deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-9165
Published: 2014-12-10
Description: Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.13 and 11.x before 11.0.10 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2014-8454 and CVE-2014-8455.
CVSS Score: 10.0 (HIGH)
References: http://helpx.adobe.com/security/products/reader/apsb14-28.html; http://helpx.adobe.com/security/products/reader/apsb14-28.html
CVE: CVE-2014-9166
Published: 2014-12-10
Description: Adobe ColdFusion 10 before Update 15 and 11 before Update 3 allows attackers to cause a denial of service (resource consumption) via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://helpx.adobe.com/security/products/coldfusion/apsb14-29.html; http://helpx.adobe.com/security/products/coldfusion/apsb14-29.html
CVE: CVE-2014-6319
Published: 2014-12-11
Description: Outlook Web App (OWA) in Microsoft Exchange Server 2007 SP3, 2010 SP3, and 2013 SP1 and Cumulative Update 6 does not properly validate tokens in requests, which allows remote attackers to spoof the origin of e-mail messages via unspecified vectors, aka "Outlook Web App Token Spoofing Vulnerability."
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-284
References: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-075; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-075
CVE: CVE-2014-6325
Published: 2014-12-11
Description: Cross-site scripting (XSS) vulnerability in Microsoft Exchange Server 2013 SP1 and Cumulative Update 6 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "OWA XSS Vulnerability," a different vulnerability than CVE-2014-6326.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-075; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-075
CVE: CVE-2014-6326
Published: 2014-12-11
Description: Cross-site scripting (XSS) vulnerability in Microsoft Exchange Server 2013 SP1 and Cumulative Update 6 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "OWA XSS Vulnerability," a different vulnerability than CVE-2014-6325.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-075; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-075
CVE: CVE-2014-6327
Published: 2014-12-11
Description: Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-6329 and CVE-2014-6376.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-080; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-080
CVE: CVE-2014-6328
Published: 2014-12-11
Description: Microsoft Internet Explorer 8 through 11 allows remote attackers to bypass the XSS filter via a crafted attribute of an element in an HTML document, aka "Internet Explorer XSS Filter Bypass Vulnerability," a different vulnerability than CVE-2014-6365.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-080; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-080
CVE: CVE-2014-6329
Published: 2014-12-11
Description: Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-6327 and CVE-2014-6376.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-080; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-080
CVE: CVE-2014-6330
Published: 2014-12-11
Description: Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-080; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-080
CVE: CVE-2014-6336
Published: 2014-12-11
Description: Outlook Web App (OWA) in Microsoft Exchange Server 2013 SP1 and Cumulative Update 6 does not properly validate redirection tokens, which allows remote attackers to redirect users to arbitrary web sites and spoof the origin of e-mail messages via unspecified vectors, aka "Exchange URL Redirection Vulnerability."
CVSS Score: 3.5 (LOW)
CWE: CWE-20
References: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-075; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-075
CVE: CVE-2014-6355
Published: 2014-12-11
Description: The Graphics Component in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly process JPEG images, which makes it easier for remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Graphics Component Information Disclosure Vulnerability."
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-085; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-085
CVE: CVE-2014-6356
Published: 2014-12-11
Description: Array index error in Microsoft Word 2007 SP3, Word 2010 SP2, and Office Compatibility Pack SP3 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Invalid Index Remote Code Execution Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-081; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-081
CVE: CVE-2014-6357
Published: 2014-12-11
Description: Use-after-free vulnerability in Microsoft Office 2010 SP2, Office 2013 Gold and SP1, Office 2013 RT Gold and SP1, Office for Mac 2011, Word Viewer, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2010 SP2 and 2013 Gold and SP1, and Office Web Apps 2010 SP2 and 2013 Gold and SP1 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Use After Free Word Remote Code Execution Vulnerability."
