deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-2714
Published: 2014-04-14
Description: The Enhanced Web Filtering (EWF) in Juniper Junos before 10.4R15, 11.4 before 11.4R9, 12.1 before 12.1R7, 12.1X44 before 12.1X44-D20, 12.1X45 before 12.1X45-D10, and 12.1X46 before 12.1X46-D10, as used in the SRX Series services gateways, allows remote attackers to cause a denial of service (flow daemon crash and restart) via a crafted URL.
CVSS Score: 7.1 (HIGH)
CWE: CWE-20
References: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10622; http://secunia.com/advisories/57835; http://securitytracker.com/id?1030060
CVE: CVE-2014-2852
Published: 2014-04-14
Description: OpenAFS before 1.6.7 delays the listen thread when an RXS_CheckResponse fails, which allows remote attackers to cause a denial of service (performance degradation) via an invalid packet.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://www.debian.org/security/2014/dsa-2899; http://www.openafs.org/frameset/dl/openafs/1.6.7/ChangeLog; http://www.debian.org/security/2014/dsa-2899
CVE: CVE-2010-5298
Published: 2014-04-14
Description: Race condition in the ssl3_read_bytes function in s3_pkt.c in OpenSSL through 1.0.1g, when SSL_MODE_RELEASE_BUFFERS is enabled, allows remote attackers to inject data across sessions or cause a denial of service (use-after-free and parsing error) via an SSL connection in a multithreaded environment.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-362
References: http://advisories.mageia.org/MGASA-2014-0187.html; http://ftp.openbsd.org/pub/OpenBSD/patches/5.5/common/004_openssl.patch.sig; http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10629
CVE: CVE-2014-0077
Published: 2014-04-14
Description: drivers/vhost/net.c in the Linux kernel before 3.13.10, when mergeable buffers are disabled, does not properly validate packet lengths, which allows guest OS users to cause a denial of service (memory corruption and host OS crash) or possibly gain privileges on the host OS via crafted packets, related to the handle_rx and get_rx_bufs functions.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=d8316f3991d207fe32881a9ac20241be8fa2bad0; http://secunia.com/advisories/59386; http://secunia.com/advisories/59599
CVE: CVE-2014-0155
Published: 2014-04-14
Description: The ioapic_deliver function in virt/kvm/ioapic.c in the Linux kernel through 3.14.1 does not properly validate the kvm_irq_delivery_to_apic return value, which allows guest OS users to cause a denial of service (host OS crash) via a crafted entry in the redirection table of an I/O APIC.  NOTE: the affected code was moved to the ioapic_service function before the vulnerability was announced.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://git.kernel.org/cgit/virt/kvm/kvm.git/commit/?id=5678de3f15010b9022ee45673f33bcfc71d47b60; http://www.openwall.com/lists/oss-security/2014/04/07/2; https://bugzilla.redhat.com/show_bug.cgi?id=1081589
CVE: CVE-2014-2706
Published: 2014-04-14
Description: Race condition in the mac80211 subsystem in the Linux kernel before 3.13.7 allows remote attackers to cause a denial of service (system crash) via network traffic that improperly interacts with the WLAN_STA_PS_STA state (aka power-save mode), related to sta_info.c and tx.c.
