Disclosure-XSS-CSRF.html; http://seclists.org/fulldisclosure/2014/Jun/173; http://secunia.com/advisories/59296
CVE: CVE-2014-0866
Published: 2014-07-07
Description: RICOS in IBM Algo Credit Limits (aka ACLM) 4.5.0 through 4.7.0 before 4.7.0.03 FP5 in IBM Algorithmics sends cleartext credentials over HTTP, which allows remote attackers to obtain sensitive information by sniffing the network.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-310
References: http://packetstormsecurity.com/files/127304/IBM-Algorithmics-RICOS-Disclosure-XSS-CSRF.html; http://seclists.org/fulldisclosure/2014/Jun/173; http://www-01.ibm.com/support/docview.wss?uid=swg21675881
CVE: CVE-2014-0867
Published: 2014-07-07
Description: rcore6/main/addcookie.jsp in RICOS in IBM Algo Credit Limits (aka ACLM) 4.5.0 through 4.7.0 before 4.7.0.03 FP5 in IBM Algorithmics allows remote attackers to create or modify cookies via the query string.
CVSS Score: 5.8 (MEDIUM)
References: http://packetstormsecurity.com/files/127304/IBM-Algorithmics-RICOS-Disclosure-XSS-CSRF.html; http://seclists.org/fulldisclosure/2014/Jun/173; http://www-01.ibm.com/support/docview.wss?uid=swg21675881
CVE: CVE-2014-0868
Published: 2014-07-07
Description: RICOS in IBM Algo Credit Limits (aka ACLM) 4.5.0 through 4.7.0 before 4.7.0.03 FP5 in IBM Algorithmics relies on client-side input validation, which allows remote authenticated users to bypass intended dual-control restrictions and modify data via a crafted XML document, as demonstrated by manipulation of read-only limit data.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-20
References: http://packetstormsecurity.com/files/127304/IBM-Algorithmics-RICOS-Disclosure-XSS-CSRF.html; http://seclists.org/fulldisclosure/2014/Jun/173; http://secunia.com/advisories/59296
CVE: CVE-2014-0869
Published: 2014-07-07
Description: The decrypt function in RICOS in IBM Algo Credit Limits (aka ACLM) 4.5.0 through 4.7.0 before 4.7.0.03 FP5 in IBM Algorithmics does not require a key, which makes it easier for remote attackers to obtain cleartext passwords by sniffing the network and then providing a string argument to this function.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-310
References: http://packetstormsecurity.com/files/127304/IBM-Algorithmics-RICOS-Disclosure-XSS-CSRF.html; http://seclists.org/fulldisclosure/2014/Jun/173; http://www-01.ibm.com/support/docview.wss?uid=swg21675881
CVE: CVE-2014-0870
Published: 2014-07-07
Description: Multiple cross-site scripting (XSS) vulnerabilities in RICOS in IBM Algo Credit Limits (aka ACLM) 4.5.0 through 4.7.0 before 4.7.0.03 FP5 in IBM Algorithmics allow remote attackers to inject arbitrary web script or HTML via (1) the Message parameter to rcore6/main/showerror.jsp, (2) the ButtonsetClass parameter to rcore6/main/buttonset.jsp, (3) the MBName parameter to rcore6/frameset.jsp, (4) the Init parameter to algopds/rcore6/main/browse.jsp, or the (5) Name, (6) StoreName, or (7) STYLESHEET parameter to algopds/rcore6/main/ibrowseheader.jsp.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/127304/IBM-Algorithmics-RICOS-Disclosure-XSS-CSRF.html; http://seclists.org/fulldisclosure/2014/Jun/173; http://secunia.com/advisories/59296
CVE: CVE-2014-0871
Published: 2014-07-07
Description: RICOS in IBM Algo Credit Limits (aka ACLM) 4.5.0 through 4.7.0 before 4.7.0.03 FP5 in IBM Algorithmics allows remote attackers to obtain potentially sensitive Tomcat stack-trace information via non-printing characters in a cookie to the /classes/ URI, as demonstrated by the \x00 character.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://packetstormsecurity.com/files/127304/IBM-Algorithmics-RICOS-Disclosure-XSS-CSRF.html; http://seclists.org/fulldisclosure/2014/Jun/173; http://secunia.com/advisories/59296
CVE: CVE-2014-0875
Published: 2014-07-07
Description: Active Cloud Engine (ACE) in IBM Storwize V7000 Unified 1.3.0.0 through 1.4.3.x allows remote attackers to bypass intended ACL restrictions in opportunistic circumstances by leveraging incorrect ACL synchronization over an unreliable NFS connection that requires retransmissions.
