deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-1994
Published: 2014-07-20
Description: Cross-site scripting (XSS) vulnerability in the Notices portlet in Cybozu Garoon 2.x and 3.x before 3.7 SP4 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://cs.cybozu.co.jp/information/gr20140714up04.php; http://jvn.jp/en/jp/JVN80583739/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2014-000076
CVE: CVE-2014-1995
Published: 2014-07-20
Description: Cross-site scripting (XSS) vulnerability in the Map search functionality in Cybozu Garoon 2.x and 3.x before 3.7 SP4 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://cs.cybozu.co.jp/information/gr20140714up02.php; http://jvn.jp/en/jp/JVN97558950/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2014-000075
CVE: CVE-2014-1996
Published: 2014-07-20
Description: Cybozu Garoon 3.7 before SP4 allows remote authenticated users to bypass intended access restrictions, and execute arbitrary code or cause a denial of service, via an API call.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://cs.cybozu.co.jp/information/gr20140714up01.php; http://jvn.jp/en/jp/JVN31082531/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2014-000074
CVE: CVE-2014-1999
Published: 2014-07-20
Description: The auto-format feature in the Request_Curl class in FuelPHP 1.1 through 1.7.1 allows remote attackers to execute arbitrary code via a crafted response.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://fuelphp.com/security-advisories; http://jvn.jp/en/jp/JVN94791545/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2014-000082
CVE: CVE-2014-3159
Published: 2014-07-20
Description: The WebContentsDelegateAndroid::OpenURLFromTab function in components/web_contents_delegate_android/web_contents_delegate_android.cc in Google Chrome before 36.0.1985.122 on Android does not properly restrict URL loading, which allows remote attackers to spoof the URL in the Omnibox via unspecified vectors.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-20
References: http://googlechromereleases.blogspot.com/2014/07/chrome-for-android-update.html; https://code.google.com/p/chromium/issues/detail?id=352083; https://src.chromium.org/viewvc/chrome?revision=273865&view=revision
CVE: CVE-2014-3160
Published: 2014-07-20
Description: The ResourceFetcher::canRequest function in core/fetch/ResourceFetcher.cpp in Blink, as used in Google Chrome before 36.0.1985.125, does not properly restrict subresource requests associated with SVG files, which allows remote attackers to bypass the Same Origin Policy via a crafted file.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://googlechromereleases.blogspot.com/2014/07/stable-channel-update.html; http://secunia.com/advisories/60061; http://secunia.com/advisories/60372
CVE: CVE-2014-3161
Published: 2014-07-20
Description: The WebMediaPlayerAndroid::load function in content/renderer/media/android/webmediaplayer_android.cc in Google Chrome before 36.0.1985.122 on Android does not properly interact with redirects, which allows remote attackers to bypass the Same Origin Policy via a crafted web site that hosts a video stream.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://googlechromereleases.blogspot.com/2014/07/chrome-for-android-update.html; https://code.google.com/p/chromium/issues/detail?id=334204; https://src.chromium.org/viewvc/chrome?revision=266396&view=revision
CVE: CVE-2014-3162
Published: 2014-07-20
Description: Multiple unspecified vulnerabilities in Google Chrome before 36.0.1985.125 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://googlechromereleases.blogspot.com/2014/07/stable-channel-update.html; http://secunia.com/advisories/60061; http://secunia.com/advisories/60372
CVE: CVE-2014-3523
Published: 2014-07-20
Description: Memory leak in the winnt_accept function in server/mpm/winnt/child.c in the WinNT MPM in the Apache HTTP Server 2.4.x before 2.4.10 on Windows, when the default AcceptFilter is enabled, allows remote attackers to cause a denial of service (memory consumption) via crafted requests.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://httpd.apache.org/security/vulnerabilities_24.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]8601&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1375&w=2
CVE: CVE-2014-3884
Published: 2014-07-20
Description: Cross-site scripting (XSS) vulnerability in Usermin before 1.600 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.  NOTE: this might overlap CVE-2014-3924.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN92737498/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2014-000058; http://jvn.jp/en/jp/JVN92737498/index.html
