deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-4258
Published: 2014-07-17
Description: Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.37 and earlier and 5.6.17 and earlier allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to SRINFOSC.
CVSS Score: 6.5 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2014-08/msg00012.html; http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00016.html; http://seclists.org/fulldisclosure/2014/Dec/23
CVE: CVE-2014-4260
Published: 2014-07-17
Description: Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.37 and earlier, and 5.6.17 and earlier, allows remote authenticated users to affect integrity and availability via vectors related to SRCHAR.
CVSS Score: 5.5 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2014-08/msg00012.html; http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00016.html; http://seclists.org/fulldisclosure/2014/Dec/23
CVE: CVE-2014-4261
Published: 2014-07-17
Description: Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox before 3.2.24, 4.0.26, 4.1.34, 4.2.26, and 4.3.14 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Core, a different vulnerability than CVE-2014-2487.
CVSS Score: 6.9 (MEDIUM)
References: http://seclists.org/fulldisclosure/2014/Dec/23; http://www.oracle.com/technetwork/topics/security/cpujul2[PII_REDACTED].html; http://www.securityfocus.com/archive/1/534161/100/0/threaded
CVE: CVE-2014-4262
Published: 2014-07-17
Description: Unspecified vulnerability in Oracle Java SE 5.0u65, 6u75, 7u60, and 8u5 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries.
CVSS Score: 9.3 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00026.html; http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00033.html; http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00036.html
CVE: CVE-2014-4263
Published: 2014-07-17
Description: Unspecified vulnerability in Oracle Java SE 5.0u65, 6u75, 7u60, and 8u5, and JRockit R27.8.2 and R28.3.2, allows remote attackers to affect confidentiality and integrity via unknown vectors related to "Diffie-Hellman key agreement."
CVSS Score: 4.0 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00026.html; http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00033.html; http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00036.html
CVE: CVE-2014-4264
Published: 2014-07-17
Description: Unspecified vulnerability in Oracle Java SE 7u60 and 8u5 allows remote attackers to affect availability via unknown vectors related to Security.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8946&w=2; http://seclists.org/fulldisclosure/2014/Dec/23; http://secunia.com/advisories/60326
CVE: CVE-2014-4265
Published: 2014-07-17
Description: Unspecified vulnerability in Oracle Java SE 6u75, 7u60, and 8u5 allows remote attackers to affect integrity via unknown vectors related to Deployment.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00026.html; http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00036.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]8946&w=2
CVE: CVE-2014-4266
Published: 2014-07-17
Description: Unspecified vulnerability in Oracle Java SE 7u60 and 8u5 allows remote attackers to affect integrity via unknown vectors related to Serviceability.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00026.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]8946&w=2; http://seclists.org/fulldisclosure/2014/Dec/23
CVE: CVE-2014-4267
Published: 2014-07-17
Description: Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.0.2.0, 10.3.6.0, 12.1.1.0, and 12.1.2.0 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to WLS Core Components.
CVSS Score: 6.8 (MEDIUM)
References: http://seclists.org/fulldisclosure/2014/Dec/23; http://www.oracle.com/technetwork/topics/security/cpujul2[PII_REDACTED].html; http://www.securityfocus.com/archive/1/534161/100/0/threaded
CVE: CVE-2014-4268
Published: 2014-07-17
Description: Unspecified vulnerability in Oracle Java SE 5.0u65, 6u75, 7u60, and 8u5 allows remote attackers to affect confidentiality via unknown vectors related to Swing.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00026.html; http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00033.html; http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00036.html
CVE: CVE-2014-4269
Published: 2014-07-17
Description: Unspecified vulnerability in the Hyperion Common Admin component in Oracle Hyperion 11.1.2.2 and 11.1.2.3 allows remote authenticated users to affect confidentiality via unknown vectors related to User Interface, a different vulnerability than CVE-2014-4270.
CVSS Score: 4.0 (MEDIUM)
References: http://seclists.org/fulldisclosure/2014/Dec/23; http://secunia.com/advisories/59289; http://www.oracle.com/technetwork/topics/security/cpujul2[PII_REDACTED].html
CVE: CVE-2014-4270
Published: 2014-07-17
Description: Unspecified vulnerability in the Hyperion Common Admin component in Oracle Hyperion 11.1.2.2 and 11.1.2.3 allows remote authenticated users to affect confidentiality via unknown vectors related to User Interface, a different vulnerability than CVE-2014-4269.
