deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-9006
Published: 2014-11-20
Description: Monstra 3.0.1 and earlier uses a cookie to track how many login attempts have been attempted, which allows remote attackers to conduct brute force login attacks by deleting the login_attempts cookie or setting it to certain values.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-255
References: http://packetstormsecurity.com/files/129082/Monstra-3.0.1-Bruteforce-Mitigation-Bypass.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/98649; http://packetstormsecurity.com/files/129082/Monstra-3.0.1-Bruteforce-Mitigation-Bypass.html
CVE: CVE-2014-3625
Published: 2014-11-20
Description: Directory traversal vulnerability in Pivotal Spring Framework 3.0.4 through 3.2.x before 3.2.12, 4.0.x before 4.0.8, and 4.1.x before 4.1.2 allows remote attackers to read arbitrary files via unspecified vectors, related to static resource handling.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://rhn.redhat.com/errata/RHSA-2015-0236.html; http://rhn.redhat.com/errata/RHSA-2015-0720.html; http://www.pivotal.io/security/cve-2014-3625
CVE: CVE-2014-8493
Published: 2014-11-20
Description: ZTE ZXHN H108L with firmware 4.0.0d_ZRQ_GR4 allows remote attackers to modify the CWMP configuration via a crafted request to Forms/access_cwmp_1.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://packetstormsecurity.com/files/129139/ZTE-ZXHN-H108L-Access-Bypass.html; http://seclists.org/fulldisclosure/2014/Nov/46; http://www.exploit-db.com/exploits/35272
CVE: CVE-2014-8767
Published: 2014-11-20
Description: Integer underflow in the olsr_print function in tcpdump 3.9.6 through 4.6.2, when in verbose mode, allows remote attackers to cause a denial of service (crash) via a crafted length value in an OLSR frame.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://advisories.mageia.org/MGASA-2014-0503.html; http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html; http://lists.opensuse.org/opensuse-updates/2015-02/msg00062.html
CVE: CVE-2014-8768
Published: 2014-11-20
Description: Multiple Integer underflows in the geonet_print function in tcpdump 4.5.0 through 4.6.2, when in verbose mode, allow remote attackers to cause a denial of service (segmentation fault and crash) via a crafted length value in a Geonet frame.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-191
References: http://lists.opensuse.org/opensuse-updates/2015-02/msg00062.html; http://packetstormsecurity.com/files/129156/tcpdump-4.6.2-Geonet-Denial-Of-Service.html; http://seclists.org/fulldisclosure/2014/Nov/48
CVE: CVE-2014-8769
Published: 2014-11-20
Description: tcpdump 3.8 through 4.6.2 might allow remote attackers to obtain sensitive information from memory or cause a denial of service (packet loss or segmentation fault) via a crafted Ad hoc On-Demand Distance Vector (AODV) packet, which triggers an out-of-bounds memory access.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-119
References: http://advisories.mageia.org/MGASA-2014-0503.html; http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html; http://lists.opensuse.org/opensuse-updates/2015-02/msg00062.html
CVE: CVE-2014-9019
Published: 2014-11-20
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in ZTE ZXDSL 831CII allow remote attackers to hijack the authentication of administrators for requests that (1) change the admin user name or (2) conduct cross-site scripting (XSS) attacks via the sysUserName parameter in a save action to adminpasswd.cgi or (3) change the admin user password via the sysPassword parameter in a save action to adminpasswd.cgi.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.com/files/129016/ZTE-831CII-Hardcoded-Credential-XSS-CSRF.html; http://www.securityfocus.com/archive/1/533930/100/0/threaded; http://www.securityfocus.com/bid/70984
CVE: CVE-2014-9020
Published: 2014-11-20
