deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2012-1834
Published: 2014-04-07
Description: Cross-site scripting (XSS) vulnerability in the cms_tpv_admin_head function in functions.php in the CMS Tree Page View plugin before 0.8.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via the cms_tpv_view parameter to wp-admin/options-general.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://plugins.trac.wordpress.org/changeset/523576/cms-tree-page-view; http://secunia.com/advisories/48510; http://wordpress.org/extend/plugins/cms-tree-page-view/changelog/
CVE: CVE-2012-2095
Published: 2014-04-07
Description: The SetWiredProperty function in the D-Bus interface in WICD before 1.7.2 allows local users to write arbitrary configuration settings and gain privileges via a crafted property name in a dbus message.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-20
References: http://bazaar.launchpad.net/~wicd-devel/wicd/experimental/revision/751; http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=668397; http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079025.html
CVE: CVE-2012-6641
Published: 2014-04-07
Description: Cross-site scripting (XSS) vulnerability in redirect.php in the Socolissimo module (modules/socolissimo/) in PrestaShop before 1.4.7.2 allows remote attackers to inject arbitrary web script or HTML via vectors related to "parameter names and values."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/48036; http://www.prestashop.com/de/entwickler-versionen/changelog/1.4.7.2; http://www.securityfocus.com/bid/52962
CVE: CVE-2014-0160
Published: 2014-04-07
Description: The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c, aka the Heartbleed bug.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125, CWE-125
References: http://advisories.mageia.org/MGASA-2014-0165.html; http://blog.fox-it.com/2014/04/08/openssl-heartbleed-bug-live-blog/; http://cogentdatahub.com/ReleaseNotes.html
CVE: CVE-2014-0346
Published: 2014-04-07
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2014-0160.  Reason: This candidate is a reservation duplicate of CVE-2014-0160.  Notes: All CVE users should reference CVE-2014-0160 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2011-4958
Published: 2014-04-08
Description: Cross-site scripting (XSS) vulnerability in the process function in SSViewer.php in SilverStripe before 2.3.13 and 2.4.x before 2.4.6 allows remote attackers to inject arbitrary web script or HTML via the QUERY_STRING to template placeholders, as demonstrated by a request to (1) admin/reports/, (2) admin/comments/, (3) admin/, (4) admin/show/, (5) admin/assets/, and (6) admin/security/.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://doc.silverstripe.org/sapphire/en/trunk/changelogs/2.3.12; http://doc.silverstripe.org/sapphire/en/trunk/changelogs/2.4.6; http://osvdb.org/76258
CVE: CVE-2011-5277
Published: 2014-04-08
Description: Multiple SQL injection vulnerabilities in signature.php in the Advanced Forum Signatures (aka afsignatures) plugin 2.0.4 for MyBB allow remote attackers to execute arbitrary SQL commands via the (1) afs_type, (2) afs_background, (3) afs_showonline, (4) afs_bar_left, (5) afs_bar_center, (6) afs_full_line1, (7) afs_full_line2, (8) afs_full_line3, (9) afs_full_line4, (10) afs_full_line5, or (11) afs_full_line6 parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/76295; http://secunia.com/advisories/46352; http://www.exploit-db.com/exploits/17961
CVE: CVE-2011-5278
Published: 2014-04-08
Description: SQL injection vulnerability in signature.php in Advanced Forum Signatures plugin (aka afsignatures) 2.0.4 for MyBB allows remote attackers to execute arbitrary SQL commands via the afs_bar_right parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/76295; http://secunia.com/advisories/46352; http://www.exploit-db.com/exploits/17961
CVE: CVE-2012-0033
Published: 2014-04-08
Description: The CBounceDCCMod::OnPrivCTCP function in bouncedcc.cpp in the bouncedcc module in ZNC 0.200 and 0.202 allows remote attackers to cause a denial of service (crash) via a crafted DCC RESUME request.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://lists.opensuse.org/opensuse-updates/2015-11/msg00023.html; http://secunia.com/advisories/47387; http://www.openwall.com/lists/oss-security/2012/01/10/1
CVE: CVE-2012-1561
Published: 2014-04-08