CVSS Score: 3.5 (LOW)
CWE: CWE-264
References: http://www.ibm.com/support/docview.wss?uid=ssg1S1004738; http://www.securityfocus.com/bid/68398; http://www.ibm.com/support/docview.wss?uid=ssg1S1004738
CVE: CVE-2014-0894
Published: 2014-07-07
Description: RICOS in IBM Algo Credit Limits (aka ACLM) 4.5.0 through 4.7.0 before 4.7.0.03 FP5 in IBM Algorithmics allows context-dependent attackers to discover database credentials by reading the DbUser and DbPass fields in an XML document.
CVSS Score: 3.5 (LOW)
CWE: CWE-200
References: http://packetstormsecurity.com/files/127304/IBM-Algorithmics-RICOS-Disclosure-XSS-CSRF.html; http://seclists.org/fulldisclosure/2014/Jun/173; http://secunia.com/advisories/59296
CVE: CVE-2014-2197
Published: 2014-07-07
Description: The Administration GUI in the web framework in Cisco Unified Communications Domain Manager (CDM) in Unified CDM Application Software before 8.1.4 does not properly implement access control, which allows remote authenticated users to modify administrative credentials via a crafted URL, aka Bug ID CSCun49862.
CVSS Score: 9.0 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/59573; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140702-cucdm; http://tools.cisco.com/security/center/viewAMBAlert.x?alertId=34689
CVE: CVE-2014-2198
Published: 2014-07-07
Description: Cisco Unified Communications Domain Manager (CDM) in Unified CDM Platform Software before 4.4.2 has a hardcoded SSH private key, which makes it easier for remote attackers to obtain access to the support and root accounts by extracting this key from a binary file found in a different installation of the product, aka Bug ID CSCud41130.
CVSS Score: 10.0 (HIGH)
CWE: CWE-255
References: http://secunia.com/advisories/59544; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140702-cucdm; http://tools.cisco.com/security/center/viewAMBAlert.x?alertId=34689
CVE: CVE-2014-2614
Published: 2014-07-07
Description: Unspecified vulnerability in HP SiteScope 11.1x through 11.13 and 11.2x through 11.24 allows remote attackers to bypass authentication via unknown vectors, aka ZDI-CAN-2140.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://www.securityfocus.com/bid/68361; http://www.securitytracker.com/id/1030519; https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04355129
CVE: CVE-2014-2615
Published: 2014-07-07
Description: Unspecified vulnerability in HP Universal CMDB 10.01 and 10.10 allows remote attackers to execute arbitrary code or obtain sensitive information via unknown vectors, aka ZDI-CAN-2083.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/58912; http://www.securityfocus.com/bid/68363; http://www.securitytracker.com/id/1030518
CVE: CVE-2014-2616
Published: 2014-07-07
Description: Unspecified vulnerability in HP Universal CMDB 10.01 and 10.10 allows remote attackers to execute arbitrary code or obtain sensitive information via unknown vectors, aka ZDI-CAN-2091.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/58912; http://www.securityfocus.com/bid/68363; http://www.securitytracker.com/id/1030518
CVE: CVE-2014-2617
Published: 2014-07-07
Description: Unspecified vulnerability in HP Universal CMDB 10.01 and 10.10 allows remote attackers to execute arbitrary code or obtain sensitive information via unknown vectors, aka ZDI-CAN-2104.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/58912; http://www.securityfocus.com/bid/68363; http://www.securitytracker.com/id/1030518
CVE: CVE-2014-2967
Published: 2014-07-07
Description: Autodesk VRED Professional 2014 before SR1 SP8 allows remote attackers to execute arbitrary code via Python os library calls in Python API commands to the integrated web server.
CVSS Score: 10.0 (HIGH)
CWE: CWE-78
References: http://www.kb.cert.org/vuls/id/402020; http://www.kb.cert.org/vuls/id/402020
CVE: CVE-2014-2969
Published: 2014-07-07
Description: NETGEAR GS108PE Prosafe Plus switches with firmware 1.2.0.5 have a hardcoded password of debugpassword for the ntgruser account, which allows remote attackers to upload firmware or read or modify memory contents, and consequently execute arbitrary code, via a request to (1) produce_burn.cgi, (2) register_debug.cgi, or (3) bootcode_update.cgi.
CVSS Score: 8.3 (HIGH)
CWE: CWE-255
References: http://www.kb.cert.org/vuls/id/143740; http://www.kb.cert.org/vuls/id/143740
CVE: CVE-2014-3113
Published: 2014-07-07
Description: Multiple buffer overflows in RealNetworks RealPlayer before 17.0.10.8 allow remote attackers to execute arbitrary code via a malformed (1) elst or (2) stsz atom in an MP4 file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/59238; http://service.real.com/realplayer/security/06272014_player/en/; http://www.fortiguard.com/advisory/RealNetworks-RealPlayer-Memory-Corruption/