CVE: CVE-2014-3885
Published: 2014-07-20
Description: Cross-site scripting (XSS) vulnerability in Webmin before 1.690 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.  NOTE: this might overlap CVE-2014-3924.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN49974594/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2014-000059; http://jvn.jp/en/jp/JVN49974594/index.html
CVE: CVE-2014-3886
Published: 2014-07-20
Description: Cross-site scripting (XSS) vulnerability in Webmin before 1.690, when referrer checking is disabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.  NOTE: this might overlap CVE-2014-3924.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN02213197/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2014-000060; http://jvn.jp/en/jp/JVN02213197/index.html
CVE: CVE-2014-3892
Published: 2014-07-20
Description: Cross-site scripting (XSS) vulnerability in Nexa Meridian before 2014 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN36028879/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2014-000080; http://www.securityfocus.com/bid/68724
CVE: CVE-2014-3894
Published: 2014-07-20
Description: Cross-site scripting (XSS) vulnerability in PHP Kobo Multifunctional MailForm Free 2014/1/28 and earlier allows remote attackers to inject arbitrary web script or HTML via an HTTP Referer header.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN41028866/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2014-000079; http://jvn.jp/en/jp/JVN41028866/index.html
CVE: CVE-2014-4341
Published: 2014-07-20
Description: MIT Kerberos 5 (aka krb5) before 1.12.2 allows remote attackers to cause a denial of service (buffer over-read and application crash) by injecting invalid tokens into a GSSAPI application session.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-125
References: http://advisories.mageia.org/MGASA-2014-0345.html; http://aix.software.ibm.com/aix/efixes/security/nas_advisory1.asc; http://krbdev.mit.edu/rt/Ticket/Display.html?id=7949
CVE: CVE-2014-4342
Published: 2014-07-20
Description: MIT Kerberos 5 (aka krb5) 1.7.x through 1.12.x before 1.12.2 allows remote attackers to cause a denial of service (buffer over-read or NULL pointer dereference, and application crash) by injecting invalid tokens into a GSSAPI application session.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://advisories.mageia.org/MGASA-2014-0345.html; http://krbdev.mit.edu/rt/Ticket/Display.html?id=7949; http://rhn.redhat.com/errata/RHSA-2015-0439.html
CVE: CVE-2014-4954
Published: 2014-07-20
Description: Cross-site scripting (XSS) vulnerability in the PMA_getHtmlForActionLinks function in libraries/structure.lib.php in phpMyAdmin 4.2.x before 4.2.6 allows remote authenticated users to inject arbitrary web script or HTML via a crafted table comment that is improperly handled during construction of a database structure page.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www.phpmyadmin.net/home_page/security/PMASA-2014-4.php; http://www.securityfocus.com/bid/68798; https://github.com/phpmyadmin/phpmyadmin/commit/57475371a5b515c83bfc1bb2efcdf3ddb14787ed
CVE: CVE-2014-4955
Published: 2014-07-20
Description: Cross-site scripting (XSS) vulnerability in the PMA_TRI_getRowForList function in libraries/rte/rte_list.lib.php in phpMyAdmin 4.0.x before 4.0.10.1, 4.1.x before 4.1.14.2, and 4.2.x before 4.2.6 allows remote authenticated users to inject arbitrary web script or HTML via a crafted trigger name that is improperly handled on the database triggers page.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-updates/2014-08/msg00045.html; http://secunia.com/advisories/60397; http://www.phpmyadmin.net/home_page/security/PMASA-2014-5.php
CVE: CVE-2014-4986
Published: 2014-07-20
Description: Multiple cross-site scripting (XSS) vulnerabilities in js/functions.js in phpMyAdmin 4.0.x before 4.0.10.1, 4.1.x before 4.1.14.2, and 4.2.x before 4.2.6 allow remote authenticated users to inject arbitrary web script or HTML via a crafted (1) table name or (2) column name that is improperly handled during construction of an AJAX confirmation message.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-updates/2014-08/msg00045.html; http://secunia.com/advisories/60397; http://www.phpmyadmin.net/home_page/security/PMASA-2014-6.php
CVE: CVE-2014-4987
Published: 2014-07-20
