deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-3328
Published: 2014-07-26
Description: The Intercluster Sync Agent Service in Cisco Unified Presence Server allows remote attackers to cause a denial of service via a TCP SYN flood, aka Bug ID CSCun34125.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-400
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3328; http://www.securityfocus.com/bid/68901; http://www.securitytracker.com/id/1030643
CVE: CVE-2014-4858
Published: 2014-07-26
Description: Multiple SQL injection vulnerabilities in CWPLogin.aspx in Sabre AirCentre Crew products 2010.2.12.20008 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) password field.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.kb.cert.org/vuls/id/394540; http://www.securityfocus.com/bid/68899; http://www.kb.cert.org/vuls/id/394540
CVE: CVE-2014-4979
Published: 2014-07-26
Description: Apple QuickTime allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a malformed version number and flags in an mvhd atom.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://support.apple.com/kb/HT6443; http://www.securityfocus.com/bid/68852; http://www.securitytracker.com/id/1030638
CVE: CVE-2014-2625
Published: 2014-07-26
Description: Directory traversal vulnerability in the storedNtxFile function in HP Network Virtualization 8.6 (aka Shunra Network Virtualization) allows remote attackers to read arbitrary files via crafted input, aka ZDI-CAN-2023.
CVSS Score: 8.5 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/60418; http://www.securitytracker.com/id/1030624; http://zerodayinitiative.com/advisories/ZDI-14-267/
CVE: CVE-2014-2626
Published: 2014-07-26
Description: Directory traversal vulnerability in the toServerObject function in HP Network Virtualization 8.6 (aka Shunra Network Virtualization) allows remote attackers to create files, and consequently execute arbitrary code, via crafted input, aka ZDI-CAN-2024.
CVSS Score: 9.4 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/60418; http://www.securitytracker.com/id/1030624; http://zerodayinitiative.com/advisories/ZDI-14-268/
CVE: CVE-2014-2966
Published: 2014-07-26
Description: The ISO-8859-1 encoder in Resin Pro before 4.0.40 does not properly perform Unicode transformations, which allows remote attackers to bypass intended text restrictions via crafted characters, as demonstrated by bypassing an XSS protection mechanism.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20, CWE-264
References: http://caucho.com/products/resin/download#download; http://www.kb.cert.org/vuls/id/162308; http://caucho.com/products/resin/download#download
CVE: CVE-2014-4747
Published: 2014-07-26
Description: The Classic Meeting Server in IBM Sametime 8.x through 8.5.2.1 allows physically proximate attackers to discover a meeting password hash by leveraging access to an unattended workstation to read HTML source code within a victim's browser.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://linux.oracle.com/errata/ELSA-2014-0747.html; http://packetstormsecurity.com/files/127830/IBM-Sametime-Meet-Server-8.5-Password-Disclosure.html; http://www-01.ibm.com/support/docview.wss?uid=swg21679221
CVE: CVE-2014-4748
Published: 2014-07-26
Description: Cross-site scripting (XSS) vulnerability in the Classic Meeting Server in IBM Sametime 8.x through 8.5.2.1 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://linux.oracle.com/errata/ELSA-2014-0747.html; http://packetstormsecurity.com/files/127831/IBM-Sametime-Meet-Server-8.5-Cross-Site-Scripting.html; http://secunia.com/advisories/60202
CVE: CVE-2014-4857
Published: 2014-07-26
Description: Cross-site scripting (XSS) vulnerability in Gurock TestRail before 3.1.3 allows remote attackers to inject arbitrary web script or HTML via the Created By field in a project activity.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://forum.gurock.com/topic/1652/testrail-313-released/; http://www.kb.cert.org/vuls/id/669804; http://forum.gurock.com/topic/1652/testrail-313-released/
CVE: CVE-2014-4971
Published: 2014-07-26
Description: Microsoft Windows XP SP3 does not validate addresses in certain IRP handler routines, which allows local users to write data to arbitrary memory locations, and consequently gain privileges, via a crafted address in an IOCTL call, related to (1) the MQAC.sys driver in the MQ Access Control subsystem and (2) the BthPan.sys driver in the Bluetooth Personal Area Networking subsystem.
