deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-2453
Published: 2014-04-16
Description: Unspecified vulnerability in the Hyperion Common Admin component in Oracle Hyperion 11.1.2.2 and 11.1.2.3 allows remote attackers to affect integrity via unknown vectors related to User Interface.
CVSS Score: 4.3 (MEDIUM)
References: http://www.oracle.com/technetwork/topics/security/cpuapr2[PII_REDACTED].html; http://www.oracle.com/technetwork/topics/security/cpuapr2[PII_REDACTED].html
CVE: CVE-2014-2454
Published: 2014-04-16
Description: Unspecified vulnerability in the Hyperion Common Admin component in Oracle Hyperion 11.1.2.2 and 11.1.2.3 allows remote attackers to affect confidentiality via unknown vectors related to User Interface.
CVSS Score: 4.3 (MEDIUM)
References: http://www.oracle.com/technetwork/topics/security/cpuapr2[PII_REDACTED].html; http://www.oracle.com/technetwork/topics/security/cpuapr2[PII_REDACTED].html
CVE: CVE-2014-2455
Published: 2014-04-16
Description: Unspecified vulnerability in the Hyperion Common Admin component in Oracle Hyperion 11.1.2.2 and 11.1.2.3 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors related to User Interface.
CVSS Score: 6.0 (MEDIUM)
References: http://www.oracle.com/technetwork/topics/security/cpuapr2[PII_REDACTED].html; http://www.oracle.com/technetwork/topics/security/cpuapr2[PII_REDACTED].html
CVE: CVE-2014-2457
Published: 2014-04-16
Description: Unspecified vulnerability in the Oracle Agile Product Lifecycle component in Oracle Supply Chain Products Suite 6.0 and 6.1.0 allows remote attackers to affect integrity via unknown vectors related to Install.
CVSS Score: 4.3 (MEDIUM)
References: http://www.oracle.com/technetwork/topics/security/cpuapr2[PII_REDACTED].html; http://www.oracle.com/technetwork/topics/security/cpuapr2[PII_REDACTED].html
CVE: CVE-2014-2458
Published: 2014-04-16
Description: Unspecified vulnerability in the Oracle Agile Product Lifecycle component in Oracle Supply Chain Products Suite 6.1.0.3 and 6.1.1.3 allows remote attackers to affect integrity via unknown vectors related to Install.
CVSS Score: 4.3 (MEDIUM)
References: http://www.oracle.com/technetwork/topics/security/cpuapr2[PII_REDACTED].html; http://www.oracle.com/technetwork/topics/security/cpuapr2[PII_REDACTED].html
CVE: CVE-2014-2459
Published: 2014-04-16
Description: Unspecified vulnerability in the Oracle Transportation Management component in Oracle Supply Chain Products Suite 6.3.2 and 6.3.3 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Security.
CVSS Score: 3.7 (LOW)
References: http://www.oracle.com/technetwork/topics/security/cpuapr2[PII_REDACTED].html; http://www.oracle.com/technetwork/topics/security/cpuapr2[PII_REDACTED].html
CVE: CVE-2014-2460
Published: 2014-04-16
Description: Unspecified vulnerability in the Oracle Transportation Management component in Oracle Supply Chain Products Suite 5.5.06, 6.0, 6.1, 6.2, 6.3, 6.3.1, 6.3.2, and 6.3.3 allows remote authenticated users to affect confidentiality via vectors related to CSV Management.
CVSS Score: 4.0 (MEDIUM)
References: http://www.oracle.com/technetwork/topics/security/cpuapr2[PII_REDACTED].html; http://www.oracle.com/technetwork/topics/security/cpuapr2[PII_REDACTED].html
CVE: CVE-2014-2461
Published: 2014-04-16
Description: Unspecified vulnerability in the Oracle Transportation Management component in Oracle Supply Chain Products Suite 5.5.06, 6.0, 6.1, 6.2, 6.3, 6.3.1, 6.3.2, and 6.3.3 allows remote attackers to affect confidentiality via unknown vectors related to Security.
