deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-2829
Published: 2014-04-11
Description: Erlang Solutions MongooseIM through 1.3.1 rev. 2 does not properly restrict the processing of compressed XML elements, which allows remote attackers to cause a denial of service (resource consumption) via a crafted XMPP stream, aka an "xmppbomb" attack.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://xmpp.org/resources/security-notices/uncontrolled-resource-consumption-with-highly-compressed-xmpp-stanzas/; https://github.com/esl/MongooseIM/commit/586d96cc12ef218243a3466354b4d208b5472a6c; http://xmpp.org/resources/security-notices/uncontrolled-resource-consumption-with-highly-compressed-xmpp-stanzas/
CVE: CVE-2013-2706
Published: 2014-04-11
Description: Cross-site request forgery (CSRF) vulnerability in the Stream Video Player plugin 1.4.0 for WordPress allows remote attackers to hijack the authentication of administrators for requests that change plugin settings via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://osvdb.org/94466; http://secunia.com/advisories/52954; http://osvdb.org/94466
CVE: CVE-2013-2708
Published: 2014-04-11
Description: Cross-site request forgery (CSRF) vulnerability in the Content Slide plugin 1.4.2 for WordPress allows remote attackers to hijack the authentication of administrators for requests that change plugin settings via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://osvdb.org/93871; http://secunia.com/advisories/52949; http://osvdb.org/93871
CVE: CVE-2013-4795
Published: 2014-04-11
Description: Cross-site scripting (XSS) vulnerability in the Submitters list in Review Board 1.6.x before 1.6.18 and 1.7.x before 1.7.12 allows remote attackers to inject arbitrary web script or HTML via a user full name.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/show/osvdb/96170; http://seclists.org/bugtraq/2013/Aug/69; http://secunia.com/advisories/54272
CVE: CVE-2013-6369
Published: 2014-04-11
Description: Stack-based buffer overflow in the jbg_dec_in function in libjbig/jbig.c in JBIG-KIT before 2.1 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted image file.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://secunia.com/advisories/57731; http://www.securityfocus.com/bid/66697; https://bugzilla.redhat.com/show_bug.cgi?id=1032273
CVE: CVE-2014-1985
Published: 2014-04-11
Description: Open redirect vulnerability in the redirect_back_or_default function in app/controllers/application_controller.rb in Redmine before 2.4.5 and 2.5.x before 2.5.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the back url (back_url parameter).
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://jvn.jp/en/jp/JVN93004610/index.html; http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-000041.html; http://seclists.org/oss-sec/2014/q2/84
CVE: CVE-2014-2333
Published: 2014-04-11
Description: Cross-site scripting (XSS) vulnerability in the Lazyest Gallery plugin before 1.1.21 for WordPress allows remote attackers to inject arbitrary web script or HTML via an EXIF tag.  NOTE: some of these details are obtained from third party information.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://secunia.com/advisories/57746; http://wordpress.org/plugins/lazyest-gallery/changelog; http://www.securityfocus.com/bid/66756
CVE: CVE-2014-2540
Published: 2014-04-11
Description: SQL injection vulnerability in OrbitScripts Orbit Open Ad Server before 1.1.1 allows remote attackers to execute arbitrary SQL commands via the site_directory_sort_field parameter to guest/site_directory.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/32792; http://www.securityfocus.com/archive/1/531781/100/0/threaded; http://www.securityfocus.com/bid/66667
CVE: CVE-2012-6130
Published: 2014-04-11
Description: Cross-site scripting (XSS) vulnerability in the history display in Roundup before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via a username, related to generating a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://issues.roundup-tracker.org/issue2550684; http://www.openwall.com/lists/oss-security/2012/11/10/2; http://www.openwall.com/lists/oss-security/2013/02/13/8
CVE: CVE-2012-6131
Published: 2014-04-11
Description: Cross-site scripting (XSS) vulnerability in cgi/client.py in Roundup before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via the @action parameter to support/issue1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://issues.roundup-tracker.org/issue2550711; http://www.openwall.com/lists/oss-security/2012/11/10/2; http://www.openwall.com/lists/oss-security/2013/02/13/8
CVE: CVE-2014-0172
Published: 2014-04-11
Description: Integer overflow in the check_section function in dwarf_begin_elf.c in the libdw library, as used in elfutils 0.153 and possibly through 0.158 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a malformed compressed debug section in an ELF file, which triggers a heap-based buffer overflow.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-189
References: http://seclists.org/oss-sec/2014/q2/54; http://www.securityfocus.com/bid/66714; http://www.ubuntu.com/usn/USN-2188-1
CVE: CVE-2014-2847
Published: 2014-04-11
Description: SQL injection vulnerability in default.asp in CIS Manager CMS allows remote attackers to execute arbitrary SQL commands via the TroncoID parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/32660; http://www.osvdb.org/105364; http://www.securityfocus.com/bid/66590
CVE: CVE-2014-2848
Published: 2014-04-11
Description: A race condition in the wmi_malware_scan.nbin plugin before[PII_REDACTED]15 for Nessus 5.2.1 allows local users to gain privileges by replacing the dissolvable agent executable in the Windows temp directory with a Trojan horse program.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-362
References: http://secunia.com/advisories/57403; http://www.securitytracker.com/id/1029946; https://discussions.nessus.org/thread/7195
CVE: CVE-2014-2849
Published: 2014-04-11
Description: The Change Password dialog box (change_password) in Sophos Web Appliance before 3.8.2 allows remote authenticated users to change the admin user password via a crafted request.
