deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-0757
Published: 2014-01-31
Description: Smart Software Solutions (3S) CoDeSys Runtime Toolkit before 2.4.7.44 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via unspecified vectors.
CVSS Score: 7.1 (HIGH)
CWE: CWE-476, CWE-399
References: http://secunia.com/advisories/56713; https://www.cisa.gov/news-events/ics-advisories/icsa-14-030-01; http://ics-cert.us-cert.gov/advisories/ICSA-14-030-01
CVE: CVE-2013-4383
Published: 2014-01-31
Description: Cross-site scripting (XSS) vulnerability in the jQuery Countdown module 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with the "access administration pages" permission to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://www.securityfocus.com/bid/62340; https://drupal.org/node/2087089; https://drupal.org/node/2087095
CVE: CVE-2013-4979
Published: 2014-01-31
Description: Buffer overflow in the gldll32.dll module in EPS Viewer 3.2 and earlier allows remote attackers to execute arbitrary code via a crafted EPS file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2013-08/0180.html; http://secunia.com/advisories/54584; http://www.coresecurity.com/advisories/eps-viewer-buffer-overflow-vulnerability
CVE: CVE-2013-6235
Published: 2014-01-31
Description: Multiple cross-site scripting (XSS) vulnerabilities in JAMon (Java Application Monitor) 2.7 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) listenertype or (2) currentlistener parameter to mondetail.jsp or ArraySQL parameter to (3) mondetail.jsp, (4) jamonadmin.jsp, (5) sql.jsp, or (6) exceptions.jsp.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/102570; http://osvdb.org/102571; http://osvdb.org/102572
CVE: CVE-2014-1204
Published: 2014-01-31
Description: SQL injection vulnerability in Tableau Server 8.0.x before 8.0.7 and 8.1.x before 8.1.2 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.  NOTE: this can be exploited by unauthenticated remote attackers if the guest user is enabled.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/102568; http://secunia.com/advisories/56620; http://www.exploit-db.com/exploits/31578
CVE: CVE-2013-6143
Published: 2014-01-31
Description: The Schneider Electric Telvent SAGE 3030 RTU with firmware C3413-500-001D3_P4 and C3413-500-001F0_PB allows remote attackers to cause a denial of service (temporary outage and CPU consumption) via malformed DNP3 traffic.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20, CWE-399
References: http://ics-cert.us-cert.gov/advisories/ICSA-14-006-01; http://ics-cert.us-cert.gov/advisories/ICSA-14-006-01
CVE: CVE-2014-0001
Published: 2014-01-31
Description: Buffer overflow in client/mysql.cc in Oracle MySQL and MariaDB before 5.5.35 allows remote database servers to cause a denial of service (crash) and possibly execute arbitrary code via a long server version string.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://bazaar.launchpad.net/~maria-captains/maria/5.5/revision/2502.565.64; http://osvdb.org/102713; http://rhn.redhat.com/errata/RHSA-2014-0164.html
CVE: CVE-2013-4043
Published: 2014-02-01
Description: The server in IBM SPSS Collaboration and Deployment Services 4.x before 4.2.1.3 IF3, 5.x before 5.0 FP3, and 6.x before 6.0 IF1 allows remote attackers to read arbitrary files via an unspecified HTTP request.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PI07828; http://www-01.ibm.com/support/docview.wss?uid=swg21661169; https://exchange.xforce.ibmcloud.com/vulnerabilities/86419
CVE: CVE-2013-6724
Published: 2014-02-01
Description: Unspecified vulnerability in the vsflex8l ActiveX control in IBM SPSS SamplePower 3.0.1 before FP1 IF1 allows remote attackers to execute arbitrary code via a crafted ComboList property value.
