deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-3620
Published: 2014-11-18
Description: cURL and libcurl before 7.38.0 allow remote attackers to bypass the Same Origin Policy and set cookies for arbitrary sites by setting a cookie for a top-level domain.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://curl.haxx.se/docs/adv_20140910B.html; http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10743; http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html
CVE: CVE-2014-7146
Published: 2014-11-18
Description: The XmlImportExport plugin in MantisBT 1.2.17 and earlier allows remote attackers to execute arbitrary PHP code via a crafted (1) description field or (2) issuelink attribute in an XML file, which is not properly handled when executing the preg_replace function with the e modifier.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://seclists.org/oss-sec/2014/q4/576; http://secunia.com/advisories/62101; http://www.debian.org/security/2015/dsa-3120
CVE: CVE-2014-7824
Published: 2014-11-18
Description: D-Bus 1.3.0 through 1.6.x before 1.6.26, 1.8.x before 1.8.10, and 1.9.x before 1.9.2 allows local users to cause a denial of service (prevention of new connections and connection drop) by queuing the maximum number of file descriptors.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-3636.1.
CVSS Score: 2.1 (LOW)
CWE: CWE-399
References: http://advisories.mageia.org/MGASA-2014-0457.html; http://secunia.com/advisories/62603; http://www.debian.org/security/2014/dsa-3099
CVE: CVE-2014-8475
Published: 2014-11-18
Description: FreeBSD 9.1, 9.2, and 10.0, when compiling OpenSSH with Kerberos support, uses incorrect library ordering when linking sshd, which causes symbols to be resolved incorrectly and allows remote attackers to cause a denial of service (sshd deadlock and prevention of new connections) by ending multiple connections before authentication is completed.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-17
References: http://packetstormsecurity.com/files/128972/FreeBSD-Security-Advisory-sshd-Denial-Of-Service.html; http://secunia.com/advisories/61440; http://www.securityfocus.com/bid/70913
CVE: CVE-2014-8598
Published: 2014-11-18
Description: The XML Import/Export plugin in MantisBT 1.2.x does not restrict access, which allows remote attackers to (1) upload arbitrary XML files via the import page or (2) obtain sensitive information via the export page.  NOTE: this issue can be combined with CVE-2014-7146 to execute arbitrary PHP code.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-19
References: http://secunia.com/advisories/62101; http://www.debian.org/security/2015/dsa-3120; http://www.mantisbt.org/bugs/view.php?id=17780
CVE: CVE-2014-4817
Published: 2014-11-18
Description: The server in IBM Tivoli Storage Manager (TSM) 5.x and 6.x before 6.3.5.10 and 7.x before 7.1.1.100 allows remote attackers to bypass intended access restrictions and replace file backups by using a certain backup option in conjunction with a filename that matches a previously used filename.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IT04884; http://www-01.ibm.com/support/docview.wss?uid=swg21686874; https://exchange.xforce.ibmcloud.com/vulnerabilities/95444
CVE: CVE-2014-6324
Published: 2014-11-18
Description: The Kerberos Key Distribution Center (KDC) in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote authenticated domain users to obtain domain administrator privileges via a forged signature in a ticket, as exploited in the wild in November 2014, aka "Kerberos Checksum Vulnerability."
CVSS Score: 8.8 (HIGH)
References: http://blogs.technet.com/b/srd/archive/2014/11/18/additional-information-about-cve-2014-6324.aspx; http://marc.info/?l=bugtraq&m=[PII_REDACTED]5918&w=2; http://secunia.com/advisories/62556
CVE: CVE-2014-7829
Published: 2014-11-18
Description: Directory traversal vulnerability in actionpack/lib/action_dispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.21, 4.0.x before 4.0.12, 4.1.x before 4.1.8, and 4.2.x before 4.2.0.beta4, when serve_static_assets is enabled, allows remote attackers to determine the existence of files outside the application root via vectors involving a \ (backslash) character, a similar issue to CVE-2014-7818.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://lists.opensuse.org/opensuse-updates/2014-11/msg00112.html; http://www.securityfocus.com/bid/71183; https://groups.google.com/forum/message/raw?msg=rubyonrails-security/rMTQy4oRCGk/loS_CRS8mNEJ
CVE: CVE-2014-7996
Published: 2014-11-18
Description: Cross-site request forgery (CSRF) vulnerability in the web framework in Cisco Integrated Management Controller in Cisco Unified Computing System allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuq45477.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://secunia.com/advisories/62565; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-7996; http://tools.cisco.com/security/center/viewAlert.x?alertId=36456
CVE: CVE-2013-3678
Published: 2014-11-19
Description: Multiple unspecified vulnerabilities in SAP Governance, Risk, and Compliance (GRC) allow remote authenticated users to gain privileges and execute arbitrary programs via a crafted (1) RFC or (2) SOAP-RFC request.
