deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-0317
Published: 2014-03-12
Description: The Security Account Manager Remote (SAMR) protocol implementation in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows Server 2012 Gold and R2 does not properly determine the user-lockout state, which makes it easier for remote attackers to bypass the account lockout policy and obtain access via a brute-force attack, aka "SAMR Security Feature Bypass Vulnerability."
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-20, CWE-264
References: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-016; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-016
CVE: CVE-2014-0319
Published: 2014-03-12
Description: Microsoft Silverlight 5 before 5.1.30214.0 and Silverlight 5 Developer Runtime before 5.1.30214.0 allow attackers to bypass the DEP and ASLR protection mechanisms via unspecified vectors, aka "Silverlight DEP/ASLR Bypass Vulnerability."
CVSS Score: 7.1 (HIGH)
CWE: CWE-264
References: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-014; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-014
CVE: CVE-2014-0321
Published: 2014-03-12
Description: Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0313.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-012; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-012
CVE: CVE-2014-0323
Published: 2014-03-12
Description: win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to obtain sensitive information from kernel memory or cause a denial of service (system hang) via a crafted application, aka "Win32k Information Disclosure Vulnerability."
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-200
References: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-015; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-015
CVE: CVE-2014-0324
Published: 2014-03-12
Description: Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0297, CVE-2014-0308, and CVE-2014-0312.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-012; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-012
CVE: CVE-2014-0503
Published: 2014-03-12
Description: Adobe Flash Player before 11.7.700.272 and 11.8.x through 12.0.x before 12.0.0.77 on Windows and OS X, and before 11.2.202.346 on Linux, allows remote attackers to bypass the Same Origin Policy via unspecified vectors.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-264
References: http://helpx.adobe.com/security/products/flash-player/apsb14-08.html; http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00013.html; http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00014.html
CVE: CVE-2014-0504
Published: 2014-03-12
Description: Adobe Flash Player before 11.7.700.272 and 11.8.x through 12.0.x before 12.0.0.77 on Windows and OS X, and before 11.2.202.346 on Linux, allows attackers to read the clipboard via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://helpx.adobe.com/security/products/flash-player/apsb14-08.html; http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00013.html; http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00014.html
CVE: CVE-2013-1636
Published: 2014-03-12
Description: Cross-site scripting (XSS) vulnerability in open-flash-chart.swf in Open Flash Chart (aka Open-Flash Chart), as used in the Pretty Link Lite plugin before 1.6.3 for WordPress, JNews (com_jnews) component 8.0.1 for Joomla!, and CiviCRM 3.1.0 through 4.2.9 and 4.3.0 through 4.3.3, allows remote attackers to inject arbitrary web script or HTML via the get-data parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2013-02/0101.html; http://osvdb.org/90435; http://packetstormsecurity.com/files/120433/WordPress-Pretty-Link-1.6.3-Cross-Site-Scripting.html
CVE: CVE-2013-3943
Published: 2014-03-12
Description: Cross-site scripting (XSS) vulnerability in DotNetNuke (DNN) before 6.2.9 and 7.x before 7.1.1 allows remote authenticated users to inject arbitrary web script or HTML via vectors related to the Display Name field in the Manage Profile.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://secunia.com/advisories/53493; http://www.dnnsoftware.com/platform/manage/security-center; http://www.securityfocus.com/bid/61809
CVE: CVE-2013-4649
Published: 2014-03-12
Description: Cross-site scripting (XSS) vulnerability in DotNetNuke (DNN) before 6.2.9 and 7.x before 7.1.1 allows remote attackers to inject arbitrary web script or HTML via the __dnnVariable parameter to the default URI.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/122792/DotNetNuke-DNN-7.1.0-6.2.8-Cross-Site-Scripting.html; http://secunia.com/advisories/53493; http://www.dnnsoftware.com/platform/manage/security-center
CVE: CVE-2013-5117
Published: 2014-03-12
Description: SQL injection vulnerability in the RSS page (DNNArticleRSS.aspx) in the ZLDNN DNNArticle module before 10.1 for DotNetNuke allows remote attackers to execute arbitrary SQL commands via the categoryid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/96306; http://seclists.org/fulldisclosure/2013/Sep/9; http://www.exploit-db.com/exploits/27602