CVSS Score: 8.5 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/57706; http://www.exploit-db.com/exploits/32789; http://www.securityfocus.com/bid/66734
CVE: CVE-2014-2850
Published: 2014-04-11
Description: The network interface configuration page (netinterface) in Sophos Web Appliance before 3.8.2 allows remote administrators to execute arbitrary commands via shell metacharacters in the address parameter.
CVSS Score: 8.5 (HIGH)
CWE: CWE-78
References: http://secunia.com/advisories/57706; http://www.exploit-db.com/exploits/32789; http://www.securityfocus.com/bid/66734
CVE: CVE-2014-0777
Published: 2014-04-11
Description: The Modbus slave/outstation driver in the OPC Drivers 1.0.20 and earlier in IOServer OPC Server allows remote attackers to cause a denial of service (out-of-bounds read and daemon crash) via a crafted packet.
CVSS Score: 8.3 (HIGH)
CWE: CWE-125, CWE-119
References: http://www.ioserver.com/; https://www.cisa.gov/news-events/ics-advisories/icsa-14-100-01; http://ics-cert.us-cert.gov/advisories/ICSA-14-100-01
CVE: CVE-2014-1969
Published: 2014-04-11
Description: Directory traversal vulnerability in the apps4u@android SD Card Manager application before 20140224 for Android allows attackers to overwrite or create arbitrary files via a crafted filename.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-22
References: http://jvn.jp/en/jp/JVN47386847/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2014-000035; http://jvn.jp/en/jp/JVN47386847/index.html
CVE: CVE-2014-0636
Published: 2014-04-11
Description: EMC RSA BSAFE Micro Edition Suite (MES) 3.2.x before 3.2.6 and 4.0.x before 4.0.5 does not properly validate X.509 certificate chains, which allows man-in-the-middle attackers to spoof SSL servers via a crafted certificate chain.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-310
References: http://archives.neohapsis.com/archives/bugtraq/2014-04/0069.html; http://www.securityfocus.com/bid/66791; http://archives.neohapsis.com/archives/bugtraq/2014-04/0069.html
CVE: CVE-2014-1209
Published: 2014-04-11
Description: VMware vSphere Client 4.0, 4.1, 5.0 before Update 3, and 5.1 before Update 2 does not properly validate updates to Client files, which allows remote attackers to trigger the downloading and execution of an arbitrary program via unspecified vectors.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://www.vmware.com/security/advisories/VMSA-2014-0003.html; http://www.vmware.com/security/advisories/VMSA-2014-0003.html
CVE: CVE-2014-1210
Published: 2014-04-11
Description: VMware vSphere Client 5.0 before Update 3 and 5.1 before Update 2 does not properly validate X.509 certificates, which allows man-in-the-middle attackers to spoof SSL servers via a crafted certificate.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-310
References: http://www.vmware.com/security/advisories/VMSA-2014-0003.html; http://www.vmware.com/security/advisories/VMSA-2014-0003.html
CVE: CVE-2013-2809
Published: 2014-04-12
Description: The DNP Master Driver in the OSIsoft PI Interface before 3.1.2.54 for DNP3 allows remote attackers to cause a denial of service (interface shutdown) via a crafted TCP packet.
CVSS Score: 7.1 (HIGH)
CWE: CWE-20
References: http://ics-cert.us-cert.gov/advisories/ICSA-14-098-01; http://ics-cert.us-cert.gov/advisories/ICSA-14-098-01
CVE: CVE-2013-2828
Published: 2014-04-12
Description: The DNP Master Driver in the OSIsoft PI Interface before 3.1.2.54 for DNP3 allows physically proximate attackers to cause a denial of service (interface shutdown) via crafted input over a serial line.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-20
References: http://ics-cert.us-cert.gov/advisories/ICSA-14-098-01; http://ics-cert.us-cert.gov/advisories/ICSA-14-098-01
CVE: CVE-2013-6216
Published: 2014-04-12
Description: Unspecified vulnerability in HP Array Configuration Utility, Array Diagnostics Utility, ProLiant Array Diagnostics, and SmartSSD Wear Gauge Utility 9.40 and earlier allows local users to gain privileges via unknown vectors.
