deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-0233
Published: 2014-11-16
Description: Red Hat OpenShift Enterprise 2.0 and 2.1 and OpenShift Origin allow remote authenticated users to execute arbitrary commands via shell metacharacters in a directory name that is referenced by a cartridge using the file: URI scheme.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-94
References: http://rhn.redhat.com/errata/RHSA-2014-0529.html; http://rhn.redhat.com/errata/RHSA-2014-0530.html; https://bugzilla.redhat.com/show_bug.cgi?id=1096955
CVE: CVE-2014-3755
Published: 2014-11-16
Description: The QSvg module in Qt, as used in the Mumble client 1.2.x before 1.2.6, allows remote attackers to cause a denial of service (hang and resource consumption) via a local file reference in an (1) image tag or (2) XML stylesheet in an SVG file.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://mumble.info/security/Mumble-SA-2014-005.txt; http://www.openwall.com/lists/oss-security/2014/05/15/1; http://www.openwall.com/lists/oss-security/2014/05/15/4
CVE: CVE-2014-3756
Published: 2014-11-16
Description: The client in Mumble 1.2.x before 1.2.6 allows remote attackers to force the loading of an external file and cause a denial of service (hang and resource consumption) via a crafted string that is treated as rich-text by a Qt widget, as demonstrated by the (1) user or (2) channel name in a Qt dialog, (3) subject common name or (4) email address to the Certificate Wizard, or (5) server name in a tooltip.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-19
References: http://mumble.info/security/Mumble-SA-2014-006.txt; http://www.openwall.com/lists/oss-security/2014/05/15/1; http://www.openwall.com/lists/oss-security/2014/05/15/4
CVE: CVE-2014-8948
Published: 2014-11-16
Description: Cross-site request forgery (CSRF) vulnerability in the iMember360 plugin 3.8.012 through 3.9.001 for WordPress allows remote attackers to hijack the authentication of administrators for requests that with an unspecified impact via the i4w_trace parameter.  NOTE: this can be leveraged with CVE-2014-8948 to execute arbitrary commands.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://osvdb.org/show/osvdb/106301; http://packetstormsecurity.com/files/126324/WordPress-iMember360is-3.9.001-XSS-Disclosure-Code-Execution.html; http://seclists.org/fulldisclosure/2014/Apr/265
CVE: CVE-2014-8949
Published: 2014-11-16
Description: The iMember360 plugin 3.8.012 through 3.9.001 for WordPress allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in the i4w_trace parameter.  NOTE: this can be leveraged with CVE-2014-8948 to allow remote attackers to execute code.  NOTE: it is not clear whether this issue itself crosses privileges.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-94
References: http://osvdb.org/show/osvdb/106301; http://packetstormsecurity.com/files/126324/WordPress-iMember360is-3.9.001-XSS-Disclosure-Code-Execution.html; http://seclists.org/fulldisclosure/2014/Apr/265
CVE: CVE-2014-0228
Published: 2014-11-16
Description: Apache Hive before 0.13.1, when in SQL standards based authorization mode, does not properly check the file permissions for (1) import and (2) export statements, which allows remote authenticated users to obtain sensitive information via a crafted URI.
CVSS Score: 3.5 (LOW)
CWE: CWE-284
References: http://mail-archives.apache.org/mod_mbox/hive-user/201406.mbox/%3CCABgNGzeN7E+9d=YV5yvnKA7wmSx1op_avtUjPcPtDaR6DLJM6g%40mail.gmail.com%3E; http://packetstormsecurity.com/files/127091/Apache-Hive-0.13.0-Authorization-Failure.html; http://www.securityfocus.com/archive/1/532418/100/0/threaded
CVE: CVE-2014-0250
Published: 2014-11-16
Description: Multiple integer overflows in client/X11/xf_graphics.c in FreeRDP allow remote attackers to have an unspecified impact via the width and height to the (1) xf_Pointer_New or (2) xf_Bitmap_Decompress function, which causes an incorrect amount of memory to be allocated.