CVSS Score: 9.3 (HIGH)
References: http://www-01.ibm.com/support/docview.wss?uid=swg21663250; https://exchange.xforce.ibmcloud.com/vulnerabilities/89279; http://www-01.ibm.com/support/docview.wss?uid=swg21663250
CVE: CVE-2013-7176
Published: 2014-02-01
Description: config/filter.d/postfix.conf in the postfix filter in Fail2ban before 0.8.11 allows remote attackers to trigger the blocking of an arbitrary IP address via a crafted e-mail address that matches an improperly designed regular expression.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-updates/2014-03/msg00021.html; http://www.debian.org/security/2014/dsa-2979; http://www.kb.cert.org/vuls/id/686662
CVE: CVE-2013-7177
Published: 2014-02-01
Description: config/filter.d/cyrus-imap.conf in the cyrus-imap filter in Fail2ban before 0.8.11 allows remote attackers to trigger the blocking of an arbitrary IP address via a crafted e-mail address that matches an improperly designed regular expression.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-updates/2014-03/msg00021.html; http://www.debian.org/security/2014/dsa-2979; http://www.kb.cert.org/vuls/id/686662
CVE: CVE-2014-0812
Published: 2014-02-01
Description: Cross-site scripting (XSS) vulnerability in KENT-WEB Joyful Note 2.8 and earlier, when Internet Explorer 7 or earlier is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN30718178/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2014-000013; http://osvdb.org/102740
CVE: CVE-2014-0830
Published: 2014-02-01
Description: Directory traversal vulnerability in the table-export implementation in the OAC component in IBM Financial Transaction Manager (FTM) 2.0 before 2.0.0.3 and 2.1 before 2.1.0.1 allows remote authenticated users to read arbitrary files via a modified pathname.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-22
References: http://www-01.ibm.com/support/docview.wss?uid=swg21662714; https://exchange.xforce.ibmcloud.com/vulnerabilities/90584; http://www-01.ibm.com/support/docview.wss?uid=swg21662714
CVE: CVE-2014-0831
Published: 2014-02-01
Description: Cross-site request forgery (CSRF) vulnerability in the OAC component in IBM Financial Transaction Manager (FTM) 2.0 before 2.0.0.3 allows remote attackers to hijack the authentication of arbitrary users for requests that modify configuration data.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://osvdb.org/102766; http://www-01.ibm.com/support/docview.wss?uid=swg21662714; https://exchange.xforce.ibmcloud.com/vulnerabilities/90585
CVE: CVE-2014-0832
Published: 2014-02-01
Description: Multiple cross-site scripting (XSS) vulnerabilities in configuration-details screens in the OAC component in IBM Financial Transaction Manager (FTM) 2.0 before 2.0.0.3 allow remote authenticated users to inject arbitrary web script or HTML via a crafted text value.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21662714; https://exchange.xforce.ibmcloud.com/vulnerabilities/90586; http://www-01.ibm.com/support/docview.wss?uid=swg21662714
CVE: CVE-2014-0833
Published: 2014-02-01
Description: The OAC component in IBM Financial Transaction Manager (FTM) 2.0 before 2.0.0.3 does not properly enforce operator-intervention requirements, which allows remote authenticated users to bypass intended access restrictions via an unspecified process step.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/102767; http://www-01.ibm.com/support/docview.wss?uid=swg21662714; https://exchange.xforce.ibmcloud.com/vulnerabilities/90612
CVE: CVE-2013-4331
Published: 2014-02-02
Description: Light Display Manager (aka LightDM) 1.4.x before 1.4.3, 1.6.x before 1.6.2, and 1.7.x before 1.7.14 uses 0664 permissions for the temporary .Xauthority file, which allows local users to obtain sensitive information by reading the file.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: https://bugs.launchpad.net/lightdm/%2Bbug/685212; https://bugs.launchpad.net/lightdm/%2Bbug/685212
CVE: CVE-2013-6491
Published: 2014-02-02
