deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-0050
Published: 2014-04-01
Description: MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a loop's intended exit conditions.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://advisories.mageia.org/MGASA-2014-0110.html; http://blog.spiderlabs.com/2014/02/cve-2014-0050-exploit-with-boundaries-loops-without-boundaries.html; http://jvn.jp/en/jp/JVN14876762/index.html
CVE: CVE-2014-0632
Published: 2014-04-01
Description: Directory traversal vulnerability in EMC VPLEX GeoSynchrony 4.x and 5.x before 5.3 allows remote authenticated users to execute arbitrary code via unspecified vectors.
CVSS Score: 9.0 (HIGH)
CWE: CWE-22
References: http://archives.neohapsis.com/archives/bugtraq/2014-03/0157.html; http://www.securityfocus.com/bid/66513; http://archives.neohapsis.com/archives/bugtraq/2014-03/0157.html
CVE: CVE-2014-0633
Published: 2014-04-01
Description: The GUI in EMC VPLEX GeoSynchrony 4.x and 5.x before 5.3 does not properly validate session-timeout values, which might make it easier for remote attackers to execute arbitrary code by leveraging an unattended workstation.
CVSS Score: 7.7 (HIGH)
CWE: CWE-20
References: http://archives.neohapsis.com/archives/bugtraq/2014-03/0157.html; http://archives.neohapsis.com/archives/bugtraq/2014-03/0157.html
CVE: CVE-2014-0634
Published: 2014-04-01
Description: EMC VPLEX GeoSynchrony 4.x and 5.x before 5.3 does not include the HTTPOnly flag in a Set-Cookie header for an unspecified cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-20
References: http://archives.neohapsis.com/archives/bugtraq/2014-03/0157.html; http://archives.neohapsis.com/archives/bugtraq/2014-03/0157.html
CVE: CVE-2014-0635
Published: 2014-04-01
Description: Session fixation vulnerability in EMC VPLEX GeoSynchrony 4.x and 5.x before 5.3 allows remote attackers to hijack web sessions via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://archives.neohapsis.com/archives/bugtraq/2014-03/0157.html; http://archives.neohapsis.com/archives/bugtraq/2014-03/0157.html
CVE: CVE-2014-2590
Published: 2014-04-01
Description: The web management interface in Siemens RuggedCom ROS before 3.11, ROS 3.11 before 3.11.5 for RS950G, ROS 3.12, and ROS 4.0 for RSG2488 allows remote attackers to cause a denial of service (interface outage) via crafted HTTP packets.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-306
References: http://ics-cert.us-cert.gov/advisories/ICSA-14-087-01; http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-831997.pdf; http://ics-cert.us-cert.gov/advisories/ICSA-14-087-01
CVE: CVE-2011-3346
Published: 2014-04-01
Description: Buffer overflow in hw/scsi-disk.c in the SCSI subsystem in QEMU before 0.15.2, as used by Xen, might allow local guest users with permission to access the CD-ROM to cause a denial of service (guest crash) via a crafted SAI READ CAPACITY SCSI command.  NOTE: this is only a vulnerability when root has manually modified certain permissions or ACLs.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-119
References: http://git.qemu.org/?p=qemu-stable-0.15.git%3Ba=log; http://www.openwall.com/lists/oss-security/2011/10/20/2; http://www.redhat.com/support/errata/RHSA-2011-1401.html
CVE: CVE-2011-4573
Published: 2014-04-01
Description: Red Hat JBoss Operations Network (JON) before 2.4.2 does not properly enforce "modify resource" permissions for remote authenticated users when deleting a plug-in configuration update from the group connection properties history, which prevents such activities from being recorded in the audit trail.
CVSS Score: 3.5 (LOW)
CWE: CWE-264
References: http://rhn.redhat.com/errata/RHSA-2012-0089.html; https://bugzilla.redhat.com/show_bug.cgi?id=760024; http://rhn.redhat.com/errata/RHSA-2012-0089.html
CVE: CVE-2012-0032
Published: 2014-04-01
Description: Red Hat JBoss Operations Network (JON) before 3.0.1 uses 0777 permissions for the root directory when installing a remote client, which allows local users to read or modify subdirectories and files within the root directory, as demonstrated by obtaining JON credentials.