CVSS Score: 7.5 (HIGH)
CWE: CWE-189
References: http://advisories.mageia.org/MGASA-2014-0287.html; http://lists.opensuse.org/opensuse-updates/2014-07/msg00008.html; http://seclists.org/oss-sec/2014/q2/365
CVE: CVE-2014-3248
Published: 2014-11-16
Description: Untrusted search path vulnerability in Puppet Enterprise 2.8 before 2.8.7, Puppet before 2.7.26 and 3.x before 3.6.2, Facter 1.6.x and 2.x before 2.0.2, Hiera before 1.3.4, and Mcollective before 2.5.2, when running with Ruby 1.9.1 or earlier, allows local users to gain privileges via a Trojan horse file in the current working directory, as demonstrated using (1) rubygems/defaults/operating_system.rb, (2) Win32API.rb, (3) Win32API.so, (4) safe_yaml.rb, (5) safe_yaml/deep.rb, or (6) safe_yaml/deep.so; or (7) operatingsystem.rb, (8) operatingsystem.so, (9) osfamily.rb, or (10) osfamily.so in puppet/confine.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-17
References: http://puppetlabs.com/security/cve/cve-2014-3248; http://rowediness.com/2014/06/13/cve-2014-3248-a-little-problem-with-puppet/; http://secunia.com/advisories/59197
CVE: CVE-2014-3916
Published: 2014-11-16
Description: The str_buf_cat function in string.c in Ruby 1.9.3, 2.0.0, and 2.1 allows context-dependent attackers to cause a denial of service (segmentation fault and crash) via a long string.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-19
References: http://seclists.org/oss-sec/2014/q2/362; http://seclists.org/oss-sec/2014/q2/375; http://www.securityfocus.com/bid/67705
CVE: CVE-2014-8950
Published: 2014-11-16
Description: Unspecified vulnerability in Check Point Security Gateway R77 and R77.10, when the (1) URL Filtering or (2) Identity Awareness blade is used, allows remote attackers to cause a denial of service (crash) via vectors involving an HTTPS request.
CVSS Score: 7.1 (HIGH)
References: http://secunia.com/advisories/58487; http://www.securityfocus.com/bid/67993; https://exchange.xforce.ibmcloud.com/vulnerabilities/98763
CVE: CVE-2014-8951
Published: 2014-11-16
Description: Unspecified vulnerability in Check Point Security Gateway R75, R76, R77, and R77.10, when UserCheck is enabled and the (1) Application Control, (2) URL Filtering, (3) DLP, (4) Threat Emulation, (5) Anti-Bot, or (6) Anti-Virus blade is used, allows remote attackers to cause a denial of service (fwk0 process crash, core dump, and restart) via a redirect to the UserCheck page.
CVSS Score: 7.1 (HIGH)
References: http://secunia.com/advisories/58487; http://www.securityfocus.com/bid/67993; https://exchange.xforce.ibmcloud.com/vulnerabilities/98761
CVE: CVE-2014-8952
Published: 2014-11-16
Description: Multiple unspecified vulnerabilities in Check Point Security Gateway R75.40VS, R75.45, R75.46, R75.47, R76, R77, and R77.10, when the (1) IPS blade, (2) IPsec Remote Access, (3) Mobile Access / SSL VPN blade, (4) SSL Network Extender, (5) Identify Awareness blade, (6) HTTPS Inspection, (7) UserCheck, or (8) Data Leak Prevention blade module is enabled, allow remote attackers to cause a denial of service ("stability issue") via an unspecified "traffic condition."
CVSS Score: 7.1 (HIGH)
References: http://secunia.com/advisories/58487; http://www.securityfocus.com/bid/67993; https://exchange.xforce.ibmcloud.com/vulnerabilities/98762
CVE: CVE-2014-3629
Published: 2014-11-17
Description: XML external entity (XXE) vulnerability in the XML Exchange module in Apache Qpid 0.30 allows remote attackers to cause outgoing HTTP connections via a crafted message.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-19
References: http://packetstormsecurity.com/files/129034/Apache-Qpid-0.30-Induced-HTTP-Requests.html; http://secunia.com/advisories/62235; http://www.securityfocus.com/archive/1/533943/100/0/threaded
CVE: CVE-2014-5277
Published: 2014-11-17
Description: Docker before 1.3.1 and docker-py before 0.5.3 fall back to HTTP when the HTTPS connection to the registry fails, which allows man-in-the-middle attackers to conduct downgrade attacks and obtain authentication and image data by leveraging a network position between the client and the registry to block HTTPS traffic.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-17
References: http://lists.opensuse.org/opensuse-updates/2014-11/msg00048.html; https://groups.google.com/forum/#%21topic/docker-user/oYm0i3xShJU; http://lists.opensuse.org/opensuse-updates/2014-11/msg00048.html
CVE: CVE-2014-8498
Published: 2014-11-17
Description: SQL injection vulnerability in BulkEditSearchResult.cc in ManageEngine Password Manager Pro (PMP) and Password Manager Pro Managed Service Providers (MSP) edition before 7.1 build 7105 allows remote authenticated users to execute arbitrary SQL commands via the SEARCH_ALL parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://osvdb.org/show/osvdb/114483; http://packetstormsecurity.com/files/129036/Password-Manager-Pro-SQL-Injection.html; http://seclists.org/fulldisclosure/2014/Nov/18
CVE: CVE-2014-8499
Published: 2014-11-17
Description: Multiple SQL injection vulnerabilities in ManageEngine Password Manager Pro (PMP) and Password Manager Pro Managed Service Providers (MSP) edition before 7.1 build 7105 allow remote authenticated users to execute arbitrary SQL commands via the SEARCH_ALL parameter to (1) SQLAdvancedALSearchResult.cc or (2) AdvancedSearchResult.cc.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://osvdb.org/show/osvdb/114484; http://osvdb.org/show/osvdb/114485; http://packetstormsecurity.com/files/129036/Password-Manager-Pro-SQL-Injection.html
CVE: CVE-2014-8517
Published: 2014-11-17
Description: The fetch_url function in usr.bin/ftp/fetch.c in tnftp, as used in NetBSD 5.1 through 5.1.4, 5.2 through 5.2.2, 6.0 through 6.0.6, and 6.1 through 6.1.5 allows remote attackers to execute arbitrary commands via a | (pipe) character at the end of an HTTP redirect.
