deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-8524
Published: 2014-10-29
Description: McAfee Network Data Loss Prevention (NDLP) before 9.3 does not disable the autocomplete setting for the password and other fields, which allows remote attackers to obtain sensitive information via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10053; https://kc.mcafee.com/corporate/index?page=content&id=SB10053
CVE: CVE-2014-8525
Published: 2014-10-29
Description: McAfee Network Data Loss Prevention (NDLP) before 9.3 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/70823; https://exchange.xforce.ibmcloud.com/vulnerabilities/98431; https://kc.mcafee.com/corporate/index?page=content&id=SB10053
CVE: CVE-2014-8526
Published: 2014-10-29
Description: McAfee Network Data Loss Prevention (NDLP) before 9.3 allows local users to obtain sensitive information by reading a Java stack trace.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10053; https://kc.mcafee.com/corporate/index?page=content&id=SB10053
CVE: CVE-2014-8527
Published: 2014-10-29
Description: McAfee Network Data Loss Prevention (NDLP) before 9.3 allows local users to obtain sensitive information and affect integrity via vectors related to a "plain text password."
CVSS Score: 3.6 (LOW)
CWE: CWE-255
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10053; https://kc.mcafee.com/corporate/index?page=content&id=SB10053
CVE: CVE-2014-8528
Published: 2014-10-29
Description: McAfee Network Data Loss Prevention (NDLP) before 9.3 logs session IDs, which allows local users to obtain sensitive information by reading the audit log.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10053; https://kc.mcafee.com/corporate/index?page=content&id=SB10053
CVE: CVE-2014-8529
Published: 2014-10-29
Description: McAfee Network Data Loss Prevention (NDLP) before 9.3 stores the SSH key in cleartext, which allows local users to obtain sensitive information via unspecified vectors.
CVSS Score: 2.1 (LOW)
CWE: CWE-310
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10053; https://kc.mcafee.com/corporate/index?page=content&id=SB10053
CVE: CVE-2014-8530
Published: 2014-10-29
Description: Unspecified vulnerability in McAfee Network Data Loss Prevention (NDLP) before 9.3 allows remote attackers to obtain sensitive information, affect integrity, or cause a denial of service via unknown vectors, related to simultaneous logins.
CVSS Score: 7.5 (HIGH)
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10053; https://kc.mcafee.com/corporate/index?page=content&id=SB10053
CVE: CVE-2014-8531
Published: 2014-10-29
Description: The TLS/SSL Server in McAfee Network Data Loss Prevention (NDLP) before 9.3 uses weak cipher algorithms, which makes it easier for remote authenticated users to execute arbitrary code via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-310
References: http://www.securityfocus.com/bid/70831; https://exchange.xforce.ibmcloud.com/vulnerabilities/98432; https://kc.mcafee.com/corporate/index?page=content&id=SB10053
CVE: CVE-2014-8532
Published: 2014-10-29
Description: Unspecified vulnerability in McAfee Network Data Loss Prevention before (NDLP) before 9.3 allows local users to obtain sensitive information and impact integrity via unknown vectors, related to partition mounting.
CVSS Score: 3.6 (LOW)
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10053; https://kc.mcafee.com/corporate/index?page=content&id=SB10053
CVE: CVE-2014-8533
Published: 2014-10-29
Description: McAfee Network Data Loss Prevention (NDLP) before 9.3 allows remote attackers to execute arbitrary code via vectors related to ICMP redirection.
CVSS Score: 7.5 (HIGH)
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10053; https://kc.mcafee.com/corporate/index?page=content&id=SB10053
CVE: CVE-2014-8534
Published: 2014-10-29
Description: Unspecified vulnerability in the login form in McAfee Network Data Loss Prevention (NDLP) before 9.2.2 allows local users to cause a denial of service via a crafted value in the domain field.
CVSS Score: 2.1 (LOW)
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10044; https://kc.mcafee.com/corporate/index?page=content&id=SB10044
CVE: CVE-2014-8535
Published: 2014-10-29
Description: McAfee Network Data Loss Prevention (NDLP) before 9.2.2 allows local users to bypass intended restriction on unspecified functionality via unknown vectors.