CVSS Score: 3.7 (LOW)
CWE: CWE-264
References: http://rhn.redhat.com/errata/RHSA-2012-0406.html; https://bugzilla.redhat.com/show_bug.cgi?id=772514; http://rhn.redhat.com/errata/RHSA-2012-0406.html
CVE: CVE-2013-1869
Published: 2014-04-01
Description: CRLF injection vulnerability in spacewalk-java before 2.1.148-1 and Red Hat Network (RHN) Satellite 5.6 allows remote attackers to inject arbitrary HTTP headers, and conduct HTTP response splitting attacks and cross-site scripting (XSS) attacks, via the return_url parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://rhn.redhat.com/errata/RHSA-2014-0148.html; http://secunia.com/advisories/56952; https://bugzilla.redhat.com/show_bug.cgi?id=923464
CVE: CVE-2013-7348
Published: 2014-04-01
Description: Double free vulnerability in the ioctx_alloc function in fs/aio.c in the Linux kernel before 3.12.4 allows local users to cause a denial of service (system crash) or possibly have unspecified other impact via vectors involving an error condition in the aio_setup_ring function.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-399
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=d558023207e008a4476a3b7bb8706b2a2bf5d84f; http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.12.4; http://www.openwall.com/lists/oss-security/2014/03/31/10
CVE: CVE-2013-7350
Published: 2014-04-01
Description: Multiple unspecified vulnerabilities in Check Point Security Gateway 80 R71.x before R71.45 (730159141) and R75.20.x before R75.20.4 and 600 and 1100 appliances R75.20.x before R75.20.42 have unknown impact and attack vectors related to "important security fixes."
CVSS Score: 10.0 (HIGH)
References: http://osvdb.org/102745; https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk98332&src=securityAlerts; http://osvdb.org/102745
CVE: CVE-2014-1891
Published: 2014-04-01
Description: Multiple integer overflows in the (1) FLASK_GETBOOL, (2) FLASK_SETBOOL, (3) FLASK_USER, and (4) FLASK_CONTEXT_TO_SID suboperations in the flask hypercall in Xen 4.3.x, 4.2.x, 4.1.x, 3.2.x, and earlier, when XSM is enabled, allow local users to cause a denial of service (processor fault) via unspecified vectors, a different vulnerability than CVE-2014-1892, CVE-2014-1893, and CVE-2014-1894.
CVSS Score: 5.2 (MEDIUM)
CWE: CWE-189
References: http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00010.html; http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00011.html; http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html
CVE: CVE-2014-1892
Published: 2014-04-01
Description: Xen 3.3 through 4.1, when XSM is enabled, allows local users to cause a denial of service via vectors related to a "large memory allocation," a different vulnerability than CVE-2014-1891, CVE-2014-1893, and CVE-2014-1894.
CVSS Score: 5.2 (MEDIUM)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00010.html; http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00011.html; http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html
CVE: CVE-2014-1893
Published: 2014-04-01
Description: Multiple integer overflows in the (1) FLASK_GETBOOL and (2) FLASK_SETBOOL suboperations in the flask hypercall in Xen 4.1.x, 3.3.x, 3.2.x, and earlier, when XSM is enabled, allow local users to cause a denial of service (processor fault) via unspecified vectors, a different vulnerability than CVE-2014-1891, CVE-2014-1892, and CVE-2014-1894.
CVSS Score: 5.2 (MEDIUM)
CWE: CWE-189
References: http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00010.html; http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00011.html; http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html
CVE: CVE-2014-1894
Published: 2014-04-01
Description: Multiple integer overflows in unspecified suboperations in the flask hypercall in Xen 3.2.x and earlier, when XSM is enabled, allow local users to cause a denial of service (processor fault) via unspecified vectors, a different vulnerability than CVE-2014-1891, CVE-2014-1892, and CVE-2014-1893.