CVSS Score: 9.3 (HIGH)
References: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-081; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-081
CVE: CVE-2014-6360
Published: 2014-12-11
Description: Microsoft Excel 2007 SP3, Excel 2010 SP2, and Office Compatibility Pack allow remote attackers to execute arbitrary code via a crafted Office document, aka "Global Free Remote Code Execution in Excel Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-083; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-083
CVE: CVE-2014-6361
Published: 2014-12-11
Description: Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 Gold and SP1, Excel 2013 RT Gold and SP1, and Office Compatibility Pack allow remote attackers to execute arbitrary code via a crafted Office document, aka "Excel Invalid Pointer Remote Code Execution Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-083; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-083
CVE: CVE-2014-6363
Published: 2014-12-11
Description: vbscript.dll in Microsoft VBScript 5.6 through 5.8, as used with Internet Explorer 6 through 11 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "VBScript Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-080; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-084; https://www.exploit-db.com/exploits/40721/
CVE: CVE-2014-6364
Published: 2014-12-11
Description: Use-after-free vulnerability in Microsoft Office 2007 SP3; 2010 SP2; 2013 Gold, SP1, and SP2; and 2013 RT Gold and SP1 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Component Use After Free Vulnerability."
CVSS Score: 9.3 (HIGH)
References: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-082; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-082
CVE: CVE-2014-6365
Published: 2014-12-11
Description: Microsoft Internet Explorer 8 through 11 allows remote attackers to bypass the XSS filter via a crafted attribute of an element in an HTML document, aka "Internet Explorer XSS Filter Bypass Vulnerability," a different vulnerability than CVE-2014-6328.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-080; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-080
CVE: CVE-2014-6366
Published: 2014-12-11
Description: Microsoft Internet Explorer 6 and 7 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-080; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-080
CVE: CVE-2014-6368
Published: 2014-12-11
Description: Microsoft Internet Explorer 11 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Internet Explorer ASLR Bypass Vulnerability."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-080; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-080
CVE: CVE-2014-6369
Published: 2014-12-11
Description: Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/71452; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-080; http://www.securityfocus.com/bid/71452
CVE: CVE-2014-6373
Published: 2014-12-11
Description: Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-080; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-080
CVE: CVE-2014-6374
Published: 2014-12-11
Description: Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-080; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-080
CVE: CVE-2014-6375
Published: 2014-12-11
Description: Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-080; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-080
CVE: CVE-2014-6376
Published: 2014-12-11
Description: Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-6327 and CVE-2014-6329.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-080; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-080
CVE: CVE-2014-8966
Published: 2014-12-11
Description: Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-080; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-080
CVE: CVE-2014-8500
Published: 2014-12-11
Description: ISC BIND 9.0.x through 9.8.x, 9.9.0 through 9.9.6, and 9.10.0 through 9.10.1 does not limit delegation chaining, which allows remote attackers to cause a denial of service (memory consumption and named crash) via a large or infinite number of referrals.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://advisories.mageia.org/MGASA-2014-0524.html; http://cert.ssi.gouv.fr/site/CERTFR-2014-AVI-512/index.html; http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2015-002.txt.asc
CVE: CVE-2014-8602
Published: 2014-12-11
Description: iterator.c in NLnet Labs Unbound before 1.5.1 does not limit delegation chaining, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a large or infinite number of referrals.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-399
References: http://cert.ssi.gouv.fr/site/CERTFR-2014-AVI-512/index.html; http://unbound.net/downloads/patch_cve_2014_8602.diff; http://www.debian.org/security/2014/dsa-3097
