deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2013-7343
Published: 2014-03-24
Description: Cross-site scripting (XSS) vulnerability in flowplayer.swf in the Flash fallback feature in Flowplayer HTML5 5.4.3 allows remote attackers to inject arbitrary web script or HTML by using URL encoding within the callback parameter name.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7342.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://github.com/flowplayer/flowplayer/commit/27e8f178276c185cbddb4f14c91d4ce7b3865db1; https://github.com/flowplayer/flowplayer/issues/381; https://github.com/flowplayer/flowplayer/commit/27e8f178276c185cbddb4f14c91d4ce7b3865db1
CVE: CVE-2014-0122
Published: 2014-03-24
Description: mod/chat/chat_ajax.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 does not properly check for the mod/chat:chat capability during chat sessions, which allows remote authenticated users to bypass intended access restrictions in opportunistic circumstances by remaining in a chat session after an intra-session capability removal by an administrator.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-264
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-44082; http://openwall.com/lists/oss-security/2014/03/17/1; https://moodle.org/mod/forum/discuss.php?d=256418
CVE: CVE-2014-0123
Published: 2014-03-24
Description: The wiki subsystem in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 does not properly restrict (1) view and (2) edit access, which allows remote authenticated users to perform wiki operations by leveraging the student role and using the Recent Activity block to reach the individual wiki of an arbitrary student.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-264
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-39990; http://openwall.com/lists/oss-security/2014/03/17/1; https://moodle.org/mod/forum/discuss.php?d=256419
CVE: CVE-2014-0124
Published: 2014-03-24
Description: The identity-reporting implementations in mod/forum/renderer.php and mod/quiz/override_form.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 do not properly restrict the display of e-mail addresses, which allows remote authenticated users to obtain sensitive information by using the (1) Forum or (2) Quiz module.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-43916; http://openwall.com/lists/oss-security/2014/03/17/1; https://moodle.org/mod/forum/discuss.php?d=256421
CVE: CVE-2014-0125
Published: 2014-03-24
Description: repository/alfresco/lib.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 places a session key in a URL, which allows remote attackers to bypass intended Alfresco Repository file restrictions by impersonating a file's owner.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-264
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-29409; http://openwall.com/lists/oss-security/2014/03/17/1; https://moodle.org/mod/forum/discuss.php?d=256422
CVE: CVE-2014-0126
Published: 2014-03-24
Description: Cross-site request forgery (CSRF) vulnerability in enrol/imsenterprise/importnow.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 allows remote attackers to hijack the authentication of administrators for requests that import an IMS Enterprise file.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-43146; http://openwall.com/lists/oss-security/2014/03/17/1; https://moodle.org/mod/forum/discuss.php?d=256423
CVE: CVE-2014-0127
Published: 2014-03-24
Description: The time-validation implementation in (1) mod/feedback/complete.php and (2) mod/feedback/complete_guest.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 allows remote authenticated users to bypass intended restrictions on starting a Feedback activity by choosing an unavailable time.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-264
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-43656; http://openwall.com/lists/oss-security/2014/03/17/1; https://moodle.org/mod/forum/discuss.php?d=256417
CVE: CVE-2014-0129
Published: 2014-03-24
Description: badges/mybadges.php in Moodle 2.5.x before 2.5.5 and 2.6.x before 2.6.2 does not properly track the user to whom a badge was issued, which allows remote authenticated users to modify the visibility of an arbitrary badge via unspecified vectors.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-44140; http://openwall.com/lists/oss-security/2014/03/17/1; https://moodle.org/mod/forum/discuss.php?d=256424
CVE: CVE-2014-2250
Published: 2014-03-24
Description: The random-number generator on Siemens SIMATIC S7-1200 CPU PLC devices with firmware before 4.0 does not have sufficient entropy, which makes it easier for remote attackers to defeat cryptographic protection mechanisms and hijack sessions via unspecified vectors, a different vulnerability than CVE-2014-2251.
