deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-2809
Published: 2014-07-08
Description: Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-2800 and CVE-2014-2807.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/59775; http://www.securityfocus.com/bid/68389; http://www.securitytracker.com/id/1030532
CVE: CVE-2014-2813
Published: 2014-07-08
Description: Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-2786 and CVE-2014-2792.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/59775; http://www.securityfocus.com/bid/68390; http://www.securitytracker.com/id/1030532
CVE: CVE-2014-2814
Published: 2014-07-08
Description: Microsoft Service Bus 1.1 on Microsoft Windows Server 2008 R2 SP1 and Server 2012 Gold and R2 allows remote authenticated users to cause a denial of service (AMQP messaging outage) via crafted AMQP messages, aka "Service Bus Denial of Service Vulnerability."
CVSS Score: 4.0 (MEDIUM)
References: http://secunia.com/advisories/59780; http://www.securityfocus.com/bid/68393; http://www.securitytracker.com/id/1030538
CVE: CVE-2014-0537
Published: 2014-07-09
Description: Adobe Flash Player before 13.0.0.231 and 14.x before 14.0.0.145 on Windows and OS X and before 11.2.202.394 on Linux, Adobe AIR before 14.0.0.137 on Android, Adobe AIR SDK before 14.0.0.137, and Adobe AIR SDK & Compiler before 14.0.0.137 allow attackers to bypass intended access restrictions via unspecified vectors, a different vulnerability than CVE-2014-0539.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://helpx.adobe.com/security/products/flash-player/apsb14-17.html; http://rhn.redhat.com/errata/RHSA-2014-0860.html; http://secunia.com/advisories/59774
CVE: CVE-2014-0539
Published: 2014-07-09
Description: Adobe Flash Player before 13.0.0.231 and 14.x before 14.0.0.145 on Windows and OS X and before 11.2.202.394 on Linux, Adobe AIR before 14.0.0.137 on Android, Adobe AIR SDK before 14.0.0.137, and Adobe AIR SDK & Compiler before 14.0.0.137 allow attackers to bypass intended access restrictions via unspecified vectors, a different vulnerability than CVE-2014-0537.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://helpx.adobe.com/security/products/flash-player/apsb14-17.html; http://rhn.redhat.com/errata/RHSA-2014-0860.html; http://secunia.com/advisories/59774
CVE: CVE-2014-4671
Published: 2014-07-09
Description: Adobe Flash Player before 13.0.0.231 and 14.x before 14.0.0.145 on Windows and OS X and before 11.2.202.394 on Linux, Adobe AIR before 14.0.0.137 on Android, Adobe AIR SDK before 14.0.0.137, and Adobe AIR SDK & Compiler before 14.0.0.137 do not properly restrict the SWF file format, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks against JSONP endpoints, and obtain sensitive information, via a crafted OBJECT element with SWF content satisfying the character-set requirements of a callback API.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: http://helpx.adobe.com/security/products/flash-player/apsb14-17.html; http://miki.it/blog/2014/7/8/abusing-jsonp-with-rosetta-flash/; http://rhn.redhat.com/errata/RHSA-2014-0860.html
CVE: CVE-2014-0207
Published: 2014-07-09
Description: The cdf_read_short_sector function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted CDF file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119, CWE-20
References: http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html; http://lists.opensuse.org/opensuse-updates/2014-09/msg00046.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]5317&w=2
CVE: CVE-2014-3309
Published: 2014-07-09
Description: The NTP implementation in Cisco IOS and IOS XE does not properly support use of the access-group command for a "deny all" configuration, which allows remote attackers to bypass intended restrictions on time synchronization via a standard query, aka Bug ID CSCuj66318.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3309; http://www.securityfocus.com/bid/68463; http://www.securitytracker.com/id/1030549
CVE: CVE-2014-3312
Published: 2014-07-09
Description: The debug console interface on Cisco Small Business SPA300 and SPA500 phones does not properly perform authentication, which allows local users to execute arbitrary debug-shell commands, or read or modify data in memory or a filesystem, via direct access to this interface, aka Bug ID CSCun77435.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-287
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3312; http://www.securityfocus.com/bid/68465; http://www.securitytracker.com/id/1030552
CVE: CVE-2014-3313
Published: 2014-07-09
Description: Cross-site scripting (XSS) vulnerability in the web user interface on Cisco Small Business SPA300 and SPA500 phones allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCuo52582.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/59808; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3313; http://tools.cisco.com/security/center/viewAlert.x?alertId=34885
CVE: CVE-2014-3478
Published: 2014-07-09
Description: Buffer overflow in the mconvert function in softmagic.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, allows remote attackers to cause a denial of service (application crash) via a crafted Pascal string in a FILE_PSTRING conversion.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119, CWE-119
References: http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html; http://lists.opensuse.org/opensuse-updates/2014-09/msg00046.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]5317&w=2
CVE: CVE-2014-3479
Published: 2014-07-09
Description: The cdf_check_stream_offset function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, relies on incorrect sector-size data, which allows remote attackers to cause a denial of service (application crash) via a crafted stream offset in a CDF file.
