deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2013-5429
Published: 2014-01-21
Description: The Risk Based Access functionality in IBM Tivoli Federated Identity Manager (TFIM) 6.2.2 before FP9 and Tivoli Federated Identity Manager Business Gateway (TFIMBG) 6.2.2 before FP9 does not prevent reuse of One Time Password (OTP) tokens, which makes it easier for remote authenticated users to complete transactions by leveraging access to an already-used token.
CVSS Score: 2.1 (LOW)
CWE: CWE-287
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IV52624; http://www-01.ibm.com/support/docview.wss?uid=swg21660509; http://www-01.ibm.com/support/docview.wss?uid=swg21660510
CVE: CVE-2013-6040
Published: 2014-01-21
Description: MW6 Aztec, DataMatrix, and MaxiCode ActiveX controls before version 4.0 vulnerable to arbitrary code via a crafted HTML document. Latest versions (4.0) of MW6 Aztec, DataMatrix, and MaxiCode ActiveX controls have resolved the issue
CVSS Score: 8.1 (HIGH)
References: http://www.exploit-db.com/exploits/31176; http://www.exploit-db.com/exploits/31177; http://www.kb.cert.org/vuls/id/219470
CVE: CVE-2014-0753
Published: 2014-01-21
Description: Stack-based buffer overflow in the SCADA server in Ecava IntegraXor before 4.1.4390 allows remote attackers to cause a denial of service (system crash) by triggering access to DLL code located in the IntegraXor directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-119
References: http://osvdb.org/102171; http://www.integraxor.com/blog/buffer-overflow-vulnerability-note/; https://www.cisa.gov/news-events/ics-advisories/icsa-14-016-01
CVE: CVE-2013-6305
Published: 2014-01-21
Description: IBM Platform Symphony 5.2 before build 229037 and 6.1.0.1 before build 229073 uses the same credentials encryption key across different customers' installations, which makes it easier for context-dependent attackers to obtain sensitive information by leveraging knowledge of this key.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-310
References: http://osvdb.org/102262; http://www-01.ibm.com/support/docview.wss?uid=isg3T1020528; https://exchange.xforce.ibmcloud.com/vulnerabilities/88536
CVE: CVE-2013-6872
Published: 2014-01-21
Description: SQL injection vulnerability in managetimetracker.php in Collabtive before 1.2 allows remote authenticated users to execute arbitrary SQL commands via the id parameter in a projectpdf action.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://osvdb.org/102123; http://packetstormsecurity.com/files/124777/Collabtive-1.1-SQL-Injection.html; http://seclists.org/fulldisclosure/2014/Jan/72
CVE: CVE-2014-1452
Published: 2014-01-21
Description: Stack-based buffer overflow in lib/snmpagent.c in bsnmpd, as used in FreeBSD 8.3 through 10.0, allows remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via a crafted GETBULK PDU request.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-119
References: http://secunia.com/advisories/56496; http://svnweb.freebsd.org/base?view=revision&amp%3Brevision=260636; http://www.freebsd.org/security/advisories/FreeBSD-SA-14:01.bsnmpd.asc
CVE: CVE-2014-1618
Published: 2014-01-21
Description: Multiple SQL injection vulnerabilities in UAEPD Shopping Cart Script allow remote attackers to execute arbitrary SQL commands via the (1) cat_id or (2) p_id parameter to products.php or id parameter to (3) page.php or (4) news.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/101859; http://osvdb.org/101899; http://osvdb.org/101900
CVE: CVE-2014-1619
Published: 2014-01-21
Description: Multiple SQL injection vulnerabilities in Cubic CMS 5.1.1, 5.1.2, and 5.2 allow remote attackers to execute arbitrary SQL commands via the (1) resource_id or (2) version_id parameter to recursos/agent.php or (3) login or (4) pass parameter to login.usuario.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/101719; http://osvdb.org/101721; http://packetstormsecurity.com/files/124652
CVE: CVE-2014-1620
Published: 2014-01-21
Description: Multiple cross-site scripting (XSS) vulnerabilities in add.php in HIOX Guest Book (HGB) 5.0 allow remote attackers to inject arbitrary web script or HTML via the (1) name1, (2) email, or (3) cmt parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/101844; http://packetstormsecurity.com/files/124681/Hiox-Guest-Book-5.0-Cross-Site-Scripting.html; http://www.securityfocus.com/bid/64683
CVE: CVE-2013-2594
Published: 2014-01-21