CVSS Score: 5.0 (MEDIUM)
References: http://www.oracle.com/technetwork/topics/security/cpuapr2[PII_REDACTED].html; http://www.oracle.com/technetwork/topics/security/cpuapr2[PII_REDACTED].html
CVE: CVE-2014-2463
Published: 2014-04-16
Description: Unspecified vulnerability in the Oracle Secure Global Desktop (SGD) component in Oracle Virtualization 4.63, 4.71, 5.0, and 5.1 allows remote attackers to affect integrity via unknown vectors related to Workspace Web Application, a different vulnerability than CVE-2014-4232.
CVSS Score: 4.3 (MEDIUM)
References: http://www.oracle.com/technetwork/topics/security/cpuapr2[PII_REDACTED].html; http://www.oracle.com/technetwork/topics/security/cpuapr2[PII_REDACTED].html
CVE: CVE-2014-2464
Published: 2014-04-16
Description: Unspecified vulnerability in the Oracle Agile PLM Framework component in Oracle Supply Chain Products Suite 9.3.3.0 allows remote authenticated users to affect confidentiality via unknown vectors related to Security.
CVSS Score: 3.5 (LOW)
References: http://www.oracle.com/technetwork/topics/security/cpuapr2[PII_REDACTED].html; http://www.oracle.com/technetwork/topics/security/cpuapr2[PII_REDACTED].html
CVE: CVE-2014-2465
Published: 2014-04-16
Description: Unspecified vulnerability in the Oracle Agile PLM Framework component in Oracle Supply Chain Products Suite 9.3.3 allows remote attackers to affect integrity via unknown vectors related to Security.
CVSS Score: 4.3 (MEDIUM)
References: http://www.oracle.com/technetwork/topics/security/cpuapr2[PII_REDACTED].html; http://www.oracle.com/technetwork/topics/security/cpuapr2[PII_REDACTED].html
CVE: CVE-2014-2466
Published: 2014-04-16
Description: Unspecified vulnerability in the Oracle Agile PLM Framework component in Oracle Supply Chain Products Suite 9.3.3 allows remote authenticated users to affect confidentiality via unknown vectors related to Security.
CVSS Score: 2.1 (LOW)
References: http://www.oracle.com/technetwork/topics/security/cpuapr2[PII_REDACTED].html; http://www.oracle.com/technetwork/topics/security/cpuapr2[PII_REDACTED].html
CVE: CVE-2014-2467
Published: 2014-04-16
Description: Unspecified vulnerability in the Oracle Agile PLM Framework component in Oracle Supply Chain Products Suite 9.3.3 allows remote authenticated users to affect integrity via unknown vectors related to Security, a different vulnerability than CVE-2014-2445.
CVSS Score: 3.5 (LOW)
References: http://www.oracle.com/technetwork/topics/security/cpuapr2[PII_REDACTED].html; http://www.oracle.com/technetwork/topics/security/cpuapr2[PII_REDACTED].html
CVE: CVE-2014-2468
Published: 2014-04-16
Description: Unspecified vulnerability in the Siebel UI Framework component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect integrity via vectors related to Open_UI, a different vulnerability than CVE-2014-4230.
CVSS Score: 4.3 (MEDIUM)
References: http://www.oracle.com/technetwork/topics/security/cpuapr2[PII_REDACTED].html; http://www.oracle.com/technetwork/topics/security/cpuapr2[PII_REDACTED].html
CVE: CVE-2014-2470
Published: 2014-04-16
Description: Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.0.2.0, 10.3.6.0, 12.1.1.0, and 12.1.2.0 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to WLS Security.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/59847; http://www.ibm.com/support/docview.wss?uid=swg21680702; http://www.ibm.com/support/docview.wss?uid=swg24038065
CVE: CVE-2014-2471
Published: 2014-04-16
Description: Unspecified vulnerability in the Oracle iLearning component in Oracle iLearning 6.0 and 6.1 allows remote attackers to affect integrity via unknown vectors related to Learner Pages.
