deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-1301
Published: 2014-04-02
Description: WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2014-04/0009.html; https://support.apple.com/kb/HT6537; http://archives.neohapsis.com/archives/bugtraq/2014-04/0009.html
CVE: CVE-2014-1302
Published: 2014-04-02
Description: WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2014-04/0009.html; http://archives.neohapsis.com/archives/bugtraq/2014-04/0135.html; http://archives.neohapsis.com/archives/bugtraq/2014-04/0136.html
CVE: CVE-2014-1304
Published: 2014-04-02
Description: WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2014-04/0009.html; http://archives.neohapsis.com/archives/bugtraq/2014-04/0135.html; http://archives.neohapsis.com/archives/bugtraq/2014-04/0136.html
CVE: CVE-2014-1305
Published: 2014-04-02
Description: WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2014-04/0009.html; http://archives.neohapsis.com/archives/bugtraq/2014-04/0135.html; http://archives.neohapsis.com/archives/bugtraq/2014-04/0136.html
CVE: CVE-2014-1307
Published: 2014-04-02
Description: WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2014-04/0009.html; http://archives.neohapsis.com/archives/bugtraq/2014-04/0135.html; http://archives.neohapsis.com/archives/bugtraq/2014-04/0136.html
CVE: CVE-2014-1308
Published: 2014-04-02
Description: WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2014-04/0009.html; http://archives.neohapsis.com/archives/bugtraq/2014-04/0135.html; http://archives.neohapsis.com/archives/bugtraq/2014-04/0136.html
CVE: CVE-2014-1309
Published: 2014-04-02
Description: WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2014-04/0009.html; http://archives.neohapsis.com/archives/bugtraq/2014-04/0135.html; http://archives.neohapsis.com/archives/bugtraq/2014-04/0136.html
CVE: CVE-2014-1310
Published: 2014-04-02
Description: WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2014-04/0009.html; http://archives.neohapsis.com/archives/bugtraq/2014-04/0135.html; http://archives.neohapsis.com/archives/bugtraq/2014-04/0136.html
CVE: CVE-2014-1311
Published: 2014-04-02
Description: WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2014-04/0009.html; http://archives.neohapsis.com/archives/bugtraq/2014-04/0135.html; http://archives.neohapsis.com/archives/bugtraq/2014-04/0136.html
CVE: CVE-2014-1312
Published: 2014-04-02
Description: WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2014-04/0009.html; http://archives.neohapsis.com/archives/bugtraq/2014-04/0135.html; http://archives.neohapsis.com/archives/bugtraq/2014-04/0136.html
CVE: CVE-2014-1313
Published: 2014-04-02
Description: WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2014-04/0009.html; http://archives.neohapsis.com/archives/bugtraq/2014-04/0135.html; http://archives.neohapsis.com/archives/bugtraq/2014-04/0136.html
CVE: CVE-2013-0735
Published: 2014-04-02
Description: Multiple SQL injection vulnerabilities in wpf.class.php in the Mingle Forum plugin before 1.0.34 for WordPress allow remote attackers to execute arbitrary SQL commands via the id parameter in a viewtopic (1) remove_post, (2) sticky, or (3) closed action or (4) thread parameter in a postreply action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/90434; http://secunia.com/advisories/52167; http://secunia.com/secunia_research/2013-4
CVE: CVE-2013-7352
Published: 2014-04-02
Description: Cross-site request forgery (CSRF) vulnerability in blogs/admin.php in b2evolution before 4.1.7 allows remote attackers to hijack the authentication of administrators for requests that conduct SQL injection attacks via the show_statuses[] parameter, related to CVE-2013-2945.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://archives.neohapsis.com/archives/bugtraq/2013-05/0004.html; http://b2evolution.net/news/2013/04/29/b2evolution-4-1-7-and-5-0-3; http://osvdb.org/show/osvdb/92906
CVE: CVE-2014-0093
Published: 2014-04-03
Description: Red Hat JBoss Enterprise Application Platform (JBEAP) 6.2.2, when using a Java Security Manager (JSM), does not properly apply permissions defined by a policy file, which causes applications to be granted the java.security.AllPermission permission and allows remote attackers to bypass intended access restrictions.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-264
References: http://rhn.redhat.com/errata/RHSA-2014-0343.html; http://rhn.redhat.com/errata/RHSA-2014-0344.html; http://rhn.redhat.com/errata/RHSA-2014-0345.html
CVE: CVE-2014-0466
Published: 2014-04-03
Description: The fixps script in a2ps 4.14 does not use the -dSAFER option when executing gs, which allows context-dependent attackers to delete arbitrary files or execute arbitrary commands via a crafted PostScript file.
