deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-4496
Published: 2015-01-30
Description: The mach_port_kobject interface in the kernel in Apple iOS before 8.1.3 and Apple TV before 7.0.3 does not properly restrict kernel-address and heap-permutation information, which makes it easier for attackers to bypass the ASLR protection mechanism via a crafted app.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce/2015/Jan/msg00000.html; http://lists.apple.com/archives/security-announce/2015/Jan/msg00001.html; http://lists.apple.com/archives/security-announce/2015/Mar/msg00002.html
CVE: CVE-2014-4497
Published: 2015-01-30
Description: Integer signedness error in IOBluetoothFamily in the Bluetooth implementation in Apple OS X before 10.10 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (write to kernel memory) via a crafted app.
CVSS Score: 10.0 (HIGH)
CWE: CWE-189
References: http://lists.apple.com/archives/security-announce/2015/Jan/msg00003.html; http://support.apple.com/HT204244; http://www.securitytracker.com/id/1031650
CVE: CVE-2014-4498
Published: 2015-01-30
Description: The CPU Software in Apple OS X before 10.10.2 allows physically proximate attackers to modify firmware during the EFI update process by inserting a Thunderbolt device with crafted code in an Option ROM, aka the "Thunderstrike" issue.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-17
References: http://lists.apple.com/archives/security-announce/2015/Jan/msg00003.html; http://support.apple.com/HT204244; http://www.securitytracker.com/id/1031650
CVE: CVE-2014-4499
Published: 2015-01-30
Description: The App Store process in CommerceKit Framework in Apple OS X before 10.10.2 places Apple ID credentials in App Store logs, which allows local users to obtain sensitive information by reading a file.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://lists.apple.com/archives/security-announce/2015/Jan/msg00003.html; http://support.apple.com/HT204244; http://www.securitytracker.com/id/1031650
CVE: CVE-2014-8816
Published: 2015-01-30
Description: CoreGraphics in Apple OS X before 10.10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted PDF document.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-399
References: http://lists.apple.com/archives/security-announce/2015/Jan/msg00003.html; http://support.apple.com/HT204244; http://www.securitytracker.com/id/1031650
CVE: CVE-2014-8817
Published: 2015-01-30
Description: coresymbolicationd in CoreSymbolication in Apple OS X before 10.10.2 does not verify that expected data types are present in XPC messages, which allows attackers to execute arbitrary code in a privileged context via a crafted app, as demonstrated by lack of verification of xpc_dictionary_get_value API return values during handling of a (1) match_mmap_archives, (2) delete_mmap_archives, (3) write_mmap_archive, or (4) read_mmap_archive command.
CVSS Score: 10.0 (HIGH)
CWE: CWE-19
References: http://lists.apple.com/archives/security-announce/2015/Jan/msg00003.html; http://support.apple.com/HT204244; http://www.securitytracker.com/id/1031650
CVE: CVE-2014-8819
Published: 2015-01-30
Description: The Intel Graphics Driver in Apple OS X before 10.10.2 allows local users to gain privileges via unspecified vectors, a different vulnerability than CVE-2014-8820 and CVE-2014-8821.
CVSS Score: 7.2 (HIGH)
References: http://lists.apple.com/archives/security-announce/2015/Jan/msg00003.html; http://support.apple.com/HT204244; http://www.securitytracker.com/id/1031650
CVE: CVE-2014-8820
Published: 2015-01-30
Description: The Intel Graphics Driver in Apple OS X before 10.10.2 allows local users to gain privileges via unspecified vectors, a different vulnerability than CVE-2014-8819 and CVE-2014-8821.
CVSS Score: 7.2 (HIGH)
References: http://lists.apple.com/archives/security-announce/2015/Jan/msg00003.html; http://support.apple.com/HT204244; http://www.securitytracker.com/id/1031650
CVE: CVE-2014-8821
Published: 2015-01-30
Description: The Intel Graphics Driver in Apple OS X before 10.10.2 allows local users to gain privileges via unspecified vectors, a different vulnerability than CVE-2014-8819 and CVE-2014-8820.
CVSS Score: 7.2 (HIGH)
References: http://lists.apple.com/archives/security-announce/2015/Jan/msg00003.html; http://support.apple.com/HT204244; http://www.securitytracker.com/id/1031650
CVE: CVE-2014-8822
Published: 2015-01-30
Description: IOHIDFamily in Apple OS X before 10.10.2 allows attackers to execute arbitrary code in a kernel context or cause a denial of service (write to kernel memory) via a crafted app that calls an unspecified user-client method.
