deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-6318
Published: 2014-11-11
Description: The audit logon feature in Remote Desktop Protocol (RDP) in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly log unauthorized login attempts supplying valid credentials, which makes it easier for remote attackers to bypass intended access restrictions via a series of attempts, aka "Remote Desktop Protocol (RDP) Failure to Audit Vulnerability."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-287
References: http://blogs.technet.com/b/srd/archive/2014/11/11/assessing-risk-for-the-november-2014-security-updates.aspx; http://secunia.com/advisories/60089; http://www.securityfocus.com/bid/70981
CVE: CVE-2014-6321
Published: 2014-11-11
Description: Schannel in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code via crafted packets, aka "Microsoft Schannel Remote Code Execution Vulnerability."
CVSS Score: 10.0 (HIGH)
CWE: CWE-94
References: http://blog.beyondtrust.com/triggering-ms14-066; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1268&w=2; http://secunia.com/advisories/59800
CVE: CVE-2014-6322
Published: 2014-11-11
Description: The Windows Audio service in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to gain privileges via a crafted web site, as demonstrated by execution of web script in Internet Explorer, aka "Windows Audio Service Vulnerability."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/59968; http://www.securityfocus.com/bid/70978; http://www.securitytracker.com/id/1031191
CVE: CVE-2014-6323
Published: 2014-11-11
Description: Microsoft Internet Explorer 7 through 11 allows remote attackers to obtain sensitive clipboard information via a crafted web site, aka "Internet Explorer Clipboard Information Disclosure Vulnerability."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/70947; http://www.securitytracker.com/id/1031185; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-065
CVE: CVE-2014-6331
Published: 2014-11-11
Description: Microsoft Active Directory Federation Services (AD FS) 2.0, 2.1, and 3.0, when a configured SAML Relying Party lacks a sign-out endpoint, does not properly process logoff actions, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation, aka "Active Directory Federation Services Information Disclosure Vulnerability."
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://blogs.technet.com/b/srd/archive/2014/11/11/assessing-risk-for-the-november-2014-security-updates.aspx; http://www.securityfocus.com/bid/70938; http://www.securitytracker.com/id/1031195
CVE: CVE-2014-6332
Published: 2014-11-11
Description: OleAut32.dll in OLE in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code via a crafted web site, as demonstrated by an array-redimensioning attempt that triggers improper handling of a size value in the SafeArrayDimen function, aka "Windows OLE Automation Array Remote Code Execution Vulnerability."
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-119
References: http://packetstormsecurity.com/files/134053/Avant-Browser-Lite-Ultimate-Remote-Code-Execution.html; http://packetstormsecurity.com/files/134061/The-World-Browser-3.0-Final-Remote-Code-Execution.html; http://packetstormsecurity.com/files/134062/HTML-Compiler-Remote-Code-Execution.html
CVE: CVE-2014-6333
Published: 2014-11-11
Description: Microsoft Word 2007 SP3, Word Viewer, and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Double Delete Remote Code Execution Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/59867; http://www.securityfocus.com/bid/70961; http://www.securitytracker.com/id/1031189
CVE: CVE-2014-6334
Published: 2014-11-11
Description: Microsoft Word 2007 SP3, Word Viewer, and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Microsoft Office Bad Index Remote Code Execution Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/59867; http://www.securityfocus.com/bid/70962; http://www.securitytracker.com/id/1031189
CVE: CVE-2014-6335
Published: 2014-11-11
Description: Microsoft Word 2007 SP3, Word Viewer, and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Microsoft Office Invalid Pointer Remote Code Execution Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/59867; http://www.securityfocus.com/bid/70963; http://www.securitytracker.com/id/1031189
CVE: CVE-2014-6337
Published: 2014-11-11
Description: Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://www.securityfocus.com/bid/70337; http://www.securitytracker.com/id/1031185; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-065
CVE: CVE-2014-6339
Published: 2014-11-11
Description: Microsoft Internet Explorer 8 and 9 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Internet Explorer ASLR Bypass Vulnerability."
