deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-5333
Published: 2014-08-19
Description: Adobe Flash Player before 13.0.0.241 and 14.x before 14.0.0.176 on Windows and OS X and before 11.2.202.400 on Linux, Adobe AIR before 14.0.0.178 on Windows and OS X and before 14.0.0.179 on Android, Adobe AIR SDK before 14.0.0.178, and Adobe AIR SDK & Compiler before 14.0.0.178 do not properly restrict the SWF file format, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks against JSONP endpoints, and obtain sensitive information, via a crafted OBJECT element with SWF content satisfying the character-set requirements of a callback API, in conjunction with a manipulation involving a '$' (dollar sign) or '(' (open parenthesis) character. NOTE: this issue exists because of an incomplete fix for CVE-2014-4671.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: http://helpx.adobe.com/security/products/flash-player/apsb14-18.html; http://miki.it/blog/2014/8/15/adobe-really-fixed-rosetta-flash-today/; https://exchange.xforce.ibmcloud.com/vulnerabilities/95418
CVE: CVE-2014-3464
Published: 2014-08-19
Description: The EJB invocation handler implementation in Red Hat JBossWS, as used in JBoss Enterprise Application Platform (EAP) 6.2.0 and 6.3.0, does not properly enforce the method level restrictions for outbound messages, which allows remote authenticated users to access otherwise restricted JAX-WS handlers by leveraging permissions to the EJB class. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-2133.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-264
References: http://rhn.redhat.com/errata/RHSA-2014-1019.html; http://rhn.redhat.com/errata/RHSA-2014-1020.html; http://rhn.redhat.com/errata/RHSA-2014-1021.html
CVE: CVE-2014-3472
Published: 2014-08-19
Description: The isCallerInRole function in SimpleSecurityManager in JBoss Application Server (AS) 7, as used in Red Hat JBoss Enterprise Application Platform (JBEAP) 6.3.0, does not properly check caller roles, which allows remote authenticated users to bypass access restrictions via unspecified vectors.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-264
References: http://rhn.redhat.com/errata/RHSA-2014-1019.html; http://rhn.redhat.com/errata/RHSA-2014-1020.html; http://rhn.redhat.com/errata/RHSA-2014-1021.html
CVE: CVE-2014-3490
Published: 2014-08-19
Description: RESTEasy 2.3.1 before 2.3.8.SP2 and 3.x before 3.0.9, as used in Red Hat JBoss Enterprise Application Platform (EAP) 6.3.0, does not disable external entities when the resteasy.document.expand.entity.references parameter is set to false, which allows remote attackers to read arbitrary files and have other unspecified impact via unspecified vectors, related to an XML External Entity (XXE) issue.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0818.
CVSS Score: 7.5 (HIGH)
References: http://rhn.redhat.com/errata/RHSA-2014-1011.html; http://rhn.redhat.com/errata/RHSA-2014-1039.html; http://rhn.redhat.com/errata/RHSA-2014-1040.html
CVE: CVE-2014-3504
Published: 2014-08-19
Description: The (1) serf_ssl_cert_issuer, (2) serf_ssl_cert_subject, and (3) serf_ssl_cert_certificate functions in Serf 0.2.0 through 1.3.x before 1.3.7 does not properly handle a NUL byte in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority.
CVSS Score: 4.0 (MEDIUM)
References: http://lists.opensuse.org/opensuse-updates/2014-08/msg00038.html; http://secunia.com/advisories/59584; http://secunia.com/advisories/60721
CVE: CVE-2014-3522
Published: 2014-08-19
Description: The Serf RA layer in Apache Subversion 1.4.0 through 1.7.x before 1.7.18 and 1.8.x before 1.8.10 does not properly handle wildcards in the Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof servers via a crafted certificate.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-297
References: http://lists.apple.com/archives/security-announce/2015/Mar/msg00003.html; http://lists.opensuse.org/opensuse-updates/2014-08/msg00038.html; http://secunia.com/advisories/59432
CVE: CVE-2014-3528
Published: 2014-08-19
Description: Apache Subversion 1.0.0 through 1.7.x before 1.7.17 and 1.8.x before 1.8.10 uses an MD5 hash of the URL and authentication realm to store cached credentials, which makes it easier for remote servers to obtain the credentials via a crafted authentication realm.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-255
References: http://lists.apple.com/archives/security-announce/2015/Mar/msg00003.html; http://lists.opensuse.org/opensuse-updates/2014-08/msg00038.html; http://rhn.redhat.com/errata/RHSA-2015-0165.html
CVE: CVE-2014-4615
Published: 2014-08-19
Description: The notifier middleware in OpenStack PyCADF 0.5.0 and earlier, Telemetry (Ceilometer) 2013.2 before 2013.2.4 and 2014.x before 2014.1.2, Neutron 2014.x before 2014.1.2 and Juno before Juno-2, and Oslo allows remote authenticated users to obtain X_AUTH_TOKEN values by reading the message queue (v2/meters/http.request).
