deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2013-7282
Published: 2014-01-10
Description: The management web interface on the Nisuta NS-WIR150NE router with firmware 5.07.41 and Nisuta NS-WIR300N router with firmware 5.07.36_NIS01 allows remote attackers to bypass authentication via a "Cookie: :language=en" HTTP header.
CVSS Score: 10.0 (HIGH)
CWE: CWE-287
References: http://www.ampliasecurity.com/advisories/AMPLIA-ARA050913.txt; http://www.ampliasecurity.com/advisories/nisuta-nswir150ne-nswir300n-wireless-router-remote-management-web-interface-authentication-bypass-vulnerability.html; http://www.ampliasecurity.com/advisories/AMPLIA-ARA050913.txt
CVE: CVE-2014-1233
Published: 2014-01-10
Description: The paratrooper-pingdom gem 1.0.0 for Ruby allows local users to obtain the App-Key, username, and password values by listing the curl process.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://openwall.com/lists/oss-security/2014/01/08/1; http://www.vapid.dhs.org/advisories/paratrooper-api-key-pingdom.html; http://openwall.com/lists/oss-security/2014/01/08/1
CVE: CVE-2014-1234
Published: 2014-01-10
Description: The paratrooper-newrelic gem 1.0.1 for Ruby allows local users to obtain the X-Api-Key value by listing the curl process.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://openwall.com/lists/oss-security/2014/01/08/2; http://www.vapid.dhs.org/advisories/paratrooper-newrelic-api.html; http://openwall.com/lists/oss-security/2014/01/08/2
CVE: CVE-2013-4460
Published: 2014-01-10
Description: Cross-site scripting (XSS) vulnerability in account_sponsor_page.php in MantisBT 1.0.0 through 1.2.15 allows remote authenticated users to inject arbitrary web script or HTML via a project name.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://osvdb.org/98823; http://seclists.org/oss-sec/2013/q4/168; http://secunia.com/advisories/55305
CVE: CVE-2014-1236
Published: 2014-01-10
Description: Stack-based buffer overflow in the chkNum function in lib/cgraph/scan.l in Graphviz 2.34.0 allows remote attackers to have unspecified impact via vectors related to a "badly formed number" and a "long digit list."
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://osvdb.org/101851; http://seclists.org/oss-sec/2014/q1/46; http://seclists.org/oss-sec/2014/q1/51
CVE: CVE-2010-5291
Published: 2014-01-10
Description: Amberdms Billing System (ABS) before 1.4.1 does not properly implement blacklisting after detection of invalid login attempts, which makes it easier for remote attackers to obtain access via a brute-force approach.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-264
References: https://projects.jethrocarr.com/p/oss-amberdms-bs/source/tree/f23f1121bd137bf798c8d3f01d35fa297a285331/help/docs/RELEASE_NOTES; https://raw.github.com/jethrocarr/amberdms-bs/master/help/docs/CHANGELOG; https://projects.jethrocarr.com/p/oss-amberdms-bs/source/tree/f23f1121bd137bf798c8d3f01d35fa297a285331/help/docs/RELEASE_NOTES
CVE: CVE-2010-5292
Published: 2014-01-10
Description: Amberdms Billing System (ABS) before 1.4.1, when a multi-instance installation is configured, might allow local users to obtain sensitive information by reading the cache in between runs of the include/cron/services_usage.php cron job.
CVSS Score: 1.9 (LOW)
CWE: CWE-200
References: https://projects.jethrocarr.com/p/oss-amberdms-bs/source/tree/f23f1121bd137bf798c8d3f01d35fa297a285331/help/docs/RELEASE_NOTES; https://raw.github.com/jethrocarr/amberdms-bs/master/help/docs/CHANGELOG; https://projects.jethrocarr.com/p/oss-amberdms-bs/source/tree/f23f1121bd137bf798c8d3f01d35fa297a285331/help/docs/RELEASE_NOTES
CVE: CVE-2013-5009
Published: 2014-01-10
Description: The Management Console in Symantec Endpoint Protection (SEP) 11.x before 11.0.7.4 and 12.x before 12.1.2 RU2 and Endpoint Protection Small Business Edition 12.x before 12.1.2 RU2 does not properly perform authentication, which allows remote authenticated users to gain privileges by leveraging access to a limited-admin account.