CVSS Score: 4.0 (MEDIUM)
References: http://seclists.org/fulldisclosure/2014/Dec/23; http://secunia.com/advisories/59289; http://www.oracle.com/technetwork/topics/security/cpujul2[PII_REDACTED].html
CVE: CVE-2014-4271
Published: 2014-07-17
Description: Unspecified vulnerability in the Hyperion Essbase component in Oracle Hyperion 11.1.2.2 and 11.1.2.3 allows remote attackers to affect availability via unknown vectors related to Agent.
CVSS Score: 5.0 (MEDIUM)
References: http://seclists.org/fulldisclosure/2014/Dec/23; http://secunia.com/advisories/59241; http://www.oracle.com/technetwork/topics/security/cpujul2[PII_REDACTED].html
CVE: CVE-2014-0957
Published: 2014-07-18
Description: Cross-site scripting (XSS) vulnerability in IBM Business Process Manager 7.5 through 8.5.5, and WebSphere Lombardi Edition 7.2, allows remote attackers to inject arbitrary web script or HTML via a crafted URL that triggers a service failure.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/59557; http://www-01.ibm.com/support/docview.wss?uid=swg1JR49990; http://www-01.ibm.com/support/docview.wss?uid=swg21679064
CVE: CVE-2014-2623
Published: 2014-07-18
Description: Unspecified vulnerability in HP Storage Data Protector 8.x allows remote attackers to execute arbitrary code via unknown vectors.
CVSS Score: 10.0 (HIGH)
References: http://packetstormsecurity.com/files/130658/HP-Data-Protector-8.10-Remote-Command-Execution.html; http://www.exploit-db.com/exploits/34066/; http://www.exploit-db.com/exploits/35961
CVE: CVE-2014-3306
Published: 2014-07-18
Description: The web server on Cisco DPC3010, DPC3212, DPC3825, DPC3925, DPQ3925, EPC3010, EPC3212, EPC3825, and EPC3925 Wireless Residential Gateway products allows remote attackers to execute arbitrary code via a crafted HTTP request, aka Bug ID CSCup40808.
CVSS Score: 10.0 (HIGH)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/ciscosa-20140716-cm; http://www.securitytracker.com/id/1030598; http://www.securitytracker.com/id/1030599
CVE: CVE-2014-3320
Published: 2014-07-18
Description: Multiple open redirect vulnerabilities in the admin web interface in the web framework in Cisco Unified Communications Domain Manager (CDM) 8.1(.4) and earlier allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via crafted URLs for unspecified scripts, aka Bug ID CSCuo48835.
CVSS Score: 5.8 (MEDIUM)
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3320; http://tools.cisco.com/security/center/viewAlert.x?alertId=34960; http://www.securityfocus.com/bid/68694
CVE: CVE-2014-3321
Published: 2014-07-18
Description: Cisco IOS XR 4.3.4 and earlier on ASR 9000 devices, when bridge-group virtual interface (BVI) routing is enabled, allows remote attackers to cause a denial of service (chip and card hangs) via a series of crafted MPLS packets, aka Bug ID CSCuo91149.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3321; http://tools.cisco.com/security/center/viewAlert.x?alertId=34936; http://www.securitytracker.com/id/1030597
CVE: CVE-2014-3323
Published: 2014-07-18
Description: Directory traversal vulnerability in Cisco Unified Contact Center Enterprise allows remote authenticated users to read arbitrary web-root files via a crafted URL, aka Bug ID CSCun25262.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-22
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3323; http://www.securityfocus.com/bid/68686; http://www.securitytracker.com/id/1030612
CVE: CVE-2014-0967
Published: 2014-07-19
Description: Cross-site scripting (XSS) vulnerability in the GDS component in IBM InfoSphere Master Data Management - Collaborative Edition 10.x and 11.x before 11.0 FP4 and InfoSphere Master Data Management Server for Product Information Management 9.0 and 9.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21677300; https://exchange.xforce.ibmcloud.com/vulnerabilities/92882; http://www-01.ibm.com/support/docview.wss?uid=swg21677300
CVE: CVE-2014-0968
Published: 2014-07-19
Description: Cross-site scripting (XSS) vulnerability in the GDS component in IBM InfoSphere Master Data Management - Collaborative Edition 10.x and 11.x before 11.0 FP4 and InfoSphere Master Data Management Server for Product Information Management 9.0 and 9.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL for an MHTML document.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21677301; https://exchange.xforce.ibmcloud.com/vulnerabilities/92884; http://www-01.ibm.com/support/docview.wss?uid=swg21677301
CVE: CVE-2014-0970
Published: 2014-07-19
Description: The GDS component in IBM InfoSphere Master Data Management - Collaborative Edition 10.x and 11.x before 11.0 FP4 and InfoSphere Master Data Management Server for Product Information Management 9.0 and 9.1 allows remote authenticated users to inject links via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-20
References: http://www-01.ibm.com/support/docview.wss?uid=swg21677304; https://exchange.xforce.ibmcloud.com/vulnerabilities/92950; http://www-01.ibm.com/support/docview.wss?uid=swg21677304
CVE: CVE-2014-2364
Published: 2014-07-19
Description: Multiple stack-based buffer overflows in Advantech WebAccess before 7.2 allow remote attackers to execute arbitrary code via a long string in the (1) ProjectName, (2) SetParameter, (3) NodeName, (4) CCDParameter, (5) SetColor, (6) AlarmImage, (7) GetParameter, (8) GetColor, (9) ServerResponse, (10) SetBaud, or (11) IPAddress parameter to an ActiveX control in (a) webvact.ocx, (b) dvs.ocx, or (c) webdact.ocx.