CVSS Score: 7.2 (HIGH)
CWE: CWE-20
References: http://blogs.technet.com/b/srd/archive/2014/10/14/accessing-risk-for-the-october-2014-security-updates.aspx; http://packetstormsecurity.com/files/127535/Microsoft-XP-SP3-BthPan.sys-Arbitrary-Write-Privilege-Escalation.html; http://packetstormsecurity.com/files/127536/Microsoft-XP-SP3-MQAC.sys-Arbitrary-Write-Privilege-Escalation.html
CVE: CVE-2014-4725
Published: 2014-07-27
Description: The MailPoet Newsletters (wysija-newsletters) plugin before 2.6.7 for WordPress allows remote attackers to bypass authentication and execute arbitrary PHP code by uploading a crafted theme using wp-admin/admin-post.php and accessing the theme in wp-content/uploads/wysija/themes/mailp/.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://arstechnica.com/security/2014/07/mass-exploit-of-wordpress-plugin-backdoors-sites-running-joomla-magento-too/; http://blog.sucuri.net/2014/07/mailpoet-vulnerability-exploited-in-the-wild-breaking-thousands-of-wordpress-sites.html; http://blog.sucuri.net/2014/07/malware-infection-breaking-wordpress-sites.html
CVE: CVE-2014-4726
Published: 2014-07-27
Description: Unspecified vulnerability in the MailPoet Newsletters (wysija-newsletters) plugin before 2.6.8 for WordPress has unspecified impact and attack vectors.
CVSS Score: 7.5 (HIGH)
References: http://www.openwall.com/lists/oss-security/2014/07/08/7; https://wordpress.org/plugins/wysija-newsletters/changelog/; http://www.openwall.com/lists/oss-security/2014/07/08/7
CVE: CVE-2014-5104
Published: 2014-07-28
Description: Multiple SQL injection vulnerabilities in ol-commerce 2.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) a_country parameter in a process action to affiliate_signup.php, (2) affiliate_banner_id parameter to affiliate_show_banner.php, (3) country parameter in a process action to create_account.php, or (4) entry_country_id parameter in an edit action to admin/create_account.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/127521/OL-Commerce-2.1.1-Cross-Site-Scripting-SQL-Injection.html; http://www.securityfocus.com/bid/68719; http://packetstormsecurity.com/files/127521/OL-Commerce-2.1.1-Cross-Site-Scripting-SQL-Injection.html
CVE: CVE-2014-5105
Published: 2014-07-28
Description: Multiple cross-site scripting (XSS) vulnerabilities in ol-commerce 2.1.1 allow remote attackers to inject arbitrary web script or HTML via the (1) a_country parameter in a process action to affiliate_signup.php or (2) entry_country_id parameter in an edit action to admin/create_account.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/127521/OL-Commerce-2.1.1-Cross-Site-Scripting-SQL-Injection.html; http://www.securityfocus.com/bid/68719; http://packetstormsecurity.com/files/127521/OL-Commerce-2.1.1-Cross-Site-Scripting-SQL-Injection.html
CVE: CVE-2014-5106
Published: 2014-07-28
Description: Cross-site scripting (XSS) vulnerability in Invision Power IP.Board (aka IPB or Power Board) 3.4.x through 3.4.6 allows remote attackers to inject arbitrary web script or HTML via the HTTP Referer header to admin/install/index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/archive/1/532822/100/0/threaded; http://www.securityfocus.com/bid/68705; https://exchange.xforce.ibmcloud.com/vulnerabilities/94693
CVE: CVE-2014-5107
Published: 2014-07-28
Description: concrete5 before 5.6.3 allows remote attackers to obtain the installation path via a direct request to (1) system/basics/editor.php, (2) system/view.php, (3) system/environment/file_storage_locations.php, (4) system/mail/importers.php, (5) system/mail/method.php, (6) system/permissions/file_types.php, (7) system/permissions/files.php, (8) system/permissions/tasks.php, (9) system/permissions/users.php, (10) system/seo/view.php, (11) view.php, (12) users/attributes.php, (13) scrapbook/view.php, (14) pages/attributes.php, (15) files/attributes.php, or (16) files/search.php in single_pages/dashboard/.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://osvdb.org/show/osvdb/109269; http://packetstormsecurity.com/files/127493/Concrete-5.6.2.1-REFERER-Cross-Site-Scripting.html; http://www.securityfocus.com/bid/68685