CVSS Score: 10.0 (HIGH)
CWE: CWE-19
References: http://lists.apple.com/archives/security-announce/2015/Jan/msg00003.html; http://support.apple.com/HT204244; http://www.securitytracker.com/id/1031650
CVE: CVE-2014-8823
Published: 2015-01-30
Description: The IOUSBControllerUserClient::ReadRegister function in the IOUSB controller in IOUSBFamily in Apple OS X before 10.10.2 allows local users to read data from arbitrary kernel-memory locations by leveraging root access and providing a crafted first argument.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-264
References: http://code.google.com/p/google-security-research/issues/detail?id=21; http://lists.apple.com/archives/security-announce/2015/Jan/msg00003.html; http://support.apple.com/HT204244
CVE: CVE-2014-8824
Published: 2015-01-30
Description: The kernel in Apple OS X before 10.10.2 does not properly validate IODataQueue object metadata fields, which allows attackers to execute arbitrary code in a privileged context via a crafted app.
CVSS Score: 10.0 (HIGH)
CWE: CWE-20
References: http://lists.apple.com/archives/security-announce/2015/Jan/msg00003.html; http://support.apple.com/HT204244; http://www.securitytracker.com/id/1031650
CVE: CVE-2014-8825
Published: 2015-01-30
Description: The kernel in Apple OS X before 10.10.2 does not properly perform identitysvc validation of certain directory-service functionality, which allows local users to gain privileges or spoof directory-service responses via unspecified vectors.
CVSS Score: 7.2 (HIGH)
CWE: CWE-20
References: http://lists.apple.com/archives/security-announce/2015/Jan/msg00003.html; http://support.apple.com/HT204244; http://www.securitytracker.com/id/1031650
CVE: CVE-2014-8826
Published: 2015-01-30
Description: LaunchServices in Apple OS X before 10.10.2 does not properly handle file-type metadata, which allows attackers to bypass the Gatekeeper protection mechanism via a crafted JAR archive.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-19
References: http://lists.apple.com/archives/security-announce/2015/Jan/msg00003.html; http://packetstormsecurity.com/files/130147/OS-X-Gatekeeper-Bypass.html; http://seclists.org/fulldisclosure/2015/Jan/109
CVE: CVE-2014-8827
Published: 2015-01-30
Description: LoginWindow in Apple OS X before 10.10.2 does not transition to the lock-screen state immediately upon being woken from sleep, which allows physically proximate attackers to obtain sensitive information by reading the screen.
CVSS Score: 2.1 (LOW)
CWE: CWE-284
References: http://lists.apple.com/archives/security-announce/2015/Jan/msg00003.html; http://support.apple.com/HT204244; http://www.securitytracker.com/id/1031650
CVE: CVE-2014-8828
Published: 2015-01-30
Description: Sandbox in Apple OS X before 10.10 allows attackers to write to the sandbox-profile cache via a sandboxed app that includes a com.apple.sandbox segment in a path.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce/2015/Jan/msg00003.html; http://support.apple.com/HT204244; http://www.securitytracker.com/id/1031650
CVE: CVE-2014-8829
Published: 2015-01-30
Description: SceneKit in Apple OS X before 10.10.2 allows attackers to execute arbitrary code or cause a denial of service (out-of-bounds write) via a crafted app.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2015/Jan/msg00003.html; http://support.apple.com/HT204244; http://www.securitytracker.com/id/1031650
CVE: CVE-2014-8830
Published: 2015-01-30
Description: Heap-based buffer overflow in SceneKit in Apple OS X before 10.10.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted accessor element in a Collada file.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html; http://lists.apple.com/archives/security-announce/2015/Jan/msg00003.html; http://support.apple.com/HT204244
CVE: CVE-2014-8831
Published: 2015-01-30
Description: security_taskgate in Apple OS X before 10.10.2 allows attackers to read group-ACL-restricted keychain items of arbitrary apps via a crafted app with a signature from a (1) self-signed certificate or (2) Developer ID certificate.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce/2015/Jan/msg00003.html; http://support.apple.com/HT204244; http://www.securitytracker.com/id/1031650
CVE: CVE-2014-8832
Published: 2015-01-30
Description: The indexing functionality in Spotlight in Apple OS X before 10.10.2 writes memory contents to an external hard drive, which allows local users to obtain sensitive information by reading from this drive.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-200
References: http://lists.apple.com/archives/security-announce/2015/Jan/msg00003.html; http://support.apple.com/HT204244; http://www.securitytracker.com/id/1031650
CVE: CVE-2014-8833
Published: 2015-01-30
Description: SpotlightIndex in Apple OS X before 10.10.2 does not properly perform deserialization during access to a permission cache, which allows local users to read search results associated with other users' protected files via a Spotlight query.