CVSS Score: 7.1 (HIGH)
CWE: CWE-362
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=1d147bfa64293b2723c4fec[PII_REDACTED]8e613ba; http://linux.oracle.com/errata/ELSA-2014-3052.html; http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00006.html
CVE: CVE-2014-2739
Published: 2014-04-14
Description: The cma_req_handler function in drivers/infiniband/core/cma.c in the Linux kernel 3.14.x through 3.14.1 attempts to resolve an RDMA over Converged Ethernet (aka RoCE) address that is properly resolved within a different module, which allows remote attackers to cause a denial of service (incorrect pointer dereference and system crash) via crafted network traffic.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-20
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=b2853fd6c2d0f383dbdf7427e263eb576a633867; http://www.openwall.com/lists/oss-security/2014/04/10/9; http://www.securityfocus.com/bid/66716
CVE: CVE-2014-2851
Published: 2014-04-14
Description: Integer overflow in the ping_init_sock function in net/ipv4/ping.c in the Linux kernel through 3.14.1 allows local users to cause a denial of service (use-after-free and system crash) or possibly gain privileges via a crafted application that leverages an improperly managed reference counter.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-416
References: http://secunia.com/advisories/59386; http://secunia.com/advisories/59599; http://www.debian.org/security/2014/dsa-2926
CVE: CVE-2013-5704
Published: 2014-04-15
Description: The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass "RequestHeader unset" directives by placing a header in the trailer portion of data sent with chunked transfer coding.  NOTE: the vendor states "this is not a security issue in httpd as such."
CVSS Score: 5.0 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html; http://lists.apple.com/archives/security-announce/2015/Sep/msg00004.html; http://marc.info/?l=apache-httpd-dev&m=[PII_REDACTED]2854&w=2
CVE: CVE-2013-5705
Published: 2014-04-15
Description: apache2/modsecurity.c in ModSecurity before 2.7.6 allows remote attackers to bypass rules by using chunked transfer coding with a capitalized Chunked value in the Transfer-Encoding HTTP header.
CVSS Score: 5.0 (MEDIUM)
References: http://martin.swende.se/blog/HTTPChunked.html; http://www.debian.org/security/2014/dsa-2991; https://github.com/SpiderLabs/ModSecurity/commit/f8d441cd25172fdfe5b613442fedfc0da3cc333d
CVE: CVE-2014-0341
Published: 2014-04-15
Description: Multiple cross-site scripting (XSS) vulnerabilities in PivotX before 2.3.9 allow remote authenticated users to inject arbitrary web script or HTML via the title field to (1) templates_internal/pages.tpl, (2) templates_internal/home.tpl, or (3) templates_internal/entries.tpl; (4) an event field to objects.php; or the (5) email or (6) nickname field to pages.php, related to templates_internal/users.tpl.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://blog.pivotx.net/archive/2014/03/03/pivotx-239-released; http://pivotx.net/page/security; http://sourceforge.net/p/pivot-weblog/code/4345/
CVE: CVE-2014-0342
Published: 2014-04-15
Description: Multiple unrestricted file upload vulnerabilities in fileupload.php in PivotX before 2.3.9 allow remote authenticated users to execute arbitrary PHP code by uploading a file with a (1) .php or (2) .php# extension, and then accessing it via unspecified vectors.
CVSS Score: 7.5 (HIGH)
References: http://blog.pivotx.net/archive/2014/03/03/pivotx-239-released; http://pivotx.net/page/security; http://sourceforge.net/p/pivot-weblog/code/4347/
CVE: CVE-2014-0348
Published: 2014-04-15
Description: The Artiva Agency Single Sign-On (SSO) implementation in Artiva Workstation 1.3.x before 1.3.9, Artiva Rm 3.1 MR7, Artiva Healthcare 5.2 MR5, and Artiva Architect 3.2 MR5, when the domain-name option is enabled, allows remote attackers to login to arbitrary domain accounts by using the corresponding username on a Windows client machine.
CVSS Score: 3.5 (LOW)
CWE: CWE-287
References: http://www.kb.cert.org/vuls/id/215284; http://www.kb.cert.org/vuls/id/215284
CVE: CVE-2014-0353
Published: 2014-04-15
Description: The ZyXEL Wireless N300 NetUSB NBG-419N router with firmware 1.00(BFQ.6)C0 allows remote attackers to bypass authentication by using %2F sequences in place of / (slash) characters.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-287
References: http://www.kb.cert.org/vuls/id/939260; http://www.kb.cert.org/vuls/id/939260
CVE: CVE-2014-0354
Published: 2014-04-15
Description: The ZyXEL Wireless N300 NetUSB NBG-419N router with firmware 1.00(BFQ.6)C0 has a hardcoded password of qweasdzxc for an unspecified account, which allows remote attackers to obtain index.asp login access via an HTTP request.