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://rhn.redhat.com/errata/RHSA-2014-1050.html; http://secunia.com/advisories/60643; http://secunia.com/advisories/60736
CVE: CVE-2014-5033
Published: 2014-08-19
Description: KDE kdelibs before 4.14 and kauth before 5.1 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process, related to CVE-2013-4288 and "PID reuse race conditions."
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-362
References: http://lists.opensuse.org/opensuse-updates/2014-08/msg00012.html; http://quickgit.kde.org/?p=kauth.git&a=commit&h=341b7d84b6d9c03cf56905cb277b47e11c81482a; http://quickgit.kde.org/?p=kdelibs.git&a=commitdiff&h=e4e7b53b71e2659adaf52691d4accc3594203b23
CVE: CVE-2014-5343
Published: 2014-08-19
Description: Cross-site scripting (XSS) vulnerability in Feng Office allows remote attackers to inject arbitrary web script or HTML via a client Name field.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/127777/Feng-Office-Cross-Site-Scripting.html; http://www.securityfocus.com/bid/69080; https://exchange.xforce.ibmcloud.com/vulnerabilities/95173
CVE: CVE-2014-5344
Published: 2014-08-19
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Mobiloud (mobiloud-mobile-app-plugin) plugin before 2.3.8 for WordPress allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/60530; http://wordpress.org/plugins/mobiloud-mobile-app-plugin/changelog; http://secunia.com/advisories/60530
CVE: CVE-2014-5345
Published: 2014-08-19
Description: Cross-site scripting (XSS) vulnerability in upgrade.php in the Disqus Comment System plugin before 2.76 for WordPress allows remote attackers to inject arbitrary web script or HTML via the step parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/127847/WordPress-Disqus-2.7.5-CSRF-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2014/Aug/35; http://www.securityfocus.com/bid/69205
CVE: CVE-2014-5346
Published: 2014-08-19
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the Disqus Comment System plugin 2.77 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) activate or (2) deactivate the plugin via the active parameter to wp-admin/edit-comments.php, (3) import comments via an import_comments action, or (4) export comments via an export_comments action to wp-admin/index.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://seclists.org/fulldisclosure/2014/Aug/46; https://vexatioustendencies.com/csrf-in-disqus-wordpress-plugin-v2-77; http://seclists.org/fulldisclosure/2014/Aug/46
CVE: CVE-2014-5347
Published: 2014-08-19
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the Disqus Comment System plugin before 2.76 for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) disqus_replace, (2) disqus_public_key, or (3) disqus_secret_key parameter to wp-admin/edit-comments.php in manage.php or that (4) reset or (5) delete plugin options via the reset parameter to wp-admin/edit-comments.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.com/files/127847/WordPress-Disqus-2.7.5-CSRF-Cross-Site-Scripting.html; http://packetstormsecurity.com/files/127852/Disqus-2.7.5-Cross-Site-Request-Forgery-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2014/Aug/35
CVE: CVE-2014-5348
Published: 2014-08-19
Description: Cross-site scripting (XSS) vulnerability in apps/zxtm/locallog.cgi in Riverbed Stingray (aka SteelApp) Traffic Manager Virtual Appliance 9.6 patchlevel[PII_REDACTED] allows remote attackers to inject arbitrary web script or HTML via the logfile parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2014/Aug/41; http://www.securityfocus.com/bid/69243; http://seclists.org/fulldisclosure/2014/Aug/41