CVSS Score: 4.3 (MEDIUM)
References: http://www.oracle.com/technetwork/topics/security/cpuapr2[PII_REDACTED].html; http://www.oracle.com/technetwork/topics/security/cpuapr2[PII_REDACTED].html
CVE: CVE-2011-0460
Published: 2014-04-16
Description: The init script in kbd, possibly 1.14.1 and earlier, allows local users to overwrite arbitrary files via a symlink attack on /dev/shm/defkeymap.map.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-59
References: http://lists.opensuse.org/opensuse-updates/2011-04/msg00053.html; https://bugzilla.novell.com/show_bug.cgi?id=663898; http://lists.opensuse.org/opensuse-updates/2011-04/msg00053.html
CVE: CVE-2011-0993
Published: 2014-04-16
Description: SUSE Lifecycle Management Server before 1.1 uses world readable postgres credentials, which allows local users to obtain sensitive information via unspecified vectors.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2011-04/msg00005.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/95697; http://lists.opensuse.org/opensuse-security-announce/2011-04/msg00005.html
CVE: CVE-2011-3180
Published: 2014-04-16
Description: kiwi before 4.98.08, as used in SUSE Studio Onsite 1.2 before 1.2.1 and SUSE Studio Extension for System z 1.2 before 1.2.1, allows attackers to execute arbitrary commands via shell metacharacters in the path of an overlay file, related to chown.
CVSS Score: 7.5 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2011-12/msg00015.html; http://www.openwall.com/lists/oss-security/2011/11/02/4; https://github.com/openSUSE/kiwi/commit/f0f74b3f6ac6d47f7919aa9db380c0ad41ffe55f#
CVE: CVE-2011-4089
Published: 2014-04-16
Description: The bzexe command in bzip2 1.0.5 and earlier generates compressed executables that do not properly handle temporary files during extraction, which allows local users to execute arbitrary code by precreating a temporary directory.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-264
References: http://seclists.org/fulldisclosure/2011/Oct/804; http://www.exploit-db.com/exploits/18147; http://www.openwall.com/lists/oss-security/2011/10/28/16
CVE: CVE-2011-4192
Published: 2014-04-16
Description: kiwi before 4.85.1, as used in SUSE Studio Onsite 1.2 before 1.2.1 and SUSE Studio Extension for System z 1.2 before 1.2.1, allows attackers to execute arbitrary commands as demonstrated by "double quotes in kiwi_oemtitle of .profile."
CVSS Score: 7.5 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2011-12/msg00015.html; http://lists.opensuse.org/opensuse-security-announce/2011-12/msg00015.html
CVE: CVE-2011-4193
Published: 2014-04-16
Description: Cross-site scripting (XSS) vulnerability in the overlay files tab in SUSE Studio Onsite 1.2 before 1.2.1 and SUSE Studio Extension for System z 1.2 before 1.2.1 allows remote attackers to inject arbitrary web script or HTML via a crafted application, related to cloning.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-security-announce/2011-12/msg00015.html; http://lists.opensuse.org/opensuse-security-announce/2011-12/msg00015.html
CVE: CVE-2011-4195
Published: 2014-04-16
Description: kiwi before 4.98.05, as used in SUSE Studio Onsite 1.2 before 1.2.1 and SUSE Studio Extension for System z 1.2 before 1.2.1, allows attackers to execute arbitrary commands via shell metacharacters in an image name.
CVSS Score: 7.5 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2011-12/msg00015.html; http://www.openwall.com/lists/oss-security/2011/11/02/4; https://github.com/openSUSE/kiwi/commit/88bf491d[PII_REDACTED]c606e4210b4e072c1019f
CVE: CVE-2011-4406
Published: 2014-04-16
Description: The Ubuntu AccountsService package before 0.6.14-1git1ubuntu1.1 does not properly drop privileges when changing language settings, which allows local users to modify arbitrary files via unspecified vectors.
