deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2012-5494
Published: 2014-09-30
Description: Cross-site scripting (XSS) vulnerability in python_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to "{u,}translate."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2012/11/10/1; https://github.com/plone/Products.CMFPlone/blob/4.2.3/docs/CHANGES.txt; https://plone.org/products/plone-hotfix/releases/20121106
CVE: CVE-2012-5495
Published: 2014-09-30
Description: python_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via a crafted URL, related to "go_back."
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-94
References: http://www.openwall.com/lists/oss-security/2012/11/10/1; https://github.com/plone/Products.CMFPlone/blob/4.2.3/docs/CHANGES.txt; https://plone.org/products/plone-hotfix/releases/20121106
CVE: CVE-2012-5496
Published: 2014-09-30
Description: kupu_spellcheck.py in Kupu in Plone before 4.0 allows remote attackers to cause a denial of service (ZServer thread lock) via a crafted URL.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://www.openwall.com/lists/oss-security/2012/11/10/1; https://github.com/plone/Products.CMFPlone/blob/4.2.3/docs/CHANGES.txt; https://plone.org/products/plone-hotfix/releases/20121106
CVE: CVE-2012-5497
Published: 2014-09-30
Description: membership_tool.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to enumerate user account names via a crafted URL.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://rhn.redhat.com/errata/RHSA-2014-1194.html; http://www.openwall.com/lists/oss-security/2012/11/10/1; https://github.com/plone/Products.CMFPlone/blob/4.2.3/docs/CHANGES.txt
CVE: CVE-2012-5498
Published: 2014-09-30
Description: queryCatalog.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to bypass caching and cause a denial of service via a crafted request to a collection.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://rhn.redhat.com/errata/RHSA-2014-1194.html; http://www.openwall.com/lists/oss-security/2012/11/09/7; http://www.openwall.com/lists/oss-security/2012/11/10/1
CVE: CVE-2012-5499
Published: 2014-09-30
Description: python_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to cause a denial of service (memory consumption) via a large value, related to formatColumns.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://rhn.redhat.com/errata/RHSA-2014-1194.html; http://www.openwall.com/lists/oss-security/2012/11/10/1; https://github.com/plone/Products.CMFPlone/blob/4.2.3/docs/CHANGES.txt
CVE: CVE-2012-5501
Published: 2014-09-30
Description: at_download.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to read arbitrary BLOBs (Files and Images) stored on custom content types via a crafted URL.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://www.openwall.com/lists/oss-security/2012/11/10/1; https://github.com/plone/Products.CMFPlone/blob/4.2.3/docs/CHANGES.txt; https://plone.org/products/plone-hotfix/releases/20121106
CVE: CVE-2012-5502
Published: 2014-09-30
Description: Cross-site scripting (XSS) vulnerability in safe_html.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote authenticated users with permissions to edit content to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2012/11/10/1; https://github.com/plone/Products.CMFPlone/blob/4.2.3/docs/CHANGES.txt; https://plone.org/products/plone-hotfix/releases/20121106
CVE: CVE-2012-5503
Published: 2014-09-30
Description: ftp.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to read hidden folder contents via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://www.openwall.com/lists/oss-security/2012/11/10/1; https://github.com/plone/Products.CMFPlone/blob/4.2.3/docs/CHANGES.txt; https://plone.org/products/plone-hotfix/releases/20121106
CVE: CVE-2012-5504
Published: 2014-09-30
Description: Cross-site scripting (XSS) vulnerability in widget_traversal.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2012/11/10/1; https://github.com/plone/Products.CMFPlone/blob/4.2.3/docs/CHANGES.txt; https://plone.org/products/plone-hotfix/releases/20121106
CVE: CVE-2012-5505
Published: 2014-09-30
Description: atat.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to read private data structures via a request for a view without a name.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www.openwall.com/lists/oss-security/2012/11/10/1; https://github.com/plone/Products.CMFPlone/blob/4.2.3/docs/CHANGES.txt; https://plone.org/products/plone-hotfix/releases/20121106
CVE: CVE-2012-5506
Published: 2014-09-30
Description: python_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to cause a denial of service (infinite loop) via an RSS feed request for a folder the user does not have permission to access.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://www.openwall.com/lists/oss-security/2012/11/10/1; https://github.com/plone/Products.CMFPlone/blob/4.2.3/docs/CHANGES.txt; https://plone.org/products/plone-hotfix/releases/20121106