CVE: CVE-2014-8680
Published: 2014-12-11
Description: The GeoIP functionality in ISC BIND 9.10.0 through 9.10.1 allows remote attackers to cause a denial of service (assertion failure and named exit) via vectors related to (1) the lack of GeoIP databases for both IPv4 and IPv6, or (2) IPv6 support with certain options.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-20, CWE-284
References: http://security.gentoo.org/glsa/glsa-201502-03.xml; https://kb.isc.org/article/AA-01217; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2014-1587
Published: 2014-12-11
Description: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 34.0, Firefox ESR 31.x before 31.3, Thunderbird before 31.3, and SeaMonkey before 2.31 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00024.html; http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00031.html; http://www.debian.org/security/2014/dsa-3090
CVE: CVE-2014-1588
Published: 2014-12-11
Description: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 34.0 and SeaMonkey before 2.31 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
References: http://www.mozilla.org/security/announce/2014/mfsa2014-83.html; http://www.oracle.com/technetwork/topics/security/bulletinapr2[PII_REDACTED].html; https://bugzilla.mozilla.org/show_bug.cgi?id=1013001
CVE: CVE-2014-1589
Published: 2014-12-11
Description: Mozilla Firefox before 34.0 and SeaMonkey before 2.31 provide stylesheets with an incorrect primary namespace, which allows remote attackers to bypass intended access restrictions via an XBL binding.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-284
References: http://www.mozilla.org/security/announce/2014/mfsa2014-84.html; http://www.oracle.com/technetwork/topics/security/bulletinapr2[PII_REDACTED].html; https://bugzilla.mozilla.org/show_bug.cgi?id=1043787
CVE: CVE-2014-1590
Published: 2014-12-11
Description: The XMLHttpRequest.prototype.send method in Mozilla Firefox before 34.0, Firefox ESR 31.x before 31.3, Thunderbird before 31.3, and SeaMonkey before 2.31 allows remote attackers to cause a denial of service (application crash) via a crafted JavaScript object.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00024.html; http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00031.html; http://www.debian.org/security/2014/dsa-3090
CVE: CVE-2014-1591
Published: 2014-12-11
Description: Mozilla Firefox 33.0 and SeaMonkey before 2.31 include path strings in CSP violation reports, which allows remote attackers to obtain sensitive information via a web site that receives a report after a redirect.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-199
References: http://www.mozilla.org/security/announce/2014/mfsa2014-86.html; http://www.oracle.com/technetwork/topics/security/bulletinapr2[PII_REDACTED].html; https://bugzilla.mozilla.org/show_bug.cgi?id=1069762
CVE: CVE-2014-1592
Published: 2014-12-11
Description: Use-after-free vulnerability in the nsHtml5TreeOperation function in xul.dll in Mozilla Firefox before 34.0, Firefox ESR 31.x before 31.3, Thunderbird before 31.3, and SeaMonkey before 2.31 allows remote attackers to execute arbitrary code by adding a second root element to an HTML5 document during parsing.
CVSS Score: 6.8 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00024.html; http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00031.html; http://www.debian.org/security/2014/dsa-3090
CVE: CVE-2014-1593
Published: 2014-12-11
Description: Stack-based buffer overflow in the mozilla::FileBlockCache::Read function in Mozilla Firefox before 34.0, Firefox ESR 31.x before 31.3, Thunderbird before 31.3, and SeaMonkey before 2.31 allows remote attackers to execute arbitrary code via crafted media content.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00024.html; http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00031.html; http://www.debian.org/security/2014/dsa-3090
CVE: CVE-2014-1594
Published: 2014-12-11
Description: Mozilla Firefox before 34.0, Firefox ESR 31.x before 31.3, Thunderbird before 31.3, and SeaMonkey before 2.31 might allow remote attackers to execute arbitrary code by leveraging an incorrect cast from the BasicThebesLayer data type to the BasicContainerLayer data type.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00024.html; http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00031.html; http://www.debian.org/security/2014/dsa-3090
CVE: CVE-2014-1595
Published: 2014-12-11
Description: Mozilla Firefox before 34.0, Firefox ESR 31.x before 31.3, and Thunderbird before 31.3 on Apple OS X 10.10 omit a CoreGraphics disable-logging action that is needed by jemalloc-based applications, which allows local users to obtain sensitive information by reading /tmp files, as demonstrated by credential information.
CVSS Score: 2.1 (LOW)
CWE: CWE-199
References: http://lists.apple.com/archives/security-announce/2015/Jan/msg00003.html; http://support.apple.com/HT204244; http://www.mozilla.org/security/announce/2014/mfsa2014-90.html
CVE: CVE-2014-6114
Published: 2014-12-11
Description: The Hosted Transparent Decision Service in the Rule Execution Server in IBM WebSphere ILOG JRules 7.1 before MP1 FP5 IF43; WebSphere Operational Decision Management 7.5 before FP3 IF41; and Operational Decision Manager 8.0 before MP1 FP2 IF34, 8.5 before MP1 FP1 IF43, and 8.6 before IF8 allows remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg21691815; https://exchange.xforce.ibmcloud.com/vulnerabilities/96211; http://www-01.ibm.com/support/docview.wss?uid=swg21691815
CVE: CVE-2014-7192
Published: 2014-12-11
Description: Eval injection vulnerability in index.js in the syntax-error package before 1.1.1 for Node.js 0.10.x, as used in IBM Rational Application Developer and other products, allows remote attackers to execute arbitrary code via a crafted file.
CVSS Score: 10.0 (HIGH)
CWE: CWE-94
References: http://www-01.ibm.com/support/docview.wss?uid=swg21690815; https://exchange.xforce.ibmcloud.com/vulnerabilities/96728; https://github.com/substack/node-syntax-error/commit/9aa4e66eb90ec595d2dba55e6f9c2dd9a668b309
CVE: CVE-2014-8631
Published: 2014-12-11
Description: The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 34.0 and SeaMonkey before 2.31 supports native-interface passing, which allows remote attackers to bypass intended DOM object restrictions via a call to an unspecified method.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: http://www.mozilla.org/security/announce/2014/mfsa2014-91.html; http://www.oracle.com/technetwork/topics/security/bulletinapr2[PII_REDACTED].html; https://bugzilla.mozilla.org/show_bug.cgi?id=821573
CVE: CVE-2014-8632
Published: 2014-12-11
Description: The structured-clone implementation in Mozilla Firefox before 34.0 and SeaMonkey before 2.31 does not properly interact with XrayWrapper property filtering, which allows remote attackers to bypass intended DOM object restrictions by leveraging property availability after XrayWrapper removal.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: http://www.mozilla.org/security/announce/2014/mfsa2014-91.html; http://www.oracle.com/technetwork/topics/security/bulletinapr2[PII_REDACTED].html; https://bugzilla.mozilla.org/show_bug.cgi?id=1050340
CVE: CVE-2014-7852
Published: 2014-12-11
Description: Cross-site scripting (XSS) vulnerability in JBoss RichFaces, as used in JBoss Portal 6.1.1, allows remote attackers to inject arbitrary web script or HTML via crafted URL, which is not properly handled in a CSS file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://rhn.redhat.com/errata/RHSA-2014-1973.html; http://www.securitytracker.com/id/1031363; http://rhn.redhat.com/errata/RHSA-2014-1973.html
CVE: CVE-2014-8372
Published: 2014-12-11
Description: AirWatch by VMware On-Premise 7.3.x before 7.3.3.0 (FP3) allows remote authenticated users to obtain the organizational information and statistics from arbitrary tenants via vectors involving a direct object reference.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://seclists.org/fulldisclosure/2014/Dec/44; http://www.vmware.com/security/advisories/VMSA-2014-0014.html; http://seclists.org/fulldisclosure/2014/Dec/44
CVE: CVE-2014-8373
Published: 2014-12-11
Description: The VMware Remote Console (VMRC) function in VMware vCloud Automation Center (vCAC) 6.0.1 through 6.1.1 allows remote authenticated users to gain privileges via vectors involving the "Connect (by) Using VMRC" function.
CVSS Score: 9.0 (HIGH)
CWE: CWE-264
References: http://packetstormsecurity.com/files/129455/VMware-Security-Advisory-2014-0013.html; http://seclists.org/fulldisclosure/2014/Dec/33; http://secunia.com/advisories/61169