deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-1441
Published: 2014-05-02
Description: Core FTP Server 1.2 before build 515 allows remote attackers to cause a denial of service (reachable assertion and crash) via an AUTH SSL command with malformed data, as demonstrated by pressing the enter key twice.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-362
References: http://coreftp.com/forums/viewtopic.php?t=2985707; http://packetstormsecurity.com/files/125073/Core-FTP-Server-1.2-DoS-Traversal-Disclosure.html; http://seclists.org/fulldisclosure/2014/Feb/39
CVE: CVE-2014-1442
Published: 2014-05-02
Description: Directory traversal vulnerability in Core FTP Server 1.2 before build 515 allows remote authenticated users to determine the existence of arbitrary files via a /../ sequence in an XCRC command.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-22
References: http://coreftp.com/forums/viewtopic.php?t=2985707; http://packetstormsecurity.com/files/125073/Core-FTP-Server-1.2-DoS-Traversal-Disclosure.html; http://seclists.org/fulldisclosure/2014/Feb/39
CVE: CVE-2014-1443
Published: 2014-05-02
Description: Core FTP Server 1.2 before build 515 allows remote authenticated users to obtain sensitive information (password for the previous user) via a USER command with a specific length, possibly related to an out-of-bounds read.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-119
References: http://coreftp.com/forums/viewtopic.php?t=2985707; http://packetstormsecurity.com/files/125073/Core-FTP-Server-1.2-DoS-Traversal-Disclosure.html; http://seclists.org/fulldisclosure/2014/Feb/39
CVE: CVE-2014-1988
Published: 2014-05-02
Description: The Phone Messages feature in Cybozu Garoon 2.0.0 through 3.7 SP2 allows remote authenticated users to cause a denial of service (resource consumption) via unspecified vectors.
CVSS Score: 3.5 (LOW)
References: http://jvn.jp/en/jp/JVN90519014/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2014-000042; https://support.cybozu.com/ja-jp/article/8105
CVE: CVE-2014-1989
Published: 2014-05-02
Description: Cybozu Garoon 3.0 through 3.7 SP3 allows remote authenticated users to bypass intended access restrictions and delete schedule information via unspecified API calls.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-264
References: http://jvn.jp/en/jp/JVN31230946/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2014-000043; https://support.cybozu.com/ja/article/5264
CVE: CVE-2014-2156
Published: 2014-05-02
Description: Cisco TelePresence System MXP Series Software before F9.3.1 allows remote attackers to cause a denial of service (device reload) via crafted SIP packets, aka Bug ID CSCty45739.
CVSS Score: 7.1 (HIGH)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140430-mxp; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140430-mxp
CVE: CVE-2014-2157
Published: 2014-05-02
Description: Cisco TelePresence System MXP Series Software before F9.3.1 allows remote attackers to cause a denial of service (device reload) via crafted SIP packets, aka Bug ID CSCty45733.
CVSS Score: 7.1 (HIGH)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140430-mxp; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140430-mxp
CVE: CVE-2014-2158
Published: 2014-05-02
Description: Cisco TelePresence System MXP Series Software before F9.3.1 allows remote attackers to cause a denial of service (device reload) via crafted SIP packets, aka Bug ID CSCty45720.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140430-mxp; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140430-mxp
CVE: CVE-2014-2159
Published: 2014-05-02
Description: The H.225 subsystem in Cisco TelePresence System MXP Series Software before F9.3.1 allows remote attackers to cause a denial of service (device reload) via crafted packets, aka Bug ID CSCtq78722.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140430-mxp; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140430-mxp
CVE: CVE-2014-2160
Published: 2014-05-02