CVSS Score: 4.3 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html; http://lists.opensuse.org/opensuse-updates/2014-09/msg00046.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]5317&w=2
CVE: CVE-2014-3480
Published: 2014-07-09
Description: The cdf_count_chain function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, does not properly validate sector-count data, which allows remote attackers to cause a denial of service (application crash) via a crafted CDF file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html; http://lists.opensuse.org/opensuse-updates/2014-09/msg00046.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]5317&w=2
CVE: CVE-2014-3487
Published: 2014-07-09
Description: The cdf_read_property_info function in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, does not properly validate a stream offset, which allows remote attackers to cause a denial of service (application crash) via a crafted CDF file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html; http://lists.opensuse.org/opensuse-updates/2014-09/msg00046.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]5317&w=2
CVE: CVE-2014-3515
Published: 2014-07-09
Description: The SPL component in PHP before 5.4.30 and 5.5.x before 5.5.14 incorrectly anticipates that certain data structures will have the array data type after unserialization, which allows remote attackers to execute arbitrary code via a crafted string that triggers use of a Hashtable destructor, related to "type confusion" issues in (1) ArrayObject and (2) SPLObjectStorage.
CVSS Score: 7.5 (HIGH)
References: http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=88223c5245e9b470e1e6362bfd96829562ffe6ab; http://lists.opensuse.org/opensuse-updates/2014-09/msg00046.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]5317&w=2
CVE: CVE-2014-3891
Published: 2014-07-09
Description: Buffer overflow in RimArts Becky! Internet Mail before 2.68 allows remote POP3 servers to execute arbitrary code via a crafted response.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://jvn.jp/en/jp/JVN35376006/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2014-000071; http://www.rimarts.co.jp/index-j.html
CVE: CVE-2014-4699
Published: 2014-07-09
Description: The Linux kernel before 3.15.4 on Intel processors does not properly restrict use of a non-canonical value for the saved RIP address in the case of a system call that does not use IRET, which allows local users to leverage a race condition and gain privileges, or cause a denial of service (double fault), via a crafted application that makes ptrace and fork system calls.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-362
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=b9cd18de4db3c9ffa7e17b0dc0ca99ed5aa4d43a; http://linux.oracle.com/errata/ELSA-2014-0924.html; http://linux.oracle.com/errata/ELSA-2014-3047.html
CVE: CVE-2012-4988
Published: 2014-07-09
Description: Heap-based buffer overflow in the xjpegls.dll (aka JLS, JPEG-LS, or JPEG lossless) format plugin in XnView 1.99 and 1.99.1 allows remote attackers to execute arbitrary code via a crafted JLS image file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/show/osvdb/85893; http://seclists.org/fulldisclosure/2012/Oct/36; http://secunia.com/advisories/50825
CVE: CVE-2014-4022
Published: 2014-07-09
Description: The alloc_domain_struct function in arch/arm/domain.c in Xen 4.4.x, when running on an ARM platform, does not properly initialize the structure containing the grant table pages for a domain, which allows local guest administrators to obtain sensitive information via the GNTTABOP_setup_table subhypercall.
