deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-8316
Published: 2014-10-16
Description: XML External Entity (XXE) vulnerability in polestar_xml.jsp in SAP BusinessObjects Explorer 14.0.5 build 882 allows remote attackers to read arbitrary files via the xmlParameter parameter in an explorationSpaceUpdate request.
CVSS Score: 5.0 (MEDIUM)
References: http://packetstormsecurity.com/files/128633/SAP-BusinessObjects-Explorer-14.0.5-XXE-Injection.html; http://scn.sap.com/docs/DOC-55451; http://seclists.org/fulldisclosure/2014/Oct/50
CVE: CVE-2014-8317
Published: 2014-10-17
Description: Cross-site scripting (XSS) vulnerability in the Webform Validation module 6.x-1.x before 6.x-1.6 and 7.x-1.x before 7.x-1.4 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a component name text.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://secunia.com/advisories/56882; http://www.securityfocus.com/bid/65525; https://drupal.org/node/2194621
CVE: CVE-2014-8318
Published: 2014-10-17
Description: Cross-site scripting (XSS) vulnerability in the Webform module 6.x-3.x before 6.x-3.20, 7.x-3.x before 7.x-3.20, and 7.x-4.x before 7.x-4.0-beta2 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a field label title, when two fields have the same form_key.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://osvdb.org/103262; http://secunia.com/advisories/56860; http://www.securityfocus.com/bid/65528
CVE: CVE-2014-8319
Published: 2014-10-17
Description: Cross-site scripting (XSS) vulnerability in the easy_social_admin_summary function in the Easy Social module 7.x-2.x before 7.x-2.11 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a block title.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://osvdb.org/103264; http://secunia.com/advisories/56857; http://www.securityfocus.com/bid/65527
CVE: CVE-2014-8320
Published: 2014-10-17
Description: Cross-site scripting (XSS) vulnerability in the Custom Search module 6.x-1.x before 6.x-1.12 and 7.x-1.x before 7.x-1.14 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via the "Label text" field to the results configuration page.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2014/Apr/41; http://secunia.com/advisories/57373; https://drupal.org/node/2231665
CVE: CVE-2013-7330
Published: 2014-10-17
Description: Jenkins before 1.502 allows remote authenticated users to configure an otherwise restricted project via vectors related to post-build actions.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://www.openwall.com/lists/oss-security/2014/02/21/2; https://github.com/jenkinsci/jenkins/commit/36342d71e29e0620f803a7470ce96c61761648d8; https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-02-14
CVE: CVE-2014-2058
Published: 2014-10-17
Description: BuildTrigger in Jenkins before 1.551 and LTS before 1.532.2 allows remote authenticated users to bypass access restrictions and execute arbitrary jobs by configuring a job to trigger another job. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7330.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://www.openwall.com/lists/oss-security/2014/02/21/2; https://github.com/jenkinsci/jenkins/commit/b6b2a367a7976be80a799c6a49fa6c58d778b50e; https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-02-14
CVE: CVE-2014-2060
Published: 2014-10-17
Description: The Winstone servlet container in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to hijack sessions via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://www.openwall.com/lists/oss-security/2014/02/21/2; https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-02-14; http://www.openwall.com/lists/oss-security/2014/02/21/2
CVE: CVE-2014-2061
Published: 2014-10-17
Description: The input control in PasswordParameterDefinition in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to obtain passwords by reading the HTML source code, related to the default value.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://www.openwall.com/lists/oss-security/2014/02/21/2; https://github.com/jenkinsci/jenkins/commit/bf539198564a1108b7b71a973bf7de963a6213ef; https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-02-14
CVE: CVE-2014-2062
Published: 2014-10-17
Description: Jenkins before 1.551 and LTS before 1.532.2 does not invalidate the API token when a user is deleted, which allows remote authenticated users to retain access via the token.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-287
References: http://www.openwall.com/lists/oss-security/2014/02/21/2; https://github.com/jenkinsci/jenkins/commit/5548b5220cfd496831b[PII_REDACTED]ff18fbb12a3; https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-02-14
CVE: CVE-2014-2063
Published: 2014-10-17
Description: Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to conduct clickjacking attacks via unspecified vectors.