CVSS Score: 2.1 (LOW)
References: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04187357; https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04187357
CVE: CVE-2014-0347
Published: 2014-04-12
Description: The Settings module in Websense Triton Unified Security Center 7.7.3 before Hotfix 31, Web Filter 7.7.3 before Hotfix 31, Web Security 7.7.3 before Hotfix 31, Web Security Gateway 7.7.3 before Hotfix 31, and Web Security Gateway Anywhere 7.7.3 before Hotfix 31 allows remote authenticated users to read cleartext passwords by replacing type="password" with type="text" in an INPUT element in the (1) Log Database or (2) User Directories component.
CVSS Score: 3.5 (LOW)
CWE: CWE-255
References: http://www.kb.cert.org/vuls/id/568252; https://www.websense.com/content/mywebsense-hotfixes.aspx?patchid=894&prodidx=20&osidx=0&intidx=0&versionidx=0; http://www.kb.cert.org/vuls/id/568252
CVE: CVE-2014-0349
Published: 2014-04-12
Description: Multiple unspecified vulnerabilities in J2k-Codec allow remote attackers to execute arbitrary code via a crafted JPEG 2000 file.
CVSS Score: 10.0 (HIGH)
References: http://www.kb.cert.org/vuls/id/345337; http://www.kb.cert.org/vuls/id/345337
CVE: CVE-2014-0763
Published: 2014-04-12
Description: An attacker using SQL injection may use arguments to construct queries 
without proper sanitization. The DBVisitor.dll is exposed through SOAP 
interfaces, and the exposed functions are vulnerable to SOAP injection. 
This may allow unexpected SQL action and access to records in the table 
of the software database or execution of arbitrary code.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89, CWE-89
References: http://webaccess.advantech.com/; http://www.securityfocus.com/bid/66740; https://www.cisa.gov/news-events/ics-advisories/icsa-14-079-03
CVE: CVE-2014-0764
Published: 2014-04-12
Description: By providing an overly long string to the NodeName parameter, an 
attacker may be able to overflow the static stack buffer. The attacker 
may then execute code on the target device remotely.
CVSS Score: 7.5 (HIGH)
CWE: CWE-121, CWE-119
References: http://webaccess.advantech.com/; http://www.securityfocus.com/bid/66740; https://www.cisa.gov/news-events/ics-advisories/icsa-14-079-03
CVE: CVE-2014-0765
Published: 2014-04-12
Description: To exploit this vulnerability, the attacker sends data from the GotoCmd 
argument to control. If the value of the argument is overly long, the 
static stack buffer can be overflowed. This will allow the attacker to 
execute arbitrary code remotely.
CVSS Score: 7.5 (HIGH)
CWE: CWE-121, CWE-119
References: http://webaccess.advantech.com/; http://www.securityfocus.com/bid/66740; https://www.cisa.gov/news-events/ics-advisories/icsa-14-079-03
CVE: CVE-2014-0766
Published: 2014-04-12
Description: An attacker can exploit this vulnerability by copying an overly long 
NodeName2 argument into a statically sized buffer on the stack to 
overflow the static stack buffer. An attacker may use this vulnerability
 to remotely execute arbitrary code.
CVSS Score: 7.5 (HIGH)
CWE: CWE-121, CWE-119
References: http://webaccess.advantech.com/; http://www.securityfocus.com/bid/66740; https://www.cisa.gov/news-events/ics-advisories/icsa-14-079-03
CVE: CVE-2014-0767
Published: 2014-04-12
Description: An attacker may exploit this vulnerability by passing an overly long 
value from the AccessCode argument to the control. This will overflow 
the static stack buffer. The attacker may then execute code on the 
target device remotely.
CVSS Score: 7.5 (HIGH)
CWE: CWE-121, CWE-119
References: http://webaccess.advantech.com/; http://www.securityfocus.com/bid/66740; https://www.cisa.gov/news-events/ics-advisories/icsa-14-079-03
CVE: CVE-2014-0768
Published: 2014-04-12
Description: An attacker may pass an overly long value from the AccessCode2 argument 
to the control to overflow the static stack buffer. The attacker may 
then remotely execute arbitrary code.