CVSS Score: 2.7 (LOW)
CWE: CWE-200
References: http://secunia.com/advisories/59523; http://www.securityfocus.com/bid/68184; http://www.securitytracker.com/id/1030471
CVE: CVE-2014-4194
Published: 2014-07-09
Description: SQL injection vulnerability in zero_transact_article.php in ZeroCMS 1.0 allows remote attackers to execute arbitrary SQL commands via the article_id parameter in a Submit Comment action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/127164/ZeroCMS-1.0-SQL-Injection.html; http://www.securityfocus.com/bid/68134; http://packetstormsecurity.com/files/127164/ZeroCMS-1.0-SQL-Injection.html
CVE: CVE-2014-4740
Published: 2014-07-09
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2014-4907, CVE-2014-4908.  Reason: This candidate is a duplicate of CVE-2014-4907 and CVE-2014-4908.  Notes: All CVE users should reference CVE-2014-4907 and/or CVE-2014-4908 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2014-4741
Published: 2014-07-09
Description: SQL injection vulnerability in demo/ads.php in Artifectx xClassified 1.2 allows remote attackers to execute arbitrary SQL commands via the catid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/127370/xClassified-1.2-SQL-Injection.html; http://www.securityfocus.com/bid/68438; http://packetstormsecurity.com/files/127370/xClassified-1.2-SQL-Injection.html
CVE: CVE-2014-4742
Published: 2014-07-09
Description: Cross-site scripting (XSS) vulnerability in system/class_link.php in the System module (module_system) in Kajona before 4.5 allows remote attackers to inject arbitrary web script or HTML via the systemid parameter in a mediaFolder action to index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/59540; http://www.kajona.de/en/Development/Changelog/Changelog-V4-5/changelog_45.html; https://github.com/kajona/kajonacms/commit/8f1b18150cc2a8f27c96d9c4f94a81022fbb61e3
CVE: CVE-2014-4743
Published: 2014-07-09
Description: Multiple cross-site scripting (XSS) vulnerabilities in (1) search_ajax.tpl and (2) search_ajax_small.tpl in templates/default/tpl/module_search/ in the Search module (module_search) in Kajona before 4.5 allow remote attackers to inject arbitrary web script or HTML via the search parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/59540; http://www.kajona.de/en/Development/Changelog/Changelog-V4-5/changelog_45.html; http://www.securityfocus.com/bid/68498
CVE: CVE-2014-4744
Published: 2014-07-09
Description: Multiple cross-site scripting (XSS) vulnerabilities in osTicket before 1.9.2 allow remote attackers to inject arbitrary web script or HTML via the (1) Phone Number field to open.php or (2) Phone number field, (3) passwd1 field, (4) passwd2 field, or (5) do parameter to account.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/59539; http://www.securityfocus.com/bid/68500; https://github.com/osTicket/osTicket-1.8/releases/tag/v1.9.2
CVE: CVE-2014-2963
Published: 2014-07-10
Description: Multiple cross-site scripting (XSS) vulnerabilities in group/control_panel/manage in Liferay Portal 6.1.2 CE GA3, 6.1.X EE, and 6.2.X EE allow remote attackers to inject arbitrary web script or HTML via the (1) _2_firstName, (2) _2_lastName, or (3) _2_middleName parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.kb.cert.org/vuls/id/100972; https://github.com/samuelkong/liferay-portal/pull/610; http://www.kb.cert.org/vuls/id/100972
CVE: CVE-2014-3310
Published: 2014-07-10
Description: The File Transfer feature in WebEx Meetings Client in Cisco WebEx Meetings Server and WebEx Meeting Center does not verify that a requested file was an offered file, which allows remote attackers to read arbitrary files via a modified request, aka Bug IDs CSCup62442 and CSCup58463.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3310; http://www.securityfocus.com/bid/68503; http://www.securitytracker.com/id/1030551
