deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-0302
Published: 2015-01-13
Description: Adobe Flash Player before 13.0.0.260 and 14.x through 16.x before 16.0.0.257 on Windows and OS X and before 11.2.202.429 on Linux, Adobe AIR before 16.0.0.245 on Windows and OS X and before 16.0.0.272 on Android, Adobe AIR SDK before 16.0.0.272, and Adobe AIR SDK & Compiler before 16.0.0.272 allow attackers to obtain sensitive keystroke information via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://helpx.adobe.com/security/products/flash-player/apsb15-01.html; http://secunia.com/advisories/62177; http://secunia.com/advisories/62187
CVE: CVE-2015-0303
Published: 2015-01-13
Description: Adobe Flash Player before 13.0.0.260 and 14.x through 16.x before 16.0.0.257 on Windows and OS X and before 11.2.202.429 on Linux, Adobe AIR before 16.0.0.245 on Windows and OS X and before 16.0.0.272 on Android, Adobe AIR SDK before 16.0.0.272, and Adobe AIR SDK & Compiler before 16.0.0.272 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0306.
CVSS Score: 10.0 (HIGH)
References: http://helpx.adobe.com/security/products/flash-player/apsb15-01.html; http://secunia.com/advisories/62177; http://secunia.com/advisories/62187
CVE: CVE-2015-0304
Published: 2015-01-13
Description: Heap-based buffer overflow in Adobe Flash Player before 13.0.0.260 and 14.x through 16.x before 16.0.0.257 on Windows and OS X and before 11.2.202.429 on Linux, Adobe AIR before 16.0.0.245 on Windows and OS X and before 16.0.0.272 on Android, Adobe AIR SDK before 16.0.0.272, and Adobe AIR SDK & Compiler before 16.0.0.272 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-0309.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://helpx.adobe.com/security/products/flash-player/apsb15-01.html; http://secunia.com/advisories/62177; http://secunia.com/advisories/62187
CVE: CVE-2015-0305
Published: 2015-01-13
Description: Adobe Flash Player before 13.0.0.260 and 14.x through 16.x before 16.0.0.257 on Windows and OS X and before 11.2.202.429 on Linux, Adobe AIR before 16.0.0.245 on Windows and OS X and before 16.0.0.272 on Android, Adobe AIR SDK before 16.0.0.272, and Adobe AIR SDK & Compiler before 16.0.0.272 allow attackers to execute arbitrary code by leveraging an unspecified "type confusion."
CVSS Score: 9.3 (HIGH)
References: http://helpx.adobe.com/security/products/flash-player/apsb15-01.html; http://secunia.com/advisories/62177; http://secunia.com/advisories/62187
CVE: CVE-2015-0306
Published: 2015-01-13
Description: Adobe Flash Player before 13.0.0.260 and 14.x through 16.x before 16.0.0.257 on Windows and OS X and before 11.2.202.429 on Linux, Adobe AIR before 16.0.0.245 on Windows and OS X and before 16.0.0.272 on Android, Adobe AIR SDK before 16.0.0.272, and Adobe AIR SDK & Compiler before 16.0.0.272 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0303.
CVSS Score: 10.0 (HIGH)
References: http://helpx.adobe.com/security/products/flash-player/apsb15-01.html; http://secunia.com/advisories/62177; http://secunia.com/advisories/62187
CVE: CVE-2015-0307
Published: 2015-01-13
Description: Adobe Flash Player before 13.0.0.260 and 14.x through 16.x before 16.0.0.257 on Windows and OS X and before 11.2.202.429 on Linux, Adobe AIR before 16.0.0.245 on Windows and OS X and before 16.0.0.272 on Android, Adobe AIR SDK before 16.0.0.272, and Adobe AIR SDK & Compiler before 16.0.0.272 allow remote attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read) via unspecified vectors.