CVE: CVE-2013-7335
Published: 2014-03-12
Description: Open redirect vulnerability in DotNetNuke (DNN) before 6.2.9 and 7.x before 7.1.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/53493; http://www.dnnsoftware.com/platform/manage/security-center; http://www.securityfocus.com/bid/61809
CVE: CVE-2014-2240
Published: 2014-03-12
Description: Stack-based buffer overflow in the cf2_hintmap_build function in cff/cf2hints.c in FreeType before 2.5.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large number of stem hints in a font file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://savannah.nongnu.org/bugs/?41697; http://secunia.com/advisories/57291; http://secunia.com/advisories/57447
CVE: CVE-2014-1277
Published: 2014-03-13
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2013-3948.  Reason: This candidate is a duplicate of CVE-2013-3948.  Notes: All CVE users should reference CVE-2013-3948 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2014-1284
Published: 2014-03-13
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2014-2019.  Reason: This candidate is a duplicate of CVE-2014-2019.  Notes: All CVE users should reference CVE-2014-2019 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2013-3727
Published: 2014-03-13
Description: SQL injection vulnerability in Kasseler CMS before 2 r1232 allows remote authenticated users to execute arbitrary SQL commands via the groups[] parameter to admin.php.  NOTE: this can be leveraged using CSRF to allow remote unauthenticated attackers to execute arbitrary SQL commands.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://diff.kasseler-cms.net/svn.html; http://diff.kasseler-cms.net/svn/patches/1232.html; http://osvdb.org/94779
CVE: CVE-2013-3728
Published: 2014-03-13
Description: Cross-site scripting (XSS) vulnerability in Kasseler CMS before 2 r1232 allows remote authenticated users with permissions to create categories to inject arbitrary web script or HTML via the cat parameter in an admin_new_category action to admin.php.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://diff.kasseler-cms.net/svn.html; http://diff.kasseler-cms.net/svn/patches/1232.html; http://osvdb.org/94780
CVE: CVE-2013-3729
Published: 2014-03-13
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in Kasseler CMS before 2 r1232 allow remote attackers to hijack the authentication of administrators for requests that conduct SQL injection attacks via the (1) groups[] parameter in a send action in the sendmail module or (2) query parameter in a sql_query action in the database module to admin.php, related to CVE-2013-3727.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://diff.kasseler-cms.net/svn.html; http://diff.kasseler-cms.net/svn/patches/1232.html; http://osvdb.org/94781
CVE: CVE-2014-1877
Published: 2014-03-13
Description: Multiple cross-site scripting (XSS) vulnerabilities in Dokeos 2.1.1 allow remote attackers to inject arbitrary web script or HTML via the (1) Phone, (2) Street, (3) Address line, (4) Zip code, or (5) City field to main/auth/profile.php; (6) Subject field to main/social/groups.php; or (7) Message body field to main/messages/view_message.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/oss-sec/2014/q1/258; http://seclists.org/oss-sec/2014/q1/286; http://www.securityfocus.com/bid/65416
CVE: CVE-2014-2043
Published: 2014-03-13
Description: SQL injection vulnerability in Resources/System/Templates/Data.aspx in Procentia IntelliPen before 1.1.18.1658 allows remote authenticated users to execute arbitrary SQL commands via the value parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://seclists.org/fulldisclosure/2014/Mar/103; http://www.exploit-db.com/exploits/32212; http://www.securityfocus.com/archive/1/531426/100/0/threaded
CVE: CVE-2013-4496
Published: 2014-03-14
Description: Samba 3.x before 3.6.23, 4.0.x before 4.0.16, and 4.1.x before 4.1.6 does not enforce the password-guessing protection mechanism for all interfaces, which makes it easier for remote attackers to obtain access via brute-force ChangePasswordUser2 (1) SAMR or (2) RAP attempts.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-255
References: http://advisories.mageia.org/MGASA-2014-0138.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136864.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134717.html
CVE: CVE-2013-4846
Published: 2014-03-14
Description: Unspecified vulnerability in HP System Management Homepage (SMH) before 7.3 allows remote attackers to obtain sensitive information via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
References: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04039138; https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04039138
CVE: CVE-2013-5133
Published: 2014-03-14
Description: Backup in Apple iOS before 7.1 does not properly restrict symlinks, which allows remote attackers to overwrite files during a restore operation via crafted backup data.
