deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2013-4286
Published: 2014-02-26
Description: Apache Tomcat before 6.0.39, 7.x before 7.0.47, and 8.x before 8.0.0-RC3, when an HTTP connector or AJP connector is used, does not properly handle certain inconsistent HTTP request headers, which allows remote attackers to trigger incorrect identification of a request's length and conduct request-smuggling attacks via (1) multiple Content-Length headers or (2) a Content-Length header and a "Transfer-Encoding: chunked" header.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2005-2090.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://advisories.mageia.org/MGASA-2014-0148.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]3542&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1440&w=2
CVE: CVE-2013-4322
Published: 2014-02-26
Description: Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 processes chunked transfer coding without properly handling (1) a large total amount of chunked data or (2) whitespace characters in an HTTP header value within a trailer field, which allows remote attackers to cause a denial of service by streaming data.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3544.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://advisories.mageia.org/MGASA-2014-0148.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1440&w=2; http://seclists.org/fulldisclosure/2014/Dec/23
CVE: CVE-2013-4590
Published: 2014-02-26
Description: Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 allows attackers to obtain "Tomcat internals" information by leveraging the presence of an untrusted web application with a context.xml, web.xml, *.jspx, *.tagx, or *.tld XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://advisories.mageia.org/MGASA-2014-0148.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1440&w=2; http://secunia.com/advisories/59036
CVE: CVE-2013-4841
Published: 2014-02-26
Description: Unspecified vulnerability in dbd_manager in LeftHand OS before 11.0 in HP StoreVirtual 4000 and StoreVirtual VSA Software (formerly LeftHand Virtual SAN Appliance) allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1509.
CVSS Score: 10.0 (HIGH)
References: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03995204; https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03995204
CVE: CVE-2013-6203
Published: 2014-02-26
Description: The Web Console in HP Application Information Optimizer (formerly HP Database Archiving) 6.2, 6.3, 6.4, 7.0, and 7.1 allows remote attackers to execute arbitrary code or obtain sensitive information via unspecified vectors, aka ZDI-CAN-1656.
CVSS Score: 7.5 (HIGH)
References: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04140965; https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04140965
CVE: CVE-2013-6204
Published: 2014-02-26
Description: The Web Console in HP Application Information Optimizer (formerly HP Database Archiving) 6.2, 6.3, 6.4, 7.0, and 7.1 allows remote attackers to execute arbitrary code or obtain sensitive information via unspecified vectors, aka ZDI-CAN-2004.
CVSS Score: 7.5 (HIGH)
References: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04140965; https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04140965
CVE: CVE-2013-6731
Published: 2014-02-26
Description: IBM Netezza Performance Portal 2.x before 2.0.0.3 allows remote authenticated users to change arbitrary passwords via an HTTP POST request.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg21663353; https://exchange.xforce.ibmcloud.com/vulnerabilities/89393; http://www-01.ibm.com/support/docview.wss?uid=swg21663353
CVE: CVE-2013-7331
Published: 2014-02-26
Description: The Microsoft.XMLDOM ActiveX control in Microsoft Windows 8.1 and earlier allows remote attackers to determine the existence of local pathnames, UNC share pathnames, intranet hostnames, and intranet IP addresses by examining error codes, as demonstrated by a res:// URL, and exploited in the wild in February 2014.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-209, CWE-209
References: http://www.fireeye.com/blog/uncategorized/2014/02/operation-snowman-deputydog-actor-compromises-us-veterans-of-foreign-wars-website.html; http://www.kb.cert.org/vuls/id/539289; http://www.securitytracker.com/id/1030818
CVE: CVE-2013-7332
Published: 2014-02-26
Description: The Microsoft.XMLDOM ActiveX control in Microsoft Windows 8.1 and earlier does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: https://soroush.secproject.com/blog/2013/04/microsoft-xmldom-in-ie-can-divulge-information-of-local-drivenetwork-in-error-messages/; https://soroush.secproject.com/blog/2013/04/microsoft-xmldom-in-ie-can-divulge-information-of-local-drivenetwork-in-error-messages/
CVE: CVE-2014-0033
Published: 2014-02-26
Description: org/apache/catalina/connector/CoyoteAdapter.java in Apache Tomcat 6.0.33 through 6.0.37 does not consider the disableURLRewriting setting when handling a session ID in a URL, which allows remote attackers to conduct session fixation attacks via a crafted URL.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://seclists.org/fulldisclosure/2014/Dec/23; http://secunia.com/advisories/59036; http://secunia.com/advisories/59722
CVE: CVE-2014-2093
Published: 2014-02-26
Description: Untrusted search path vulnerability in Catfish through 0.4.0.3 allows local users to gain privileges via a Trojan horse catfish.py in the current working directory.