CVSS Score: 7.8 (HIGH)
CWE: CWE-255
References: http://www.kb.cert.org/vuls/id/939260; http://www.kb.cert.org/vuls/id/939260
CVE: CVE-2014-0355
Published: 2014-04-15
Description: Multiple stack-based buffer overflows on the ZyXEL Wireless N300 NetUSB NBG-419N router with firmware 1.00(BFQ.6)C0 allow man-in-the-middle attackers to execute arbitrary code via (1) a long temp attribute in a yweather:condition element in a forecastrss file that is processed by the checkWeather function; the (2) WeatherCity or (3) WeatherDegree variable to the detectWeather function; unspecified input to the (4) UpnpAddRunRLQoS, (5) UpnpDeleteRunRLQoS, or (6) UpnpDeletePortCheckType function; or (7) the SET COUNTRY udps command.
CVSS Score: 7.9 (HIGH)
CWE: CWE-119
References: http://www.kb.cert.org/vuls/id/939260; http://www.kb.cert.org/vuls/id/939260
CVE: CVE-2014-0356
Published: 2014-04-15
Description: The ZyXEL Wireless N300 NetUSB NBG-419N router with firmware 1.00(BFQ.6)C0 allows remote attackers to execute arbitrary code via shell metacharacters in input to the (1) detectWeather, (2) set_language, (3) SystemCommand, or (4) NTPSyncWithHost function in management.c, or a (5) SET COUNTRY, (6) SET WLAN SSID, (7) SET WLAN CHANNEL, (8) SET WLAN STATUS, or (9) SET WLAN COUNTRY udps command.
CVSS Score: 7.9 (HIGH)
CWE: CWE-78
References: http://www.kb.cert.org/vuls/id/939260; http://www.kb.cert.org/vuls/id/939260
CVE: CVE-2014-0357
Published: 2014-04-15
Description: Amtelco miSecureMessages allows remote attackers to read the messages of arbitrary users via an XML request containing a valid license key and a modified contactID value, as demonstrated by a request from the iOS or Android application.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-287
References: http://ics-cert.us-cert.gov/advisories/ICSA-14-121-01; http://www.kb.cert.org/vuls/id/251628; https://service.amtelco.com/INFINITY/MSM/MSM6.2SecurityBriefing.pdf
CVE: CVE-2014-0358
Published: 2014-04-15
Description: Multiple directory traversal vulnerabilities in Xangati XSR before 11 and XNR before 7 allow remote attackers to read arbitrary files via a .. (dot dot) in (1) the file parameter in a getUpgradeStatus action to servlet/MGConfigData, (2) the download parameter in a download action to servlet/MGConfigData, (3) the download parameter in a port_svc action to servlet/MGConfigData, (4) the file parameter in a getfile action to servlet/Installer, or (5) the binfile parameter to servlet/MGConfigData.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: http://www.kb.cert.org/vuls/id/657622; http://www.kb.cert.org/vuls/id/657622
CVE: CVE-2014-0359
Published: 2014-04-15
Description: Xangati XSR before 11 and XNR before 7 allows remote attackers to execute arbitrary commands via shell metacharacters in a gui_input_test.pl params parameter to servlet/Installer.
CVSS Score: 9.0 (HIGH)
CWE: CWE-78
References: http://www.kb.cert.org/vuls/id/657622; http://www.kb.cert.org/vuls/id/657622
CVE: CVE-2014-0105
Published: 2014-04-15
Description: The auth_token middleware in the OpenStack Python client library for Keystone (aka python-keystoneclient) before 0.7.0 does not properly retrieve user tokens from memcache, which allows remote authenticated users to gain privileges in opportunistic circumstances via a large number of requests, related to an "interaction between eventlet and python-memcached."