CVSS Score: 9.0 (HIGH)
References: http://packetstormsecurity.com/files/129083/SAP-GRC-Bypass-Privilege-Escalation-Program-Execution.html; http://seclists.org/fulldisclosure/2014/Nov/25; http://www.esnc.de/security-advisories/security-vulnerability-in-sap-grc-access-control
CVE: CVE-2014-7899
Published: 2014-11-19
Description: Google Chrome before 38.0.2125.101 allows remote attackers to spoof the address bar by placing a blob: substring at the beginning of the URL, followed by the original URI scheme and a long username string.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://googlechromereleases.blogspot.com/2014/11/stable-channel-update_18.html; http://rhn.redhat.com/errata/RHSA-2014-1894.html; http://secunia.com/advisories/60194
CVE: CVE-2014-7900
Published: 2014-11-19
Description: Use-after-free vulnerability in the CPDF_Parser::IsLinearizedFile function in fpdfapi/fpdf_parser/fpdf_parser_parser.cpp in PDFium, as used in Google Chrome before 39.0.2171.65, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted PDF document.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://googlechromereleases.blogspot.com/2014/11/stable-channel-update_18.html; http://www.securityfocus.com/bid/71163; http://www.securitytracker.com/id/1031241
CVE: CVE-2014-7901
Published: 2014-11-19
Description: Integer overflow in the opj_t2_read_packet_data function in fxcodec/fx_libopenjpeg/libopenjpeg20/t2.c in OpenJPEG in PDFium, as used in Google Chrome before 39.0.2171.65, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a long segment in a JPEG image.
CVSS Score: 7.5 (HIGH)
CWE: CWE-189
References: http://googlechromereleases.blogspot.com/2014/11/stable-channel-update_18.html; http://www.securityfocus.com/bid/71158; http://www.securitytracker.com/id/1031241
CVE: CVE-2014-7902
Published: 2014-11-19
Description: Use-after-free vulnerability in PDFium, as used in Google Chrome before 39.0.2171.65, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted PDF document.
CVSS Score: 7.5 (HIGH)
CWE: CWE-17
References: http://googlechromereleases.blogspot.com/2014/11/stable-channel-update_18.html; http://www.securityfocus.com/bid/71165; http://www.securitytracker.com/id/1031241
CVE: CVE-2014-7903
Published: 2014-11-19
Description: Buffer overflow in OpenJPEG before r2911 in PDFium, as used in Google Chrome before 39.0.2171.65, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted JPEG image.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://googlechromereleases.blogspot.com/2014/11/stable-channel-update_18.html; http://www.securityfocus.com/bid/71164; http://www.securitytracker.com/id/1031241
CVE: CVE-2014-7904
Published: 2014-11-19
Description: Buffer overflow in Skia, as used in Google Chrome before 39.0.2171.65, allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://googlechromereleases.blogspot.com/2014/11/stable-channel-update_18.html; http://rhn.redhat.com/errata/RHSA-2014-1894.html; http://secunia.com/advisories/60194
CVE: CVE-2014-7905
Published: 2014-11-19
Description: Google Chrome before 39.0.2171.65 on Android does not prevent navigation to a URL in cases where an intent for the URL lacks CATEGORY_BROWSABLE, which allows remote attackers to bypass intended access restrictions via a crafted web site.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-284
References: http://googlechromereleases.blogspot.com/2014/11/stable-channel-update_18.html; http://www.securityfocus.com/bid/71162; http://www.securitytracker.com/id/1031241
CVE: CVE-2014-7906
Published: 2014-11-19
Description: Use-after-free vulnerability in the Pepper plugins in Google Chrome before 39.0.2171.65 allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted Flash content that triggers an attempted PepperMediaDeviceManager access outside of the object's lifetime.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://googlechromereleases.blogspot.com/2014/11/stable-channel-update_18.html; http://rhn.redhat.com/errata/RHSA-2014-1894.html; http://secunia.com/advisories/60194
CVE: CVE-2014-7907
Published: 2014-11-19
Description: Multiple use-after-free vulnerabilities in modules/screen_orientation/ScreenOrientationController.cpp in Blink, as used in Google Chrome before 39.0.2171.65, allow remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger improper handling of a detached frame, related to the (1) lock and (2) unlock methods.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://googlechromereleases.blogspot.com/2014/11/stable-channel-update_18.html; http://rhn.redhat.com/errata/RHSA-2014-1894.html; http://secunia.com/advisories/60194