CVSS Score: 4.6 (MEDIUM)
References: http://openwall.com/lists/oss-security/2014/02/25/2; http://openwall.com/lists/oss-security/2014/02/25/4; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=739958
CVE: CVE-2014-2094
Published: 2014-02-26
Description: Untrusted search path vulnerability in Catfish through 0.4.0.3, when a Fedora package such as 0.4.0.2-2 is not used, allows local users to gain privileges via a Trojan horse catfish.pyc in the current working directory.
CVSS Score: 4.6 (MEDIUM)
References: http://openwall.com/lists/oss-security/2014/02/25/2; http://openwall.com/lists/oss-security/2014/02/25/4; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=739958
CVE: CVE-2014-2095
Published: 2014-02-26
Description: Untrusted search path vulnerability in Catfish 0.6.0 through 1.0.0, when a Fedora package such as 0.8.2-1 is not used, allows local users to gain privileges via a Trojan horse bin/catfish.pyc under the current working directory.
CVSS Score: 4.6 (MEDIUM)
References: http://openwall.com/lists/oss-security/2014/02/25/2; http://openwall.com/lists/oss-security/2014/02/25/4; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=739958
CVE: CVE-2014-2096
Published: 2014-02-26
Description: Untrusted search path vulnerability in Catfish 0.6.0 through 1.0.0 allows local users to gain privileges via a Trojan horse bin/catfish.py under the current working directory.
CVSS Score: 4.6 (MEDIUM)
References: http://openwall.com/lists/oss-security/2014/02/25/2; http://openwall.com/lists/oss-security/2014/02/25/4; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=739958
CVE: CVE-2011-1749
Published: 2014-02-26
Description: The nfs_addmntent function in support/nfs/nfs_mntent.c in the mount.nsf tool in nfs-utils before 1.2.4 attempts to append to the /etc/mtab file without first checking whether resource limits would interfere, which allows local users to corrupt this file via a process with a small RLIMIT_FSIZE value, a related issue to CVE-2011-1089.