CVE: CVE-2014-5108
Published: 2014-07-28
Description: Cross-site scripting (XSS) vulnerability in single_pages\download_file.php in concrete5 before 5.6.3 allows remote attackers to inject arbitrary web script or HTML via the HTTP Referer header to index.php/download_file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/show/osvdb/109273; http://packetstormsecurity.com/files/127493/Concrete-5.6.2.1-REFERER-Cross-Site-Scripting.html; http://www.securityfocus.com/bid/68685
CVE: CVE-2014-5109
Published: 2014-07-28
Description: SQL injection vulnerability in maint/modules/endpointcfg/endpoint_generic.php in Fonality trixbox allows remote attackers to execute arbitrary SQL commands via the mac parameter in a Submit action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/127522/Trixbox-XSS-LFI-SQL-Injection-Code-Execution.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/94718; http://packetstormsecurity.com/files/127522/Trixbox-XSS-LFI-SQL-Injection-Code-Execution.html
CVE: CVE-2014-5110
Published: 2014-07-28
Description: Cross-site scripting (XSS) vulnerability in user/help/html/index.php in Fonality trixbox allows remote attackers to inject arbitrary web script or HTML via the id_nodo parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/127522/Trixbox-XSS-LFI-SQL-Injection-Code-Execution.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/94719; http://packetstormsecurity.com/files/127522/Trixbox-XSS-LFI-SQL-Injection-Code-Execution.html
CVE: CVE-2014-5111
Published: 2014-07-28
Description: Multiple directory traversal vulnerabilities in Fonality trixbox allow remote attackers to read arbitrary files via a .. (dot dot) in the lang parameter to (1) home/index.php, (2) asterisk_info/asterisk_info.php, (3) repo/repo.php, or (4) endpointcfg/endpointcfg.php in maint/modules/.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.com/files/127522/Trixbox-XSS-LFI-SQL-Injection-Code-Execution.html; http://packetstormsecurity.com/files/127522/Trixbox-XSS-LFI-SQL-Injection-Code-Execution.html
CVE: CVE-2014-5112
Published: 2014-07-28
Description: maint/modules/home/index.php in Fonality trixbox allows remote attackers to execute arbitrary commands via shell metacharacters in the lang parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://packetstormsecurity.com/files/127522/Trixbox-XSS-LFI-SQL-Injection-Code-Execution.html; http://packetstormsecurity.com/files/127522/Trixbox-XSS-LFI-SQL-Injection-Code-Execution.html
CVE: CVE-2014-5113
Published: 2014-07-28
Description: Multiple cross-site scripting (XSS) vulnerabilities in test.php in Visualware MyConnection Server 9.7i allow remote attackers to inject arbitrary web script or HTML via the (1) testtype, (2) ver, (3) cm, (4) map, (5) lines, (6) pps, (7) bpp, (8) codec, (9) provtext, (10) provtextextra, (11) provlink, or (12) duration parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/127545/MyConnection-Server-MCS-9.7i-Cross-Site-Scripting.html; http://treadstonesecurity.blogspot.ca/2014/07/myconnection-server-mcs-reflective-xss.html; http://www.securityfocus.com/bid/68793
CVE: CVE-2013-4840
Published: 2014-07-28
Description: Unspecified vulnerability in HP and H3C VPN Firewall Module products SECPATH1000FE before 5.20.R3177 and SECBLADEFW before 5.20.R3177 allows remote attackers to cause a denial of service via unknown vectors.