CVSS Score: 4.6 (MEDIUM)
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10044; https://kc.mcafee.com/corporate/index?page=content&id=SB10044
CVE: CVE-2014-8536
Published: 2014-10-29
Description: McAfee Network Data Loss Prevention (NDLP) before 9.2.2 allows local users to obtain sensitive information by reading unspecified error messages.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://www.securityfocus.com/bid/70840; https://exchange.xforce.ibmcloud.com/vulnerabilities/98427; https://kc.mcafee.com/corporate/index?page=content&id=SB10044
CVE: CVE-2014-8537
Published: 2014-10-29
Description: McAfee Network Data Loss Prevention (NDLP) before 9.2.2 allows local users to obtain sensitive information by reading the logs.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://www.securityfocus.com/bid/70835; https://exchange.xforce.ibmcloud.com/vulnerabilities/98430; https://kc.mcafee.com/corporate/index?page=content&id=SB10044
CVE: CVE-2014-8538
Published: 2014-10-29
Description: The Hijab Modern (aka com.Aisyaidea.HijabModern) application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/200313; http://www.kb.cert.org/vuls/id/582497; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-7877
Published: 2014-10-30
Description: Unspecified vulnerability in the kernel in HP HP-UX B.11.31 allows local users to cause a denial of service via unknown vectors.
CVSS Score: 4.9 (MEDIUM)
References: http://secunia.com/advisories/61196; http://www.securityfocus.com/bid/70808; http://www.securitytracker.com/id/1031139
CVE: CVE-2013-3304
Published: 2014-10-30
Description: Directory traversal vulnerability in Dell EqualLogic PS4000 with firmware 6.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the default URI.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://www.exploit-db.com/exploits/35056; http://www.securityfocus.com/bid/70760; https://www.xlabs.com.br/blog/?p=50
CVE: CVE-2014-3446
Published: 2014-10-30
Description: SQL injection vulnerability in wcm/system/pages/admin/getnode.aspx in BSS Continuity CMS 4.2.22640.0 allows remote attackers to execute arbitrary SQL commands via the nodeid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://seclists.org/fulldisclosure/2014/May/87; http://www.securityfocus.com/bid/70861; https://exchange.xforce.ibmcloud.com/vulnerabilities/93280
CVE: CVE-2014-3584
Published: 2014-10-30
Description: The SamlHeaderInHandler in Apache CXF before 2.6.11, 2.7.x before 2.7.8, and 3.0.x before 3.0.1 allows remote attackers to cause a denial of service (infinite loop) via a crafted SAML token in the authorization header of a request to a JAX-RS service.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://cxf.apache.org/security-advisories.data/CVE-2014-3584.txt.asc; http://seclists.org/oss-sec/2014/q4/437; http://secunia.com/advisories/61909
CVE: CVE-2014-3623
Published: 2014-10-30
Description: Apache WSS4J before 1.6.17 and 2.x before 2.0.2, as used in Apache CXF 2.7.x before 2.7.13 and 3.0.x before 3.0.2, when using TransportBinding, does not properly enforce the SAML SubjectConfirmation method security semantics, which allows remote attackers to conduct spoofing attacks via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-287
References: http://rhn.redhat.com/errata/RHSA-2015-0236.html; http://rhn.redhat.com/errata/RHSA-2015-0675.html; http://rhn.redhat.com/errata/RHSA-2015-0850.html
CVE: CVE-2014-3684
Published: 2014-10-30
Description: The tm_adopt function in lib/Libifl/tm.c in Terascale Open-Source Resource and Queue Manager (aka TORQUE Resource Manager) 5.0.x, 4.5.x, 4.2.x, and earlier does not validate that the owner of the process also owns the adopted session id, which allows remote authenticated users to kill arbitrary processes via a crafted executable.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://advisories.mageia.org/MGASA-2014-0408.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-May/159183.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-May/159201.html
CVE: CVE-2013-7409
Published: 2014-10-30
Description: Buffer overflow in ALLPlayer 5.6.2 through 5.8.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in a .m3u (playlist) file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://osvdb.org/show/osvdb/98283; http://packetstormsecurity.com/files/123554/ALLPlayer-5.6.2-Buffer-Overflow.html; http://packetstormsecurity.com/files/123986/ALLPlayer-5.6.2-SEH-Buffer-Overflow.html
CVE: CVE-2014-3366
Published: 2014-10-31
Description: SQL injection vulnerability in the administrative web interface in Cisco Unified Communications Manager allows remote authenticated users to execute arbitrary SQL commands via a crafted response, aka Bug ID CSCup88089.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3366; http://www.securityfocus.com/bid/70855; http://www.securitytracker.com/id/1031160
