deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-0474
Published: 2014-04-23
Description: The (1) FilePathField, (2) GenericIPAddressField, and (3) IPAddressField model field classes in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 do not properly perform type conversion, which allows remote attackers to have unspecified impact and vectors, related to "MySQL typecasting."
CVSS Score: 10.0 (HIGH)
CWE: CWE-399
References: http://lists.opensuse.org/opensuse-updates/2014-09/msg00023.html; http://rhn.redhat.com/errata/RHSA-2014-0456.html; http://rhn.redhat.com/errata/RHSA-2014-0457.html
CVE: CVE-2014-2327
Published: 2014-04-23
Description: Cross-site request forgery (CSRF) vulnerability in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to hijack the authentication of users for unspecified commands, as demonstrated by requests that (1) modify binary files, (2) modify configurations, or (3) add arbitrary users.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://jvn.jp/en/jp/JVN55076671/index.html; http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-002239.html; http://lists.opensuse.org/opensuse-updates/2015-03/msg00034.html
CVE: CVE-2014-2328
Published: 2014-04-23
Description: lib/graph_export.php in Cacti 0.8.7g, 0.8.8b, and earlier allows remote authenticated users to execute arbitrary commands via shell metacharacters in unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
References: http://bugs.cacti.net/view.php?id=2433; http://lists.fedoraproject.org/pipermail/package-announce/2014-April/131821.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-April/131842.html
CVE: CVE-2014-2554
Published: 2014-04-23
Description: OTRS 3.1.x before 3.1.21, 3.2.x before 3.2.16, and 3.3.x before 3.3.6 allows remote attackers to conduct clickjacking attacks via an IFRAME element.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-updates/2014-04/msg00062.html; http://www.otrs.com/security-advisory-2014-05-clickjacking-issue/; http://lists.opensuse.org/opensuse-updates/2014-04/msg00062.html
CVE: CVE-2014-2709
Published: 2014-04-23
Description: lib/rrd.php in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in unspecified parameters.
CVSS Score: 7.5 (HIGH)
References: http://lists.fedoraproject.org/pipermail/package-announce/2014-April/131821.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-April/131842.html; http://seclists.org/oss-sec/2014/q2/15
CVE: CVE-2014-2855
Published: 2014-04-23
Description: The check_secret function in authenticate.c in rsync 3.1.0 and earlier allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a user name which does not exist in the secrets file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://advisories.mageia.org/MGASA-2015-0065.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-April/131910.html; http://lists.opensuse.org/opensuse-updates/2014-05/msg00006.html
CVE: CVE-2014-2888
Published: 2014-04-23
Description: lib/sfpagent/bsig.rb in the sfpagent gem before 0.4.15 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in the module name in a JSON request.
CVSS Score: 7.5 (HIGH)
References: http://seclists.org/fulldisclosure/2014/Apr/243; http://www.openwall.com/lists/oss-security/2014/04/16/1; http://www.openwall.com/lists/oss-security/2014/04/18/4
CVE: CVE-2014-2893
Published: 2014-04-23
Description: The GetHTMLRunDir function in the scan-build utility in Clang 3.5 and earlier allows local users to obtain sensitive information or overwrite arbitrary files via a symlink attack on temporary directories with predictable names.
CVSS Score: 1.9 (LOW)
CWE: CWE-59
References: http://lists.opensuse.org/opensuse-updates/2015-02/msg00038.html; http://www.openwall.com/lists/oss-security/2014/04/16/2; http://www.openwall.com/lists/oss-security/2014/04/20/1
CVE: CVE-2014-2894
Published: 2014-04-23
Description: Off-by-one error in the cmd_smart function in the smart self test in hw/ide/core.c in QEMU before 2.0 allows local users to have unspecified impact via a SMART EXECUTE OFFLINE command that triggers a buffer underflow and memory corruption.