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://www.securityfocus.com/bid/70948; http://www.securitytracker.com/id/1031185; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-065
CVE: CVE-2014-6340
Published: 2014-11-11
Description: Microsoft Internet Explorer 6 through 11 allows remote attackers to read content from a different (1) domain or (2) zone via a crafted web site, aka "Internet Explorer Cross-domain Information Disclosure Vulnerability."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/70941; http://www.securitytracker.com/id/1031185; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-065
CVE: CVE-2014-6341
Published: 2014-11-11
Description: Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-4143.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://www.securityfocus.com/bid/70338; http://www.securitytracker.com/id/1031185; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-065
CVE: CVE-2014-6342
Published: 2014-11-11
Description: Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-6348.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://www.securityfocus.com/bid/70341; http://www.securitytracker.com/id/1031185; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-065
CVE: CVE-2014-6343
Published: 2014-11-11
Description: Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://www.securityfocus.com/bid/70344; http://www.securitytracker.com/id/1031185; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-065
CVE: CVE-2014-6344
Published: 2014-11-11
Description: Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://www.securityfocus.com/bid/70346; http://www.securitytracker.com/id/1031185; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-065
CVE: CVE-2014-6345
Published: 2014-11-11
Description: Microsoft Internet Explorer 9 and 10 allows remote attackers to read content from a different (1) domain or (2) zone via a crafted web site, aka "Internet Explorer Cross-domain Information Disclosure Vulnerability."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/70942; http://www.securitytracker.com/id/1031185; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-065
CVE: CVE-2014-6346
Published: 2014-11-11
Description: Microsoft Internet Explorer 8 through 11 allows remote attackers to read content from a different (1) domain or (2) zone via a crafted web site, aka "Internet Explorer Cross-domain Information Disclosure Vulnerability."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/70946; http://www.securitytracker.com/id/1031185; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-065
CVE: CVE-2014-6347
Published: 2014-11-11
Description: Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://www.securityfocus.com/bid/70347; http://www.securitytracker.com/id/1031185; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-065
CVE: CVE-2014-6348
Published: 2014-11-11
Description: Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-6342.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://www.securityfocus.com/bid/70348; http://www.securitytracker.com/id/1031185; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-065
CVE: CVE-2014-6349
Published: 2014-11-11
Description: Microsoft Internet Explorer 10 and 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation of Privilege Vulnerability," a different vulnerability than CVE-2014-6350.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://www.securityfocus.com/bid/70939; http://www.securitytracker.com/id/1031185; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-065
CVE: CVE-2014-6350
Published: 2014-11-11
Description: Microsoft Internet Explorer 10 and 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation of Privilege Vulnerability," a different vulnerability than CVE-2014-6349.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://www.securityfocus.com/bid/70940; http://www.securitytracker.com/id/1031185; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-065
CVE: CVE-2014-6351
Published: 2014-11-11
Description: Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://www.securityfocus.com/bid/70323; http://www.securitytracker.com/id/1031185; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-065
CVE: CVE-2014-6353
Published: 2014-11-11
Description: Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://www.securityfocus.com/bid/70333; http://www.securitytracker.com/id/1031185; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-065
CVE: CVE-2014-0573
Published: 2014-11-11
Description: Use-after-free vulnerability in Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR before 15.0.0.356, Adobe AIR SDK before 15.0.0.356, and Adobe AIR SDK & Compiler before 15.0.0.356 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2014-0588 and CVE-2014-8438.