CVE: CVE-2014-3372
Published: 2014-10-31
Description: Multiple cross-site scripting (XSS) vulnerabilities in the CCM reports interface in the Server in Cisco Unified Communications Manager allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug ID CSCuq90589.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/61003; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3372; http://tools.cisco.com/security/center/viewAlert.x?alertId=36292
CVE: CVE-2014-3373
Published: 2014-10-31
Description: Multiple cross-site scripting (XSS) vulnerabilities in the CCM Dialed Number Analyzer interface in the Server in Cisco Unified Communications Manager allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug ID CSCup92550.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/59692; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3373; http://tools.cisco.com/security/center/viewAlert.x?alertId=36294
CVE: CVE-2014-3374
Published: 2014-10-31
Description: Multiple cross-site scripting (XSS) vulnerabilities in the CCM admin interface in the Server in Cisco Unified Communications Manager allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug ID CSCuq90582.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/59696; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3374; http://tools.cisco.com/security/center/viewAlert.x?alertId=36295
CVE: CVE-2014-3375
Published: 2014-10-31
Description: Multiple cross-site scripting (XSS) vulnerabilities in the CCM Service interface in the Server in Cisco Unified Communications Manager allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug ID CSCuq90597.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/61025; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3375; http://tools.cisco.com/security/center/viewAlert.x?alertId=36297
CVE: CVE-2014-6101
Published: 2014-10-31
Description: Cross-site scripting (XSS) vulnerability in the redirect-login feature in IBM Business Process Manager (BPM) Advanced 7.5 through 8.5.5 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/61804; http://www-01.ibm.com/support/docview.wss?uid=swg1JR51211; http://www-01.ibm.com/support/docview.wss?uid=swg1JR51507
CVE: CVE-2014-6148
Published: 2014-10-31
Description: IBM Tivoli Application Dependency Discovery Manager (TADDM) 7.2.0.0 through 7.2.0.10, 7.2.1.0 through 7.2.1.6, and 7.2.2.0 through 7.2.2.2 does not require TADDM authentication for rptdesign downloads, which allows remote authenticated users to obtain sensitive database information via a crafted URL.
CVSS Score: 3.5 (LOW)
CWE: CWE-287
References: http://secunia.com/advisories/61785; http://www-01.ibm.com/support/docview.wss?uid=swg21688549; http://www.securityfocus.com/bid/70842
CVE: CVE-2014-6150
Published: 2014-10-31
Description: Cross-site scripting (XSS) vulnerability in IBM Tivoli Application Dependency Discovery Manager (TADDM) 7.2.1.0 through 7.2.1.6 and 7.2.2.0 through 7.2.2.2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://secunia.com/advisories/61785; http://www-01.ibm.com/support/docview.wss?uid=swg21688424; https://exchange.xforce.ibmcloud.com/vulnerabilities/96920
CVE: CVE-2013-0334
Published: 2014-10-31
Description: Bundler before 1.7, when multiple top-level source lines are used, allows remote attackers to install arbitrary gems by creating a gem with the same name as another gem in a different source.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://bundler.io/blog/2014/08/14/bundler-may-install-gems-from-a-different-source-than-expected-cve-2013-0334.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-October/140609.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-October/140654.html
CVE: CVE-2014-2334
Published: 2014-10-31
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Web User Interface in Fortinet FortiAnalyzer before 5.0.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2014-2336.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/61309; http://www.fortiguard.com/advisory/FG-IR-14-033/; http://www.securityfocus.com/bid/70887
CVE: CVE-2014-2335
Published: 2014-10-31
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Web User Interface in Fortinet FortiManager before 5.0.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2014-2336.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/61309; http://www.fortiguard.com/advisory/FG-IR-14-033/; https://exchange.xforce.ibmcloud.com/vulnerabilities/98478
CVE: CVE-2014-2336
Published: 2014-10-31