CVSS Score: 7.5 (HIGH)
CWE: CWE-121, CWE-119
References: http://packetstormsecurity.com/files/128384/Advantech-WebAccess-dvs.ocx-GetColor-Buffer-Overflow.html; http://webaccess.advantech.com/; http://www.securityfocus.com/bid/68714
CVE: CVE-2014-2365
Published: 2014-07-19
Description: Unspecified vulnerability in Advantech WebAccess before 7.2 allows remote authenticated users to create or delete arbitrary files via unknown vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: http://webaccess.advantech.com/; https://www.cisa.gov/news-events/ics-advisories/icsa-14-198-02; http://ics-cert.us-cert.gov/advisories/ICSA-14-198-02
CVE: CVE-2014-2366
Published: 2014-07-19
Description: upAdminPg.asp in Advantech WebAccess before 7.2 allows remote authenticated users to discover credentials by reading HTML source code.
CVSS Score: 9.0 (HIGH)
CWE: CWE-316, CWE-200
References: http://webaccess.advantech.com/; https://www.cisa.gov/news-events/ics-advisories/icsa-14-198-02; http://ics-cert.us-cert.gov/advisories/ICSA-14-198-02
CVE: CVE-2014-2367
Published: 2014-07-19
Description: The ChkCookie subroutine in an ActiveX control in broadweb/include/gChkCook.asp in Advantech WebAccess before 7.2 allows remote attackers to read arbitrary files via a crafted call.
CVSS Score: 7.5 (HIGH)
CWE: CWE-592, CWE-200
References: http://webaccess.advantech.com/; https://www.cisa.gov/news-events/ics-advisories/icsa-14-198-02; http://ics-cert.us-cert.gov/advisories/ICSA-14-198-02
CVE: CVE-2014-2368
Published: 2014-07-19
Description: The BrowseFolder method in the bwocxrun ActiveX control in Advantech WebAccess before 7.2 allows remote attackers to read arbitrary files via a crafted call.
CVSS Score: 7.5 (HIGH)
CWE: CWE-623, CWE-200
References: http://webaccess.advantech.com/; https://www.cisa.gov/news-events/ics-advisories/icsa-14-198-02; http://ics-cert.us-cert.gov/advisories/ICSA-14-198-02
CVE: CVE-2014-3043
Published: 2014-07-19
Description: IBM Storwize V7000 Unified 1.3.x and 1.4.x before 1.4.3.3 allows remote authenticated users to gain privileges by leveraging access to the service account.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004811; http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004811
CVE: CVE-2014-3045
Published: 2014-07-19
Description: IBM Scale Out Network Attached Storage (SONAS) 1.3.x and 1.4.x before 1.4.3.3 places an administrative password in the shell history upon use of the -p option to chuser, which allows local users to obtain sensitive information by leveraging root access.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004815; http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004815
CVE: CVE-2014-3064
Published: 2014-07-19
Description: The GDS component in IBM InfoSphere Master Data Management - Collaborative Edition 10.x and 11.x before 11.0 FP4 and InfoSphere Master Data Management Server for Product Information Management 9.0 and 9.1 allows remote authenticated users to read arbitrary files via a crafted UNIX file parameter.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg21677299; http://www.securityfocus.com/bid/69027; https://exchange.xforce.ibmcloud.com/vulnerabilities/93600
CVE: CVE-2013-4273
Published: 2014-07-19
Description: The Entity API module 7.x-1.x before 7.x-1.2 for Drupal does not properly restrict access to node comments, which allows remote authenticated users to read the comments via unspecified vectors. NOTE: this identifier was SPLIT per ADT5 due to different researcher organizations. CVE-2013-7391 was assigned for the View vector.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://www.openwall.com/lists/oss-security/2013/08/22/2; https://drupal.org/node/2065197; https://drupal.org/node/2065207
CVE: CVE-2013-7391
Published: 2014-07-19
Description: The Entity API module 7.x-1.x before 7.x-1.2 for Drupal, when using the (a) Views field or (b) area plugins, allows remote attackers to read restricted entities via the (1) field, (2) header, or (3) footer of a View.  NOTE: this identifier was SPLIT from CVE-2013-4273 per ADT5 due to different researcher organizations.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://www.openwall.com/lists/oss-security/2013/08/22/2; https://drupal.org/node/2065197; https://drupal.org/node/2065207
CVE: CVE-2012-2682
Published: 2014-07-19
Description: Cumin (aka MRG Management Console), as used in Red Hat Enterprise MRG 2.5, allows attackers with certain database privileges to cause a denial of service (inaccessible page) via a non-ASCII character in the name of a link.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://rhn.redhat.com/errata/RHSA-2014-0858.html; http://rhn.redhat.com/errata/RHSA-2014-0859.html; https://bugzilla.redhat.com/show_bug.cgi?id=830254
CVE: CVE-2014-2519
Published: 2014-07-19
Description: The default configuration of EMC RecoverPoint Appliance (RPA) 4.1 before 4.1.0.1 does not enable a firewall, which allows remote attackers to obtain potentially sensitive information about open ports, or cause a denial of service, by sending packets to many ports.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-200
References: http://archives.neohapsis.com/archives/bugtraq/2014-07/0091.html; http://www.securitytracker.com/id/1030608; http://archives.neohapsis.com/archives/bugtraq/2014-07/0091.html
CVE: CVE-2014-3325
Published: 2014-07-19
Description: Multiple cross-site scripting (XSS) vulnerabilities in Cisco Unified Customer Voice Portal (CVP) allow remote attackers to inject arbitrary web script or HTML via a crafted parameter, aka Bug IDs CSCuh61711, CSCuh61720, CSCuh61723, CSCuh61726, CSCuh61727, CSCuh61731, and CSCuh61733.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/60546; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3325; http://www.securityfocus.com/bid/68691
CVE: CVE-2014-3532
Published: 2014-07-19
Description: dbus 1.3.0 before 1.6.22 and 1.8.x before 1.8.6, when running on Linux 2.6.37-rc4 or later, allows local users to cause a denial of service (system-bus disconnect of other services or applications) by sending a message containing a file descriptor, then exceeding the maximum recursion depth before the initial message is forwarded.
CVSS Score: 2.1 (LOW)
CWE: CWE-20
References: http://advisories.mageia.org/MGASA-2014-0294.html; http://lists.opensuse.org/opensuse-updates/2014-09/msg00049.html; http://openwall.com/lists/oss-security/2014/07/02/4
CVE: CVE-2014-3533
Published: 2014-07-19
Description: dbus 1.3.0 before 1.6.22 and 1.8.x before 1.8.6 allows local users to cause a denial of service (disconnect) via a certain sequence of crafted messages that cause the dbus-daemon to forward a message containing an invalid file descriptor.
CVSS Score: 2.1 (LOW)
CWE: CWE-20
References: http://advisories.mageia.org/MGASA-2014-0294.html; http://lists.opensuse.org/opensuse-updates/2014-09/msg00049.html; http://openwall.com/lists/oss-security/2014/07/02/4
CVE: CVE-2014-4943
Published: 2014-07-19
Description: The PPPoL2TP feature in net/l2tp/l2tp_ppp.c in the Linux kernel through 3.15.6 allows local users to gain privileges by leveraging data-structure differences between an l2tp socket and an inet socket.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-269
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=3cf521f7dc87c031617fd47e4b7aa2593c2f3daf; http://linux.oracle.com/errata/ELSA-2014-0924.html; http://linux.oracle.com/errata/ELSA-2014-3047.html
CVE: CVE-2014-4331
Published: 2014-07-19
Description: Cross-site scripting (XSS) vulnerability in admin/viewer.php in OctavoCMS allows remote attackers to inject arbitrary web script or HTML via the src parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/127404/OctavoCMS-Cross-Site-Scripting.html; http://www.attrition.org/pipermail/vim/2014-July/002773.html; http://www.securityfocus.com/archive/1/532701/100/0/threaded
CVE: CVE-2013-4352
Published: 2014-07-20
Description: The cache_invalidate function in modules/cache/cache_storage.c in the mod_cache module in the Apache HTTP Server 2.4.6, when a caching forward proxy is enabled, allows remote HTTP servers to cause a denial of service (NULL pointer dereference and daemon crash) via vectors that trigger a missing hostname value.
