deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-1556
Published: 2014-07-23
Description: Mozilla Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7 allow remote attackers to execute arbitrary code via crafted WebGL content constructed with the Cesium JavaScript library.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://linux.oracle.com/errata/ELSA-2014-0918.html; http://secunia.com/advisories/59591; http://secunia.com/advisories/59719
CVE: CVE-2014-1557
Published: 2014-07-23
Description: The ConvolveHorizontally function in Skia, as used in Mozilla Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7, does not properly handle the discarding of image data during function execution, which allows remote attackers to execute arbitrary code by triggering prolonged image scaling, as demonstrated by scaling of a high-quality image.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://linux.oracle.com/errata/ELSA-2014-0918.html; http://secunia.com/advisories/59591; http://secunia.com/advisories/59719
CVE: CVE-2014-1558
Published: 2014-07-23
Description: Mozilla Firefox before 31.0 and Thunderbird before 31.0 allow remote attackers to cause a denial of service (X.509 certificate parsing outage) via a crafted certificate that does not use UTF-8 character encoding in a required context, a different vulnerability than CVE-2014-1559.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/60628; http://www.mozilla.org/security/announce/2014/mfsa2014-65.html; http://www.securitytracker.com/id/1030619
CVE: CVE-2014-1559
Published: 2014-07-23
Description: Mozilla Firefox before 31.0 and Thunderbird before 31.0 allow remote attackers to cause a denial of service (X.509 certificate parsing outage) via a crafted certificate that does not use UTF-8 character encoding in a required context, a different vulnerability than CVE-2014-1558.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/60628; http://www.mozilla.org/security/announce/2014/mfsa2014-65.html; http://www.oracle.com/technetwork/topics/security/bulletinapr2[PII_REDACTED].html
CVE: CVE-2014-1560
Published: 2014-07-23
Description: Mozilla Firefox before 31.0 and Thunderbird before 31.0 allow remote attackers to cause a denial of service (X.509 certificate parsing outage) via a crafted certificate that does not use ASCII character encoding in a required context.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/60628; http://www.mozilla.org/security/announce/2014/mfsa2014-65.html; http://www.securitytracker.com/id/1030619
CVE: CVE-2014-1561
Published: 2014-07-23
Description: Mozilla Firefox before 31.0 does not properly restrict use of drag-and-drop events to spoof customization events, which allows remote attackers to alter the placement of UI icons via crafted JavaScript code that is encountered during (1) page, (2) panel, or (3) toolbar customization.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/59760; http://secunia.com/advisories/60628; http://www.mozilla.org/security/announce/2014/mfsa2014-60.html
CVE: CVE-2014-3537
Published: 2014-07-23
Description: The web interface in CUPS before 1.7.4 allows local users in the lp group to read arbitrary files via a symlink attack on a file in /var/cache/cups/rss/.
CVSS Score: 1.2 (LOW)
CWE: CWE-59
References: http://advisories.mageia.org/MGASA-2014-0313.html; http://archives.neohapsis.com/archives/bugtraq/2014-10/0101.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-July/135528.html
CVE: CVE-2014-3555
Published: 2014-07-23
Description: OpenStack Neutron before 2013.2.4, 2014.x before 2014.1.2, and Juno before Juno-2 allows remote authenticated users to cause a denial of service (crash or long firewall rule updates) by creating a large number of allowed address pairs.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://lists.openstack.org/pipermail/openstack-announce/2014-July/000255.html; http://rhn.redhat.com/errata/RHSA-2014-1119.html; http://rhn.redhat.com/errata/RHSA-2014-1120.html
CVE: CVE-2014-3938
Published: 2014-07-23
Description: Integer overflow in Autodesk SketchBook Pro before 6.2.6 allows remote attackers to execute arbitrary code via crafted layer mask data in a PSD file, which triggers a heap-based buffer overflow.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://secunia.com/advisories/58000; http://secunia.com/secunia_research/2014-6/; http://secunia.com/advisories/58000
