deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-1326
Published: 2014-05-22
Description: WebKit, as used in Apple Safari before 6.1.4 and 7.x before 7.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-05-21-1.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2014-05/0128.html; http://archives.neohapsis.com/archives/bugtraq/2014-06/0174.html; http://archives.neohapsis.com/archives/bugtraq/2014-06/0175.html
CVE: CVE-2014-1327
Published: 2014-05-22
Description: WebKit, as used in Apple Safari before 6.1.4 and 7.x before 7.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-05-21-1.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2014-05/0128.html; http://archives.neohapsis.com/archives/bugtraq/2014-06/0174.html; http://archives.neohapsis.com/archives/bugtraq/2014-06/0175.html
CVE: CVE-2014-1329
Published: 2014-05-22
Description: WebKit, as used in Apple Safari before 6.1.4 and 7.x before 7.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-05-21-1.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2014-05/0128.html; http://archives.neohapsis.com/archives/bugtraq/2014-06/0174.html; http://archives.neohapsis.com/archives/bugtraq/2014-06/0175.html
CVE: CVE-2014-1330
Published: 2014-05-22
Description: WebKit, as used in Apple Safari before 6.1.4 and 7.x before 7.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-05-21-1.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2014-05/0128.html; http://archives.neohapsis.com/archives/bugtraq/2014-06/0174.html; http://archives.neohapsis.com/archives/bugtraq/2014-06/0175.html
CVE: CVE-2014-1331
Published: 2014-05-22
Description: WebKit, as used in Apple Safari before 6.1.4 and 7.x before 7.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-05-21-1.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2014-05/0128.html; http://archives.neohapsis.com/archives/bugtraq/2014-06/0174.html; http://archives.neohapsis.com/archives/bugtraq/2014-06/0175.html
CVE: CVE-2014-1333
Published: 2014-05-22
Description: WebKit, as used in Apple Safari before 6.1.4 and 7.x before 7.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-05-21-1.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2014-05/0128.html; http://archives.neohapsis.com/archives/bugtraq/2014-06/0174.html; http://archives.neohapsis.com/archives/bugtraq/2014-06/0175.html
CVE: CVE-2014-1334
Published: 2014-05-22
Description: WebKit, as used in Apple Safari before 6.1.4 and 7.x before 7.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-05-21-1.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2014-05/0128.html; http://archives.neohapsis.com/archives/bugtraq/2014-06/0174.html; http://archives.neohapsis.com/archives/bugtraq/2014-06/0175.html
CVE: CVE-2014-1335
Published: 2014-05-22
Description: WebKit, as used in Apple Safari before 6.1.4 and 7.x before 7.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-05-21-1.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2014-05/0128.html; http://archives.neohapsis.com/archives/bugtraq/2014-06/0174.html; http://archives.neohapsis.com/archives/bugtraq/2014-06/0175.html
CVE: CVE-2014-1336
Published: 2014-05-22
Description: WebKit, as used in Apple Safari before 6.1.4 and 7.x before 7.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-05-21-1.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2014-05/0128.html; http://archives.neohapsis.com/archives/bugtraq/2014-06/0174.html; http://archives.neohapsis.com/archives/bugtraq/2014-06/0175.html
CVE: CVE-2014-1337
Published: 2014-05-22
Description: WebKit, as used in Apple Safari before 6.1.4 and 7.x before 7.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-05-21-1.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2014-05/0128.html; http://archives.neohapsis.com/archives/bugtraq/2014-06/0174.html; http://archives.neohapsis.com/archives/bugtraq/2014-06/0175.html
CVE: CVE-2014-1338
Published: 2014-05-22