CVSS Score: 7.2 (HIGH)
CWE: CWE-189
References: http://rhn.redhat.com/errata/RHSA-2014-0704.html; http://rhn.redhat.com/errata/RHSA-2014-0743.html; http://rhn.redhat.com/errata/RHSA-2014-0744.html
CVE: CVE-2014-2976
Published: 2014-04-23
Description: Directory traversal vulnerability in Sixnet SixView Manager 2.4.1 allows remote attackers to read arbitrary files via a .. (dot dot) in an HTTP GET request to TCP port 18081.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/58231; http://www.exploit-db.com/exploits/32973; http://secunia.com/advisories/58231
CVE: CVE-2014-2983
Published: 2014-04-23
Description: Drupal 6.x before 6.31 and 7.x before 7.27 does not properly isolate the cached data of different anonymous users, which allows remote anonymous users to obtain sensitive interim form input information in opportunistic situations via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www.debian.org/security/2014/dsa-2913; http://www.debian.org/security/2014/dsa-2914; http://www.openwall.com/lists/oss-security/2014/04/22/2
CVE: CVE-2014-0892
Published: 2014-04-23
Description: IBM Notes and Domino 8.5.x before 8.5.3 FP6 IF3 and 9.x before 9.0.1 FP1 on 32-bit Linux platforms use incorrect gcc options, which makes it easier for remote attackers to execute arbitrary code by leveraging the absence of the NX protection mechanism and placing crafted x86 code on the stack, aka SPR KLYH9GGS9W.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg21670264; http://www.kb.cert.org/vuls/id/350089; https://exchange.xforce.ibmcloud.com/vulnerabilities/91286
CVE: CVE-2014-1646
Published: 2014-04-23
Description: Symantec PGP Desktop 10.0.x through 10.2.x and Encryption Desktop Professional 10.3.x before 10.3.2 MP1 do not properly perform memory copies, which allows remote attackers to cause a denial of service (read access violation and application crash) via a malformed certificate.
CVSS Score: 2.6 (LOW)
CWE: CWE-119
References: http://www.securityfocus.com/bid/67016; http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20140423_00; http://www.securityfocus.com/bid/67016
CVE: CVE-2014-1647
Published: 2014-04-23
Description: Symantec PGP Desktop 10.0.x through 10.2.x and Encryption Desktop Professional 10.3.x before 10.3.2 MP1 do not properly perform block-data moves, which allows remote attackers to cause a denial of service (read access violation and application crash) via a malformed certificate.
CVSS Score: 2.6 (LOW)
CWE: CWE-119
References: http://www.securityfocus.com/bid/67020; http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20140423_00; http://www.securityfocus.com/bid/67020
CVE: CVE-2011-5279
Published: 2014-04-23
Description: CRLF injection vulnerability in the CGI implementation in Microsoft Internet Information Services (IIS) 4.x and 5.x on Windows NT and Windows 2000 allows remote attackers to modify arbitrary uppercase environment variables via a \n (newline) character in an HTTP header.
CVSS Score: 5.0 (MEDIUM)
References: http://hi.baidu.com/yuange1975/item/b2cc7141c22108e91e19bc2e; http://seclists.org/fulldisclosure/2012/Apr/0; http://seclists.org/fulldisclosure/2012/Apr/13
CVE: CVE-2014-0360
Published: 2014-04-23
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2014-2741.  Reason: This candidate is a duplicate of CVE-2014-2741.  Notes: All CVE users should reference CVE-2014-2741 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2014-2391
Published: 2014-04-24
Description: The password recovery service in Open-Xchange AppSuite before 7.2.2-rev20, 7.4.1 before 7.4.1-rev11, and 7.4.2 before 7.4.2-rev13 makes an improper decision about the sensitivity of a string representing a previously used but currently invalid password, which allows remote attackers to obtain potentially useful password-pattern information by reading (1) a web-server access log, (2) a web-server Referer log, or (3) browser history that contains this string because of its presence in a GET request.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/archive/1/531762; http://www.securityfocus.com/archive/1/531762
CVE: CVE-2014-2392
Published: 2014-04-24
Description: The E-Mail autoconfiguration feature in Open-Xchange AppSuite before 7.2.2-rev20, 7.4.1 before 7.4.1-rev11, and 7.4.2 before 7.4.2-rev13 places a password in a GET request, which allows remote attackers to obtain sensitive information by reading (1) web-server access logs, (2) web-server Referer logs, or (3) the browser history.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/archive/1/531762; http://www.securityfocus.com/archive/1/531762
CVE: CVE-2014-2393
Published: 2014-04-24