CVSS Score: 7.5 (HIGH)
References: http://www.openwall.com/lists/oss-security/2014/02/21/2; https://github.com/jenkinsci/jenkins/commit/16931bd7bf7560e26ef98328b8e95e803d0e90f6; https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-02-14
CVE: CVE-2014-2064
Published: 2014-10-17
Description: The loadUserByUsername function in hudson/security/HudsonPrivateSecurityRealm.java in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to determine whether a user exists via vectors related to failed login attempts.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www.openwall.com/lists/oss-security/2014/02/21/2; https://github.com/jenkinsci/jenkins/commit/fbf96734470caba9364f04e0b77b0bae7293a1ec; https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-02-14
CVE: CVE-2014-2065
Published: 2014-10-17
Description: Cross-site scripting (XSS) vulnerability in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to inject arbitrary web script or HTML via the iconSize cookie.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2014/02/21/2; https://github.com/jenkinsci/jenkins/commit/a0b00508eeb74d7033dc4100eb382df4e8fa72e7; https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-02-14
CVE: CVE-2014-2066
Published: 2014-10-17
Description: Session fixation vulnerability in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to hijack web sessions via vectors involving the "override" of Jenkins cookies.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287
References: http://www.openwall.com/lists/oss-security/2014/02/21/2; https://github.com/jenkinsci/jenkins/commit/8ac74c[PII_REDACTED]98f9d5edfed39dd35de8842a; https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-02-14
CVE: CVE-2014-2068
Published: 2014-10-17
Description: The doIndex function in hudson/util/RemotingDiagnostics.java in CloudBees Jenkins before 1.551 and LTS before 1.532.2 allows remote authenticated users with the ADMINISTER permission to obtain sensitive information via vectors related to heapDump.
CVSS Score: 3.5 (LOW)
CWE: CWE-264
References: http://www.openwall.com/lists/oss-security/2014/02/21/2; https://github.com/jenkinsci/jenkins/commit/0530a6645aac10fec[PII_REDACTED]60e98db44b5eb; https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-02-14
CVE: CVE-2014-7960
Published: 2014-10-17
Description: OpenStack Object Storage (Swift) before 2.2.0 allows remote authenticated users to bypass the max_meta_count and other metadata constraints via multiple crafted requests which exceed the limit when combined.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-399
References: http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00025.html; http://rhn.redhat.com/errata/RHSA-2015-0835.html; http://rhn.redhat.com/errata/RHSA-2015-0836.html
CVE: CVE-2014-8074
Published: 2014-10-17
Description: Buffer overflow in the SetLogFile method in Foxit.FoxitPDFSDKProCtrl.5 in Foxit PDF SDK ActiveX 2.3 through 5.0.1820 before 5.0.2.924 allows remote attackers to execute arbitrary code via a long string, related to global variables.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://www.foxitsoftware.com/support/security_bulletins.php#FRD-22; http://www.securityfocus.com/bid/70608; http://www.zerodayinitiative.com/advisories/ZDI-14-362/
CVE: CVE-2014-8755
Published: 2014-10-17
Description: Panasonic Network Camera View 3 and 4 allows remote attackers to execute arbitrary code via a crafted page, which triggers an invalid pointer dereference, related to "the ability to nullify an arbitrary address in memory."
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://security.panasonic.com/pss/security/library/howto_update_NCV.html; http://www.zerodayinitiative.com/advisories/ZDI-14-364/; http://security.panasonic.com/pss/security/library/howto_update_NCV.html
CVE: CVE-2014-8756
Published: 2014-10-17
Description: The NcrCtl4.NcrNet.1 control in Panasonic Network Camera Recorder before 4.04R03 allows remote attackers to execute arbitrary code via a crafted GetVOLHeader method call, which writes null bytes to an arbitrary address.
