deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-1524
Published: 2014-04-30
Description: The nsXBLProtoImpl::InstallImplementation function in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 does not properly check whether objects are XBL objects, which allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow) via crafted JavaScript code that accesses a non-XBL object as if it were an XBL object.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: http://lists.fedoraproject.org/pipermail/package-announce/2014-May/132332.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-May/132437.html; http://lists.opensuse.org/opensuse-security-announce/2014-05/msg00006.html
CVE: CVE-2014-1525
Published: 2014-04-30
Description: The mozilla::dom::TextTrack::AddCue function in Mozilla Firefox before 29.0 and SeaMonkey before 2.26 does not properly perform garbage collection for Text Track Manager variables, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and heap memory corruption) via a crafted VIDEO element in an HTML document.
CVSS Score: 9.3 (HIGH)
CWE: CWE-416, CWE-787
References: http://lists.fedoraproject.org/pipermail/package-announce/2014-May/132437.html; http://lists.opensuse.org/opensuse-updates/2014-05/msg00010.html; http://lists.opensuse.org/opensuse-updates/2014-05/msg00033.html
CVE: CVE-2014-1526
Published: 2014-04-30
Description: The XrayWrapper implementation in Mozilla Firefox before 29.0 and SeaMonkey before 2.26 allows user-assisted remote attackers to bypass intended access restrictions via a crafted web site that is visited in the debugger, leading to unwrapping operations and calls to DOM methods on the unwrapped objects.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-269
References: http://lists.fedoraproject.org/pipermail/package-announce/2014-May/132437.html; http://lists.opensuse.org/opensuse-updates/2014-05/msg00010.html; http://lists.opensuse.org/opensuse-updates/2014-05/msg00033.html
CVE: CVE-2014-1527
Published: 2014-04-30
Description: Mozilla Firefox before 29.0 on Android allows remote attackers to spoof the address bar via crafted JavaScript code that uses DOM events to prevent the reemergence of the actual address bar after scrolling has taken it off of the screen.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.fedoraproject.org/pipermail/package-announce/2014-May/132437.html; http://www.mozilla.org/security/announce/2014/mfsa2014-40.html; http://www.oracle.com/technetwork/topics/security/bulletinapr2[PII_REDACTED].html
CVE: CVE-2014-1528
Published: 2014-04-30
Description: The sse2_composite_src_x888_8888 function in Pixman, as used in Cairo in Mozilla Firefox 28.0 and SeaMonkey 2.25 on Windows, allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds write and application crash) by painting on a CANVAS element.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://lists.fedoraproject.org/pipermail/package-announce/2014-May/132437.html; http://lists.opensuse.org/opensuse-updates/2014-05/msg00010.html; http://lists.opensuse.org/opensuse-updates/2014-05/msg00033.html
CVE: CVE-2014-1529
Published: 2014-04-30
Description: The Web Notification API in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allows remote attackers to bypass intended source-component restrictions and execute arbitrary JavaScript code in a privileged context via a crafted web page for which Notification.permission is granted.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: http://lists.fedoraproject.org/pipermail/package-announce/2014-May/132332.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-May/132437.html; http://lists.opensuse.org/opensuse-security-announce/2014-05/msg00006.html
CVE: CVE-2014-1530
Published: 2014-04-30
Description: The docshell implementation in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allows remote attackers to trigger the loading of a URL with a spoofed baseURI property, and conduct cross-site scripting (XSS) attacks, via a crafted web site that performs history navigation.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://lists.fedoraproject.org/pipermail/package-announce/2014-May/132332.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-May/132437.html; http://lists.opensuse.org/opensuse-security-announce/2014-05/msg00006.html
CVE: CVE-2014-1531
Published: 2014-04-30