CVE: CVE-2012-5507
Published: 2014-09-30
Description: AccessControl/AuthEncoding.py in Zope before 2.13.19, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to obtain passwords via vectors involving timing discrepancies in password validation.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-362
References: http://www.openwall.com/lists/oss-security/2012/11/10/1; https://bugs.launchpad.net/zope2/+bug/1071067; https://github.com/plone/Products.CMFPlone/blob/4.2.3/docs/CHANGES.txt
CVE: CVE-2012-6316
Published: 2014-09-30
Description: Multiple cross-site scripting (XSS) vulnerabilities in the TP-LINK TL-WR841N router with firmware 3.13.9 Build 120201 Rel.54965n and earlier allow remote administrators to inject arbitrary web script or HTML via the (1) username or (2) pwd parameter to userRpm/NoipDdnsRpm.htm.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2012/Dec/93; http://www.securityfocus.com/bid/56602; http://seclists.org/fulldisclosure/2012/Dec/93
CVE: CVE-2014-0170
Published: 2014-09-30
Description: Teiid before 8.4.3 and before 8.7 and Red Hat JBoss Data Virtualization 6.0.0 before patch 3 allows remote attackers to read arbitrary files via a crafted request to a REST endpoint, related to an XML External Entity (XXE) issue.
CVSS Score: 4.3 (MEDIUM)
References: http://rhn.redhat.com/errata/RHSA-2014-1284.html; http://secunia.com/advisories/61530; http://www.securitytracker.com/id/1030886
CVE: CVE-2014-3558
Published: 2014-09-30
Description: ReflectionHelper (org.hibernate.validator.util.ReflectionHelper) in Hibernate Validator 4.1.0 before 4.2.1, 4.3.x before 4.3.2, and 5.x before 5.1.2 allows attackers to bypass Java Security Manager (JSM) restrictions and execute restricted reflection calls via a crafted application.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://rhn.redhat.com/errata/RHSA-2014-1285.html; http://rhn.redhat.com/errata/RHSA-2014-1286.html; http://rhn.redhat.com/errata/RHSA-2014-1287.html
CVE: CVE-2014-5267
Published: 2014-09-30
Description: modules/openid/xrds.inc in Drupal 6.x before 6.33 and 7.x before 7.31 allows remote attackers to have unspecified impact via a crafted DOCTYPE declaration in an XRDS document.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://cgit.drupalcode.org/drupal/diff/modules/openid/xrds.inc?id=1849830; http://openwall.com/lists/oss-security/2014/08/16/4; http://www.debian.org/security/2014/dsa-2999
CVE: CVE-2014-5444
Published: 2014-09-30
Description: Geary before 0.6.3 does not present the user with a warning when a TLS certificate error is detected, which makes it easier for remote attackers to conduct man-in-the-middle attacks via a crafted certificate.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-310
References: http://lists.opensuse.org/opensuse-updates/2014-09/msg00035.html; https://bugzilla.gnome.org/show_bug.cgi?id=713247; https://git.gnome.org/browse/geary/commit/?h=geary-0.6&id=55f06a7bdcedb7efde6a516bde626ea28793ca7e
CVE: CVE-2014-6269
Published: 2014-09-30
Description: Multiple integer overflows in the http_request_forward_body function in proto_http.c in HAProxy 1.5-dev23 before 1.5.4 allow remote attackers to cause a denial of service (crash) via a large stream of data, which triggers a buffer overflow and an out-of-bounds read.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://article.gmane.org/gmane.comp.web.haproxy/17726; http://article.gmane.org/gmane.comp.web.haproxy/18097; http://git.haproxy.org/?p=haproxy-1.5.git%3Ba=commitdiff%3Bh=b4d05093bc89f[PII_REDACTED]8007e69a1434c1a0c
CVE: CVE-2014-6273
Published: 2014-09-30
Description: Buffer overflow in the HTTP transport code in apt-get in APT 1.0.1 and earlier allows man-in-the-middle attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted URL.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://secunia.com/advisories/61605; http://secunia.com/advisories/61710; http://www.debian.org/security/2014/dsa-3031
CVE: CVE-2014-7199
Published: 2014-09-30
Description: Cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.19, 1.22.x before 1.22.11, and 1.23.x before 1.23.4 allows remote attackers to inject arbitrary web script or HTML via a crafted SVG file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/61666; http://www.debian.org/security/2014/dsa-3036; http://www.openwall.com/lists/oss-security/2014/09/27/2
CVE: CVE-2014-4330
Published: 2014-09-30
Description: The Dumper method in Data::Dumper before 2.154, as used in Perl 5.20.1 and earlier, allows context-dependent attackers to cause a denial of service (stack consumption and crash) via an Array-Reference with many nested Array-References, which triggers a large number of recursive calls to the DD_dump function.