CVSS Score: 2.1 (LOW)
CWE: CWE-284
References: http://lists.apple.com/archives/security-announce/2015/Jan/msg00003.html; http://support.apple.com/HT204244; http://www.securitytracker.com/id/1031650
CVE: CVE-2014-8834
Published: 2015-01-30
Description: UserAccountUpdater in Apple OS X 10.10 before 10.10.2 stores a PDF document's password in a printing preference file, which allows local users to obtain sensitive information by reading a file.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://lists.apple.com/archives/security-announce/2015/Jan/msg00003.html; http://support.apple.com/HT204244; http://www.securitytracker.com/id/1031650
CVE: CVE-2014-8835
Published: 2015-01-30
Description: The xpc_data_get_bytes function in libxpc in Apple OS X before 10.10.2 does not verify that a dictionary's Attributes key has the xpc_data data type, which allows attackers to execute arbitrary code by providing a crafted dictionary to sysmond, related to an "XPC type confusion" issue.
CVSS Score: 9.3 (HIGH)
CWE: CWE-19
References: http://lists.apple.com/archives/security-announce/2015/Jan/msg00003.html; http://packetstormsecurity.com/files/135701/OS-X-Sysmond-XPC-Type-Confusion-Privilege-Escalation.html; http://support.apple.com/HT204244
CVE: CVE-2014-8836
Published: 2015-01-30
Description: The Bluetooth driver in Apple OS X before 10.10.2 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (arbitrary-size bzero of kernel memory) via a crafted app.
CVSS Score: 10.0 (HIGH)
CWE: CWE-20
References: http://code.google.com/p/google-security-research/issues/detail?id=136; http://lists.apple.com/archives/security-announce/2015/Jan/msg00003.html; http://support.apple.com/HT204244
CVE: CVE-2014-8837
Published: 2015-01-30
Description: Multiple unspecified vulnerabilities in the Bluetooth driver in Apple OS X before 10.10.2 allow attackers to execute arbitrary code in a privileged context via a crafted app.
CVSS Score: 9.3 (HIGH)
References: http://lists.apple.com/archives/security-announce/2015/Jan/msg00003.html; http://support.apple.com/HT204244; http://www.securitytracker.com/id/1031650
CVE: CVE-2014-8838
Published: 2015-01-30
Description: The Security component in Apple OS X before 10.10.2 does not properly process cached information about app certificates, which allows attackers to bypass the Gatekeeper protection mechanism by leveraging access to a revoked Developer ID certificate for signing a crafted app.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce/2015/Jan/msg00003.html; http://support.apple.com/HT204244; http://www.securitytracker.com/id/1031650
CVE: CVE-2014-8839
Published: 2015-01-30
Description: Spotlight in Apple OS X before 10.10.2 does not enforce the Mail "Load remote content in messages" configuration, which allows remote attackers to discover recipient IP addresses by including an inline image in an HTML e-mail message and logging HTTP requests for this image's URL.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://heise.de/newsticker/meldung/Datenschutzpanne-in-Mac-OS-X-Yosemite-2514198.html; http://lists.apple.com/archives/security-announce/2015/Jan/msg00003.html; http://securitytracker.com/id/1031521
CVE: CVE-2014-8840
Published: 2015-01-30
Description: The iTunes Store component in Apple iOS before 8.1.3 allows remote attackers to bypass a Safari sandbox protection mechanism by leveraging redirection of an SSL URL to the iTunes Store.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-310
References: http://lists.apple.com/archives/security-announce/2015/Jan/msg00001.html; http://support.apple.com/HT204245; http://www.securitytracker.com/id/1031652
CVE: CVE-2014-9161
Published: 2015-01-30
Description: CoolType.dll in Adobe Reader and Acrobat 10.x before 10.1.13 and 11.x before 11.0.10 on Windows, and 10.x through 10.1.13 and 11.x through 11.0.10 on OS X, allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted PDF document.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://code.google.com/p/google-security-research/issues/detail?id=149; http://packetstormsecurity.com/files/134394/Adobe-Reader-X-XI-Out-Of-Bounds-Read.html; http://www.securityfocus.com/bid/74600
CVE: CVE-2014-4632
Published: 2015-02-01
Description: VMware vSphere Data Protection (VDP) 5.1, 5.5 before 5.5.9, and 5.8 before 5.8.1 and the proxy client in EMC Avamar Data Store (ADS) and Avamar Virtual Edition (AVE) 6.x and 7.0.x do not properly verify X.509 certificates from vCenter Server SSL servers, which allows man-in-the-middle attackers to spoof servers, and bypass intended backup and restore access restrictions, via a crafted certificate.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-310
References: http://archives.neohapsis.com/archives/bugtraq/2015-01/0154.html; http://www.securitytracker.com/id/1031664; http://www.vmware.com/security/advisories/VMSA-2015-0002.html
CVE: CVE-2014-7287
Published: 2015-02-01
Description: The key-management component in Symantec PGP Universal Server and Encryption Management Server before 3.3.2 MP7 allows remote attackers to trigger unintended content in outbound e-mail messages via a crafted key UID value in an inbound e-mail message, as demonstrated by the outbound Subject header.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-74
References: http://www.securityfocus.com/bid/72307; http://www.securitytracker.com/id/1031673; http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20150129_00
CVE: CVE-2014-7288
Published: 2015-02-01
Description: Symantec PGP Universal Server and Encryption Management Server before 3.3.2 MP7 allow remote authenticated administrators to execute arbitrary shell commands via a crafted command line in a database-backup restore action.