CVSS Score: 4.3 (MEDIUM)
References: http://httpd.apache.org/security/vulnerabilities_24.html; http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/cache/cache_storage.c; http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/cache/cache_storage.c?r1=1491564&r2=1523235&diff_format=h
CVE: CVE-2014-0117
Published: 2014-07-20
Description: The mod_proxy module in the Apache HTTP Server 2.4.x before 2.4.10, when a reverse proxy is enabled, allows remote attackers to cause a denial of service (child-process crash) via a crafted HTTP Connection header.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://advisories.mageia.org/MGASA-2014-0305.html; http://httpd.apache.org/security/vulnerabilities_24.html; http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html
CVE: CVE-2014-0118
Published: 2014-07-20
Description: The deflate_in_filter function in mod_deflate.c in the mod_deflate module in the Apache HTTP Server before 2.4.10, when request body decompression is enabled, allows remote attackers to cause a denial of service (resource consumption) via crafted request data that decompresses to a much larger size.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-400
References: http://advisories.mageia.org/MGASA-2014-0304.html; http://advisories.mageia.org/MGASA-2014-0305.html; http://httpd.apache.org/security/vulnerabilities_24.html
CVE: CVE-2014-0226
Published: 2014-07-20
Description: Race condition in the mod_status module in the Apache HTTP Server before 2.4.10 allows remote attackers to cause a denial of service (heap-based buffer overflow), or possibly obtain sensitive credential information or execute arbitrary code, via a crafted request that triggers improper scoreboard handling within the status_handler function in modules/generators/mod_status.c and the lua_ap_scoreboard_worker function in modules/lua/lua_request.c.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-362
References: http://advisories.mageia.org/MGASA-2014-0304.html; http://advisories.mageia.org/MGASA-2014-0305.html; http://httpd.apache.org/security/vulnerabilities_24.html
CVE: CVE-2014-0231
Published: 2014-07-20
Description: The mod_cgid module in the Apache HTTP Server before 2.4.10 does not have a timeout mechanism, which allows remote attackers to cause a denial of service (process hang) via a request to a CGI script that does not read from its stdin file descriptor.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://advisories.mageia.org/MGASA-2014-0304.html; http://advisories.mageia.org/MGASA-2014-0305.html; http://httpd.apache.org/security/vulnerabilities_24.html
CVE: CVE-2014-1973
Published: 2014-07-20
Description: Directory traversal vulnerability in the NextApp File Explorer application before 2.1.0.3 for Android allows remote attackers to overwrite or create arbitrary files via a crafted filename.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://jvn.jp/en/jp/JVN84335912/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2014-000081; http://www.securityfocus.com/bid/68726
CVE: CVE-2014-1987
Published: 2014-07-20
Description: The CGI component in Cybozu Garoon 3.1.0 through 3.7 SP3 allows remote attackers to execute arbitrary commands via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-78
References: http://cs.cybozu.co.jp/information/gr20140421news01.php; http://jvn.jp/en/jp/JVN42024228/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2014-000073
CVE: CVE-2014-1992
Published: 2014-07-20
Description: Cross-site scripting (XSS) vulnerability in the Messages functionality in Cybozu Garoon 3.1.x, 3.5.x, and 3.7.x before 3.7 SP4 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://cs.cybozu.co.jp/information/gr20140714up05.php; http://jvn.jp/en/jp/JVN94838679/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2014-000078
CVE: CVE-2014-1993
Published: 2014-07-20
Description: The Portlets subsystem in Cybozu Garoon 2.x and 3.x before 3.7 SP4 allows remote authenticated users to bypass intended access restrictions via unspecified vectors.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://cs.cybozu.co.jp/information/gr20140714up04.php; http://jvn.jp/en/jp/JVN75990997/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2014-000077