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Web User Interface in Fortinet FortiManager before 5.0.7 and FortiAnalyzer before 5.0.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2014-2334 and CVE-2014-2335.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/61309; http://www.fortiguard.com/advisory/FG-IR-14-033/; http://www.securityfocus.com/bid/70889
CVE: CVE-2014-3708
Published: 2014-10-31
Description: OpenStack Compute (Nova) before 2014.1.4 and 2014.2.x before 2014.2.1 allows remote authenticated users to cause a denial of service (CPU consumption) via an IP filter in a list active servers API request.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-399
References: http://lists.openstack.org/pipermail/openstack-announce/2014-October/000301.html; http://rhn.redhat.com/errata/RHSA-2015-0843.html; http://rhn.redhat.com/errata/RHSA-2015-0844.html
CVE: CVE-2014-7177
Published: 2014-10-31
Description: XML External Entity vulnerability in Enalean Tuleap 7.2 and earlier allows remote authenticated users to read arbitrary files via a crafted xml document in a create action to plugins/tracker/.
CVSS Score: 4.0 (MEDIUM)
References: http://seclists.org/fulldisclosure/2014/Oct/120; http://www.osvdb.org/113680; http://www.securityfocus.com/bid/70771
CVE: CVE-2014-7985
Published: 2014-10-31
Description: Directory traversal vulnerability in EspoCRM before 2.6.0 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the action parameter to install/index.php.
CVSS Score: 10.0 (HIGH)
CWE: CWE-22
References: http://blog.espocrm.com/news/espocrm-2-6-0-released; http://packetstormsecurity.com/files/128888/EspoCRM-2.5.2-XSS-LFI-Access-Control.html; http://www.securityfocus.com/archive/1/533844/100/0/threaded
CVE: CVE-2014-7986
Published: 2014-10-31
Description: install/index.php in EspoCRM before 2.6.0 allows remote attackers to re-install the application via a 1 value in the installProcess parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://blog.espocrm.com/news/espocrm-2-6-0-released; http://packetstormsecurity.com/files/128888/EspoCRM-2.5.2-XSS-LFI-Access-Control.html; http://www.securityfocus.com/archive/1/533844/100/0/threaded
CVE: CVE-2014-7987
Published: 2014-10-31
Description: Cross-site scripting (XSS) vulnerability in EspoCRM before 2.6.0 allows remote attackers to inject arbitrary web script or HTML via the desc parameter in an errors action to install/index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://blog.espocrm.com/news/espocrm-2-6-0-released; http://packetstormsecurity.com/files/128888/EspoCRM-2.5.2-XSS-LFI-Access-Control.html; http://www.securityfocus.com/archive/1/533844/100/0/threaded
CVE: CVE-2014-8081
Published: 2014-10-31
Description: lib/execute/execSetResults.php in TestLink before 1.9.13 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via the filter_result_result parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://karmainsecurity.com/KIS-2014-11; http://mantis.testlink.org/view.php?id=6651; http://seclists.org/fulldisclosure/2014/Oct/105
CVE: CVE-2014-8082
Published: 2014-10-31
Description: lib/functions/database.class.php in TestLink before 1.9.13 allows remote attackers to obtain sensitive information via unspecified vectors, which reveals the installation path in an error message.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://karmainsecurity.com/KIS-2014-12; http://mantis.testlink.org/view.php?id=6651; http://packetstormsecurity.com/files/128824/TestLink-1.9.12-Path-Disclosure.html
CVE: CVE-2014-8333
Published: 2014-10-31
Description: The VMware driver in OpenStack Compute (Nova) before 2014.1.4 allows remote authenticated users to cause a denial of service (disk consumption) by deleting an instance in the resize state.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-399
References: http://lists.openstack.org/pipermail/openstack-announce/2014-October/000298.html; http://rhn.redhat.com/errata/RHSA-2015-0843.html; http://rhn.redhat.com/errata/RHSA-2015-0844.html
CVE: CVE-2014-8334
Published: 2014-10-31
Description: The WP-DBManager (aka Database Manager) plugin before 2.7.2 for WordPress allows remote authenticated users to execute arbitrary commands via shell metacharacters in the (1) $backup['filepath'] (aka "Path to Backup:" field) or (2) $backup['mysqldumppath'] variable.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-78
References: http://osvdb.org/show/osvdb/113508; http://packetstormsecurity.com/files/128785/WordPress-Database-Manager-2.7.1-Command-Injection-Credential-Leak.html; http://seclists.org/fulldisclosure/2014/Oct/99
CVE: CVE-2014-8399
Published: 2014-10-31
Description: The default configuration in systemd-shim 8 enables the Abandon debugging clause, which allows local users to cause a denial of service via unspecified vectors.
