deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2013-2695
Published: 2014-03-28
Description: Cross-site scripting (XSS) vulnerability in invite.php in the WP Symposium plugin before 13.04 for WordPress allows remote attackers to inject arbitrary web script or HTML via the u parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/92275; http://secunia.com/advisories/52864; http://osvdb.org/92275
CVE: CVE-2014-0133
Published: 2014-03-28
Description: Heap-based buffer overflow in the SPDY implementation in nginx 1.3.15 before 1.4.7 and 1.5.x before 1.5.12 allows remote attackers to execute arbitrary code via a crafted request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-updates/2014-03/msg00095.html; http://mailman.nginx.org/pipermail/nginx-announce/2014/000135.html; http://www.securityfocus.com/bid/66537
CVE: CVE-2014-2525
Published: 2014-03-28
Description: Heap-based buffer overflow in the yaml_parser_scan_uri_escapes function in LibYAML before 0.1.6 allows context-dependent attackers to execute arbitrary code via a long sequence of percent-encoded characters in a URI in a YAML file.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://advisories.mageia.org/MGASA-2014-0150.html; http://lists.opensuse.org/opensuse-updates/2014-04/msg00022.html; http://lists.opensuse.org/opensuse-updates/2015-02/msg00078.html
CVE: CVE-2014-2599
Published: 2014-03-28
Description: The HVMOP_set_mem_access HVM control operations in Xen 4.1.x for 32-bit and 4.1.x through 4.4.x for 64-bit allow local guest administrators to cause a denial of service (CPU consumption) by leveraging access to certain service domains for HVM guests and a large input.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00002.html; http://security.gentoo.org/glsa/glsa-201407-03.xml; http://www.debian.org/security/2014/dsa-3006
CVE: CVE-2014-2668
Published: 2014-03-28
Description: Apache CouchDB 1.5.0 and earlier allows remote attackers to cause a denial of service (CPU and memory consumption) via the count parameter to /_uuids.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-updates/2014-04/msg00039.html; http://packetstormsecurity.com/files/125889; http://secunia.com/advisories/57572
CVE: CVE-2013-6211
Published: 2014-03-29
Description: Unspecified vulnerability in HP StoreOnce Virtual Storage Appliance (VSA) before 3.7.2, StoreOnce 26xx and 4210 iSCSI Backup System before 3.9.0, StoreOnce 4210 FC Backup System before 3.9.0, and StoreOnce 4xxx Backup System before 3.9.0 allows remote attackers to obtain sensitive information or cause a denial of service via unknown vectors.
CVSS Score: 7.8 (HIGH)
References: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04126368; https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04126368
CVE: CVE-2014-0880
Published: 2014-03-29
Description: IBM SAN Volume Controller; Storwize V3500, V3700, V5000, and V7000; and Flex System V7000 with software 6.3 and 6.4 before 6.4.1.8, and 7.1 and 7.2 before 7.2.0.3, allow remote attackers to obtain CLI access, and consequently cause a denial of service, via unspecified traffic to the administrative IP address.
CVSS Score: 7.5 (HIGH)
References: http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004570; https://exchange.xforce.ibmcloud.com/vulnerabilities/91145; http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004570
CVE: CVE-2014-1644
Published: 2014-03-29
Description: The forgotten-password feature in forcepasswd.do in the management GUI in Symantec LiveUpdate Administrator (LUA) 2.x before 2.3.2.110 allows remote attackers to reset arbitrary passwords by providing the e-mail address associated with a user account.
