deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2013-2086
Published: 2014-03-14
Description: The configuration loader in ownCloud 5.0.x before 5.0.6 allows remote attackers to obtain CSRF tokens and other sensitive information by reading an unspecified JavaScript file.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://owncloud.org/about/security/advisories/oC-SA-2013-027/; http://owncloud.org/about/security/advisories/oC-SA-2013-027/
CVE: CVE-2013-2089
Published: 2014-03-14
Description: Incomplete blacklist vulnerability in ownCloud before 5.0.6 allows remote authenticated users to execute arbitrary PHP code by uploading a crafted file, then accessing it via a direct request to the file in /data.
CVSS Score: 4.6 (MEDIUM)
References: http://owncloud.org/about/security/advisories/oC-SA-2013-026/; http://owncloud.org/about/security/advisories/oC-SA-2013-026/
CVE: CVE-2013-2149
Published: 2014-03-14
Description: Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.16 and 5.x before 5.0.7 allow remote authenticated users to inject arbitrary web script or HTML via vectors related to shared files.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://owncloud.org/about/security/advisories/oC-SA-2013-028/; http://owncloud.org/about/security/advisories/oC-SA-2013-028/
CVE: CVE-2013-2150
Published: 2014-03-14
Description: Multiple cross-site scripting (XSS) vulnerabilities in js/viewer.js in ownCloud before 4.5.12 and 5.x before 5.0.7 allow remote attackers to inject arbitrary web script or HTML via vectors related to shared files.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://owncloud.org/about/security/advisories/oC-SA-2013-028/; http://owncloud.org/about/security/advisories/oC-SA-2013-028/
CVE: CVE-2013-4963
Published: 2014-03-14
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in Puppet Enterprise (PE) before 3.0.1 allow remote attackers to hijack the authentication of users for requests that deleting a (1) report, (2) group, or (3) class or possibly have other unspecified impact.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://puppetlabs.com/security/cve/cve-2013-4963; http://puppetlabs.com/security/cve/cve-2013-4963
CVE: CVE-2014-2047
Published: 2014-03-14
Description: Session fixation vulnerability in ownCloud before 6.0.2, when PHP is configured to accept session parameters through a GET request, allows remote attackers to hijack web sessions via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287
References: http://owncloud.org/about/security/advisories/oC-SA-2014-001/; http://owncloud.org/about/security/advisories/oC-SA-2014-001/
CVE: CVE-2014-2049
Published: 2014-03-14
Description: The default Flash Cross Domain policies in ownCloud before 5.0.15 and 6.x before 6.0.2 allows remote attackers to access user files via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://owncloud.org/about/security/advisories/oC-SA-2014-003/; http://owncloud.org/about/security/advisories/oC-SA-2014-003/
CVE: CVE-2013-0299
Published: 2014-03-14
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in ownCloud before 4.0.12 and 4.5.x before 4.5.7 allow remote attackers to hijack the authentication of users for requests that (1) change the timezone for the user via the lat and lng parameters to apps/calendar/ajax/settings/guesstimezone.php, (2) disable or enable the automatic timezone detection via the timezonedetection parameter to apps/calendar/ajax/settings/timezonedetection.php, (3) import user accounts via the admin_export parameter to apps/admin_migrate/settings.php, (4) overwrite user files via the operation parameter to apps/user_migrate/ajax/export.php, or (5) change the authentication server URL via unspecified vectors to apps/user_ldap/settings.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://owncloud.org/about/security/advisories/oC-SA-2013-004/; http://owncloud.org/about/security/advisories/oC-SA-2013-004/
CVE: CVE-2013-0300
Published: 2014-03-14
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in ownCloud 4.5.x before 4.5.7 allow remote attackers to hijack the authentication of users for requests that (1) change the default view via the v parameter to apps/calendar/ajax/changeview.php, mount arbitrary (2) Google Drive or (3) Dropbox folders via vectors related to addRootCertificate.php, dropbox.php and google.php in apps/files_external/ajax/, or (4) change the authentication server URL via unspecified vectors to apps/user_webdavauth/settings.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://owncloud.org/about/security/advisories/oC-SA-2013-004/; http://owncloud.org/about/security/advisories/oC-SA-2013-004/