Description: SQL injection vulnerability in reports/calldiary.php in Hornbill Supportworks ITSM 1.0.0 through 3.4.14 allows remote attackers to execute arbitrary SQL commands via the callref parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/92757; http://packetstormsecurity.com/files/121402/Hornbill-Supportworks-ITSM-1.0.0-SQL-Injection.html; http://seclists.org/fulldisclosure/2013/Apr/232
CVE: CVE-2013-4200
Published: 2014-01-21
Description: The isURLInPortal method in the URLTool class in in_portal.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 treats URLs starting with a space as a relative URL, which allows remote attackers to bypass the allow_external_login_sites filtering property,  redirect users to arbitrary web sites, and conduct phishing attacks via a space before a URL in the "next" parameter to acl_users/credentials_cookie_auth/require_login.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-264
References: http://plone.org/products/plone-hotfix/releases/20130618; http://plone.org/products/plone/security/advisories/20130618-announcement; http://www.openwall.com/lists/oss-security/2013/08/01/2
CVE: CVE-2013-6922
Published: 2014-01-21
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the Seagate BlackArmor NAS 220 devices with firmware sg2000-2000.1331 allow remote attackers to hijack the authentication of administrators for requests that (1) add user accounts via a crafted request to admin/access_control_user_add.php; (2) modify or (3) delete user accounts; (4) perform a factory reset; (5) perform a device reboot; or (6) add, (7) modify, or (8) delete shares and volumes.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://secunia.com/advisories/56047; http://www.exploit-db.com/exploits/30726; http://secunia.com/advisories/56047
CVE: CVE-2013-7219
Published: 2014-01-21
Description: SQL injection vulnerability in vote.php in the 2Glux Sexy Polling (com_sexypolling) component before 1.0.9 for Joomla! allows remote attackers to execute arbitrary SQL commands via the answer_id[] parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://2glux.com/forum/sexypolling/sexy-polling-security-vulnerability-notification-t2026.html; http://www.securityfocus.com/archive/1/530789/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/90519
CVE: CVE-2012-2997
Published: 2014-01-21
Description: XML External Entity (XXE) vulnerability in sam/admin/vpe2/public/php/server.php in F5 BIG-IP 10.0.0 through 10.2.4 and 11.0.0 through 11.2.1 allows remote authenticated users to read arbitrary files via a crafted XML file.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://archives.neohapsis.com/archives/bugtraq/2013-01/0093.html; http://osvdb.org/89447; http://support.f5.com/kb/en-us/solutions/public/14000/100/sol14138.html
CVE: CVE-2013-0157
Published: 2014-01-21
Description: (a) mount and (b) umount in util-linux 2.14.1, 2.17.2, and probably other versions allow local users to determine the existence of restricted directories by (1) using the --guess-fstype command-line option or (2) attempting to mount a non-existent device, which generates different error messages depending on whether the directory exists.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://bugs.debian.org/697464; http://marc.info/?l=oss-security&m=[PII_REDACTED]2247&w=2; http://osvdb.org/88953
CVE: CVE-2013-0339
Published: 2014-01-21
Description: libxml2 through 2.9.1 does not properly handle external entities expansion unless an application developer uses the xmlSAX2ResolveEntity or xmlSetExternalEntityLoader function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue.  NOTE: it could be argued that because libxml2 already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed and each affected application would need its own CVE.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00002.html; http://openwall.com/lists/oss-security/2013/02/21/24; http://openwall.com/lists/oss-security/2013/02/22/3
CVE: CVE-2013-0340
Published: 2014-01-21
Description: expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue.  NOTE: it could be argued that because expat already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed, and each affected application would need its own CVE.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-611
References: http://openwall.com/lists/oss-security/2013/02/22/3; http://seclists.org/fulldisclosure/2021/Oct/61; http://seclists.org/fulldisclosure/2021/Oct/62
CVE: CVE-2013-0485
Published: 2014-01-21
Description: Unspecified vulnerability in IBM Java SDK 7 before SR4-FP1, 6 before SR13-FP1, 5.0 before SR16-FP1, and 1.4.2 before SR13-FP16 has unknown impact and attack vectors related to Class Libraries.