Description: server_user_groups.php in phpMyAdmin 4.1.x before 4.1.14.2 and 4.2.x before 4.2.6 allows remote authenticated users to bypass intended access restrictions and read the MySQL user list via a viewUsers request.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-updates/2014-08/msg00045.html; http://secunia.com/advisories/60397; http://www.phpmyadmin.net/home_page/security/PMASA-2014-7.php
CVE: CVE-2014-4734
Published: 2014-07-21
Description: Cross-site scripting (XSS) vulnerability in e107_admin/db.php in e107 2.0 alpha2 and earlier allows remote attackers to inject arbitrary web script or HTML via the type parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/127499/e107-2.0-alpha2-Cross-Site-Scripting.html; http://www.securityfocus.com/archive/1/532801/100/0/threaded; http://www.securityfocus.com/bid/68674
CVE: CVE-2014-4960
Published: 2014-07-21
Description: Multiple SQL injection vulnerabilities in models\gallery.php in Youtube Gallery (com_youtubegallery) component 4.x through 4.1.7, and possibly 3.x, for Joomla! allow remote attackers to execute arbitrary SQL commands via the (1) listid or (2) themeid parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/127497/Joomla-Youtube-Gallery-4.1.7-SQL-Injection.html; http://www.exploit-db.com/exploits/34087; http://www.securityfocus.com/bid/68676
CVE: CVE-2014-5016
Published: 2014-07-21
Description: Multiple cross-site scripting (XSS) vulnerabilities in LimeSurvey 2.05+ Build 140618 allow remote attackers to inject arbitrary web script or HTML via (1) the pid attribute to the getAttribute_json function to application/controllers/admin/participantsaction.php in CPDB, (2) the sa parameter to application/views/admin/globalSettings_view.php, or (3) a crafted CSV file to the "Import CSV" functionality.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/127369/Lime-Survey-2.05-Build-140618-XSS-SQL-Injection.html; https://github.com/LimeSurvey/LimeSurvey/commit/d23fbbd6c[PII_REDACTED]cf8bd2c5a4a0b569c352a; http://packetstormsecurity.com/files/127369/Lime-Survey-2.05-Build-140618-XSS-SQL-Injection.html
CVE: CVE-2014-5017
Published: 2014-07-21
Description: SQL injection vulnerability in CPDB in application/controllers/admin/participantsaction.php in LimeSurvey 2.05+ Build 140618 allows remote attackers to execute arbitrary SQL commands via the sidx parameter in a JSON request to admin/participants/sa/getParticipants_json, related to a search parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/127369/Lime-Survey-2.05-Build-140618-XSS-SQL-Injection.html; https://github.com/LimeSurvey/LimeSurvey/commit/9938bcd1df8ea27052557c722a67b00c0e7d6cb6; http://packetstormsecurity.com/files/127369/Lime-Survey-2.05-Build-140618-XSS-SQL-Injection.html
CVE: CVE-2014-5018
Published: 2014-07-21
Description: Incomplete blacklist vulnerability in the autoEscape function in common_helper.php in LimeSurvey 2.05+ Build 140618 allows remote attackers to conduct cross-site scripting (XSS) attacks via the GBK charset in the loadname parameter to index.php, related to the survey resume.
CVSS Score: 4.3 (MEDIUM)
References: http://packetstormsecurity.com/files/127369/Lime-Survey-2.05-Build-140618-XSS-SQL-Injection.html; https://github.com/LimeSurvey/LimeSurvey/commit/3a6dd6b44cef2fa3f96f403e1cb971d8d0d694b5; http://packetstormsecurity.com/files/127369/Lime-Survey-2.05-Build-140618-XSS-SQL-Injection.html
CVE: CVE-2013-7392
Published: 2014-07-22
Description: Gitlist allows remote attackers to execute arbitrary commands via shell metacharacters in a file name to Source/.
CVSS Score: 7.5 (HIGH)
References: http://hatriot.github.io/blog/2014/06/29/gitlist-rce/; https://github.com/klaussilveira/gitlist/issues/395; http://hatriot.github.io/blog/2014/06/29/gitlist-rce/
CVE: CVE-2014-2385
Published: 2014-07-22
Description: Multiple cross-site scripting (XSS) vulnerabilities in the web UI in Sophos Anti-Virus for Linux before 9.6.1 allow local users to inject arbitrary web script or HTML via the (1) newListList:ExcludeFileOnExpression, (2) newListList:ExcludeFilesystems, or (3) newListList:ExcludeMountPaths parameter to exclusion/configure or (4) text:EmailServer or (5) newListList:Email parameter to notification/configure.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/127228/Sophos-Antivirus-9.5.1-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2014/Jun/126; http://www.securityfocus.com/archive/1/532558/100/0/threaded
CVE: CVE-2014-4326
Published: 2014-07-22
Description: Elasticsearch Logstash 1.0.14 through 1.4.x before 1.4.2 allows remote attackers to execute arbitrary commands via a crafted event in (1) zabbix.rb or (2) nagios_nsca.rb in outputs/.