CVSS Score: 6.8 (MEDIUM)
References: http://panasonic.net/pcc/cgi-bin/products/netwkcam/download_us/tbookmarka_m.cgi?m=%20&mm=[PII_REDACTED]; http://www.zerodayinitiative.com/advisories/ZDI-14-363/; http://panasonic.net/pcc/cgi-bin/products/netwkcam/download_us/tbookmarka_m.cgi?m=%20&mm=[PII_REDACTED]
CVE: CVE-2014-2559
Published: 2014-10-17
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in twitget.php in the Twitget plugin before 3.3.3 for WordPress allow remote attackers to hijack the authentication of administrators for requests that change unspecified plugin options via a request to wp-admin/options-general.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.com/files/126134; http://seclists.org/fulldisclosure/2014/Apr/172; http://secunia.com/advisories/57892
CVE: CVE-2014-2995
Published: 2014-10-17
Description: Multiple cross-site scripting (XSS) vulnerabilities in twitget.php in the Twitget plugin before 3.3.3 for WordPress allow remote authenticated administrators to inject arbitrary web script or HTML via unspecified vectors, as demonstrated by the twitget_consumer_key parameter to wp-admin/options-general.php.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://packetstormsecurity.com/files/126134; http://seclists.org/fulldisclosure/2014/Apr/172; http://wordpress.org/plugins/twitget/changelog
CVE: CVE-2014-2278
Published: 2014-10-17
Description: Unrestricted file upload vulnerability in op/op.AddFile2.php in SeedDMS (formerly LetoDMS and MyDMS) before 4.3.4 allows remote attackers to execute arbitrary code by uploading a file with an executable extension specified by the partitionIndex parameter and leveraging CVE-2014-2279.2 to access it via the directory specified by the fileId parameter.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-20
References: http://archives.neohapsis.com/archives/bugtraq/2014-03/0101.html; http://osvdb.org/show/osvdb/104465; http://packetstormsecurity.com/files/125726
CVE: CVE-2014-2279
Published: 2014-10-17
Description: Multiple directory traversal vulnerabilities in SeedDMS (formerly LetoDMS and MyDMS) before 4.3.4 allow (1) remote authenticated users with access to the LogManagement functionality to read arbitrary files via a .. (dot dot) in the logname parameter to out/out.LogManagement.php or (2) remote attackers to write to arbitrary files via a .. (dot dot) in the fileId parameter to op/op.AddFile2.php.  NOTE: vector 2 can be leveraged to execute arbitrary code by using CVE-2014-2278.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-22
References: http://archives.neohapsis.com/archives/bugtraq/2014-03/0101.html; http://osvdb.org/show/osvdb/104466; http://packetstormsecurity.com/files/125726
CVE: CVE-2014-6283
Published: 2014-10-17
Description: SAP Adaptive Server Enterprise (ASE) 15.7 before SP122 or SP63, 15.5 before ESD#5.4, and 15.0.3 before ESD#4.4 does not properly restrict access, which allows remote authenticated database users to (1) overwrite the master encryption key or (2) trigger a buffer overflow via a crafted RPC message to the hacmpmsgxchg function, and possibly other vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://blog.spiderlabs.com/2014/09/cve-2014-6283-sap-ase-missing-authorization-checks-and-arbitrary-code-execution.html; http://scn.sap.com/docs/DOC-55451; http://secunia.com/advisories/61238
CVE: CVE-2014-3573
Published: 2014-10-18
Description: The oVirt Engine backend module, as used in Red Hat Enterprise Virtualization Manager before 3.4.2, uses an "insecure DocumentBuilderFactory," which allows remote attackers to read arbitrary files or possibly have other unspecified impact via a crafted XML/RSDL document, related to an XML External Entity (XXE) issue.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://rhn.redhat.com/errata/RHSA-2014-1161.html; http://www.securitytracker.com/id/1030807; http://rhn.redhat.com/errata/RHSA-2014-1161.html
CVE: CVE-2014-4351
Published: 2014-10-18
Description: Buffer overflow in QuickTime in Apple OS X before 10.10 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted audio samples in an m4a file.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2014-10/0101.html; http://www.securityfocus.com/bid/70643; http://www.securitytracker.com/id/1031065
CVE: CVE-2014-4391
Published: 2014-10-18
Description: The Code Signing feature in Apple OS X before 10.10 does not properly handle incomplete resource envelopes in signed bundles, which allows remote attackers to bypass intended app-author restrictions by omitting an execution-related resource.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-310
References: http://archives.neohapsis.com/archives/bugtraq/2014-10/0101.html; http://www.securityfocus.com/bid/70637; http://www.securitytracker.com/id/1031063
CVE: CVE-2014-4417
Published: 2014-10-18