CVE: CVE-2014-5349
Published: 2014-08-19
Description: Stack-based buffer overflow in Baidu Spark Browser 26.5.9999.3511 allows remote attackers to cause a denial of service (application crash) via nested calls to the window.print JavaScript function.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://osvdb.org/show/osvdb/108605; http://www.exploit-db.com/exploits/33951; http://www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5190.php
CVE: CVE-2014-5350
Published: 2014-08-19
Description: Multiple directory traversal vulnerabilities in Bitdefender GravityZone before 5.1.11.432 allow remote attackers to read arbitrary files via a (1) .. (dot dot) in the id parameter to webservice/CORE/downloadFullKitEpc/a/1 in the Web Console or (2) %2E%2E (encoded dot dot) in the default URI to port 7074 on the Update Server.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://seclists.org/fulldisclosure/2014/Jul/78; http://www.bitdefender.com/support/how-to-configure-iptables-firewall-rules-on-gravityzone-for-restricting-outside-access-to-mongodatabase-1265.html; https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140716-3_Bitdefender_GravityZone_Multiple_critical_vulnerabilities_v10.txt
CVE: CVE-2014-0640
Published: 2014-08-20
Description: EMC RSA Archer GRC Platform 5.x before 5.5 SP1 allows remote authenticated users to bypass intended restrictions on resource access via unspecified vectors.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://archives.neohapsis.com/archives/bugtraq/2014-08/0097.html; http://www.securityfocus.com/bid/69288; http://www.securitytracker.com/id/1030738
CVE: CVE-2014-0641
Published: 2014-08-20
Description: Cross-site request forgery (CSRF) vulnerability in EMC RSA Archer GRC Platform 5.x before 5.5 SP1 allows remote attackers to hijack the authentication of arbitrary users.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://archives.neohapsis.com/archives/bugtraq/2014-08/0097.html; http://www.securityfocus.com/bid/69289; http://www.securitytracker.com/id/1030738
CVE: CVE-2014-2505
Published: 2014-08-20
Description: EMC RSA Archer GRC Platform 5.x before 5.5 SP1 allows remote attackers to trigger the download of arbitrary code, and consequently change the product's functionality, via unspecified vectors.
CVSS Score: 5.4 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2014-08/0097.html; http://www.securityfocus.com/bid/69290; http://www.securitytracker.com/id/1030738
CVE: CVE-2014-2511
Published: 2014-08-20
Description: Multiple cross-site scripting (XSS) vulnerabilities in EMC Documentum WebTop before 6.7 SP1 P28 and 6.7 SP2 before P14 allow remote attackers to inject arbitrary web script or HTML via the (1) startat or (2) entryId parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/60561; http://www.securityfocus.com/archive/1/533160/30/0/threaded; http://www.securityfocus.com/bid/69272
CVE: CVE-2014-2515
Published: 2014-08-20
Description: EMC Documentum D2 3.1 before P24, 3.1SP1 before P02, 4.0 before P11, 4.1 before P16, and 4.2 before P05 does not properly restrict tickets provided by D2GetAdminTicketMethod and D2RefreshCacheMethod, which allows remote authenticated users to gain privileges via a request for a superuser ticket.
CVSS Score: 8.5 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/60565; http://www.securityfocus.com/archive/1/533161/30/0/threaded; http://www.securityfocus.com/bid/69275
CVE: CVE-2014-2517
Published: 2014-08-20
Description: Unspecified vulnerability in EMC RSA Archer GRC Platform 5.x before 5.5 SP1 allows remote authenticated users to gain privileges via unknown vectors.