CVSS Score: 7.4 (HIGH)
CWE: CWE-287
References: http://www.securityfocus.com/bid/64128; http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20140109_00; https://exchange.xforce.ibmcloud.com/vulnerabilities/90224
CVE: CVE-2013-5010
Published: 2014-01-10
Description: The Application/Device Control (ADC) component in the client in Symantec Endpoint Protection (SEP) 11.x before 11.0.7.4 and 12.x before 12.1.2 RU2 and Endpoint Protection Small Business Edition 12.x before 12.1.2 RU2 does not properly handle custom polices, which allows local users to bypass intended policy restrictions and access files or directories via unspecified vectors.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-264
References: http://www.securityfocus.com/bid/64129; http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20140109_00; https://exchange.xforce.ibmcloud.com/vulnerabilities/90225
CVE: CVE-2013-5011
Published: 2014-01-10
Description: Unquoted Windows search path vulnerability in the client in Symantec Endpoint Protection (SEP) 11.x before 11.0.7.4 and 12.x before 12.1.2 RU2 and Endpoint Protection Small Business Edition 12.x before 12.1.2 RU2 allows local users to gain privileges via a crafted program in the %SYSTEMDRIVE% directory.
CVSS Score: 7.2 (HIGH)
CWE: CWE-22
References: http://www.securityfocus.com/bid/64130; http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20140109_00; https://exchange.xforce.ibmcloud.com/vulnerabilities/90226
CVE: CVE-2013-7288
Published: 2014-01-10
Description: Cross-site scripting (XSS) vulnerability in the mycode_parse_video function in inc/class_parser.php in MyBB (aka MyBulletinBoard) before 1.6.12 allows remote attackers to inject arbitrary web script or HTML via vectors related to Yahoo video URLs.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://blog.mybb.com/2013/12/16/mybb-1-6-12-released-security-maintenance-release; http://osvdb.org/show/osvdb/101544; http://secunia.com/advisories/55945
CVE: CVE-2013-7289
Published: 2014-01-10
Description: Multiple cross-site scripting (XSS) vulnerabilities in register.php in Andy's PHP Knowledgebase (Aphpkb) before 0.95.8 allow remote attackers to inject arbitrary web script or HTML via the (1) first_name, (2) last_name, (3) email, or (4) username parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://aphpkb.blogspot.dk/2013/12/release-of-aphpkb-0958.html; http://osvdb.org/101466; http://secunia.com/advisories/56228
CVE: CVE-2014-0658
Published: 2014-01-10
Description: Cisco 9900 Unified IP phones allow remote attackers to cause a denial of service (unregistration) via a crafted SIP header, aka Bug ID CSCul24898.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-20
References: http://osvdb.org/101913; http://secunia.com/advisories/56384; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0658
CVE: CVE-2014-0663
Published: 2014-01-10
Description: Cross-site scripting (XSS) vulnerability in the web framework in Cisco Secure Access Control System (ACS) allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCum03625.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/101914; http://secunia.com/advisories/56382; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0663
CVE: CVE-2014-0664
Published: 2014-01-10
Description: The server in Cisco Unity Connection allows remote authenticated users to cause a denial of service (CPU consumption) via unspecified IMAP commands, aka Bug ID CSCul49976.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-399
References: http://osvdb.org/101915; http://secunia.com/advisories/56370; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0664
CVE: CVE-2014-1405
Published: 2014-01-10
Description: Multiple open redirect vulnerabilities on the Conceptronic C54APM access point with runtime code 1.26 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via (1) the submit-url parameter in a Refresh action to goform/formWlSiteSurvey or (2) the wlan-url parameter to goform/formWlanSetup.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://antoniovazquezblanco.github.io/docs/advisories/Advisory_C54APM_Multiple.pdf; http://osvdb.org/101916; http://osvdb.org/101917
CVE: CVE-2014-1406
Published: 2014-01-10
Description: CRLF injection vulnerability in goform/formWlSiteSurvey on the Conceptronic C54APM access point with runtime code 1.26 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the submit-url parameter in a Refresh action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://antoniovazquezblanco.github.io/docs/advisories/Advisory_C54APM_Multiple.pdf; http://antoniovazquezblanco.github.io/docs/advisories/Advisory_C54APM_Multiple.pdf
CVE: CVE-2014-1407
Published: 2014-01-10
Description: Multiple cross-site scripting (XSS) vulnerabilities on the Conceptronic C54APM access point with runtime code 1.26 allow remote attackers to inject arbitrary web script or HTML via (1) the submit-url parameter in a Refresh action to goform/formWlSiteSurvey or (2) the wlan-url parameter to goform/formWlanSetup.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://antoniovazquezblanco.github.io/docs/advisories/Advisory_C54APM_Multiple.pdf; http://osvdb.org/101919; http://osvdb.org/101921
CVE: CVE-2014-1408
Published: 2014-01-10
Description: The Conceptronic C54APM access point with runtime code 1.26 has a default password of admin for the admin account, which makes it easier for remote attackers to obtain access via an HTTP request, as demonstrated by stored XSS attacks.
