deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2013-6078
Published: 2014-06-17
Description: The default configuration of EMC RSA BSAFE Toolkits and RSA Data Protection Manager (DPM) 20130918 uses the Dual Elliptic Curve Deterministic Random Bit Generation (Dual_EC_DRBG) algorithm, which makes it easier for context-dependent attackers to defeat cryptographic protection mechanisms by leveraging unspecified "security concerns," aka the ESA-2013-068 issue.  NOTE: this issue has been SPLIT from CVE-2007-6755 because the vendor announcement did not state a specific technical rationale for a change in the algorithm; thus, CVE cannot reach a conclusion that a CVE-2007-6755 concern was the reason, or one of the reasons, for this change.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-310
References: http://arstechnica.com/security/2013/09/stop-using-nsa-influence-code-in-our-product-rsa-tells-customers/; http://blog.cryptographyengineering.com/2013/09/rsa-warns-developers-against-its-own.html; http://stream.wsj.com/story/latest-headlines/SS-2-63399/SS-2-332655/
CVE: CVE-2014-4038
Published: 2014-06-17
Description: ppc64-diag 2.6.1 allows local users to overwrite arbitrary files via a symlink attack related to (1) rtas_errd/diag_support.c and /tmp/get_dt_files, (2) scripts/ppc64_diag_mkrsrc and /tmp/diagSEsnap/snapH.tar.gz, or (3) lpd/test/lpd_ela_test.sh and /var/tmp/ras.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-59
References: http://lists.opensuse.org/opensuse-security-announce/2014-07/msg00018.html; http://openwall.com/lists/oss-security/2014/06/17/1; http://rhn.redhat.com/errata/RHSA-2015-0383.html
CVE: CVE-2014-4039
Published: 2014-06-17
Description: ppc64-diag 2.6.1 uses 0775 permissions for /tmp/diagSEsnap and does not properly restrict permissions for /tmp/diagSEsnap/snapH.tar.gz, which allows local users to obtain sensitive information by reading files in this archive, as demonstrated by /var/log/messages and /etc/yaboot.conf.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2014-07/msg00018.html; http://openwall.com/lists/oss-security/2014/06/17/1; http://rhn.redhat.com/errata/RHSA-2015-0383.html
CVE: CVE-2014-4040
Published: 2014-06-17
Description: snap in powerpc-utils 1.2.20 produces an archive with fstab and yaboot.conf files potentially containing cleartext passwords, and lacks a warning about reviewing this archive to detect included passwords, which might allow remote attackers to obtain sensitive information by leveraging access to a technical-support data stream.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://openwall.com/lists/oss-security/2014/06/17/1; http://rhn.redhat.com/errata/RHSA-2015-0384.html; http://openwall.com/lists/oss-security/2014/06/17/1
CVE: CVE-2014-4191
Published: 2014-06-17
Description: The TLS implementation in EMC RSA BSAFE-C Toolkits (aka Share for C and C++) sends a long series of random bytes during use of the Dual_EC_DRBG algorithm, which makes it easier for remote attackers to obtain plaintext from TLS sessions by recovering the algorithm's inner state, a different issue than CVE-2007-6755.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://dualec.org/; http://dualec.org/DualECTLS.pdf; http://dualec.org/
CVE: CVE-2014-4192
Published: 2014-06-17
Description: The Dual_EC_DRBG implementation in EMC RSA BSAFE-C Toolkits (aka Share for C and C++) processes certain requests for output bytes by considering only the requested byte count and not the use of cached bytes, which makes it easier for remote attackers to obtain plaintext from TLS sessions by recovering the algorithm's inner state, a different issue than CVE-2007-6755.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://dualec.org/; http://dualec.org/DualECTLS.pdf; http://dualec.org/
CVE: CVE-2014-4193
Published: 2014-06-17
Description: The TLS implementation in EMC RSA BSAFE-Java Toolkits (aka Share for Java) supports the Extended Random extension during use of the Dual_EC_DRBG algorithm, which makes it easier for remote attackers to obtain plaintext from TLS sessions by requesting long nonces from a server, a different issue than CVE-2007-6755.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://dualec.org/; http://dualec.org/DualECTLS.pdf; http://www.securityfocus.com/bid/68191
CVE: CVE-2011-2592
Published: 2014-06-18
Description: Heap-based buffer overflow in the StartEpa method in the nsepacom ActiveX control (nsepa.exe) in Citrix Access Gateway Enterprise Edition Plug-in for Windows 9.x before 9.3-57.5 and 10.0 before 10.0-69.4 allows remote attackers to execute arbitrary code via a long CSEC HTTP response header.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2012-08/0009.html; http://osvdb.org/show/osvdb/84433; http://secunia.com/secunia_research/2012-27
CVE: CVE-2014-3876
Published: 2014-06-18
Description: Multiple cross-site scripting (XSS) vulnerabilities in Frams' Fast File EXchange (F*EX, aka fex) before fex-20140530 allow remote attackers to inject arbitrary web script or HTML via the (1) akey parameter to rup or (2) disclaimer or (3) gm parameter to fuc.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://fex.rus.uni-stuttgart.de/fex.html; http://packetstormsecurity.com/files/126906/F-EX-20140313-1-HTTP-Response-Splitting-Cross-Site-Scripting.html; https://www.lsexperts.de/advisories/lse-2014-05-22.txt
CVE: CVE-2014-3877
Published: 2014-06-18
Description: Incomplete blacklist vulnerability in Frams' Fast File EXchange (F*EX, aka fex) before fex-20140530 allows remote attackers to conduct cross-site scripting (XSS) attacks via the addto parameter to fup.