CVSS Score: 2.1 (LOW)
CWE: CWE-119
References: http://advisories.mageia.org/MGASA-2014-0406.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-September/139441.html; http://packetstormsecurity.com/files/128422/Perl-5.20.1-Deep-Recursion-Stack-Overflow.html
CVE: CVE-2014-4727
Published: 2014-09-30
Description: Cross-site scripting (XSS) vulnerability in the DHCP clients page in the TP-LINK N750 Wireless Dual Band Gigabit Router (TL-WDR4300) with firmware before 140916 allows remote attackers to inject arbitrary web script or HTML via the hostname in a DHCP request.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/128343/TP-LINK-WDR4300-XSS-Denial-Of-Service.html; http://seclists.org/fulldisclosure/2014/Sep/80; http://www.securityfocus.com/archive/1/533499/100/0/threaded
CVE: CVE-2014-4728
Published: 2014-09-30
Description: The web server in the TP-LINK N750 Wireless Dual Band Gigabit Router (TL-WDR4300) with firmware before 140916 allows remote attackers to cause a denial of service (crash) via a long header in a GET request.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://packetstormsecurity.com/files/128343/TP-LINK-WDR4300-XSS-Denial-Of-Service.html; http://seclists.org/fulldisclosure/2014/Sep/80; http://www.securityfocus.com/archive/1/533499/100/0/threaded
CVE: CVE-2014-6051
Published: 2014-09-30
Description: Integer overflow in the MallocFrameBuffer function in vncviewer.c in LibVNCServer 0.9.9 and earlier allows remote VNC servers to cause a denial of service (crash) and possibly execute arbitrary code via an advertisement for a large screen size, which triggers a heap-based buffer overflow.
CVSS Score: 7.5 (HIGH)
CWE: CWE-189
References: http://lists.fedoraproject.org/pipermail/package-announce/2014-October/139654.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-September/139445.html; http://lists.opensuse.org/opensuse-updates/2015-12/msg00022.html
CVE: CVE-2014-6055
Published: 2014-09-30
Description: Multiple stack-based buffer overflows in the File Transfer feature in rfbserver.c in LibVNCServer 0.9.9 and earlier allow remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via a (1) long file or (2) directory name or the (3) FileTime attribute in a rfbFileTransferOffer message.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: http://lists.fedoraproject.org/pipermail/package-announce/2014-October/139654.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-September/139445.html; http://lists.opensuse.org/opensuse-updates/2015-12/msg00022.html
CVE: CVE-2014-6618
Published: 2014-09-30
Description: Cross-site scripting (XSS) vulnerability in Your Online Shop allows remote attackers to inject arbitrary web script or HTML via the products_id parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/128336/Your-Online-Shop-Cross-Site-Scripting.html; http://www.securityfocus.com/bid/70073; https://exchange.xforce.ibmcloud.com/vulnerabilities/96163
CVE: CVE-2014-6619
Published: 2014-09-30
Description: Multiple cross-site scripting (XSS) vulnerabilities in register-exec.php in Restaurant Script (PizzaInn_Project) 1.0.0 allow remote attackers to inject arbitrary web script or HTML via the (1) fname, (2) lname, or (3) login parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/show/osvdb/112019; http://packetstormsecurity.com/files/128337; http://www.exploit-db.com/exploits/34760
CVE: CVE-2014-7190
Published: 2014-09-30
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in Openfiler 2.99.1 allow remote attackers to hijack the authentication of administrators for requests that (1) shutdown or (2) reboot the server via a request to admin/system_shutdown.html.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.com/files/128455/Openfiler-2.99.1-Denial-Of-Service.html; http://seclists.org/fulldisclosure/2014/Sep/109; http://www.securityfocus.com/bid/70163
CVE: CVE-2014-6809
Published: 2014-09-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2014-6846, CVE-2014-6847.  Reason: this ID was intended for one issue, but was assigned to two issues by a CNA.  Notes: All CVE users should consult CVE-2014-6846 and CVE-2014-6847 to determine which ID is appropriate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2014-6837
Published: 2014-09-30
Description: The Hillside (aka com.hillside.hermanus) application 1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/582497; http://www.kb.cert.org/vuls/id/883633; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-6838
Published: 2014-09-30