CVSS Score: 5.2 (MEDIUM)
CWE: CWE-189
References: http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00010.html; http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00011.html; http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html
CVE: CVE-2014-1895
Published: 2014-04-01
Description: Off-by-one error in the flask_security_avc_cachestats function in xsm/flask/flask_op.c in Xen 4.2.x and 4.3.x, when the maximum number of physical CPUs are in use, allows local users to cause a denial of service (host crash) or obtain sensitive information from hypervisor memory by leveraging a FLASK_AVC_CACHESTAT hypercall, which triggers a buffer over-read.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-189
References: http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00011.html; http://security.gentoo.org/glsa/glsa-201407-03.xml; http://www.openwall.com/lists/oss-security/2014/02/07/12
CVE: CVE-2014-1896
Published: 2014-04-01
Description: The (1) do_send and (2) do_recv functions in io.c in libvchan in Xen 4.2.x, 4.3.x, and 4.4-RC series allows local guests to cause a denial of service or possibly gain privileges via crafted xenstore ring indexes, which triggers a "read or write past the end of the ring."
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00011.html; http://security.gentoo.org/glsa/glsa-201407-03.xml; http://www.openwall.com/lists/oss-security/2014/02/07/12
CVE: CVE-2014-2237
Published: 2014-04-01
Description: The memcache token backend in OpenStack Identity (Keystone) 2013.1 through 2.013.1.4, 2013.2 through 2013.2.2, and icehouse before icehouse-3, when issuing a trust token with impersonation enabled, does not include this token in the trustee's token-index-list, which prevents the token from being invalidated by bulk token revocation and allows the trustee to bypass intended access restrictions.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://rhn.redhat.com/errata/RHSA-2014-0580.html; http://www.openwall.com/lists/oss-security/2014/03/04/16; http://www.securityfocus.com/bid/65895
CVE: CVE-2014-2672
Published: 2014-04-01
Description: Race condition in the ath_tx_aggr_sleep function in drivers/net/wireless/ath/ath9k/xmit.c in the Linux kernel before 3.13.7 allows remote attackers to cause a denial of service (system crash) via a large amount of network traffic that triggers certain list deletions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-362
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=21f8aaee0c[PII_REDACTED]8ce092838aa7df4d25d8; http://secunia.com/advisories/57468; http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.13.7
CVE: CVE-2014-2673
Published: 2014-04-01
Description: The arch_dup_task_struct function in the Transactional Memory (TM) implementation in arch/powerpc/kernel/process.c in the Linux kernel before 3.13.7 on the powerpc platform does not properly interact with the clone and fork system calls, which allows local users to cause a denial of service (Program Check and system crash) via certain instructions that are executed with the processor in the Transactional state.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-20
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=621b5060e823301d0cba4cb52a7ee3491922d291; http://secunia.com/advisories/57436; http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.13.7
CVE: CVE-2014-2678
Published: 2014-04-01
Description: The rds_iw_laddr_check function in net/rds/iw.c in the Linux kernel through 3.14 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a bind system call for an RDS socket on a system that lacks RDS transports.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-476
References: http://linux.oracle.com/errata/ELSA-2014-0926-1.html; http://linux.oracle.com/errata/ELSA-2014-0926.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-April/131276.html
CVE: CVE-2014-1691
Published: 2014-04-01
Description: The framework/Util/lib/Horde/Variables.php script in the Util library in Horde before 5.1.1 allows remote attackers to conduct object injection attacks and execute arbitrary PHP code via a crafted serialized object in the _formvars form.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://seclists.org/oss-sec/2014/q1/153; http://seclists.org/oss-sec/2014/q1/156; http://seclists.org/oss-sec/2014/q1/169
CVE: CVE-2014-2212
Published: 2014-04-01
Description: The remember me feature in portal/scr_authentif.php in POSH (aka Posh portal or Portaneo) 3.0, 3.2.1, 3.3.0, and earlier stores the username and MD5 digest of the password in cleartext in a cookie, which allows attackers to obtain sensitive information by reading this cookie.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-255