CVE: CVE-2014-3939
Published: 2014-07-23
Description: Heap-based buffer overflow in Autodesk SketchBook Pro before 6.2.6 allows remote attackers to execute arbitrary code via crafted layer bitmap data in a PXD file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/58000; http://secunia.com/secunia_research/2014-7/; http://secunia.com/advisories/58000
CVE: CVE-2014-4501
Published: 2014-07-23
Description: Multiple stack-based buffer overflows in sgminer before 4.2.2, cgminer before 4.3.5, and BFGMiner before 3.3.0 allow remote pool servers to have unspecified impact via a long URL in a client.reconnect stratum message to the (1) extract_sockaddr or (2) parse_reconnect functions in util.c.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://seclists.org/fulldisclosure/2014/Jul/118; https://github.com/ckolivas/cgminer/commit/e1c[PII_REDACTED]973b99d181c45e74b2cbb00272e; https://github.com/luke-jr/bfgminer/commit/c80ad8548251eb0e15329fc240c89070640c9d79
CVE: CVE-2014-4502
Published: 2014-07-23
Description: Multiple heap-based buffer overflows in the parse_notify function in sgminer before 4.2.2, cgminer before 4.3.5, and BFGMiner before 4.1.0 allow remote pool servers to have unspecified impact via a (1) large or (2) negative value in the Extranonc2_size parameter in a mining.subscribe response and a crafted mining.notify request.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://seclists.org/fulldisclosure/2014/Jul/119; http://www.securityfocus.com/bid/68831; https://github.com/ckolivas/cgminer/commit/e1c[PII_REDACTED]973b99d181c45e74b2cbb00272e
CVE: CVE-2014-4503
Published: 2014-07-23
Description: The parse_notify function in util.c in sgminer before 4.2.2 and cgminer 3.3.0 through 4.0.1 allows man-in-the-middle attackers to cause a denial of service (application exit) via a crafted (1) bbversion, (2) prev_hash, (3) nbit, or (4) ntime parameter in a mining.notify action stratum message.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://seclists.org/fulldisclosure/2014/Jul/120; https://github.com/sgminer-dev/sgminer/commit/910c36089940e81fb85c65b8e63dcd2fac71470c; http://seclists.org/fulldisclosure/2014/Jul/120
CVE: CVE-2014-4980
Published: 2014-07-23
Description: The /server/properties resource in Tenable Web UI before 2.3.5 for Nessus 5.2.3 through 5.2.7 allows remote attackers to obtain sensitive information via the token parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://packetstormsecurity.com/files/127532/Tenable-Nessus-5.2.7-Parameter-Tampering-Authentication-Bypass.html; http://www.halock.com/blog/cve-2014-4980-parameter-tampering-nessus-web-ui/; http://www.osvdb.org/109376
CVE: CVE-2014-0607
Published: 2014-07-24
Description: Unrestricted file upload vulnerability in Attachmate Verastream Process Designer (VPD) before R6 SP1 Hotfix 1 allows remote attackers to execute arbitrary code by uploading and launching an executable file.
CVSS Score: 10.0 (HIGH)
References: http://support.attachmate.com/techdocs/2700.html; http://support.attachmate.com/techdocs/2700.html
CVE: CVE-2014-1419
Published: 2014-07-24
Description: Race condition in the power policy functions in policy-funcs in acpi-support before 0.142 allows local users to gain privileges via unspecified vectors.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-362
References: http://secunia.com/advisories/60319; http://www.debian.org/security/2014/dsa-2984; http://www.ubuntu.com/usn/USN-2297-1
CVE: CVE-2014-2360
Published: 2014-07-24
Description: OleumTech WIO DH2 Wireless Gateway and Sensor Wireless I/O Modules allow remote attackers to execute arbitrary code via packets that report a high battery voltage.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20, CWE-20
References: http://support.oleumtech.com/; http://www.securityfocus.com/bid/68797; https://www.cisa.gov/news-events/ics-advisories/icsa-14-202-01a
CVE: CVE-2014-2361
Published: 2014-07-24
Description: OleumTech WIO DH2 Wireless Gateway and Sensor Wireless I/O Modules, when BreeZ is used, do not require authentication for reading the site security key, which allows physically proximate attackers to spoof communication by obtaining this key after use of direct hardware access or manual-setup mode.