CVSS Score: 6.5 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2014-08/0097.html; http://www.securityfocus.com/bid/69287; http://www.securitytracker.com/id/1030738
CVE: CVE-2014-2518
Published: 2014-08-20
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in EMC Documentum WDK before 6.7SP1 P28 and 6.7SP2 before P15 allow remote attackers to hijack the authentication of arbitrary users.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://secunia.com/advisories/60563; http://www.securityfocus.com/archive/1/533159/30/0/threaded; http://www.securityfocus.com/bid/69277
CVE: CVE-2014-2520
Published: 2014-08-20
Description: EMC Documentum Content Server before 6.7 SP2 P16 and 7.x before 7.1 P07, when Oracle Database is used, does not properly restrict DQL hints, which allows remote authenticated users to conduct DQL injection attacks and read sensitive database content via a crafted request.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/60571; http://www.securityfocus.com/archive/1/533162/30/0/threaded; http://www.securityfocus.com/bid/69274
CVE: CVE-2014-2521
Published: 2014-08-20
Description: EMC Documentum Content Server before 6.7 SP2 P16 and 7.x before 7.1 P07 allows remote authenticated users to read sensitive object metadata via an RPC command.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-200
References: http://secunia.com/advisories/60571; http://www.securityfocus.com/archive/1/533162/30/0/threaded; http://www.securityfocus.com/bid/69276
CVE: CVE-2014-3331
Published: 2014-08-20
Description: The Session Manager component in Packet Data Network Gateway (aka PGW) in Cisco ASR 5000 Series Software 11.0, 12.0, 12.1, 12.2, 14.0, 15.0, 16.x through 16.1.2, and 17.0 allows remote attackers to cause a denial of service (process crash) via a crafted TCP packet, aka Bug ID CSCuo21914.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/60706; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3331; http://tools.cisco.com/security/center/viewAlert.x?alertId=35346
CVE: CVE-2014-3340
Published: 2014-08-20
Description: Directory traversal vulnerability in an unspecified PHP script in the server in Cisco WebEx MeetMeNow allows remote authenticated users to read arbitrary files via a crafted request, aka Bug ID CSCuo16166.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-22
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3340; http://www.securityfocus.com/bid/69285; http://www.securitytracker.com/id/1030748
CVE: CVE-2014-3514
Published: 2014-08-20
Description: activerecord/lib/active_record/relation/query_methods.rb in Active Record in Ruby on Rails 4.0.x before 4.0.9 and 4.1.x before 4.1.5 allows remote attackers to bypass the strong parameters protection mechanism via crafted input to an application that makes create_with calls.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://openwall.com/lists/oss-security/2014/08/18/10; http://rhn.redhat.com/errata/RHSA-2014-1102.html; http://secunia.com/advisories/60347
CVE: CVE-2014-4618
Published: 2014-08-20
Description: EMC Documentum Content Server before 6.7 SP2 P16 and 7.x before 7.1 P07 allows remote authenticated users to gain privileges via a user-created system object.
CVSS Score: 8.5 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/60571; http://www.securityfocus.com/archive/1/533162/30/0/threaded; http://www.securityfocus.com/bid/69273
CVE: CVE-2014-4749
Published: 2014-08-20
Description: IBM PowerVC 1.2.0 before FixPack3 does not properly use the known_hosts file, which allows man-in-the-middle attackers to spoof SSH servers via an arbitrary server key.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=nas8N1020224; https://exchange.xforce.ibmcloud.com/vulnerabilities/94351; http://www-01.ibm.com/support/docview.wss?uid=nas8N1020224
CVE: CVE-2014-4750
Published: 2014-08-20
Description: IBM PowerVC Express Edition 1.2.0 before FixPack3 establishes an FTP session for transferring files to a managed IVM, which allows remote attackers to discover credentials by sniffing the network.
CVSS Score: 2.9 (LOW)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=nas8N1020223; http://www.securityfocus.com/bid/69299; https://exchange.xforce.ibmcloud.com/vulnerabilities/94352
CVE: CVE-2014-2524
Published: 2014-08-20
Description: The _rl_tropen function in util.c in GNU readline before 6.3 patch 3 allows local users to create or overwrite arbitrary files via a symlink attack on a /var/tmp/rltrace.[PID] file.
CVSS Score: 3.3 (LOW)
CWE: CWE-59
References: http://advisories.mageia.org/MGASA-2014-0319.html; http://lists.gnu.org/archive/html/bug-readline/2014-03/msg00057.html; http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00037.html
CVE: CVE-2014-4929
Published: 2014-08-20
Description: Directory traversal vulnerability in the routing component in ownCloud Server before 5.0.17 and 6.0.x before 6.0.4 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in a filename, related to index.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://advisories.mageia.org/MGASA-2014-0301.html; http://owncloud.org/security/advisory/?id=oc-sa-2014-018; http://www.mandriva.com/security/advisories?name=MDVSA-2014:140
CVE: CVE-2014-5382
Published: 2014-08-20
Description: Multiple cross-site scripting (XSS) vulnerabilities in the web interface in Schrack Technik microControl with firmware 1.7.0 (937) allow remote attackers to inject arbitrary web script or HTML via the position textbox in the configuration menu or other unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2014/Jul/40; https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140710-2_Schrack_Technik_Microcontrol_Multiple_critical_vulnerabilities_v10.txt; http://seclists.org/fulldisclosure/2014/Jul/40
CVE: CVE-2014-3562
Published: 2014-08-21
Description: Red Hat Directory Server 8 and 389 Directory Server, when debugging is enabled, allows remote attackers to obtain sensitive replicated metadata by searching the directory.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://rhn.redhat.com/errata/RHSA-2014-1031.html; http://rhn.redhat.com/errata/RHSA-2014-1032.html; https://bugzilla.redhat.com/show_bug.cgi?id=1123477
CVE: CVE-2014-3577
Published: 2014-08-21
Description: org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before 4.3.5 and HttpAsyncClient before 4.0.2 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a "CN=" string in a field in the distinguished name (DN) of a certificate, as demonstrated by the "foo,CN=www.apache.org" string in the O field.