Description: WebKit, as used in Apple Safari before 6.1.4 and 7.x before 7.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-05-21-1.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2014-05/0128.html; http://archives.neohapsis.com/archives/bugtraq/2014-06/0174.html; http://archives.neohapsis.com/archives/bugtraq/2014-06/0175.html
CVE: CVE-2014-1339
Published: 2014-05-22
Description: WebKit, as used in Apple Safari before 6.1.4 and 7.x before 7.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-05-21-1.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2014-05/0128.html; http://archives.neohapsis.com/archives/bugtraq/2014-06/0174.html; http://archives.neohapsis.com/archives/bugtraq/2014-06/0175.html
CVE: CVE-2014-1341
Published: 2014-05-22
Description: WebKit, as used in Apple Safari before 6.1.4 and 7.x before 7.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-05-21-1.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2014-05/0128.html; http://archives.neohapsis.com/archives/bugtraq/2014-06/0174.html; http://archives.neohapsis.com/archives/bugtraq/2014-06/0175.html
CVE: CVE-2014-1342
Published: 2014-05-22
Description: WebKit, as used in Apple Safari before 6.1.4 and 7.x before 7.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-05-21-1.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2014-05/0128.html; http://archives.neohapsis.com/archives/bugtraq/2014-06/0174.html; http://archives.neohapsis.com/archives/bugtraq/2014-06/0175.html
CVE: CVE-2014-1343
Published: 2014-05-22
Description: WebKit, as used in Apple Safari before 6.1.4 and 7.x before 7.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-05-21-1.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2014-05/0128.html; http://archives.neohapsis.com/archives/bugtraq/2014-06/0174.html; http://archives.neohapsis.com/archives/bugtraq/2014-06/0175.html
CVE: CVE-2014-1344
Published: 2014-05-22
Description: WebKit, as used in Apple Safari before 6.1.4 and 7.x before 7.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-05-21-1.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2014-05/0128.html; http://support.apple.com/kb/HT6254; http://www.securityfocus.com/bid/67553
CVE: CVE-2014-1346
Published: 2014-05-22
Description: WebKit, as used in Apple Safari before 6.1.4 and 7.x before 7.0.4, does not properly interpret Unicode encoding, which allows remote attackers to spoof a postMessage origin, and bypass intended restrictions on sending a message to a connected frame or window, via crafted characters in a URL.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://archives.neohapsis.com/archives/bugtraq/2014-05/0128.html; http://archives.neohapsis.com/archives/bugtraq/2014-06/0174.html; http://support.apple.com/kb/HT6254
CVE: CVE-2014-3831
Published: 2014-05-22
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not a security issue.  Notes: none
CVE: CVE-2014-2349
Published: 2014-05-22
Description: Emerson DeltaV 10.3.1, 11.3, 11.3.1, and 12.3 uses hardcoded credentials for diagnostic services, which allows remote attackers to bypass intended access restrictions via a TCP session, as demonstrated by a session that uses the telnet program.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-285, CWE-264
References: https://www.cisa.gov/news-events/ics-advisories/icsa-14-133-02; http://ics-cert.us-cert.gov/advisories/ICSA-14-133-02
CVE: CVE-2014-2350
Published: 2014-05-22
Description: Emerson DeltaV 10.3.1, 11.3, 11.3.1, and 12.3 uses hardcoded credentials for diagnostic services, which allows remote attackers to bypass intended access restrictions via a TCP session, as demonstrated by a session that uses the telnet program.
CVSS Score: 2.4 (LOW)
CWE: CWE-798, CWE-255
References: https://www.cisa.gov/news-events/ics-advisories/icsa-14-133-02; http://ics-cert.us-cert.gov/advisories/ICSA-14-133-02
CVE: CVE-2014-2938
Published: 2014-05-22
Description: Hanvon FaceID before 1.007.110 does not require authentication, which allows remote attackers to modify access-control and attendance-tracking data via API commands.