CVSS Score: 4.3 (MEDIUM)
References: http://fex.rus.uni-stuttgart.de/fex.html; http://packetstormsecurity.com/files/126906/F-EX-20140313-1-HTTP-Response-Splitting-Cross-Site-Scripting.html; https://www.lsexperts.de/advisories/lse-2014-05-22.txt
CVE: CVE-2014-4301
Published: 2014-06-18
Description: Multiple cross-site scripting (XSS) vulnerabilities in the respond_error function in routing.py in Eugene Pankov Ajenti before 1.2.21.7 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) resources.js or (2) resources.css in ajenti:static/, related to the traceback page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/59177; http://www.securityfocus.com/bid/68047; https://github.com/Eugeny/ajenti/commit/d3fc5eb142ff16d55d158afb050af18d5ff09120
CVE: CVE-2014-4302
Published: 2014-06-18
Description: Cross-site scripting (XSS) vulnerability in rating/rating.php in HAM3D Shop Engine allows remote attackers to inject arbitrary web script or HTML via the ID parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/127050/HAM3D-Shop-Engine-CMS-Cross-Site-Scripting.html; http://packetstormsecurity.com/files/127050/HAM3D-Shop-Engine-CMS-Cross-Site-Scripting.html
CVE: CVE-2014-4303
Published: 2014-06-18
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Touch theme 7.x-1.x before 7.x-1.9 for Drupal allow remote authenticated users with the Administer themes permission to inject arbitrary web script or HTML via vectors related to the (1) Twitter and (2) Facebook username settings.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://secunia.com/advisories/58828; http://www.securityfocus.com/bid/68045; https://drupal.org/node/2269483
CVE: CVE-2014-4304
Published: 2014-06-18
Description: Cross-site scripting (XSS) vulnerability in browse.php in SQL Buddy 1.3.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the table parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/59002; http://www.securityfocus.com/bid/68017; https://www.netsparker.com/critical-xss-vulnerability-in-sql-buddy
CVE: CVE-2014-4305
Published: 2014-06-18
Description: Multiple SQL injection vulnerabilities in NICE Recording eXpress (aka Cybertech eXpress) 6.5.7 and earlier allow remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/126858/NICE-Recording-eXpress-6.x-Root-Backdoor-XSS-Bypass.html; https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140528-0_NICE_Recording_eXpress_Multiple_critical_vulnerabilities_v10.txt; http://packetstormsecurity.com/files/126858/NICE-Recording-eXpress-6.x-Root-Backdoor-XSS-Bypass.html
CVE: CVE-2014-4306
Published: 2014-06-18
Description: Directory traversal vulnerability in logs-x.php in WebTitan before 4.04 allows remote attackers to read arbitrary files via a .. (dot dot) in the logfile parameter in a download action.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.com/files/126984/WebTitan-4.01-Build-68-SQL-Injection-Command-Execution.html; https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140606-0_WebTitan_Multiple_Vulnerabilities_v10.txt; http://packetstormsecurity.com/files/126984/WebTitan-4.01-Build-68-SQL-Injection-Command-Execution.html
CVE: CVE-2014-4307
Published: 2014-06-18
Description: SQL injection vulnerability in categories-x.php in WebTitan before 4.04 allows remote attackers to execute arbitrary SQL commands via the sortkey parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/126984/WebTitan-4.01-Build-68-SQL-Injection-Command-Execution.html; https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140606-0_WebTitan_Multiple_Vulnerabilities_v10.txt; http://packetstormsecurity.com/files/126984/WebTitan-4.01-Build-68-SQL-Injection-Command-Execution.html
CVE: CVE-2014-4308
Published: 2014-06-18