CVSS Score: 7.5 (HIGH)
CWE: CWE-121, CWE-119
References: http://webaccess.advantech.com/; http://www.securityfocus.com/bid/66740; https://www.cisa.gov/news-events/ics-advisories/icsa-14-079-03
CVE: CVE-2014-0770
Published: 2014-04-12
Description: By providing an overly long string to the UserName parameter, an 
attacker may be able to overflow the static stack buffer. The attacker 
may then execute code on the target device remotely.
CVSS Score: 7.5 (HIGH)
CWE: CWE-121, CWE-119
References: http://webaccess.advantech.com/; http://www.securityfocus.com/bid/66740; https://www.cisa.gov/news-events/ics-advisories/icsa-14-079-03
CVE: CVE-2014-0771
Published: 2014-04-12
Description: The BWOCXRUN.BwocxrunCtrl.1 control contains a method named 
“OpenUrlToBuffer.” This method takes a URL as a parameter and returns 
its contents to the caller in JavaScript. The URLs are accessed in the 
security context of the current browser session. The control does not 
perform any URL validation and allows “file://” URLs that access the 
local disk.


The method can be used to open a URL (including file URLs) and read 
file URLs through JavaScript. This method could also be used to reach 
any arbitrary URL to which the browser has access.
CVSS Score: 7.5 (HIGH)
CWE: CWE-538, CWE-200
References: http://webaccess.advantech.com/; http://www.securityfocus.com/bid/66740; https://www.cisa.gov/news-events/ics-advisories/icsa-14-079-03
CVE: CVE-2014-0772
Published: 2014-04-12
Description: The BWOCXRUN.BwocxrunCtrl.1 control contains a method named 
OpenUrlToBufferTimeout. This method takes a URL as a parameter and 
returns its contents to the caller in JavaScript. The URLs are accessed 
in the security context of the current browser session. The control does
 not perform any URL validation and allows file:// URLs that access the 
local disk.


The method can be used to open a URL (including file URLs) and read 
the URLs through JavaScript. This method could also be used to reach any
 arbitrary URL to which the browser has access.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-538, CWE-200
References: http://webaccess.advantech.com/; http://www.securityfocus.com/bid/66740; https://www.cisa.gov/news-events/ics-advisories/icsa-14-079-03
CVE: CVE-2014-0773
Published: 2014-04-12
Description: The BWOCXRUN.BwocxrunCtrl.1 control contains a method named 
“CreateProcess.” This method contains validation to ensure an attacker 
cannot run arbitrary command lines. After validation, the values 
supplied in the HTML are passed to the Windows CreateProcessA API.


The validation can be bypassed allowing for running arbitrary command
 lines. The command line can specify running remote files (example: UNC 
command line).


A function exists at offset 100019B0 of bwocxrun.ocx. Inside this 
function, there are 3 calls to strstr to check the contents of the user 
specified command line. If “\setup.exe,” “\bwvbprt.exe,” or 
“\bwvbprtl.exe” are contained in the command line (strstr returns 
nonzero value), the command line passes validation and is then passed to
 CreateProcessA.
CVSS Score: 7.5 (HIGH)
CWE: CWE-77
References: http://webaccess.advantech.com/; http://www.securityfocus.com/bid/66740; https://www.cisa.gov/news-events/ics-advisories/icsa-14-079-03
CVE: CVE-2014-0787
Published: 2014-04-12
Description: Stack-based buffer overflow in WellinTech KingSCADA before 3.1.2.13 allows remote attackers to execute arbitrary code via a crafted packet.
CVSS Score: 10.0 (HIGH)
CWE: CWE-121, CWE-119
References: http://www.securityfocus.com/bid/66709; http://www.wellintech.com/index.php?option=com_content&view=article&id=56&Itemid=11; https://www.cisa.gov/news-events/ics-advisories/icsa-14-098-02
CVE: CVE-2014-2139
Published: 2014-04-12
Description: Cisco ONS 15454 controller cards with software 9.6 and earlier allow remote attackers to cause a denial of service (flash write outage) via a TCP FIN attack that triggers file-descriptor exhaustion, aka Bug ID CSCug97315.
CVSS Score: 5.0 (MEDIUM)
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2139; http://tools.cisco.com/security/center/viewAlert.x?alertId=33681; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2139
CVE: CVE-2014-2140
Published: 2014-04-12
Description: Cisco ONS 15454 controller cards with software 9.6 and earlier allow remote attackers to cause a denial of service (card reset) via a TCP FIN attack that triggers file-descriptor exhaustion and a failure to open a CAL pipe, aka Bug ID CSCug97348.