CVSS Score: 8.3 (HIGH)
CWE: CWE-310
References: http://ics-cert.us-cert.gov/advisories/ICSA-14-079-02; http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-654382.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-654382.pdf
CVE: CVE-2014-2252
Published: 2014-03-24
Description: Siemens SIMATIC S7-1200 CPU PLC devices with firmware before 4.0 allow remote attackers to cause a denial of service (defect-mode transition) via crafted PROFINET packets, a different vulnerability than CVE-2014-2253.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-399
References: http://ics-cert.us-cert.gov/advisories/ICSA-14-079-02; http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-654382.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-654382.pdf
CVE: CVE-2014-2254
Published: 2014-03-24
Description: Siemens SIMATIC S7-1200 CPU PLC devices with firmware before 4.0 allow remote attackers to cause a denial of service (defect-mode transition) via crafted HTTP packets, a different vulnerability than CVE-2014-2255.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://ics-cert.us-cert.gov/advisories/ICSA-14-079-02; http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-654382.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-654382.pdf
CVE: CVE-2014-2256
Published: 2014-03-24
Description: Siemens SIMATIC S7-1200 CPU PLC devices with firmware before 4.0 allow remote attackers to cause a denial of service (defect-mode transition) via crafted ISO-TSAP packets, a different vulnerability than CVE-2014-2257.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://ics-cert.us-cert.gov/advisories/ICSA-14-079-02; http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-654382.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-654382.pdf
CVE: CVE-2014-2258
Published: 2014-03-24
Description: Siemens SIMATIC S7-1200 CPU PLC devices with firmware before 4.0 allow remote attackers to cause a denial of service (defect-mode transition) via crafted HTTPS packets, a different vulnerability than CVE-2014-2259.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://ics-cert.us-cert.gov/advisories/ICSA-14-079-02; http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-654382.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-654382.pdf
CVE: CVE-2014-2571
Published: 2014-03-24
Description: Cross-site scripting (XSS) vulnerability in the quiz_question_tostring function in mod/quiz/editlib.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 allows remote authenticated users to inject arbitrary web script or HTML via a quiz question.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-43690; http://openwall.com/lists/oss-security/2014/03/17/1; https://moodle.org/mod/forum/discuss.php?d=256416
CVE: CVE-2014-2572
Published: 2014-03-24
Description: mod/assign/externallib.php in Moodle 2.6.x before 2.6.2 does not properly handle assignment web-service parameters, which might allow remote authenticated users to modify grade metadata via unspecified vectors.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-43468; http://openwall.com/lists/oss-security/2014/03/17/1; https://moodle.org/mod/forum/discuss.php?d=256425
CVE: CVE-2013-0303
Published: 2014-03-24
Description: Unspecified vulnerability in core/ajax/translations.php in ownCloud before 4.0.12 and 4.5.x before 4.5.6 allows remote authenticated users to execute arbitrary PHP code via unknown vectors.  NOTE: this entry has been SPLIT due to different affected versions. The core/settings.php issue is covered by CVE-2013-7344.
CVSS Score: 6.5 (MEDIUM)
References: http://owncloud.org/about/security/advisories/oC-SA-2013-006/; http://owncloud.org/about/security/advisories/oC-SA-2013-006/
CVE: CVE-2013-7344
Published: 2014-03-24
Description: Unspecified vulnerability in core/settings.php in ownCloud before 4.0.12 and 4.5.x before 4.5.6 allows remote authenticated users to execute arbitrary PHP code via unknown vectors.  NOTE: this issue was SPLIT from CVE-2013-0303 due to different affected versions.
CVSS Score: 6.5 (MEDIUM)
References: http://owncloud.org/about/security/advisories/oC-SA-2013-006/; http://owncloud.org/about/security/advisories/oC-SA-2013-006/
CVE: CVE-2013-7345
Published: 2014-03-24
Description: The BEGIN regular expression in the awk script detector in magic/Magdir/commands in file before 5.15 uses multiple wildcards with unlimited repetitions, which allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted ASCII file that triggers a large amount of backtracking, as demonstrated via a file with many newline characters.