CVE: CVE-2013-0301
Published: 2014-03-14
Description: Cross-site request forgery (CSRF) vulnerability in apps/calendar/ajax/settings/settimezone in ownCloud before 4.0.12 allows remote attackers to hijack the authentication of users for requests that change the timezone via the timezone parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://owncloud.org/about/security/advisories/oC-SA-2013-004/; http://owncloud.org/about/security/advisories/oC-SA-2013-004/
CVE: CVE-2013-4057
Published: 2014-03-16
Description: Cross-site request forgery (CSRF) vulnerability in the XML Pack in IBM InfoSphere Information Server 8.5.x through 8.5 FP3, 8.7.x through 8.7 FP2, and 9.1.x through 9.1.2.0 allows remote attackers to hijack the authentication of arbitrary users.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www-01.ibm.com/support/docview.wss?uid=swg1JR48815; http://www-01.ibm.com/support/docview.wss?uid=swg1JR49200; http://www-01.ibm.com/support/docview.wss?uid=swg1JR49206
CVE: CVE-2013-4058
Published: 2014-03-16
Description: Multiple SQL injection vulnerabilities in IBM InfoSphere Information Server 8.x through 8.5 FP3, 8.7.x through 8.7 FP2, and 9.1.x through 9.1.2.0 allow remote authenticated users to execute arbitrary SQL commands via unspecified interfaces.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://www-01.ibm.com/support/docview.wss?uid=swg1JR48815; http://www-01.ibm.com/support/docview.wss?uid=swg1JR49200; http://www-01.ibm.com/support/docview.wss?uid=swg1JR49206
CVE: CVE-2013-4059
Published: 2014-03-16
Description: Multiple cross-site scripting (XSS) vulnerabilities in IBM InfoSphere Information Server 8.x through 8.5 FP3, 8.7.x through 8.7 FP2, and 9.1.x through 9.1.2.0 allow remote attackers to inject arbitrary web script or HTML via unspecified interfaces.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1JR48815; http://www-01.ibm.com/support/docview.wss?uid=swg1JR49200; http://www-01.ibm.com/support/docview.wss?uid=swg1JR49206
CVE: CVE-2013-6208
Published: 2014-03-16
Description: Unspecified vulnerability in HP Smart Update Manager 5.3.5 before build 70 on Linux allows local users to gain privileges via unknown vectors.
CVSS Score: 7.2 (HIGH)
References: http://h20565.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?docId=emr_na-c04000397; http://h20565.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?docId=emr_na-c04000397
CVE: CVE-2013-6210
Published: 2014-03-16
Description: Unspecified vulnerability in HP Unified Functional Testing before 12.0 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1932.
CVSS Score: 7.5 (HIGH)
References: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04122007; https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04122007
CVE: CVE-2014-0338
Published: 2014-03-16
Description: Multiple cross-site scripting (XSS) vulnerabilities in the firewall policy management pages in WatchGuard Fireware XTM before 11.8.3 allow remote attackers to inject arbitrary web script or HTML via the pol_name parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2014/Mar/154; http://watchguardsecuritycenter.com/2014/03/13/fireware-xtm-11-8-3-update-corrects-xss-flaw/; http://www.kb.cert.org/vuls/id/807134
CVE: CVE-2014-0339
Published: 2014-03-16
Description: Cross-site scripting (XSS) vulnerability in view.cgi in Webmin before 1.680 allows remote attackers to inject arbitrary web script or HTML via the search parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2014/Mar/274; http://www-01.ibm.com/support/docview.wss?uid=swg21679713; http://www.kb.cert.org/vuls/id/381692
CVE: CVE-2014-0850
Published: 2014-03-16
Description: Cross-site scripting (XSS) vulnerability in IBM InfoSphere Master Data Management Reference Data Management (RDM) Hub 10.1 and 11.0 before 11.0.0.0-MDM-IF008 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21666119; https://exchange.xforce.ibmcloud.com/vulnerabilities/90751; http://www-01.ibm.com/support/docview.wss?uid=swg21666119
CVE: CVE-2014-0873
Published: 2014-03-16
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the (1) Data Stewardship, (2) Business Admin, and (3) Product interfaces in IBM InfoSphere Master Data Management (MDM) Server 8.5 before 8.5.0.82, 9.0.1 before 9.0.1.38, 9.0.2 before 9.0.2.35, 10.0 before 10.0.0.0.26, and 10.1 before 10.1.0.0.15 allow remote attackers to hijack the authentication of arbitrary users.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www-01.ibm.com/support/docview.wss?uid=swg21666462; https://exchange.xforce.ibmcloud.com/vulnerabilities/90994; http://www-01.ibm.com/support/docview.wss?uid=swg21666462