CVSS Score: 3.6 (LOW)
CWE: CWE-264
References: http://bazaar.launchpad.net/~ubuntu-branches/ubuntu/oneiric/accountsservice/oneiric-updates/revision/21; http://people.canonical.com/~ubuntu-security/cve/2011/CVE-2011-4406.html; http://www.ubuntu.com/usn/USN-1351-1
CVE: CVE-2013-1764
Published: 2014-04-16
Description: The Zypper (aka zypp) backend in PackageKit before 0.8.8 allows local users to downgrade packages via the "install updates" method.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-updates/2013-06/msg00026.html; http://www.openwall.com/lists/oss-security/2013/02/25/20; https://bugs.freedesktop.org/show_bug.cgi?id=61231
CVE: CVE-2014-1453
Published: 2014-04-16
Description: The NFS server (nfsserver) in FreeBSD 8.3 through 10.0 does not acquire locks in the proper order when converting a directory file handle to a vnode, which allows remote authenticated users to cause a denial of service (deadlock) via vectors involving a thread that uses the correct locking order.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-399
References: http://secunia.com/advisories/57760; http://secunia.com/advisories/59034; http://www.debian.org/security/2014/dsa-2952
CVE: CVE-2014-2338
Published: 2014-04-16
Description: IKEv2 in strongSwan 4.0.7 before 5.1.3 allows remote attackers to bypass authentication by rekeying an IKE_SA during (1) initiation or (2) re-authentication, which triggers the IKE_SA state to be set to established.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-287
References: http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00010.html; http://lists.opensuse.org/opensuse-updates/2014-05/msg00064.html; http://lists.opensuse.org/opensuse-updates/2014-05/msg00066.html
CVE: CVE-2013-4694
Published: 2014-04-16
Description: Stack-based buffer overflow in gen_jumpex.dll in Winamp before 5.64 Build 3418 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a package with a long Skin directory name.  NOTE: a second buffer overflow involving a long GUI Search field to ml_local.dll was also reported. However, since it is only exploitable by the user of the application, this issue would not cross privilege boundaries unless Winamp is running under a highly restricted environment such as a kiosk.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://forums.winamp.com/showthread.php?t=364291; http://osvdb.org/94739; http://osvdb.org/94740
CVE: CVE-2014-0644
Published: 2014-04-17
Description: EMC Cloud Tiering Appliance (CTA) 10 through SP1 allows remote attackers to read arbitrary files via an api/login request containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, as demonstrated by reading the /etc/shadow file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-200
References: http://archives.neohapsis.com/archives/bugtraq/2014-04/0094.html; http://seclists.org/fulldisclosure/2014/Mar/426; https://gist.github.com/brandonprry/9895721
CVE: CVE-2014-0645
Published: 2014-04-17
Description: EMC Cloud Tiering Appliance (CTA) 9.x through 10 SP1 and File Management Appliance (FMA) 7.x store DES password hashes for the root, super, and admin accounts, which makes it easier for context-dependent attackers to obtain sensitive information via a brute-force attack.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-255
References: http://archives.neohapsis.com/archives/bugtraq/2014-04/0094.html; http://seclists.org/fulldisclosure/2014/Mar/426; https://gist.github.com/brandonprry/9895721
CVE: CVE-2011-3154
Published: 2014-04-17
Description: DistUpgrade/DistUpgradeViewKDE.py in Update Manager before 1:0.87.31.1, 1:0.134.x before 1:0.134.11.1, 1:0.142.x before 1:0.142.23.1, 1:0.150.x before 1:0.150.5.1, and 1:0.152.x before 1:0.152.25.5 does not properly create temporary files, which allows local users to obtain the XAUTHORITY file content for a user via a symlink attack on the temporary file.