References: http://seclists.org/oss-sec/2014/q1/444; http://www.sysdream.com/CVE-2014-2211_2214; http://www.sysdream.com/system/files/POSH-3.2.1-advisory_0.pdf
CVE: CVE-2013-3588
Published: 2014-04-02
Description: The web management interface on Zyxel P660 devices allows remote attackers to cause a denial of service (reboot) via a flood of TCP SYN packets.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://www.kb.cert.org/vuls/id/893726; http://www.kb.cert.org/vuls/id/893726
CVE: CVE-2014-0828
Published: 2014-04-02
Description: Cross-site scripting (XSS) vulnerability in the WCM (Web Content Manager) UI in IBM WebSphere Portal 6.1.0.x through 6.1.0.6 CF27, 6.1.5.x through 6.1.5.3 CF27, 7.0.0.x through 7.0.0.2 CF27, and 8.0.0.x before 8.0.0.1 CF11 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PI10734; http://www-01.ibm.com/support/docview.wss?uid=swg21667016; http://www.securityfocus.com/bid/66556
CVE: CVE-2014-0901
Published: 2014-04-02
Description: Cross-site scripting (XSS) vulnerability in the Social Rendering implementation in the IBM Connections integration in IBM WebSphere Portal 8.0.0.x before 8.0.0.1 CF11 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PI12659; http://www-01.ibm.com/support/docview.wss?uid=swg21667016; http://www.securityfocus.com/bid/66559
CVE: CVE-2014-1942
Published: 2014-04-02
Description: Cross-site scripting (XSS) vulnerability in aal/loginverification.aspx in Pearson eSIS Enterprise Student Information System allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.kb.cert.org/vuls/id/163188; http://www.kb.cert.org/vuls/id/163188
CVE: CVE-2014-2125
Published: 2014-04-02
Description: Cross-site scripting (XSS) vulnerability in the Web Inbox in Cisco Unity Connection 8.6(2a)SU3 and earlier allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCui33028.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2125; http://tools.cisco.com/security/center/viewAlert.x?alertId=33603; http://www.securitytracker.com/id/1029988
CVE: CVE-2014-2137
Published: 2014-04-02
Description: CRLF injection vulnerability in the web framework in Cisco Web Security Appliance (WSA) 7.7 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct redirection attacks via a crafted URL, aka Bug ID CSCuj61002.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2137; http://tools.cisco.com/security/center/viewAlert.x?alertId=33608; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2137
CVE: CVE-2014-2138
Published: 2014-04-02
Description: CRLF injection vulnerability in the web framework in Cisco Security Manager 4.2 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct redirection attacks via a crafted URL, aka Bug ID CSCun82349.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2138; http://tools.cisco.com/security/center/viewAlert.x?alertId=33607; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2138
CVE: CVE-2013-1770
Published: 2014-04-02
Description: Cross-site scripting (XSS) vulnerability in views_view.php in Ganglia Web 3.5.7 allows remote attackers to inject arbitrary web script or HTML via the view_name parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/52673; http://www.openwall.com/lists/oss-security/2013/02/21/12; http://www.openwall.com/lists/oss-security/2013/02/26/11
CVE: CVE-2013-3213
Published: 2014-04-02
Description: Multiple SQL injection vulnerabilities in vTiger CRM 5.0.0 through 5.4.0 allow remote attackers to execute arbitrary SQL commands via the (1) picklist_name parameter in the get_picklists method to soap/customerportal.php, (2) where parameter in the get_tickets_list method to soap/customerportal.php, or (3) emailaddress parameter in the SearchContactsByEmail method to soap/vtigerolservice.php; or remote authenticated users to execute arbitrary SQL commands via the (4) emailaddress parameter in the SearchContactsByEmail method to soap/thunderbirdplugin.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://archives.neohapsis.com/archives/bugtraq/2013-08/0001.html; http://karmainsecurity.com/KIS-2013-06; http://www.securityfocus.com/bid/61563
CVE: CVE-2013-4240
Published: 2014-04-02