CVSS Score: 7.5 (HIGH)
CWE: CWE-255
References: http://archives.neohapsis.com/archives/bugtraq/2014-03/0172.html; http://www.securityfocus.com/bid/66399; http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20140327_00
CVE: CVE-2014-1645
Published: 2014-03-29
Description: SQL injection vulnerability in forcepasswd.do in the management GUI in Symantec LiveUpdate Administrator (LUA) 2.x before 2.3.2.110 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://archives.neohapsis.com/archives/bugtraq/2014-03/0172.html; http://www.securityfocus.com/bid/66400; http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20140327_00
CVE: CVE-2014-2131
Published: 2014-03-29
Description: The packet driver in Cisco IOS allows remote attackers to cause a denial of service (device reload) via a series of (1) Virtual Switching Systems (VSS) or (2) Bidirectional Forwarding Detection (BFD) packets, aka Bug IDs CSCug41049 and CSCue61890.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2131; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2131
CVE: CVE-2014-0344
Published: 2014-03-29
Description: Properties.do in ZOHO ManageEngine OpStor before build 8500 does not properly check privilege levels, which allows remote authenticated users to obtain Admin access by using the name parameter in conjunction with a true value of the edit parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://www.kb.cert.org/vuls/id/140886; http://www.securityfocus.com/bid/66499; http://www.kb.cert.org/vuls/id/140886
CVE: CVE-2014-1516
Published: 2014-03-29
Description: The saltProfileName function in base/GeckoProfileDirectories.java in Mozilla Firefox through 28.0.1 on Android relies on Android's weak approach to seeding the Math.random function, which makes it easier for attackers to bypass a profile-randomization protection mechanism via a crafted application.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://archives.neohapsis.com/archives/bugtraq/2014-03/0153.html; http://securityintelligence.com/vulnerabilities-firefox-android-overtaking-firefox-profiles/; http://www.slideshare.net/ibmsecurity/overtaking-firefox-profiles-vulnerabilities-in-firefox-for-android
CVE: CVE-2014-2670
Published: 2014-03-29
Description: Cross-site scripting (XSS) vulnerability in Properties.do in ZOHO ManageEngine OpStor before build 8500 allows remote authenticated users to inject arbitrary web script or HTML via the name parameter, a different vulnerability than CVE-2014-0344.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www.kb.cert.org/vuls/id/140886; http://www.securityfocus.com/bid/66499; http://www.kb.cert.org/vuls/id/140886
CVE: CVE-2014-0060
Published: 2014-03-31
Description: PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 does not properly enforce the ADMIN OPTION restriction, which allows remote authenticated members of a role to add or remove arbitrary users to that role by calling the SET ROLE command before the associated GRANT command.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://archives.neohapsis.com/archives/bugtraq/2014-10/0103.html; http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705; http://lists.opensuse.org/opensuse-updates/2014-03/msg00018.html
CVE: CVE-2014-0061
Published: 2014-03-31
Description: The validator functions for the procedural languages (PLs) in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allow remote authenticated users to gain privileges via a function that is (1) defined in another language or (2) not allowed to be directly called by the user due to permissions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://archives.neohapsis.com/archives/bugtraq/2014-10/0103.html; http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705; http://lists.opensuse.org/opensuse-updates/2014-03/msg00018.html
CVE: CVE-2014-0062
Published: 2014-03-31
Description: Race condition in the (1) CREATE INDEX and (2) unspecified ALTER TABLE commands in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allows remote authenticated users to create an unauthorized index or read portions of unauthorized tables by creating or deleting a table with the same name during the timing window.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-362
References: http://archives.neohapsis.com/archives/bugtraq/2014-10/0103.html; http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705; http://lists.opensuse.org/opensuse-updates/2014-03/msg00018.html
CVE: CVE-2014-0063
Published: 2014-03-31
Description: Multiple stack-based buffer overflows in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allow remote authenticated users to cause a denial of service (crash) or possibly execute arbitrary code via vectors related to an incorrect MAXDATELEN constant and datetime values involving (1) intervals, (2) timestamps, or (3) timezones, a different vulnerability than CVE-2014-0065.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2014-10/0103.html; http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705; http://lists.opensuse.org/opensuse-updates/2014-03/msg00018.html