CVSS Score: 9.0 (HIGH)
CWE: CWE-264
References: http://www.exploit-db.com/exploits/35949; http://www.osvdb.org/117766; http://www.securityfocus.com/bid/72308
CVE: CVE-2014-8266
Published: 2015-02-01
Description: Multiple cross-site scripting (XSS) vulnerabilities in the note-creation page in QPR Portal 2014.1.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) title or (2) body field.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.kb.cert.org/vuls/id/546340; http://www.kb.cert.org/vuls/id/546340
CVE: CVE-2014-8267
Published: 2015-02-01
Description: Cross-site scripting (XSS) vulnerability in QPR Portal 2014.1.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the RID parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.kb.cert.org/vuls/id/546340; http://www.kb.cert.org/vuls/id/546340
CVE: CVE-2014-8268
Published: 2015-02-01
Description: QPR Portal before 2012.2.1 allows remote attackers to modify or delete notes via a direct request.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-264
References: http://www.kb.cert.org/vuls/id/546340; http://www.kb.cert.org/vuls/id/546340
CVE: CVE-2015-0870
Published: 2015-02-01
Description: Cross-site scripting (XSS) vulnerability in hb.cgi in Nishishi Factory Fumy News Clipper 2.x before 2.5.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN33735535/995592/index.html; http://jvn.jp/en/jp/JVN33735535/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000010
CVE: CVE-2015-0926
Published: 2015-02-01
Description: Labtech before 100.237 on Linux uses world-writable permissions for root-executed scripts, which allows local users to gain privileges by modifying a script file.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-284
References: http://www.kb.cert.org/vuls/id/637068; http://www.kb.cert.org/vuls/id/637068
CVE: CVE-2014-7266
Published: 2015-02-01
Description: Algorithmic complexity vulnerability in Cybozu Remote Service Manager through 2.3.0 and 3.x through 3.1.2 allows remote attackers to cause a denial of service (CPU consumption) via vectors that trigger colliding hash-table keys.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-1983.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://jvn.jp/en/jp/JVN13566542/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000001; https://cs.cybozu.co.jp/2015/001245.html
CVE: CVE-2014-7269
Published: 2015-02-01
Description: ASUS JAPAN RT-AC87U routers with firmware 3.0.0.4.378.3754 and earlier, RT-AC68U routers with firmware 3.0.0.4.376.3715 and earlier, RT-AC56S routers with firmware 3.0.0.4.376.3715 and earlier, RT-N66U routers with firmware 3.0.0.4.376.3715 and earlier, and RT-N56U routers with firmware 3.0.0.4.376.3715 and earlier allow remote authenticated users to execute arbitrary OS commands via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-78
References: http://jvn.jp/en/jp/JVN77792759/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000011; http://www.asus.com/jp/News/PNzPd7vkXtrKWXHR
CVE: CVE-2014-7270
Published: 2015-02-01
Description: Cross-site request forgery (CSRF) vulnerability on ASUS JAPAN RT-AC87U routers with firmware 3.0.0.4.378.3754 and earlier, RT-AC68U routers with firmware 3.0.0.4.376.3715 and earlier, RT-AC56S routers with firmware 3.0.0.4.376.3715 and earlier, RT-N66U routers with firmware 3.0.0.4.376.3715 and earlier, and RT-N56U routers with firmware 3.0.0.4.376.3715 and earlier allows remote attackers to hijack the authentication of arbitrary users.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://jvn.jp/en/jp/JVN32631078/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000012; http://www.asus.com/jp/News/PNzPd7vkXtrKWXHR
CVE: CVE-2014-8630
Published: 2015-02-01
Description: Bugzilla before 4.0.16, 4.1.x and 4.2.x before 4.2.12, 4.3.x and 4.4.x before 4.4.7, and 5.x before 5.0rc1 allows remote authenticated users to execute arbitrary commands by leveraging the editcomponents privilege and triggering crafted input to a two-argument Perl open call, as demonstrated by shell metacharacters in a product name.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-77