CVSS Score: 7.5 (HIGH)
CWE: CWE-78
References: http://www.elasticsearch.org/blog/logstash-1-4-2/; http://www.securityfocus.com/archive/1/532841/100/0/threaded; https://www.elastic.co/community/security/
CVE: CVE-2014-4511
Published: 2014-07-22
Description: Gitlist before 0.5.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the file name in the URI of a request for a (1) blame, (2) file, or (3) stats page, as demonstrated by requests to blame/master/, master/, and stats/master/.
CVSS Score: 7.5 (HIGH)
References: http://hatriot.github.io/blog/2014/06/29/gitlist-rce/; http://packetstormsecurity.com/files/127281/Gitlist-0.4.0-Remote-Code-Execution.html; http://packetstormsecurity.com/files/127364/Gitlist-Unauthenticated-Remote-Command-Execution.html
CVE: CVE-2014-4911
Published: 2014-07-22
Description: The ssl_decrypt_buf function in library/ssl_tls.c in PolarSSL before 1.2.11 and 1.3.x before 1.3.8 allows remote attackers to cause a denial of service (crash) via vectors related to the GCM ciphersuites, as demonstrated using the Codenomicon Defensics toolkit.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://secunia.com/advisories/60215; http://www.debian.org/security/2014/dsa-2981; https://polarssl.org/tech-updates/security-advisories/polarssl-security-advisory-2014-02
CVE: CVE-2014-5019
Published: 2014-07-22
Description: The multisite feature in Drupal 6.x before 6.32 and 7.x before 7.29 allows remote attackers to cause a denial of service via a crafted HTTP Host header, related to determining which configuration file to use.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://www.debian.org/security/2014/dsa-2983; https://www.drupal.org/SA-CORE-2014-003; http://www.debian.org/security/2014/dsa-2983
CVE: CVE-2014-5020
Published: 2014-07-22
Description: The File module in Drupal 7.x before 7.29 does not properly check permissions to view files, which allows remote authenticated users with certain permissions to bypass intended restrictions and read files by attaching the file to content with a file field.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-264
References: http://www.debian.org/security/2014/dsa-2983; https://www.drupal.org/SA-CORE-2014-003; http://www.debian.org/security/2014/dsa-2983
CVE: CVE-2014-5021
Published: 2014-07-22
Description: Cross-site scripting (XSS) vulnerability in the Form API in Drupal 6.x before 6.32 and possibly 7.x before 7.29 allows remote authenticated users with the "administer taxonomy" permission to inject arbitrary web script or HTML via an option group label.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://www.debian.org/security/2014/dsa-2983; https://www.drupal.org/SA-CORE-2014-003; http://www.debian.org/security/2014/dsa-2983
CVE: CVE-2014-5022
Published: 2014-07-22
Description: Cross-site scripting (XSS) vulnerability in the Ajax system in Drupal 7.x before 7.29 allows remote attackers to inject arbitrary web script or HTML via vectors involving forms with an Ajax-enabled textfield and a file field.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.debian.org/security/2014/dsa-2983; https://www.drupal.org/SA-CORE-2014-003; http://www.debian.org/security/2014/dsa-2983
CVE: CVE-2014-5023
Published: 2014-07-22
Description: Repository.php in Gitter, as used in Gitlist, allows remote attackers with commit privileges to execute arbitrary commands via shell metacharacters in a branch name, as demonstrated by a "git checkout -b" command.