CVSS Score: 6.8 (MEDIUM)
References: http://lists.opensuse.org/opensuse-updates/2014-04/msg00021.html; http://www.debian.org/security/2014/dsa-2892; http://www.securityfocus.com/bid/66660
CVE: CVE-2014-2340
Published: 2014-04-03
Description: Cross-site request forgery (CSRF) vulnerability in the XCloner plugin before 3.1.1 for WordPress allows remote attackers to hijack the authentication of administrators for requests that create website backups via a request to wp-admin/plugins.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://secunia.com/advisories/57362; http://wordpress.org/plugins/xcloner-backup-and-restore/changelog/; http://www.exploit-db.com/exploits/32701
CVE: CVE-2012-4920
Published: 2014-04-04
Description: Directory traversal vulnerability in the zing_forum_output function in forum.php in the Zingiri Forum (aka Forums) plugin before 1.4.4 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the url parameter to index.php.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/89069; http://secunia.com/advisories/50833; http://wordpress.org/plugins/zingiri-forum/changelog
CVE: CVE-2012-5648
Published: 2014-04-04
Description: Multiple SQL injection vulnerabilities in Foreman before 1.0.2 allow remote attackers to execute arbitrary SQL commands via unspecified parameters to (1) app/models/hostext/search.rb or (2) app/models/puppetclass.rb, related to the search mechanism.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/show/osvdb/88618; http://osvdb.org/show/osvdb/88623; http://seclists.org/oss-sec/2012/q4/499
CVE: CVE-2012-6429
Published: 2014-04-04
Description: Buffer overflow in the PrepareSync method in the SyncService.dll ActiveX control in Samsung Kies before 2.5.1.12123_2_7 allows remote attackers to execute arbitrary code via a long string to the password argument.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2013-01/0036.html; http://osvdb.org/89118; http://packetstormsecurity.com/files/119423/Samsung-Kies-2.5.0.12114_1-Buffer-Overflow.html
CVE: CVE-2013-2287
Published: 2014-04-04
Description: Multiple cross-site scripting (XSS) vulnerabilities in views/notify.php in the Uploader plugin 1.0.4 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) notify or (2) blog parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/90840; https://www.dognaedis.com/vulns/DGS-SEC-16.html; http://osvdb.org/90840
CVE: CVE-2013-3930
Published: 2014-04-04
Description: Stack-based buffer overflow in Core FTP before 2.2 build 1785 allows remote FTP servers to execute arbitrary code via a crafted directory name in a CWD command reply.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/96314; http://secunia.com/advisories/53743; http://www.coreftp.com/forums/viewtopic.php?t=222102
CVE: CVE-2014-0592
Published: 2014-04-04
Description: Barclamp (aka barclamp-network) 1.7 for the Crowbar Framework, as used in SUSE Cloud 3, does not enable netfilter on bridges when creating new instances, which allows remote attackers to bypass security group restrictions via unspecified vectors, related to floating IPs.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00025.html; http://secunia.com/advisories/57509; http://www.securityfocus.com/bid/66519
CVE: CVE-2014-0637
Published: 2014-04-04
Description: Cross-site scripting (XSS) vulnerability in the back-office case-management application in RSA Adaptive Authentication (On-Premise) 6.x and 7.x before 7.1 SP0 P2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2014-04/0007.html; http://archives.neohapsis.com/archives/bugtraq/2014-04/0007.html
CVE: CVE-2014-0638
Published: 2014-04-04
Description: Cross-site scripting (XSS) vulnerability in RSA Adaptive Authentication (On-Premise) 6.x and 7.x before 7.1 SP0 P2 allows remote attackers to inject arbitrary web script or HTML via vectors involving FRAME elements, related to a "cross-frame scripting" issue.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2014-04/0007.html; http://archives.neohapsis.com/archives/bugtraq/2014-04/0007.html
CVE: CVE-2014-0789
Published: 2014-04-04
Description: Multiple buffer overflows in the OPC Automation 2.0 Server Object ActiveX control in Schneider Electric OPC Factory Server (OFS) TLXCDSUOFS33 3.5 and earlier, TLXCDSTOFS33 3.5 and earlier, TLXCDLUOFS33 3.5 and earlier, TLXCDLTOFS33 3.5 and earlier, and TLXCDLFOFS33 3.5 and earlier allow remote attackers to cause a denial of service via long arguments to unspecified functions.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-122, CWE-119
References: http://www.schneider-electric.com/corporate/en/support/cybersecurity/viewer-news.page?c_filepath=/templatedata/Content/News/data/en/local/cybersecurity/general_information/2014/03/20140325_vulnerability_disclosure_opc_factory_server.xml; http://www2.schneider-electric.com/sites/corporate/en/support/cybersecurity/cybersecurity.page; https://www.cisa.gov/news-events/ics-advisories/icsa-14-093-01