CVSS Score: 5.0 (MEDIUM)
References: http://bugs.gw.com/view.php?id=164; http://rhn.redhat.com/errata/RHSA-2014-1765.html; http://support.apple.com/kb/HT6443
CVE: CVE-2014-0016
Published: 2014-03-24
Description: stunnel before 5.00, when using fork threading, does not properly update the state of the OpenSSL pseudo-random number generator (PRNG), which causes subsequent children with the same process ID to use the same entropy pool and allows remote attackers to obtain private keys for EC (ECDSA) or DSA certificates.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-332
References: http://www.openwall.com/lists/oss-security/2014/03/05/1; http://www.securityfocus.com/bid/65964; https://bugzilla.redhat.com/attachment.cgi?id=870826&action=diff
CVE: CVE-2014-2057
Published: 2014-03-24
Description: Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 6.0.2 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://owncloud.org/about/security/advisories/oC-SA-2014-007/; http://owncloud.org/about/security/advisories/oC-SA-2014-007/
CVE: CVE-2014-2585
Published: 2014-03-24
Description: ownCloud before 5.0.15 and 6.x before 6.0.2, when the file_external app is enabled, allows remote authenticated users to mount the local filesystem in the user's ownCloud via the mount configuration.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-20
References: http://owncloud.org/about/security/advisories/oC-SA-2014-008/; http://owncloud.org/about/security/advisories/oC-SA-2014-008/
CVE: CVE-2014-2586
Published: 2014-03-24
Description: Cross-site scripting (XSS) vulnerability in the login audit form in McAfee Cloud Single Sign On (SSO) allows remote attackers to inject arbitrary web script or HTML via a crafted password.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/125775/McAfee-Cloud-SSO-Asset-Manager-Issues.html; http://seclists.org/fulldisclosure/2014/Mar/325; http://www.exploit-db.com/exploits/32368
CVE: CVE-2014-2587
Published: 2014-03-24
Description: SQL injection vulnerability in jsp/reports/ReportsAudit.jsp in McAfee Asset Manager 6.6 allows remote authenticated users to execute arbitrary SQL commands via the username of an audit report (aka user parameter).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://packetstormsecurity.com/files/125775/McAfee-Cloud-SSO-Asset-Manager-Issues.html; http://seclists.org/fulldisclosure/2014/Mar/325; http://www.exploit-db.com/exploits/32368
CVE: CVE-2014-2588
Published: 2014-03-24
Description: Directory traversal vulnerability in servlet/downloadReport in McAfee Asset Manager 6.6 allows remote authenticated users to read arbitrary files via a .. (dot dot) in the reportFileName parameter.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.com/files/125775/McAfee-Cloud-SSO-Asset-Manager-Issues.html; http://seclists.org/fulldisclosure/2014/Mar/325; http://www.exploit-db.com/exploits/32368
CVE: CVE-2014-2589
Published: 2014-03-24
Description: Cross-site scripting (XSS) vulnerability in the Dashboard Backend service (stats/dashboard.jsp) in SonicWall Network Security Appliance (NSA) 2400 allows remote attackers to inject arbitrary web script or HTML via the sn parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/57275; http://www.osvdb.org/104089; http://www.securityfocus.com/archive/1/531364/100/0/threaded
CVE: CVE-2013-7339
Published: 2014-03-24
Description: The rds_ib_laddr_check function in net/rds/ib.c in the Linux kernel before 3.12.8 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a bind system call for an RDS socket on a system that lacks RDS transports.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-476
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=c2349758acf1874e4c2b93fe41d072336f1a31d0; http://secunia.com/advisories/59386; http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.12.8
CVE: CVE-2014-0131
Published: 2014-03-24
Description: Use-after-free vulnerability in the skb_segment function in net/core/skbuff.c in the Linux kernel through 3.13.6 allows attackers to obtain sensitive information from kernel memory by leveraging the absence of a certain orphaning operation.
CVSS Score: 2.9 (LOW)
CWE: CWE-416
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=1fd819ecb90cc9b822cd84d3056ddba315d3340f; http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00010.html; http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00025.html
CVE: CVE-2014-2523
Published: 2014-03-24
Description: net/netfilter/nf_conntrack_proto_dccp.c in the Linux kernel through 3.13.6 uses a DCCP header pointer incorrectly, which allows remote attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a DCCP packet that triggers a call to the (1) dccp_new, (2) dccp_packet, or (3) dccp_error function.