Description: The python-qpid client (common/rpc/impl_qpid.py) in OpenStack Oslo before 2013.2 does not enforce SSL connections when qpid_protocol is set to ssl, which allows remote attackers to obtain sensitive information by sniffing the network.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-310
References: http://rhn.redhat.com/errata/RHSA-2014-0112.html; http://www.ubuntu.com/usn/USN-2247-1; https://bugs.launchpad.net/oslo/+bug/1158807
CVE: CVE-2013-7300
Published: 2014-02-02
Description: Absolute path traversal vulnerability in cantata before 1.2.2 allows local users to read arbitrary files via a full pathname in a request to the internal httpd server.  NOTE: this vulnerability can be leveraged by remote attackers using CVE-2013-7301.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://seclists.org/oss-sec/2014/q1/121; http://seclists.org/oss-sec/2014/q1/124; https://code.google.com/p/cantata/issues/detail?id=356
CVE: CVE-2013-7301
Published: 2014-02-02
Description: Cantata before 1.2.2 does not restrict access to files in the play queue, which allows remote attackers to obtain sensitive information by reading the songs in the queue.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://seclists.org/oss-sec/2014/q1/121; http://seclists.org/oss-sec/2014/q1/124; https://code.google.com/p/cantata/issues/detail?id=356
CVE: CVE-2014-0015
Published: 2014-02-02
Description: cURL and libcurl 7.10.6 through 7.34.0, when more than one authentication method is enabled, re-uses NTLM connections, which might allow context-dependent attackers to authenticate as other users via a request.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-287
References: http://archives.neohapsis.com/archives/bugtraq/2014-06/0172.html; http://curl.haxx.se/docs/adv_20140129.html; http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10743
CVE: CVE-2012-3427
Published: 2014-02-02
Description: EC2 Amazon Machine Image (AMI) in JBoss Enterprise Application Platform (EAP) 5.1.2 uses 755 permissions for /var/cache/jboss-ec2-eap/, which allows local users to read sensitive information such as Amazon Web Services (AWS) credentials by reading files in the directory.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://rhn.redhat.com/errata/RHSA-2012-1376.html; http://secunia.com/advisories/51016; http://www.osvdb.org/86409
CVE: CVE-2013-0234
Published: 2014-02-02
Description: Cross-site scripting (XSS) vulnerability in the Twitter widget in Elgg before 1.7.17 and 1.8.x before 1.8.13 allows remote attackers to inject arbitrary web script or HTML via the params[twitter_username] parameter to action/widgets/save.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://blog.elgg.org/pg/blog/cash/read/223/elgg-1813-and-1717; http://packetstormsecurity.com/files/119903/Elgg-Twitter-Widget-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2013/Jan/251
CVE: CVE-2011-4327
Published: 2014-02-03
Description: ssh-keysign.c in ssh-keysign in OpenSSH before 5.8p2 on certain platforms executes ssh-rand-helper with unintended open file descriptors, which allows local users to obtain sensitive key information via the ptrace system call.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://www.openssh.com/txt/portable-keysign-rand-helper.adv; https://bugzilla.redhat.com/show_bug.cgi?id=755640; http://www.openssh.com/txt/portable-keysign-rand-helper.adv
CVE: CVE-2012-2249
Published: 2014-02-03
Description: Tor before 0.2.3.23-rc allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a renegotiation attempt that occurs after the initiation of the V3 link protocol.
CVSS Score: 5.0 (MEDIUM)
References: https://gitweb.torproject.org/tor.git?a=blob_plain%3Bhb=HEAD%3Bf=ChangeLog; https://gitweb.torproject.org/tor.git?a=blob_plain%3Bhb=HEAD%3Bf=ChangeLog
CVE: CVE-2012-2250
Published: 2014-02-03
Description: Tor before 0.2.3.24-rc allows remote attackers to cause a denial of service (assertion failure and daemon exit) by performing link protocol negotiation incorrectly.