Description: The H.225 subsystem in Cisco TelePresence System MXP Series Software before F9.3.1 allows remote attackers to cause a denial of service (device reload) via crafted packets, aka Bug ID CSCty45745.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140430-mxp; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140430-mxp
CVE: CVE-2014-2161
Published: 2014-05-02
Description: The H.225 subsystem in Cisco TelePresence System MXP Series Software before F9.3.1 allows remote attackers to cause a denial of service (device reload) via crafted packets, aka Bug ID CSCty45731.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140430-mxp; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140430-mxp
CVE: CVE-2014-2162
Published: 2014-05-02
Description: The SIP implementation in Cisco TelePresence TC Software 4.x and 5.x and TE Software 4.x and 6.0 allows remote attackers to cause a denial of service (device reload) via crafted SIP packets, aka Bug ID CSCud29566.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140430-tcte; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140430-tcte
CVE: CVE-2014-2163
Published: 2014-05-02
Description: The SIP implementation in Cisco TelePresence TC Software 4.x and 5.x and TE Software 4.x allows remote attackers to cause a denial of service (device reload) via crafted SIP packets, aka Bug ID CSCua64961.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140430-tcte; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140430-tcte
CVE: CVE-2014-2164
Published: 2014-05-02
Description: The SIP implementation in Cisco TelePresence TC Software 4.x and 5.x and TE Software 4.x and 6.0 allows remote attackers to cause a denial of service (device reload) via crafted SIP packets, aka Bug ID CSCuj94651.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140430-tcte; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140430-tcte
CVE: CVE-2014-2165
Published: 2014-05-02
Description: The SIP implementation in Cisco TelePresence TC Software 4.x and 5.x and TE Software 4.x and 6.0 allows remote attackers to cause a denial of service (device reload) via crafted SIP packets, aka Bug ID CSCtq72699.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140430-tcte; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140430-tcte
CVE: CVE-2014-2166
Published: 2014-05-02
Description: The SIP implementation in Cisco TelePresence TC Software 4.x and TE Software 4.x allows remote attackers to cause a denial of service (device reload) via crafted SIP packets, aka Bug ID CSCto70562.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140430-tcte; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140430-tcte
CVE: CVE-2014-2167
Published: 2014-05-02
Description: The SIP implementation in Cisco TelePresence TC Software 4.x and 5.x and TE Software 4.x and 6.0 allows remote attackers to cause a denial of service (device reload) via crafted SIP packets, aka Bug ID CSCua86589.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140430-tcte; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140430-tcte
CVE: CVE-2014-2168
Published: 2014-05-02
Description: Buffer overflow in Cisco TelePresence TC Software 4.x and 5.x and TE Software 4.x and 6.0 allows remote attackers to execute arbitrary code via crafted DNS response packets, aka Bug ID CSCty44804.
CVSS Score: 7.6 (HIGH)
CWE: CWE-119
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140430-tcte; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140430-tcte
CVE: CVE-2014-2169
Published: 2014-05-02
Description: Cisco TelePresence TC Software 4.x through 6.x before 6.2.0 and TE Software 4.x and 6.0 allow remote authenticated users to execute arbitrary commands by using the commands as arguments to internal system scripts, aka Bug ID CSCue60211.
CVSS Score: 9.0 (HIGH)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140430-tcte; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140430-tcte
CVE: CVE-2014-2170
Published: 2014-05-02
Description: Cisco TelePresence TC Software 4.x and 5.x before 5.1.7 and 6.x before 6.0.1 and TE Software 4.x and 6.0 allow remote authenticated users to execute arbitrary commands by using the commands as arguments to tshell (aka tcsh) scripts, aka Bug ID CSCue60202.