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-255
References: http://rhn.redhat.com/errata/RHSA-2014-0382.html; http://rhn.redhat.com/errata/RHSA-2014-0409.html; http://www.openwall.com/lists/oss-security/2014/03/27/4
CVE: CVE-2014-0138
Published: 2014-04-15
Description: The default configuration in cURL and libcurl 7.10.6 before 7.36.0 re-uses (1) SCP, (2) SFTP, (3) POP3, (4) POP3S, (5) IMAP, (6) IMAPS, (7) SMTP, (8) SMTPS, (9) LDAP, and (10) LDAPS connections, which might allow context-dependent attackers to connect as other users via a request, a similar issue to CVE-2014-0015.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-287
References: http://curl.haxx.se/docs/adv_20140326A.html; http://lists.opensuse.org/opensuse-updates/2014-04/msg00042.html; http://seclists.org/fulldisclosure/2014/Dec/23
CVE: CVE-2014-0139
Published: 2014-04-15
Description: cURL and libcurl 7.1 before 7.36.0, when using the OpenSSL, axtls, qsossl or gskit libraries for TLS, recognize a wildcard IP address in the subject's Common Name (CN) field of an X.509 certificate, which might allow man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-310
References: http://advisories.mageia.org/MGASA-2015-0165.html; http://curl.haxx.se/docs/adv_20140326B.html; http://lists.opensuse.org/opensuse-updates/2014-04/msg00042.html
CVE: CVE-2014-0157
Published: 2014-04-15
Description: Cross-site scripting (XSS) vulnerability in the Horizon Orchestration dashboard in OpenStack Dashboard (aka Horizon) 2013.2 before 2013.2.4 and icehouse before icehouse-rc2 allows remote attackers to inject arbitrary web script or HTML via the description field of a Heat template.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-updates/2015-01/msg00040.html; http://www.openwall.com/lists/oss-security/2014/04/08/8; http://www.securityfocus.com/bid/66706
CVE: CVE-2014-0167
Published: 2014-04-15
Description: The Nova EC2 API security group implementation in OpenStack Compute (Nova) 2013.1 before 2013.2.4 and icehouse before icehouse-rc2 does not enforce RBAC policies for (1) add_rules, (2) remove_rules, (3) destroy, and other unspecified methods in compute/api.py when using non-default policies, which allows remote authenticated users to gain privileges via these API requests.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-264
References: http://www.openwall.com/lists/oss-security/2014/04/09/26; http://www.ubuntu.com/usn/USN-2247-1; https://launchpad.net/bugs/1290537
CVE: CVE-2014-2690
Published: 2014-04-15
Description: Citrix VDI-in-a-Box 5.3.x before 5.3.6 and 5.4.x before 5.4.3 allows local users to obtain administrator credentials by reading the log.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://secunia.com/advisories/57734; http://support.citrix.com/article/CTX140106; http://www.securitytracker.com/id/1030068
CVE: CVE-2014-2828
Published: 2014-04-15
Description: The V3 API in OpenStack Identity (Keystone) 2013.1 before 2013.2.4 and icehouse before icehouse-rc2 allows remote attackers to cause a denial of service (CPU consumption) via a large number of the same authentication method in a request, aka "authentication chaining."