CVSS Score: 5.0 (MEDIUM)
References: https://gitweb.torproject.org/tor.git?a=blob_plain%3Bhb=HEAD%3Bf=ChangeLog; https://gitweb.torproject.org/tor.git?a=blob_plain%3Bhb=HEAD%3Bf=ChangeLog
CVE: CVE-2013-4738
Published: 2014-02-03
Description: Multiple stack-based buffer overflows in the MSM camera driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allow attackers to gain privileges via (1) a crafted VIDIOC_MSM_VPE_DEQUEUE_STREAM_BUFF_INFO ioctl call, related to drivers/media/platform/msm/camera_v2/pproc/vpe/msm_vpe.c, or (2) a crafted VIDIOC_MSM_CPP_DEQUEUE_STREAM_BUFF_INFO ioctl call, related to drivers/media/platform/msm/camera_v2/pproc/cpp/msm_cpp.c.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://www.openwall.com/lists/oss-security/2013/10/15/4; https://www.codeaurora.org/projects/security-advisories/stack-based-buffer-overflow-and-memory-disclosure-camera-driver-cve-2013-4748-cve-2013-4739; http://www.openwall.com/lists/oss-security/2013/10/15/4
CVE: CVE-2013-4739
Published: 2014-02-03
Description: The MSM camera driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows attackers to obtain sensitive information from kernel stack memory via (1) a crafted MSM_MCR_IOCTL_EVT_GET ioctl call, related to drivers/media/platform/msm/camera_v1/mercury/msm_mercury_sync.c, or (2) a crafted MSM_JPEG_IOCTL_EVT_GET ioctl call, related to drivers/media/platform/msm/camera_v2/jpeg_10/msm_jpeg_sync.c.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-200
References: http://www.openwall.com/lists/oss-security/2013/10/15/4; https://www.codeaurora.org/projects/security-advisories/stack-based-buffer-overflow-and-memory-disclosure-camera-driver-cve-2013-4748-cve-2013-4739; http://www.openwall.com/lists/oss-security/2013/10/15/4
CVE: CVE-2013-5427
Published: 2014-02-04
Description: Cross-site request forgery (CSRF) vulnerability in IBM InfoSphere Master Data Management - Collaborative Edition 10.x before 10.1 FP8 through 11.0 and InfoSphere Master Data Management Server for Product Information Management 9.0 and 9.1 allows remote attackers to hijack the authentication of arbitrary users.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www.ibm.com/support/docview.wss?uid=swg21663181; https://exchange.xforce.ibmcloud.com/vulnerabilities/87536; http://www.ibm.com/support/docview.wss?uid=swg21663181
CVE: CVE-2013-6032
Published: 2014-02-04
Description: cgi-bin/postpf/cgi-bin/dynamic/config/config.html on Lexmark X94x before LC.BR.P142, X85x through LC4.BE.P487, X644 and X646 before LC2.MC.P374, X642 through LC2.MB.P318, W840 through LS.HA.P252, T64x before LS.ST.P344, X64xef through LC2.TI.P325, C935dn through LC.JO.P091, C920 through LS.TA.P152, C78x through LC.IO.P187, X78x through LC2.IO.P335, C77x through LC.CM.P052, X772 through LC2.TR.P291, C53x through LS.SW.P069, C52x through LS.FA.P150, 25xxN through LCL.CU.P114, N4000 through LC.MD.P119, N4050e through GO.GO.N206, N70xxe through LC.CO.N309, E450 through LM.SZ.P124, E350 through LE.PH.P129, and E250 through LE.PM.P126 printers allows remote attackers to remove the Password Protect administrative password via the vac.255.GENPASSWORD parameter.