CVSS Score: 7.8 (HIGH)
CWE: CWE-255
References: http://antoniovazquezblanco.github.io/docs/advisories/Advisory_C54APM_Multiple.pdf; http://download.conceptronic.net/manuals/C04-058_C54APM_v2.0_Quick_Guide_ML.pdf; http://antoniovazquezblanco.github.io/docs/advisories/Advisory_C54APM_Multiple.pdf
CVE: CVE-2014-0977
Published: 2014-01-10
Description: Cross-site scripting (XSS) vulnerability in the Rich Text Editor in Movable Type 5.0x, 5.1x before 5.161, 5.2.x before 5.2.9, and 6.0.x before 6.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=734304; http://movabletype.org/news/2013/11/movable_type_601_529_and_5161_released_to_close_security_vul.html; http://seclists.org/oss-sec/2014/q1/24
CVE: CVE-2014-0978
Published: 2014-01-10
Description: Stack-based buffer overflow in the yyerror function in lib/cgraph/scan.l in Graphviz 2.34.0 allows remote attackers to have unspecified impact via a long line in a dot file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://seclists.org/oss-sec/2014/q1/28; http://seclists.org/oss-sec/2014/q1/38; http://secunia.com/advisories/55666
CVE: CVE-2013-2050
Published: 2014-01-11
Description: SQL injection vulnerability in the miq_policy controller in Red Hat CloudForms 2.0 Management Engine (CFME) 5.1 and ManageIQ Enterprise Virtualization Manager 5.0 and earlier allows remote authenticated users to execute arbitrary SQL commands via the profile[] parameter in an explorer action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/124609/cfme_manageiq_evm_pass_reset.rb.txt; http://secunia.com/advisories/56181; http://www.securityfocus.com/bid/64524
CVE: CVE-2013-3713
Published: 2014-01-11
Description: The image creation configuration in aaa_base before 16.26.1 for openSUSE 13.1 KDE adds the root user to the "users" group when installing from a live image, which allows local users to obtain sensitive information and possibly have other unspecified impacts, as demonstrated by reading /etc/shadow.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-200
References: http://lists.opensuse.org/opensuse-updates/2013-12/msg00117.html; https://bugzilla.novell.com/show_bug.cgi?id=843230; http://lists.opensuse.org/opensuse-updates/2013-12/msg00117.html
CVE: CVE-2013-4517
Published: 2014-01-11
Description: Apache Santuario XML Security for Java before 1.5.6, when applying Transforms, allows remote attackers to cause a denial of service (memory consumption) via crafted Document Type Definitions (DTDs), related to signatures.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-399
References: http://osvdb.org/101169; http://packetstormsecurity.com/files/124554/Java-XML-Signature-Denial-Of-Service-Attack.html; http://rhn.redhat.com/errata/RHSA-2014-0170.html
CVE: CVE-2014-0618
Published: 2014-01-11
Description: Juniper Junos before 10.4 before 10.4R16, 11.4 before 11.4R8, 12.1R before 12.1R7, 12.1X44 before 12.1X44-D20, and 12.1X45 before 12.1X45-D10 on SRX Series service gateways, when used as a UAC enforcer and captive portal is enabled, allows remote attackers to cause a denial of service (flowd crash) via a crafted HTTP message.
CVSS Score: 7.8 (HIGH)
References: http://osvdb.org/101864; http://www.securityfocus.com/bid/64769; http://www.securitytracker.com/id/1029584
CVE: CVE-2013-5031
Published: 2014-01-12
Description: Unspecified vulnerability in Atmail before 6.6.4, and 7.x before 7.1.2, has unknown impact and attack vectors, a different vulnerability than CVE-2013-5032, CVE-2013-5033, and CVE-2013-5034.
CVSS Score: 10.0 (HIGH)
References: http://atmail.com/changelog/; http://blog.atmail.com/2013/atmail-7-1-2-security-hotfix/; http://atmail.com/changelog/
CVE: CVE-2013-5032
Published: 2014-01-12
Description: Unspecified vulnerability in Atmail before 6.6.4, and 7.x before 7.1.2, has unknown impact and attack vectors, a different vulnerability than CVE-2013-5031, CVE-2013-5033, and CVE-2013-5034.