CVSS Score: 7.8 (HIGH)
CWE: CWE-287
References: http://rhn.redhat.com/errata/RHSA-2014-1688.html; http://www.openwall.com/lists/oss-security/2014/04/10/20; https://bugs.launchpad.net/keystone/+bug/1300274
CVE: CVE-2014-2842
Published: 2014-04-15
Description: Juniper ScreenOS 6.3 and earlier allows remote attackers to cause a denial of service (crash and restart or failover) via a malformed SSL/TLS packet.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://secunia.com/advisories/57910; http://www.kb.cert.org/vuls/id/480428; http://www.securityfocus.com/bid/66802
CVE: CVE-2013-7368
Published: 2014-04-15
Description: Multiple cross-site scripting (XSS) vulnerabilities in Gnew 2013.1 allow remote attackers to inject arbitrary web script or HTML via the gnew_template parameter to (1) users/profile.php, (2) articles/index.php, or (3) admin/polls.php; (4) category_id parameter to news/submit.php; news_id parameter to (5) news/send.php or (6) comments/add.php; or (7) post_subject or (8) thread_id parameter to posts/edit.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/122771; http://www.securityfocus.com/bid/61721; http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5153.php
CVE: CVE-2014-0107
Published: 2014-04-15
Description: The TransformerFactory in Apache Xalan-Java before 2.7.2 does not properly restrict access to certain properties when FEATURE_SECURE_PROCESSING is enabled, which allows remote attackers to bypass expected restrictions and load arbitrary classes or access external resources via a crafted (1) xalan:content-header, (2) xalan:entities, (3) xslt:content-header, or (4) xslt:entities property, or a Java property that is bound to the XSLT 1.0 system-property function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://rhn.redhat.com/errata/RHSA-2014-0348.html; http://rhn.redhat.com/errata/RHSA-2014-1351.html; http://rhn.redhat.com/errata/RHSA-2015-1888.html
CVE: CVE-2014-2580
Published: 2014-04-15
Description: The netback driver in Xen, when using certain Linux versions that do not allow sleeping in softirq context, allows local guest administrators to cause a denial of service ("scheduling while atomic" error and host crash) via a malformed packet, which causes a mutex to be taken when trying to disable the interface.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-399
References: http://www.openwall.com/lists/oss-security/2014/03/24/6; http://www.openwall.com/lists/oss-security/2014/03/24/8; http://www.securityfocus.com/bid/66386
CVE: CVE-2014-0514
Published: 2014-04-15
Description: The Adobe Reader Mobile application before 11.2 for Android does not properly restrict use of JavaScript, which allows remote attackers to execute arbitrary code via a crafted PDF document, a related issue to CVE-2012-6636.
CVSS Score: 9.3 (HIGH)
CWE: CWE-264
References: http://helpx.adobe.com/security/products/reader-mobile/apsb14-12.html; http://packetstormsecurity.com/files/127113/Adobe-Reader-for-Android-addJavascriptInterface-Exploit.html; http://seclists.org/fulldisclosure/2014/Apr/192
CVE: CVE-2014-1986
Published: 2014-04-15
Description: The Content Provider in the KOKUYO CamiApp application 1.21.1 and earlier for Android allows attackers to bypass intended access restrictions and read database information via a crafted application.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-264
References: http://jvn.jp/en/jp/JVN55438786/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2014-000036; https://play.google.com/store/apps/details?id=jp.co.kokuyost.CamiApp
CVE: CVE-2014-2384
Published: 2014-04-15
Description: vmx86.sys in VMware Workstation 10.0.1 build 1379776 and VMware Player 6.0.1 build 1379776 on Windows might allow local users to cause a denial of service (read access violation and system crash) via a crafted buffer in an IOCTL call.  NOTE: the researcher reports "Vendor rated issue as non-exploitable."