CVSS Score: 1.9 (LOW)
CWE: CWE-59
References: http://secunia.com/advisories/47024; http://www.ubuntu.com/usn/USN-1284-1; https://bugs.launchpad.net/ubuntu/+source/update-manager/+bug/881541
CVE: CVE-2013-2143
Published: 2014-04-17
Description: The users controller in Katello 1.5.0-14 and earlier, and Red Hat Satellite, does not check authorization for the update_roles action, which allows remote authenticated users to gain privileges by setting a user account to an administrator account.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://packetstormsecurity.com/files/125866/Katello-Red-Hat-Satellite-users-update_roles-Missing-Authorization.html; http://www.exploit-db.com/exploits/32515; http://www.osvdb.org/104981
CVE: CVE-2014-0036
Published: 2014-04-17
Description: The rbovirt gem before 0.0.24 for Ruby uses the rest-client gem with SSL verification disabled, which allows remote attackers to conduct man-in-the-middle attacks via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-310
References: http://lists.fedoraproject.org/pipermail/package-announce/2014-March/130148.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-March/130180.html; http://seclists.org/oss-sec/2014/q1/509
CVE: CVE-2014-0054
Published: 2014-04-17
Description: The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4152, CVE-2013-7315, and CVE-2013-6429.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://rhn.redhat.com/errata/RHSA-2014-0400.html; http://secunia.com/advisories/57915; http://www.oracle.com/technetwork/security-advisory/cpuapr2[PII_REDACTED].html
CVE: CVE-2014-0071
Published: 2014-04-17
Description: PackStack in Red Hat OpenStack 4.0 does not enforce the default security groups when deployed to Neutron, which allows remote attackers to bypass intended access restrictions and make unauthorized connections.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-264
References: http://rhn.redhat.com/errata/RHSA-2014-0233.html; http://www.securityfocus.com/bid/66001; https://bugzilla.redhat.com/show_bug.cgi?id=1064163
CVE: CVE-2014-0085
Published: 2014-04-17
Description: JBoss Fuse did not enable encrypted passwords by default in its usage of Apache Zookeeper. This permitted sensitive information disclosure via logging to local users. Note: this description has been updated; previous text mistakenly identified the source of the flaw as Zookeeper. Previous text: Apache Zookeeper logs cleartext admin passwords, which allows local users to obtain sensitive information by reading the log.
CVSS Score: 2.1 (LOW)
CWE: CWE-255
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-0085; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-0085
CVE: CVE-2014-0111
Published: 2014-04-17
Description: Apache Syncope 1.0.0 before 1.0.9 and 1.1.0 before 1.1.7 allows remote administrators to execute arbitrary Java code via vectors related to Apache Commons JEXL expressions, "derived schema definition," "user / role templates," and "account links of resource mappings."
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-94
References: http://mail-archives.us.apache.org/mod_mbox/www-announce/201404.mbox/%3C534CE[PII_REDACTED]%40apache.org%3E; http://syncope.apache.org/security.html; http://www.securityfocus.com/archive/1/531841/100/0/threaded
CVE: CVE-2014-0984
Published: 2014-04-17
Description: The passwordCheck function in SAP Router 721 patch 117, 720 patch 411, 710 patch 029, and earlier terminates validation of a Route Permission Table entry password upon encountering the first incorrect character, which allows remote attackers to obtain passwords via a brute-force attack that relies on timing differences in responses to incorrect password guesses, aka a timing side-channel attack.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://scn.sap.com/docs/DOC-8218; http://www.coresecurity.com/advisories/sap-router-password-timing-attack; http://www.exploit-db.com/exploits/32919
CVE: CVE-2014-1932
Published: 2014-04-17
Description: The (1) load_djpeg function in JpegImagePlugin.py, (2) Ghostscript function in EpsImagePlugin.py, (3) load function in IptcImagePlugin.py, and (4) _copy function in Image.py in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 do not properly create temporary files, which allow local users to overwrite arbitrary files and obtain sensitive information via a symlink attack on the temporary file.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-59