Description: Cross-site scripting (XSS) vulnerability in Open-Xchange AppSuite 7.4.1 before 7.4.1-rev11 and 7.4.2 before 7.4.2-rev13 allows remote attackers to inject arbitrary web script or HTML via a Drive filename that is not properly handled during use of the composer to add an e-mail attachment.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/archive/1/531762; http://www.securityfocus.com/archive/1/531762
CVE: CVE-2012-3946
Published: 2014-04-24
Description: Cisco IOS before 15.3(2)S allows remote attackers to bypass interface ACL restrictions in opportunistic circumstances by sending IPv6 packets in an unspecified scenario in which expected packet drops do not occur for "a small percentage" of the packets, aka Bug ID CSCty73682.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://www.cisco.com/c/en/us/td/docs/ios/15_3s/release/notes/15_3s_rel_notes/15_3s_caveats_15_3_2s.html; http://www.cisco.com/c/en/us/td/docs/ios/15_3s/release/notes/15_3s_rel_notes/15_3s_caveats_15_3_2s.html
CVE: CVE-2012-5723
Published: 2014-04-24
Description: Cisco ASR 1000 devices with software before 3.8S, when BDI routing is enabled, allow remote attackers to cause a denial of service (device reload) via crafted (1) broadcast or (2) multicast ICMP packets with fragmentation, aka Bug ID CSCub55948.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-20
References: http://www.cisco.com/c/en/us/td/docs/routers/asr1000/release/notes/asr1k_rn_rel_notes/asr1k_caveats_38s.html; http://www.cisco.com/c/en/us/td/docs/routers/asr1000/release/notes/asr1k_rn_rel_notes/asr1k_caveats_38s.html
CVE: CVE-2013-6738
Published: 2014-04-24
Description: Cross-site scripting (XSS) vulnerability in IBM SmartCloud Analytics Log Analysis 1.1 and 1.2 before 1.2.0.0-CSI-SCALA-IF0003 allows remote attackers to inject arbitrary web script or HTML via an invalid query parameter in a response from an OAuth authorization endpoint.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IV57425; http://www-01.ibm.com/support/docview.wss?uid=swg21669137; http://www-01.ibm.com/support/docview.wss?uid=swg21669554
CVE: CVE-2014-2907
Published: 2014-04-24
Description: The srtp_add_address function in epan/dissectors/packet-rtp.c in the RTP dissector in Wireshark 1.10.x before 1.10.7 does not properly update SRTP conversation data, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.
CVSS Score: 4.3 (MEDIUM)
References: http://lists.opensuse.org/opensuse-updates/2014-05/msg00022.html; http://www.wireshark.org/security/wnpa-sec-2014-06.html; https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9885
CVE: CVE-2014-0188
Published: 2014-04-24
Description: The openshift-origin-broker in Red Hat OpenShift Enterprise 2.0.5, 1.2.7, and earlier does not properly handle authentication requests from the remote-user auth plugin, which allows remote attackers to bypass authentication and impersonate arbitrary users via the X-Remote-User header in a request to a passthrough trigger.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://rhn.redhat.com/errata/RHSA-2014-0422.html; http://rhn.redhat.com/errata/RHSA-2014-0423.html; https://bugzilla.redhat.com/show_bug.cgi?id=1090120
CVE: CVE-2014-2736
Published: 2014-04-24
Description: Multiple SQL injection vulnerabilities in MODX Revolution before 2.2.14 allow remote attackers to execute arbitrary SQL commands via the (1) session ID (PHPSESSID) to index.php or remote authenticated users to execute arbitrary SQL commands via the (2) user parameter to connectors/security/message.php or (3) id parameter to manager/index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://archives.neohapsis.com/archives/bugtraq/2014-04/0124.html; http://forums.modx.com/thread/90173/modx-revolution-2-2-13-and-prior-blind-sql-injection; http://secunia.com/advisories/58036
CVE: CVE-2014-2915
Published: 2014-04-24
Description: Xen 4.4.x, when running on ARM systems, does not properly restrict access to hardware features, which allows local guest users to cause a denial of service (host or guest crash) via unspecified vectors, related to (1) cache control, (2) coprocessors, (3) debug registers, and (4) other unspecified registers.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-264
References: http://www.openwall.com/lists/oss-security/2014/04/22/10; http://www.openwall.com/lists/oss-security/2014/04/23/2; http://www.securitytracker.com/id/1030135
CVE: CVE-2014-2601
Published: 2014-04-24
Description: The server in HP Integrated Lights-Out 2 (aka iLO 2) 2.23 and earlier allows remote attackers to cause a denial of service via crafted HTTPS traffic, as demonstrated by traffic from a CVE-2014-0160 vulnerability-assessment tool.