CVSS Score: 8.3 (HIGH)
CWE: CWE-287
References: http://www.kb.cert.org/vuls/id/767044; http://www.kb.cert.org/vuls/id/767044
CVE: CVE-2014-2947
Published: 2014-05-22
Description: Cross-site scripting (XSS) vulnerability in Login.aspx in Bizagi BPM Suite before 10.3 allows remote attackers to inject arbitrary web script or HTML via the txtUsername parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.kb.cert.org/vuls/id/112412; http://www.securityfocus.com/bid/67591; http://www.kb.cert.org/vuls/id/112412
CVE: CVE-2014-2948
Published: 2014-05-22
Description: SQL injection vulnerability in workflowenginesoa.asmx in Bizagi BPM Suite through 10.4 allows remote authenticated users to execute arbitrary SQL commands via a crafted SOAP request.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://www.kb.cert.org/vuls/id/112412; http://www.kb.cert.org/vuls/id/112412
CVE: CVE-2012-0943
Published: 2014-05-22
Description: debian/guest-account in Light Display Manager (lightdm) 1.0.x before 1.0.6 and 1.1.x before 1.1.7, as used in Ubuntu Linux 11.10, allows local users to delete arbitrary files via a space in the name of a file in /tmp.  NOTE: this identifier was SPLIT per ADT1/ADT2 due to different codebases and affected versions. CVE-2012-6648 has been assigned for the gdm-guest-session issue.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://www.ubuntu.com/usn/USN-1399-2; https://bugs.launchpad.net/ubuntu/%2Bsource/lightdm/%2Bbug/953044; https://launchpadlibrarian.net/96471251/lightdm.secure-cleanup.debdiff
CVE: CVE-2012-6648
Published: 2014-05-22
Description: gdm/guest-session-cleanup.sh in gdm-guest-session 0.24 and earlier, as used in Ubuntu Linux 10.04 LTS, 10.10, and 11.04, allows local users to delete arbitrary files via a space in the name of a file in /tmp. NOTE: this identifier was SPLIT from CVE-2012-0943 per ADT1/ADT2 due to different codebases and affected versions. CVE-2012-0943 is used for the guest-account issue.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://ubuntu.com/usn/usn-1399-1; https://bugs.launchpad.net/ubuntu/%2Bsource/lightdm/%2Bbug/953044; https://launchpadlibrarian.net/96474113/gdm-guest-session.secure-cleanup.debdiff
CVE: CVE-2014-3788
Published: 2014-05-22
Description: Heap-based buffer overflow in the Web Server in Cogent Real-Time Systems Cogent DataHub before 7.3.5 allows remote attackers to execute arbitrary code via a negative value in the Content-Length field in a request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://cogentdatahub.com/ReleaseNotes.html; http://www.zerodayinitiative.com/advisories/ZDI-14-135/; http://cogentdatahub.com/ReleaseNotes.html
CVE: CVE-2014-3789
Published: 2014-05-22
Description: GetPermissions.asp in Cogent Real-Time Systems Cogent DataHub before 7.3.5 allows remote attackers to execute arbitrary commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://cogentdatahub.com/ReleaseNotes.html; http://www.securityfocus.com/bid/67486; http://www.zerodayinitiative.com/advisories/ZDI-14-136/
CVE: CVE-2010-5299
Published: 2014-05-23
Description: Stack-based buffer overflow in MicroP 0.1.1.1600 allows remote attackers to execute arbitrary code via a crafted .mppl file.  NOTE: it has been reported that the overflow is in the lpFileName parameter of the CreateFileA function, but the overflow is probably caused by a separate, unnamed function.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://osvdb.org/show/osvdb/73627; http://packetstormsecurity.com/files/125723/MicroP-0.1.1.1600-Buffer-Overflow.html; http://www.exploit-db.com/exploits/14720
CVE: CVE-2013-2107
Published: 2014-05-23
Description: Cross-site request forgery (CSRF) vulnerability in the Mail On Update plugin before 5.2.0 for WordPress allows remote attackers to hijack the authentication of administrators for requests that change the "List of alternative recipients" via the mailonupdate_mailto parameter in the mail-on-update page to wp-admin/options-general.php.  NOTE: a third party claims that 5.2.1 and 5.2.2 are also vulnerable, but the issue might require a separate CVE identifier since this might reflect an incomplete fix.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://osvdb.org/93452; http://seclists.org/oss-sec/2013/q2/356; http://secunia.com/advisories/53449
CVE: CVE-2012-5649
Published: 2014-05-23
Description: Apache CouchDB before 1.0.4, 1.1.x before 1.1.2, and 1.2.x before 1.2.1 allows remote attackers to execute arbitrary code via a JSONP callback, related to Adobe Flash.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://archives.neohapsis.com/archives/bugtraq/2013-01/0057.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-February/098089.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-February/098092.html
CVE: CVE-2013-0289
Published: 2014-05-23
Description: Isync 0.4 before 1.0.6, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-310
References: http://lists.fedoraproject.org/pipermail/package-announce/2013-March/099544.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-March/099547.html; http://secunia.com/advisories/55190
CVE: CVE-2013-1668
Published: 2014-05-23
Description: The uploadFile function in upload/index.php in CosCMS before 1.822 allows remote administrators to execute arbitrary commands via shell metacharacters in the name of an uploaded file.