Description: Use-after-free vulnerability in the nsGenericHTMLElement::GetWidthHeightForImage function in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via vectors involving an imgLoader object that is not properly handled during an image-resize operation.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://lists.fedoraproject.org/pipermail/package-announce/2014-May/132332.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-May/132437.html; http://lists.opensuse.org/opensuse-security-announce/2014-05/msg00006.html
CVE: CVE-2014-1532
Published: 2014-04-30
Description: Use-after-free vulnerability in the nsHostResolver::ConditionallyRefreshRecord function in libxul.so in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via vectors related to host resolution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: http://lists.fedoraproject.org/pipermail/package-announce/2014-May/132332.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-May/132437.html; http://lists.opensuse.org/opensuse-security-announce/2014-05/msg00006.html
CVE: CVE-2014-2186
Published: 2014-04-30
Description: Cross-site request forgery (CSRF) vulnerability in the web framework in Cisco WebEx Meetings Server allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuj81777.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2186; http://www.securitytracker.com/id/1030173; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2186
CVE: CVE-2014-2545
Published: 2014-04-30
Description: TIBCO Managed File Transfer Internet Server before 7.2.2, Managed File Transfer Command Center before 7.2.2, Slingshot before 1.9.1, and Vault before 1.0.1 allow remote attackers to obtain sensitive information via a crafted HTTP request.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www.tibco.com/mk/advisory.jsp; http://www.tibco.com/multimedia/mft_advisory_20140429_tcm8-21013.txt; http://www.tibco.com/mk/advisory.jsp
CVE: CVE-2013-6445
Published: 2014-04-30
Description: Cumin (aka MRG Management Console), as used in Red Hat Enterprise MRG 2.5, uses the DES-based crypt function to hash passwords, which makes it easier for attackers to obtain sensitive information via a brute-force attack.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://rhn.redhat.com/errata/RHSA-2014-0440.html; http://rhn.redhat.com/errata/RHSA-2014-0441.html; http://www.securitytracker.com/id/1030158
CVE: CVE-2013-6990
Published: 2014-04-30
Description: FortiGuard FortiAuthenticator before 3.0 allows remote administrators to gain privileges via the command line interface.
CVSS Score: 9.0 (HIGH)
CWE: CWE-264
References: http://www.fortiguard.com/advisory/FG-IR-13-016/; https://exchange.xforce.ibmcloud.com/vulnerabilities/96200; http://www.fortiguard.com/advisory/FG-IR-13-016/
CVE: CVE-2014-0470
Published: 2014-04-30
Description: super.c in Super 3.30.0 does not check the return value of the setuid function when the -F flag is set, which allows local users to gain privileges via unspecified vectors, aka an RLIMIT_NPROC attack.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://www.debian.org/security/2014/dsa-2917; http://www.openwall.com/lists/oss-security/2014/04/28/6; http://www.debian.org/security/2014/dsa-2917
CVE: CVE-2014-0471
Published: 2014-04-30
Description: Directory traversal vulnerability in the unpacking functionality in dpkg before 1.15.9, 1.16.x before 1.16.13, and 1.17.x before 1.17.8 allows remote attackers to write arbitrary files via a crafted source package, related to "C-style filename quoting."
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://www.debian.org/security/2014/dsa-2915; http://www.securityfocus.com/bid/67106; http://www.ubuntu.com/usn/USN-2183-1
CVE: CVE-2014-1955
Published: 2014-04-30
Description: Cross-site scripting (XSS) vulnerability in FortiGuard FortiWeb before 5.0.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.fortiguard.com/advisory/FG-IR-13-009/; http://www.fortiguard.com/advisory/FG-IR-13-009/
CVE: CVE-2014-1956
Published: 2014-04-30
Description: CRLF injection vulnerability in FortiGuard FortiWeb before 5.0.3 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://www.fortiguard.com/advisory/FG-IR-13-009/; http://www.fortiguard.com/advisory/FG-IR-13-009/
CVE: CVE-2014-1957
Published: 2014-04-30
Description: FortiGuard FortiWeb before 5.0.3 allows remote authenticated users to gain privileges via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://www.fortiguard.com/advisory/FG-IR-13-009/; http://www.fortiguard.com/advisory/FG-IR-13-009/
CVE: CVE-2014-2565
Published: 2014-04-30
Description: The commandline interface in Blue Coat Content Analysis System (CAS) 1.1 before 1.1.4.2 allows remote administrators to execute arbitrary commands via unspecified vectors, related to "command injection."