CVSS Score: 7.5 (HIGH)
CWE: CWE-77
References: http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2014-013.txt.asc; http://lists.apple.com/archives/security-announce/2015/Jan/msg00003.html; http://lists.opensuse.org/opensuse-updates/2014-11/msg00029.html
CVE: CVE-2014-8596
Published: 2014-11-17
Description: Multiple SQL injection vulnerabilities in PHP-Fusion 7.02.07 allow remote authenticated users to execute arbitrary SQL commands via the (1) submit_id parameter in a 2 action to files/administration/submissions.php or (2) status parameter to files/administration/members.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/show/osvdb/112419; http://packetstormsecurity.com/files/129053/PHP-Fusion-7.02.07-SQL-Injection.html; http://packetstormsecurity.com/files/133869/PHP-Fusion-7.02.07-Blind-SQL-Injection.html
CVE: CVE-2014-8727
Published: 2014-11-17
Description: Multiple directory traversal vulnerabilities in F5 BIG-IP before 10.2.2 allow local users with the "Resource Administrator" or "Administrator" role to enumerate and delete arbitrary files via a .. (dot dot) in the name parameter to (1) tmui/Control/jspmap/tmui/system/archive/properties.jsp or (2) tmui/Control/form.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.com/files/129084/F5-BIG-IP-10.1.0-Directory-Traversal.html; http://www.exploit-db.com/exploits/35222; http://www.securityfocus.com/bid/71063
CVE: CVE-2014-8732
Published: 2014-11-17
Description: Cross-site scripting (XSS) vulnerability in phpMemcachedAdmin 1.2.2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/129090/PHPMemcachedAdmin-1.2.2-Cross-Site-Scripting.html; http://www.securityfocus.com/archive/1/533969/100/0/threaded; http://www.securityfocus.com/archive/1/533981/100/0/threaded
CVE: CVE-2014-8953
Published: 2014-11-17
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in Php Scriptlerim Who's Who script allow remote attackers to hijack the authentication of administrators or requests that (1) add an admin account via a request to filepath/yonetim/plugin/adminsave.php or have unspecified impact via a request to (2) ayarsave.php, (3) uyesave.php, (4) slaytadd.php, or (5) slaytsave.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.com/files/129102/Whos-Who-Script-Cross-Site-Request-Forgery.html; http://www.exploit-db.com/exploits/35129; https://exchange.xforce.ibmcloud.com/vulnerabilities/98631
CVE: CVE-2014-8954
Published: 2014-11-17
Description: Multiple cross-site scripting (XSS) vulnerabilities in phpSound 1.0.5 allow remote attackers to inject arbitrary web script or HTML via the (1) Title or (2) Description fields in a playlist or the (3) filter parameter in an explore action to index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/129104/phpSound-Music-Sharing-Platform-1.0.5-Cross-Site-Scripting.html; http://www.exploit-db.com/exploits/35198; http://www.securityfocus.com/bid/71172
CVE: CVE-2014-8955
Published: 2014-11-17
Description: Cross-site scripting (XSS) vulnerability in the Contact Form Clean and Simple (clean-and-simple-contact-form-by-meg-nicholas) plugin 4.4.0 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the cscf[name] parameter to contact-us/.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/128957/WordPress-Clean-And-Simple-Contact-Form-4.4.0-XSS.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/98469; http://packetstormsecurity.com/files/128957/WordPress-Clean-And-Simple-Contact-Form-4.4.0-XSS.html