CVE: CVE-2014-0064
Published: 2014-03-31
Description: Multiple integer overflows in the path_in and other unspecified functions in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allow remote authenticated users to have unspecified impact and attack vectors, which trigger a buffer overflow.  NOTE: this identifier has been SPLIT due to different affected versions; use CVE-2014-2669 for the hstore vector.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-189
References: http://archives.neohapsis.com/archives/bugtraq/2014-10/0103.html; http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705; http://lists.opensuse.org/opensuse-updates/2014-03/msg00018.html
CVE: CVE-2014-0065
Published: 2014-03-31
Description: Multiple buffer overflows in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allow remote authenticated users to have unspecified impact and attack vectors, a different vulnerability than CVE-2014-0063.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2014-10/0103.html; http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705; http://lists.opensuse.org/opensuse-updates/2014-03/msg00018.html
CVE: CVE-2014-0066
Published: 2014-03-31
Description: The chkpass extension in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 does not properly check the return value of the crypt library function, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and crash) via unspecified vectors.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-20
References: http://archives.neohapsis.com/archives/bugtraq/2014-10/0103.html; http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705; http://lists.opensuse.org/opensuse-updates/2014-03/msg00018.html
CVE: CVE-2014-0067
Published: 2014-03-31
Description: The "make check" command for the test suites in PostgreSQL 9.3.3 and earlier does not properly invoke initdb to specify the authentication requirements for a database cluster to be used for the tests, which allows local users to gain privileges by leveraging access to this cluster.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html; http://lists.apple.com/archives/security-announce/2015/Sep/msg00004.html; http://lists.opensuse.org/opensuse-updates/2014-03/msg00018.html
CVE: CVE-2014-0086
Published: 2014-03-31
Description: The doFilter function in webapp/PushHandlerFilter.java in JBoss RichFaces 4.3.4, 4.3.5, and 5.x allows remote attackers to cause a denial of service (memory consumption and out-of-memory error) via a large number of malformed atmosphere push requests.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://rhn.redhat.com/errata/RHSA-2014-0335.html; http://secunia.com/advisories/57053; https://bugzilla.redhat.com/show_bug.cgi?id=1067268
CVE: CVE-2014-2669
Published: 2014-03-31
Description: Multiple integer overflows in contrib/hstore/hstore_io.c in PostgreSQL 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allow remote authenticated users to have unspecified impact via vectors related to the (1) hstore_recv, (2) hstore_from_arrays, and (3) hstore_from_array functions in contrib/hstore/hstore_io.c; and the (4) hstoreArrayToPairs function in contrib/hstore/hstore_op.c, which triggers a buffer overflow.  NOTE: this issue was SPLIT from CVE-2014-0064 because it has a different set of affected versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-189
References: http://rhn.redhat.com/errata/RHSA-2014-0221.html; http://rhn.redhat.com/errata/RHSA-2014-0469.html; http://wiki.postgresql.org/wiki/20140220securityrelease
CVE: CVE-2014-0981
Published: 2014-03-31
Description: VBox/GuestHost/OpenGL/util/net.c in Oracle VirtualBox before 3.2.22, 4.0.x before 4.0.24, 4.1.x before 4.1.32, 4.2.x before 4.2.24, and 4.3.x before 4.3.8, when using 3D Acceleration allows local guest OS users to execute arbitrary code on the Chromium server via crafted Chromium network pointer in a (1) CR_MESSAGE_READBACK or (2) CR_MESSAGE_WRITEBACK message to the VBoxSharedCrOpenGL service, which triggers an arbitrary pointer dereference and memory corruption.  NOTE: this issue was MERGED with CVE-2014-0982 because it is the same type of vulnerability affecting the same set of versions. All CVE users should reference CVE-2014-0981 instead of CVE-2014-0982.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-399
References: http://seclists.org/fulldisclosure/2014/Mar/95; http://secunia.com/advisories/57384; http://www.coresecurity.com/advisories/oracle-virtualbox-3d-acceleration-multiple-memory-corruption-vulnerabilities
CVE: CVE-2014-0982
Published: 2014-03-31