CVSS Score: 8.8 (HIGH)
CWE: CWE-264
References: http://support.apple.com/kb/HT6162; http://support.apple.com/kb/HT6162
CVE: CVE-2013-6188
Published: 2014-03-14
Description: Cross-site request forgery (CSRF) vulnerability in HP System Management Homepage (SMH) 7.1 through 7.2.2 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04039138; https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04039138
CVE: CVE-2013-6205
Published: 2014-03-14
Description: Unspecified vulnerability in HP Rapid Deployment Pack (RDP) and Insight Control Server Deployment allows local users to obtain sensitive information, modify data, or cause a denial of service via unknown vectors.
CVSS Score: 4.1 (MEDIUM)
References: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04135307; https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04135307
CVE: CVE-2013-6206
Published: 2014-03-14
Description: Unspecified vulnerability in HP Rapid Deployment Pack (RDP) and Insight Control Server Deployment allows remote attackers to obtain sensitive information, modify data, or cause a denial of service via unknown vectors.
CVSS Score: 9.0 (HIGH)
References: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04135307; https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04135307
CVE: CVE-2013-6209
Published: 2014-03-14
Description: Unspecified vulnerability in rpc.lockd in the NFS subsystem in HP HP-UX B.11.11 and B.11.23 allows remote attackers to cause a denial of service via unknown vectors.
CVSS Score: 4.3 (MEDIUM)
References: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04174142; https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04174142
CVE: CVE-2013-6442
Published: 2014-03-14
Description: The owner_set function in smbcacls.c in smbcacls in Samba 4.0.x before 4.0.16 and 4.1.x before 4.1.6 removes an ACL during use of a --chown or --chgrp option, which allows remote attackers to bypass intended access restrictions in opportunistic circumstances by leveraging an unintended administrative change.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-264
References: http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136864.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134717.html; http://lists.opensuse.org/opensuse-updates/2014-03/msg00062.html
CVE: CVE-2013-6835
Published: 2014-03-14
Description: TelephonyUI Framework in Apple iOS 7 before 7.1, when Safari is used, does not require user confirmation for FaceTime audio calls, which allows remote attackers to obtain telephone number or e-mail address information via a facetime-audio: URL.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://archives.neohapsis.com/archives/bugtraq/2014-09/0106.html; http://seclists.org/bugtraq/2014/Mar/63; http://seclists.org/fulldisclosure/2014/Mar/92
CVE: CVE-2014-0505
Published: 2014-03-14
Description: Adobe Shockwave Player before 12.1.0.150 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://helpx.adobe.com/security/products/shockwave/apsb14-10.html; http://helpx.adobe.com/security/products/shockwave/apsb14-10.html
CVE: CVE-2014-0694
Published: 2014-03-14
Description: Intelligent Automation for Cloud (IAC) in Cisco Cloud Portal 9.4.1 and earlier includes a cryptographic key in binary files, which makes it easier for remote attackers to obtain cleartext data from an arbitrary IAC installation by leveraging knowledge of this key, aka Bug IDs CSCui34764, CSCui34772, CSCui34776, CSCui34798, CSCui34800, CSCui34805, CSCui34809, CSCui34810, CSCui34813, CSCui34814, and CSCui34818.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-255
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0694; http://tools.cisco.com/security/center/viewAlert.x?alertId=33336; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0694
CVE: CVE-2014-0779
Published: 2014-03-14
Description: The PLC driver in ServerMain.exe in the Kepware KepServerEX 4 component in Schneider Electric StruxureWare SCADA Expert ClearSCADA 2010 R2 build 71.4165, 2010 R2.1 build 71.4325, 2010 R3 build 72.4560, 2010 R3.1 build 72.4644, 2013 R1 build 73.4729, 2013 R1.1 build 73.4832, 2013 R1.1a build 73.4903, 2013 R1.2 build 73.4955, and 2013 R2 build 74.5094 allows remote attackers to cause a denial of service (application crash) via a crafted OPF file (aka project file).