CVSS Score: 10.0 (HIGH)
CWE: CWE-20
References: http://support.lexmark.com/index?page=content&id=TE586; http://www.kb.cert.org/vuls/id/108062; http://support.lexmark.com/index?page=content&id=TE586
CVE: CVE-2013-6033
Published: 2014-02-04
Description: Multiple cross-site scripting (XSS) vulnerabilities on Lexmark W840 through LS.HA.P252, T64x before LS.ST.P344, C935dn through LC.JO.P091, C920 through LS.TA.P152, C53x through LS.SW.P069, C52x through LS.FA.P150, E450 through LM.SZ.P124, E350 through LE.PH.P129, and E250 through LE.PM.P126 printers allow remote authenticated users to inject arbitrary web script or HTML by using (1) SNMP or (2) the Embedded Web Server (EWS) to set the (a) Contact or (b) Location field.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://support.lexmark.com/index?page=content&id=TE585; http://www.kb.cert.org/vuls/id/108062; http://www.osvdb.org/102752
CVE: CVE-2013-6034
Published: 2014-02-04
Description: The firmware on GateHouse; Harris BGAN RF-7800B-VU204 and BGAN RF-7800B-DU204; Hughes Network Systems 9201, 9450, and 9502; Inmarsat; Japan Radio JUE-250 and JUE-500; and Thuraya IP satellite terminals has hardcoded credentials, which makes it easier for attackers to obtain unspecified login access via unknown vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-255
References: http://www.kb.cert.org/vuls/id/250358; http://www.kb.cert.org/vuls/id/250358
CVE: CVE-2013-6035
Published: 2014-02-04
Description: The firmware on GateHouse; Harris BGAN RF-7800B-VU204 and BGAN RF-7800B-DU204; Hughes Network Systems 9201, 9450, and 9502; Inmarsat; Japan Radio JUE-250 and JUE-500; and Thuraya IP satellite terminals does not require authentication for sessions on TCP port 1827, which allows remote attackers to execute arbitrary code via unspecified protocol operations.
CVSS Score: 10.0 (HIGH)
CWE: CWE-287
References: http://www.kb.cert.org/vuls/id/250358; http://www.kb.cert.org/vuls/id/250358
CVE: CVE-2013-7179
Published: 2014-02-04
Description: The ping functionality in cgi-bin/diagnostic.cgi on Seowon Intech SWC-9100 routers allows remote attackers to execute arbitrary commands via shell metacharacters in the ping_ipaddr parameter.
CVSS Score: 8.3 (HIGH)
CWE: CWE-20
References: http://secunia.com/advisories/56756; http://www.kb.cert.org/vuls/id/431726; http://secunia.com/advisories/56756
CVE: CVE-2013-7181
Published: 2014-02-04
Description: Cross-site scripting (XSS) vulnerability in user/ldap_user/add in Fortinet FortiOS 5.0.3 allows remote attackers to inject arbitrary web script or HTML via the filter parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/fulldisclosure/2014-02/0015.html; http://osvdb.org/102820; http://secunia.com/advisories/56732
CVE: CVE-2013-7182
Published: 2014-02-04
Description: Cross-site scripting (XSS) vulnerability in firewall/schedule/recurrdlg in Fortinet FortiOS 5.0.5 allows remote attackers to inject arbitrary web script or HTML via the mkey parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/fulldisclosure/2014-02/0016.html; http://osvdb.org/102819; http://secunia.com/advisories/56739
CVE: CVE-2013-7183
Published: 2014-02-04
Description: cgi-bin/reboot.cgi on Seowon Intech SWC-9100 routers allows remote attackers to (1) cause a denial of service (reboot) via a default_reboot action or (2) reset all configuration values via a factory_default action.
CVSS Score: 7.8 (HIGH)
CWE: CWE-287
References: http://osvdb.org/102817; http://secunia.com/advisories/56756; http://www.kb.cert.org/vuls/id/431726
CVE: CVE-2014-0329
Published: 2014-02-04
Description: The TELNET service on the ZTE ZXV10 W300 router 2.1.0 has a hardcoded password ending with airocon for the admin account, which allows remote attackers to obtain administrative access by leveraging knowledge of the MAC address characters present at the beginning of the password.