Description: Multiple cross-site scripting (XSS) vulnerabilities in NICE Recording eXpress (aka Cybertech eXpress) before 6.5.5 allow remote attackers to inject arbitrary web script or HTML via the (1) USRLNM parameter to myaccount/mysettings.edit.validate.asp or the frame parameter to (2) iframe.picker.statchannels.asp, (3) iframe.picker.channelgroups.asp, (4) iframe.picker.extensions.asp, (5) iframe.picker.licenseusergroups.asp, (6) iframe.picker.licenseusers.asp, (7) iframe.picker.lookup.asp, or (8) iframe.picker.marks.asp in _ifr/.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/126858/NICE-Recording-eXpress-6.x-Root-Backdoor-XSS-Bypass.html; https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140528-0_NICE_Recording_eXpress_Multiple_critical_vulnerabilities_v10.txt; http://packetstormsecurity.com/files/126858/NICE-Recording-eXpress-6.x-Root-Backdoor-XSS-Bypass.html
CVE: CVE-2014-4309
Published: 2014-06-18
Description: Multiple cross-site scripting (XSS) vulnerabilities in Openfiler 2.99 allow remote attackers to inject arbitrary web script or HTML via the (1) TinkerAjax parameter to uptime.html, or remote authenticated users to inject arbitrary web script or HTML via the (2) MaxInstances, (3) PassivePorts, (4) Port, (5) ServerName, (6) TimeoutLogin, (7) TimeoutNoTransfer, or (8) TimeoutStalled parameter to admin/services_ftp.html; the (9) dns1 or (10) dns2 parameter to admin/system.html; the (11) newTgtName parameter to admin/volumes_iscsi_targets.html; the User-Agent HTTP header to (12) language.html, (13) login.html, or (14) password.html in account/; or the User-Agent HTTP header to (15) account_groups.html, (16) account_users.html, (17) services.html, (18) services_ftp.html, (19) services_iscsi_target.html, (20) services_rsync.html, (21) system_clock.html, (22) system_info.html, (23) system_ups.html, (24) volumes_editpartitions.html, or (25) volumes_iscsi_targets.html in admin/.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/127044/Openfiler-NAS-SAN-Appliance-2.99-XSS-Traversal-Command-Injection.html; http://packetstormsecurity.com/files/127044/Openfiler-NAS-SAN-Appliance-2.99-XSS-Traversal-Command-Injection.html
CVE: CVE-2013-6221
Published: 2014-06-18
Description: Directory traversal vulnerability in CommunicationServlet in HP Service Virtualization 3.x before 3.50.1, when the AutoPass license server is enabled, allows remote attackers to create arbitrary files and consequently execute arbitrary code via unspecified vectors, aka ZDI-CAN-2031.
CVSS Score: 10.0 (HIGH)
CWE: CWE-22
References: http://packetstormsecurity.com/files/127247/HP-AutoPass-License-Server-File-Upload.html; http://www.exploit-db.com/exploits/33891; http://www.osvdb.org/107943
CVE: CVE-2014-0910
Published: 2014-06-18
Description: Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 6.1.0.0 through 6.1.0.6 CF27, 6.1.5.0 through 6.1.5.3 CF27, and 7.0.0 through 7.0.0.2 CF28 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PI18845; http://www-01.ibm.com/support/docview.wss?uid=swg21675257; https://exchange.xforce.ibmcloud.com/vulnerabilities/91875
CVE: CVE-2014-2000
Published: 2014-06-18
Description: The NTT 050 plus application before 4.2.1 for Android allows attackers to obtain sensitive information by leveraging the ability to read system log files.
CVSS Score: 2.6 (LOW)
CWE: CWE-200
References: http://jvn.jp/en/jp/JVN07677464/995558/index.html; http://jvn.jp/en/jp/JVN07677464/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2014-000049
CVE: CVE-2014-2151
Published: 2014-06-18
Description: The WebVPN portal in Cisco Adaptive Security Appliance (ASA) Software 8.4(.7.15) and earlier allows remote authenticated users to obtain sensitive information via a crafted JavaScript file, aka Bug ID CSCui04520.