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119, CWE-119
References: http://download.schneider-electric.com/files?p_Doc_Ref=SEVD%202014-024-01; https://www.cisa.gov/news-events/ics-advisories/icsa-14-072-01; http://download.schneider-electric.com/files?p_Doc_Ref=SEVD%202014-024-01
CVE: CVE-2014-0781
Published: 2014-03-14
Description: Heap-based buffer overflow in BKCLogSvr.exe in Yokogawa CENTUM CS 3000 R3.09.50 and earlier allows remote attackers to execute arbitrary code via crafted UDP packets.
CVSS Score: 9.3 (HIGH)
CWE: CWE-122, CWE-119
References: http://www.securityfocus.com/bid/66130; http://www.yokogawa.com/dcs/security/ysar/dcs-ysar-index-en.htm.; https://community.rapid7.com/community/metasploit/blog/2014/03/10/yokogawa-centum-cs3000-vulnerabilities
CVE: CVE-2014-0783
Published: 2014-03-14
Description: Stack-based buffer overflow in BKHOdeq.exe in Yokogawa CENTUM CS 3000 R3.09.50 and earlier allows remote attackers to execute arbitrary code via a crafted TCP packet.
CVSS Score: 9.0 (HIGH)
CWE: CWE-121, CWE-119
References: http://www.securityfocus.com/bid/66130; http://www.yokogawa.com/dcs/security/ysar/dcs-ysar-index-en.htm.; https://community.rapid7.com/community/metasploit/blog/2014/03/10/yokogawa-centum-cs3000-vulnerabilities
CVE: CVE-2014-0784
Published: 2014-03-14
Description: Stack-based buffer overflow in BKBCopyD.exe in Yokogawa CENTUM CS 3000 R3.09.50 and earlier allows remote attackers to execute arbitrary code via a crafted TCP packet.
CVSS Score: 8.3 (HIGH)
CWE: CWE-121, CWE-119
References: http://www.securityfocus.com/bid/66130; http://www.yokogawa.com/dcs/security/ysar/dcs-ysar-index-en.htm.; https://community.rapid7.com/community/metasploit/blog/2014/03/10/yokogawa-centum-cs3000-vulnerabilities
CVE: CVE-2014-1267
Published: 2014-03-14
Description: The Configuration Profiles component in Apple iOS before 7.1 and Apple TV before 6.1 does not properly evaluate the expiration date of a mobile configuration profile, which allows attackers to bypass intended access restrictions by using a profile after the date has passed.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://support.apple.com/kb/HT6162; http://support.apple.com/kb/HT6163; http://support.apple.com/kb/HT6162
CVE: CVE-2014-1271
Published: 2014-03-14
Description: CoreCapture in Apple iOS before 7.1 and Apple TV before 6.1 does not properly validate IOKit API calls, which allows attackers to cause a denial of service (assertion failure and device crash) via a crafted app.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://support.apple.com/kb/HT6162; http://support.apple.com/kb/HT6163; http://support.apple.com/kb/HT6162
CVE: CVE-2014-1272
Published: 2014-03-14
Description: CrashHouseKeeping in Crash Reporting in Apple iOS before 7.1 and Apple TV before 6.1 allows local users to change arbitrary file permissions by leveraging a symlink.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-59
References: http://support.apple.com/kb/HT6162; http://support.apple.com/kb/HT6163; http://support.apple.com/kb/HT6162
CVE: CVE-2014-1273
Published: 2014-03-14
Description: dyld in Apple iOS before 7.1 and Apple TV before 6.1 allows attackers to bypass code-signing requirements by leveraging use of text-relocation instructions in a dynamic library.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://support.apple.com/kb/HT6162; http://support.apple.com/kb/HT6163; http://support.apple.com/kb/HT6162
CVE: CVE-2014-1274
Published: 2014-03-14
Description: FaceTime in Apple iOS before 7.1 allows physically proximate attackers to obtain sensitive FaceTime contact information by using the lock screen for an invalid FaceTime call.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://support.apple.com/kb/HT6162; http://support.apple.com/kb/HT6162