Description: Cross-site scripting (XSS) vulnerability in the Finder module 6.x-1.x before 6.x-1.26, 7.x-1.x, and 7.x-2.x before 7.x-2.0-alpha8 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to the "checkbox and radio button functionalities."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/1432318; http://drupal.org/node/1432320; http://drupalcode.org/project/finder.git/commit/13e2d0c
CVE: CVE-2012-6642
Published: 2014-04-08
Description: Cross-site scripting (XSS) vulnerability in ClipBucket 2.6 allows remote attackers to inject arbitrary web script or HTML via the type parameter to view_channel.php.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/78199; http://secunia.com/advisories/47474; http://osvdb.org/78199
CVE: CVE-2012-6643
Published: 2014-04-08
Description: Multiple SQL injection vulnerabilities in the update_counter function in includes/functions.php in ClipBucket 2.6 allow remote attackers to execute arbitrary SQL commands via the time parameter to (1) videos.php or (2) channels.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/78201; http://osvdb.org/78202; http://packetstormsecurity.org/files/108489/clipbucket-sqlxss.txt
CVE: CVE-2012-6644
Published: 2014-04-08
Description: Multiple cross-site scripting (XSS) vulnerabilities in ClipBucket 2.6 allow remote attackers to inject arbitrary web script or HTML via the (1) cat parameter to channels.php, (2) collections.php, (3) groups.php, or (4) videos.php; (5) query parameter to search_result.php; or (6) type parameter to view_collection.php or (7) view_item.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/78193; http://osvdb.org/78194; http://osvdb.org/78195
CVE: CVE-2012-6645
Published: 2014-04-08
Description: Cross-site scripting (XSS) vulnerability in the autocomplete functionality in the Finder module 6.x-1.x before 6.x-1.26, 7.x-1.x, and 7.x-2.x before 7.x-2.0-alpha8 for Drupal allows remote attackers to inject arbitrary web script or HTML via the title of a node, a different vulnerability than CVE-2012-1561.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/1432318; http://drupal.org/node/1432320; http://drupalcode.org/project/finder.git/commit/13e2d0c
CVE: CVE-2014-2541
Published: 2014-04-08
Description: The Rendezvous Daemon (rvd), Rendezvous Routing Daemon (rvrd), Rendezvous Secure Daemon (rvsd), and Rendezvous Secure Routing Daemon (rvsrd) in TIBCO Rendezvous before 8.4.2, Messaging Appliance before 8.7.1, and Substation ES before 2.8.1 do not properly implement access control, which allows remote attackers to obtain sensitive information or modify transmitted information via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://www.securitytracker.com/id/1030070; http://www.tibco.com/mk/advisory.jsp; http://www.tibco.com/multimedia/rendezvous_advisory_20140408_tcm8-20763.txt
CVE: CVE-2014-2542
Published: 2014-04-08
Description: Cross-site scripting (XSS) vulnerability in the Rendezvous Daemon (rvd), Rendezvous Routing Daemon (rvrd), Rendezvous Secure Daemon (rvsd), and Rendezvous Secure Routing Daemon (rvsrd) in TIBCO Rendezvous before 8.4.2, Messaging Appliance before 8.7.1, and Substation ES before 2.8.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/101873; http://www.securityfocus.com/bid/66737; http://www.securitytracker.com/id/1030070
CVE: CVE-2014-2543
Published: 2014-04-08
Description: Buffer overflow in the Rendezvous Daemon (rvd), Rendezvous Routing Daemon (rvrd), Rendezvous Secure Daemon (rvsd), and Rendezvous Secure Routing Daemon (rvsrd) in TIBCO Rendezvous before 8.4.2, Messaging Appliance before 8.7.1, and Substation ES before 2.8.1 allows remote attackers to execute arbitrary code by leveraging access to a directly connected client and transmitting crafted data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/66744; http://www.securitytracker.com/id/1030070; http://www.tibco.com/mk/advisory.jsp
CVE: CVE-2014-0235
Published: 2014-04-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2014-0325, CVE-2014-3538.  Reason: This candidate is a duplicate of CVE-2014-0325 and/or CVE-2014-3538.  A typo caused the wrong ID to be used.  Notes: All CVE users should reference CVE-2014-0325 instead of this candidate for the issue in the Internet Explorer product, and should reference CVE-2014-3538 instead of this candidate for the issue in the file product.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2014-0315
Published: 2014-04-08
Description: Untrusted search path vulnerability in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a Trojan horse cmd.exe file in the current working directory, as demonstrated by a directory that contains a .bat or .cmd file, aka "Windows File Handling Vulnerability."