CVSS Score: 8.5 (HIGH)
CWE: CWE-78
References: http://archives.neohapsis.com/archives/bugtraq/2013-03/0033.html; http://osvdb.org/90927; http://www.coscms.org/blog/view/4/Version-1.822
CVE: CVE-2013-1864
Published: 2014-05-23
Description: The Portable Tool Library (aka PTLib) before 2.10.10, as used in Ekiga before 4.0.1, does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted PXML document containing a large number of nested entity references, aka a "billion laughs attack."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://lists.fedoraproject.org/pipermail/package-announce/2013-March/099553.html; http://osvdb.org/91439; http://seclists.org/oss-sec/2013/q1/674
CVE: CVE-2013-2712
Published: 2014-05-23
Description: Cross-site scripting (XSS) vulnerability in services/get_article.php in KrisonAV CMS before 3.0.2 allows remote attackers to inject arbitrary web script or HTML via the content parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2013-04/0184.html; http://www.exploit-db.com/exploits/24965; http://www.krisonav.com/index.php?module=articles_show&articles_id=release-notes
CVE: CVE-2013-2713
Published: 2014-05-23
Description: Cross-site request forgery (CSRF) vulnerability in users_maint.html in KrisonAV CMS before 3.0.2 allows remote attackers to hijack the authentication of administrators for requests that create user accounts via a crafted request.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://archives.neohapsis.com/archives/bugtraq/2013-04/0184.html; http://www.exploit-db.com/exploits/24965; http://www.krisonav.com/index.php?module=articles_show&articles_id=release-notes
CVE: CVE-2013-2756
Published: 2014-05-23
Description: Apache CloudStack 4.0.0 before 4.0.2 and Citrix CloudPlatform (formerly Citrix CloudStack) 3.0.x before 3.0.6 Patch C allows remote attackers to bypass the console proxy authentication by leveraging knowledge of the source code.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-287
References: http://mail-archives.apache.org/mod_mbox/cloudstack-dev/201304.mbox/%3C5[PII_REDACTED]300%40stratosec.co%3E; http://osvdb.org/92748; http://secunia.com/advisories/53175
CVE: CVE-2013-2757
Published: 2014-05-23
Description: Citrix CloudPlatform (formerly Citrix CloudStack) 3.0.x before 3.0.6 Patch C does not properly restrict access to VNC ports on the management network, which allows remote attackers to have unspecified impact via unknown vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://osvdb.org/92746; http://secunia.com/advisories/53204; http://support.citrix.com/article/CTX135815
CVE: CVE-2013-2758
Published: 2014-05-23
Description: Apache CloudStack 4.0.0 before 4.0.2 and Citrix CloudPlatform (formerly Citrix CloudStack) 3.0.x before 3.0.6 Patch C uses a hash of a predictable sequence, which makes it easier for remote attackers to guess the console access URL via a brute force attack.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://mail-archives.apache.org/mod_mbox/cloudstack-dev/201304.mbox/%3C5[PII_REDACTED]300%40stratosec.co%3E; http://osvdb.org/92749; http://secunia.com/advisories/53175
CVE: CVE-2013-4223
Published: 2014-05-23
Description: The Gentoo Nullmailer package before 1.11-r2 uses world-readable permissions for /etc/nullmailer/remotes, which allows local users to obtain SMTP authentication credentials by reading the file.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/96177; http://seclists.org/oss-sec/2013/q3/337; http://seclists.org/oss-sec/2013/q3/339
CVE: CVE-2014-3442
Published: 2014-05-23
Description: Winamp 5.666 and earlier allows remote attackers to cause a denial of service (memory corruption and crash) via a malformed .FLV file, related to f263.w5s.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://packetstormsecurity.com/files/126636; http://www.securityfocus.com/bid/67429; https://exchange.xforce.ibmcloud.com/vulnerabilities/93173
CVE: CVE-2014-3450
Published: 2014-05-23
Description: Unspecified vulnerability in Panda Gold Protection and Global Protection 2014 7.01.01 and earlier, Internet Security 2014 19.01.01 and earlier, and AV Pro 2014 13.01.01 and earlier allows local users to gain privileges via unspecified vectors.