CVSS Score: 9.3 (HIGH)
CWE: CWE-255
References: http://blog.alguien.at/2014/02/hackeando-el-router-zte-zxv10-w300-v21.html; http://osvdb.org/102816; http://packetstormsecurity.com/files/125142/ZTE-ZXV10-W300-Hardcoded-Credentials.html
CVE: CVE-2014-0686
Published: 2014-02-04
Description: Cisco Unified Communications Manager (aka Unified CM) 9.1 (2.10000.28) and earlier allows local users to gain privileges by leveraging incorrect file permissions, aka Bug IDs CSCul24917 and CSCul24908.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/102750; http://secunia.com/advisories/56818; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0686
CVE: CVE-2014-0834
Published: 2014-02-04
Description: IBM General Parallel File System (GPFS) 3.4 through 3.4.0.27 and 3.5 through 3.5.0.16 allows attackers to cause a denial of service (daemon crash) via crafted arguments to a setuid program.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-20
References: http://osvdb.org/102765; http://www-01.ibm.com/support/docview.wss?uid=isg3T1020542; http://www-01.ibm.com/support/docview.wss?uid=swg1IV52863
CVE: CVE-2013-3098
Published: 2014-02-04
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in TRENDnet TEW-812DRU router with firmware before 1.0.9.0 allow remote attackers to hijack the authentication of administrators for requests that (1) change admin credentials in a request to setSysAdm.cgi, (2) enable remote management or (3) enable port forwarding in an Apply action to uapply.cgi, or (4) have unspecified impact via a request to setNTP.cgi.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://infosec42.blogspot.com/2013/07/exploit-trendnet-tew-812dru-csrfcommand.html; http://osvdb.org/95803; http://secunia.com/advisories/54310
CVE: CVE-2013-3365
Published: 2014-02-04
Description: TRENDnet TEW-812DRU router allows remote authenticated users to execute arbitrary commands via shell metacharacters in the (1) wan network prefix to internet/ipv6.asp; (2) remote port to adm/management.asp; (3) pptp username, (4) pptp password, (5) ip, (6) gateway, (7) l2tp username, or (8) l2tp password to internet/wan.asp; (9) NtpDstStart, (10) NtpDstEnd, or (11) NtpDstOffset to adm/time.asp; or (12) device url to adm/management.asp.  NOTE: vectors 9, 10, and 11 can be exploited by unauthenticated remote attackers by leveraging CVE-2013-3098.
CVSS Score: 8.5 (HIGH)
CWE: CWE-78
References: http://infosec42.blogspot.com/2013/07/exploit-trendnet-tew-812dru-csrfcommand.html; http://securityevaluators.com/content/case-studies/routers/Vulnerability_Catalog.pdf; http://infosec42.blogspot.com/2013/07/exploit-trendnet-tew-812dru-csrfcommand.html
CVE: CVE-2014-0019
Published: 2014-02-04
Description: Stack-based buffer overflow in socat 1.3.0.0 through 1.7.2.2 and 2.0.0-b1 through 2.0.0-b6 allows local users to cause a denial of service (segmentation fault) via a long server name in the PROXY-CONNECT address in the command line.
CVSS Score: 1.9 (LOW)
CWE: CWE-119
References: http://lists.fedoraproject.org/pipermail/package-announce/2014-February/128190.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-February/128229.html; http://lists.opensuse.org/opensuse-updates/2015-04/msg00043.html
CVE: CVE-2014-1471
Published: 2014-02-04
Description: SQL injection vulnerability in the StateGetStatesByType function in Kernel/System/State.pm in Open Ticket Request System (OTRS) 3.1.x before 3.1.19, 3.2.x before 3.2.14, and 3.3.x before 3.3.4 allows remote attackers to execute arbitrary SQL commands via vectors related to a ticket search URL.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/102661; http://secunia.com/advisories/56644; http://secunia.com/advisories/56655
CVE: CVE-2014-1694
Published: 2014-02-04
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in (1) CustomerPreferences.pm, (2) CustomerTicketMessage.pm, (3) CustomerTicketProcess.pm, and (4) CustomerTicketZoom.pm in Kernel/Modules/ in Open Ticket Request System (OTRS) 3.1.x before 3.1.19, 3.2.x before 3.2.14, and 3.3.x before 3.3.4 allow remote attackers to hijack the authentication of arbitrary users for requests that (5) create tickets or (6) send follow-ups to existing tickets.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://bugs.otrs.org/show_bug.cgi?id=10099; http://osvdb.org/102632; http://secunia.com/advisories/56644