CVSS Score: 8.5 (HIGH)
CWE: CWE-119
References: http://helpx.adobe.com/security/products/flash-player/apsb15-01.html; http://secunia.com/advisories/62177; http://secunia.com/advisories/62187
CVE: CVE-2015-0308
Published: 2015-01-13
Description: Use-after-free vulnerability in Adobe Flash Player before 13.0.0.260 and 14.x through 16.x before 16.0.0.257 on Windows and OS X and before 11.2.202.429 on Linux, Adobe AIR before 16.0.0.245 on Windows and OS X and before 16.0.0.272 on Android, Adobe AIR SDK before 16.0.0.272, and Adobe AIR SDK & Compiler before 16.0.0.272 allows attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 10.0 (HIGH)
References: http://helpx.adobe.com/security/products/flash-player/apsb15-01.html; http://secunia.com/advisories/62177; http://secunia.com/advisories/62187
CVE: CVE-2015-0309
Published: 2015-01-13
Description: Heap-based buffer overflow in Adobe Flash Player before 13.0.0.260 and 14.x through 16.x before 16.0.0.257 on Windows and OS X and before 11.2.202.429 on Linux, Adobe AIR before 16.0.0.245 on Windows and OS X and before 16.0.0.272 on Android, Adobe AIR SDK before 16.0.0.272, and Adobe AIR SDK & Compiler before 16.0.0.272 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-0304.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://helpx.adobe.com/security/products/flash-player/apsb15-01.html; http://secunia.com/advisories/62177; http://secunia.com/advisories/62187
CVE: CVE-2014-5231
Published: 2015-01-14
Description: The Siemens SIMATIC WinCC Sm@rtClient app before 1.0.2 for iOS allows physically proximate attackers to extract the password from storage via unspecified vectors.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://www.securitytracker.com/id/1031546; http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-311299.pdf; http://www.securitytracker.com/id/1031546
CVE: CVE-2014-5232
Published: 2015-01-14
Description: The Siemens SIMATIC WinCC Sm@rtClient app before 1.0.2 for iOS allows local users to bypass an intended application-password requirement by leveraging the running of the app in the background state.
CVSS Score: 1.9 (LOW)
CWE: CWE-264
References: http://www.securitytracker.com/id/1031546; http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-311299.pdf; http://www.securitytracker.com/id/1031546
CVE: CVE-2014-5233
Published: 2015-01-14
Description: The Siemens SIMATIC WinCC Sm@rtClient app before 1.0.2 for iOS allows physically proximate attackers to discover Sm@rtServer credentials by leveraging an error in the credential-processing mechanism.
CVSS Score: 1.9 (LOW)
CWE: CWE-200
References: http://www.securitytracker.com/id/1031546; http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-311299.pdf; http://www.securitytracker.com/id/1031546
CVE: CVE-2014-8634
Published: 2015-01-14
Description: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 35.0, Firefox ESR 31.x before 31.4, Thunderbird before 31.4, and SeaMonkey before 2.32 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://linux.oracle.com/errata/ELSA-2015-0046.html; http://linux.oracle.com/errata/ELSA-2015-0047.html; http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00014.html
CVE: CVE-2014-8635
Published: 2015-01-14
Description: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00014.html; http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00002.html; http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00031.html
CVE: CVE-2014-8636
Published: 2015-01-14
Description: The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with a DOM object that has a named getter, which might allow remote attackers to execute arbitrary JavaScript code with chrome privileges via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00014.html; http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00032.html; http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00033.html
CVE: CVE-2014-8637
Published: 2015-01-14
Description: Mozilla Firefox before 35.0 and SeaMonkey before 2.32 do not properly initialize memory for BMP images, which allows remote attackers to obtain sensitive information from process memory via a crafted web page that triggers the rendering of malformed BMP data within a CANVAS element.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00014.html; http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00032.html; http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00033.html
CVE: CVE-2014-8638
Published: 2015-01-14
Description: The navigator.sendBeacon implementation in Mozilla Firefox before 35.0, Firefox ESR 31.x before 31.4, Thunderbird before 31.4, and SeaMonkey before 2.32 omits the CORS Origin header, which allows remote attackers to bypass intended CORS access-control checks and conduct cross-site request forgery (CSRF) attacks via a crafted web site.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://linux.oracle.com/errata/ELSA-2015-0046.html; http://linux.oracle.com/errata/ELSA-2015-0047.html; http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00014.html
CVE: CVE-2014-8639
Published: 2015-01-14
Description: Mozilla Firefox before 35.0, Firefox ESR 31.x before 31.4, Thunderbird before 31.4, and SeaMonkey before 2.32 do not properly interpret Set-Cookie headers within responses that have a 407 (aka Proxy Authentication Required) status code, which allows remote HTTP proxy servers to conduct session fixation attacks by providing a cookie name that corresponds to the session cookie of the origin server.