CVSS Score: 10.0 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00020.html; http://www.ibm.com/developerworks/java/jdk/aix/142_64/fixes.html#SR13FP16; http://www.ibm.com/developerworks/java/jdk/aix/j532/fixes.html#SR16FP1
CVE: CVE-2013-1361
Published: 2014-01-21
Description: Untrusted search path vulnerability in Lenovo Thinkpad Bluetooth with Enhanced Data Rate Software 6.4.0.2900 and earlier allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse DLL that is located in the same folder as a file that is processed by Lenovo Bluetooth.
CVSS Score: 9.3 (HIGH)
References: http://secunia.com/advisories/51846; http://technet.microsoft.com/en-us/security/msvr/msvr13-001; http://www.osvdb.org/89483
CVE: CVE-2013-1769
Published: 2014-01-21
Description: A certain hashing algorithm in Telepathy Gabble 0.16.x before 0.16.5 and 0.17.x before 0.17.3 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted message.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://lists.freedesktop.org/archives/telepathy/2013-March/006377.html; http://lists.freedesktop.org/archives/telepathy/2013-March/006378.html; http://lists.opensuse.org/opensuse-updates/2013-03/msg00085.html
CVE: CVE-2013-1923
Published: 2014-01-21
Description: rpc-gssd in nfs-utils before 1.2.8 performs reverse DNS resolution for server names during GSSAPI authentication, which might allow remote attackers to read otherwise-restricted files via DNS spoofing attacks.
CVSS Score: 3.2 (LOW)
CWE: CWE-200
References: http://lists.opensuse.org/opensuse-updates/2013-06/msg00142.html; http://lists.opensuse.org/opensuse-updates/2013-06/msg00146.html; http://lists.opensuse.org/opensuse-updates/2013-06/msg00172.html
CVE: CVE-2013-2104
Published: 2014-01-21
Description: python-keystoneclient before 0.2.4, as used in OpenStack Keystone (Folsom), does not properly check expiry for PKI tokens, which allows remote authenticated users to (1) retain use of a token after it has expired, or (2) use a revoked token once it expires.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-updates/2013-06/msg00198.html; http://rhn.redhat.com/errata/RHSA-2013-0944.html; http://www.openwall.com/lists/oss-security/2013/05/28/7
CVE: CVE-2013-2151
Published: 2014-01-21
Description: Unquoted Windows search path vulnerability in Red Hat Enterprise Virtualization (RHEV) 3 and 3.2 allows local users to gain privileges via a crafted application in an unspecified folder.
CVSS Score: 7.2 (HIGH)
References: http://rhn.redhat.com/errata/RHSA-2013-0925.html; http://www.securityfocus.com/bid/60473; https://exchange.xforce.ibmcloud.com/vulnerabilities/84868
CVE: CVE-2013-2152
Published: 2014-01-21
Description: Unquoted Windows search path vulnerability in the SPICE service, as used in Red Hat Enterprise Virtualization (RHEV) 3.2, allows local users to gain privileges via a crafted application in an unspecified folder.
CVSS Score: 7.2 (HIGH)
References: http://rhn.redhat.com/errata/RHSA-2013-0924.html; http://rhn.redhat.com/errata/RHSA-2013-0925.html; http://www.securityfocus.com/bid/60475
CVE: CVE-2013-4160
Published: 2014-01-21
Description: Little CMS (lcms2) before 2.5, as used in OpenJDK 7 and possibly other products, allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via vectors related to (1) cmsStageAllocLabV2ToV4curves, (2) cmsPipelineDup, (3) cmsAllocProfileSequenceDescription, (4) CurvesAlloc, and (5) cmsnamed.
CVSS Score: 5.0 (MEDIUM)
References: http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2013-July/023895.html; http://openwall.com/lists/oss-security/2013/07/18/7; http://openwall.com/lists/oss-security/2013/07/22/1
CVE: CVE-2013-4884
Published: 2014-01-21
Description: Cross-site scripting (XSS) vulnerability in McAfee SuperScan 4.0 allows remote attackers to inject arbitrary web script or HTML via UTF-7 encoded sequences in a server response, which is not properly handled in the SuperScan HTML report.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2013/Aug/68; http://www.exploit-db.com/exploits/27406; http://www.securityfocus.com/bid/61640
CVE: CVE-2013-5986
Published: 2014-01-21
Description: Unspecified vulnerability in NVIDIA graphics driver Release 331, 325, 319, 310, and 304 has unknown impact and attack vectors, a different vulnerability than CVE-2013-5987.