CVSS Score: 10.0 (HIGH)
References: http://helpx.adobe.com/security/products/flash-player/apsb14-24.html; http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00013.html; http://helpx.adobe.com/security/products/flash-player/apsb14-24.html
CVE: CVE-2014-0574
Published: 2014-11-11
Description: Double free vulnerability in Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR before 15.0.0.356, Adobe AIR SDK before 15.0.0.356, and Adobe AIR SDK & Compiler before 15.0.0.356 allows attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-94
References: http://googlechromereleases.blogspot.com/2014/11/stable-channel-update_18.html; http://helpx.adobe.com/security/products/flash-player/apsb14-24.html; http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00013.html
CVE: CVE-2014-0576
Published: 2014-11-11
Description: Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR before 15.0.0.356, Adobe AIR SDK before 15.0.0.356, and Adobe AIR SDK & Compiler before 15.0.0.356 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0581, CVE-2014-8440, and CVE-2014-8441.
CVSS Score: 10.0 (HIGH)
References: http://helpx.adobe.com/security/products/flash-player/apsb14-24.html; http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00013.html; http://helpx.adobe.com/security/products/flash-player/apsb14-24.html
CVE: CVE-2014-0577
Published: 2014-11-11
Description: Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR before 15.0.0.356, Adobe AIR SDK before 15.0.0.356, and Adobe AIR SDK & Compiler before 15.0.0.356 allow attackers to execute arbitrary code by leveraging an unspecified "type confusion," a different vulnerability than CVE-2014-0584, CVE-2014-0585, CVE-2014-0586, and CVE-2014-0590.
CVSS Score: 10.0 (HIGH)
CWE: CWE-94
References: http://helpx.adobe.com/security/products/flash-player/apsb14-24.html; http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00013.html; http://helpx.adobe.com/security/products/flash-player/apsb14-24.html
CVE: CVE-2014-0581
Published: 2014-11-11
Description: Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR before 15.0.0.356, Adobe AIR SDK before 15.0.0.356, and Adobe AIR SDK & Compiler before 15.0.0.356 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0576, CVE-2014-8440, and CVE-2014-8441.
CVSS Score: 10.0 (HIGH)
References: http://helpx.adobe.com/security/products/flash-player/apsb14-24.html; http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00013.html; http://helpx.adobe.com/security/products/flash-player/apsb14-24.html
CVE: CVE-2014-0582
Published: 2014-11-11
Description: Heap-based buffer overflow in Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR before 15.0.0.356, Adobe AIR SDK before 15.0.0.356, and Adobe AIR SDK & Compiler before 15.0.0.356 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2014-0589.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://helpx.adobe.com/security/products/flash-player/apsb14-24.html; http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00013.html; http://www.securityfocus.com/bid/71039
CVE: CVE-2014-0583
Published: 2014-11-11
Description: Heap-based buffer overflow in Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR before 15.0.0.356, Adobe AIR SDK before 15.0.0.356, and Adobe AIR SDK & Compiler before 15.0.0.356 allows attackers to complete a transition from Low Integrity to Medium Integrity via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://helpx.adobe.com/security/products/flash-player/apsb14-24.html; http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00013.html; http://www.securityfocus.com/bid/71035
CVE: CVE-2014-0584
Published: 2014-11-11
Description: Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR before 15.0.0.356, Adobe AIR SDK before 15.0.0.356, and Adobe AIR SDK & Compiler before 15.0.0.356 allow attackers to execute arbitrary code by leveraging an unspecified "type confusion," a different vulnerability than CVE-2014-0577, CVE-2014-0585, CVE-2014-0586, and CVE-2014-0590.
CVSS Score: 10.0 (HIGH)
CWE: CWE-94
References: http://helpx.adobe.com/security/products/flash-player/apsb14-24.html; http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00013.html; http://helpx.adobe.com/security/products/flash-player/apsb14-24.html
CVE: CVE-2014-0585
Published: 2014-11-11
Description: Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR before 15.0.0.356, Adobe AIR SDK before 15.0.0.356, and Adobe AIR SDK & Compiler before 15.0.0.356 allow attackers to execute arbitrary code by leveraging an unspecified "type confusion," a different vulnerability than CVE-2014-0577, CVE-2014-0584, CVE-2014-0586, and CVE-2014-0590.