CVSS Score: 5.8 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00032.html; http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00033.html; http://packetstormsecurity.com/files/127913/Apache-HttpComponents-Man-In-The-Middle.html
CVE: CVE-2014-5158
Published: 2014-08-21
Description: The (1) av-centerd SOAP service and (2) backup command in the ossim-framework service in AlienVault OSSIM before 4.6.0 allows remote attackers to execute arbitrary commands via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-94
References: http://forums.alienvault.com/discussion/2559/security-advisory-multiple-vulnerabilities; http://www.zerodayinitiative.com/advisories/ZDI-14-272/; http://www.zerodayinitiative.com/advisories/ZDI-14-273/
CVE: CVE-2014-5159
Published: 2014-08-21
Description: SQL injection vulnerability in the ossim-framework service in AlienVault OSSIM before 4.6.0 allows remote attackers to execute arbitrary SQL commands via the ws_data parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://forums.alienvault.com/discussion/2559/security-advisory-multiple-vulnerabilities; http://www.zerodayinitiative.com/advisories/ZDI-14-271/; http://forums.alienvault.com/discussion/2559/security-advisory-multiple-vulnerabilities
CVE: CVE-2014-5210
Published: 2014-08-21
Description: The av-centerd SOAP service in AlienVault OSSIM before 4.7.0 allows remote attackers to execute arbitrary commands via a crafted (1) remote_task or (2) get_license request, a different vulnerability than CVE-2014-3804 and CVE-2014-3805.
CVSS Score: 10.0 (HIGH)
CWE: CWE-94
References: http://forums.alienvault.com/discussion/2690; http://www.securityfocus.com/bid/69239; http://www.zerodayinitiative.com/advisories/ZDI-14-294/
CVE: CVE-2014-5383
Published: 2014-08-21
Description: SQL injection vulnerability in AlienVault OSSIM before 4.7.0 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://forums.alienvault.com/discussion/2690; http://www.securityfocus.com/bid/67312; http://forums.alienvault.com/discussion/2690
CVE: CVE-2014-3951
Published: 2014-08-21
Description: The HZ module in the iconv implementation in FreeBSD 10.0 before p6 and NetBSD allows context-dependent attackers to cause a denial of service (NULL pointer dereference) via a crafted argument to the iconv_open function.  NOTE: this issue was SPLIT per ADT2 due to different vulnerability types. CVE-2014-5384 is used for the NULL pointer dereference.
CVSS Score: 5.0 (MEDIUM)
References: http://mail-index.netbsd.org/source-changes/2014/06/24/msg055822.html; http://www.freebsd.org/security/advisories/FreeBSD-SA-14:15.iconv.asc; http://www.securitytracker.com/id/1030458
CVE: CVE-2014-5384
Published: 2014-08-21
Description: The VIQR module in the iconv implementation in FreeBSD 10.0 before p6 and NetBSD allows context-dependent attackers to cause a denial of service (out-of-bounds array access) via a crafted argument to the iconv_open function.  NOTE: this issue was SPLIT from CVE-2014-3951 per ADT2 due to different vulnerability types.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://mail-index.netbsd.org/source-changes/2014/06/24/msg055822.html; http://www.freebsd.org/security/advisories/FreeBSD-SA-14:15.iconv.asc; http://www.securitytracker.com/id/1030458
CVE: CVE-2009-5142
Published: 2014-08-21
Description: Cross-site scripting (XSS) vulnerability in timthumb.php in TimThumb 1.09 and earlier, as used in Mimbo Pro 2.3.1 and other products, allows remote attackers to inject arbitrary web script or HTML via the src parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/127724/WordPress-Gamespeed-Theme-Cross-Site-Scripting.html; http://www.osvdb.org/71878; https://code.google.com/p/timthumb/issues/detail?id=49