CVSS Score: 7.8 (HIGH)
References: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03993467; https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03993467
CVE: CVE-2014-2974
Published: 2014-07-28
Description: Cross-site request forgery (CSRF) vulnerability in php/user_account.php in Silver Peak VX through 6.2.4 allows remote attackers to hijack the authentication of administrators for requests that create administrative accounts.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www.kb.cert.org/vuls/id/867980; http://www.kb.cert.org/vuls/id/867980
CVE: CVE-2014-2975
Published: 2014-07-28
Description: Cross-site scripting (XSS) vulnerability in php/user_account.php in Silver Peak VX before 6.2.4 allows remote attackers to inject arbitrary web script or HTML via the user_id parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.kb.cert.org/vuls/id/867980; http://www.securityfocus.com/bid/68923; http://www.kb.cert.org/vuls/id/867980
CVE: CVE-2014-3303
Published: 2014-07-28
Description: The web framework in Cisco WebEx Meetings Server does not properly restrict the content of query strings, which allows remote attackers to obtain sensitive information by reading (1) web-server access logs, (2) web-server Referer logs, or (3) the browser history, aka Bug ID CSCuj81713.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3303; http://www.securityfocus.com/bid/68910; http://www.securitytracker.com/id/1030645
CVE: CVE-2014-3304
Published: 2014-07-28
Description: The OutlookAction Class in Cisco WebEx Meetings Server allows remote attackers to enumerate user accounts by entering crafted URLs and examining the returned messages, aka Bug ID CSCuj81722.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3304; http://www.securityfocus.com/bid/68911; http://www.securitytracker.com/id/1030641
CVE: CVE-2013-4262
Published: 2014-07-28
Description: svnwcsub.py in Subversion 1.8.0 before 1.8.3, when using the --pidfile option and running in foreground mode, allows local users to gain privileges via a symlink attack on the pid file.  NOTE: this issue was SPLIT due to different affected versions (ADT3). The irkerbridge.py issue is covered by CVE-2013-7393.
CVSS Score: 2.4 (LOW)
CWE: CWE-59
References: http://www.oracle.com/technetwork/topics/security/bulletinoct2[PII_REDACTED].html; https://subversion.apache.org/security/CVE-2013-4262-advisory.txt; http://www.oracle.com/technetwork/topics/security/bulletinoct2[PII_REDACTED].html
CVE: CVE-2013-7393
Published: 2014-07-28
Description: The daemonize.py module in Subversion 1.8.0 before 1.8.2 allows local users to gain privileges via a symlink attack on the pid file created for (1) svnwcsub.py or (2) irkerbridge.py when the --pidfile option is used.  NOTE: this issue was SPLIT from CVE-2013-4262 based on different affected versions (ADT3).
CVSS Score: 2.4 (LOW)
CWE: CWE-59
References: http://www.oracle.com/technetwork/topics/security/bulletinoct2[PII_REDACTED].html; https://subversion.apache.org/security/CVE-2013-4262-advisory.txt; http://www.oracle.com/technetwork/topics/security/bulletinoct2[PII_REDACTED].html
CVE: CVE-2014-3120
Published: 2014-07-28
Description: The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to _search.  NOTE: this only violates the vendor's intended security policy if the user does not run Elasticsearch in its own independent virtual machine.
CVSS Score: 8.1 (HIGH)
CWE: CWE-284, CWE-284
References: http://bouk.co/blog/elasticsearch-rce/; http://www.exploit-db.com/exploits/33370; http://www.osvdb.org/106949
CVE: CVE-2014-3541
Published: 2014-07-29
Description: The Repositories component in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote attackers to conduct PHP object injection attacks and execute arbitrary code via serialized data associated with an add-on.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-45616; http://openwall.com/lists/oss-security/2014/07/21/1; https://moodle.org/mod/forum/discuss.php?d=264262
CVE: CVE-2014-3542
Published: 2014-07-29
Description: mod/lti/service.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-45463; http://openwall.com/lists/oss-security/2014/07/21/1; https://moodle.org/mod/forum/discuss.php?d=264263
CVE: CVE-2014-3543
Published: 2014-07-29
Description: mod/imscp/locallib.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote attackers to read arbitrary files via a package with a manifest file containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue affecting IMSCP resources and the IMSCC format.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-45417; http://openwall.com/lists/oss-security/2014/07/21/1; https://moodle.org/mod/forum/discuss.php?d=264264
CVE: CVE-2014-3544
Published: 2014-07-29
Description: Cross-site scripting (XSS) vulnerability in user/profile.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote authenticated users to inject arbitrary web script or HTML via the Skype ID profile field.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-45683; http://openwall.com/lists/oss-security/2014/07/21/1; http://osandamalith.wordpress.com/2014/07/25/moodle-2-7-persistent-xss/