CVSS Score: 7.2 (HIGH)
References: http://seclists.org/fulldisclosure/2014/May/89; http://www.securityfocus.com/archive/1/532163/100/0/threaded; http://www.securityfocus.com/bid/67527
CVE: CVE-2014-3801
Published: 2014-05-23
Description: OpenStack Orchestration API (Heat) 2013.2 through 2013.2.3 and 2014.1, when creating the stack for a template using a provider template, allows remote authenticated users to obtain the provider template URL via the resource-type-list.
CVSS Score: 3.5 (LOW)
CWE: CWE-200
References: http://rhn.redhat.com/errata/RHSA-2014-1687.html; http://www.openwall.com/lists/oss-security/2014/05/20/1; http://www.openwall.com/lists/oss-security/2014/05/20/6
CVE: CVE-2014-3848
Published: 2014-05-23
Description: The iMember360 plugin before 3.9.001 for WordPress does not properly restrict access, which allows remote attackers to obtain database credentials via the i4w_dbinfo parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://packetstormsecurity.com/files/126324/WordPress-iMember360is-3.9.001-XSS-Disclosure-Code-Execution.html; http://releases.imember360.com/; http://seclists.org/fulldisclosure/2014/Apr/265
CVE: CVE-2014-3849
Published: 2014-05-23
Description: The iMember360 plugin 3.8.012 through 3.9.001 for WordPress does not properly restrict access, which allows remote attackers to delete arbitrary users via a request containing a user name in the Email parameter and the API key in the i4w_clearuser parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://packetstormsecurity.com/files/126324/WordPress-iMember360is-3.9.001-XSS-Disclosure-Code-Execution.html; http://seclists.org/fulldisclosure/2014/Apr/265; http://www.exploit-db.com/exploits/33076
CVE: CVE-2014-0639
Published: 2014-05-25
Description: Multiple cross-site scripting (XSS) vulnerabilities in EMC RSA Archer 5.x before GRC 5.4 SP1 P3 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2014-05/0134.html; http://packetstormsecurity.com/files/126788/RSA-Archer-GRC-Cross-Site-Scripting.html; http://www.securityfocus.com/bid/67602
CVE: CVE-2014-0943
Published: 2014-05-25
Description: IBM WebSphere Commerce 6.0 Feature Pack 2 through Feature Pack 5, 7.0.0.0 through 7.0.0.8, and 7.0 Feature Pack 1 through Feature Pack 7 allows remote attackers to cause a denial of service (resource consumption and daemon crash) via a malformed id parameter in a request.
CVSS Score: 7.1 (HIGH)
CWE: CWE-20
References: http://www-01.ibm.com/support/docview.wss?uid=swg1JR49881; http://www-01.ibm.com/support/docview.wss?uid=swg1JR49996; http://www-01.ibm.com/support/docview.wss?uid=swg21671377