CVSS Score: 9.0 (HIGH)
CWE: CWE-94
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140430-tcte; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140430-tcte
CVE: CVE-2014-2171
Published: 2014-05-02
Description: Heap-based buffer overflow in Cisco TelePresence TC Software 4.x through 6.x before 6.0.1 and TE Software 4.x and 6.0.x before 6.0.2 allows remote attackers to execute arbitrary code via crafted SIP packets, aka Bug ID CSCud81796.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140430-tcte; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140430-tcte
CVE: CVE-2014-2172
Published: 2014-05-02
Description: Buffer overflow in Cisco TelePresence TC Software 4.x and 5.x and TE Software 4.x and 6.0 allows local users to gain privileges by leveraging improper handling of the u-boot compiler flag for internal executable files, aka Bug ID CSCub67693.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-119
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140430-tcte; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140430-tcte
CVE: CVE-2014-2173
Published: 2014-05-02
Description: Cisco TelePresence TC Software 4.x and 5.x and TE Software 4.x and 6.0 do not properly restrict access to the serial port, which allows local users to gain privileges via unspecified commands, aka Bug ID CSCub67692.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140430-tcte; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140430-tcte
CVE: CVE-2014-2175
Published: 2014-05-02
Description: Cisco TelePresence TC Software 4.x and 5.x and TE Software 4.x and 6.0 allow remote attackers to cause a denial of service (memory consumption) via crafted H.225 packets, aka Bug ID CSCtq78849.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140430-tcte; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140430-tcte
CVE: CVE-2014-3139
Published: 2014-05-02
Description: recoveryconsole/bpl/snmpd.php in Unitrends Enterprise Backup 7.3.0 allows remote attackers to bypass authentication by setting the auth parameter to a certain string.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://seclists.org/fulldisclosure/2014/Apr/204; http://www.exploit-db.com/exploits/32885; https://gist.github.com/brandonprry/10745756
CVE: CVE-2013-7060
Published: 2014-05-02
Description: Products/CMFPlone/FactoryTool.py in Plone 3.3 through 4.3.2 allows remote attackers to obtain the installation path via vectors related to a file object for unspecified documentation which is initialized in class scope.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www.openwall.com/lists/oss-security/2013/12/10/15; http://www.openwall.com/lists/oss-security/2013/12/12/3; https://plone.org/security/20131210/path-leak
CVE: CVE-2013-7061
Published: 2014-05-02
Description: Products/CMFPlone/CatalogTool.py in Plone 3.3 through 4.3.2 allows remote administrators to bypass restrictions and obtain sensitive information via an unspecified search API.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-264
References: http://www.openwall.com/lists/oss-security/2013/12/10/15; http://www.openwall.com/lists/oss-security/2013/12/12/3; https://plone.org/security/20131210/catalogue-exposure
CVE: CVE-2014-0189
Published: 2014-05-02
Description: virt-who uses world-readable permissions for /etc/sysconfig/virt-who, which allows local users to obtain password for hypervisors by reading the file.
CVSS Score: 2.1 (LOW)
CWE: CWE-310
References: http://rhn.redhat.com/errata/RHSA-2015-0430.html; http://www.openwall.com/lists/oss-security/2014/04/28/2; http://www.securityfocus.com/bid/67089
CVE: CVE-2014-1899
Published: 2014-05-02
Description: Cross-site scripting (XSS) vulnerability in Citrix NetScaler Gateway (formerly Citrix Access Gateway Enterprise Edition) 9.x before 9.3.66.5 and 10.x before 10.1.123.9 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/67177; http://www.securitytracker.com/id/1030186; https://support.citrix.com/article/CTX140291
CVE: CVE-2014-2322
Published: 2014-05-02
Description: lib/string_utf_support.rb in the Arabic Prawn 0.0.1 gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) downloaded_file or (2) url variable.
CVSS Score: 7.5 (HIGH)
References: http://www.openwall.com/lists/oss-security/2014/03/10/8; http://www.openwall.com/lists/oss-security/2014/03/12/6; http://www.vapid.dhs.org/advisories/arabic-ruby-gem.html
CVE: CVE-2014-2905
Published: 2014-05-02
Description: fish (aka fish-shell) 1.16.0 before 2.1.1 does not properly check the credentials, which allows local users to gain privileges via the universal variable socket, related to /tmp/fishd.socket.user permissions.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00059.html; http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00071.html; http://www.openwall.com/lists/oss-security/2014/04/28/4