CVE: CVE-2014-0895
Published: 2014-03-16
Description: Buffer overflow in the vsflex8l ActiveX control in IBM SPSS SamplePower 3.0.1 before FP1 3.0.1-IM-S3SAMPC-WIN32-FP001-IF02 allows remote attackers to execute arbitrary code via a crafted ComboList property value.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PI09800; http://www-01.ibm.com/support/docview.wss?uid=swg21666790; http://www.solarwinds.com/documentation/orion/docs/releasenotes/releasenotes.htm
CVE: CVE-2014-1700
Published: 2014-03-16
Description: Use-after-free vulnerability in modules/speech/SpeechSynthesis.cpp in Blink, as used in Google Chrome before 33.0.1750.149, allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging improper handling of a certain utterance data structure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://googlechromereleases.blogspot.com/2014/03/stable-channel-update_11.html; http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00008.html; http://security.gentoo.org/glsa/glsa-201408-16.xml
CVE: CVE-2014-1701
Published: 2014-03-16
Description: The GenerateFunction function in bindings/scripts/code_generator_v8.pm in Blink, as used in Google Chrome before 33.0.1750.149, does not implement a certain cross-origin restriction for the EventTarget::dispatchEvent function, which allows remote attackers to conduct Universal XSS (UXSS) attacks via vectors involving events.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://googlechromereleases.blogspot.com/2014/03/stable-channel-update_11.html; http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00008.html; http://security.gentoo.org/glsa/glsa-201408-16.xml
CVE: CVE-2014-1702
Published: 2014-03-16
Description: Use-after-free vulnerability in the DatabaseThread::cleanupDatabaseThread function in modules/webdatabase/DatabaseThread.cpp in the web database implementation in Blink, as used in Google Chrome before 33.0.1750.149, allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging improper handling of scheduled tasks during shutdown of a thread.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://googlechromereleases.blogspot.com/2014/03/stable-channel-update_11.html; http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00008.html; http://security.gentoo.org/glsa/glsa-201408-16.xml
CVE: CVE-2014-1703
Published: 2014-03-16
Description: Use-after-free vulnerability in the WebSocketDispatcherHost::SendOrDrop function in content/browser/renderer_host/websocket_dispatcher_host.cc in the Web Sockets implementation in Google Chrome before 33.0.1750.149 might allow remote attackers to bypass the sandbox protection mechanism by leveraging an incorrect deletion in a certain failure case.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://googlechromereleases.blogspot.com/2014/03/stable-channel-update_11.html; http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00008.html; http://security.gentoo.org/glsa/glsa-201408-16.xml
CVE: CVE-2014-1704
Published: 2014-03-16
Description: Multiple unspecified vulnerabilities in Google V8 before 3.23.17.18, as used in Google Chrome before 33.0.1750.149, allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
CVSS Score: 10.0 (HIGH)
References: http://googlechromereleases.blogspot.com/2014/03/stable-channel-update_11.html; http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00008.html; http://security.gentoo.org/glsa/glsa-201408-16.xml
CVE: CVE-2014-1705
Published: 2014-03-16
Description: Google V8, as used in Google Chrome before 33.0.1750.152 on OS X and Linux and before 33.0.1750.154 on Windows, allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: http://googlechromereleases.blogspot.com/2014/03/stable-channel-update-for-chrome-os_14.html; http://googlechromereleases.blogspot.com/2014/03/stable-channel-update_14.html; http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00008.html
CVE: CVE-2014-1706
Published: 2014-03-16
Description: crosh in Google Chrome OS before 33.0.1750.152 allows attackers to inject commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
References: http://googlechromereleases.blogspot.com/2014/03/stable-channel-update-for-chrome-os_14.html; https://code.google.com/p/chromium/issues/detail?id=351796; http://googlechromereleases.blogspot.com/2014/03/stable-channel-update-for-chrome-os_14.html