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-0981. Reason: This issue was MERGED into CVE-2014-0981 in accordance with CVE content decisions, because it is the same type of vulnerability and affects the same versions. Notes: All CVE users should reference CVE-2014-0981 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2014-0983
Published: 2014-03-31
Description: Multiple array index errors in programs that are automatically generated by VBox/HostServices/SharedOpenGL/crserverlib/server_dispatch.py in Oracle VirtualBox 4.2.x through 4.2.20 and 4.3.x before 4.3.8, when using 3D Acceleration, allow local guest OS users to execute arbitrary code on the Chromium server via certain CR_MESSAGE_OPCODES messages with a crafted index, which are not properly handled by the (1) CR_VERTEXATTRIB4NUBARB_OPCODE to the crServerDispatchVertexAttrib4NubARB function, (2) CR_VERTEXATTRIB1DARB_OPCODE to the crServerDispatchVertexAttrib1dARB function, (3) CR_VERTEXATTRIB1FARB_OPCODE to the crServerDispatchVertexAttrib1fARB function, (4) CR_VERTEXATTRIB1SARB_OPCODE to the crServerDispatchVertexAttrib1sARB function, (5) CR_VERTEXATTRIB2DARB_OPCODE to the crServerDispatchVertexAttrib2dARB function, (6) CR_VERTEXATTRIB2FARB_OPCODE to the crServerDispatchVertexAttrib2fARB function, (7) CR_VERTEXATTRIB2SARB_OPCODE to the crServerDispatchVertexAttrib2sARB function, (8) CR_VERTEXATTRIB3DARB_OPCODE to the crServerDispatchVertexAttrib3dARB function, (9) CR_VERTEXATTRIB3FARB_OPCODE to the crServerDispatchVertexAttrib3fARB function, (10) CR_VERTEXATTRIB3SARB_OPCODE to the crServerDispatchVertexAttrib3sARB function, (11) CR_VERTEXATTRIB4DARB_OPCODE to the crServerDispatchVertexAttrib4dARB function, (12) CR_VERTEXATTRIB4FARB_OPCODE to the crServerDispatchVertexAttrib4fARB function, and (13) CR_VERTEXATTRIB4SARB_OPCODE to the crServerDispatchVertexAttrib4sARB function.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-399
References: http://seclists.org/fulldisclosure/2014/Mar/95; http://secunia.com/advisories/57384; http://www.coresecurity.com/advisories/oracle-virtualbox-3d-acceleration-multiple-memory-corruption-vulnerabilities
CVE: CVE-2014-1982
Published: 2014-03-31
Description: The administrative interface in Allied Telesis AT-RG634A ADSL Broadband router 3.3+, iMG624A firmware 3.5, iMG616LH firmware 2.4, and iMG646BD firmware 3.5 allows remote attackers to gain privileges and execute arbitrary commands via a direct request to cli.html.
CVSS Score: 10.0 (HIGH)
CWE: CWE-78, CWE-287
References: http://seclists.org/fulldisclosure/2014/Mar/340; http://www.exploit-db.com/exploits/32545; http://seclists.org/fulldisclosure/2014/Mar/340
CVE: CVE-2012-3359
Published: 2014-03-31
Description: Luci in Red Hat Conga stores the user's username and password in a Base64 encoded string in the __ac session cookie, which allows attackers to gain privileges by accessing this cookie.  NOTE: this issue has been SPLIT due to different vulnerability types. Use CVE-2013-7347 for the incorrect enforcement of a user timeout.
CVSS Score: 3.7 (LOW)
CWE: CWE-255
References: http://rhn.redhat.com/errata/RHSA-2013-0128.html; https://bugzilla.redhat.com/show_bug.cgi?id=607179; http://rhn.redhat.com/errata/RHSA-2013-0128.html
CVE: CVE-2013-7347
Published: 2014-03-31
Description: Luci in Red Hat Conga does not properly enforce the user session timeout, which might allow attackers to gain access to the session by reading the __ac session cookie.  NOTE: this issue has been SPLIT due to different vulnerability types. Use CVE-2012-3359 for the base64-encoded storage of the user and password in a cookie.
CVSS Score: 3.7 (LOW)
CWE: CWE-264
References: http://rhn.redhat.com/errata/RHSA-2013-0128.html; https://bugzilla.redhat.com/show_bug.cgi?id=607179; http://rhn.redhat.com/errata/RHSA-2013-0128.html
CVE: CVE-2013-6768
Published: 2014-03-31
Description: Untrusted search path vulnerability in the CyanogenMod/ClockWorkMod/Koush Superuser package 1.0.2.1 for Android 4.2.x and earlier allows attackers to trigger the launch of a Trojan horse app_process program via a crafted PATH environment variable for a /system/xbin/su process.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://www.securityfocus.com/archive/1/529796; http://www.securityfocus.com/archive/1/529796
CVE: CVE-2013-6769
Published: 2014-03-31
Description: The CyanogenMod/ClockWorkMod/Koush Superuser package 1.0.2.1 for Android allows attackers to gain privileges via shell metacharacters in the -c option to /system/xbin/su.
CVSS Score: 10.0 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/archive/1/529797; http://www.securityfocus.com/archive/1/529797
CVE: CVE-2013-6770
Published: 2014-03-31
Description: The CyanogenMod/ClockWorkMod/Koush Superuser package 1.0.2.1 for Android 4.3 and 4.4 does not properly restrict the set of users who can execute /system/xbin/su with the --daemon option, which allows attackers to gain privileges by leveraging ADB shell access and a certain Linux UID, and then creating a Trojan horse script.
