deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2013-4289
Published: 2014-04-18
Description: Multiple integer overflows in lib/openjp3d/jp3d.c in OpenJPEG before 1.5.2 allow remote attackers to have unspecified impact and vectors, which trigger a heap-based buffer overflow.
CVSS Score: 10.0 (HIGH)
CWE: CWE-189
References: http://openjpeg.googlecode.com/svn/tags/version.1.5.2/NEWS; http://seclists.org/oss-sec/2013/q3/593; http://secunia.com/advisories/57285
CVE: CVE-2013-4290
Published: 2014-04-18
Description: Stack-based buffer overflow in OpenJPEG before 1.5.2 allows remote attackers to have unspecified impact via unknown vectors to (1) lib/openjp3d/opj_jp3d_compress.c, (2) bin/jp3d/convert.c, or (3) lib/openjp3d/event.c.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://openjpeg.googlecode.com/svn/tags/version.1.5.2/NEWS; http://seclists.org/oss-sec/2013/q3/593; http://secunia.com/advisories/57285
CVE: CVE-2013-7369
Published: 2014-04-18
Description: SQL injection vulnerability in an unspecified DLL in the FSDBCom ActiveX control in F-Secure Anti-Virus for Microsoft Exchange Server before HF02, Anti-Virus for Windows Servers 9.00 before HF09, Anti-Virus for Citrix Servers 9.00 before HF09, and F-Secure Email and Server Security and F-Secure Server Security 9.20 before HF01 allows remote attackers to execute arbitrary SQL commands via unknown vectors, related to GetCommand.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.f-secure.com/en/web/labs_global/fsc-2013-1; http://www.zerodayinitiative.com/advisories/ZDI-13-095/; http://www.f-secure.com/en/web/labs_global/fsc-2013-1
CVE: CVE-2014-0150
Published: 2014-04-18
Description: Integer overflow in the virtio_net_handle_mac function in hw/net/virtio-net.c in QEMU 2.0 and earlier allows local guest users to execute arbitrary code via a MAC addresses table update request, which triggers a heap-based buffer overflow.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-189
References: http://article.gmane.org/gmane.comp.emulators.qemu/266768; http://secunia.com/advisories/57878; http://secunia.com/advisories/58191
CVE: CVE-2014-2844
Published: 2014-04-18
Description: Cross-site scripting (XSS) vulnerability in F-Secure Messaging Secure Gateway 7.5.0 before Patch 1862 allows remote authenticated administrators to inject arbitrary web script or HTML via the new parameter in the SysUser module to admin.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2014/Apr/223; http://secunia.com/advisories/58038; http://www.f-secure.com/en/web/labs_global/fsc-2014-2
CVE: CVE-2014-2856
Published: 2014-04-18
Description: Cross-site scripting (XSS) vulnerability in scheduler/client.c in Common Unix Printing System (CUPS) before 1.7.2 allows remote attackers to inject arbitrary web script or HTML via the URL path, related to the is_path_absolute function.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://advisories.mageia.org/MGASA-2014-0193.html; http://rhn.redhat.com/errata/RHSA-2014-1388.html; http://secunia.com/advisories/57880
CVE: CVE-2013-4279
Published: 2014-04-18
Description: imapsync 1.564 and earlier performs a release check by default, which sends sensitive information (imapsync, operating system, and Perl version) to the developer's site.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://lists.fedoraproject.org/pipermail/package-announce/2014-March/130493.html; http://www.mandriva.com/security/advisories?name=MDVSA-2014:060; http://www.securityfocus.com/bid/65002
CVE: CVE-2013-7195
Published: 2014-04-18
Description: PHPFox 3.7.3 and 3.7.4 allows remote authenticated users to bypass intended "Only Me" restrictions and "like" a publication via a request that specifies the ID for the publication.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-264
References: http://www.securityfocus.com/archive/1/531745/100/0/threaded; http://www.securityfocus.com/bid/66672; https://exchange.xforce.ibmcloud.com/vulnerabilities/92335
CVE: CVE-2013-7196
Published: 2014-04-18
Description: static/ajax.php in PHPFox 3.7.3, 3.7.4, and 3.7.5 allows remote authenticated users to bypass intended "Only Me" restrictions and comment on a private publication via a request with a modified val[item_id] parameter for the publication.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-264
References: http://www.securityfocus.com/archive/1/531745/100/0/threaded; http://www.securityfocus.com/bid/66677; https://exchange.xforce.ibmcloud.com/vulnerabilities/92336
CVE: CVE-2014-2014
Published: 2014-04-18