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-78
References: https://kb.bluecoat.com/index?page=content&id=SA78&actp=LIST; https://kb.bluecoat.com/index?page=content&id=SA78&actp=LIST
CVE: CVE-2014-3129
Published: 2014-04-30
Description: The Java Server Pages in the Software Lifecycle Manager (SLM) in SAP NetWeaver allows remote attackers to obtain sensitive information via a crafted request, related to SAP Solution Manager 7.1.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://scn.sap.com/docs/DOC-8218; http://seclists.org/fulldisclosure/2014/Apr/294; http://www.onapsis.com/resources/get.php?resid=adv_onapsis-2014-005
CVE: CVE-2014-3130
Published: 2014-04-30
Description: The ABAP Help documentation and translation tools (BC-DOC-HLP) in Basis in SAP Netweaver ABAP Application Server does not properly restrict access, which allows local users to gain privileges and execute ABAP instructions via crafted help messages.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-264
References: http://scn.sap.com/docs/DOC-8218; http://seclists.org/fulldisclosure/2014/Apr/302; http://www.onapsis.com/resources/get.php?resid=adv_onapsis-2014-009
CVE: CVE-2014-3131
Published: 2014-04-30
Description: SAP Profile Maintenance does not properly restrict access, which allows remote authenticated users to obtain sensitive information via an unspecified RFC function, related to SAP Solution Manager 7.1.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://scn.sap.com/docs/DOC-8218; http://seclists.org/fulldisclosure/2014/Apr/300; http://www.onapsis.com/resources/get.php?resid=adv_onapsis-2014-007
CVE: CVE-2014-3132
Published: 2014-04-30
Description: SAP Background Processing does not properly restrict access, which allows remote authenticated users to obtain sensitive information via an unspecified RFC function, related to SAP Solution Manager 7.1.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://scn.sap.com/docs/DOC-8218; http://seclists.org/fulldisclosure/2014/Apr/299; http://www.onapsis.com/resources/get.php?resid=adv_onapsis-2014-006
CVE: CVE-2014-3133
Published: 2014-04-30
Description: SAP Netweaver Java Application Server does not properly restrict access, which allows remote attackers to obtain the list of SAP systems registered on an SLD via an unspecified webdynpro, related to SystemSelection.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://scn.sap.com/docs/DOC-8218; http://seclists.org/fulldisclosure/2014/Apr/301; http://www.onapsis.com/resources/get.php?resid=adv_onapsis-2014-008
CVE: CVE-2014-3134
Published: 2014-04-30
Description: Cross-site scripting (XSS) vulnerability in the InfoView application in SAP BusinessObjects allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://scn.sap.com/docs/DOC-8218; http://seclists.org/fulldisclosure/2014/Apr/303; http://www.onapsis.com/resources/get.php?resid=adv_onapsis-2014-010
CVE: CVE-2014-3135
Published: 2014-04-30
Description: Multiple cross-site scripting (XSS) vulnerabilities in vBulletin 5.1.1 Alpha 9 allow remote attackers to inject arbitrary web script or HTML via (1) the PATH_INFO to privatemessage/new/, (2) the folderid parameter to a private message in privatemessage/view, (3) a fragment indicator to /help, or (4) the view parameter to a topic, as demonstrated by a request to forum/anunturi-importante/rst-power/67030-rst-admin-restore.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/126226/vBulletin-5.1-Cross-Site-Scripting.html; http://www.securityfocus.com/bid/66972; https://exchange.xforce.ibmcloud.com/vulnerabilities/92664
CVE: CVE-2013-1805
Published: 2014-04-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2013-1806. Reason: This issue was MERGED into CVE-2013-1806 in accordance with CVE content decisions, because it is the same type of vulnerability and affects the same versions.  Notes: All CVE users should reference CVE-2013-1806 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2013-1806