CVE: CVE-2014-3000
Published: 2014-05-02
Description: The TCP reassembly function in the inet module in FreeBSD 8.3 before p16, 8.4 before p9, 9.1 before p12, 9.2 before p5, and 10.0 before p2 allows remote attackers to cause a denial of service (undefined memory access and system crash) or possibly read system memory via multiple crafted packets, related to moving a reassemble queue entry to the segment list when the queue is full.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/58293; http://secunia.com/advisories/59034; http://www.debian.org/security/2014/dsa-2952
CVE: CVE-2014-3001
Published: 2014-05-02
Description: The device file system (aka devfs) in FreeBSD 10.0 before p2 does not load default rulesets when booting, which allows context-dependent attackers to bypass intended restrictions by leveraging a jailed device node process.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-264
References: http://www.freebsd.org/security/advisories/FreeBSD-SA-14:07.devfs.asc; http://www.securityfocus.com/bid/67158; http://www.securitytracker.com/id/1030171
CVE: CVE-2014-3006
Published: 2014-05-02
Description: Sitepark Information Enterprise Server (IES) 2.9 before 2.9.6, when upgraded from an earlier version, does not properly restrict access, which allows remote attackers to change the manager account password and obtain sensitive information via a request to install/.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://seclists.org/fulldisclosure/2014/Apr/317; http://www.securityfocus.com/archive/1/531986/100/0/threaded; http://www.securityfocus.com/bid/67165
CVE: CVE-2014-3125
Published: 2014-05-02
Description: Xen 4.4.x, when running on an ARM system, does not properly context switch the CNTKCTL_EL1 register, which allows local guest users to modify the hardware timers and cause a denial of service (crash) via unspecified vectors.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/58347; http://www.openwall.com/lists/oss-security/2014/04/30/11; http://www.openwall.com/lists/oss-security/2014/04/30/5
CVE: CVE-2014-0469
Published: 2014-05-05
Description: Stack-based buffer overflow in a certain Debian patch for xbuffy before 3.3.bl.3.dfsg-9 allows remote attackers to execute arbitrary code via the subject of an email, possibly related to indent subject lines.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://packages.qa.debian.org/x/xbuffy/news/20140427T181904Z.html; http://www.debian.org/security/2014/dsa-2921; http://www.openwall.com/lists/oss-security/2014/04/28/3
CVE: CVE-2014-2916
Published: 2014-05-05
Description: Cross-site request forgery (CSRF) vulnerability in the subscription page editor (spageedit) in phpList before 3.0.6 allows remote attackers to hijack the authentication of administrators via a request to admin/.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://labs.davidsopas.com/2014/04/phplist-csrf-on-subscription-page.html; http://secunia.com/advisories/57893; http://www.phplist.com/?lid=638
CVE: CVE-2010-5109
Published: 2014-05-05
Description: Off-by-one error in the DecompressRTF function in ytnef.c in Yerase's TNEF Stream Reader allows remote attackers to cause a denial of service (crash) via a crafted TNEF file, which triggers a buffer overflow.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-189
References: http://sourceforge.net/p/ytnef/bugs/13/; http://www.openwall.com/lists/oss-security/2013/04/11/1; http://www.securityfocus.com/bid/54484
CVE: CVE-2013-0350
Published: 2014-05-05
Description: tmp_smtp.c in pktstat 1.8.5 allows local users to overwrite arbitrary files via a symlink attack on /tmp/smtp.log.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-59
References: http://osvdb.org/90588; http://seclists.org/oss-sec/2013/q1/417; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=701211
CVE: CVE-2013-1803
Published: 2014-05-05