Description: Safari in Apple OS X before 10.10 allows remote attackers to cause a denial of service (universal Push Notification outage) via a web site that triggers an uncaught SafariNotificationAgent exception by providing a crafted Push Notification.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://archives.neohapsis.com/archives/bugtraq/2014-10/0101.html; http://www.securityfocus.com/bid/70629; http://www.securitytracker.com/id/1031063
CVE: CVE-2014-4425
Published: 2014-10-18
Description: CFPreferences in Apple OS X before 10.10 does not properly enforce the "require password after sleep or screen saver begins" setting, which makes it easier for physically proximate attackers to obtain access by leveraging an unattended workstation.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-287
References: http://archives.neohapsis.com/archives/bugtraq/2014-10/0101.html; http://www.securityfocus.com/bid/70630; http://www.securitytracker.com/id/1031063
CVE: CVE-2014-4426
Published: 2014-10-18
Description: AFP File Server in Apple OS X before 10.10 allows remote attackers to discover the network addresses of all interfaces via an unspecified command to one interface.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://archives.neohapsis.com/archives/bugtraq/2014-10/0101.html; http://lists.apple.com/archives/security-announce/2015/Jan/msg00003.html; http://support.apple.com/HT204244
CVE: CVE-2014-4427
Published: 2014-10-18
Description: App Sandbox in Apple OS X before 10.10 allows attackers to bypass a sandbox protection mechanism via the accessibility API.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://archives.neohapsis.com/archives/bugtraq/2014-10/0101.html; http://www.securityfocus.com/bid/70635; http://www.securitytracker.com/id/1031063
CVE: CVE-2014-4428
Published: 2014-10-18
Description: Bluetooth in Apple OS X before 10.10 does not require encryption for HID Low Energy devices, which allows remote attackers to spoof a device by leveraging previous pairing.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://archives.neohapsis.com/archives/bugtraq/2014-10/0101.html; http://secunia.com/advisories/61825; http://secunia.com/advisories/61827
CVE: CVE-2014-4430
Published: 2014-10-18
Description: CoreStorage in Apple OS X before 10.10 retains a volume's encryption keys upon an eject action in the unlocked state, which makes it easier for physically proximate attackers to obtain cleartext data via a remount.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-310
References: http://archives.neohapsis.com/archives/bugtraq/2014-10/0101.html; http://www.securityfocus.com/bid/70628; http://www.securitytracker.com/id/1031063
CVE: CVE-2014-4431
Published: 2014-10-18
Description: Dock in Apple OS X before 10.10 does not properly manage the screen-lock state, which allows physically proximate attackers to view windows by leveraging an unattended workstation.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://archives.neohapsis.com/archives/bugtraq/2014-10/0101.html; http://www.securityfocus.com/bid/70633; http://www.securitytracker.com/id/1031063
CVE: CVE-2014-4432
Published: 2014-10-18
Description: fdesetup in Apple OS X before 10.10 does not properly display the encryption status in between a setting-update action and a reboot action, which might make it easier for physically proximate attackers to obtain cleartext data by leveraging ignorance of the reboot requirement.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-310
References: http://archives.neohapsis.com/archives/bugtraq/2014-10/0101.html; http://www.securityfocus.com/bid/70632; http://www.securitytracker.com/id/1031063
CVE: CVE-2014-4433
Published: 2014-10-18
Description: Heap-based buffer overflow in the kernel in Apple OS X before 10.10 allows physically proximate attackers to execute arbitrary code via crafted resource forks in an HFS filesystem.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2014-10/0101.html; http://www.securityfocus.com/bid/70620; http://www.securitytracker.com/id/1031063
CVE: CVE-2014-4434
Published: 2014-10-18
Description: The kernel in Apple OS X before 10.10 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted filename on an HFS filesystem.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-20
References: http://archives.neohapsis.com/archives/bugtraq/2014-10/0101.html; http://www.securityfocus.com/bid/70618; http://www.securitytracker.com/id/1031063
CVE: CVE-2014-4435
Published: 2014-10-18
Description: The "iCloud Find My Mac" feature in Apple OS X before 10.10 does not properly enforce rate limiting of lost-mode PIN entry, which makes it easier for physically proximate attackers to obtain access via a brute-force attack involving a series of reboots.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-287
References: http://archives.neohapsis.com/archives/bugtraq/2014-10/0101.html; http://www.securityfocus.com/bid/70638; http://www.securitytracker.com/id/1031063
CVE: CVE-2014-4436
Published: 2014-10-18