CVSS Score: 3.3 (LOW)
CWE: CWE-20
References: http://rhn.redhat.com/errata/RHSA-2011-1534.html; http://rhn.redhat.com/errata/RHSA-2012-0310.html; http://sourceforge.net/projects/nfs/files/nfs-utils/1.2.4/Changelog-nfs-utils-1.2.4/download
CVE: CVE-2011-2941
Published: 2014-02-26
Description: Open redirect vulnerability in Red Hat JBoss Enterprise Portal Platform before 5.2.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the initialURI parameter.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://rhn.redhat.com/errata/RHSA-2011-1822.html; http://rhn.redhat.com/errata/RHSA-2011-1822.html
CVE: CVE-2011-4111
Published: 2014-02-26
Description: Buffer overflow in the ccid_card_vscard_handle_message function in hw/ccid-card-passthru.c in QEMU before 0.15.2 and 1.x before 1.0-rc4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted VSC_ATR message.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://git.qemu.org/?p=qemu-stable-0.15.git%3Ba=log; http://git.qemu.org/?p=qemu.git%3Ba=log%3Bh=refs/heads/stable-1.0; http://rhn.redhat.com/errata/RHSA-2011-1777.html
CVE: CVE-2011-4580
Published: 2014-02-26
Description: Multiple cross-site scripting (XSS) vulnerabilities in Red Hat JBoss Enterprise Portal Platform before 5.2.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://rhn.redhat.com/errata/RHSA-2011-1822.html; http://rhn.redhat.com/errata/RHSA-2011-1822.html
CVE: CVE-2012-2134
Published: 2014-02-26
Description: The handle_connection_error function in ldap_helper.c in bind-dyndb-ldap before 1.1.0rc1 does not properly handle LDAP query errors, which allows remote attackers to cause a denial of service (infinite loop and named server hang) via a non-alphabet character in the base DN in an LDAP search DNS query.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-399
References: http://rhn.redhat.com/errata/RHSA-2012-0683.html; http://secunia.com/advisories/48901; http://www.openwall.com/lists/oss-security/2012/04/24/15
CVE: CVE-2013-3712
Published: 2014-02-26
Description: SUSE Studio Onsite 1.3.x before 1.3.6 and SUSE Studio Extension for System z 1.3 uses "static" secret tokens, which has unspecified impact and vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-310
References: http://secunia.com/advisories/57050; https://www.suse.com/support/update/announcement/2014/suse-su-20140254-1.html; http://secunia.com/advisories/57050
CVE: CVE-2014-0058
Published: 2014-02-26
Description: The security audit functionality in Red Hat JBoss Enterprise Application Platform (EAP) 6.x before 6.2.1 logs request parameters in plaintext, which might allow local users to obtain passwords by reading the log files.
CVSS Score: 1.9 (LOW)
CWE: CWE-310
References: http://rhn.redhat.com/errata/RHSA-2014-0204.html; http://rhn.redhat.com/errata/RHSA-2014-0205.html; http://rhn.redhat.com/errata/RHSA-2015-0034.html
CVE: CVE-2014-2205
Published: 2014-02-26
Description: The Import and Export Framework in McAfee ePolicy Orchestrator (ePO) before 4.6.7 Hotfix 940148 allows remote authenticated users with permissions to add dashboards to read arbitrary files by importing a crafted XML file, related to an XML External Entity (XXE) issue.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/57114; http://www.securityfocus.com/archive/1/531255/100/0/threaded; http://www.securityfocus.com/bid/65771
CVE: CVE-2014-0070
Published: 2014-02-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not a security issue.  Notes: none
CVE: CVE-2014-0740
Published: 2014-02-27
Description: Cross-site request forgery (CSRF) vulnerability in the Call Detail Records Analysis and Reporting (CAR) interface in the OS Administration component in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier allows remote attackers to hijack the authentication of administrators for requests that make administrative changes, aka Bug ID CSCun00701.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0740; http://tools.cisco.com/security/center/viewAlert.x?alertId=33049; http://www.securitytracker.com/id/1029843
CVE: CVE-2014-0741
Published: 2014-02-27
Description: The certificate-import feature in the Certificate Authority Proxy Function (CAPF) CLI implementation in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier allows local users to read or modify arbitrary files via a crafted command, aka Bug ID CSCum95461.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-310
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0741; http://tools.cisco.com/security/center/viewAlert.x?alertId=33046; http://www.securitytracker.com/id/1029843
CVE: CVE-2014-0742
Published: 2014-02-27