CVSS Score: 5.0 (MEDIUM)
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2140; http://tools.cisco.com/security/center/viewAlert.x?alertId=33680; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2140
CVE: CVE-2014-2142
Published: 2014-04-12
Description: Cisco ONS 15454 controller cards with software 10.0 and earlier allow remote attackers to cause a denial of service (card reload) via a crafted HTTP URI, aka Bug ID CSCun06870.
CVSS Score: 5.0 (MEDIUM)
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2142; http://tools.cisco.com/security/center/viewAlert.x?alertId=33679; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2142
CVE: CVE-2014-2389
Published: 2014-04-12
Description: Stack-based buffer overflow in a certain decryption function in qconnDoor on BlackBerry Z10 devices with software 10.1.0.2312, when developer-mode has been previously enabled, allows remote attackers to execute arbitrary code via a crafted packet in a TCP session on a wireless network.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2014-04/0036.html; http://archives.neohapsis.com/archives/bugtraq/2014-04/0036.html
CVE: CVE-2014-0128
Published: 2014-04-14
Description: Squid 3.1 before 3.3.12 and 3.4 before 3.4.4, when SSL-Bump is enabled, allows remote attackers to cause a denial of service (assertion failure) via a crafted range request, related to state management.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html; http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00040.html; http://lists.opensuse.org/opensuse-updates/2014-04/msg00030.html
CVE: CVE-2014-0159
Published: 2014-04-14
Description: Buffer overflow in the GetStatistics64 remote procedure call (RPC) in OpenAFS 1.4.8 before 1.6.7 allows remote attackers to cause a denial of service (crash) via a crafted statsVersion argument.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://openafs.org/pages/security/OPENAFS-SA-2014-001.txt; http://secunia.com/advisories/57779; http://secunia.com/advisories/57832
CVE: CVE-2014-0612
Published: 2014-04-14
Description: Unspecified vulnerability in Juniper Junos before 11.4R10-S1, before 11.4R11, 12.1X44 before 12.1X44-D26, 12.1X44 before 12.1X44-D30, 12.1X45 before 12.1X45-D20, and 12.1X46 before 12.1X46-D10, when Dynamic IPsec VPN is configured, allows remote attackers to cause a denial of service (new Dynamic VPN connection failures and CPU and disk consumption) via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10620; http://secunia.com/advisories/57845; http://securitytracker.com/id?1030057
CVE: CVE-2014-0614
Published: 2014-04-14
Description: Juniper Junos 13.2 before 13.2R3 and 13.3 before 13.3R1, when PIM is enabled, allows remote attackers to cause a denial of service (kernel panic and crash) via a large number of crafted IGMP packets.
CVSS Score: 7.1 (HIGH)
References: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10618; http://secunia.com/advisories/57819; http://securitytracker.com/id?1030062
CVE: CVE-2014-2711
Published: 2014-04-14
Description: Cross-site scripting (XSS) vulnerability in J-Web in Juniper Junos before 11.4R11, 11.4X27 before 11.4X27.62 (BBE), 12.1 before 12.1R9, 12.1X44 before 12.1X44-D35, 12.1X45 before 12.1X45-D25, 12.1X46 before 12.1X46-D20, 12.2 before 12.2R7, 12.3 before 12.3R6, 13.1 before 13.1R4, 13.2 before 13.2R3, and 13.3 before 13.3R1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10619; http://www.securityfocus.com/bid/66770; http://www.securitytracker.com/id/1030061
CVE: CVE-2014-2712
Published: 2014-04-14
Description: Cross-site scripting (XSS) vulnerability in J-Web in Juniper Junos before 10.0S25, 10.4 before 10.4R10, 11.4 before 11.4R11, 12.1 before 12.1R9, 12.1X44 before 12.1X44-D30, 12.1X45 before 12.1X45-D20, 12.1X46 before 12.1X46-D10, and 12.2 before 12.2R1 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters to index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10521; http://www.securityfocus.com/bid/66767; http://www.securitytracker.com/id/1030058
CVE: CVE-2014-2713
Published: 2014-04-14
Description: Juniper Junos before 11.4R11, 12.1 before 12.1R9, 12.2 before 12.2R7, 12.3R4 before 12.3R4-S3, 13.1 before 13.1R4, 13.2 before 13.2R2, and 13.3 before 13.3R1, as used in MX Series and T4000 routers, allows remote attackers to cause a denial of service (PFE restart) via a crafted IP packet to certain (1) Trio or (2) Cassis-based Packet Forwarding Engine (PFE) modules.
CVSS Score: 5.0 (MEDIUM)
References: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10621; http://www.securityfocus.com/bid/66764; http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10621