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-426
References: http://blogs.technet.com/b/srd/archive/2014/04/08/ms14-019-fixing-a-binary-hijacking-via-cmd-or-bat-file.aspx; http://seclists.org/fulldisclosure/2020/Jul/33; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-019
CVE: CVE-2014-0507
Published: 2014-04-08
Description: Buffer overflow in Adobe Flash Player before 11.7.700.275 and 11.8.x through 13.0.x before 13.0.0.182 on Windows and OS X and before 11.2.202.350 on Linux, Adobe AIR before 13.0.0.83 on Android, Adobe AIR SDK before 13.0.0.83, and Adobe AIR SDK & Compiler before 13.0.0.83 allows attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://helpx.adobe.com/security/products/flash-player/apsb14-09.html; http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00012.html; http://lists.opensuse.org/opensuse-updates/2014-04/msg00036.html
CVE: CVE-2014-0508
Published: 2014-04-08
Description: Adobe Flash Player before 11.7.700.275 and 11.8.x through 13.0.x before 13.0.0.182 on Windows and OS X and before 11.2.202.350 on Linux, Adobe AIR before 13.0.0.83 on Android, Adobe AIR SDK before 13.0.0.83, and Adobe AIR SDK & Compiler before 13.0.0.83 allow attackers to bypass intended access restrictions and obtain sensitive information via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://helpx.adobe.com/security/products/flash-player/apsb14-09.html; http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00012.html; http://lists.opensuse.org/opensuse-updates/2014-04/msg00036.html
CVE: CVE-2014-0509
Published: 2014-04-08
Description: Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 11.7.700.275 and 11.8.x through 13.0.x before 13.0.0.182 on Windows and OS X and before 11.2.202.350 on Linux, Adobe AIR before 13.0.0.83 on Android, Adobe AIR SDK before 13.0.0.83, and Adobe AIR SDK & Compiler before 13.0.0.83 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://helpx.adobe.com/security/products/flash-player/apsb14-09.html; http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00012.html; http://lists.opensuse.org/opensuse-updates/2014-04/msg00036.html
CVE: CVE-2014-1751
Published: 2014-04-08
Description: Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0235 and CVE-2014-1755.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-018; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-018
CVE: CVE-2014-1752
Published: 2014-04-08
Description: Microsoft Internet Explorer 6 and 7 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-018; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-018
CVE: CVE-2014-1753
Published: 2014-04-08
Description: Microsoft Internet Explorer 6 through 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-018; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-018
CVE: CVE-2014-1755
Published: 2014-04-08
Description: Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0235 and CVE-2014-1751.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-018; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-018
CVE: CVE-2014-1757
Published: 2014-04-08
Description: Microsoft Word 2007 SP3 and 2010 SP1 and SP2, and Office Compatibility Pack SP3, allocates memory incorrectly for file conversions from a binary (aka .doc) format to a newer format, which allows remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office File Format Converter Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.kb.cert.org/vuls/id/882841; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-017; http://www.kb.cert.org/vuls/id/882841
CVE: CVE-2014-1758
Published: 2014-04-08
Description: Stack-based buffer overflow in Microsoft Word 2003 SP3 allows remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Word Stack Overflow Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-017; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-017
CVE: CVE-2014-1759
Published: 2014-04-08
Description: pubconv.dll in Microsoft Publisher 2003 SP3 and 2007 SP3 allows remote attackers to execute arbitrary code or cause a denial of service (incorrect pointer dereference and application crash) via a crafted .pub file, aka "Arbitrary Pointer Dereference Vulnerability."
CVSS Score: 9.3 (HIGH)
References: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-020; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-020
CVE: CVE-2014-1760
Published: 2014-04-08
Description: Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-018; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-018
CVE: CVE-2014-1716
Published: 2014-04-09
Description: Cross-site scripting (XSS) vulnerability in the Runtime_SetPrototype function in runtime.cc in Google V8, as used in Google Chrome before 34.0.1847.116, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Universal XSS (UXSS)."
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html; http://lists.opensuse.org/opensuse-updates/2014-05/msg00012.html; http://security.gentoo.org/glsa/glsa-201408-16.xml
CVE: CVE-2014-1717
Published: 2014-04-09
Description: Google V8, as used in Google Chrome before 34.0.1847.116, does not properly use numeric casts during handling of typed arrays, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted JavaScript code.
CVSS Score: 7.5 (HIGH)
CWE: CWE-189
References: http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html; http://lists.opensuse.org/opensuse-updates/2014-05/msg00012.html; http://security.gentoo.org/glsa/glsa-201408-16.xml
CVE: CVE-2014-1718
Published: 2014-04-09
Description: Integer overflow in the SoftwareFrameManager::SwapToNewFrame function in content/browser/renderer_host/software_frame_manager.cc in the software compositor in Google Chrome before 34.0.1847.116 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger an attempted mapping of a large amount of renderer memory.