CVSS Score: 10.0 (HIGH)
References: http://nvidia.custhelp.com/app/answers/detail/a_id/3377; http://support.apple.com/kb/HT6150; http://nvidia.custhelp.com/app/answers/detail/a_id/3377
CVE: CVE-2013-5987
Published: 2014-01-21
Description: Unspecified vulnerability in NVIDIA graphics driver Release 331, 325, 319, 310, and 304 allows local users to bypass intended access restrictions for the GPU and gain privileges via unknown vectors.
CVSS Score: 7.2 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1604&w=2; http://nvidia.custhelp.com/app/answers/detail/a_id/3377; http://support.apple.com/kb/HT6150
CVE: CVE-2013-6343
Published: 2014-01-22
Description: Multiple buffer overflows in web.c in httpd on the ASUS RT-N56U and RT-AC66U routers with firmware 3.0.0.4.374_979 allow remote attackers to execute arbitrary code via the (1) apps_name or (2) apps_flag parameter to APP_Installation.asp.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://infosec42.blogspot.com/2014/01/exploit-asus-rt-n56u-remote-root-shell.html; http://osvdb.org/102267; http://www.exploit-db.com/exploits/31033
CVE: CVE-2013-6746
Published: 2014-01-22
Description: Cross-site scripting (XSS) vulnerability in FileNet P8 Platform Documentation Installable Info Center 4.5.1 through 5.2.0 in IBM FileNet Business Process Manager 4.5.1 through 5.1.0, FileNet Content Manager 4.5.1 through 5.2.0, and Case Foundation 5.2.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/56500; http://www.ibm.com/support/docview.wss?uid=swg21662360; http://www.securityfocus.com/bid/65045
CVE: CVE-2014-0669
Published: 2014-01-22
Description: The Wireless Session Protocol (WSP) feature in the Gateway GPRS Support Node (GGSN) component on Cisco ASR 5000 series devices allows remote attackers to bypass intended Top-Up payment restrictions via unspecified WSP packets, aka Bug ID CSCuh28371.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/102318; http://secunia.com/advisories/56546; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0669
CVE: CVE-2014-0670
Published: 2014-01-22
Description: Cross-site scripting (XSS) vulnerability in the Search and Play interface in Cisco MediaSense allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCum16686.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/102319; http://secunia.com/advisories/56563; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0670
CVE: CVE-2014-0671
Published: 2014-01-22
Description: Open redirect vulnerability in Cisco MediaSense allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via an unspecified parameter, aka Bug ID CSCum16749.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://osvdb.org/102341; http://secunia.com/advisories/56544; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0671
CVE: CVE-2014-0672
Published: 2014-01-22
Description: The Search and Play interface in Cisco MediaSense does not properly enforce authorization requirements, which allows remote authenticated users to download arbitrary recordings via a request to this interface.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/102342; http://secunia.com/advisories/56600; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0672
CVE: CVE-2013-2750
Published: 2014-01-22
Description: Cross-site scripting (XSS) vulnerability in e107_plugins/content/handlers/content_preset.php in e107 before 1.0.3 allows remote attackers to inject arbitrary web script or HTML via the query string.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://sourceforge.net/p/e107/svn/13079; http://www.securityfocus.com/archive/1/526168; https://www.secuvera.de/advisories/TC-SA-2013-01.txt
CVE: CVE-2013-7304
Published: 2014-01-22
Description: Check Point Endpoint Security MI Server through R73 3.0.0 HFA2.5 does not configure X.509 certificate validation for client devices, which allows man-in-the-middle attackers to spoof SSL servers by presenting an arbitrary certificate during a session established by a client.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-310
References: http://secunia.com/advisories/56744; http://www.securityfocus.com/bid/65135; http://www.securitytracker.com/id/1029704
CVE: CVE-2013-7305
Published: 2014-01-22
Description: fpw.php in e107 through 1.0.4 does not check the user_ban field, which makes it easier for remote attackers to reset passwords by sending a pwsubmit request and leveraging access to the e-mail account of a banned user.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-255
References: http://sourceforge.net/p/e107/svn/13114; http://sourceforge.net/p/e107/svn/13114
CVE: CVE-2014-1636
Published: 2014-01-22
Description: Multiple SQL injection vulnerabilities in Command School Student Management System 1.06.01 allow remote attackers to execute arbitrary SQL commands via the id parameter in an edit action to (1) admin_school_names.php, (2) admin_subjects.php, (3) admin_grades.php, (4) admin_terms.php, (5) admin_school_years.php, (6) admin_sgrades.php, (7) admin_media_codes_1.php, (8) admin_infraction_codes.php, (9) admin_generations.php, (10) admin_relations.php, (11) admin_titles.php, or (12) health_allergies.php in sw/.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/101874; http://osvdb.org/101875; http://osvdb.org/101876
CVE: CVE-2014-1637
Published: 2014-01-22
Description: Command School Student Management System 1.06.01 does not properly restrict access to sw/backup/backup_ray2.php, which allows remote attackers to download a database backup via a direct request.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://osvdb.org/101888; http://packetstormsecurity.com/files/124708/Command-School-Student-Management-System-1.06.01-SQL-Injection-CSRF-XSS.html; http://www.securityfocus.com/bid/64707
CVE: CVE-2014-0660
Published: 2014-01-22
Description: Cisco TelePresence ISDN Gateway with software before 2.2(1.92) allows remote attackers to cause a denial of service (D-channel call outage) via a crafted Q.931 STATUS message, aka Bug ID CSCui50360.
