deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-6035
Published: 2014-12-04
Description: Directory traversal vulnerability in the FileCollector servlet in ZOHO ManageEngine OpManager 11.4, 11.3, and earlier allows remote attackers to write and execute arbitrary files via a .. (dot dot) in the FILENAME parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://seclists.org/fulldisclosure/2014/Sep/110; https://raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_opmanager_socialit_it360.txt; https://support.zoho.com/portal/manageengine/helpcenter/articles/servlet-vulnerability-fix
CVE: CVE-2014-6036
Published: 2014-12-04
Description: Directory traversal vulnerability in the multipartRequest servlet in ZOHO ManageEngine OpManager 11.3 and earlier, Social IT Plus 11.0, and IT360 10.3, 10.4, and earlier allows remote attackers or remote authenticated users to delete arbitrary files via a .. (dot dot) in the fileName parameter.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-22
References: http://seclists.org/fulldisclosure/2014/Sep/110; https://raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_opmanager_socialit_it360.txt; https://support.zoho.com/portal/manageengine/helpcenter/articles/servlet-vulnerability-fix
CVE: CVE-2014-7867
Published: 2014-12-04
Description: SQL injection vulnerability in the com.manageengine.opmanager.servlet.UpdateProbeUpgradeStatus servlet in ZOHO ManageEngine OpManager 11.3 and 11.4, IT360 10.3 and 10.4, and Social IT Plus 11.0 allows remote attackers or remote authenticated users to execute arbitrary SQL commands via the probeName parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://support.zoho.com/portal/manageengine/helpcenter/articles/sql-injection-vulnerability-fix; https://support.zoho.com/portal/manageengine/helpcenter/articles/sql-injection-vulnerability-fix
CVE: CVE-2014-7868
Published: 2014-12-04
Description: Multiple SQL injection vulnerabilities in ZOHO ManageEngine OpManager 11.3 and 11.4, IT360 10.3 and 10.4, and Social IT Plus 11.0 allow remote attackers or remote authenticated users to execute arbitrary SQL commands via the (1) OPM_BVNAME parameter in a Delete operation to the APMBVHandler servlet or (2) query parameter in a compare operation to the DataComparisonServlet servlet.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/129037/ManageEngine-OpManager-Social-IT-Plus-IT360-File-Upload-SQL-Injection.html; http://seclists.org/fulldisclosure/2014/Nov/21; http://www.securityfocus.com/archive/1/533946/100/0/threaded
CVE: CVE-2014-3996
Published: 2014-12-05
Description: SQL injection vulnerability in the LinkViewFetchServlet servlet in ManageEngine Desktop Central (DC) and Desktop Central Managed Service Providers (MSP) edition before 9 build 90043, Password Manager Pro (PMP) and Password Manager Pro Managed Service Providers (MSP) edition before 7 build 7003, IT360 and IT360 Managed Service Providers (MSP) edition before 10.3.3 build 10330, and possibly other ManageEngine products, allows remote attackers or remote authenticated users to execute arbitrary SQL commands via the sv parameter to LinkViewFetchServlet.dat.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/127973/ManageEngine-Password-Manager-MetadataServlet.dat-SQL-Injection.html; http://seclists.org/fulldisclosure/2014/Aug/55; http://seclists.org/fulldisclosure/2014/Aug/85
CVE: CVE-2014-3997
Published: 2014-12-05
Description: SQL injection vulnerability in the MetadataServlet servlet in ManageEngine Password Manager Pro (PMP) and Password Manager Pro Managed Service Providers (MSP) edition 5 through 7 build 7003, IT360 and IT360 Managed Service Providers (MSP) edition before 10.3.3 build 10330, and possibly other ManageEngine products, allows remote attackers or remote authenticated users to execute arbitrary SQL commands via the sv parameter to MetadataServlet.dat.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://seclists.org/fulldisclosure/2014/Aug/55; http://seclists.org/fulldisclosure/2014/Aug/85; https://raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_dc_pmp_it360_sqli.txt
CVE: CVE-2014-8800
Published: 2014-12-05