CVE: CVE-2014-7908
Published: 2014-11-19
Description: Multiple integer overflows in the CheckMov function in media/base/container_names.cc in Google Chrome before 39.0.2171.65 allow remote attackers to cause a denial of service or possibly have unspecified other impact via a large atom in (1) MPEG-4 or (2) QuickTime .mov data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-189
References: http://googlechromereleases.blogspot.com/2014/11/stable-channel-update_18.html; http://rhn.redhat.com/errata/RHSA-2014-1894.html; http://secunia.com/advisories/60194
CVE: CVE-2014-7909
Published: 2014-11-19
Description: effects/SkDashPathEffect.cpp in Skia, as used in Google Chrome before 39.0.2171.65, computes a hash key using uninitialized integer values, which might allow remote attackers to cause a denial of service by rendering crafted data.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://googlechromereleases.blogspot.com/2014/11/stable-channel-update_18.html; http://rhn.redhat.com/errata/RHSA-2014-1894.html; http://secunia.com/advisories/60194
CVE: CVE-2014-7910
Published: 2014-11-19
Description: Multiple unspecified vulnerabilities in Google Chrome before 39.0.2171.65 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://googlechromereleases.blogspot.com/2014/11/stable-channel-update_18.html; http://rhn.redhat.com/errata/RHSA-2014-1894.html; http://secunia.com/advisories/60194
CVE: CVE-2014-7290
Published: 2014-11-19
Description: Multiple cross-site scripting (XSS) vulnerabilities in Atlas Systems Aeon 3.5 and 3.6 allow remote attackers to inject arbitrary web script or HTML via the (1) Action or (2) Form parameter to aeon.dll.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/129114/Atlas-Systems-Aeon-3.5-3.6-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2014/Nov/32; http://tetraph.com/security/xss-vulnerability/cve-2014-7290-atlas-systems-aeon-xss-cross-site-scripting-vulnerability/
CVE: CVE-2014-8629
Published: 2014-11-19
Description: Cross-site scripting (XSS) vulnerability in the Page visualization agents in Pandora FMS 5.1 SP1 and earlier allows remote attackers to inject arbitrary web script or HTML via the refr parameter to index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://blog.pandorafms.org/?p=3271; http://packetstormsecurity.com/files/129112/Pandora-FMS-5.1SP1-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2014/Nov/35
CVE: CVE-2014-5342
Published: 2014-11-19
Description: Aruba Networks ClearPass before 6.3.5 and 6.4.x before 6.4.1 allows remote attackers to execute arbitrary commands via unspecified vectors, a different vulnerability than CVE-2014-6627.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/61916; http://www.arubanetworks.com/support/alerts/aid-10282014.txt; http://secunia.com/advisories/61916
CVE: CVE-2014-6621
Published: 2014-11-19
Description: Aruba Networks ClearPass before 6.3.6 and 6.4.x before 6.4.1 does not disable the troubleshooting and diagnostics page in production systems, which allows remote attackers to obtain version numbers, module configuration, and other sensitive information by reading the page.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://secunia.com/advisories/61916; http://www.arubanetworks.com/support/alerts/aid-10282014.txt; http://secunia.com/advisories/61916
CVE: CVE-2014-6622
Published: 2014-11-19
Description: Aruba Networks ClearPass before 6.3.6 and 6.4.x before 6.4.1 allows remote attackers to determine the validity of filenames via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://secunia.com/advisories/61916; http://www.arubanetworks.com/support/alerts/aid-10282014.txt; http://secunia.com/advisories/61916
CVE: CVE-2014-6624
Published: 2014-11-19
Description: The Insight module in Aruba Networks ClearPass before 6.3.6 and 6.4.x before 6.4.1 allows remote authenticated users to read arbitrary files via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-200
References: http://secunia.com/advisories/61916; http://www.arubanetworks.com/support/alerts/aid-10282014.txt; http://www.securityfocus.com/bid/71215
CVE: CVE-2014-6625
Published: 2014-11-19
Description: The Policy Manager in Aruba Networks ClearPass before 6.3.6 and 6.4.x before 6.4.1 allows remote authenticated users to gain privileges via unspecified vectors.