CVSS Score: 10.0 (HIGH)
References: http://atmail.com/changelog/; http://blog.atmail.com/2013/atmail-7-1-2-security-hotfix/; http://atmail.com/changelog/
CVE: CVE-2013-5033
Published: 2014-01-12
Description: Unspecified vulnerability in Atmail before 6.6.4, and 7.x before 7.1.2, has unknown impact and attack vectors, a different vulnerability than CVE-2013-5031, CVE-2013-5032, and CVE-2013-5034.
CVSS Score: 10.0 (HIGH)
References: http://atmail.com/changelog/; http://blog.atmail.com/2013/atmail-7-1-2-security-hotfix/; http://atmail.com/changelog/
CVE: CVE-2013-5034
Published: 2014-01-12
Description: Unspecified vulnerability in Atmail before 6.6.4, and 7.x before 7.1.2, has unknown impact and attack vectors, a different vulnerability than CVE-2013-5031, CVE-2013-5032, and CVE-2013-5033.
CVSS Score: 10.0 (HIGH)
References: http://atmail.com/changelog/; http://blog.atmail.com/2013/atmail-7-1-2-security-hotfix/; http://atmail.com/changelog/
CVE: CVE-2013-6017
Published: 2014-01-12
Description: Cross-site scripting (XSS) vulnerability in Atmail Webmail Server before 7.2 allows remote attackers to inject arbitrary web script or HTML via the body of an e-mail message, as demonstrated by the SRC attribute of an IFRAME element.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://atmail.com/changelog/; http://osvdb.org/101937; http://www.kb.cert.org/vuls/id/204950
CVE: CVE-2013-6028
Published: 2014-01-12
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in Atmail Webmail Server before 7.2 allow remote attackers to hijack the authentication of administrators for requests that (1) add user accounts, (2) modify user accounts, (3) delete user accounts, or (4) stop the product's service.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://atmail.com/changelog/; http://osvdb.org/101936; http://www.kb.cert.org/vuls/id/204950
CVE: CVE-2013-6954
Published: 2014-01-12
Description: The png_do_expand_palette function in libpng before 1.6.8 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via (1) a PLTE chunk of zero bytes or (2) a NULL palette, related to pngrtran.c and pngset.c.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: http://advisories.mageia.org/MGASA-2014-0075.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127947.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127952.html
CVE: CVE-2014-0659
Published: 2014-01-12
Description: The Cisco WAP4410N access point with firmware through 2.0.6.1, WRVS4400N router with firmware 1.x through 1.1.13 and 2.x through 2.0.2.1, and RVS4000 router with firmware through 2.0.3.2 allow remote attackers to read credential and configuration data, and execute arbitrary commands, via requests to the test interface on TCP port 32764, aka Bug IDs CSCum37566, CSCum43693, CSCum43700, and CSCum43685.
CVSS Score: 10.0 (HIGH)
CWE: CWE-78
References: http://secunia.com/advisories/56292; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140110-sbd; http://tools.cisco.com/security/center/viewAlert.x?alertId=32381
CVE: CVE-2014-0802
Published: 2014-01-12
Description: Directory traversal vulnerability in the aokitaka ZIP with Pass application 4.5.7 and earlier, and ZIP with Pass Pro application 6.3.8 and earlier, for Android allows attackers to overwrite or create arbitrary files via unspecified vectors.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-22
References: http://jvn.jp/en/jp/JVN88313872/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2014-000001; http://jvn.jp/en/jp/JVN88313872/index.html
CVE: CVE-2014-0803
Published: 2014-01-12
Description: Directory traversal vulnerability in the tetra filer application 2.3.1 and earlier for Android 4.0.3, tetra filer free application 2.3.1 and earlier for Android 4.0.3, tetra filer application 1.5.1 and earlier for Android before 4.0.3, and tetra filer free application 1.5.1 and earlier for Android before 4.0.3 allows attackers to overwrite or create arbitrary files via unspecified vectors.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-22
References: http://jvn.jp/en/jp/JVN51285738/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2014-000002; https://play.google.com/store/apps/details?id=jp.main.brits.android.filer.app
CVE: CVE-2014-0804
Published: 2014-01-12
Description: Directory traversal vulnerability in the CGENE Security File Manager Pro application 1.0.6 and earlier, and Security File Manager Trial application 1.0.6 and earlier, for Android allows attackers to overwrite or create arbitrary files via unspecified vectors.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-22
References: http://jvn.jp/en/jp/JVN44392991/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2014-000003; https://play.google.com/store/apps/details?id=com.cgene.android.secret.filelock.free
CVE: CVE-2014-0805
Published: 2014-01-12
Description: Directory traversal vulnerability in the NeoFiler application 5.4.3 and earlier, NeoFiler Free application 5.4.3 and earlier, and NeoFiler Lite application 2.4.2 and earlier for Android allows attackers to overwrite or create arbitrary files via unspecified vectors.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-22
References: http://jvn.jp/en/jp/JVN85716574/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2014-000004; http://www.skyarts.com/products/android/neofiler/index.html
CVE: CVE-2013-7292
Published: 2014-01-13
Description: VASCO IDENTIKEY Authentication Server (IAS) 3.4.x allows remote authenticated users to bypass Active Directory (AD) authentication by entering only a DIGIPASS one-time password, instead of the intended combination of this one-time password and a multiple-time AD password.