References: http://lists.opensuse.org/opensuse-updates/2014-05/msg00002.html; http://www.openwall.com/lists/oss-security/2014/02/11/1; http://www.securityfocus.com/bid/65511
CVE: CVE-2014-1933
Published: 2014-04-17
Description: The (1) JpegImagePlugin.py and (2) EpsImagePlugin.py scripts in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 uses the names of temporary files on the command line, which makes it easier for local users to conduct symlink attacks by listing the processes.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-updates/2014-05/msg00002.html; http://www.openwall.com/lists/oss-security/2014/02/10/15; http://www.openwall.com/lists/oss-security/2014/02/11/1
CVE: CVE-2014-2310
Published: 2014-04-17
Description: The AgentX subagent in Net-SNMP before 5.4.4 allows remote attackers to cause a denial of service (hang) by sending a multi-object request with an Object ID (OID) containing more subids than previous requests, a different vulnerability than CVE-2012-6151.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://seclists.org/oss-sec/2014/q1/513; http://seclists.org/oss-sec/2014/q1/527; http://secunia.com/advisories/57870
CVE: CVE-2014-2469
Published: 2014-04-17
Description: Unspecified vulnerability in lighttpd in Oracle Solaris 11.1 allows attackers to cause a denial of service via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://securitytracker.com/id?1029999; http://www.osvdb.org/105298; http://www.securityfocus.com/bid/66599
CVE: CVE-2014-2707
Published: 2014-04-17
Description: cups-browsed in cups-filters 1.0.41 before 1.0.51 allows remote IPP printers to execute arbitrary commands via shell metacharacters in the (1) model or (2) PDL, related to "System V interface scripts generated for queues."
CVSS Score: 8.3 (HIGH)
CWE: CWE-78
References: http://bzr.linuxfoundation.org/loggerhead/openprinting/cups-filters/revision/7188#NEWS; http://lists.fedoraproject.org/pipermail/package-announce/2014-April/131485.html; http://seclists.org/oss-sec/2014/q2/13
CVE: CVE-2014-2879
Published: 2014-04-17
Description: Multiple cross-site scripting (XSS) vulnerabilities in Dell SonicWALL Email Security 7.4.5 and earlier allow remote authenticated administrators to inject arbitrary web script or HTML via (1) the uploadPatch parameter to the System/Advanced page (settings_advanced.html) or (2) the uploadLicenses parameter in the License management (settings_upload_dlicense.html) page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2014/Mar/409; http://www.securityfocus.com/archive/1/531642/100/0/threaded; http://www.securityfocus.com/bid/66501
CVE: CVE-2014-2880
Published: 2014-04-17
Description: Open redirect vulnerability in the Oracle Identity Manager component in Oracle Fusion Middleware 11.1.1.5, 11.1.1.7, 11.1.2.1, and 11.1.2.2 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the backUrl parameter in a changepwd action to identity/faces/firstlogin.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://packetstormsecurity.com/files/125992/Oracle-Identity-Manager-11g-R2-SP1-Unvalidated-Redirect.html; http://www.exploit-db.com/exploits/32670; http://www.oracle.com/technetwork/topics/security/cpuoct2[PII_REDACTED].html
CVE: CVE-2012-0871
Published: 2014-04-18
Description: The session_link_x11_socket function in login/logind-session.c in systemd-logind in systemd, possibly 37 and earlier, allows local users to create or overwrite arbitrary files via a symlink attack on the X11 user directory in /run/user/.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-59
References: http://cgit.freedesktop.org/systemd/systemd/commit/?id=fc3c1c6e091ea16ad5600b145201ec535bbb5d7c; http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00030.html; http://www.osvdb.org/79768
CVE: CVE-2012-6646
Published: 2014-04-18
Description: F-Secure Anti-Virus, Safe Anywhere, and PSB Workstation Security before 11500 for Mac OS X allows local users to disable the Mac OS X firewall via unspecified vectors.
CVSS Score: 2.1 (LOW)
References: http://www.f-secure.com/en/web/labs_global/fsc-2012-2; http://www.f-secure.com/en/web/labs_global/fsc-2012-2