CVSS Score: 4.0 (MEDIUM)
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2151; http://tools.cisco.com/security/center/viewAlert.x?alertId=34627; http://www.securityfocus.com/bid/68063
CVE: CVE-2014-2779
Published: 2014-06-18
Description: mpengine.dll in Microsoft Malware Protection Engine before 1.1.10701.0 allows remote attackers to cause a denial of service (system hang) via a crafted file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/59337; http://www.securityfocus.com/bid/68076; http://www.securitytracker.com/id/1030438
CVE: CVE-2014-2949
Published: 2014-06-18
Description: SQL injection vulnerability in the web service in F5 ARX Data Manager 3.0.0 through 3.1.0 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://support.f5.com/kb/en-us/solutions/public/15000/300/sol15310.html?sr=38021626; http://www.kb.cert.org/vuls/id/210884; http://www.securityfocus.com/bid/68078
CVE: CVE-2014-3012
Published: 2014-06-18
Description: Multiple CRLF injection vulnerabilities in IBM Curam Social Program Management 5.2 SP1 through 6.0.5.4 allow remote authenticated users to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified parameters to custom JSPs.
CVSS Score: 3.5 (LOW)
References: http://secunia.com/advisories/59257; http://www-01.ibm.com/support/docview.wss?uid=swg21675454; https://exchange.xforce.ibmcloud.com/vulnerabilities/93010
CVE: CVE-2014-3013
Published: 2014-06-18
Description: Multiple cross-site scripting (XSS) vulnerabilities in IBM Curam Social Program Management 4.5 SP10 through 6.0.5.4 allow remote authenticated users to inject arbitrary web script or HTML via crafted input to a (1) custom JSP or (2) custom renderer.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://secunia.com/advisories/59259; http://www-01.ibm.com/support/docview.wss?uid=swg21675415; https://exchange.xforce.ibmcloud.com/vulnerabilities/93011
CVE: CVE-2014-4020
Published: 2014-06-18
Description: The dissect_frame function in epan/dissectors/packet-frame.c in the frame metadissector in Wireshark 1.10.x before 1.10.8 interprets a negative integer as a length value even though it was intended to represent an error condition, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-189
References: http://lists.opensuse.org/opensuse-updates/2014-06/msg00049.html; http://www.wireshark.org/security/wnpa-sec-2014-07.html; https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=10030
CVE: CVE-2014-4174
Published: 2014-06-18
Description: wiretap/libpcap.c in the libpcap file parser in Wireshark 1.10.x before 1.10.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted packet-trace file that includes a large packet.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://anonsvn.wireshark.org/viewvc/trunk-1.10/wiretap/libpcap.c?r1=53123&r2=53122&pathrev=53123; http://anonsvn.wireshark.org/viewvc?view=revision&revision=53123; http://www.wireshark.org/security/wnpa-sec-2014-05.html
CVE: CVE-2014-0598
Published: 2014-06-18
Description: Directory traversal vulnerability in iPrint in Novell Open Enterprise Server (OES) 11 SP1 before Maintenance Update 9151 on Linux has unspecified impact and remote attack vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/59113; http://www.securityfocus.com/bid/68066; https://bugzilla.novell.com/show_bug.cgi?id=869970
CVE: CVE-2014-0599
Published: 2014-06-18
Description: Cross-site scripting (XSS) vulnerability in iPrint in Novell Open Enterprise Server (OES) 11 SP1 before Maintenance Update 9151 on Linux allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/59113; https://bugzilla.novell.com/show_bug.cgi?id=869975; https://www.novell.com/support/kb/doc.php?id=7010867
CVE: CVE-2012-2592
Published: 2014-06-18
Description: Cross-site scripting (XSS) vulnerability in Axigen Mail Server 8.0.1 allows remote attackers to inject arbitrary web script or HTML via the body of an email.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/84526; http://www.exploit-db.com/exploits/20348; http://www.securityfocus.com/bid/54899
CVE: CVE-2013-5017
Published: 2014-06-18
Description: SNMPConfig.php in the management console in Symantec Web Gateway (SWG) before 5.2.1 allows remote attackers to execute arbitrary commands via unspecified vectors.