CVSS Score: 7.2 (HIGH)
CWE: CWE-320
References: http://support.oleumtech.com/; http://www.securityfocus.com/bid/68797; https://www.cisa.gov/news-events/ics-advisories/icsa-14-202-01a
CVE: CVE-2014-2362
Published: 2014-07-24
Description: OleumTech WIO DH2 Wireless Gateway and Sensor Wireless I/O Modules rely exclusively on a time value for entropy in key generation, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by predicting the time of project creation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-338
References: http://support.oleumtech.com/; http://www.securityfocus.com/bid/68797; https://www.cisa.gov/news-events/ics-advisories/icsa-14-202-01a
CVE: CVE-2014-2369
Published: 2014-07-24
Description: Cross-site request forgery (CSRF) vulnerability in the web application on Omron NS5, NS8, NS10, NS12, and NS15 HMI terminals 8.1xx through 8.68x allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://automation.omron.com/en/us/products/; https://www.cisa.gov/news-events/ics-advisories/icsa-14-203-01; http://ics-cert.us-cert.gov/advisories/ICSA-14-203-01
CVE: CVE-2014-2370
Published: 2014-07-24
Description: Cross-site scripting (XSS) vulnerability in the web application on Omron NS5, NS8, NS10, NS12, and NS15 HMI terminals 8.1xx through 8.68x allows remote authenticated users to inject arbitrary web script or HTML via crafted data.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://automation.omron.com/en/us/products/; https://www.cisa.gov/news-events/ics-advisories/icsa-14-203-01; http://ics-cert.us-cert.gov/advisories/ICSA-14-203-01
CVE: CVE-2014-2717
Published: 2014-07-24
Description: Honeywell FALCON XLWeb Linux controller devices 2.04.01 and earlier and FALCON XLWeb XLWebExe controller devices 2.02.11 and earlier allow remote attackers to bypass authentication and obtain administrative access by visiting the change-password page.
CVSS Score: 7.6 (HIGH)
References: http://ics-cert.us-cert.gov/advisories/ICSA-14-175-01; http://ics-cert.us-cert.gov/advisories/ICSA-14-175-01
CVE: CVE-2014-2968
Published: 2014-07-24
Description: Cross-site scripting (XSS) vulnerability in the web interface on the Huawei E355 CH1E355SM modem with software 21.157.37.01.910 and Web UI 11.001.08.00.03 allows remote attackers to inject arbitrary web script or HTML via an SMS message.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.kb.cert.org/vuls/id/688812; http://www.kb.cert.org/vuls/id/688812
CVE: CVE-2014-2971
Published: 2014-07-24
Description: Cross-site scripting (XSS) vulnerability in AddStdLetter.jsp in MicroPact iComplaints before 8.0.2.1.8.8014 allows remote authenticated users to inject arbitrary web script or HTML via the description parameter.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www.kb.cert.org/vuls/id/875548; http://www.kb.cert.org/vuls/id/875548
CVE: CVE-2014-3110
Published: 2014-07-24
Description: Multiple cross-site scripting (XSS) vulnerabilities on Honeywell FALCON XLWeb Linux controller devices 2.04.01 and earlier and FALCON XLWeb XLWebExe controller devices 2.02.11 and earlier allow remote attackers to inject arbitrary web script or HTML via invalid input.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://ics-cert.us-cert.gov/advisories/ICSA-14-175-01; http://www.securityfocus.com/bid/68838; https://www.exploit-db.com/exploits/44749/
CVE: CVE-2014-3322
Published: 2014-07-24
Description: Cisco IOS XR 4.3(.2) and earlier on ASR 9000 devices does not properly perform NetFlow sampling of IP packets, which allows remote attackers to cause a denial of service (chip and card hangs) via malformed (1) IPv4 or (2) IPv6 packets, aka Bug ID CSCuo68417.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/60311; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3322; http://tools.cisco.com/security/center/viewAlert.x?alertId=35009
CVE: CVE-2014-4682
Published: 2014-07-24
Description: The WebNavigator server in Siemens SIMATIC WinCC before 7.3, as used in PCS7 and other products, allows remote attackers to obtain sensitive information via an HTTP request.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-214365.pdf; http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-214365.pdf
CVE: CVE-2014-4683
Published: 2014-07-24
Description: The WebNavigator server in Siemens SIMATIC WinCC before 7.3, as used in PCS7 and other products, allows remote authenticated users to gain privileges via a (1) HTTP or (2) HTTPS request.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-264
References: http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-214365.pdf; http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-214365.pdf
CVE: CVE-2014-4684
Published: 2014-07-24
Description: The database server in Siemens SIMATIC WinCC before 7.3, as used in PCS7 and other products, allows remote authenticated users to gain privileges via a request to TCP port 1433.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-264
References: http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-214365.pdf; http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-214365.pdf
CVE: CVE-2014-4685
Published: 2014-07-24
Description: Siemens SIMATIC WinCC before 7.3, as used in PCS7 and other products, allows local users to gain privileges by leveraging weak system-object access control.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-264
References: http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-214365.pdf; http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-214365.pdf
CVE: CVE-2014-4686
Published: 2014-07-24
Description: The Project administration application in Siemens SIMATIC WinCC before 7.3, as used in PCS7 and other products, has a hardcoded encryption key, which allows remote attackers to obtain sensitive information by extracting this key from another product installation and then employing this key during the sniffing of network traffic on TCP port 1030.