CVSS Score: 7.6 (HIGH)
CWE: CWE-264
References: http://www.securityfocus.com/archive/1/529795; http://www.securityfocus.com/archive/1/529795
CVE: CVE-2013-6774
Published: 2014-03-31
Description: Untrusted search path vulnerability in the ChainsDD Superuser package 3.1.3 for Android 4.2.x and earlier, CyanogenMod/ClockWorkMod/Koush Superuser package 1.0.2.1 for Android 4.2.x and earlier, and Chainfire SuperSU package before 1.69 for Android 4.2.x and earlier allows attackers to load an arbitrary .jar file and gain privileges via a crafted BOOTCLASSPATH environment variable for a /system/xbin/su process.  NOTE: another researcher was unable to reproduce this with ChainsDD Superuser.
CVSS Score: 10.0 (HIGH)
References: http://www.securityfocus.com/archive/1/529796; http://www.securityfocus.com/archive/1/529822; http://www.securityfocus.com/archive/1/529796
CVE: CVE-2013-6775
Published: 2014-03-31
Description: The Chainfire SuperSU package before 1.69 for Android allows attackers to gain privileges via the (1) backtick or (2) $() type of shell metacharacters in the -c option to /system/xbin/su.
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://www.securityfocus.com/archive/1/529797; http://www.securityfocus.com/archive/1/529797
CVE: CVE-2014-2671
Published: 2014-03-31
Description: Microsoft Windows Media Player (WMP) 11.0.5721.5230 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted WAV file.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://packetstormsecurity.com/files/125834; http://www.exploit-db.com/exploits/32477/; http://www.securityfocus.com/bid/66403
CVE: CVE-2009-5141
Published: 2014-04-01
Description: Format string vulnerability in War FTP Daemon (warftpd) 1.82 RC 12 allows remote authenticated users to cause a denial of service (crash) via format string specifiers in a LIST command.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-134
References: http://archives.neohapsis.com/archives/bugtraq/2009-09/0105.html; http://www.exploit-db.com/exploits/9622; http://www.osvdb.org/62599
CVE: CVE-2013-2278
Published: 2014-04-01
Description: Unspecified vulnerability in War FTP Daemon (warftpd) 1.82, when running as a Windows service, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors related to log messages and the "internal log handler to the Windows Event log."
CVSS Score: 10.0 (HIGH)
References: http://www.securityfocus.com/archive/1/525830; http://www.warftp.org/index.php?cmd=show_article&article_id=1035; http://www.securityfocus.com/archive/1/525830
CVE: CVE-2013-5640
Published: 2014-04-01
Description: Multiple SQL injection vulnerabilities in Gnew 2013.1 allow remote attackers to execute arbitrary SQL commands via the (1) answer_id or (2) question_id parameter to polls/vote.php, (3) story_id parameter to comments/add.php or (4) comments/edit.php, or (5) thread_id parameter to posts/add.php.  NOTE: this issue was SPLIT due to differences in researchers and disclosure dates. CVE-2013-7349 already covers the news_id parameter to news/send.php, user_email parameter to users/register.php, and thread_id to posts/edit.php vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/123482; http://www.exploit-db.com/exploits/28684; http://www.securityfocus.com/bid/62817
CVE: CVE-2013-7349
Published: 2014-04-01
Description: Multiple SQL injection vulnerabilities in Gnew 2013.1 allow remote attackers to execute arbitrary SQL commands via the (1) news_id parameter to news/send.php, (2) thread_id parameter to posts/edit.php, or (3) user_email parameter to users/password.php or (4) users/register.php.  NOTE: these issues were SPLIT from CVE-2013-5640 due to differences in researchers and disclosure dates.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/122771; http://packetstormsecurity.com/files/123482; http://www.exploit-db.com/exploits/28684
CVE: CVE-2014-2034
Published: 2014-04-01
Description: Unspecified vulnerability in Sonatype Nexus OSS and Pro 2.4.0 through 2.7.1 allows attackers to create arbitrary user accounts via unknown vectors related to "an unauthenticated execution path."
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/57142; http://www.osvdb.org/104049; http://www.securityfocus.com/bid/65956
CVE: CVE-2013-0662
Published: 2014-04-01
Description: Multiple stack-based buffer overflows in ModbusDrv.exe in Schneider Electric Modbus Serial Driver 1.10 through 3.2 allow remote attackers to execute arbitrary code via a large buffer-size value in a Modbus Application Header.
CVSS Score: 9.3 (HIGH)
CWE: CWE-787
References: http://download.schneider-electric.com/files?p_Doc_Ref=SEVD%202013-070-01; http://ics-cert.us-cert.gov/advisories/ICSA-14-086-01; http://www.securityfocus.com/bid/66500