Description: IOHIDFamily in Apple OS X before 10.10 allows attackers to cause denial of service (out-of-bounds read operation) via a crafted application.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2014-10/0101.html; http://www.securityfocus.com/bid/70616; http://www.securitytracker.com/id/1031063
CVE: CVE-2014-4437
Published: 2014-10-18
Description: LaunchServices in Apple OS X before 10.10 allows attackers to bypass intended sandbox restrictions via an application that specifies a crafted handler for the Content-Type field of an object.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://archives.neohapsis.com/archives/bugtraq/2014-10/0101.html; http://www.securityfocus.com/bid/70627; http://www.securitytracker.com/id/1031063
CVE: CVE-2014-4438
Published: 2014-10-18
Description: Race condition in LoginWindow in Apple OS X before 10.10 allows physically proximate attackers to obtain access by leveraging an unattended workstation on which screen locking had been attempted.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-362
References: http://archives.neohapsis.com/archives/bugtraq/2014-10/0101.html; http://www.securityfocus.com/bid/70622; http://www.securitytracker.com/id/1031063
CVE: CVE-2014-4439
Published: 2014-10-18
Description: Mail in Apple OS X before 10.10 does not properly recognize the removal of a recipient address from a message, which makes it easier for remote attackers to obtain sensitive information in opportunistic circumstances by reading a message intended exclusively for other recipients.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://archives.neohapsis.com/archives/bugtraq/2014-10/0101.html; http://www.securityfocus.com/bid/70619; http://www.securitytracker.com/id/1031063
CVE: CVE-2014-4440
Published: 2014-10-18
Description: The MCX Desktop Config Profiles implementation in Apple OS X before 10.10 retains web-proxy settings from uninstalled mobile-configuration profiles, which allows remote attackers to obtain sensitive information in opportunistic circumstances by leveraging access to an unintended proxy server.
CVSS Score: 2.6 (LOW)
CWE: CWE-16, CWE-200
References: http://archives.neohapsis.com/archives/bugtraq/2014-10/0101.html; http://www.securityfocus.com/bid/70631; http://www.securitytracker.com/id/1031063
CVE: CVE-2014-4441
Published: 2014-10-18
Description: NetFS Client Framework in Apple OS X before 10.10 does not ensure that the disabling of File Sharing is always possible, which allows remote attackers to read or write to files by leveraging a state in which File Sharing is permanently enabled.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://archives.neohapsis.com/archives/bugtraq/2014-10/0101.html; http://www.securitytracker.com/id/1031063; https://exchange.xforce.ibmcloud.com/vulnerabilities/97627
CVE: CVE-2014-4442
Published: 2014-10-18
Description: The kernel in Apple OS X before 10.10 allows local users to cause a denial of service (panic) via a message to a system control socket.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-20
References: http://archives.neohapsis.com/archives/bugtraq/2014-10/0101.html; http://www.securityfocus.com/bid/70624; http://www.securitytracker.com/id/1031063
CVE: CVE-2014-4443
Published: 2014-10-18
Description: Apple OS X before 10.10 allows remote attackers to cause a denial of service (NULL pointer dereference) via crafted ASN.1 data.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://archives.neohapsis.com/archives/bugtraq/2014-10/0101.html; http://www.securityfocus.com/bid/70625; http://www.securitytracker.com/id/1031063
CVE: CVE-2014-4444
Published: 2014-10-18
Description: SecurityAgent in Apple OS X before 10.10 does not ensure that a Kerberos ticket is in the cache for the correct user, which allows local users to gain privileges in opportunistic circumstances by leveraging a Fast User Switching login.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-287
References: http://archives.neohapsis.com/archives/bugtraq/2014-10/0101.html; http://www.securitytracker.com/id/1031063; https://exchange.xforce.ibmcloud.com/vulnerabilities/97623
CVE: CVE-2014-4446
Published: 2014-10-18
Description: Mail Service in Apple OS X Server before 4.0 does not enforce SACL changes until after a service restart, which allows remote authenticated users to bypass intended access restrictions in opportunistic circumstances by leveraging a change made by an administrator.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://archives.neohapsis.com/archives/bugtraq/2014-10/0103.html; http://www.securitytracker.com/id/1031071; https://exchange.xforce.ibmcloud.com/vulnerabilities/97645
CVE: CVE-2014-4447
Published: 2014-10-18
Description: Profile Manager in Apple OS X Server before 4.0 allows local users to discover cleartext passwords by reading a file after a (1) profile setup or (2) profile edit occurs.
CVSS Score: 1.9 (LOW)
CWE: CWE-310
References: http://archives.neohapsis.com/archives/bugtraq/2014-10/0103.html; http://www.securitytracker.com/id/1031071; https://exchange.xforce.ibmcloud.com/vulnerabilities/97646