CVE: CVE-2014-3311
Published: 2014-07-10
Description: Heap-based buffer overflow in the file-sharing feature in WebEx Meetings Client in Cisco WebEx Meetings Server and WebEx Meeting Center allows remote attackers to execute arbitrary code via crafted data, aka Bug IDs CSCup62463 and CSCup58467.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-119
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3311; http://www.securityfocus.com/bid/68502; http://www.securitytracker.com/id/1030550
CVE: CVE-2014-3315
Published: 2014-07-10
Description: Cross-site scripting (XSS) vulnerability in viewfilecontents.do in the Dialed Number Analyzer (DNA) component in Cisco Unified Communications Manager allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCup76308.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/59739; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3315; http://tools.cisco.com/security/center/viewAlert.x?alertId=34900
CVE: CVE-2014-3316
Published: 2014-07-10
Description: The Multiple Analyzer in the Dialed Number Analyzer (DNA) component in Cisco Unified Communications Manager allows remote authenticated users to bypass intended upload restrictions via a crafted parameter, aka Bug ID CSCup76297.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/59730; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3316; http://tools.cisco.com/security/center/viewAlert.x?alertId=34899
CVE: CVE-2014-3318
Published: 2014-07-10
Description: Directory traversal vulnerability in dna/viewfilecontents.do in the Dialed Number Analyzer (DNA) component in Cisco Unified Communications Manager allows remote authenticated users to read arbitrary files via a crafted URL, aka Bug ID CSCup76318.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/59728; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3318; http://tools.cisco.com/security/center/viewAlert.x?alertId=34897
CVE: CVE-2014-3888
Published: 2014-07-10
Description: Stack-based buffer overflow in BKFSim_vhfd.exe in Yokogawa CENTUM CS 1000, CENTUM CS 3000 R3.09.50 and earlier, CENTUM VP R5.03.20 and earlier, Exaopc R3.72.00 and earlier, B/M9000CS R5.05.01 and earlier, and B/M9000 VP R7.03.01 and earlier, when FCS/Test Function is enabled, allows remote attackers to execute arbitrary code via a crafted packet.
CVSS Score: 8.3 (HIGH)
CWE: CWE-119
References: http://ics-cert.us-cert.gov/advisories/ICSA-14-189-01; http://osvdb.org/show/osvdb/108756; http://packetstormsecurity.com/files/127382/Yokogawa-CS3000-BKFSim_vhfd.exe-Buffer-Overflow.html
CVE: CVE-2014-4670
Published: 2014-07-10
Description: Use-after-free vulnerability in ext/spl/spl_dllist.c in the SPL component in PHP through 5.5.14 allows context-dependent attackers to cause a denial of service or possibly have unspecified other impact via crafted iterator usage within applications in certain web-hosting environments.
CVSS Score: 4.6 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html; http://lists.opensuse.org/opensuse-updates/2014-07/msg00035.html; http://lists.opensuse.org/opensuse-updates/2014-09/msg00046.html
CVE: CVE-2014-4698
Published: 2014-07-10
Description: Use-after-free vulnerability in ext/spl/spl_array.c in the SPL component in PHP through 5.5.14 allows context-dependent attackers to cause a denial of service or possibly have unspecified other impact via crafted ArrayIterator usage within applications in certain web-hosting environments.