Description: imapsync before 1.584, when running with the --tls option, attempts a cleartext login when a certificate verification failure occurs, which allows remote attackers to obtain credentials by sniffing the network.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-255
References: http://seclists.org/oss-sec/2014/q1/367; http://seclists.org/oss-sec/2014/q1/378; http://www.linux-france.org/prj/imapsync_list/msg01907.html
CVE: CVE-2014-2286
Published: 2014-04-18
Description: main/http.c in Asterisk Open Source 1.8.x before 1.8.26.1, 11.8.x before 11.8.1, and 12.1.x before 12.1.1, and Certified Asterisk 1.8.x before 1.8.15-cert5 and 11.6 before 11.6-cert2, allows remote attackers to cause a denial of service (stack consumption) and possibly execute arbitrary code via an HTTP request with a large number of Cookie headers.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://downloads.asterisk.org/pub/security/AST-2014-001-1.8.diff; http://downloads.asterisk.org/pub/security/AST-2014-001.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-March/130400.html
CVE: CVE-2014-2287
Published: 2014-04-18
Description: channels/chan_sip.c in Asterisk Open Source 1.8.x before 1.8.26.1, 11.8.x before 11.8.1, and 12.1.x before 12.1.1, and Certified Asterisk 1.8.15 before 1.8.15-cert5 and 11.6 before 11.6-cert2, when chan_sip has a certain configuration, allows remote authenticated users to cause a denial of service (channel and file descriptor consumption) via an INVITE request with a (1) Session-Expires or (2) Min-SE header with a malformed or invalid value.
CVSS Score: 3.5 (LOW)
CWE: CWE-20
References: http://downloads.asterisk.org/pub/security/AST-2014-002-1.8.diff; http://downloads.asterisk.org/pub/security/AST-2014-002.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-March/130400.html
CVE: CVE-2014-2288
Published: 2014-04-18
Description: The PJSIP channel driver in Asterisk Open Source 12.x before 12.1.1, when qualify_frequency "is enabled on an AOR and the remote SIP server challenges for authentication of the resulting OPTIONS request," allows remote attackers to cause a denial of service (crash) via a PJSIP endpoint that does not have an associated outgoing request.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://downloads.asterisk.org/pub/security/AST-2014-003-12.diff; http://downloads.asterisk.org/pub/security/AST-2014-003.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-March/130400.html
CVE: CVE-2014-2289
Published: 2014-04-18
Description: res/res_pjsip_exten_state.c in the PJSIP channel driver in Asterisk Open Source 12.x before 12.1.0 allows remote authenticated users to cause a denial of service (crash) via a SUBSCRIBE request without any Accept headers, which triggers an invalid pointer dereference.
CVSS Score: 3.5 (LOW)
CWE: CWE-20
References: http://downloads.asterisk.org/pub/security/AST-2014-004-12.diff; http://downloads.asterisk.org/pub/security/AST-2014-004.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-March/130400.html
CVE: CVE-2014-2522
Published: 2014-04-18
Description: curl and libcurl 7.27.0 through 7.35.0, when running on Windows and using the SChannel/Winssl TLS backend, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate when accessing a URL that uses a numerical IP address, which allows man-in-the-middle attackers to spoof servers via an arbitrary valid certificate.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-20
References: http://curl.haxx.se/docs/adv_20140326D.html; http://seclists.org/oss-sec/2014/q1/585; http://seclists.org/oss-sec/2014/q1/586
CVE: CVE-2014-2597
Published: 2014-04-18
Description: PCNetSoftware RAC Server 4.0.4 and 4.0.5 allows local users to cause a denial of service (disabled keyboard or crash) via a large input buffer to unspecified IOCTL requests in RACDriver.sys, which triggers a buffer over-read.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-20
References: http://seclists.org/fulldisclosure/2014/Apr/221; http://secunia.com/advisories/58090; https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-2597/
CVE: CVE-2013-6213
Published: 2014-04-19
Description: Unspecified vulnerability in Virtual User Generator in HP LoadRunner before 11.52 Patch 1 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1833.
CVSS Score: 10.0 (HIGH)
References: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03969437; https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03969437
CVE: CVE-2013-6214
Published: 2014-04-19
Description: Unspecified vulnerability in the Integration Service in HP Universal Configuration Management Database 9.05, 10.01, and 10.10 allows remote authenticated users to obtain sensitive information via unknown vectors, aka ZDI-CAN-2042.