References: http://advisories.mageia.org/MGASA-2015-0048.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-February/149921.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-February/149925.html
CVE: CVE-2014-9200
Published: 2015-02-01
Description: Stack-based buffer overflow in an unspecified DLL file in a DTM development kit in Schneider Electric Unity Pro, SoMachine, SoMove, SoMove Lite, Modbus Communication Library 2.2.6 and earlier, CANopen Communication Library 1.0.2 and earlier, EtherNet/IP Communication Library 1.0.0 and earlier, EM X80 Gateway DTM (MB TCP/SL), Advantys DTM for OTB, Advantys DTM for STB, KINOS DTM, SOLO DTM, and Xantrex DTMs allows remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-121, CWE-119
References: http://www.securityfocus.com/bid/72335; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2015-009-01; https://www.cisa.gov/news-events/ics-advisories/icsa-15-027-02
CVE: CVE-2015-0868
Published: 2015-02-01
Description: Unrestricted file upload vulnerability in Mrs. Shiromuku Perl CGI shiromuku(bu2)BBS before 2.91 allows remote attackers to execute arbitrary code by uploading an executable file.
CVSS Score: 7.5 (HIGH)
References: http://jvn.jp/en/jp/JVN94502417/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000008; http://www.t-okada.com/cgi-bin/sb2_data/sb2_data_news.cgi?action=data_list&cat=16#495
CVE: CVE-2015-0869
Published: 2015-02-01
Description: I-O DATA DEVICE NP-BBRM routers allow remote attackers to cause a denial of service (SSDP reflection) via UPnP requests.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://jvn.jp/en/jp/JVN27142693/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000009; http://www.iodata.jp/support/information/2015/np-bbrm/
CVE: CVE-2014-6136
Published: 2015-02-02
Description: IBM Security AppScan Standard 8.x and 9.x before 9.0.1.1 FP1 supports unencrypted sessions, which allows remote attackers to obtain sensitive information by sniffing the network.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://www-01.ibm.com/support/docview.wss?uid=swg21695170; https://exchange.xforce.ibmcloud.com/vulnerabilities/96816; http://www-01.ibm.com/support/docview.wss?uid=swg21695170
CVE: CVE-2014-6141
Published: 2015-02-02
Description: IBM Tivoli Monitoring (ITM) 6.2.0 through FP03, 6.2.1 through FP04, 6.2.2 through FP09, 6.2.3 through FP05, and 6.3.0 before FP04 allows remote authenticated users to bypass intended access restrictions and execute arbitrary commands by leveraging Take Action view authority to modify in-progress commands.
CVSS Score: 8.5 (HIGH)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg21690932; https://exchange.xforce.ibmcloud.com/vulnerabilities/96911; http://www-01.ibm.com/support/docview.wss?uid=swg21690932
CVE: CVE-2014-6170
Published: 2015-02-02
Description: The HTTPInput node in IBM WebSphere Message Broker 7.0 before 7.0.0.8 and 8.0 before 8.0.0.6 and IBM Integration Bus 9.0 before 9.0.0.4 allows remote attackers to obtain sensitive information by triggering a SOAP fault.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IT01929; http://www-01.ibm.com/support/docview.wss?uid=swg21690725; https://exchange.xforce.ibmcloud.com/vulnerabilities/98309
CVE: CVE-2014-7882
Published: 2015-02-02
Description: Unspecified vulnerability in HP SiteScope 11.1x and 11.2x allows remote authenticated users to gain privileges via unknown vectors.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-264
References: http://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04539443; http://secunia.com/advisories/62654; http://www.securityfocus.com/bid/72459
CVE: CVE-2014-8918
Published: 2015-02-02
Description: IBM Security AppScan Standard 8.x and 9.x before 9.0.1.1 FP1 does not properly verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-310
References: http://www-01.ibm.com/support/docview.wss?uid=swg21695170; https://exchange.xforce.ibmcloud.com/vulnerabilities/99304; http://www-01.ibm.com/support/docview.wss?uid=swg21695170