CVE: CVE-2014-1275
Published: 2014-03-14
Description: Buffer overflow in ImageIO in Apple iOS before 7.1 and Apple TV before 6.1 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted JPEG2000 data in a PDF document.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://support.apple.com/kb/HT6162; http://support.apple.com/kb/HT6163; http://support.apple.com/kb/HT6162
CVE: CVE-2014-1276
Published: 2014-03-14
Description: IOKit HID Event in Apple iOS before 7.1 allows attackers to conduct user-action monitoring attacks against arbitrary apps via a crafted app that accesses an IOKit framework interface.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://support.apple.com/kb/HT6162; http://support.apple.com/kb/HT6162
CVE: CVE-2014-1278
Published: 2014-03-14
Description: The ptmx_get_ioctl function in the ARM kernel in Apple iOS before 7.1 and Apple TV before 6.1 allows local users to gain privileges or cause a denial of service (out-of-bounds memory access and device crash) via a crafted call.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://support.apple.com/kb/HT6162; http://support.apple.com/kb/HT6163; http://support.apple.com/kb/HT6162
CVE: CVE-2014-1279
Published: 2014-03-14
Description: Apple TV before 6.1 does not properly restrict logging, which allows local users to obtain sensitive information by reading log data.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://support.apple.com/kb/HT6163; http://support.apple.com/kb/HT6163
CVE: CVE-2014-1280
Published: 2014-03-14
Description: Video Driver in Apple iOS before 7.1 and Apple TV before 6.1 allows remote attackers to cause a denial of service (NULL pointer dereference and device hang) via a crafted video file with MPEG-4 encoding.
CVSS Score: 7.1 (HIGH)
References: http://support.apple.com/kb/HT6162; http://support.apple.com/kb/HT6163; http://support.apple.com/kb/HT6162
CVE: CVE-2014-1281
Published: 2014-03-14
Description: Photos Backend in Apple iOS before 7.1 does not properly manage the asset-library cache during deletions, which allows physically proximate attackers to obtain sensitive photo data by launching the Photos app and looking under a transparent image.
CVSS Score: 1.9 (LOW)
CWE: CWE-264
References: http://support.apple.com/kb/HT6162; http://support.apple.com/kb/HT6162
CVE: CVE-2014-1282
Published: 2014-03-14
Description: The Profiles component in Apple iOS before 7.1 and Apple TV before 6.1 allows attackers to bypass intended configuration-profile visibility requirements via a long name.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-264
References: http://support.apple.com/kb/HT6162; http://support.apple.com/kb/HT6163; http://support.apple.com/kb/HT6162
CVE: CVE-2014-1285
Published: 2014-03-14
Description: Springboard in Apple iOS before 7.1 allows physically proximate attackers to bypass intended access restrictions and read the home screen by leveraging an application crash during activation of an unactivated device.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-264
References: http://support.apple.com/kb/HT6162; http://support.apple.com/kb/HT6162
CVE: CVE-2014-1286
Published: 2014-03-14
Description: SpringBoard Lock Screen in Apple iOS before 7.1 allows remote attackers to cause a denial of service (lock-screen hang) by leveraging a state-management error.
CVSS Score: 5.0 (MEDIUM)
References: http://support.apple.com/kb/HT6162; http://support.apple.com/kb/HT6162
CVE: CVE-2014-1287
Published: 2014-03-14
Description: USB Host in Apple iOS before 7.1 and Apple TV before 6.1 allows physically proximate attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted USB messages.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://support.apple.com/kb/HT6162; http://support.apple.com/kb/HT6163; http://support.apple.com/kb/HT6162