Description: Cross-site scripting (XSS) vulnerability in the Quick Stats page (psilan.cgi) in ZTE ZXDSL 831 and 831CII allows remote attackers to inject arbitrary web script or HTML via the domainname parameter in a save action.  NOTE: this issue was SPLIT from CVE-2014-9021 per ADT1 due to different affected products and codebases.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/129016/ZTE-831CII-Hardcoded-Credential-XSS-CSRF.html; http://packetstormsecurity.com/files/129017/ZTE-ZXDSL-831-Cross-Site-Scripting.html; http://www.securityfocus.com/archive/1/533930/100/0/threaded
CVE: CVE-2014-9021
Published: 2014-11-20
Description: Multiple cross-site scripting (XSS) vulnerabilities in ZTE ZXDSL 831 allow remote attackers to inject arbitrary web script or HTML via the (1) tr69cAcsURL, (2) tr69cAcsUser, (3) tr69cAcsPwd, (4) tr69cConnReqPwd, or (5) tr69cDebugEnable parameter to the TR-069 client page (tr69cfg.cgi); the (6) timezone parameter to the Time and date page (sntpcfg.sntp); or the (7) hostname parameter in a save action to the Quick Stats page (psilan.cgi).  NOTE: this issue was SPLIT from CVE-2014-9020 per ADT1 due to different affected products and codebases.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/129017/ZTE-ZXDSL-831-Cross-Site-Scripting.html; http://www.securityfocus.com/archive/1/533931/100/0/threaded; http://www.securityfocus.com/bid/70985
CVE: CVE-2014-9022
Published: 2014-11-20
Description: The Webform Component Roles module 6.x-1.x before 6.x-1.8 and 7.x-1.x before 7.x-1.8 for Drupal allows remote attackers to bypass the "disabled" restriction and modify read-only components via a crafted form.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-264
References: https://www.drupal.org/node/2373471; https://www.drupal.org/node/2373473; https://www.drupal.org/node/2373973
CVE: CVE-2014-9023
Published: 2014-11-20
Description: The Twilio module 7.x-1.x before 7.x-1.9 for Drupal does not properly restrict access to the Twilio administration pages, which allows remote authenticated users to read and modify authentication tokens by leveraging the "access administration pages" Drupal permission.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-264
References: https://www.drupal.org/node/2337623; https://www.drupal.org/node/2344363; https://www.drupal.org/node/2337623
CVE: CVE-2014-9024
Published: 2014-11-20
Description: The Protected Pages module 7.x-2.x before 7.x-2.4 for Drupal allows remote attackers to bypass the password protection via a crafted path.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: https://www.drupal.org/node/2353451; https://www.drupal.org/node/2378279; https://www.drupal.org/node/2353451
CVE: CVE-2014-9025
Published: 2014-11-20
Description: The default checkout completion rule in the commerce_order module in the Drupal Commerce module 7.x-1.x before 7.x-1.10 for Drupal uses the email address as the username for new accounts created at checkout, which allows remote attackers to obtain sensitive information via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: https://www.drupal.org/node/2336327; https://www.drupal.org/node/2336357; https://www.drupal.org/node/2336327
CVE: CVE-2014-9026
Published: 2014-11-20
Description: The Ubercart module 7.x-3.x before 7.x-3.7 for Drupal does not properly protect the per-user order history view, which allows remote authenticated users with the "view own orders" permission to obtain sensitive information via unspecified vectors.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: https://www.drupal.org/node/2336109; https://www.drupal.org/node/2336259; https://www.drupal.org/node/2336109
CVE: CVE-2014-9027
Published: 2014-11-20