CVSS Score: 6.8 (MEDIUM)
References: http://linux.oracle.com/errata/ELSA-2015-0046.html; http://linux.oracle.com/errata/ELSA-2015-0047.html; http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00014.html
CVE: CVE-2014-8640
Published: 2015-01-14
Description: The mozilla::dom::AudioParamTimeline::AudioNodeInputValue function in the Web Audio API implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly restrict timeline operations, which allows remote attackers to cause a denial of service (uninitialized-memory read and application crash) via crafted API calls.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-362
References: http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00014.html; http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00032.html; http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00033.html
CVE: CVE-2014-8641
Published: 2015-01-14
Description: Use-after-free vulnerability in the WebRTC implementation in Mozilla Firefox before 35.0, Firefox ESR 31.x before 31.4, and SeaMonkey before 2.32 allows remote attackers to execute arbitrary code via crafted track data.
CVSS Score: 7.5 (HIGH)
References: http://linux.oracle.com/errata/ELSA-2015-0046.html; http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00014.html; http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00032.html
CVE: CVE-2014-8642
Published: 2015-01-14
Description: Mozilla Firefox before 35.0 and SeaMonkey before 2.32 do not consider the id-pkix-ocsp-nocheck extension in deciding whether to trust an OCSP responder, which makes it easier for remote attackers to obtain sensitive information by sniffing the network during a session in which there was an incorrect decision to accept a compromised and revoked certificate.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-310
References: http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00014.html; http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00002.html; http://secunia.com/advisories/62242
CVE: CVE-2014-8643
Published: 2015-01-14
Description: Mozilla Firefox before 35.0 on Windows allows remote attackers to bypass the Gecko Media Plugin (GMP) sandbox protection mechanism by leveraging access to the GMP process, as demonstrated by the OpenH264 plugin's process.
CVSS Score: 7.1 (HIGH)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00014.html; http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00002.html; http://secunia.com/advisories/62253
CVE: CVE-2014-3314
Published: 2015-01-14
Description: Cisco AnyConnect on Android and OS X does not properly verify the host type, which allows remote attackers to spoof authentication forms and possibly capture credentials via unspecified vectors, aka Bug IDs CSCuo24931 and CSCuo24940.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3314; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3314
CVE: CVE-2015-0577
Published: 2015-01-14
Description: Multiple cross-site scripting (XSS) vulnerabilities in the IronPort Spam Quarantine (ISQ) page in Cisco AsyncOS, as used on the Cisco Email Security Appliance (ESA) and Content Security Management Appliance (SMA), allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug IDs CSCus22925 and CSCup08113.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/62289; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015-0577; http://www.securityfocus.com/bid/72056
CVE: CVE-2015-0578
Published: 2015-01-14
Description: Cisco Adaptive Security Appliance (ASA) Software, when a DHCPv6 relay is configured, allows remote attackers to cause a denial of service (device reload) via crafted DHCP packets on the local network, aka Bug ID CSCur45455.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-20, CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015-0578; http://www.securityfocus.com/bid/72718; http://www.securitytracker.com/id/1031542
CVE: CVE-2015-0579
Published: 2015-01-14
Description: Cisco TelePresence Video Communication Server (VCS) and Cisco Expressway allow remote attackers to cause a denial of service (memory and CPU consumption, and partial outage) via crafted SIP packets, aka Bug ID CSCur12473.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015-0579; http://www.securityfocus.com/bid/72057; http://www.securitytracker.com/id/1031541
CVE: CVE-2015-0583
Published: 2015-01-14
Description: Cisco WebEx Meeting Center does not properly restrict the content of URLs, which allows remote attackers to obtain sensitive information via vectors related to file: URIs, aka Bug ID CSCus18281.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015-0583; http://www.securityfocus.com/bid/72012; https://exchange.xforce.ibmcloud.com/vulnerabilities/100565
CVE: CVE-2014-0171
Published: 2015-01-15
Description: XML external entity (XXE) vulnerability in StaxXMLFactoryProvider2 in Odata4j, as used in Red Hat JBoss Data Virtualization before 6.0.0 patch 4, allows remote attackers to read arbitrary files via a crafted request to a REST endpoint.