CVSS Score: 6.8 (MEDIUM)
References: http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-214365.pdf; http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-214365.pdf
CVE: CVE-2014-4736
Published: 2014-07-24
Description: SQL injection vulnerability in E2 before 2.4 (2845) allows remote attackers to execute arbitrary SQL commands via the note-id parameter to @actions/comment-process.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/127594/E2-2844-SQL-Injection.html; http://www.securityfocus.com/archive/1/532867/100/0/threaded; http://www.securityfocus.com/bid/68843
CVE: CVE-2014-4910
Published: 2014-07-24
Description: Directory traversal vulnerability in tools/backlight_helper.c in X.Org xf86-video-intel 2.99.911 allows remote attackers to create or overwrite arbitrary files via a .. (dot dot) in the interface name.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-22
References: http://lists.x.org/archives/xorg-commit/2014-July/036840.html; http://osvdb.org/show/osvdb/108851; http://seclists.org/oss-sec/2014/q3/138
CVE: CVE-2014-4927
Published: 2014-07-24
Description: Buffer overflow in ACME micro_httpd, as used in D-Link DSL2750U and DSL2740U and NetGear WGR614 and MR-ADSL-DG834 routers allows remote attackers to cause a denial of service (crash) via a long string in the URI in a GET request.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://osvdb.org/show/osvdb/109356; http://packetstormsecurity.com/files/127544/ACME-micro_httpd-Denial-Of-Service.html; http://www.exploit-db.com/exploits/34102
CVE: CVE-2014-5015
Published: 2014-07-24
Description: bozotic HTTP server (aka bozohttpd) before 20140708, as used in NetBSD, truncates paths when checking .htpasswd restrictions, which allows remote attackers to bypass the HTTP authentication scheme and access restrictions via a long path.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2014-007.txt.asc; http://seclists.org/oss-sec/2014/q3/180; http://www.eterna.com.au/bozohttpd/
CVE: CVE-2014-5024
Published: 2014-07-24
Description: Cross-site scripting (XSS) vulnerability in sgms/panelManager in Dell SonicWALL GMS, Analyzer, and UMA before 7.2 SP1 allows remote attackers to inject arbitrary web script or HTML via the node_id parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/127575/SonicWALL-GMS-7.2-Build-7221.1701-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2014/Jul/125; http://secunia.com/advisories/60287
CVE: CVE-2014-2227
Published: 2014-07-25
Description: The default Flash cross-domain policy (crossdomain.xml) in Ubiquiti Networks UniFi Video (formerly AirVision aka AirVision Controller) before 3.0.1 does not restrict access to the application, which allows remote attackers to bypass the Same Origin Policy via a crafted SWF file.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-264
References: http://seclists.org/fulldisclosure/2014/Jul/128; http://sethsec.blogspot.com/2014/07/cve-2014-2227.html; http://www.securityfocus.com/bid/68866
CVE: CVE-2014-5027
Published: 2014-07-25
Description: Cross-site scripting (XSS) vulnerability in Review Board 1.7.x before 1.7.27 and 2.0.x before 2.0.4 allows remote attackers to inject arbitrary web script or HTML via a query parameter to a diff fragment page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/oss-sec/2014/q3/207; http://seclists.org/oss-sec/2014/q3/219; http://secunia.com/advisories/60243
CVE: CVE-2014-5100
Published: 2014-07-25
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in Omeka before 2.2.1 allow remote attackers to hijack the authentication of administrators for requests that (1) add a new super user account via a request to admin/users/add, (2) insert cross-site scripting (XSS) sequences via the api_key_label parameter to admin/users/api-keys/1, or (3) disable file validation via a request to admin/settings/edit-security.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://omeka.org/blog/2014/07/16/omeka-2-2-1-security-update-released; http://omeka.org/codex/Release_Notes_for_2.2.1; http://packetstormsecurity.com/files/127523/Omeka-2.2-Cross-Site-Request-Forgery-Cross-Site-Scripting.html
CVE: CVE-2014-5101
Published: 2014-07-25