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in ZTE ZXDSL 831CII allow remote attackers to hijack the authentication of administrators for requests that disable modem lan ports via the (1) enblftp, (2) enblhttp, (3) enblsnmp, (4) enbltelnet, (5) enbltftp, (6) enblicmp, or (7) enblssh parameter to accesslocal.cmd.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.com/files/129041; https://exchange.xforce.ibmcloud.com/vulnerabilities/98590; http://packetstormsecurity.com/files/129041
CVE: CVE-2014-7194
Published: 2014-11-21
Description: TIBCO Managed File Transfer Internet Server before 7.2.4, Managed File Transfer Command Center before 7.2.4, Slingshot before 1.9.3, and Vault before 1.1.1 allow remote attackers to obtain sensitive information or modify data by leveraging agent access.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-264
References: http://www.tibco.com/assets/blt7454ec3ae638d8c4/mft-advisory-20141029-008.txt; http://www.tibco.com/mk/advisory.jsp; http://www.tibco.com/assets/blt7454ec3ae638d8c4/mft-advisory-20141029-008.txt
CVE: CVE-2014-7195
Published: 2014-11-21
Description: Spotfire Web Player Engine in TIBCO Spotfire Web Player 6.0.x before 6.0.2 and 6.5.x before 6.5.2, Spotfire Deployment Kit 6.0.x before 6.0.2 and 6.5.x before 6.5.2, and Silver Fabric Enabler for Spotfire Web Player before 1.6.1 allows remote authenticated users to obtain sensitive information via unspecified vectors.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://www.tibco.com/assets/blta5b5c969aff51474/2014-009-spotfire-advisory.txt; http://www.tibco.com/mk/advisory.jsp; http://www.tibco.com/assets/blta5b5c969aff51474/2014-009-spotfire-advisory.txt
CVE: CVE-2014-8000
Published: 2014-11-21
Description: Cisco Unified Communications Manager IM and Presence Service 9.1(1) produces different returned messages for URL requests depending on whether a username exists, which allows remote attackers to enumerate user accounts via a series of requests, aka Bug ID CSCur63497.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/62558; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-8000; http://tools.cisco.com/security/center/viewAlert.x?alertId=36467
CVE: CVE-2014-8388
Published: 2014-11-21
Description: Stack-based buffer overflow in Advantech WebAccess, formerly BroadWin WebAccess, before 8.0 allows remote attackers to execute arbitrary code via a crafted ip_address parameter in an HTML document.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: https://ics-cert.us-cert.gov/advisories/ICSA-14-324-01; https://ics-cert.us-cert.gov/advisories/ICSA-14-324-01
CVE: CVE-2014-5395
Published: 2014-11-21
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in Huawei HiLink E3276 and E3236 TCPU before V200R002B470D13SP00C00 and WebUI before V100R007B100D03SP01C03, E5180s-22 before 21.270.21.00.00, and E586Bs-2 before 21.322.10.00.889 allow remote attackers to hijack the authentication of users for requests that (1) modify configurations, (2) send SMS messages, or have other unspecified impact via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-360246.htm; http://www.securityfocus.com/bid/69162; https://www.exploit-db.com/exploits/46092/
CVE: CVE-2014-7137
Published: 2014-11-21
Description: Multiple SQL injection vulnerabilities in Dolibarr ERP/CRM before 3.6.1 allow remote authenticated users to execute arbitrary SQL commands via the (1) contactid parameter in an addcontact action, (2) ligne parameter in a swapstatut action, or (3) project_ref parameter to projet/tasks/contact.php; (4) lineid parameter in a deletecontact action, (5) ligne parameter in a swapstatut action, or (6) ref parameter to projet/contact.php; (7) id parameter to compta/bank/fiche.php, (8) contact/info.php, (9) holiday/index.php, (10) product/stock/fiche.php, (11) product/stock/info.php, or (12) in an edit action to product/stock/fiche.php; (13) productid parameter in an addline action to product/stock/massstockmove.php; (14) project_ref parameter to projet/tasks/note.php; (15) ref parameter to