Description: Cross-site scripting (XSS) vulnerability in nextend-facebook-settings.php in the Nextend Facebook Connect plugin before 1.5.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the fb_login_button parameter in a newfb_update_options action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/show/osvdb/115231; http://security.szurek.pl/nextend-facebook-connect-1459-xss.html; http://www.exploit-db.com/exploits/35439
CVE: CVE-2014-9129
Published: 2014-12-05
Description: Cross-site request forgery (CSRF) vulnerability in the CreativeMinds CM Downloads Manager plugin before 2.0.7 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the addons_title parameter in the CMDM_admin_settings page to wp-admin/admin.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.com/files/129357/WordPress-CM-Download-Manager-2.0.6-XSS-CSRF.html; http://www.securityfocus.com/archive/1/534132/100/0/threaded; http://www.securityfocus.com/bid/71418
CVE: CVE-2014-9142
Published: 2014-12-05
Description: Cross-site scripting (XSS) vulnerability in Technicolor Router TD5130 with firmware 2.05.C29GV allows remote attackers to inject arbitrary web script or HTML via the failrefer parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/129374/ADSL2-2.05.C29GV-XSS-URL-Redirect-Command-Injection.html; http://www.exploit-db.com/exploits/35462; http://www.securityfocus.com/archive/1/534143/100/0/threaded
CVE: CVE-2014-9143
Published: 2014-12-05
Description: Open redirect vulnerability in Technicolor Router TD5130 with firmware 2.05.C29GV allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the failrefer parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-17
References: http://packetstormsecurity.com/files/129374/ADSL2-2.05.C29GV-XSS-URL-Redirect-Command-Injection.html; http://www.exploit-db.com/exploits/35462; http://www.securityfocus.com/archive/1/534143/100/0/threaded
CVE: CVE-2014-9144
Published: 2014-12-05
Description: Technicolor Router TD5130 with firmware 2.05.C29GV allows remote attackers to execute arbitrary commands via shell metacharacters in the ping field (setobject_ip parameter).
CVSS Score: 7.5 (HIGH)
CWE: CWE-77
References: http://packetstormsecurity.com/files/129374/ADSL2-2.05.C29GV-XSS-URL-Redirect-Command-Injection.html; http://www.exploit-db.com/exploits/35462; http://www.securityfocus.com/archive/1/534143/100/0/threaded
CVE: CVE-2014-9212
Published: 2014-12-05
Description: Multiple cross-site scripting (XSS) vulnerabilities in Altitude uAgent in Altitude uCI (Unified Customer Interaction) 7.5 allow remote attackers to inject arbitrary web script or HTML via (1) an email hyperlink or the (2) style parameter in the image attribute section.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/129372/Altitude-uAgent-Altitude-uCI-7.5-XSS.html; http://packetstormsecurity.com/files/129372/Altitude-uAgent-Altitude-uCI-7.5-XSS.html
CVE: CVE-2014-9215
Published: 2014-12-05
Description: SQL injection vulnerability in the CheckEmail function in includes/functions.class.php in PBBoard 3.0.1 before 20141128 allows remote attackers to execute arbitrary SQL commands via the email parameter in the register page to index.php.  NOTE: the email parameter in the forget page vector is already covered by CVE-2012-4034.2.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.itas.vn/news/ITAS-Team-discovered-SQL-Injection-in-PBBoard-CMS-68.html; http://www.securityfocus.com/archive/1/534149/100/0/threaded; https://www.youtube.com/watch?v=AQiGvH5xrJg
CVE: CVE-2012-6656
Published: 2014-12-05
Description: iconvdata/ibm930.c in GNU C Library (aka glibc) before 2.16 allows context-dependent attackers to cause a denial of service (out-of-bounds read) via a multibyte character value of "0xffff" to the iconv function when converting IBM930 encoded data to UTF-8.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://www.debian.org/security/2015/dsa-3142; http://www.mandriva.com/security/advisories?name=MDVSA-2014:175; http://www.openwall.com/lists/oss-security/2014/08/29/3
CVE: CVE-2014-2273
Published: 2014-12-05