Published: 2014-04-30
Description: Multiple directory traversal vulnerabilities in PHP-Fusion before 7.02.06 allow remote authenticated users to include and execute arbitrary files via a .. (dot dot) in the (1) user_theme parameter to maincore.php; or remote authenticated administrators to delete arbitrary files via the (2) enable parameter to administration/user_fields.php or (3) file parameter to administration/db_backup.php.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.com/files/120598/PHP-Fusion-7.02.05-XSS-LFI-SQL-Injection.html; http://seclists.org/fulldisclosure/2013/Feb/154; http://www.openwall.com/lists/oss-security/2013/03/03/1
CVE: CVE-2013-1807
Published: 2014-04-30
Description: PHP-Fusion before 7.02.06 stores backup files with predictable filenames in an unrestricted directory under the web document root, which might allow remote attackers to obtain sensitive information via a direct request to the backup file in administration/db_backups/.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://packetstormsecurity.com/files/120598/PHP-Fusion-7.02.05-XSS-LFI-SQL-Injection.html; http://seclists.org/fulldisclosure/2013/Feb/154; http://www.openwall.com/lists/oss-security/2013/03/03/1
CVE: CVE-2014-2260
Published: 2014-04-30
Description: Cross-site scripting (XSS) vulnerability in plugins/main/content/js/ajenti.coffee in Eugene Pankov Ajenti 1.2.13 allows remote authenticated users to inject arbitrary web script or HTML via the command field in the Cron functionality.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://packetstormsecurity.com/files/124804/Ajenti-1.2.13-Cross-Site-Scripting.html; http://www.osvdb.org/102174; http://www.securityfocus.com/bid/64982
CVE: CVE-2014-0786
Published: 2014-05-01
Description: Ecava IntegraXor before 4.1.4393 allows remote attackers to read cleartext credentials for administrative accounts via SELECT statements that leverage the guest role.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200, CWE-310
References: http://www.integraxor.com/blog/category/security/vulnerability-note/; http://www.integraxor.com/blog/category/security/vulnerability-note/; https://www.cisa.gov/news-events/ics-advisories/icsa-14-091-01
CVE: CVE-2013-4121
Published: 2014-05-01
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was a site-specific issue.  Notes: none
CVE: CVE-2013-7374
Published: 2014-05-01
Description: The Ubuntu Date and Time Indicator (aka indicator-datetime) 13.10.0+13.10.x before 13.10.0+13.10.20131023.2-0ubuntu1.1 does not properly restrict access to Evolution, which allows local users to bypass the greeter screen restrictions by clicking the date.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-264
References: http://bazaar.launchpad.net/~indicator-applet-developers/indicator-datetime/trunk.13.10/revision/282; http://www.openwall.com/lists/oss-security/2014/04/29/3; http://www.openwall.com/lists/oss-security/2014/04/30/1
CVE: CVE-2014-2881
Published: 2014-05-01
Description: Unspecified vulnerability in the Diffie-Hellman key agreement implementation in the management GUI Java applet in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway before 9.3-66.5 and 10.x before 10.1-122.17 has unknown impact and vectors.
CVSS Score: 10.0 (HIGH)
References: http://support.citrix.com/article/CTX140651; http://www.securitytracker.com/id/1030180; http://support.citrix.com/article/CTX140651
CVE: CVE-2014-2882
Published: 2014-05-01
Description: Unspecified vulnerability in the management GUI in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway before 9.3-66.5 and 10.x before 10.1-122.17 has unspecified impact and vectors, related to certificate validation.
CVSS Score: 10.0 (HIGH)
References: http://support.citrix.com/article/CTX140651; http://www.securitytracker.com/id/1030180; http://support.citrix.com/article/CTX140651
CVE: CVE-2013-6323
Published: 2014-05-01
Description: Cross-site scripting (XSS) vulnerability in the Administration Console in IBM WebSphere Application Server (WAS) 7.x before 7.0.0.33, 8.x before 8.0.0.9, and 8.5.x before 8.5.5.2, and WebSphere Virtual Enterprise 7.x before 7.0.0.5, allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PI04777; http://www-01.ibm.com/support/docview.wss?uid=swg1PI04880; http://www-01.ibm.com/support/docview.wss?uid=swg21669554
CVE: CVE-2014-0646
Published: 2014-05-01
Description: The runtime WS component in the server in EMC RSA Access Manager 6.1.3 before 6.1.3.39, 6.1.4 before 6.1.4.22, 6.2.0 before 6.2.0.11, and 6.2.1 before 6.2.1.03, when INFO logging is enabled, allows local users to discover cleartext passwords by reading log files.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-310
References: http://archives.neohapsis.com/archives/bugtraq/2014-04/0191.html; http://archives.neohapsis.com/archives/bugtraq/2014-04/0191.html
CVE: CVE-2014-0823
Published: 2014-05-01
Description: IBM WebSphere Application Server (WAS) 8.x before 8.0.0.9 and 8.5.x before 8.5.5.2 allows remote attackers to read arbitrary files via a crafted URL.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PI05324; http://www-01.ibm.com/support/docview.wss?uid=swg21669554; http://www-01.ibm.com/support/docview.wss?uid=swg21676092
CVE: CVE-2014-0857
Published: 2014-05-01
Description: The Administrative Console in IBM WebSphere Application Server (WAS) 8.x before 8.0.0.9 and 8.5.x before 8.5.5.2 allows remote authenticated users to obtain sensitive information via a crafted request.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PI07808; http://www-01.ibm.com/support/docview.wss?uid=swg21669554; http://www-01.ibm.com/support/docview.wss?uid=swg21676092
CVE: CVE-2014-0859
Published: 2014-05-01
Description: The web-server plugin in IBM WebSphere Application Server (WAS) 7.x before 7.0.0.33, 8.x before 8.0.0.9, and 8.5.x before 8.5.5.2, when POST retries are enabled, allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PI08892; http://www-01.ibm.com/support/docview.wss?uid=swg21669554; http://www-01.ibm.com/support/docview.wss?uid=swg21676091
CVE: CVE-2014-0896
Published: 2014-05-01
Description: IBM WebSphere Application Server (WAS) Liberty Profile 8.5.x before 8.5.5.2 allows remote attackers to obtain sensitive information via a crafted request.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PI10134; http://www-01.ibm.com/support/docview.wss?uid=swg21669554; https://exchange.xforce.ibmcloud.com/vulnerabilities/91326
CVE: CVE-2014-0941
Published: 2014-05-01
Description: Cross-site scripting (XSS) vulnerability in webtop/eventviewer/eventViewer.jsp in the Web GUI in IBM Netcool/OMNIbus 7.4.0 before FP2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2014-0942.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21671686; https://exchange.xforce.ibmcloud.com/vulnerabilities/92400; http://www-01.ibm.com/support/docview.wss?uid=swg21671686
CVE: CVE-2014-0942
Published: 2014-05-01
Description: Cross-site scripting (XSS) vulnerability in webtop/eventviewer/eventViewer.jsp in the Web GUI in IBM Netcool/OMNIbus 7.4.0 before FP2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2014-0941.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21671686; https://exchange.xforce.ibmcloud.com/vulnerabilities/92401; http://www-01.ibm.com/support/docview.wss?uid=swg21671686
CVE: CVE-2014-3138
Published: 2014-05-02
Description: SQL injection vulnerability in Xerox DocuShare before 6.53 Patch 6 Hotfix 2, 6.6.1 Update 1 before Hotfix 24, and 6.6.1 Update 2 before Hotfix 3 allows remote authenticated users to execute arbitrary SQL commands via the PATH_INFO to /docushare/dsweb/ResultBackgroundJobMultiple/.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://packetstormsecurity.com/files/126171/Xerox-DocuShare-SQL-Injection.html; http://seclists.org/fulldisclosure/2014/Apr/205; http://secunia.com/advisories/57996
CVE: CVE-2013-2073
Published: 2014-05-02
Description: Transifex command-line client before 0.9 does not validate X.509 certificates, which allows man-in-the-middle attackers to spoof a Transifex server via an arbitrary certificate.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://blog.transifex.com/post/[PII_REDACTED]6/new-version-of-the-transifex-client-has-been-released; http://www.openwall.com/lists/oss-security/2013/05/22/14; https://bugzilla.redhat.com/show_bug.cgi?id=952194
CVE: CVE-2013-7110
Published: 2014-05-02
Description: Transifex command-line client before 0.10 does not validate X.509 certificates for data transfer connections, which allows man-in-the-middle attackers to spoof a Transifex server via an arbitrary certificate.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-2073.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2013/12/13/5; http://www.openwall.com/lists/oss-security/2013/12/15/3; https://github.com/transifex/transifex-client/issues/42