CVSS Score: 10.0 (HIGH)
CWE: CWE-94
References: http://helpx.adobe.com/security/products/flash-player/apsb14-24.html; http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00013.html; http://helpx.adobe.com/security/products/flash-player/apsb14-24.html
CVE: CVE-2014-0586
Published: 2014-11-11
Description: Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR before 15.0.0.356, Adobe AIR SDK before 15.0.0.356, and Adobe AIR SDK & Compiler before 15.0.0.356 allow attackers to execute arbitrary code by leveraging an unspecified "type confusion," a different vulnerability than CVE-2014-0577, CVE-2014-0584, CVE-2014-0585, and CVE-2014-0590.
CVSS Score: 10.0 (HIGH)
CWE: CWE-94
References: http://helpx.adobe.com/security/products/flash-player/apsb14-24.html; http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00013.html; http://helpx.adobe.com/security/products/flash-player/apsb14-24.html
CVE: CVE-2014-0588
Published: 2014-11-11
Description: Use-after-free vulnerability in Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR before 15.0.0.356, Adobe AIR SDK before 15.0.0.356, and Adobe AIR SDK & Compiler before 15.0.0.356 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2014-0573 and CVE-2014-8438.
CVSS Score: 10.0 (HIGH)
References: http://helpx.adobe.com/security/products/flash-player/apsb14-24.html; http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00013.html; https://www.verisign.com/en_US/security-services/security-intelligence/vulnerability-reports/articles/index.xhtml?id=1084
CVE: CVE-2014-0589
Published: 2014-11-11
Description: Heap-based buffer overflow in Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR before 15.0.0.356, Adobe AIR SDK before 15.0.0.356, and Adobe AIR SDK & Compiler before 15.0.0.356 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2014-0582.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://helpx.adobe.com/security/products/flash-player/apsb14-24.html; http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00013.html; http://www.securityfocus.com/bid/71051
CVE: CVE-2014-0590
Published: 2014-11-11
Description: Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR before 15.0.0.356, Adobe AIR SDK before 15.0.0.356, and Adobe AIR SDK & Compiler before 15.0.0.356 allow attackers to execute arbitrary code by leveraging an unspecified "type confusion," a different vulnerability than CVE-2014-0577, CVE-2014-0584, CVE-2014-0585, and CVE-2014-0586.
CVSS Score: 10.0 (HIGH)
References: http://helpx.adobe.com/security/products/flash-player/apsb14-24.html; http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00013.html; http://helpx.adobe.com/security/products/flash-player/apsb14-24.html
CVE: CVE-2014-8437
Published: 2014-11-11
Description: Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR before 15.0.0.356, Adobe AIR SDK before 15.0.0.356, and Adobe AIR SDK & Compiler before 15.0.0.356 allow remote attackers to discover session tokens via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://helpx.adobe.com/security/products/flash-player/apsb14-24.html; http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00013.html; http://www.securityfocus.com/bid/71036
CVE: CVE-2014-8438
Published: 2014-11-11
Description: Use-after-free vulnerability in Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR before 15.0.0.356, Adobe AIR SDK before 15.0.0.356, and Adobe AIR SDK & Compiler before 15.0.0.356 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2014-0573 and CVE-2014-0588.
CVSS Score: 10.0 (HIGH)
References: http://helpx.adobe.com/security/products/flash-player/apsb14-24.html; http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00013.html; http://www.securityfocus.com/bid/71049
CVE: CVE-2014-8440
Published: 2014-11-11
Description: Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR before 15.0.0.356, Adobe AIR SDK before 15.0.0.356, and Adobe AIR SDK & Compiler before 15.0.0.356 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0576, CVE-2014-0581, and CVE-2014-8441.
CVSS Score: 10.0 (HIGH)
References: http://helpx.adobe.com/security/products/flash-player/apsb14-24.html; http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00013.html; http://www.securityfocus.com/bid/71047