CVSS Score: 6.8 (MEDIUM)
References: http://hatriot.github.io/blog/2014/06/29/gitlist-rce/; http://hatriot.github.io/blog/2014/06/29/gitlist-rce/
CVE: CVE-2014-3518
Published: 2014-07-22
Description: jmx-remoting.sar in JBoss Remoting, as used in Red Hat JBoss Enterprise Application Platform (JEAP) 5.2.0, Red Hat JBoss BRMS 5.3.1, Red Hat JBoss Portal Platform 5.2.2, and Red Hat JBoss SOA Platform 5.3.1, does not properly implement the JSR 160 specification, which allows remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://rhn.redhat.com/errata/RHSA-2014-0887.html; http://rhn.redhat.com/errata/RHSA-2014-0887.html
CVE: CVE-2014-3530
Published: 2014-07-22
Description: The org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory method in PicketLink, as used in Red Hat JBoss Enterprise Application Platform (JBEAP) 5.2.0 and 6.2.4, expands entity references, which allows remote attackers to read arbitrary code and possibly have other unspecified impact via unspecified vectors, related to an XML External Entity (XXE) issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://rhn.redhat.com/errata/RHSA-2014-0883.html; http://rhn.redhat.com/errata/RHSA-2014-0884.html; http://rhn.redhat.com/errata/RHSA-2014-0885.html
CVE: CVE-2014-4947
Published: 2014-07-22
Description: Buffer overflow in the HVM graphics console support in Citrix XenServer 6.2 Service Pack 1 and earlier has unspecified impact and attack vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/60027; http://support.citrix.com/article/CTX140984; http://www.securityfocus.com/bid/68659
CVE: CVE-2014-4948
Published: 2014-07-22
Description: Unspecified vulnerability in Citrix XenServer 6.2 Service Pack 1 and earlier allows attackers to cause a denial of service and obtain sensitive information by modifying the guest virtual hard disk (VHD).
CVSS Score: 6.4 (MEDIUM)
References: http://secunia.com/advisories/60027; http://support.citrix.com/article/CTX140984; http://www.securityfocus.com/bid/68660
CVE: CVE-2014-1544
Published: 2014-07-23
Description: Use-after-free vulnerability in the CERT_DestroyCertificate function in libnss3.so in Mozilla Network Security Services (NSS) 3.x, as used in Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7, allows remote attackers to execute arbitrary code via vectors that trigger certain improper removal of an NSSCertificate structure from a trust domain.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/59591; http://secunia.com/advisories/59719; http://secunia.com/advisories/59760
CVE: CVE-2014-1547
Published: 2014-07-23
Description: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
CVSS Score: 10.0 (HIGH)
References: http://linux.oracle.com/errata/ELSA-2014-0918.html; http://secunia.com/advisories/59591; http://secunia.com/advisories/59719
CVE: CVE-2014-1548
Published: 2014-07-23
Description: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 31.0 and Thunderbird before 31.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/59719; http://secunia.com/advisories/59760; http://secunia.com/advisories/60083
CVE: CVE-2014-1549
Published: 2014-07-23
Description: The mozilla::dom::AudioBufferSourceNodeEngine::CopyFromInputBuffer function in Mozilla Firefox before 31.0 and Thunderbird before 31.0 does not properly allocate Web Audio buffer memory, which allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) via crafted audio content that is improperly handled during playback buffering.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/59760; http://secunia.com/advisories/60628; http://www.mozilla.org/security/announce/2014/mfsa2014-57.html
CVE: CVE-2014-1550
Published: 2014-07-23
Description: Use-after-free vulnerability in the MediaInputPort class in Mozilla Firefox before 31.0 and Thunderbird before 31.0 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) by leveraging incorrect Web Audio control-message ordering.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/59760; http://secunia.com/advisories/60628; http://www.mozilla.org/security/announce/2014/mfsa2014-58.html
CVE: CVE-2014-1551
Published: 2014-07-23
Description: Use-after-free vulnerability in the FontTableRec destructor in Mozilla Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7 on Windows allows remote attackers to execute arbitrary code via crafted use of fonts in MathML content, leading to improper handling of a DirectWrite font-face object.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/59760; http://www.mozilla.org/security/announce/2014/mfsa2014-59.html; http://www.oracle.com/technetwork/topics/security/bulletinapr2[PII_REDACTED].html
CVE: CVE-2014-1552
Published: 2014-07-23
Description: Mozilla Firefox before 31.0 and Thunderbird before 31.0 do not properly implement the sandbox attribute of the IFRAME element, which allows remote attackers to bypass intended restrictions on same-origin content via a crafted web site in conjunction with a redirect.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/59760; http://secunia.com/advisories/60628; http://www.mozilla.org/security/announce/2014/mfsa2014-66.html
CVE: CVE-2014-1555
Published: 2014-07-23
Description: Use-after-free vulnerability in the nsDocLoader::OnProgress function in Mozilla Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7 allows remote attackers to execute arbitrary code via vectors that trigger a FireOnStateChange event.
CVSS Score: 9.3 (HIGH)
References: http://linux.oracle.com/errata/ELSA-2014-0918.html; http://secunia.com/advisories/59591; http://secunia.com/advisories/59719