CVE: CVE-2012-1669
Published: 2014-11-17
Description: Directory traversal vulnerability in index.php in phpMoneyBooks before 1.0.3 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the module parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/80101; http://packetstormsecurity.com/files/111114/phpMoneyBooks-1.0.2-Local-File-Inclusion.html; http://seclists.org/fulldisclosure/2012/Mar/259
CVE: CVE-2012-6665
Published: 2014-11-17
Description: Directory traversal vulnerability in index.php in phpMoneyBooks 1.0.4 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter, a different vulnerability than CVE-2012-1669. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.  NOTE: this issue might have been fixed in 1.0.3.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/80101; http://secunia.com/advisories/48389; http://osvdb.org/80101
CVE: CVE-2014-0059
Published: 2014-11-17
Description: JBoss SX and PicketBox, as used in Red Hat JBoss Enterprise Application Platform (EAP) before 6.2.3, use world-readable permissions on audit.log, which allows local users to obtain sensitive information by reading this file.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://rhn.redhat.com/errata/RHSA-2014-0563.html; http://rhn.redhat.com/errata/RHSA-2014-0564.html; http://rhn.redhat.com/errata/RHSA-2014-0565.html
CVE: CVE-2014-6095
Published: 2014-11-18
Description: Directory traversal vulnerability in IBM Security Identity Manager 6.x before 6.0.0.3 IF14 allows remote attackers to read arbitrary files via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/62363; http://www-01.ibm.com/support/docview.wss?uid=swg1IV66496; http://www-01.ibm.com/support/docview.wss?uid=swg1IV66624
CVE: CVE-2014-6096
Published: 2014-11-18
Description: Cross-site scripting (XSS) vulnerability in IBM Security Identity Manager 6.x before 6.0.0.3 IF14 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/62363; http://www-01.ibm.com/support/docview.wss?uid=swg1IV66496; http://www-01.ibm.com/support/docview.wss?uid=swg1IV66624
CVE: CVE-2014-6098
Published: 2014-11-18
Description: IBM Security Identity Manager 6.x before 6.0.0.3 IF14 allows remote attackers to discover cleartext passwords via a crafted request.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-255
References: http://secunia.com/advisories/62363; http://www-01.ibm.com/support/docview.wss?uid=swg1IV66496; http://www-01.ibm.com/support/docview.wss?uid=swg1IV66624
CVE: CVE-2014-6105
Published: 2014-11-18
Description: IBM Security Identity Manager 6.x before 6.0.0.3 IF14 allows remote attackers to conduct clickjacking attacks via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/62363; http://www-01.ibm.com/support/docview.wss?uid=swg1IV66496; http://www-01.ibm.com/support/docview.wss?uid=swg1IV66624
CVE: CVE-2014-6107
Published: 2014-11-18
Description: IBM Security Identity Manager 6.x before 6.0.0.3 IF14 allows remote attackers to obtain sensitive cookie information by sniffing the network during an HTTP session.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://secunia.com/advisories/62363; http://www-01.ibm.com/support/docview.wss?uid=swg1IV66496; http://www-01.ibm.com/support/docview.wss?uid=swg1IV66624
CVE: CVE-2014-6110
Published: 2014-11-18
Description: IBM Security Identity Manager 6.x before 6.0.0.3 IF14 does not properly perform logout actions, which allows remote attackers to access sessions by leveraging an unattended workstation.