CVSS Score: 4.0 (MEDIUM)
References: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04220407; https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04220407
CVE: CVE-2014-0778
Published: 2014-04-19
Description: TCPUploader module listens on Port 10651/TCP for incoming connections. 
Exploitation of this vulnerability could allow a remote unauthenticated 
user access to release OS version information. While this is a minor 
vulnerability, it represents a method for further network 
reconnaissance.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200, CWE-200
References: http://www.progea.com/it-it/downloads/software.aspx; https://www.cisa.gov/news-events/ics-advisories/icsa-14-105-01; http://ics-cert.us-cert.gov/advisories/ICSA-14-105-01
CVE: CVE-2014-1974
Published: 2014-04-19
Description: Directory traversal vulnerability in the LYSESOFT AndExplorer application before 20140403 and AndExplorerPro application before 20140405 for Android allows attackers to overwrite or create arbitrary files via unspecified vectors.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-22
References: http://jvn.jp/en/jp/JVN22670349/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2014-000037; https://play.google.com/store/apps/details?id=lysesoft.andexplorer
CVE: CVE-2014-1983
Published: 2014-04-19
Description: Unspecified vulnerability in Cybozu Remote Service Manager through 2.3.0 and 3.x before 3.1.1 allows remote attackers to cause a denial of service (CPU consumption) via unknown vectors.
CVSS Score: 7.8 (HIGH)
References: http://cs.cybozu.co.jp/information/20130317notice01.php; http://jvn.jp/en/jp/JVN10319260/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2014-000039
CVE: CVE-2014-1984
Published: 2014-04-19
Description: Session fixation vulnerability in the management screen in Cybozu Remote Service Manager through 2.3.0 and 3.x before 3.1.1 allows remote attackers to hijack web sessions via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287
References: http://cs.cybozu.co.jp/information/20130317notice02.php; http://jvn.jp/en/jp/JVN00058727/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2014-000040
CVE: CVE-2014-1990
Published: 2014-04-19
Description: Cross-site request forgery (CSRF) vulnerability in TopAccess (aka the web-based management utility) on TOSHIBA TEC e-Studio 232, 233, 282, and 283 devices allows remote attackers to hijack the authentication of administrators for requests that change passwords.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://jvn.jp/en/jp/JVN13313061/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2014-000038; http://www.toshibatec.co.jp/page.jsp?id=4224
CVE: CVE-2014-2731
Published: 2014-04-19
Description: Multiple unspecified vulnerabilities in the integrated web server in Siemens SINEMA Server before 12 SP1 allow remote attackers to execute arbitrary code via HTTP traffic to port (1) 4999 or (2) 80.
CVSS Score: 9.3 (HIGH)
References: http://ics-cert.us-cert.gov/advisories/ICSA-14-107-01; http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-364879.pdf; http://ics-cert.us-cert.gov/advisories/ICSA-14-107-01
CVE: CVE-2014-2732
Published: 2014-04-19
Description: Multiple directory traversal vulnerabilities in the integrated web server in Siemens SINEMA Server before 12 SP1 allow remote attackers to access arbitrary files via HTTP traffic to port (1) 4999 or (2) 80.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://ics-cert.us-cert.gov/advisories/ICSA-14-107-01; http://www.securityfocus.com/bid/66965; http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-364879.pdf
CVE: CVE-2014-2733
Published: 2014-04-19
Description: Siemens SINEMA Server before 12 SP1 allows remote attackers to cause a denial of service (web-interface outage) via crafted HTTP requests to port (1) 4999 or (2) 80.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://ics-cert.us-cert.gov/advisories/ICSA-14-107-01; http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-364879.pdf; http://ics-cert.us-cert.gov/advisories/ICSA-14-107-01
CVE: CVE-2013-6212
Published: 2014-04-19
Description: Unspecified vulnerability in HP Database and Middleware Automation 10.0, 10.01, 10.10, and 10.20 before 10.20.100 allows remote authenticated users to obtain sensitive information via unknown vectors.
CVSS Score: 6.5 (MEDIUM)
References: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04201408; https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04201408
CVE: CVE-2013-6215
Published: 2014-04-19
Description: Unspecified vulnerability in the Integration Service in HP Universal Configuration Management Database 10.01 and 10.10 allows remote authenticated users to execute arbitrary code via unknown vectors, aka ZDI-CAN-1977.
CVSS Score: 8.5 (HIGH)
References: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04219959; https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04219959
CVE: CVE-2013-6218
Published: 2014-04-19
Description: Unspecified vulnerability in HP Network Node Manager i (NNMi) 9.0x, 9.1x, and 9.2x allows remote attackers to execute arbitrary code via unknown vectors.