CVE: CVE-2014-2114
Published: 2014-04-04
Description: Cross-site scripting (XSS) vulnerability in UserServlet in Cisco Emergency Responder (ER) 8.6 and earlier allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCun24384.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2114; http://tools.cisco.com/security/center/viewAlert.x?alertId=33644; http://www.securityfocus.com/bid/66635
CVE: CVE-2014-2115
Published: 2014-04-04
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in CERUserServlet pages in Cisco Emergency Responder (ER) 8.6 and earlier allow remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCun24250.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2115; http://tools.cisco.com/security/center/viewAlert.x?alertId=33643; http://www.securityfocus.com/bid/66631
CVE: CVE-2014-2116
Published: 2014-04-04
Description: Cisco Emergency Responder (ER) 8.6 and earlier allows remote attackers to inject web pages and modify dynamic content via unspecified parameters, aka Bug ID CSCun37882.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2116; http://tools.cisco.com/security/center/viewAlert.x?alertId=33641; http://www.securityfocus.com/bid/66632
CVE: CVE-2014-2117
Published: 2014-04-04
Description: Multiple open redirect vulnerabilities in Cisco Emergency Responder (ER) 8.6 and earlier allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified parameters, aka Bug ID CSCun37909.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2117; http://tools.cisco.com/security/center/viewAlert.x?alertId=33642; http://www.securityfocus.com/bid/66634
CVE: CVE-2014-2143
Published: 2014-04-04
Description: The IKE implementation in Cisco IOS 15.4(1)T and earlier and IOS XE allows remote attackers to cause a denial of service (security-association drop) via crafted Main Mode packets, aka Bug ID CSCun31021.
CVSS Score: 5.0 (MEDIUM)
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2143; http://tools.cisco.com/security/center/viewAlert.x?alertId=33639; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2143
CVE: CVE-2014-2210
Published: 2014-04-04
Description: Multiple directory traversal vulnerabilities in CA ERwin Web Portal 9.5 allow remote attackers to obtain sensitive information, bypass intended access restrictions, cause a denial of service, or possibly execute arbitrary code via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://www.securityfocus.com/bid/66644; http://www.securitytracker.com/id/1030017; https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=%7B7F968A14-7407-4BCF-9EB1-EFE9F0E6D663%7D
CVE: CVE-2014-0337
Published: 2014-04-05
Description: Cross-site scripting (XSS) vulnerability in the web interface on Huawei Echo Life HG8247 routers with software before V100R006C00SPC127 allows remote attackers to inject arbitrary web script or HTML via an invalid TELNET connection attempt with a crafted username that is not properly handled during construction of the "failed log-in attempts over telnet" log view.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.kb.cert.org/vuls/id/917700; http://www.kb.cert.org/vuls/id/917700
CVE: CVE-2014-0827
Published: 2014-04-05
Description: Cross-site scripting (XSS) vulnerability in IBM InfoSphere Optim Workload Replay 1.1 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21669093; http://www.securityfocus.com/bid/66621; https://exchange.xforce.ibmcloud.com/vulnerabilities/90503
CVE: CVE-2014-2144
Published: 2014-04-05
Description: Cisco IOS XR does not properly throttle ICMPv6 redirect packets, which allows remote attackers to cause a denial of service (IPv4 and IPv6 transit outage) via crafted redirect messages, aka Bug ID CSCum14266.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2144; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2144
CVE: CVE-2014-2145
Published: 2014-04-05
Description: Directory traversal vulnerability in the messaging API in Cisco Unity Connection allows remote authenticated users to read arbitrary files via vectors related to unenforced access constraints for .wav files and the audio/x-wav MIME type, aka Bug ID CSCun91071.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-22
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2145; http://www.securityfocus.com/bid/66676; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2145
CVE: CVE-2014-2600
Published: 2014-04-05
Description: Unspecified vulnerability in HP IceWall Identity Manager 4.0 through SP1 and 5.0 and IceWall SSO 10.0 Password Reset Option, when Apache Commons FileUpload is used, allows remote authenticated users to cause a denial of service via unknown vectors.