Description: The hx170dec device driver in Huawei P2-6011 before V100R001C00B043 allows local users to read and write to arbitrary memory locations via unspecified vectors.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-401529.htm; http://www.securityfocus.com/bid/71374; https://exchange.xforce.ibmcloud.com/vulnerabilities/99088
CVE: CVE-2014-3561
Published: 2014-12-05
Description: The rhevm-log-collector package in Red Hat Enterprise Virtualization 3.4 uses the PostgreSQL database password on the command line when calling sosreport, which allows local users to obtain sensitive information by listing the processes.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://rhn.redhat.com/errata/RHSA-2014-1947.html; http://www.securitytracker.com/id/1031291; https://exchange.xforce.ibmcloud.com/vulnerabilities/99096
CVE: CVE-2014-3627
Published: 2014-12-05
Description: The YARN NodeManager daemon in Apache Hadoop 0.23.0 through 0.23.11 and 2.x before 2.5.2, when using Kerberos authentication, allows remote cluster users to change the permissions of certain files to world-readable via a symlink attack in a public tar archive, which is not properly handled during localization, related to distributed cache.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-59
References: http://mail-archives.apache.org/mod_mbox/hadoop-general/201411.mbox/%3CCALwhT97dOi04aC3VbekaB+zn2UAS_OZV2EAiP78GmjnMzfp2Ug%40mail.gmail.com%3E; http://secunia.com/advisories/60079; http://secunia.com/advisories/60432
CVE: CVE-2014-4701
Published: 2014-12-05
Description: The check_dhcp plugin in Nagios Plugins before 2.0.2 allows local users to obtain sensitive information from INI configuration files via the extra-opts flag, a different vulnerability than CVE-2014-4702.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://legalhackers.com/advisories/nagios-check_dhcp.txt; http://nagios-plugins.org/nagios-plugins-2-0-2-released/?utm_source=Nagios.org&utm_medium=News+Post&utm_content=Nagios%20Plugins%202.0.2%20Released&utm_campaign=Nagios%20Plugins; http://seclists.org/fulldisclosure/2014/May/74
CVE: CVE-2014-4702
Published: 2014-12-05
Description: The check_icmp plugin in Nagios Plugins before 2.0.2 allows local users to obtain sensitive information from INI configuration files via the extra-opts flag, a different vulnerability than CVE-2014-4701.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://nagios-plugins.org/nagios-plugins-2-0-2-released/?utm_source=Nagios.org&utm_medium=News+Post&utm_content=Nagios%20Plugins%202.0.2%20Released&utm_campaign=Nagios%20Plugins; http://secunia.com/advisories/58751; http://secunia.com/advisories/61319
CVE: CVE-2014-4703
Published: 2014-12-05
Description: lib/parse_ini.c in Nagios Plugins 2.0.2 allows local users to obtain sensitive information via a symlink attack on the configuration file in the extra-opts flag.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-4701.
CVSS Score: 2.1 (LOW)
CWE: CWE-59
References: http://nagios-plugins.org/nagios-plugins-2-0-3-released/; http://seclists.org/fulldisclosure/2014/Jun/141; http://www.openwall.com/lists/oss-security/2014/06/30/6
CVE: CVE-2014-6040
Published: 2014-12-05
Description: GNU C Library (aka glibc) before 2.20 allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) via a multibyte character value of "0xffff" to the iconv function when converting (1) IBM933, (2) IBM935, (3) IBM937, (4) IBM939, or (5) IBM1364 encoded data to UTF-8.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://linux.oracle.com/errata/ELSA-2015-0016.html; http://secunia.com/advisories/62100; http://secunia.com/advisories/62146
CVE: CVE-2014-8123
Published: 2014-12-05
Description: Buffer overflow in the bGetPPS function in wordole.c in Antiword 0.37 allows remote attackers to cause a denial of service (crash) via a crafted document.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://www.openwall.com/lists/oss-security/2014/12/01/4; http://www.openwall.com/lists/oss-security/2014/12/02/1; http://www.securityfocus.com/bid/71386
CVE: CVE-2014-8990
Published: 2014-12-05
Description: default-rsyncssh.lua in Lsyncd 2.1.5 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in a filename.
CVSS Score: 7.5 (HIGH)
CWE: CWE-77
References: http://lists.fedoraproject.org/pipermail/package-announce/2014-December/145114.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-December/145131.html; http://secunia.com/advisories/62321
CVE: CVE-2014-9140
Published: 2014-12-05
Description: Buffer overflow in the ppp_hdlc function in print-ppp.c in tcpdump 4.6.2 and earlier allows remote attackers to cause a denial of service (crash) cia a crafted PPP packet.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://advisories.mageia.org/MGASA-2014-0511.html; http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html; http://lists.opensuse.org/opensuse-updates/2015-03/msg00084.html
CVE: CVE-2014-7243
Published: 2014-12-05
Description: LG Electronics Mobile WiFi router L-09C, L-03E, and L-04D does not restrict access to the web administration interface, which allows remote attackers to obtain sensitive information via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://jvn.jp/en/jp/JVN71762315/995312/index.html; http://jvn.jp/en/jp/JVN71762315/index.html; http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-000140.html
CVE: CVE-2014-7252
Published: 2014-12-05
Description: Multiple unspecified vulnerabilities in the Syslink driver for Texas Instruments OMAP mobile processor, as used on NTT DOCOMO ARROWS Tab LTE F-01D, ARROWS X LTE F-05D, Disney Mobile on docomo F-08D, REGZA Phone T-01D, and PRADA phone by LG L-02D; and SoftBank SHARP handsets 102SH allow local users to execute arbitrary code or read kernel memory via unknown vectors related to userland data and "improper data validation."
CVSS Score: 4.6 (MEDIUM)
References: http://jvn.jp/en/jp/JVN67792023/397327/index.html; http://jvn.jp/en/jp/JVN67792023/995312/index.html; http://jvn.jp/en/jp/JVN67792023/index.html
CVE: CVE-2014-7253
Published: 2014-12-05
Description: FUJITSU F-12C, ARROWS Tab LTE F-01D, ARROWS Kiss F-03D, and REGZA Phone T-01D for Android allows local users to execute arbitrary commands via unspecified vectors.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: http://jvn.jp/en/jp/JVN06302787/995312/index.html; http://jvn.jp/en/jp/JVN06302787/index.html; http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-000138.html
CVE: CVE-2014-7254
Published: 2014-12-05
Description: Unspecified vulnerability in ARROWS Me F-11D allows physically proximate attackers to read or modify flash memory via unknown vectors.
CVSS Score: 4.6 (MEDIUM)
References: http://jvn.jp/en/jp/JVN61593104/995312/index.html; http://jvn.jp/en/jp/JVN61593104/index.html; http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-000139.html
CVE: CVE-2014-7255
Published: 2014-12-05
Description: Internet Initiative Japan Inc. SEIL Series routers SEIL/X1 2.50 through 4.62, SEIL/X2 2.50 through 4.62, SEIL/B1 2.50 through 4.62, and SEIL/x86 Fuji 1.70 through 3.22 allow remote attackers to cause a denial of service (CPU and traffic consumption) via a large number of NTP requests within a short time, which causes unnecessary NTP responses to be sent.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: http://jvn.jp/en/jp/JVN21907573/index.html; http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-000135.html; http://www.seil.jp/support/security/a01510.html
CVE: CVE-2014-7256
Published: 2014-12-05
Description: The (1) PPP Access Concentrator (PPPAC) and (2) Dial-Up Networking Internet Initiative Japan Inc. SEIL series routers SEIL/x86 Fuji 1.00 through 3.22; SEIL/X1, SEIL/X2, and SEIL/B1 1.00 through 4.62; SEIL/Turbo 1.82 through 2.18; and SEIL/neu 2FE Plus 1.82 through 2.18 allow remote attackers to cause a denial of service (restart) via crafted (a) GRE or (b) MPPE packets.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://jvn.jp/en/jp/JVN04895240/index.html; http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-000136.html; http://www.seil.jp/support/security/a01511.html
CVE: CVE-2014-7258
Published: 2014-12-05
Description: Cross-site scripting (XSS) vulnerability in KENT-WEB Clip Board 2.91 and earlier, when running certain versions of Internet Explorer, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN12798709/index.html; http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-000147.html; http://www.kent-web.com/bbs/clipbbs.html
CVE: CVE-2014-7259
Published: 2014-12-05
Description: SQUARE ENIX Co., Ltd. Kaku-San-Sei Million Arthur before 2.25 for Android stores "product credentials" on the SD card, which allows attackers to gain privileges via a crafted application.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://jvn.jp/en/jp/JVN24909891/index.html; http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-000148.html; http://jvn.jp/en/jp/JVN24909891/index.html
CVE: CVE-2014-8877
Published: 2014-12-05
Description: The alterSearchQuery function in lib/controllers/CmdownloadController.php in the CreativeMinds CM Downloads Manager plugin before 2.0.4 for WordPress allows remote attackers to execute arbitrary PHP code via the CMDsearch parameter to cmdownloads/, which is processed by the PHP create_function function.
CVSS Score: 10.0 (HIGH)
CWE: CWE-94
References: http://packetstormsecurity.com/files/129183/WordPress-CM-Download-Manager-2.0.0-Code-Injection.html; http://www.itas.vn/news/code-injection-in-cm-download-manager-plugin-66.html; http://www.securityfocus.com/archive/1/534037/100/0/threaded
CVE: CVE-2014-9292
Published: 2014-12-05
Description: Server-side request forgery (SSRF) vulnerability in proxy.php in the jRSS Widget plugin 1.2 and earlier for WordPress allows remote attackers to trigger outbound requests and enumerate open ports via the url parameter.
CVSS Score: 5.8 (MEDIUM)
References: http://codevigilant.com/disclosure/wp-plugin-jrss-widget-ssrfxspa/; http://codevigilant.com/disclosure/wp-plugin-jrss-widget-ssrfxspa/
CVE: CVE-2014-3099
Published: 2014-12-06
Description: Unspecified vulnerability in the Security component in IBM Systems Director 6.3.0 through 6.3.5 allows local users to obtain sensitive information via unknown vectors.
CVSS Score: 2.1 (LOW)
References: http://www-01.ibm.com/support/docview.wss?rs=0&uid=nas76c9e0fe437973f6c86257d48003b00b9; http://www-01.ibm.com/support/docview.wss?uid=swg1IT04508; http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5096586
CVE: CVE-2014-4629
Published: 2014-12-06
Description: EMC Documentum Content Server 7.0, 7.1 before 7.1 P10, and 6.7 before SP2 P19 allows remote authenticated users to read or delete arbitrary files via unspecified vectors related to an insecure direct object reference.
CVSS Score: 9.0 (HIGH)
CWE: CWE-264
References: http://packetstormsecurity.com/files/129376/EMC-Documentum-Content-Server-Insecure-Direct-Object-Reference.html; http://www.securityfocus.com/archive/1/534135/100/0/threaded; http://www.securityfocus.com/bid/71422
CVE: CVE-2014-5429
Published: 2014-12-06
Description: DNP Master Driver 3.02 and earlier in Elipse SCADA 2.29 build 141 and earlier, E3 1.0 through 4.6, and Elipse Power 1.0 through 4.6 allows remote attackers to cause a denial of service (CPU consumption) via malformed packets.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://ics-cert.us-cert.gov/advisories/ICSA-14-303-02; http://ics-cert.us-cert.gov/advisories/ICSA-14-303-02
CVE: CVE-2014-6140
Published: 2014-12-06
Description: IBM Tivoli Endpoint Manager Mobile Device Management (MDM) before 9.0.60100 uses the same secret HMAC token across different customers' installations, which allows remote attackers to execute arbitrary code via crafted marshalled Ruby objects in cookies to (1) Enrollment and Apple iOS Management Extender, (2) Self-service portal, (3) Trusted Services provider, or (4) Admin Portal.