CVSS Score: 7.8 (HIGH)
References: http://h20565.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?docId=emr_na-c04249852-1; http://www.securitytracker.com/id/1030148; https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04244787
CVE: CVE-2014-2734
Published: 2014-04-24
Description: The openssl extension in Ruby 2.x does not properly maintain the state of process memory after a file is reopened, which allows remote attackers to spoof signatures within the context of a Ruby script that attempts signature verification after performing a certain sequence of filesystem operations.  NOTE: this issue has been disputed by the Ruby OpenSSL team and third parties, who state that the original demonstration PoC contains errors and redundant or unnecessarily-complex code that does not appear to be related to a demonstration of the issue. As of 20140502, CVE is not aware of any public comment by the original researcher
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-399
References: http://packetstormsecurity.com/files/126218/Ruby-OpenSSL-Private-Key-Spoofing.html; http://seclists.org/fulldisclosure/2014/Apr/231; http://seclists.org/fulldisclosure/2014/May/13
CVE: CVE-2014-0760
Published: 2014-04-25
Description: The Festo CECX-X-C1 Modular Master Controller with CoDeSys and CECX-X-M1
 Modular Controller with CoDeSys and SoftMotion provide an undocumented 
access method involving the FTP protocol, which could allow a remote attacker to execute arbitrary code or cause a denial of service (application 
crash) via unspecified vectors.
CVSS Score: 9.3 (HIGH)
CWE: CWE-287, CWE-287
References: https://www.cisa.gov/news-events/ics-advisories/icsa-14-084-01; http://ics-cert.us-cert.gov/advisories/ICSA-14-084-01
CVE: CVE-2014-0769
Published: 2014-04-25
Description: The Festo CECX-X-C1 Modular Master Controller with CoDeSys and CECX-X-M1 Modular Controller with CoDeSys and SoftMotion do not require authentication for connections to certain TCP ports, which allows remote attackers to (1) modify the configuration via a request to the debug service on port 4000 or (2) delete log entries via a request to the log service on port 4001.
CVSS Score: 9.3 (HIGH)
CWE: CWE-287, CWE-287
References: https://www.cisa.gov/news-events/ics-advisories/icsa-14-084-01; http://ics-cert.us-cert.gov/advisories/ICSA-14-084-01
CVE: CVE-2014-0780
Published: 2014-04-25
Description: Directory traversal vulnerability in NTWebServer in InduSoft Web Studio 7.1 before SP2 Patch 4 allows remote attackers to read administrative passwords in APP files, and consequently execute arbitrary code, via unspecified web requests.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22, CWE-22, CWE-22
References: http://download.indusoft.com/71.2.4/IWS71.2.4.zip; http://www.securityfocus.com/bid/67056; https://www.cisa.gov/news-events/ics-advisories/icsa-14-107-02
CVE: CVE-2014-2908
Published: 2014-04-25
Description: Cross-site scripting (XSS) vulnerability in the integrated web server on Siemens SIMATIC S7-1200 CPU devices 2.x and 3.x allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://ics-cert.us-cert.gov/advisories/ICSA-14-114-02; http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-892012.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-892012.pdf
CVE: CVE-2014-2909
Published: 2014-04-25
Description: CRLF injection vulnerability in the integrated web server on Siemens SIMATIC S7-1200 CPU devices 2.x and 3.x allows remote attackers to inject arbitrary HTTP headers via unspecified vectors.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-94
References: http://ics-cert.us-cert.gov/advisories/ICSA-14-114-02; http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-892012.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-892012.pdf
CVE: CVE-2014-2984
Published: 2014-04-25
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2014-2650.  Reason: This candidate is a reservation duplicate of CVE-2014-2650.  Notes: All CVE users should reference CVE-2014-2650 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2012-4230
Published: 2014-04-25
Description: The bbcode plugin in TinyMCE 3.5.8 does not properly enforce the TinyMCE security policy for the (1) encoding directive and (2) valid_elements attribute, which allows attackers to conduct cross-site scripting (XSS) attacks via application-specific vectors, as demonstrated using a textarea element.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/91130; http://packetstormsecurity.com/files/120750/TinyMCE-3.5.8-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2013/Mar/114
CVE: CVE-2013-5954
Published: 2014-04-25