CVSS Score: 9.8 (CRITICAL)
References: http://www.securityfocus.com/bid/67752; http://www.securitytracker.com/id/1030443; http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=securit%20y_advisory&pvid=security_advisory&year=&suid=20140616_00
CVE: CVE-2014-1650
Published: 2014-06-18
Description: SQL injection vulnerability in user.php in the management console in Symantec Web Gateway (SWG) before 5.2.1 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 5.2 (MEDIUM)
CWE: CWE-89
References: http://www.securityfocus.com/bid/67753; http://www.securitytracker.com/id/1030443; http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=securit%20y_advisory&pvid=security_advisory&year=&suid=20140616_00
CVE: CVE-2014-1651
Published: 2014-06-18
Description: SQL injection vulnerability in clientreport.php in the management console in Symantec Web Gateway (SWG) before 5.2 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-89
References: http://www.kb.cert.org/vuls/id/719172; http://www.securityfocus.com/bid/67754; http://www.securitytracker.com/id/1030443
CVE: CVE-2014-1652
Published: 2014-06-18
Description: Multiple cross-site scripting (XSS) vulnerabilities in the management console in Symantec Web Gateway (SWG) before 5.2 allow remote authenticated users to inject arbitrary web script or HTML via unspecified report parameters.
CVSS Score: 2.3 (LOW)
CWE: CWE-79
References: http://www.kb.cert.org/vuls/id/719172; http://www.securityfocus.com/bid/67755; http://www.securitytracker.com/id/1030443
CVE: CVE-2014-4021
Published: 2014-06-18
Description: Xen 3.2.x through 4.4.x does not properly clean memory pages recovered from guests, which allows local guest OS users to obtain sensitive information via unspecified vectors.
CVSS Score: 2.7 (LOW)
CWE: CWE-119
References: http://linux.oracle.com/errata/ELSA-2014-0926-1.html; http://linux.oracle.com/errata/ELSA-2014-0926.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-July/135068.html
CVE: CVE-2014-4049
Published: 2014-06-18
Description: Heap-based buffer overflow in the php_parserr function in ext/standard/dns.c in PHP 5.6.0beta4 and earlier allows remote servers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted DNS TXT record, related to the dns_get_record function.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2014-07/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2014-07/msg00002.html
CVE: CVE-2014-4151
Published: 2014-06-18
Description: The av-centerd SOAP service in AlienVault OSSIM before 4.8.0 allows remote attackers to create arbitrary files and execute arbitrary code via a crafted set_file request.
CVSS Score: 10.0 (HIGH)
CWE: CWE-94
References: http://forums.alienvault.com/discussion/2806; http://secunia.com/advisories/59112; http://www.zerodayinitiative.com/advisories/ZDI-14-205/
CVE: CVE-2014-4152
Published: 2014-06-18
Description: The av-centerd SOAP service in AlienVault OSSIM before 4.8.0 allows remote attackers to execute arbitrary code via a crafted remote_task request, related to injecting an ssh public key.
CVSS Score: 10.0 (HIGH)
CWE: CWE-94
References: http://forums.alienvault.com/discussion/2806; http://secunia.com/advisories/59112; http://www.zerodayinitiative.com/advisories/ZDI-14-206/
CVE: CVE-2014-4153
Published: 2014-06-18
Description: The av-centerd SOAP service in AlienVault OSSIM before 4.8.0 allows remote attackers to read arbitrary files via a crafted get_file request.
CVSS Score: 7.8 (HIGH)
CWE: CWE-200
References: http://forums.alienvault.com/discussion/2806; http://secunia.com/advisories/59112; http://www.zerodayinitiative.com/advisories/ZDI-14-207/
CVE: CVE-2014-4286
Published: 2014-06-18
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2013-4286.  Reason: This candidate is a duplicate of CVE-2013-4286.  A typo caused the wrong ID to be used.  Notes: All CVE users should reference CVE-2013-4286 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2014-2001
Published: 2014-06-19
Description: The East Japan Railway Company JR East Japan application before 1.2.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to obtain sensitive information via a crafted certificate.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-310
References: http://jvn.jp/en/jp/JVN10603428/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2014-000050; https://play.google.com/store/apps/details?id=jp.co.jreast
CVE: CVE-2014-2609
Published: 2014-06-19
Description: The Java Glassfish Admin Console in HP Executive Scorecard 9.40 and 9.41 does not require authentication, which allows remote attackers to execute arbitrary code via a session on TCP port 10001, aka ZDI-CAN-2116.
CVSS Score: 10.0 (HIGH)
CWE: CWE-287
References: http://secunia.com/advisories/59363; http://www.securityfocus.com/bid/68093; http://www.securitytracker.com/id/1030439
CVE: CVE-2014-2610
Published: 2014-06-19
Description: Directory traversal vulnerability in the Content Acceleration Pack (CAP) web application in HP Executive Scorecard 9.40 and 9.41 allows remote authenticated users to execute arbitrary code by uploading an executable file, aka ZDI-CAN-2117.
CVSS Score: 7.1 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/59363; http://www.securityfocus.com/bid/68093; http://www.securitytracker.com/id/1030439