CVSS Score: 4.6 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html; http://lists.opensuse.org/opensuse-updates/2014-07/msg00035.html; http://lists.opensuse.org/opensuse-updates/2014-09/msg00046.html
CVE: CVE-2014-4845
Published: 2014-07-10
Description: Cross-site scripting (XSS) vulnerability in the BannerMan plugin 0.2.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the bannerman_background parameter to wp-admin/options-general.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/127289/WordPress-Bannerman-0.2.4-Cross-Site-Scripting.html; http://www.securityfocus.com/bid/68278; http://packetstormsecurity.com/files/127289/WordPress-Bannerman-0.2.4-Cross-Site-Scripting.html
CVE: CVE-2014-4846
Published: 2014-07-10
Description: Cross-site scripting (XSS) vulnerability in the Meta Slider (ml-slider) plugin 2.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the id parameter to wp-admin/admin.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/127288/WordPress-ml-slider-2.5-Cross-Site-Scripting.html; http://www.securityfocus.com/bid/68283; http://packetstormsecurity.com/files/127288/WordPress-ml-slider-2.5-Cross-Site-Scripting.html
CVE: CVE-2014-4847
Published: 2014-07-10
Description: Cross-site scripting (XSS) vulnerability in the Random Banner plugin 1.1.2.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the buffercode_RBanner_url_banner1 parameter in an update action to wp-admin/options.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/127292/WordPress-Random-Banner-1.1.2.1-Cross-Site-Scripting.html; http://www.securityfocus.com/bid/68280; http://packetstormsecurity.com/files/127292/WordPress-Random-Banner-1.1.2.1-Cross-Site-Scripting.html
CVE: CVE-2014-4848
Published: 2014-07-10
Description: Cross-site scripting (XSS) vulnerability in the Blogstand Banner (blogstand-smart-banner) plugin 1.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via the bs_blog_id parameter to wp-admin/options-general.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/127290/WordPress-Blogstand-Smart-Banner-1.0-Cross-Site-Scripting.html; http://www.securityfocus.com/bid/68282; http://packetstormsecurity.com/files/127290/WordPress-Blogstand-Smart-Banner-1.0-Cross-Site-Scripting.html
CVE: CVE-2014-4849
Published: 2014-07-10
Description: Multiple cross-site scripting (XSS) vulnerabilities in msg.php in FoeCMS allow remote attackers to inject arbitrary web script or HTML via the (1) e or (2) r parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/127358/FoeCMS-XSS-SQL-Injection-Open-Redirect.html; http://packetstormsecurity.com/files/127358/FoeCMS-XSS-SQL-Injection-Open-Redirect.html
CVE: CVE-2014-4850
Published: 2014-07-10
Description: SQL injection vulnerability in index.php in FoeCMS allows remote attackers to execute arbitrary SQL commands via the i parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/127358/FoeCMS-XSS-SQL-Injection-Open-Redirect.html; http://packetstormsecurity.com/files/127358/FoeCMS-XSS-SQL-Injection-Open-Redirect.html
CVE: CVE-2014-4851
Published: 2014-07-10
Description: Open redirect vulnerability in msg.php in FoeCMS allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the r parameter.
CVSS Score: 5.8 (MEDIUM)
References: http://packetstormsecurity.com/files/127358/FoeCMS-XSS-SQL-Injection-Open-Redirect.html; http://packetstormsecurity.com/files/127358/FoeCMS-XSS-SQL-Injection-Open-Redirect.html
CVE: CVE-2014-4852
Published: 2014-07-10
Description: SQL injection vulnerability in admin/uploads.php in The Digital Craft AtomCMS, possibly 2.0, allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/127371/Atom-CMS-Shell-Upload-SQL-Injection.html; http://www.securityfocus.com/bid/68437; http://packetstormsecurity.com/files/127371/Atom-CMS-Shell-Upload-SQL-Injection.html
CVE: CVE-2014-4853
Published: 2014-07-10
Description: Cross-site scripting (XSS) vulnerability in odm-init.php in OpenDocMan before 1.2.7.3 allows remote authenticated users to inject arbitrary web script or HTML via the file name of an uploaded file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/127330/OpenDocMan-1.2.7.2-Cross-Site-Scripting.html; http://www.opendocman.com/opendocman-v1-2-7-3-release-notes; https://github.com/opendocman/opendocman/commit/d202ef3def8674be61a3e4ccbe28beba4953b7ce
CVE: CVE-2014-4854
Published: 2014-07-10
Description: Cross-site scripting (XSS) vulnerability in the WP Construction Mode plugin 1.8 for WordPress allows remote attackers to inject arbitrary web script or HTML via the wuc_logo parameter in a save action to wp-admin/admin.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/127287/WordPress-Construction-Mode-1.8-Cross-Site-Scripting.html; http://www.securityfocus.com/bid/68287; http://packetstormsecurity.com/files/127287/WordPress-Construction-Mode-1.8-Cross-Site-Scripting.html
CVE: CVE-2014-4855
Published: 2014-07-10
Description: Cross-site scripting (XSS) vulnerability in the Polylang plugin before 1.5.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via vectors related to a user description.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/59357; http://wordpress.org/plugins/polylang/changelog; http://secunia.com/advisories/59357