element.php, (16) ganttview.php, (17) note.php, or (18) tasks.php in projet/; (19) sall or (20) sref parameter to comm/mailing/liste.php; (21) search_bon, (22) search_ligne, (23) search_societe, or (24) search_code parameter to compta/prelevement/liste.php; (25) search_label parameter to compta/sociales/index.php; (26) search_project parameter to projet/tasks/index.php; (27) search_societe parameter to compta/prelevement/demandes.php; (28) search_statut parameter to user/index.php; (29) socid parameter to compta/recap-compta.php, (30) societe/commerciaux.php, or (31) societe/rib.php; (32) sortorder, (33) sref, (34) sall, or (35) sortfield parameter to product/stock/liste.php; (36) statut parameter to adherents/liste.php or (37) compta/dons/liste.php; (38) tobuy or (39) tosell parameter to product/liste.php; (40) tobuy, (41) tosell, (42) search_categ, or (43) sref parameter to product/reassort.php; (44) type parameter to product/index.php; or the (a) sortorder or (b) sortfield parameter to (45) compta/paiement/cheque/liste.php, (46) compta/prelevement/bons.php, (47) compta/prelevement/rejets.php, (48) product/stats/commande.php, (49) product/stats/commande_fournisseur.php, (50) product/stats/contrat.php, (51) product/stats/facture.php, (52) product/stats/facture_fournisseur.php, (53) product/stats/propal.php, or (54) product/stock/replenishorders.php.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://packetstormsecurity.com/files/129175/Dolibarr-ERP-And-CRM-3.5.3-SQL-Injection.html; http://seclists.org/fulldisclosure/2014/Nov/56; http://www.securityfocus.com/archive/1/534020/100/0/threaded
CVE: CVE-2014-7871
Published: 2014-11-21
Description: SQL injection vulnerability in Open-Xchange (OX) AppSuite before 7.4.2-rev36 and 7.6.x before 7.6.0-rev23 allows remote authenticated users to execute arbitrary SQL commands via a crafted jslob API call.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://packetstormsecurity.com/files/129020/OX-App-Suite-7.6.0-SQL-Injection.html; http://www.securityfocus.com/archive/1/533936/100/0/threaded; http://www.securityfocus.com/bid/70982
CVE: CVE-2014-8090
Published: 2014-11-21
Description: The REXML parser in Ruby 1.9.x before 1.9.3 patchlevel 551, 2.0.x before 2.0.0 patchlevel 598, and 2.1.x before 2.1.5 allows remote attackers to cause a denial of service (CPU and memory consumption) a crafted XML document containing an empty string in an entity that is used in a large number of nested entity references, aka an XML Entity Expansion (XEE) attack.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-1821 and CVE-2014-8080.
CVSS Score: 5.0 (MEDIUM)
References: http://advisories.mageia.org/MGASA-2014-0472.html; http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html; http://lists.opensuse.org/opensuse-updates/2014-12/msg00035.html
CVE: CVE-2014-8469
Published: 2014-11-21
Description: Cross-site scripting (XSS) vulnerability in Guests/Boots in AdminCP in Moxi9 PHPFox before 4 Beta allows remote attackers to inject arbitrary web script or HTML via the User-Agent header.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/129153/PHPFox-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2014/Nov/50; http://www.exploit-db.com/exploits/35274
CVE: CVE-2014-8539
Published: 2014-11-21
Description: Cross-site scripting (XSS) vulnerability in Simple Email Form 1.8.5 and earlier allows remote attackers to inject arbitrary web script or HTML via the mod_simpleemailform_field2_1 parameter to index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/129171/Joomla-Simple-Email-Form-1.8.5-Cross-Site-Scripting.html; http://www.securityfocus.com/archive/1/534017/100/0/threaded; http://www.securityfocus.com/bid/71131
CVE: CVE-2014-8681
Published: 2014-11-21