Description: Multiple cross-site scripting (XSS) vulnerabilities in WeBid 1.1.1 allow remote attackers to inject arbitrary web script or HTML via the (1) TPL_name, (2) TPL_nick, (3) TPL_email, (4) TPL_year, (5) TPL_address, (6) TPL_city, (7) TPL_prov, (8) TPL_zip, (9) TPL_phone, (10) TPL_pp_email, (11) TPL_authnet_id, (12) TPL_authnet_pass, (13) TPL_worldpay_id, (14) TPL_toocheckout_id, or (15) TPL_moneybookers_email in a first action to register.php or the (16) username parameter in a login action to user_login.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/127431/WeBid-1.1.1-Cross-Site-Scripting-LDAP-Injection.html; http://www.securityfocus.com/bid/68519; http://packetstormsecurity.com/files/127431/WeBid-1.1.1-Cross-Site-Scripting-LDAP-Injection.html
CVE: CVE-2014-5102
Published: 2014-07-25
Description: SQL injection vulnerability in vBulletin 5.0.4 through 5.1.3 Alpha 5 allows remote attackers to execute arbitrary SQL commands via the criteria[startswith] parameter to ajax/render/memberlist_items.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/127537/vBulletin-5.1.2-SQL-Injection.html; http://www.pcworld.com/article/2455500/emergency-vbulletin-patch-fixes-dangerous-sql-injection-vulnerability.html; http://www.securityfocus.com/bid/68709
CVE: CVE-2014-5103
Published: 2014-07-25
Description: Cross-site scripting (XSS) vulnerability in ZOHO ManageEngine EventLog Analyzer 9 build 9000 allows remote attackers to inject arbitrary web script or HTML via the j_username parameter to event/j_security_check. Fixed in Version 10 Build 10000.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/127568/EventLog-Analyzer-9.0-Build-9000-Cross-Site-Scripting.html; http://www.securityfocus.com/archive/1/532856/100/0/threaded; http://www.securityfocus.com/bid/68854
CVE: CVE-2014-2363
Published: 2014-07-26
Description: Morpho Itemiser 3 8.17 has hardcoded administrative credentials, which makes it easier for remote attackers to obtain access via a login request.
CVSS Score: 10.0 (HIGH)
CWE: CWE-259
References: https://www.cisa.gov/news-events/ics-advisories/icsa-14-205-01; http://ics-cert.us-cert.gov/advisories/ICSA-14-205-01
CVE: CVE-2014-3071
Published: 2014-07-26
Description: Cross-site scripting (XSS) vulnerability in the Data Quality Console in IBM InfoSphere Information Server 11.3 allows remote attackers to inject arbitrary web script or HTML via a crafted URL for adding a project connection.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/59267; http://www-01.ibm.com/support/docview.wss?uid=swg1JR50453; http://www-01.ibm.com/support/docview.wss?uid=swg21677719
CVE: CVE-2014-3301
Published: 2014-07-26
Description: The ProfileAction controller in Cisco WebEx Meetings Server (CWMS) 1.5(.1.131) and earlier allows remote attackers to obtain sensitive information by reading stack traces in returned messages, aka Bug ID CSCuj81700.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://secunia.com/advisories/60573; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3301; http://tools.cisco.com/security/center/viewAlert.x?alertId=35040
CVE: CVE-2014-3305
Published: 2014-07-26
Description: Cross-site request forgery (CSRF) vulnerability in the web framework in Cisco WebEx Meetings Server 1.5(.1.131) and earlier allows remote attackers to hijack the authentication of unspecified victims via unknown vectors, aka Bug ID CSCuj81735.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3305; http://tools.cisco.com/security/center/viewAlert.x?alertId=35051; http://www.securityfocus.com/bid/68903
CVE: CVE-2014-3324
Published: 2014-07-26
Description: Multiple cross-site scripting (XSS) vulnerabilities in the login page in the administrative web interface in Cisco TelePresence Server Software 4.0(2.8) allow remote attackers to inject arbitrary web script or HTML via a crafted parameter, aka Bug ID CSCup90060.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/60456; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3324; http://tools.cisco.com/security/center/viewAlert.x?alertId=35031
CVE: CVE-2014-3326
Published: 2014-07-26
Description: SQL injection vulnerability in the web framework in Cisco Security Manager 4.5 and 4.6 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCup26957.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/60455; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3326; http://tools.cisco.com/security/center/viewAlert.x?alertId=35029