CVSS Score: 10.0 (HIGH)
CWE: CWE-20
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=b22f5126a24b3b2f15448c3f2a254fc10cbc2b92; http://secunia.com/advisories/57446; http://twitter.com/grsecurity/statuses/[PII_REDACTED]99461888
CVE: CVE-2014-2568
Published: 2014-03-24
Description: Use-after-free vulnerability in the nfqnl_zcopy function in net/netfilter/nfnetlink_queue_core.c in the Linux kernel through 3.13.6 allows attackers to obtain sensitive information from kernel memory by leveraging the absence of a certain orphaning operation. NOTE: the affected code was moved to the skb_zerocopy function in net/core/skbuff.c before the vulnerability was announced.
CVSS Score: 2.9 (LOW)
CWE: CWE-416
References: http://seclists.org/oss-sec/2014/q1/627; http://secunia.com/advisories/59599; http://www.openwall.com/lists/oss-security/2014/03/20/16
CVE: CVE-2012-4886
Published: 2014-03-24
Description: Stack-based buffer overflow in wpsio.dll in Kingsoft WPS Office 2012 possibly 8.1.0.3238 allows remote attackers to execute arbitrary code via a long BSTR string.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://osvdb.org/92847; http://packetstormsecurity.com/files/121431/WPS-Office-Stack-Buffer-Overflow.html; http://seclists.org/fulldisclosure/2013/Apr/247
CVE: CVE-2012-6430
Published: 2014-03-24
Description: Cross-site scripting (XSS) vulnerability in Open Solution Quick.Cms 5.0 and Quick.Cart 6.0, possibly as downloaded before December 19, 2012, allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to admin.php.  NOTE: this might be a duplicate of CVE-2008-4140.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2013-01/0035.html; http://osvdb.org/89119; http://osvdb.org/89120
CVE: CVE-2013-1408
Published: 2014-03-24
Description: Multiple SQL injection vulnerabilities in the Wysija Newsletters plugin before 2.2.1 for WordPress allow remote authenticated administrators to execute arbitrary SQL commands via the (1) search or (2) orderby parameter to wp-admin/admin.php.  NOTE: this can be leveraged using CSRF to allow remote unauthenticated attackers to execute arbitrary SQL commands.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://archives.neohapsis.com/archives/bugtraq/2013-02/0030.html; http://osvdb.org/89924; http://packetstormsecurity.com/files/120089/WordPress-Wysija-Newsletters-2.2-SQL-Injection.html
CVE: CVE-2014-2284
Published: 2014-03-24
Description: The Linux implementation of the ICMP-MIB in Net-SNMP 5.5 before 5.5.2.1, 5.6.x before 5.6.2.1, and 5.7.x before 5.7.2.1 does not properly validate input, which allows remote attackers to cause a denial of service via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://comments.gmane.org/gmane.comp.security.oss.general/12284; http://lists.opensuse.org/opensuse-updates/2014-03/msg00060.html; http://lists.opensuse.org/opensuse-updates/2014-03/msg00061.html
CVE: CVE-2014-1761
Published: 2014-03-25
Description: Microsoft Word 2003 SP3, 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Word Viewer; Office Compatibility Pack SP3; Office for Mac 2011; Word Automation Services on SharePoint Server 2010 SP1 and SP2 and 2013; Office Web Apps 2010 SP1 and SP2; and Office Web Apps Server 2013 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted RTF data, as exploited in the wild in March 2014.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: http://technet.microsoft.com/security/advisory/2953095; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-017; http://technet.microsoft.com/security/advisory/2953095
CVE: CVE-2014-0076
Published: 2014-03-25
Description: The Montgomery ladder implementation in OpenSSL through 1.0.0l does not ensure that certain swap operations have a constant-time behavior, which makes it easier for local users to obtain ECDSA nonces via a FLUSH+RELOAD cache side-channel attack.