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in OpenX 2.8.11 and earlier allow remote attackers to hijack the authentication of administrators for requests that delete (1) users via admin/agency-user-unlink.php, (2) advertisers via admin/advertiser-delete.php, (3) banners via admin/banner-delete.php, (4) campaigns via admin/campaign-delete.php, (5) channels via admin/channel-delete.php, (6) affiliate websites via admin/affiliate-delete.php, or (7) zones via admin/zone-delete.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.com/files/125735; http://seclists.org/fulldisclosure/2014/Mar/270; http://seclists.org/fulldisclosure/2014/May/68
CVE: CVE-2013-5956
Published: 2014-04-25
Description: Cross-site scripting (XSS) vulnerability in includes/flvthumbnail.php in the Youtube Gallery (com_youtubegallery) component 3.4.0 for Joomla! allows remote attackers to inject arbitrary web script or HTML via the videofile parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/125732/Joomla-Youtube-Gallery-3.4.0-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2014/Mar/264; http://seclists.org/fulldisclosure/2014/Mar/288
CVE: CVE-2014-2729
Published: 2014-04-25
Description: Cross-site scripting (XSS) vulnerability in content.aspx in Ektron CMS 8.7 before 8.7.0.055 allows remote authenticated users to inject arbitrary web script or HTML via the category0 parameter, which is not properly handled when displaying the Subjects tab in the View Properties menu option.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://packetstormsecurity.com/files/126187/Ektron-CMS-8.7-Cross-Site-Scripting.html; http://www.securityfocus.com/archive/1/531852/100/0/threaded; http://www.securityfocus.com/archive/1/531853/100/0/threaded
CVE: CVE-2013-2025
Published: 2014-04-25
Description: Cross-site scripting (XSS) vulnerability in Ushahidi Platform 2.5.x through 2.6.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/59410; https://github.com/rjmackay/Ushahidi_Web/commit/593719ff805a302e3ab2f2e535c875f90a04ea56; https://github.com/ushahidi/Ushahidi_Web/issues/1009
CVE: CVE-2013-3069
Published: 2014-04-25
Description: Multiple cross-site scripting (XSS) vulnerabilities in NETGEAR WNDR4700 with firmware 1.0.0.34 allow remote authenticated users to inject arbitrary web script or HTML via the (1) UserName or (2) Password to the NAS User Setup page, (3) deviceName to USB_advanced.htm, or (4) Network Key to the Wireless Setup page.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://osvdb.org/92557; http://securityevaluators.com/knowledge/case_studies/routers/Vulnerability_Catalog.pdf; http://osvdb.org/92557
CVE: CVE-2013-4565
Published: 2014-04-25
Description: Heap-based buffer overflow in the __OLEdecode function in ppthtml 0.5.1 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted .ppt file.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://seclists.org/oss-sec/2013/q4/279; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=729279; https://exchange.xforce.ibmcloud.com/vulnerabilities/88885
CVE: CVE-2013-4722
Published: 2014-04-25
Description: Multiple cross-site scripting (XSS) vulnerabilities in Admin/login/default.asp in DDSN Interactive cm3 Acora CMS 6.0.6/1a, 6.0.2/1a, 5.5.7/12b, 5.5.0/1b-p1, and possibly other versions allow remote attackers to inject arbitrary web script or HTML via the (1) username, (2) url, (3) qstr parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/96661; http://packetstormsecurity.com/files/122954/CM3-AcoraCMS-XSS-CSRF-Redirection-Disclosure.html; http://www.digitalsec.net/stuff/explt+advs/CM3.AcoraCMS.v6.txt
CVE: CVE-2013-4723
Published: 2014-04-25
Description: Open redirect vulnerability in DDSN Interactive cm3 Acora CMS 6.0.6/1a, 6.0.2/1a, 5.5.7/12b, 5.5.0/1b-p1, and possibly other versions allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the l parameter to track.aspx.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://osvdb.org/96662; http://packetstormsecurity.com/files/122954/CM3-AcoraCMS-XSS-CSRF-Redirection-Disclosure.html; http://www.digitalsec.net/stuff/explt+advs/CM3.AcoraCMS.v6.txt
CVE: CVE-2013-4726
Published: 2014-04-25
Description: Cross-site request forgery (CSRF) vulnerability in DDSN Interactive cm3 Acora CMS 6.0.6/1a, 6.0.2/1a, 5.5.7/12b, 5.5.0/1b-p1, and possibly other versions, allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://osvdb.org/96665; http://packetstormsecurity.com/files/122954/CM3-AcoraCMS-XSS-CSRF-Redirection-Disclosure.html; http://www.digitalsec.net/stuff/explt+advs/CM3.AcoraCMS.v6.txt
CVE: CVE-2013-5660
Published: 2014-04-25
Description: Buffer overflow in Power Software WinArchiver 3.2 allows remote attackers to execute arbitrary code via a crafted .zip file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/ref/92/winarchiver-overflow.txt; http://osvdb.org/show/osvdb/92992; http://packetstormsecurity.com/files/121512/Winarchiver-3.2-Buffer-Overflow.html