Description: The Certificate Authority Proxy Function (CAPF) CLI implementation in the CSR management feature in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier allows local users to read or modify arbitrary files via unspecified vectors, aka Bug ID CSCum95464.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0742; http://tools.cisco.com/security/center/viewAlert.x?alertId=33045; http://www.securitytracker.com/id/1029843
CVE: CVE-2014-0743
Published: 2014-02-27
Description: The Certificate Authority Proxy Function (CAPF) component in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier allows remote attackers to bypass authentication and modify registered-device information via crafted data, aka Bug ID CSCum95468.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-287
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0743; http://tools.cisco.com/security/center/viewAlert.x?alertId=33044; http://www.securitytracker.com/id/1029843
CVE: CVE-2014-0745
Published: 2014-02-27
Description: Cross-site request forgery (CSRF) vulnerability in the Unified Serviceability subsystem in Cisco Unified Contact Center Express (Unified CCX) allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCum95502.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0745; http://www.securitytracker.com/id/1029842; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0745
CVE: CVE-2014-0746
Published: 2014-02-27
Description: The disaster recovery system (DRS) in Cisco Unified Contact Center Express (Unified CCX) allows remote authenticated users to obtain sensitive information by reading extraneous fields in an HTML document, aka Bug ID CSCum95536.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0746; http://www.securitytracker.com/id/1029842; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0746
CVE: CVE-2014-0747
Published: 2014-02-27
Description: The Certificate Authority Proxy Function (CAPF) CLI implementation in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier allows local users to inject commands via unspecified CAPF programs, aka Bug ID CSCum95493.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0747; http://tools.cisco.com/security/center/viewAlert.x?alertId=33048; http://www.securitytracker.com/id/1029843
CVE: CVE-2014-0816
Published: 2014-02-27
Description: Unspecified vulnerability in Norman Security Suite 10.1 and earlier allows local users to gain privileges via unknown vectors.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://jvn.jp/en/jp/JVN02017463/995510/index.html; http://jvn.jp/en/jp/JVN02017463/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2014-000026
CVE: CVE-2014-0817
Published: 2014-02-27
Description: Cybozu Garoon 2.x through 2.5.4 and 3.x through 3.7 SP3 does not properly manage sessions, which allows remote authenticated users to impersonate arbitrary users via unspecified vectors.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-264
References: http://cs.cybozu.co.jp/information/gr20140225up03.php; http://jvn.jp/en/jp/JVN24035499/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2014-000021
CVE: CVE-2014-0820
Published: 2014-02-27
Description: Directory traversal vulnerability in the download feature in Cybozu Garoon 2.x through 2.5.4 and 3.x through 3.7 SP3 allows remote authenticated users to read arbitrary files via unspecified vectors.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-22
References: http://cs.cybozu.co.jp/information/gr20140225up05.php; http://jvn.jp/en/jp/JVN26393529/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2014-000023
CVE: CVE-2014-0821
Published: 2014-02-27
Description: SQL injection vulnerability in the download feature in Cybozu Garoon 2.x through 2.5.4 and 3.x through 3.7 SP3 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, a different vulnerability than CVE-2013-6930 and CVE-2013-6931.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://cs.cybozu.co.jp/information/gr20140225up04.php; http://jvn.jp/en/jp/JVN71045461/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2014-000024
CVE: CVE-2014-1243
Published: 2014-02-27
Description: Apple QuickTime before 7.7.5 does not initialize an unspecified pointer, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted track list in a movie file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://support.apple.com/kb/HT6151; http://support.apple.com/kb/HT6151
CVE: CVE-2014-1244
Published: 2014-02-27
Description: Buffer overflow in Apple QuickTime before 7.7.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted movie file with H.264 encoding.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://support.apple.com/kb/HT6151; http://www.securityfocus.com/bid/65786; http://support.apple.com/kb/HT6151
CVE: CVE-2014-1245
Published: 2014-02-27
Description: Integer signedness error in Apple QuickTime before 7.7.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted stsz atom in a movie file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://support.apple.com/kb/HT6150; http://support.apple.com/kb/HT6151; http://support.apple.com/kb/HT6150