CVSS Score: 7.5 (HIGH)
CWE: CWE-189
References: http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html; http://lists.opensuse.org/opensuse-updates/2014-05/msg00012.html; http://security.gentoo.org/glsa/glsa-201408-16.xml
CVE: CVE-2014-1719
Published: 2014-04-09
Description: Use-after-free vulnerability in the WebSharedWorkerStub::OnTerminateWorkerContext function in content/worker/websharedworker_stub.cc in the Web Workers implementation in Google Chrome before 34.0.1847.116 allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via vectors that trigger a SharedWorker termination during script loading.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html; http://lists.opensuse.org/opensuse-updates/2014-05/msg00012.html; http://security.gentoo.org/glsa/glsa-201408-16.xml
CVE: CVE-2014-1720
Published: 2014-04-09
Description: Use-after-free vulnerability in the HTMLBodyElement::insertedInto function in core/html/HTMLBodyElement.cpp in Blink, as used in Google Chrome before 34.0.1847.116, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving attributes.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html; http://lists.opensuse.org/opensuse-updates/2014-05/msg00012.html; http://security.gentoo.org/glsa/glsa-201408-16.xml
CVE: CVE-2014-1721
Published: 2014-04-09
Description: Google V8, as used in Google Chrome before 34.0.1847.116, does not properly implement lazy deoptimization, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via crafted JavaScript code, as demonstrated by improper handling of a heap allocation of a number outside the Small Integer (aka smi) range.
CVSS Score: 7.5 (HIGH)
CWE: CWE-189
References: http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html; http://lists.opensuse.org/opensuse-updates/2014-05/msg00012.html; http://security.gentoo.org/glsa/glsa-201408-16.xml
CVE: CVE-2014-1722
Published: 2014-04-09
Description: Use-after-free vulnerability in the RenderBlock::addChildIgnoringAnonymousColumnBlocks function in core/rendering/RenderBlock.cpp in Blink, as used in Google Chrome before 34.0.1847.116, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving addition of a child node.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html; http://lists.opensuse.org/opensuse-updates/2014-05/msg00012.html; http://security.gentoo.org/glsa/glsa-201408-16.xml
CVE: CVE-2014-1723
Published: 2014-04-09
Description: The UnescapeURLWithOffsetsImpl function in net/base/escape.cc in Google Chrome before 34.0.1847.116 does not properly handle bidirectional Internationalized Resource Identifiers (IRIs), which makes it easier for remote attackers to spoof URLs via crafted use of right-to-left (RTL) Unicode text.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html; http://lists.opensuse.org/opensuse-updates/2014-05/msg00012.html; http://security.gentoo.org/glsa/glsa-201408-16.xml
CVE: CVE-2014-1724
Published: 2014-04-09
Description: Use-after-free vulnerability in Free(b)soft Laboratory Speech Dispatcher 0.7.1, as used in Google Chrome before 34.0.1847.116, allows remote attackers to cause a denial of service (application hang) or possibly have unspecified other impact via a text-to-speech request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html; http://lists.opensuse.org/opensuse-updates/2014-05/msg00012.html; http://security.gentoo.org/glsa/glsa-201408-16.xml
CVE: CVE-2014-1725
Published: 2014-04-09
Description: The base64DecodeInternal function in wtf/text/Base64.cpp in Blink, as used in Google Chrome before 34.0.1847.116, does not properly handle string data composed exclusively of whitespace characters, which allows remote attackers to cause a denial of service (out-of-bounds read) via a window.atob method call.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html; http://lists.opensuse.org/opensuse-updates/2014-05/msg00012.html; http://security.gentoo.org/glsa/glsa-201408-16.xml
CVE: CVE-2014-1726
Published: 2014-04-09
Description: The drag implementation in Google Chrome before 34.0.1847.116 allows user-assisted remote attackers to bypass the Same Origin Policy and forge local pathnames by leveraging renderer access.
CVSS Score: 4.3 (MEDIUM)
References: http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html; http://lists.opensuse.org/opensuse-updates/2014-05/msg00012.html; http://security.gentoo.org/glsa/glsa-201408-16.xml
CVE: CVE-2014-1727
Published: 2014-04-09
Description: Use-after-free vulnerability in content/renderer/renderer_webcolorchooser_impl.h in Google Chrome before 34.0.1847.116 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to forms.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html; http://lists.opensuse.org/opensuse-updates/2014-05/msg00012.html; http://security.gentoo.org/glsa/glsa-201408-16.xml
CVE: CVE-2014-1728
Published: 2014-04-09
Description: Multiple unspecified vulnerabilities in Google Chrome before 34.0.1847.116 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html; http://lists.opensuse.org/opensuse-updates/2014-05/msg00012.html; http://security.gentoo.org/glsa/glsa-201408-16.xml