CVSS Score: 1.9 (LOW)
CWE: CWE-310
References: http://advisories.mageia.org/MGASA-2014-0165.html; http://eprint.iacr.org/2014/140; http://git.openssl.org/gitweb/?p=openssl.git%3Ba=commit%3Bh=2198be3483259de374f91e57d247d0fc667aef29
CVE: CVE-2014-0628
Published: 2014-03-25
Description: The server in EMC RSA BSAFE Micro Edition Suite (MES) 4.0.x before 4.0.5 does not properly process certificate chains, which allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://archives.neohapsis.com/archives/bugtraq/2014-03/0130.html; http://archives.neohapsis.com/archives/bugtraq/2014-03/0130.html
CVE: CVE-2014-1492
Published: 2014-03-25
Description: The cert_TestHostName function in lib/certdb/certdb.c in the certificate-checking implementation in Mozilla Network Security Services (NSS) before 3.16 accepts a wildcard character that is embedded in an internationalized domain name's U-label, which might allow man-in-the-middle attackers to spoof SSL servers via a crafted certificate.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761; http://lists.fedoraproject.org/pipermail/package-announce/2014-May/132437.html; http://lists.opensuse.org/opensuse-security-announce/2014-05/msg00006.html
CVE: CVE-2014-1515
Published: 2014-03-25
Description: Mozilla Firefox before 28.0.1 on Android processes a file: URL by copying a local file onto the SD card, which allows attackers to obtain sensitive information from the Firefox profile directory via a crafted application.
CVSS Score: 1.9 (LOW)
CWE: CWE-200
References: http://archives.neohapsis.com/archives/bugtraq/2014-03/0153.html; https://bugzilla.mozilla.org/show_bug.cgi?id=945429; https://www.mozilla.org/security/announce/2014/mfsa2014-33.html
CVE: CVE-2013-5951
Published: 2014-03-25
Description: Multiple cross-site scripting (XSS) vulnerabilities in eXtplorer 2.1.3, when used as a component for Joomla!, allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) application.js.php in scripts/ or (2) admin.php, (3) copy_move.php, (4) functions.php, (5) header.php, or (6) upload.php in include/.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/fulldisclosure/2014-03/0273.html; http://secunia.com/advisories/57387; http://secunia.com/advisories/57482
CVE: CVE-2014-2386
Published: 2014-03-25
Description: Multiple off-by-one errors in Icinga, possibly 1.10.2 and earlier, allow remote attackers to cause a denial of service (crash) via unspecified vectors to the (1) display_nav_table, (2) print_export_link, (3) page_num_selector, or (4) page_limit_selector function in cgi/cgiutils.c or (5) status_page_num_selector function in cgi/status.c, which triggers a stack-based buffer overflow.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://comments.gmane.org/gmane.comp.security.oss.general/12355; http://lists.opensuse.org/opensuse-updates/2014-03/msg00072.html; https://dev.icinga.org/issues/5663
CVE: CVE-2014-2573
Published: 2014-03-25
Description: The VMWare driver in OpenStack Compute (Nova) 2013.2 through 2013.2.2 does not properly put VMs into RESCUE status, which allows remote authenticated users to bypass the quota limit and cause a denial of service (resource consumption) by requesting the VM be put into rescue and then deleting the image.
CVSS Score: 2.3 (LOW)
CWE: CWE-264
References: http://secunia.com/advisories/57498; http://www.openwall.com/lists/oss-security/2014/03/21/1; http://www.openwall.com/lists/oss-security/2014/03/21/2
CVE: CVE-2013-1604
Published: 2014-03-25
Description: Directory traversal vulnerability in MayGion IP Cameras with firmware before 2013.04.22 (05.53) allows remote attackers to read arbitrary files via a .. (dot dot) in the default URI.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://seclists.org/fulldisclosure/2013/May/194; http://www.coresecurity.com/advisories/maygion-IP-cameras-multiple-vulnerabilities; http://www.exploit-db.com/exploits/25813
CVE: CVE-2013-1605
Published: 2014-03-25
Description: Buffer overflow in MayGion IP Cameras with firmware before 2013.04.22 (05.53) allows remote attackers to execute arbitrary code via a long filename in a GET request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://osvdb.org/93708; http://packetstormsecurity.com/files/121787/MayGion-IP-Camera-Path-Traversal-Buffer-Overflow.html; http://seclists.org/fulldisclosure/2013/May/194