Description: The Groupama toujours la (aka com.groupama.toujoursla) application 1.3.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/167577; http://www.kb.cert.org/vuls/id/582497; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-6839
Published: 2014-09-30
Description: The Alma Corinthiana (aka com.alma.corinthiana) application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/582497; http://www.kb.cert.org/vuls/id/671641; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-6840
Published: 2014-09-30
Description: The My Wedding Planner (aka app.wedding) application 1.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/541929; http://www.kb.cert.org/vuls/id/582497; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-6841
Published: 2014-09-30
Description: The RTI INDIA (aka com.vbulletin.build_890) application 3.8.21 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/201457; http://www.kb.cert.org/vuls/id/582497; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-6842
Published: 2014-09-30
Description: The Daily Advertiser Print (aka com.lafayettedailyadv.android.prod) application 6.7 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/582497; http://www.kb.cert.org/vuls/id/698921; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-6843
Published: 2014-09-30
Description: The Sweatshop (aka com.orderingapps.sweatshop) application 2.96 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/582497; http://www.kb.cert.org/vuls/id/803641; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-6844
Published: 2014-09-30
Description: The ABC Song (aka com.tabtale.abcsingalong) application 1.0.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/582497; http://www.kb.cert.org/vuls/id/717401; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-6845
Published: 2014-09-30
Description: The MediaFire (aka com.mediafire.android) application 1.1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/318849; http://www.kb.cert.org/vuls/id/582497; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-6846
Published: 2014-09-30
Description: The Four Seasons Beverly Hills (aka com.intelitycorp.FourSeasons.android.ice) application @7F050007 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/300105; http://www.kb.cert.org/vuls/id/582497; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-6847
Published: 2014-09-30
Description: The Horoscopes and Dreams (aka com.horoscopesanddreams) application 1.0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/279689; http://www.kb.cert.org/vuls/id/582497; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-6848
Published: 2014-09-30
Description: The DS file (aka com.synology.DSfile) application 4.1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/582497; http://www.kb.cert.org/vuls/id/954825; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-6850
Published: 2014-09-30
Description: The SED Account (aka com.starkville.smartapps) application 1.153.0034 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/497841; http://www.kb.cert.org/vuls/id/582497; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-3395
Published: 2014-09-30
Description: Cisco WebEx Meetings Server (WMS) 2.5 allows remote attackers to trigger the download of arbitrary files via a crafted URL, aka Bug ID CSCup10343.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3395; http://tools.cisco.com/security/center/viewAlert.x?alertId=35876; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3395
CVE: CVE-2014-6851
Published: 2014-10-01
Description: The New Beginnings CFC (aka com.goodbarber.nbcfc) application 1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/336889; http://www.kb.cert.org/vuls/id/582497; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-6852
Published: 2014-10-01
Description: The LedLine.gr Official (aka com.automon.ledline.gr) application 1.4.0.9 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/582497; http://www.kb.cert.org/vuls/id/943473; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-6853
Published: 2014-10-01
Description: The Foxit MobilePDF - PDF Reader (aka com.foxit.mobile.pdf.lite) application 2.2.0.0616 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/582497; http://www.kb.cert.org/vuls/id/715905; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-6854
Published: 2014-10-01
Description: The EyeXam (aka com.globaleyeventures.eyexam) application 1.4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/582497; http://www.kb.cert.org/vuls/id/672609; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing