deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2012-5684
Published: 2014-08-14
Description: Cross-site scripting (XSS) vulnerability in ZPanel 10.0.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the inFullname parameter in an UpdateAccountSettings action in the my_account module to zpanel/.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/show/osvdb/87139; http://packetstormsecurity.com/files/117894/ZPanel-10.0.1-XSS-CSRF-SQL-Injection.html; http://secunia.com/advisories/51172
CVE: CVE-2012-5685
Published: 2014-08-14
Description: SQL injection vulnerability in ZPanel 10.0.1 and earlier allows remote attackers to execute arbitrary SQL commands via the inEmailAddress parameter in an UpdateClient action in the manage_clients module to the default URI.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/show/osvdb/87142; http://secunia.com/advisories/51172; http://www.exploit-db.com/exploits/22490
CVE: CVE-2012-6654
Published: 2014-08-14
Description: Multiple SQL injection vulnerabilities in ZPanel 10.0.1 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) resetkey or (2) inConfEmail parameter to index.php, a different vulnerability than CVE-2012-5685.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/show/osvdb/87138; http://secunia.com/advisories/51172; https://exchange.xforce.ibmcloud.com/vulnerabilities/79840
CVE: CVE-2014-5248
Published: 2014-08-14
Description: Cross-site scripting (XSS) vulnerability in MyBB before 1.6.15 allows remote attackers to inject arbitrary web script or HTML via vectors related to video MyCode.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://blog.mybb.com/2014/08/04/mybb-1-6-15-released-security-maintenance-release; http://secunia.com/advisories/59707; http://blog.mybb.com/2014/08/04/mybb-1-6-15-released-security-maintenance-release
CVE: CVE-2014-5249
Published: 2014-08-14
Description: SQL injection vulnerability in the "Biblio self autocomplete" submodule in the Biblio Autocomplete module 6.x-1.x before 6.x-1.1 and 7.x-1.x before 7.x-1.5 for Drupal allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/69091; https://exchange.xforce.ibmcloud.com/vulnerabilities/95146; https://www.drupal.org/node/2316023
CVE: CVE-2014-5250
Published: 2014-08-14
Description: Unspecified vulnerability in the AJAX autocompletion callback in the Biblio Autocomplete module 6.x-1.x before 6.x-1.1 and 7.x-1.x before 7.x-1.5 for Drupal allows remote attackers to access data via unspecified vectors.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/69091; https://www.drupal.org/node/2316023; https://www.drupal.org/node/2316025
CVE: CVE-2013-7180
Published: 2014-08-15
Description: Cobham SAILOR 900 VSAT; SAILOR FleetBroadBand 150, 250, and 500; EXPLORER BGAN; and AVIATOR 200, 300, 350, and 700D devices do not properly restrict password recovery, which allows attackers to obtain administrative privileges by leveraging physical access or terminal access to spoof a reset code.
CVSS Score: 7.8 (HIGH)
References: http://www.kb.cert.org/vuls/id/602006; http://www.kb.cert.org/vuls/id/602006
CVE: CVE-2014-0328
Published: 2014-08-15
Description: The thraneLINK protocol implementation on Cobham devices does not verify firmware signatures, which allows attackers to execute arbitrary code by leveraging physical access or terminal access to send an SNMP request and a TFTP response.
CVSS Score: 9.3 (HIGH)
References: http://www.kb.cert.org/vuls/id/179732; http://www.kb.cert.org/vuls/id/179732
CVE: CVE-2014-2940
Published: 2014-08-15
Description: Cobham Sailor 900 and 6000 satellite terminals with firmware 1.08 MFHF and 2.11 VHF have hardcoded credentials for the administrator account, which allows attackers to obtain administrative control by leveraging physical access or terminal access.
CVSS Score: 10.0 (HIGH)
References: http://www.kb.cert.org/vuls/id/460687; http://www.kb.cert.org/vuls/id/460687
CVE: CVE-2014-2941
Published: 2014-08-15
Description: Cobham Sailor 6000 satellite terminals have hardcoded Tbus 2 credentials, which allows remote attackers to obtain access via a TBUS2 command.  NOTE: the vendor reportedly states "there is no possibility to exploit another user's credentials.
CVSS Score: 7.1 (HIGH)
References: http://www.kb.cert.org/vuls/id/269991; http://www.kb.cert.org/vuls/id/269991
CVE: CVE-2014-2943
Published: 2014-08-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2014-2886, CVE-2014-2942.  Reason: this ID was intended for one issue, but was assigned to two issues by a CNA.  Notes: All CVE users should consult CVE-2014-2886 and CVE-2014-2942 to determine which ID is appropriate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2014-2964
Published: 2014-08-15
Description: Cobham Aviator 700D and 700E satellite terminals have hardcoded passwords for the (1) debug, (2) prod, (3) do160, and (4) flrp programs, which allows physically proximate attackers to gain privileges by sending a password over a serial line.
CVSS Score: 6.9 (MEDIUM)
References: http://www.kb.cert.org/vuls/id/882207; http://www.kb.cert.org/vuls/id/882207
CVE: CVE-2014-3902
Published: 2014-08-15
Description: The CyberAgent Ameba application 3.x and 4.x before 4.5.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-310
References: http://jvn.jp/en/jp/JVN27702217/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2014-000098; https://play.google.com/store/apps/details?id=jp.ameba
CVE: CVE-2013-7144
Published: 2014-08-16
Description: LINE 3.2.1.83 and earlier on Windows and 3.2.1 and earlier on OS X does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-310
References: https://www.thaicert.or.th/papers/general/2013/pa2013ge010.html; https://www.thaicert.or.th/papers/general/2013/pa2013ge010.html
CVE: CVE-2014-0852
Published: 2014-08-16
Description: IBM WebSphere DataPower SOA appliances through 4.0.2.15, 5.x through 5.0.0.17, 6.0.0.x through 6.0.0.9, and 6.0.1.x through 6.0.1.5 make it easier for remote attackers to obtain a PreMasterSecret value and defeat cryptographic protection mechanisms by sending a large number of requests in an SSL/TLS side-channel timing attack.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-310
References: http://secunia.com/advisories/60112; http://www-01.ibm.com/support/docview.wss?uid=swg1IT01111; http://www-01.ibm.com/support/docview.wss?uid=swg21678204
CVE: CVE-2014-5260
Published: 2014-08-16
Description: The (1) mkxmltype and (2) mkdtskel scripts in XML-DT before 0.64 allow local users to overwrite arbitrary files via a symlink attack on a /tmp/_xml_##### temporary file.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-59
References: http://openwall.com/lists/oss-security/2014/08/15/8; https://bugs.debian.org/756566; https://metacpan.org/diff/file?target=AMBS/XML-DT-0.64/&source=AMBS/XML-DT-0.63/
CVE: CVE-2014-0609
Published: 2014-08-17
Description: Unspecified vulnerability in Novell Open Enterprise Server (OES) 11 SP1 before Scheduled Maintenance Update 9415 and 11 SP2 before Scheduled Maintenance Update 9413 for Linux has unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/59982; http://www.novell.com/support/kb/doc.php?id=7010867; http://www.novell.com/support/kb/doc.php?id=7014420
CVE: CVE-2014-3900
Published: 2014-08-17
Description: Cross-site scripting (XSS) vulnerability in admin/picture_modify.php in the photo-edit subsystem in Piwigo 2.6.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the associate[] field, a different vulnerability than CVE-2014-4649.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN09717399/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2014-000093; http://piwigo.org/bugs/view.php?id=3089
CVE: CVE-2014-3904
Published: 2014-08-17
Description: SQL injection vulnerability in lib/admin.php in tenfourzero Shutter 0.1.4 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://jvn.jp/en/jp/JVN48039501/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2014-000095; http://jvn.jp/en/jp/JVN48039501/index.html
CVE: CVE-2014-3905
Published: 2014-08-17
Description: Cross-site scripting (XSS) vulnerability in tenfourzero Shutter 0.1.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN04455183/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2014-000096; http://jvn.jp/en/jp/JVN04455183/index.html
CVE: CVE-2014-0326
Published: 2014-08-17
Description: The Pilot Below Deck Equipment (BDE) and OpenPort implementations on Iridium satellite terminals allow remote attackers to read hardcoded credentials via the web interface.
CVSS Score: 9.3 (HIGH)
References: http://www.kb.cert.org/vuls/id/578598; http://www.kb.cert.org/vuls/id/578598
CVE: CVE-2014-0327
Published: 2014-08-17
Description: The Terminal Upgrade Tool in the Pilot Below Deck Equipment (BDE) and OpenPort implementations on Iridium satellite terminals allows remote attackers to execute arbitrary code by uploading new firmware to TCP port 54321.
CVSS Score: 9.3 (HIGH)
References: http://www.kb.cert.org/vuls/id/578598; http://www.kb.cert.org/vuls/id/578598
CVE: CVE-2014-0876
Published: 2014-08-17
Description: Buffer overflow in the Java GUI Configuration Wizard and Preferences Editor in the backup-archive client in IBM Tivoli Storage Manager (TSM) 5.x and 6.x before 6.2.5.2, 6.3.x before 6.3.2, and 6.4.x before 6.4.2 on Windows and OS X allows local users to cause a denial of service (application crash or hang) via unspecified vectors.
CVSS Score: 2.1 (LOW)
CWE: CWE-119
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IC95875; http://www-01.ibm.com/support/docview.wss?uid=swg21673318; https://exchange.xforce.ibmcloud.com/vulnerabilities/91063
CVE: CVE-2014-0905
Published: 2014-08-17
Description: IBM InfoSphere BigInsights 2.0 through 2.1.2 does not set the secure flag for the LTPA cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.
CVSS Score: 2.9 (LOW)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg21680830; https://exchange.xforce.ibmcloud.com/vulnerabilities/91720; http://www-01.ibm.com/support/docview.wss?uid=swg21680830
CVE: CVE-2014-0966
Published: 2014-08-17
Description: SQL injection vulnerability in the GDS component in IBM InfoSphere Master Data Management - Collaborative Edition 10.x and 11.x before 11.0-FP5 and InfoSphere Master Data Management Server for Product Information Management 9.x through 11.x before 11.3-IF2 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/60679; http://secunia.com/advisories/60693; http://secunia.com/advisories/60695
CVE: CVE-2014-0969
Published: 2014-08-17
Description: Cross-site request forgery (CSRF) vulnerability in the GDS component in IBM InfoSphere Master Data Management - Collaborative Edition 10.x and 11.x before 11.0-FP5 and InfoSphere Master Data Management Server for Product Information Management 9.x through 11.x before 11.3-IF2 allows remote authenticated users to hijack the authentication of arbitrary users.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://secunia.com/advisories/60679; http://secunia.com/advisories/60693; http://secunia.com/advisories/60695
CVE: CVE-2014-3063
Published: 2014-08-17
Description: IBM InfoSphere Master Data Management - Collaborative Edition 10.x before 10.1-FP11 and 11.x before 11.0-FP5 and InfoSphere Master Data Management Server for Product Information Management 9.x before 9.1-FP15 and 10.x and 11.x before 11.3-IF2 allow local users to obtain administrator privileges via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/60680; http://secunia.com/advisories/60694; http://secunia.com/advisories/60695
CVE: CVE-2014-3080
Published: 2014-08-17
Description: Multiple cross-site scripting (XSS) vulnerabilities on IBM GCM16 and GCM32 Global Console Manager switches with firmware before 1.20.20.23447 allow remote attackers to inject arbitrary web script or HTML via (1) the query string to kvm.cgi or (2) the key parameter to avctalert.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/127543/IBM-1754-GCM-KVM-Code-Execution-File-Read-XSS.html; http://seclists.org/fulldisclosure/2014/Jul/113; http://www.exploit-db.com/exploits/34132/
CVE: CVE-2014-3081
Published: 2014-08-17
Description: prodtest.php on IBM GCM16 and GCM32 Global Console Manager switches with firmware before 1.20.20.23447 allows remote authenticated users to read arbitrary files via the filename parameter.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-200
References: http://packetstormsecurity.com/files/127543/IBM-1754-GCM-KVM-Code-Execution-File-Read-XSS.html; http://seclists.org/fulldisclosure/2014/Jul/113; http://www.exploit-db.com/exploits/34132/
CVE: CVE-2014-3085
Published: 2014-08-17
Description: systest.php on IBM GCM16 and GCM32 Global Console Manager switches with firmware before 1.20.20.23447 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the lpres parameter.
CVSS Score: 7.1 (HIGH)
CWE: CWE-78
References: http://packetstormsecurity.com/files/127543/IBM-1754-GCM-KVM-Code-Execution-File-Read-XSS.html; http://www.exploit-db.com/exploits/34132/; http://www.ibm.com/support/entry/portal/docdisplay?lndocid=migr-5095983
CVE: CVE-2014-3087
Published: 2014-08-17
Description: callService.do in IBM Business Process Manager (BPM) 7.5 through 8.5.5 and WebSphere Lombardi Edition 7.2 through 7.2.0.5 allows remote authenticated users to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://secunia.com/advisories/60752; http://secunia.com/advisories/60755; http://secunia.com/advisories/60757
CVE: CVE-2014-4775
Published: 2014-08-17
Description: IBM InfoSphere Master Data Management - Collaborative Edition 10.x before 10.1-FP11 and 11.x before 11.0-FP5 and InfoSphere Master Data Management Server for Product Information Management 9.x before 9.1-FP15 and 10.x and 11.x before 11.3-IF2 do not properly protect credentials, which allows remote attackers to obtain sensitive information via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-255
References: http://www-01.ibm.com/support/docview.wss?uid=swg21681640; https://exchange.xforce.ibmcloud.com/vulnerabilities/94917; http://www-01.ibm.com/support/docview.wss?uid=swg21681640
CVE: CVE-2014-5074
Published: 2014-08-17
Description: Siemens SIMATIC S7-1500 CPU devices with firmware before 1.6 allow remote attackers to cause a denial of service (device restart and STOP transition) via crafted TCP packets.
CVSS Score: 7.1 (HIGH)
References: http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-310688.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-310688.pdf; https://ics-cert.us-cert.gov/advisories/ICSA-14-226-01
CVE: CVE-2014-1469
Published: 2014-08-18
Description: BlackBerry Enterprise Server 5.x before 5.0.4 MR7 and Enterprise Service 10.x before 10.2.2 log cleartext credentials during exception handling, which allows local users to obtain sensitive information by reading the exception log file.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-310
References: http://secunia.com/advisories/60154; http://www.blackberry.com/btsc/KB36175; http://www.securityfocus.com/bid/69211
CVE: CVE-2014-1470
Published: 2014-08-18
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2014-2388.  Reason: This candidate is a reservation duplicate of CVE-2014-2388.  Notes: All CVE users should reference CVE-2014-2388 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2014-2388
Published: 2014-08-18
Description: The Storage and Access service in BlackBerry OS 10.x before 10.2.1.1925 on Q5, Q10, Z10, and Z30 devices does not enforce the password requirement for SMB filesystem access, which allows context-dependent attackers to read arbitrary files via (1) a session over a Wi-Fi network or (2) a session over a USB connection in Development Mode.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-264
References: http://packetstormsecurity.com/files/127850; http://packetstormsecurity.com/files/127850/BlackBerry-Z10-Authentication-Bypass.html; http://secunia.com/advisories/60156
CVE: CVE-2014-3799
Published: 2014-08-18
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not a security issue within the scope of CVE.  Notes: none
CVE: CVE-2014-5043
Published: 2014-08-18
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not a security issue.  Notes: none
CVE: CVE-2014-5203
Published: 2014-08-18
Description: wp-includes/class-wp-customize-widgets.php in the widget implementation in WordPress 3.9.x before 3.9.2 might allow remote attackers to execute arbitrary code via crafted serialized data.
CVSS Score: 7.5 (HIGH)
References: http://openwall.com/lists/oss-security/2014/08/13/3; https://core.trac.wordpress.org/changeset/29389; https://wordpress.org/news/2014/08/wordpress-3-9-2/
CVE: CVE-2014-5204
Published: 2014-08-18
Description: wp-includes/pluggable.php in WordPress before 3.9.2 rejects invalid CSRF nonces with a different timing depending on which characters in the nonce are incorrect, which makes it easier for remote attackers to bypass a CSRF protection mechanism via a brute-force attack.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://openwall.com/lists/oss-security/2014/08/13/3; http://www.debian.org/security/2014/dsa-3001; https://core.trac.wordpress.org/changeset/29384
CVE: CVE-2014-5205
Published: 2014-08-18
Description: wp-includes/pluggable.php in WordPress before 3.9.2 does not use delimiters during concatenation of action values and uid values in CSRF tokens, which makes it easier for remote attackers to bypass a CSRF protection mechanism via a brute-force attack.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://openwall.com/lists/oss-security/2014/08/13/3; http://www.debian.org/security/2014/dsa-3001; https://core.trac.wordpress.org/changeset/29408
CVE: CVE-2014-5206
Published: 2014-08-18
Description: The do_remount function in fs/namespace.c in the Linux kernel through 3.16.1 does not maintain the MNT_LOCK_READONLY bit across a remount of a bind mount, which allows local users to bypass an intended read-only restriction and defeat certain sandbox protection mechanisms via a "mount -o remount" command within a user namespace.
CVSS Score: 7.2 (HIGH)
CWE: CWE-269
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=a6138db815df5ee542d848318e5dae681590fccd; http://www.openwall.com/lists/oss-security/2014/08/13/4; http://www.securityfocus.com/bid/69214
CVE: CVE-2014-5207
Published: 2014-08-18
Description: fs/namespace.c in the Linux kernel through 3.16.1 does not properly restrict clearing MNT_NODEV, MNT_NOSUID, and MNT_NOEXEC and changing MNT_ATIME_MASK during a remount of a bind mount, which allows local users to gain privileges, interfere with backups and auditing on systems that had atime enabled, or cause a denial of service (excessive filesystem updating) on systems that had atime disabled via a "mount -o remount" command within a user namespace.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-269
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=9566d6742852c527bf5af38af5cbb878dad75705; http://osvdb.org/show/osvdb/110055; http://packetstormsecurity.com/files/128595/Linux-Kernel-3.16.1-FUSE-Privilege-Escalation.html
CVE: CVE-2014-5240
Published: 2014-08-18
Description: Cross-site scripting (XSS) vulnerability in wp-includes/pluggable.php in WordPress before 3.9.2, when Multisite is enabled, allows remote authenticated administrators to inject arbitrary web script or HTML, and obtain Super Admin privileges, via a crafted avatar URL.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://openwall.com/lists/oss-security/2014/08/13/3; http://www.debian.org/security/2014/dsa-3001; https://core.trac.wordpress.org/changeset/29398
CVE: CVE-2014-5265
Published: 2014-08-18
Description: The Incutio XML-RPC (IXR) Library, as used in WordPress before 3.9.2 and Drupal 6.x before 6.33 and 7.x before 7.31, permits entity declarations without considering recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://cgit.drupalcode.org/drupal/diff/includes/xmlrpc.inc?id=1849830; http://www.debian.org/security/2014/dsa-2999; http://www.debian.org/security/2014/dsa-3001
CVE: CVE-2014-5266
Published: 2014-08-18
Description: The Incutio XML-RPC (IXR) Library, as used in WordPress before 3.9.2 and Drupal 6.x before 6.33 and 7.x before 7.31, does not limit the number of elements in an XML document, which allows remote attackers to cause a denial of service (CPU consumption) via a large document, a different vulnerability than CVE-2014-5265.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://cgit.drupalcode.org/drupal/diff/includes/xmlrpc.inc?id=1849830; http://cgit.drupalcode.org/drupal/diff/modules/openid/xrds.inc?id=1849830; http://www.debian.org/security/2014/dsa-2999
CVE: CVE-2014-3341
Published: 2014-08-19
Description: The SNMP module in Cisco NX-OS 7.0(3)N1(1) and earlier on Nexus 5000 and 6000 devices provides different error messages for invalid requests depending on whether the VLAN ID exists, which allows remote attackers to enumerate VLANs via a series of requests, aka Bug ID CSCup85616.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3341; http://tools.cisco.com/security/center/viewAlert.x?alertId=35338; http://www.securityfocus.com/bid/69266
CVE: CVE-2014-3903
Published: 2014-08-19
Description: Cross-site scripting (XSS) vulnerability in the Cakifo theme 1.x before 1.6.2 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via crafted Exif data.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://jayj.dk/security/JVN27531188.html; http://jvn.jp/en/jp/JVN27531188/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2014-000100
CVE: CVE-2014-3906
Published: 2014-08-19
Description: SQL injection vulnerability in OSK Advance-Flow 4.41 and earlier and Advance-Flow Forms 4.41 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://jvn.jp/en/jp/JVN20812625/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2014-000099; http://jvn.jp/en/jp/JVN20812625/index.html