CVSS Score: 10.0 (HIGH)
References: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04026039; https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04026039
CVE: CVE-2013-6219
Published: 2014-04-19
Description: Unspecified vulnerability in HP HP-UX Whitelisting (aka WLI) before A.01.02.02 on HP-UX B.11.31 allows local users to bypass intended access restrictions via unknown vectors.
CVSS Score: 3.8 (LOW)
References: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04227671; https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04227671
CVE: CVE-2014-2155
Published: 2014-04-19
Description: The DHCPv6 server module in Cisco CNS Network Registrar 7.1 allows remote attackers to cause a denial of service (daemon reload) via a malformed DHCPv6 packet, aka Bug ID CSCuo07437.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2155; http://tools.cisco.com/security/center/viewAlert.x?alertId=33850; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2155
CVE: CVE-2014-1517
Published: 2014-04-20
Description: The login form in Bugzilla 2.x, 3.x, 4.x before 4.4.3, and 4.5.x before 4.5.3 does not properly handle a correctly authenticated but unintended login attempt, which makes it easier for remote authenticated users to obtain sensitive information by arranging for a victim to login to the attacker's account and then submit a vulnerability report, related to a "login CSRF" issue.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-287
References: http://git.mozilla.org/?p=bugzilla/bugzilla.git%3Ba=commit%3Bh=0e390970ba51b14a5dc780be7c6f0d6d7baa67e3; http://lists.fedoraproject.org/pipermail/package-announce/2014-April/132281.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-April/132309.html
CVE: CVE-2014-2665
Published: 2014-04-20
Description: includes/specials/SpecialChangePassword.php in MediaWiki before 1.19.14, 1.20.x and 1.21.x before 1.21.8, and 1.22.x before 1.22.5 does not properly handle a correctly authenticated but unintended login attempt, which makes it easier for remote authenticated users to obtain sensitive information by arranging for a victim to login to the attacker's account, as demonstrated by tracking the victim's activity, related to a "login CSRF" issue.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-287
References: http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-March/000145.html; http://openwall.com/lists/oss-security/2014/03/28/1; http://openwall.com/lists/oss-security/2014/04/01/7
CVE: CVE-2013-5459
Published: 2014-04-21
Description: Unspecified vulnerability in IBM Rational Software Architect (RSA) Design Manager and Rational Rhapsody Design Manager 3.x through 3.0.1 and 4.x before 4.0.6 allows remote authenticated users to modify data by leveraging improper parameter checking.
CVSS Score: 5.5 (MEDIUM)
References: http://www-01.ibm.com/support/docview.wss?uid=swg21664531; https://exchange.xforce.ibmcloud.com/vulnerabilities/84773; http://www-01.ibm.com/support/docview.wss?uid=swg21664531
CVE: CVE-2014-0361
Published: 2014-04-21
Description: The default configuration of IBM 4690 OS, as used in Toshiba Global Commerce Solutions 4690 POS and other products, hashes passwords with the ADXCRYPT algorithm, which makes it easier for context-dependent attackers to obtain sensitive information via unspecified cryptanalysis of an ADXCSOUF.DAT file.
CVSS Score: 3.0 (LOW)
CWE: CWE-310
References: http://www-01.ibm.com/support/docview.wss?uid=pos1R1005054; http://www.kb.cert.org/vuls/id/622950; http://www-01.ibm.com/support/docview.wss?uid=pos1R1005054
CVE: CVE-2014-0932
Published: 2014-04-21
Description: Cross-site scripting (XSS) vulnerability in IBM Sterling Order Management 8.5 before HF105 and Sterling Selling and Fulfillment Foundation 9.0 before HF85 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IT00419; http://www-01.ibm.com/support/docview.wss?uid=swg21670912; http://www.securityfocus.com/bid/66993
CVE: CVE-2014-2921
Published: 2014-04-21
Description: The getObjectByToken function in Newsletter.php in the Pimcore_Tool_Newsletter module in pimcore 1.4.9 through 2.0.0 does not properly handle an object obtained by unserializing Lucene search data, which allows remote attackers to conduct PHP object injection attacks and execute arbitrary code via vectors involving a Zend_Pdf_ElementFactory_Proxy object and a pathname with a trailing \0 character.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://openwall.com/lists/oss-security/2014/04/21/1; http://www.pimcore.org/en/resources/blog/pimcore+2.2+released_b442; https://github.com/pedrib/PoC/blob/master/pimcore-2.1.0.txt
CVE: CVE-2014-2922
Published: 2014-04-21
Description: The getObjectByToken function in Newsletter.php in the Pimcore_Tool_Newsletter module in pimcore 1.4.9 through 2.1.0 does not properly handle an object obtained by unserializing a pathname, which allows remote attackers to conduct PHP object injection attacks and delete arbitrary files via vectors involving a Zend_Http_Response_Stream object.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-20
References: http://openwall.com/lists/oss-security/2014/04/21/1; http://www.pimcore.org/en/resources/blog/pimcore+2.2+released_b442; https://github.com/pedrib/PoC/blob/master/pimcore-2.1.0.txt
CVE: CVE-2013-5948
Published: 2014-04-22
Description: The Network Analysis tab (Main_Analysis_Content.asp) in the ASUS RT-AC68U and other RT series routers with firmware before 3.0.0.4.374.5047 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the Target field (destIP parameter).
CVSS Score: 8.5 (HIGH)
CWE: CWE-78
References: http://seclists.org/fulldisclosure/2014/Apr/59; http://seclists.org/fulldisclosure/2014/Apr/66; http://support.asus.com/download.aspx?m=RT-N66U+%28VER.B1%29
CVE: CVE-2013-6370
Published: 2014-04-22
Description: Buffer overflow in the printbuf APIs in json-c before 0.12 allows remote attackers to cause a denial of service via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://lists.fedoraproject.org/pipermail/package-announce/2014-April/131845.html; http://secunia.com/advisories/57791; http://www.mandriva.com/security/advisories?name=MDVSA-2014:079
CVE: CVE-2013-6371
Published: 2014-04-22
Description: The hash functionality in json-c before 0.12 allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted JSON data, involving collisions.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://lists.fedoraproject.org/pipermail/package-announce/2014-April/131845.html; http://secunia.com/advisories/57791; http://www.mandriva.com/security/advisories?name=MDVSA-2014:079
CVE: CVE-2013-6469
Published: 2014-04-22
Description: JBoss Overlord Run Time Governance (RTGov) 1.0 for JBossAS allows remote authenticated users to execute arbitrary Java code via an MVFLEX Expression Language (MVEL) expression.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-94
References: http://secunia.com/advisories/57843; https://bugzilla.redhat.com/show_bug.cgi?id=1051279; http://secunia.com/advisories/57843
CVE: CVE-2014-0173
Published: 2014-04-22
Description: The Jetpack plugin before 1.9 before 1.9.4, 2.0.x before 2.0.9, 2.1.x before 2.1.4, 2.2.x before 2.2.7, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.2, 2.6.x before 2.6.3, 2.7.x before 2.7.2, 2.8.x before 2.8.2, and 2.9.x before 2.9.3 for WordPress does not properly restrict access to the XML-RPC service, which allows remote attackers to bypass intended restrictions and publish posts via unspecified vectors.  NOTE: some of these details are obtained from third party information.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-264
References: http://jetpack.me/2014/04/10/jetpack-security-update/; http://secunia.com/advisories/57729; http://www.securityfocus.com/bid/66789
CVE: CVE-2014-1216
Published: 2014-04-22
Description: FitNesse Wiki 20131110, 20140201, and earlier allows remote attackers to execute arbitrary commands by defining a COMMAND_PATTERN and TEST_RUNNER in the pageContent parameter when editing a page.
CVSS Score: 7.5 (HIGH)
References: http://secpod.org/blog/?p=2311; http://www.exploit-db.com/exploits/32568; https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-1216/
CVE: CVE-2014-2269
Published: 2014-04-22
Description: modules/Users/ForgotPassword.php in vTiger 6.0 before Security Patch 2 allows remote attackers to reset the password for arbitrary users via a request containing the username, password, and confirmPassword parameters.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-20
References: http://vtiger-crm.2324883.n4.nabble.com/Vtigercrm-developers-IMP-forgot-password-and-re-installation-security-fix-tt9786.html; http://www.securityfocus.com/bid/66758; http://vtiger-crm.2324883.n4.nabble.com/Vtigercrm-developers-IMP-forgot-password-and-re-installation-security-fix-tt9786.html
CVE: CVE-2014-2341
Published: 2014-04-22
Description: Session fixation vulnerability in CubeCart before 5.2.9 allows remote attackers to hijack web sessions via the PHPSESSID parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287
References: http://forums.cubecart.com/topic/48427-cubecart-529-relased/; http://secunia.com/advisories/57856; http://www.exploit-db.com/exploits/32830