CVSS Score: 7.1 (HIGH)
CWE: CWE-20
References: http://osvdb.org/102361; http://secunia.com/advisories/56591; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140122-isdngw
CVE: CVE-2014-0661
Published: 2014-01-22
Description: The System Status Collection Daemon (SSCD) in Cisco TelePresence System 500-37, 1000, 1300-65, and 3xxx before 1.10.2(42), and 500-32, 1300-47, TX1310 65, and TX9xxx before 6.0.4(11), allows remote attackers to execute arbitrary commands or cause a denial of service (stack memory corruption) via a crafted XML-RPC message, aka Bug ID CSCui32796.
CVSS Score: 8.3 (HIGH)
CWE: CWE-94
References: http://osvdb.org/102362; http://secunia.com/advisories/56533; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140122-cts
CVE: CVE-2014-0662
Published: 2014-01-22
Description: The SIP module in Cisco TelePresence Video Communication Server (VCS) before 8.1 allows remote attackers to cause a denial of service (process failure) via a crafted SDP message, aka Bug ID CSCue97632.
CVSS Score: 7.1 (HIGH)
CWE: CWE-20
References: http://osvdb.org/102363; http://secunia.com/advisories/56592; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140122-vcs
CVE: CVE-2014-0676
Published: 2014-01-22
Description: Cisco NX-OS allows local users to bypass intended TACACS+ command restrictions via a series of multiple commands, aka Bug ID CSCum47367.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/102366; http://secunia.com/advisories/56597; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0676
CVE: CVE-2014-0677
Published: 2014-01-22
Description: The Label Distribution Protocol (LDP) functionality in Cisco NX-OS allows remote attackers to cause a denial of service (temporary LDP session outage) via LDP discovery traffic containing malformed Hello messages, aka Bug ID CSCul88851.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://osvdb.org/102368; http://secunia.com/advisories/56611; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0677
CVE: CVE-2014-0806
Published: 2014-01-22
Description: The Sleipnir Mobile application 2.12.1 and earlier and Sleipnir Mobile Black Edition application 2.12.1 and earlier for Android provide Geolocation API data without verifying user consent, which allows remote attackers to obtain sensitive location information via a web site that makes API calls.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://jvn.jp/en/jp/JVN81637882/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2014-000007; http://jvn.jp/en/jp/JVN81637882/index.html
CVE: CVE-2014-0807
Published: 2014-01-22
Description: data/class/pages/shopping/LC_Page_Shopping_Deliv.php in LOCKON EC-CUBE 2.4.4 and earlier, and 2.11.0 through 2.12.2, allows remote attackers to modify data via unspecified vectors.
CVSS Score: 6.4 (MEDIUM)
References: http://jvn.jp/en/jp/JVN17849447/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2014-000005; http://www.ec-cube.net/info/weakness/weakness.php?id=56
CVE: CVE-2014-0808
Published: 2014-01-22
Description: Authorization bypass through user-controlled key issue exists in EC-CUBE 2.11.0 through 2.12.2 and EC-Orange systems deployed before June 29th, 2015. If this vulnerability is exploited, a user of the affected shopping website may obtain other users' information by sending a crafted HTTP request.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-566
References: http://jvn.jp/en/jp/JVN51770585/; http://jvndb.jvn.jp/jvndb/JVNDB-2014-000006; http://www.ec-cube.net/info/weakness/weakness.php?id=57