CVSS Score: 5.0 (MEDIUM)
References: http://rhn.redhat.com/errata/RHSA-2015-0034.html; https://issues.jboss.org/browse/TEIID-2911; http://rhn.redhat.com/errata/RHSA-2015-0034.html
CVE: CVE-2014-7811
Published: 2015-01-15
Description: Multiple cross-site scripting (XSS) vulnerabilities in Spacewalk and Red Hat Network (RHN) Satellite before 5.7.0 allow remote authenticated users to inject arbitrary web script or HTML via crafted XML data to the REST API.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00020.html; http://rhn.redhat.com/errata/RHSA-2015-0033.html; http://secunia.com/advisories/62183
CVE: CVE-2014-7812
Published: 2015-01-15
Description: Cross-site scripting (XSS) vulnerability in Spacewalk and Red Hat Network (RHN) Satellite before 5.7.0 allows remote authenticated users to inject arbitrary web script or HTML via the System Groups field.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00020.html; http://rhn.redhat.com/errata/RHSA-2015-0033.html; http://secunia.com/advisories/62183
CVE: CVE-2014-7956
Published: 2015-01-15
Description: Cross-site scripting (XSS) vulnerability in the Pods plugin before 2.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the id parameter in an edit action in the pods page to wp-admin/admin.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/129890/WordPress-Pods-2.4.3-CSRF-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2015/Jan/26; http://www.securityfocus.com/archive/1/534437/100/0/threaded
CVE: CVE-2014-7957
Published: 2015-01-15
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the Pods plugin before 2.5 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) conduct cross-site scripting (XSS) attacks via the toggled parameter in a toggle action in the pods-components page to wp-admin/admin.php, (2) delete a pod in a delete action in the pods page to wp-admin/admin.php, (3) reset pod settings and data via the pods_reset parameter in the pod-settings page to wp-admin/admin.php, (4) deactivate and reset pod data via the pods_reset_deactivate parameter in the pod-settings page to wp-admin/admin.php, (5) delete the admin role via the id parameter in a delete action in the pods-component-roles-and-capabilities page to wp-admin/admin.php, or (6) enable "roles and capabilities" in a toggle action in the pods-components page to wp-admin/admin.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.com/files/129890/WordPress-Pods-2.4.3-CSRF-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2015/Jan/26; http://www.securityfocus.com/archive/1/534437/100/0/threaded
CVE: CVE-2014-8150
Published: 2015-01-15
Description: CRLF injection vulnerability in libcurl 6.0 through 7.x before 7.40.0, when using an HTTP proxy, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in a URL.
CVSS Score: 4.3 (MEDIUM)
References: http://advisories.mageia.org/MGASA-2015-0020.html; http://curl.haxx.se/docs/adv_20150108B.html; http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10743
CVE: CVE-2014-8151
Published: 2015-01-15
Description: The darwinssl_connect_step1 function in lib/vtls/curl_darwinssl.c in libcurl 7.31.0 through 7.39.0, when using the DarwinSSL (aka SecureTransport) back-end for TLS, does not check if a cached TLS session validated the certificate when reusing the session, which allows man-in-the-middle attackers to spoof servers via a crafted certificate.