CVSS Score: 2.1 (LOW)
CWE: CWE-284
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IV66496; http://www-01.ibm.com/support/docview.wss?uid=swg1IV66624; http://www-01.ibm.com/support/docview.wss?uid=swg1IV66635
CVE: CVE-2014-7992
Published: 2014-11-18
Description: The DLSw implementation in Cisco IOS does not initialize packet buffers, which allows remote attackers to obtain sensitive credential information from process memory via a session on TCP port 2067, aka Bug ID CSCur14014.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-7992; http://tools.cisco.com/security/center/viewAlert.x?alertId=36453; http://www.securityfocus.com/bid/71145
CVE: CVE-2014-4451
Published: 2014-11-18
Description: Apple iOS before 8.1.1 does not properly enforce the failed-passcode limit, which makes it easier for physically proximate attackers to bypass the lock-screen protection mechanism via a series of guesses.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce/2014/Nov/msg00000.html; http://secunia.com/advisories/62504; http://www.securityfocus.com/bid/71138
CVE: CVE-2014-4452
Published: 2014-11-18
Description: WebKit, as used in Apple iOS before 8.1.1 and Apple TV before 7.0.2, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2014-4462.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-399
References: http://lists.apple.com/archives/security-announce/2014/Dec/msg00000.html; http://lists.apple.com/archives/security-announce/2014/Nov/msg00000.html; http://lists.apple.com/archives/security-announce/2014/Nov/msg00002.html
CVE: CVE-2014-4453
Published: 2014-11-18
Description: Apple iOS before 8.1.1 and OS X before 10.10.1 include location data during establishment of a Spotlight Suggestions server connection by Spotlight or Safari, which might allow remote attackers to obtain sensitive information via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://lists.apple.com/archives/security-announce/2014/Nov/msg00000.html; http://lists.apple.com/archives/security-announce/2014/Nov/msg00001.html; http://secunia.com/advisories/62503
CVE: CVE-2014-4455
Published: 2014-11-18
Description: dyld in Apple iOS before 8.1.1 and Apple TV before 7.0.2 does not properly handle overlapping segments in Mach-O executable files, which allows local users to bypass intended code-signing restrictions via a crafted file.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce/2014/Nov/msg00000.html; http://lists.apple.com/archives/security-announce/2014/Nov/msg00002.html; http://lists.apple.com/archives/security-announce/2015/Jan/msg00000.html
CVE: CVE-2014-4457
Published: 2014-11-18
Description: The Sandbox Profiles subsystem in Apple iOS before 8.1.1 does not properly implement the debugserver sandbox, which allows attackers to bypass intended binary-execution restrictions via a crafted application that is run during a time period when debugging is not enabled.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce/2014/Nov/msg00000.html; http://www.securityfocus.com/bid/71143; http://www.securitytracker.com/id/1031232
CVE: CVE-2014-4458
Published: 2014-11-18
Description: The "System Profiler About This Mac" component in Apple OS X before 10.10.1 includes extraneous cookie data in system-model requests, which might allow remote attackers to obtain sensitive information via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://lists.apple.com/archives/security-announce/2014/Nov/msg00001.html; http://secunia.com/advisories/62503; http://www.securityfocus.com/bid/71139
CVE: CVE-2014-4459
Published: 2014-11-18
Description: Use-after-free vulnerability in WebKit, as used in Apple OS X before 10.10.1, allows remote attackers to execute arbitrary code via crafted page objects in an HTML document.
CVSS Score: 6.8 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2014/Dec/msg00000.html; http://lists.apple.com/archives/security-announce/2014/Nov/msg00001.html; http://lists.apple.com/archives/security-announce/2015/Jan/msg00000.html
CVE: CVE-2014-4460
Published: 2014-11-18
Description: CFNetwork in Apple iOS before 8.1.1 and OS X before 10.10.1 does not properly clear the browsing cache upon a transition out of private-browsing mode, which makes it easier for physically proximate attackers to obtain sensitive information by reading cache files.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://lists.apple.com/archives/security-announce/2014/Nov/msg00000.html; http://lists.apple.com/archives/security-announce/2014/Nov/msg00001.html; http://lists.apple.com/archives/security-announce/2015/Jan/msg00003.html
CVE: CVE-2014-4461
Published: 2014-11-18
Description: The kernel in Apple iOS before 8.1.1 and Apple TV before 7.0.2 does not properly validate IOSharedDataQueue object metadata, which allows attackers to execute arbitrary code in a privileged context via a crafted application.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://lists.apple.com/archives/security-announce/2014/Nov/msg00000.html; http://lists.apple.com/archives/security-announce/2014/Nov/msg00002.html; http://lists.apple.com/archives/security-announce/2015/Jan/msg00003.html
CVE: CVE-2014-4462
Published: 2014-11-18
Description: WebKit, as used in Apple iOS before 8.1.1 and Apple TV before 7.0.2, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2014-4452.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-399
References: http://lists.apple.com/archives/security-announce/2014/Nov/msg00000.html; http://lists.apple.com/archives/security-announce/2014/Nov/msg00002.html; http://secunia.com/advisories/62504
CVE: CVE-2014-4463
Published: 2014-11-18
Description: Apple iOS before 8.1.1 allows physically proximate attackers to bypass the lock-screen protection mechanism, and view or transmit a Photo Library photo, via the FaceTime "Leave a Message" feature.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce/2014/Nov/msg00000.html; http://secunia.com/advisories/62504; http://www.securityfocus.com/bid/71141
CVE: CVE-2014-3613
Published: 2014-11-18
Description: cURL and libcurl before 7.38.0 does not properly handle IP addresses in cookie domain names, which allows remote attackers to set cookies for or send arbitrary cookies to certain sites, as demonstrated by a site at 192.168.0.1 setting cookies for a site at 127.168.0.1.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://curl.haxx.se/docs/adv_20140910A.html; http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10743; http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html