CVE: CVE-2014-3545
Published: 2014-07-29
Description: Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote authenticated users to execute arbitrary code via a calculated question in a quiz.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-94
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-46148; http://openwall.com/lists/oss-security/2014/07/21/1; https://moodle.org/mod/forum/discuss.php?d=264266
CVE: CVE-2014-3546
Published: 2014-07-29
Description: Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 does not enforce certain capability requirements in (1) notes/index.php and (2) user/edit.php, which allows remote attackers to obtain potentially sensitive username and course information via a modified URL.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-45760; http://openwall.com/lists/oss-security/2014/07/21/1; https://moodle.org/mod/forum/discuss.php?d=264267
CVE: CVE-2014-3547
Published: 2014-07-29
Description: Multiple cross-site scripting (XSS) vulnerabilities in badges/renderer.php in Moodle 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allow remote attackers to inject arbitrary web script or HTML via an external badge.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-46042; http://openwall.com/lists/oss-security/2014/07/21/1; http://www.securityfocus.com/bid/68758
CVE: CVE-2014-3548
Published: 2014-07-29
Description: Multiple cross-site scripting (XSS) vulnerabilities in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allow remote attackers to inject arbitrary web script or HTML via vectors that trigger an AJAX exception dialog.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-45471; http://openwall.com/lists/oss-security/2014/07/21/1; http://www.securityfocus.com/bid/68766
CVE: CVE-2014-3549
Published: 2014-07-29
Description: Cross-site scripting (XSS) vulnerability in the get_description function in lib/classes/event/user_login_failed.php in Moodle 2.7.x before 2.7.1 allows remote attackers to inject arbitrary web script or HTML via a crafted username that is improperly handled during the logging of an invalid login attempt.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-46201; http://openwall.com/lists/oss-security/2014/07/21/1; http://www.securityfocus.com/bid/68761
CVE: CVE-2014-3550
Published: 2014-07-29
Description: Multiple cross-site scripting (XSS) vulnerabilities in admin/tool/task/scheduledtasks.php in Moodle 2.7.x before 2.7.1 allow remote attackers to inject arbitrary web script or HTML via vectors that trigger a crafted (1) error or (2) success message for a scheduled task.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-46227; http://openwall.com/lists/oss-security/2014/07/21/1; http://www.securityfocus.com/bid/68762
CVE: CVE-2014-3551
Published: 2014-07-29
Description: Multiple cross-site scripting (XSS) vulnerabilities in the advanced-grading implementation in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allow remote authenticated users to inject arbitrary web script or HTML via a crafted (1) qualification or (2) rating field in a rubric.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-46223; http://openwall.com/lists/oss-security/2014/07/21/1; http://www.securityfocus.com/bid/68763
CVE: CVE-2014-3552
Published: 2014-07-29
Description: The Shibboleth authentication plugin in auth/shibboleth/index.php in Moodle through 2.3.11, 2.4.x before 2.4.11, and 2.5.x before 2.5.7 does not check whether a session ID is empty, which allows remote authenticated users to hijack sessions via crafted plugin interaction.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-287
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=refs%2Fheads%2FMOODLE_25_STABLE&st=commit&s=MDL-45485; http://openwall.com/lists/oss-security/2014/07/21/1; https://moodle.org/mod/forum/discuss.php?d=264261
CVE: CVE-2014-3553
Published: 2014-07-29
Description: mod/forum/classes/post_form.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 does not enforce the moodle/site:accessallgroups capability requirement before proceeding with a post to all groups, which allows remote authenticated users to bypass intended access restrictions by leveraging two or more group memberships.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-264
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-38990; http://openwall.com/lists/oss-security/2014/07/21/1; https://moodle.org/mod/forum/discuss.php?d=264268
CVE: CVE-2014-0103
Published: 2014-07-29
Description: WebAccess in Zarafa before 7.1.10 and WebApp before 1.6 stores credentials in cleartext, which allows local Apache users to obtain sensitive information by reading the PHP session files.
CVSS Score: 2.1 (LOW)
CWE: CWE-310
References: http://advisories.mageia.org/MGASA-2014-0380.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-July/136033.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-July/136044.html