CVE: CVE-2014-1246
Published: 2014-02-27
Description: Buffer overflow in Apple QuickTime before 7.7.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted ftab atom in a movie file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://support.apple.com/kb/HT6150; http://support.apple.com/kb/HT6151; http://support.apple.com/kb/HT6150
CVE: CVE-2014-1247
Published: 2014-02-27
Description: Apple QuickTime before 7.7.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted dref atom in a movie file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://support.apple.com/kb/HT6150; http://support.apple.com/kb/HT6151; http://support.apple.com/kb/HT6150
CVE: CVE-2014-1248
Published: 2014-02-27
Description: Buffer overflow in Apple QuickTime before 7.7.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted ldat atom in a movie file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://support.apple.com/kb/HT6150; http://support.apple.com/kb/HT6151; http://support.apple.com/kb/HT6150
CVE: CVE-2014-1249
Published: 2014-02-27
Description: Buffer overflow in Apple QuickTime before 7.7.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted PSD image.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://support.apple.com/kb/HT6150; http://support.apple.com/kb/HT6151; http://support.apple.com/kb/HT6150
CVE: CVE-2014-1250
Published: 2014-02-27
Description: Apple QuickTime before 7.7.5 does not properly perform a byte-swapping operation, which allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds memory access and application crash) via a crafted ttfo element in a movie file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://support.apple.com/kb/HT6150; http://support.apple.com/kb/HT6151; http://support.apple.com/kb/HT6150
CVE: CVE-2014-1251
Published: 2014-02-27
Description: Buffer overflow in Apple QuickTime before 7.7.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted clef atom in a movie file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://support.apple.com/kb/HT6151; http://www.securityfocus.com/bid/65787; http://support.apple.com/kb/HT6151
CVE: CVE-2014-1254
Published: 2014-02-27
Description: Apple Type Services (ATS) in Apple OS X before 10.9.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Type 1 font that is embedded in a document.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://support.apple.com/kb/HT6150; http://support.apple.com/kb/HT6150
CVE: CVE-2014-1255
Published: 2014-02-27
Description: Apple Type Services (ATS) in Apple OS X before 10.9.2 does not properly validate calls to the free function, which allows attackers to bypass the App Sandbox protection mechanism via crafted Mach messages.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://support.apple.com/kb/HT6150; http://support.apple.com/kb/HT6150
CVE: CVE-2014-1256
Published: 2014-02-27
Description: Buffer overflow in Apple Type Services (ATS) in Apple OS X before 10.9.2 allows attackers to bypass the App Sandbox protection mechanism via crafted Mach messages.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://support.apple.com/kb/HT6150; http://support.apple.com/kb/HT6150
CVE: CVE-2014-1257
Published: 2014-02-27
Description: CFNetwork in Apple OS X through 10.8.5 does not remove session cookies upon a Safari reset action, which allows physically proximate attackers to bypass intended access restrictions by leveraging an unattended workstation.
CVSS Score: 3.6 (LOW)
CWE: CWE-264
References: http://support.apple.com/kb/HT6150; http://support.apple.com/kb/HT6150
CVE: CVE-2014-1258
Published: 2014-02-27
Description: Heap-based buffer overflow in CoreAnimation in Apple OS X before 10.9.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted image.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://support.apple.com/kb/HT6150; http://support.apple.com/kb/HT6150
CVE: CVE-2014-1259
Published: 2014-02-27
Description: Buffer overflow in File Bookmark in Apple OS X before 10.9.2 allows attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted filename.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://support.apple.com/kb/HT6150; http://support.apple.com/kb/HT6150
CVE: CVE-2014-1260
Published: 2014-02-27
Description: QuickLook in Apple OS X through 10.8.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted Microsoft Office document.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://support.apple.com/kb/HT6150; http://support.apple.com/kb/HT6150
CVE: CVE-2014-1261
Published: 2014-02-27
Description: Integer signedness error in CoreText in Apple OS X before 10.9.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted Unicode font.
CVSS Score: 7.5 (HIGH)
CWE: CWE-189
References: http://support.apple.com/kb/HT6150; http://support.apple.com/kb/HT6150