Description: SQL injection vulnerability in the GetIssues function in models/issue.go in Gogs (aka Go Git Service) 0.3.1-9 through 0.5.6.x before 0.5.6.1025 Beta allows remote attackers to execute arbitrary SQL commands via the label parameter to user/repos/issues.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://gogs.io/docs/intro/change_log.html; http://packetstormsecurity.com/files/129116/Gogs-Label-Search-Blind-SQL-Injection.html; http://seclists.org/fulldisclosure/2014/Nov/31
CVE: CVE-2014-8682
Published: 2014-11-21
Description: Multiple SQL injection vulnerabilities in Gogs (aka Go Git Service) 0.3.1-9 through 0.5.x before 0.5.6.1105 Beta allow remote attackers to execute arbitrary SQL commands via the q parameter to (1) api/v1/repos/search, which is not properly handled in models/repo.go, or (2) api/v1/users/search, which is not properly handled in models/user.go.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://gogs.io/docs/intro/change_log.html; http://packetstormsecurity.com/files/129117/Gogs-Repository-Search-SQL-Injection.html; http://seclists.org/fulldisclosure/2014/Nov/33
CVE: CVE-2014-8683
Published: 2014-11-21
Description: Cross-site scripting (XSS) vulnerability in models/issue.go in Gogs (aka Go Git Service) 0.3.1-9 through 0.5.x before 0.5.8 allows remote attackers to inject arbitrary web script or HTML via the text parameter to api/v1/markdown.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://gogs.io/docs/intro/change_log.html; http://packetstormsecurity.com/files/129118/Gogs-Markdown-Renderer-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2014/Nov/34
CVE: CVE-2014-4807
Published: 2014-11-23
Description: Sterling Order Management in IBM Sterling Selling and Fulfillment Suite 9.3.0 before FP8 allows remote authenticated users to cause a denial of service (CPU consumption) via a '\0' character.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-399
References: http://secunia.com/advisories/59549; http://www-01.ibm.com/support/docview.wss?uid=swg21690662; https://exchange.xforce.ibmcloud.com/vulnerabilities/95355
CVE: CVE-2014-6183
Published: 2014-11-23
Description: IBM Security Network Protection 5.1 before 5.1.0.0 FP13, 5.1.1 before 5.1.1.0 FP8, 5.1.2 before 5.1.2.0 FP9, 5.1.2.1 before FP5, 5.2 before 5.2.0.0 FP5, and 5.3 before 5.3.0.0 FP1 on XGS devices allows remote authenticated users to execute arbitrary commands via unspecified vectors.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-399
References: http://www-01.ibm.com/support/docview.wss?uid=swg21690823; https://exchange.xforce.ibmcloud.com/vulnerabilities/98519; http://www-01.ibm.com/support/docview.wss?uid=swg21690823
CVE: CVE-2014-8626
Published: 2014-11-23
Description: Stack-based buffer overflow in the date_from_ISO8601 function in ext/xmlrpc/libxmlrpc/xmlrpc.c in PHP before 5.2.7 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code by including a timezone field in a date, leading to improper XML-RPC encoding.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=c818d0d01341907fee82bdb81cab07b7d93bb9db; http://openwall.com/lists/oss-security/2014/11/06/3; http://php.net/ChangeLog-5.php
CVE: CVE-2014-8710
Published: 2014-11-23
Description: The decompress_sigcomp_message function in epan/sigcomp-udvm.c in the SigComp UDVM dissector in Wireshark 1.10.x before 1.10.11 allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted packet.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://lists.fedoraproject.org/pipermail/package-announce/2014-December/145658.html; http://lists.opensuse.org/opensuse-updates/2014-11/msg00104.html; http://rhn.redhat.com/errata/RHSA-2015-1460.html
CVE: CVE-2014-8711
Published: 2014-11-23
Description: Multiple integer overflows in epan/dissectors/packet-amqp.c in the AMQP dissector in Wireshark 1.10.x before 1.10.11 and 1.12.x before 1.12.2 allow remote attackers to cause a denial of service (application crash) via a crafted amqp_0_10 PDU in a packet.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://lists.fedoraproject.org/pipermail/package-announce/2014-December/145658.html; http://lists.opensuse.org/opensuse-updates/2014-11/msg00104.html; http://rhn.redhat.com/errata/RHSA-2015-1460.html