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-399
References: http://seclists.org/fulldisclosure/2014/Apr/163; https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-2384/; http://seclists.org/fulldisclosure/2014/Apr/163
CVE: CVE-2014-0642
Published: 2014-04-15
Description: EMC Documentum Content Server before 6.7 SP1 P26, 6.7 SP2 before P13, 7.0 before P13, and 7.1 before P02 allows remote authenticated users to bypass intended access restrictions and read metadata from certain folders via unspecified vectors.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-264
References: http://archives.neohapsis.com/archives/bugtraq/2014-04/0072.html; http://twitter.com/artika4biz/statuses/[PII_REDACTED]16823040; http://archives.neohapsis.com/archives/bugtraq/2014-04/0072.html
CVE: CVE-2014-0921
Published: 2014-04-15
Description: The server in IBM MessageSight 1.x before 1.1.0.0-IBM-IMA-IT01015 allows remote attackers to cause a denial of service (daemon crash and message data loss) via malformed headers during a WebSockets connection upgrade.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IC98583; http://www-01.ibm.com/support/docview.wss?uid=swg21670278; https://exchange.xforce.ibmcloud.com/vulnerabilities/92074
CVE: CVE-2014-0922
Published: 2014-04-15
Description: IBM MessageSight 1.x before 1.1.0.0-IBM-IMA-IT01015 allows remote attackers to cause a denial of service (resource consumption) via WebSockets MQ Telemetry Transport (MQTT) data.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IC98692; http://www-01.ibm.com/support/docview.wss?uid=swg21670278; https://exchange.xforce.ibmcloud.com/vulnerabilities/92075
CVE: CVE-2014-0923
Published: 2014-04-15
Description: IBM MessageSight 1.x before 1.1.0.0-IBM-IMA-IT01015 allows remote attackers to cause a denial of service (daemon restart) via crafted MQ Telemetry Transport (MQTT) authentication data.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IT00582; http://www-01.ibm.com/support/docview.wss?uid=swg21670278; https://exchange.xforce.ibmcloud.com/vulnerabilities/92076
CVE: CVE-2014-0924
Published: 2014-04-15
Description: IBM MessageSight 1.x before 1.1.0.0-IBM-IMA-IT01015 does not verify that all of the characters of a password are correct, which makes it easier for remote authenticated users to bypass intended access restrictions by leveraging knowledge of a password substring.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-20
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IT00583; http://www-01.ibm.com/support/docview.wss?uid=swg21670278; https://exchange.xforce.ibmcloud.com/vulnerabilities/92077
CVE: CVE-2014-2859
Published: 2014-04-15
Description: PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allows remote attackers to bypass intended access restrictions via a direct request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://www.kb.cert.org/vuls/id/437385; http://www.kb.cert.org/vuls/id/437385
CVE: CVE-2014-2860
Published: 2014-04-15
Description: Multiple cross-site scripting (XSS) vulnerabilities in PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allow remote attackers to inject arbitrary web script or HTML via a crafted HTTP request to a (1) ColdFusion or (2) JavaScript component.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.kb.cert.org/vuls/id/437385; http://www.kb.cert.org/vuls/id/437385
CVE: CVE-2014-2861
Published: 2014-04-15
Description: Incomplete blacklist vulnerability in PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted string, as demonstrated by bypassing a protection mechanism that removes only the "alert" string.
CVSS Score: 4.3 (MEDIUM)
References: http://www.kb.cert.org/vuls/id/437385; http://www.kb.cert.org/vuls/id/437385
CVE: CVE-2014-2862
Published: 2014-04-15
Description: PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 does not check authorization in unspecified situations, which allows remote authenticated users to perform actions via unknown vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://www.kb.cert.org/vuls/id/437385; http://www.kb.cert.org/vuls/id/437385
CVE: CVE-2014-2863
Published: 2014-04-15
Description: Multiple absolute path traversal vulnerabilities in PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allow remote attackers to have an unspecified impact via a full pathname in a parameter.
CVSS Score: 10.0 (HIGH)
CWE: CWE-22
References: http://www.kb.cert.org/vuls/id/437385; http://www.kb.cert.org/vuls/id/437385
CVE: CVE-2014-2864
Published: 2014-04-15
Description: Multiple directory traversal vulnerabilities in PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allow remote attackers to have an unspecified impact via a filename parameter containing directory traversal sequences.
CVSS Score: 10.0 (HIGH)
CWE: CWE-22
References: http://www.kb.cert.org/vuls/id/437385; http://www.kb.cert.org/vuls/id/437385
CVE: CVE-2014-2865
Published: 2014-04-15
Description: PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allows remote attackers to bypass intended access restrictions via a '\0' character, as demonstrated by using this character within a pathname on the drive containing the web root directory of a ColdFusion installation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://www.kb.cert.org/vuls/id/437385; http://www.kb.cert.org/vuls/id/437385