CVE: CVE-2014-1707
Published: 2014-03-16
Description: Directory traversal vulnerability in CrosDisks in Google Chrome OS before 33.0.1750.152 has unspecified impact and attack vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://googlechromereleases.blogspot.com/2014/03/stable-channel-update-for-chrome-os_14.html; https://code.google.com/p/chromium/issues/detail?id=351811; http://googlechromereleases.blogspot.com/2014/03/stable-channel-update-for-chrome-os_14.html
CVE: CVE-2014-1708
Published: 2014-03-16
Description: The boot implementation in Google Chrome OS before 33.0.1750.152 does not properly consider file persistence, which allows remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 10.0 (HIGH)
References: http://googlechromereleases.blogspot.com/2014/03/stable-channel-update-for-chrome-os_14.html; https://code.google.com/p/chromium/issues/detail?id=344051; http://googlechromereleases.blogspot.com/2014/03/stable-channel-update-for-chrome-os_14.html
CVE: CVE-2014-1710
Published: 2014-03-16
Description: The AsyncPixelTransfersCompletedQuery::End function in gpu/command_buffer/service/query_manager.cc in Google Chrome, as used in Google Chrome OS before 33.0.1750.152, does not check whether a certain position is within the bounds of a shared-memory segment, which allows remote attackers to cause a denial of service (GPU command-buffer memory corruption) or possibly have unspecified other impact via unknown vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://googlechromereleases.blogspot.com/2014/03/stable-channel-update-for-chrome-os_14.html; https://code.google.com/p/chromium/issues/detail?id=351852; https://src.chromium.org/viewvc/chrome?revision=256723&view=revision
CVE: CVE-2014-1711
Published: 2014-03-16
Description: The GPU driver in the kernel in Google Chrome OS before 33.0.1750.152 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via unknown vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://googlechromereleases.blogspot.com/2014/03/stable-channel-update-for-chrome-os_14.html; https://code.google.com/p/chromium/issues/detail?id=351855; http://googlechromereleases.blogspot.com/2014/03/stable-channel-update-for-chrome-os_14.html
CVE: CVE-2014-1713
Published: 2014-03-16
Description: Use-after-free vulnerability in the AttributeSetter function in bindings/templates/attributes.cpp in the bindings in Blink, as used in Google Chrome before 33.0.1750.152 on OS X and Linux and before 33.0.1750.154 on Windows, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving the document.location value.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: http://archives.neohapsis.com/archives/bugtraq/2014-03/0144.html; http://archives.neohapsis.com/archives/bugtraq/2014-04/0009.html; http://archives.neohapsis.com/archives/bugtraq/2014-04/0135.html
CVE: CVE-2014-1714
Published: 2014-03-16
Description: The ScopedClipboardWriter::WritePickledData function in ui/base/clipboard/scoped_clipboard_writer.cc in Google Chrome before 33.0.1750.152 on OS X and Linux and before 33.0.1750.154 on Windows does not verify a certain format value, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the clipboard.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://archives.neohapsis.com/archives/bugtraq/2014-03/0143.html; http://googlechromereleases.blogspot.com/2014/03/stable-channel-update_14.html; http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00008.html
CVE: CVE-2014-1715
Published: 2014-03-16
Description: Directory traversal vulnerability in Google Chrome before 33.0.1750.152 on OS X and Linux and before 33.0.1750.154 on Windows has unspecified impact and attack vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://googlechromereleases.blogspot.com/2014/03/stable-channel-update_14.html; http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00008.html; http://security.gentoo.org/glsa/glsa-201408-16.xml
CVE: CVE-2014-2246
Published: 2014-03-16
Description: Cross-site scripting (XSS) vulnerability in the integrated web server on Siemens SIMATIC S7-1500 CPU PLC devices with firmware before 1.5.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://ics-cert.us-cert.gov/advisories/ICSA-14-073-01; http://www.securityfocus.com/bid/66201; http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-456423.pdf
CVE: CVE-2014-2247
Published: 2014-03-16
Description: The integrated web server on Siemens SIMATIC S7-1500 CPU PLC devices with firmware before 1.5.0 allows remote attackers to inject headers via unspecified vectors.
CVSS Score: 5.8 (MEDIUM)
References: http://ics-cert.us-cert.gov/advisories/ICSA-14-073-01; http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-456423.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-456423.pdf
CVE: CVE-2014-2248
Published: 2014-03-16
Description: Open redirect vulnerability in the integrated web server on Siemens SIMATIC S7-1500 CPU PLC devices with firmware before 1.5.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
References: http://ics-cert.us-cert.gov/advisories/ICSA-14-073-01; http://www.securityfocus.com/bid/66190; http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-456423.pdf
CVE: CVE-2014-2249
Published: 2014-03-16
Description: Cross-site request forgery (CSRF) vulnerability on Siemens SIMATIC S7-1500 CPU PLC devices with firmware before 1.5.0 and SIMATIC S7-1200 CPU PLC devices with firmware before 4.0 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-352
References: http://ics-cert.us-cert.gov/advisories/ICSA-14-073-01; http://ics-cert.us-cert.gov/advisories/ICSA-14-079-02; http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-456423.pdf
CVE: CVE-2014-2251
Published: 2014-03-16
Description: The random-number generator on Siemens SIMATIC S7-1500 CPU PLC devices with firmware before 1.5.0 does not have sufficient entropy, which makes it easier for remote attackers to defeat cryptographic protection mechanisms and hijack sessions via unspecified vectors.
CVSS Score: 8.3 (HIGH)
References: http://ics-cert.us-cert.gov/advisories/ICSA-14-073-01; http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-456423.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-456423.pdf
CVE: CVE-2014-2253
Published: 2014-03-16
Description: Siemens SIMATIC S7-1500 CPU PLC devices with firmware before 1.5.0 allow remote attackers to cause a denial of service (defect-mode transition) via crafted Profinet packets.
CVSS Score: 6.1 (MEDIUM)
References: http://ics-cert.us-cert.gov/advisories/ICSA-14-073-01; http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-456423.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-456423.pdf
CVE: CVE-2014-2255
Published: 2014-03-16
Description: Siemens SIMATIC S7-1500 CPU PLC devices with firmware before 1.5.0 allow remote attackers to cause a denial of service (defect-mode transition) via crafted HTTP packets.
CVSS Score: 7.8 (HIGH)
References: http://ics-cert.us-cert.gov/advisories/ICSA-14-073-01; http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-456423.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-456423.pdf
CVE: CVE-2014-2257
Published: 2014-03-16
Description: Siemens SIMATIC S7-1500 CPU PLC devices with firmware before 1.5.0 allow remote attackers to cause a denial of service (defect-mode transition) via crafted ISO-TSAP packets.
CVSS Score: 7.8 (HIGH)
References: http://ics-cert.us-cert.gov/advisories/ICSA-14-073-01; http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-456423.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-456423.pdf
CVE: CVE-2014-2259
Published: 2014-03-16
Description: Siemens SIMATIC S7-1500 CPU PLC devices with firmware before 1.5.0 allow remote attackers to cause a denial of service (defect-mode transition) via crafted HTTPS packets.
CVSS Score: 7.8 (HIGH)
References: http://ics-cert.us-cert.gov/advisories/ICSA-14-073-01; http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-456423.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-456423.pdf
CVE: CVE-2013-6438
Published: 2014-03-18
Description: The dav_xml_get_cdata function in main/util.c in the mod_dav module in the Apache HTTP Server before 2.4.8 does not properly remove whitespace characters from CDATA sections, which allows remote attackers to cause a denial of service (daemon crash) via a crafted DAV WRITE request.
CVSS Score: 5.0 (MEDIUM)
References: http://advisories.mageia.org/MGASA-2014-0135.html; http://archives.neohapsis.com/archives/bugtraq/2014-10/0101.html; http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10698
CVE: CVE-2014-0098
Published: 2014-03-18
Description: The log_cookie function in mod_log_config.c in the mod_log_config module in the Apache HTTP Server before 2.4.8 allows remote attackers to cause a denial of service (segmentation fault and daemon crash) via a crafted cookie that is not properly handled during truncation.
CVSS Score: 5.0 (MEDIUM)
References: http://advisories.mageia.org/MGASA-2014-0135.html; http://archives.neohapsis.com/archives/bugtraq/2014-10/0101.html; http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10698