CVSS Score: 2.1 (LOW)
References: http://www.ubuntu.com/usn/USN-2392-1; https://github.com/desrt/systemd-shim/commit/d2e91c118f[PII_REDACTED]a638007702d1cc665893; http://www.ubuntu.com/usn/USN-2392-1
CVE: CVE-2014-8495
Published: 2014-10-31
Description: Citrix XenMobile MDX Toolkit before 9.0.4, when used to wrap iOS 8 applications, does not properly encrypt cached application data, which allows context-dependent attackers to obtain sensitive information by reading the cache.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://support.citrix.com/article/CTX200260; http://www.securityfocus.com/bid/70799; http://www.securitytracker.com/id/1031164
CVE: CVE-2014-8509
Published: 2014-10-31
Description: The lazy_bdecode function in BitTorrent bootstrap-dht (aka Bootstrap) allows remote attackers to execute arbitrary code via a crafted packet, which triggers an out-of-bounds read, related to "Improper Indexing."
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/70812; http://www.zerodayinitiative.com/advisories/ZDI-14-370/; https://github.com/bittorrent/bootstrap-dht/commit/bbc0b7191e3f48461ca6e5b1b34bdf4b3f1e79a9
CVE: CVE-2014-8577
Published: 2014-10-31
Description: Multiple cross-site scripting (XSS) vulnerabilities in Croogo before 2.1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) data[Contact][title] parameter to admin/contacts/contacts/add page; (2) data[Block][title] or (3) data[Block][alias] parameter to admin/blocks/blocks/edit page; (4) data[Region][title] parameter to admin/blocks/regions/add page; (5) data[Menu][title] or (6) data[Menu][alias] parameter to admin/menus/menus/add page; or (7) data[Link][title] parameter to admin/menus/links/add/menu page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://blog.croogo.org/blog/croogo-210-released; http://packetstormsecurity.com/files/128639/Croogo-2.0.0-Cross-Site-Scripting.html; http://www.exploit-db.com/exploits/34959
CVE: CVE-2014-3473
Published: 2014-10-31
Description: Cross-site scripting (XSS) vulnerability in the Orchestration/Stack section in the Horizon Orchestration dashboard in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2, when used with Heat, allows remote Orchestration template owners or catalogs to inject arbitrary web script or HTML via a crafted template.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-updates/2015-01/msg00040.html; http://www.openwall.com/lists/oss-security/2014/07/08/6; http://www.securityfocus.com/bid/68459
CVE: CVE-2014-3474
Published: 2014-10-31
Description: Cross-site scripting (XSS) vulnerability in horizon/static/horizon/js/horizon.instances.js in the Launch Instance menu in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 allows remote authenticated users to inject arbitrary web script or HTML via a network name.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-updates/2015-01/msg00040.html; http://www.openwall.com/lists/oss-security/2014/07/08/6; http://www.securityfocus.com/bid/68460
CVE: CVE-2014-3475
Published: 2014-10-31
Description: Cross-site scripting (XSS) vulnerability in the Users panel (admin/users/) in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 allows remote administrators to inject arbitrary web script or HTML via a user email address, a different vulnerability than CVE-2014-8578.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-updates/2015-01/msg00040.html; http://www.openwall.com/lists/oss-security/2014/07/08/6; http://www.securityfocus.com/bid/68456