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the HMS Testimonials plugin before 2.0.11 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) add new testimonials via the hms-testimonials-addnew page, (2) add new groups via the hms-testimonials-addnewgroup page, (3) change default settings via the hms-testimonials-settings page, (4) change advanced settings via the hms-testimonials-settings-advanced page, (5) change custom fields settings via the hms-testimonials-settings-fields page, or (6) change template settings via the hms-testimonials-templates-new page to wp-admin/admin.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://osvdb.org/96107; http://seclists.org/fulldisclosure/2013/Aug/96; http://seclists.org/fulldisclosure/2013/Aug/98
CVE: CVE-2013-5365
Published: 2014-04-02
Description: Heap-based buffer overflow in Autodesk SketchBook for Enterprise 2014, Pro, and Express before 6.25, and Copic Edition before 2.0.2 allows remote attackers to execute arbitrary code via RLE-compressed channel data in a PSD file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/55000; http://secunia.com/secunia_research/2014-5; http://www.sketchbook.com/news/important-security-update-for-sketchbook.html
CVE: CVE-2014-2553
Published: 2014-04-02
Description: Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) 3.1.x before 3.1.21, 3.2.x before 3.2.16, and 3.3.x before 3.3.6 allows remote authenticated users to inject arbitrary web script or HTML via vectors related to dynamic fields.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-updates/2014-04/msg00062.html; http://secunia.com/advisories/57616; https://www.otrs.com/security-advisory-2014-04-xss-issue
CVE: CVE-2014-2578
Published: 2014-04-02
Description: Cross-site scripting (XSS) vulnerability in Splunk Web in Splunk before 5.0.8 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/57554; http://www.securityfocus.com/bid/66453; http://www.securitytracker.com/id/1029966
CVE: CVE-2014-2655
Published: 2014-04-02
Description: SQL injection vulnerability in the gen_show_status function in functions.inc.php in Postfix Admin (aka postfixadmin) before 2.3.7 allows remote authenticated users to execute arbitrary SQL commands via a new alias.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://lists.opensuse.org/opensuse-updates/2014-05/msg00075.html; http://sourceforge.net/p/postfixadmin/code/1650; http://www.debian.org/security/2014/dsa-2889
CVE: CVE-2013-0729
Published: 2014-04-02
Description: Heap-based buffer overflow in Tracker Software PDF-XChange before 2.5.208 allows remote attackers to execute arbitrary code via a crafted Define Huffman Table header in a JPEG image file stream in a PDF file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/89442; http://secunia.com/advisories/51855; http://www.securityfocus.com/bid/57491
CVE: CVE-2013-2945
Published: 2014-04-02
Description: SQL injection vulnerability in blogs/admin.php in b2evolution before 4.1.7 allows remote authenticated administrators to execute arbitrary SQL commands via the show_statuses[] parameter.  NOTE: this can be leveraged using CSRF to allow remote unauthenticated attackers to execute arbitrary SQL commands.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://archives.neohapsis.com/archives/bugtraq/2013-05/0004.html; http://b2evolution.net/news/2013/04/29/b2evolution-4-1-7-and-5-0-3; http://osvdb.org/92905
CVE: CVE-2013-3484
Published: 2014-04-02
Description: Multiple cross-site scripting (XSS) vulnerabilities in dotCMS before 2.3.2 allow remote attackers to inject arbitrary web script or HTML via the (1) _loginUserName parameter to application/login/login.html, (2) my_account_login parameter to c/portal_public/login, or (3) email parameter to forgotPassword.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://dotcms.com/security/SI-14; http://secunia.com/advisories/53265; https://github.com/dotCMS/dotCMS/issues/2949
CVE: CVE-2014-1297
Published: 2014-04-02
Description: WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, does not properly validate WebProcess IPC messages, which allows remote attackers to bypass a sandbox protection mechanism and read arbitrary files by leveraging WebProcess access.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://archives.neohapsis.com/archives/bugtraq/2014-04/0009.html; http://archives.neohapsis.com/archives/bugtraq/2014-04/0009.html
CVE: CVE-2014-1298
Published: 2014-04-02
Description: WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2014-04/0009.html; http://archives.neohapsis.com/archives/bugtraq/2014-04/0135.html; http://archives.neohapsis.com/archives/bugtraq/2014-04/0136.html
CVE: CVE-2014-1299
Published: 2014-04-02
Description: WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2014-04/0009.html; http://archives.neohapsis.com/archives/bugtraq/2014-04/0135.html; http://archives.neohapsis.com/archives/bugtraq/2014-04/0136.html