Description: Multiple SQL injection vulnerabilities in PHP-Fusion before 7.02.06 allow remote attackers to execute arbitrary SQL commands via the (1) orderby parameter to downloads.php; or remote authenticated users with certain permissions to execute arbitrary SQL commands via a (2) parameter name starting with "delete_attach_" in an edit action to forum/postedit.php; the (3) poll_opts[] parameter in a newthread action to forum/postnewthread.php; the (4) pm_email_notify, (5) pm_save_sent, (6) pm_inbox, (7) pm_sentbox, or (8) pm_savebox parameter to administration/settings_messages.php; the (9) thumb_compression, (10) photo_watermark_text_color1, (11) photo_watermark_text_color2, or (12) photo_watermark_text_color3 parameter to administration/settings_photo.php; the (13) enable parameter to administration/bbcodes.php; the (14) news_image, (15) news_image_t1, or (16) news_image_t2 parameter to administration/news.php; the (17) news_id parameter in an edit action to administration/news.php; or the (18) article_id parameter in an edit action to administration/articles.php.  NOTE: the user ID cookie issue in Authenticate.class.php is already covered by CVE-2013-7375.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/90693; http://osvdb.org/90695; http://osvdb.org/90709
CVE: CVE-2013-3736
Published: 2014-05-05
Description: Cross-site scripting (XSS) vulnerability in the MobileUI (aka RT-Extension-MobileUI) extension before 1.04 in Request Tracker (RT) 4.0.0 before 4.0.13 allows remote attackers to inject arbitrary web script or HTML via the name of an attached file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.bestpractical.com/pipermail/rt-announce/2013-June/000230.html; http://osvdb.org/94281; http://secunia.com/advisories/53799
CVE: CVE-2013-4215
Published: 2014-05-05
Description: The IPXPING_COMMAND in contrib/check_ipxping.c in Nagios Plugins 1.4.16 allows local users to gain privileges via a symlink attack on /tmp/ipxping/ipxping.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-59
References: http://osvdb.org/96085; http://seclists.org/oss-sec/2013/q3/310; http://tracker.nagios.org/view.php?id=451
CVE: CVE-2013-6418
Published: 2014-05-05
Description: PyWBEM 0.7 and earlier uses a separate connection to validate X.509 certificates, which allows man-in-the-middle attackers to spoof a peer via an arbitrary certificate.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://seclists.org/oss-sec/2013/q4/531; http://secunia.com/advisories/58327; http://sourceforge.net/p/pywbem/code/627/
CVE: CVE-2013-6444
Published: 2014-05-05
Description: PyWBEM 0.7 and earlier does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://seclists.org/oss-sec/2013/q4/524; http://sourceforge.net/p/pywbem/code/627/; http://sourceforge.net/p/pywbem/mailman/message/31757312/
CVE: CVE-2013-7003
Published: 2014-05-05
Description: Multiple cross-site scripting (XSS) vulnerabilities in LiveZilla before 5.1.2.0 allow remote attackers to inject arbitrary web script or HTML via the (1) full name field, (2) company field, or (3) filename to chat.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/100828; http://packetstormsecurity.com/files/124374/LiveZilla-5.1.1.0-Cross-Site-Scripting.html; http://seclists.org/bugtraq/2013/Dec/42
CVE: CVE-2013-7034
Published: 2014-05-05
Description: The setCookieValue function in _lib/functions.global.inc.php in LiveZilla before 5.1.2.1 allows remote attackers to execute arbitrary PHP code via a serialized PHP object in a cookie.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://archives.neohapsis.com/archives/bugtraq/2013-12/0078.html; http://forums.livezilla.net/index.php?/topic/163-livezilla-changelog/; http://www.securityfocus.com/bid/64383
CVE: CVE-2013-7375
Published: 2014-05-05
Description: SQL injection vulnerability in includes/classes/Authenticate.class.php in PHP-Fusion 7.02.01 through 7.02.05 allows remote attackers to execute arbitrary SQL commands via the user ID in a user cookie, a different vulnerability than CVE-2013-1803.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/show/osvdb/90359; http://packetstormsecurity.com/files/120368/PHP-Fusion-CMS-7.02.05-SQL-Injection.html; http://packetstormsecurity.com/files/120598/PHP-Fusion-7.02.05-XSS-LFI-SQL-Injection.html
CVE: CVE-2014-0149
Published: 2014-05-05
Description: Multiple cross-site scripting (XSS) vulnerabilities in Red Hat JBoss Web Framework Kit 2.5.0 allow remote attackers to inject arbitrary web script or HTML via a (1) parameter or (2) id name.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://rhn.redhat.com/errata/RHSA-2014-0462.html; https://bugzilla.redhat.com/show_bug.cgi?id=1078646; http://rhn.redhat.com/errata/RHSA-2014-0462.html
CVE: CVE-2014-0164
Published: 2014-05-05
Description: openshift-origin-broker-util, as used in Red Hat OpenShift Enterprise 1.2.7 and 2.0.5, uses world-readable permissions for the mcollective client.cfg configuration file, which allows local users to obtain credentials and other sensitive information by reading the file.
CVSS Score: 2.1 (LOW)
CWE: CWE-310
References: http://rhn.redhat.com/errata/RHSA-2014-0460.html; http://rhn.redhat.com/errata/RHSA-2014-0461.html; http://rhn.redhat.com/errata/RHSA-2014-0460.html