CVE: CVE-2014-8712
Published: 2014-11-23
Description: The build_expert_data function in epan/dissectors/packet-ncp2222.inc in the NCP dissector in Wireshark 1.10.x before 1.10.11 and 1.12.x before 1.12.2 does not properly initialize a data structure, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://lists.fedoraproject.org/pipermail/package-announce/2014-December/145658.html; http://lists.opensuse.org/opensuse-updates/2014-11/msg00104.html; http://rhn.redhat.com/errata/RHSA-2015-1460.html
CVE: CVE-2014-8713
Published: 2014-11-23
Description: Stack-based buffer overflow in the build_expert_data function in epan/dissectors/packet-ncp2222.inc in the NCP dissector in Wireshark 1.10.x before 1.10.11 and 1.12.x before 1.12.2 allows remote attackers to cause a denial of service (application crash) via a crafted packet.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://lists.fedoraproject.org/pipermail/package-announce/2014-December/145658.html; http://lists.opensuse.org/opensuse-updates/2014-11/msg00104.html; http://rhn.redhat.com/errata/RHSA-2015-1460.html
CVE: CVE-2014-8714
Published: 2014-11-23
Description: The dissect_write_structured_field function in epan/dissectors/packet-tn5250.c in the TN5250 dissector in Wireshark 1.10.x before 1.10.11 and 1.12.x before 1.12.2 allows remote attackers to cause a denial of service (infinite loop) via a crafted packet.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://lists.fedoraproject.org/pipermail/package-announce/2014-December/145658.html; http://lists.opensuse.org/opensuse-updates/2014-11/msg00104.html; http://rhn.redhat.com/errata/RHSA-2015-1460.html
CVE: CVE-2014-6477
Published: 2014-11-23
Description: Unspecified vulnerability in the JPublisher component in Oracle Database Server 11.1.0.7, 11.2.0.3, 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote authenticated users to affect confidentiality via unknown vectors, a different vulnerability than CVE-2014-4290, CVE-2014-4291, CVE-2014-4292, CVE-2014-4293, CVE-2014-4296, CVE-2014-4297, CVE-2014-4310, and CVE-2014-6547.  NOTE: this issue was originally mapped to CVE-2014-4301, but CVE-2014-4301 is for an unrelated vulnerability.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-200
References: http://www.oracle.com/technetwork/topics/security/cpuoct2[PII_REDACTED].html; https://exchange.xforce.ibmcloud.com/vulnerabilities/99937; http://www.oracle.com/technetwork/topics/security/cpuoct2[PII_REDACTED].html
CVE: CVE-2014-5314
Published: 2014-11-24
Description: Buffer overflow in Cybozu Office 9 and 10 before 10.1.0, Mailwise 4 and 5 before 5.1.4, and Dezie 8 before 8.1.1 allows remote authenticated users to execute arbitrary code via e-mail messages.
CVSS Score: 9.0 (HIGH)
CWE: CWE-119
References: http://jvn.jp/en/jp/JVN14691234/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2014-000130; http://secunia.com/advisories/62248
CVE: CVE-2014-5325
Published: 2014-11-24
Description: The (1) DOMConverter, (2) JDOMConverter, (3) DOM4JConverter, and (4) XOMConverter functions in Direct Web Remoting (DWR) through 2.0.10 and 3.x through 3.0.RC2 allow remote attackers to read arbitrary files via DOM data containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://jvn.jp/en/jp/JVN91502163/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2014-000117; http://www.securityfocus.com/bid/71093
CVE: CVE-2014-5326
Published: 2014-11-24
Description: Cross-site scripting (XSS) vulnerability in Direct Web Remoting (DWR) through 2.0.10 and 3.x through 3.0.RC2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN52422792/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2014-000118; http://jvn.jp/en/jp/JVN52422792/index.html