CVSS Score: 9.3 (HIGH)
CWE: CWE-310
References: http://packetstormsecurity.com/files/129349/IBM-Endpoint-Manager-For-Mobile-Devices-Code-Execution.html; http://seclists.org/fulldisclosure/2014/Dec/3; http://www-01.ibm.com/support/docview.wss?uid=swg21691701
CVE: CVE-2014-7251
Published: 2014-12-06
Description: XML external entity (XXE) vulnerability in the WebHMI server in Yokogawa Electric Corporation FAST/TOOLS before R9.05-SP2 allows local users to cause a denial of service (CPU or network traffic consumption) or read arbitrary files via unspecified vectors.
CVSS Score: 3.2 (LOW)
CWE: CWE-20
References: http://jvn.jp/en/jp/JVN54775800/index.html; http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-000141.html; http://www.yokogawa.com/dcs/security/ysar/YSAR-14-0004E.pdf
CVE: CVE-2014-9278
Published: 2014-12-06
Description: The OpenSSH server, as used in Fedora and Red Hat Enterprise Linux 7 and when running in a Kerberos environment, allows remote authenticated users to log in as another user when they are listed in the .k5users file of that user, which might bypass intended authentication requirements that would force a local login.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-287
References: http://rhn.redhat.com/errata/RHSA-2015-0425.html; http://thread.gmane.org/gmane.comp.encryption.kerberos.general/15855; http://www.openwall.com/lists/oss-security/2014/12/02/3
CVE: CVE-2014-8651
Published: 2014-12-06
Description: The KDE Clock KCM policykit helper in kde-workspace before 4.11.14 and plasma-desktop before 5.1.1 allows local users to gain privileges via a crafted ntpUtility (ntp utility name) argument.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://lists.fedoraproject.org/pipermail/package-announce/2014-November/143781.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-November/144034.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-November/144093.html
CVE: CVE-2014-9117
Published: 2014-12-06
Description: MantisBT before 1.2.18 uses the public_key parameter value as the key to the CAPTCHA answer, which allows remote attackers to bypass the CAPTCHA protection mechanism by leveraging knowledge of a CAPTCHA answer for a public_key parameter value, as demonstrated by E4652 for the public_key value 0.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-284
References: http://secunia.com/advisories/62101; http://www.debian.org/security/2015/dsa-3120; http://www.openwall.com/lists/oss-security/2014/11/26/19
CVE: CVE-2014-8868
Published: 2014-12-07
Description: EntryPass N5200 Active Network Control Panel does not properly restrict access, which allows remote attackers to obtain the administrator username and password, and possibly other sensitive information, via a request to /4.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://seclists.org/fulldisclosure/2014/Dec/2; http://www.securityfocus.com/archive/1/534128/100/0/threaded; https://www.redteam-pentesting.de/advisories/rt-sa-2014-011
CVE: CVE-2014-9300
Published: 2014-12-07
Description: Cross-site request forgery (CSRF) vulnerability in the cmisbrowser servlet in Content Management Interoperability Service (CMIS) in Alfresco Community Edition before 5.0.a allows remote attackers to hijack the authentication of users for requests that access unauthorized URLs and obtain user credentials via a URL in the url parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://seclists.org/bugtraq/2014/Jul/72; https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140716-0_Alfresco_Community_Edition_Multiple_SSRF_vulnerabilities_v10.txt; http://seclists.org/bugtraq/2014/Jul/72