CVSS Score: 5.8 (MEDIUM)
References: http://curl.haxx.se/docs/adv_20150108A.html; http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10743; http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html
CVE: CVE-2014-8153
Published: 2015-01-15
Description: The L3 agent in OpenStack Neutron 2014.2.x before 2014.2.2, when using radvd 2.0+, allows remote authenticated users to cause a denial of service (blocked router update processing) by creating eight routers and assigning an ipv6 non-provider subnet to each.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-20
References: http://lists.openstack.org/pipermail/openstack-announce/2015-January/000320.html; http://www.securityfocus.com/bid/71961; https://bugs.launchpad.net/neutron/+bug/1398779
CVE: CVE-2014-8394
Published: 2015-01-15
Description: Multiple untrusted search path vulnerabilities in Corel CAD 2014 allow local users to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse (1) FxManagedCommands_3.08_9.tx or (2) TD_Mgd_3.08_9.dll file in the current working directory.
CVSS Score: 4.6 (MEDIUM)
References: http://seclists.org/fulldisclosure/2015/Jan/33; http://www.coresecurity.com/advisories/corel-software-dll-hijacking; http://www.securityfocus.com/archive/1/534452/100/0/threaded
CVE: CVE-2014-8395
Published: 2015-01-15
Description: Untrusted search path vulnerability in Corel Painter 2015 allows local users to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse wacommt.dll file that is located in the same folder as the file being processed.
CVSS Score: 4.6 (MEDIUM)
References: http://seclists.org/fulldisclosure/2015/Jan/33; http://www.coresecurity.com/advisories/corel-software-dll-hijacking; http://www.securityfocus.com/archive/1/534452/100/0/threaded
CVE: CVE-2014-8396
Published: 2015-01-15
Description: Untrusted search path vulnerability in Corel PDF Fusion allows local users to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse quserex.dll file that is located in the same folder as the file being processed.
CVSS Score: 4.6 (MEDIUM)
References: http://seclists.org/fulldisclosure/2015/Jan/33; http://www.coresecurity.com/advisories/corel-software-dll-hijacking; http://www.securityfocus.com/archive/1/534452/100/0/threaded
CVE: CVE-2014-8397
Published: 2015-01-15
Description: Untrusted search path vulnerability in Corel VideoStudio PRO X7 or FastFlick allows local users to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse u32ZLib.dll file that is located in the same folder as the file being processed.
CVSS Score: 4.6 (MEDIUM)
References: http://seclists.org/fulldisclosure/2015/Jan/33; http://www.coresecurity.com/advisories/corel-software-dll-hijacking; http://www.securityfocus.com/archive/1/534452/100/0/threaded
CVE: CVE-2014-8398
Published: 2015-01-15
Description: Multiple untrusted search path vulnerabilities in Corel FastFlick allow local users to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse (1) igfxcmrt32.dll, (2) ipl.dll, (3) MSPStyleLib.dll, (4) uFioUtil.dll, (5) uhDSPlay.dll, (6) uipl.dll, (7) uvipl.dll, (8) VC1DecDll.dll, or (9) VC1DecDll_SSE3.dll file that is located in the same folder as the file being processed.
CVSS Score: 4.6 (MEDIUM)
References: http://seclists.org/fulldisclosure/2015/Jan/33; http://www.coresecurity.com/advisories/corel-software-dll-hijacking; http://www.securityfocus.com/archive/1/534452/100/0/threaded
CVE: CVE-2014-8738
Published: 2015-01-15
Description: The _bfd_slurp_extended_name_table function in bfd/archive.c in GNU binutils 2.24 and earlier allows remote attackers to cause a denial of service (invalid write, segmentation fault, and crash) via a crafted extended name table in an archive.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-January/147346.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-January/147354.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148427.html
CVE: CVE-2014-8869
Published: 2015-01-15
Description: Multiple cross-site scripting (XSS) vulnerabilities in mobiquo/smartbanner/welcome.php in the Tapatalk (com.tapatalk.wbb4) plugin 1.x before 1.1.2 for Woltlab Burning Board 4.0 allow remote attackers to inject arbitrary web script or HTML via the (1) app_android_id or (2) app_kindle_url parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2015/Jan/31; http://www.securityfocus.com/archive/1/534449/100/0/threaded; http://www.securityfocus.com/bid/71997