CVSS Score: 9.0 (HIGH)
CWE: CWE-284
References: http://secunia.com/advisories/61916; http://www.arubanetworks.com/support/alerts/aid-10282014.txt; http://secunia.com/advisories/61916
CVE: CVE-2014-6626
Published: 2014-11-19
Description: Aruba Networks ClearPass before 6.3.6 and 6.4.x before 6.4.1 does not properly restrict access to unspecified administrative functions, which allows remote attackers to bypass authentication and execute administrative actions via unknown vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-284
References: http://secunia.com/advisories/61916; http://www.arubanetworks.com/support/alerts/aid-10282014.txt; http://secunia.com/advisories/61916
CVE: CVE-2014-6627
Published: 2014-11-19
Description: Aruba Networks ClearPass before 6.3.5 and 6.4.x before 6.4.1 allows remote attackers to execute arbitrary commands via unspecified vectors, a different vulnerability than CVE-2014-5342.
CVSS Score: 9.0 (HIGH)
CWE: CWE-284
References: http://secunia.com/advisories/61916; http://www.arubanetworks.com/support/alerts/aid-10282014.txt; http://secunia.com/advisories/61916
CVE: CVE-2014-7828
Published: 2014-11-19
Description: FreeIPA 4.0.x before 4.0.5 and 4.1.x before 4.1.1, when 2FA is enabled, allows remote attackers to bypass the password requirement of the two-factor authentication leveraging an enabled OTP token, which triggers an anonymous bind.
CVSS Score: 3.5 (LOW)
CWE: CWE-264
References: http://lists.fedoraproject.org/pipermail/package-announce/2014-November/143000.html; http://www.freeipa.org/page/Releases/4.1.1; http://www.securityfocus.com/bid/70932
CVE: CVE-2014-8594
Published: 2014-11-19
Description: The do_mmu_update function in arch/x86/mm.c in Xen 4.x through 4.4.x does not properly restrict updates to only PV page tables, which allows remote PV guests to cause a denial of service (NULL pointer dereference) by leveraging hardware emulation services for HVM guests using Hardware Assisted Paging (HAP).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00010.html; http://secunia.com/advisories/62672
CVE: CVE-2014-8595
Published: 2014-11-19
Description: arch/x86/x86_emulate/x86_emulate.c in Xen 3.2.1 through 4.4.x does not properly check privileges, which allows local HVM guest users to gain privileges or cause a denial of service (crash) via a crafted (1) CALL, (2) JMP, (3) RETF, (4) LCALL, (5) LJMP, or (6) LRET far branch instruction.
CVSS Score: 1.9 (LOW)
CWE: CWE-17
References: http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00010.html; http://secunia.com/advisories/62537
CVE: CVE-2014-2382
Published: 2014-11-20
Description: The DfDiskLo.sys driver in Faronics Deep Freeze Standard and Enterprise 8.10 and earlier allows local administrators to cause a denial of service (crash) and execute arbitrary code via a crafted IOCTL request that writes to arbitrary memory locations, related to the IofCallDriver function.
CVSS Score: 7.2 (HIGH)
CWE: CWE-399
References: http://packetstormsecurity.com/files/129172/Faronics-Deep-Freeze-Arbitrary-Code-Execution.html; http://seclists.org/fulldisclosure/2014/Nov/52; https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-2382/
CVE: CVE-2014-8387
Published: 2014-11-20
Description: cgi/utility.cgi in Advantech EKI-6340 2.05 Wi-Fi Mesh Access Point allows remote authenticated users to execute arbitrary commands via shell metacharacters in the pinghost parameter to ping.cgi.
CVSS Score: 9.0 (HIGH)
CWE: CWE-78
References: http://seclists.org/fulldisclosure/2014/Nov/58; http://www.coresecurity.com/advisories/advantech-eki-6340-command-injection; http://www.securityfocus.com/archive/1/534021/100/0/threaded
CVE: CVE-2014-8995
Published: 2014-11-20
Description: SQL injection vulnerability in Maarch LetterBox 2.8 allows remote attackers to execute arbitrary SQL commands via the UserId cookie.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-89
References: http://packetstormsecurity.com/files/129135/Maarch-LetterBox-2.8-Insecure-Cookie-Handling.html; http://www.osvdb.org/114772; https://exchange.xforce.ibmcloud.com/vulnerabilities/98775
CVE: CVE-2014-8996
Published: 2014-11-20
Description: Multiple cross-site scripting (XSS) vulnerabilities in Nibbleblog before 4.0.2 allow remote attackers to inject arbitrary web script or HTML via the (1) author_name or (2) content parameter to index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://blog.nibbleblog.com/post/nibbleblog-v4.0.2-coffee/; http://packetstormsecurity.com/files/129133/Nibbleblog-4.0.1-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2014/Nov/38
CVE: CVE-2014-8997
Published: 2014-11-20
Description: Unrestricted file upload vulnerability in the Photo functionality in DigitalVidhya Digi Online Examination System 2.0 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in assets/uploads/images/.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://packetstormsecurity.com/files/129108/Digi-Online-Examination-System-2.0-Shell-Upload.html; http://www.exploit-db.com/exploits/35223; https://exchange.xforce.ibmcloud.com/vulnerabilities/98662
CVE: CVE-2014-8998
Published: 2014-11-20
Description: lib/message.php in X7 Chat 2.0.0 through 2.0.5.1 allows remote authenticated users to execute arbitrary PHP code via a crafted HTTP header to index.php, which is processed by the preg_replace function with the eval switch.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-94
References: http://packetstormsecurity.com/files/128964/X7-Chat-2.0.5-lib-message.php-preg_replace-PHP-Code-Execution.html; http://www.exploit-db.com/exploits/35183; http://www.securityfocus.com/bid/71014
CVE: CVE-2014-8999
Published: 2014-11-20
Description: SQL injection vulnerability in htdocs/modules/system/admin.php in XOOPS before 2.5.7 Final allows remote authenticated users to execute arbitrary SQL commands via the selgroups parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://packetstormsecurity.com/files/129134/XOOPS-2.5.6-SQL-Injection.html; http://seclists.org/fulldisclosure/2014/Nov/39; http://www.securityfocus.com/bid/71117
CVE: CVE-2014-9000
Published: 2014-11-20
Description: Mule Enterprise Management Console (MMC) does not properly restrict access to handler/securityService.rpc, which allows remote authenticated users to gain administrator privileges and execute arbitrary code via a crafted request that adds a new user.  NOTE: this issue was originally reported for ESB Runtime 3.5.1, but it originates in MMC.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://packetstormsecurity.com/files/128799; http://seclists.org/fulldisclosure/2014/Oct/107; http://seclists.org/fulldisclosure/2014/Oct/98
CVE: CVE-2014-9001
Published: 2014-11-20
Description: reminders/index.php in Incredible PBX 11 2.0.6.5.0 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the (1) APPTMIN, (2) APPTHR, (3) APPTDA, (4) APPTMO, (5) APPTYR, or (6) APPTPHONE parameters.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-94
References: http://seclists.org/fulldisclosure/2014/Oct/101; http://seclists.org/fulldisclosure/2014/Oct/101
CVE: CVE-2014-9002
Published: 2014-11-20
Description: Lantronix xPrintServer does not properly restrict access to ips/, which allows remote attackers to execute arbitrary commands via the c parameter in an rpc action.
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://i.imgur.com/gjbZhXZ.png; http://packetstormsecurity.com/files/129091/Lantronix-xPrintServer-Remote-Command-Execution-CSRF.html; http://seclists.org/fulldisclosure/2014/Nov/24
CVE: CVE-2014-9003
Published: 2014-11-20
Description: Cross-site request forgery (CSRF) vulnerability in Lantronix xPrintServer allows remote attackers to hijack the authentication of administrators for requests that modify configuration, as demonstrated by executing arbitrary commands using the c parameter in the rpc action.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.com/files/129091/Lantronix-xPrintServer-Remote-Command-Execution-CSRF.html; http://seclists.org/fulldisclosure/2014/Nov/24; https://exchange.xforce.ibmcloud.com/vulnerabilities/98645
CVE: CVE-2014-9004
Published: 2014-11-20
Description: Cross-site scripting (XSS) vulnerability in vldPersonals before 2.7.1 allows remote attackers to inject arbitrary web script or HTML via the id parameter in a member_profile action to index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.exploit-db.com/exploits/35193; https://exchange.xforce.ibmcloud.com/vulnerabilities/98742; http://www.exploit-db.com/exploits/35193
CVE: CVE-2014-9005
Published: 2014-11-20
Description: Multiple SQL injection vulnerabilities in vldPersonals before 2.7.1 allow remote attackers to execute arbitrary SQL commands via the (1) country, (2) gender1, or ((3) gender2 parameter in a search action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/35193; https://exchange.xforce.ibmcloud.com/vulnerabilities/98746; http://www.exploit-db.com/exploits/35193