CVSS Score: 4.0 (MEDIUM)
References: http://h20565.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?docId=emr_na-c04214298; http://h20565.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?docId=emr_na-c04214298
CVE: CVE-2014-2730
Published: 2014-04-05
Description: The XML parser in Microsoft Office 2007 SP3, 2010 SP1 and SP2, and 2013, and Office for Mac 2011, does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory consumption and persistent application hang) via a crafted XML document containing a large number of nested entity references, as demonstrated by a crafted text/plain e-mail message to Outlook, a similar issue to CVE-2003-1564.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://www.securityfocus.com/archive/1/531722/100/0/threaded; http://www.securityfocus.com/archive/1/531722/100/0/threaded
CVE: CVE-2001-1593
Published: 2014-04-05
Description: The tempname_ensure function in lib/routines.h in a2ps 4.14 and earlier, as used by the spy_user function and possibly other functions, allows local users to modify arbitrary files via a symlink attack on a temporary file.
CVSS Score: 2.1 (LOW)
CWE: CWE-59
References: http://pkgs.fedoraproject.org/cgit/a2ps.git/plain/a2ps-4.13-security.patch; http://seclists.org/oss-sec/2014/q1/237; http://seclists.org/oss-sec/2014/q1/253
CVE: CVE-2012-5565
Published: 2014-04-05
Description: Cross-site scripting (XSS) vulnerability in js/compose-dimp.js in Horde Internet Mail Program (IMP) before 5.0.24, as used in Horde Groupware Webmail Edition before 4.0.9, allows remote attackers to inject arbitrary web script or HTML via a crafted name for an attached file, related to the dynamic view.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.horde.org/archives/announce/2012/000833.html; http://lists.horde.org/archives/announce/2012/000840.html; http://lists.opensuse.org/opensuse-updates/2012-12/msg00020.html
CVE: CVE-2012-5566
Published: 2014-04-05
Description: Multiple cross-site scripting (XSS) vulnerabilities in Horde Kronolith Calendar Application H4 before 3.0.17, as used in Horde Groupware Webmail Edition before 4.0.8, allow remote attackers to inject arbitrary web script or HTML via the (1) tasks view or (2) search view.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://bugs.horde.org/ticket/11189; http://git.horde.org/horde-git/-/commit/1228a6825a8dab3333d0a8c8986fc10d1f3d11b2; http://lists.horde.org/archives/announce/2012/000773.html
CVE: CVE-2012-5567
Published: 2014-04-05
Description: Multiple cross-site scripting (XSS) vulnerabilities in Horde Kronolith Calendar Application H4 before 3.0.18, as used in Horde Groupware Webmail Edition before 4.0.9, allow remote attackers to inject arbitrary web script or HTML via crafted event location parameters in the (1) month, (2) monthlist, or (3) prevmonthlist fields, related to portal blocks.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://git.horde.org/horde-git/-/commit/d865c564beb6e98532880aa51a04a79f3311cd1e; http://lists.horde.org/archives/announce/2012/000836.html; http://lists.opensuse.org/opensuse-updates/2012-12/msg00019.html
CVE: CVE-2012-6640
Published: 2014-04-05
Description: Cross-site scripting (XSS) vulnerability in Horde Internet Mail Program (IMP) before 5.0.22, as used in Horde Groupware Webmail Edition before 4.0.9, allows remote attackers to inject arbitrary web script or HTML via a crafted SVG image attachment, a different vulnerability than CVE-2012-5565.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.horde.org/archives/announce/2012/000775.html; http://lists.horde.org/archives/announce/2012/000840.html; https://github.com/horde/horde/commit/08c699f744b6d2be1a5f3a2ba7203f4631b4c5dc
CVE: CVE-2013-1946
Published: 2014-04-06
Description: The RESTful Web Services (RESTWS) module 7.x-1.x before 7.x-1.3 and 7.x-2.x before 7.x-2.0-alpha5 for Drupal, when page caching is enabled and anonymous users are assigned RESTWS permissions, allows remote attackers to cause a denial of service via a GET request with an HTTP Accept header set to a non-HTML type, which can "interfere with Drupal's page cache."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2013/04/12/1; http://www.osvdb.org/92259; https://drupal.org/node/1966752
CVE: CVE-2013-5680
Published: 2014-04-06
Description: Heap-based buffer overflow in hfaxd in HylaFAX+ 5.2.4 through 5.5.3, when using LDAP authentication, might allow remote attackers to cause a denial of service (child hang) or execute arbitrary code via a long USER command.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://hylafax.sourceforge.net/news/5.5.4.php; http://securitytracker.com/id?1029119; http://www.exploit-db.com/exploits/28683