CVSS Score: 3.5 (LOW)
CWE: CWE-287
References: http://www.kb.cert.org/vuls/id/612076; http://www.kb.cert.org/vuls/id/612076
CVE: CVE-2010-0746
Published: 2014-01-13
Description: Directory traversal vulnerability in DeviceKit-disks in DeviceKit, as used in Fedora 11 and 12 and possibly other operating systems, allows local users to gain privileges via .. (dot dot) sequences in the label for a pluggable storage device.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-22
References: http://seclists.org/oss-sec/2010/q2/5; http://stealth.openwall.net/xSports/devshit.pl; http://xorl.wordpress.com/2010/04/06/cve-2010-0746-devicekit-local-privilege-escalation/
CVE: CVE-2013-0179
Published: 2014-01-13
Description: The process_bin_delete function in memcached.c in memcached 1.4.4 and other versions before 1.4.17, when running in verbose mode, allows remote attackers to cause a denial of service (segmentation fault) via a request to delete a key, which does not account for the lack of a null terminator in the key and triggers a buffer over-read when printing to stderr.
CVSS Score: 1.8 (LOW)
CWE: CWE-119
References: http://secunia.com/advisories/56183; http://www.openwall.com/lists/oss-security/2013/01/14/4; http://www.openwall.com/lists/oss-security/2013/01/14/6
CVE: CVE-2013-7239
Published: 2014-01-13
Description: memcached before 1.4.17 allows remote attackers to bypass authentication by sending an invalid request with SASL credentials, then sending another request with incorrect SASL credentials.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-287
References: http://seclists.org/oss-sec/2013/q4/572; http://secunia.com/advisories/56183; http://www.debian.org/security/2014/dsa-2832
CVE: CVE-2013-7290
Published: 2014-01-13
Description: The do_item_get function in items.c in memcached 1.4.4 and other versions before 1.4.17, when running in verbose mode, allows remote attackers to cause a denial of service (segmentation fault) via a request to delete a key, which does not account for the lack of a null terminator in the key and triggers a buffer over-read when printing to stderr, a different vulnerability than CVE-2013-0179.
CVSS Score: 1.8 (LOW)
CWE: CWE-119
References: http://www.securityfocus.com/bid/64988; https://code.google.com/p/memcached/issues/detail?id=306; https://code.google.com/p/memcached/wiki/ReleaseNotes1417
CVE: CVE-2013-7291
Published: 2014-01-13
Description: memcached before 1.4.17, when running in verbose mode, allows remote attackers to cause a denial of service (crash) via a request that triggers an "unbounded key print" during logging, related to an issue that was "quickly grepped out of the source tree," a different vulnerability than CVE-2013-0179 and CVE-2013-7290.
CVSS Score: 1.8 (LOW)
CWE: CWE-119
References: http://www.securityfocus.com/bid/64989; https://code.google.com/p/memcached/issues/detail?id=306; https://code.google.com/p/memcached/wiki/ReleaseNotes1417
CVE: CVE-2013-6123
Published: 2014-01-14
Description: Multiple array index errors in drivers/media/video/msm/server/msm_cam_server.c in the MSM camera driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allow attackers to gain privileges by leveraging camera device-node access, related to the (1) msm_ctrl_cmd_done, (2) msm_ioctl_server, and (3) msm_server_send_ctrl functions.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-20
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/90505; https://www.codeaurora.org/cgit/quic/la//kernel/msm/commit/?id=60e4af06161d91d5aeaa04c7d6e9f4345a6acdd4; https://www.codeaurora.org/cgit/quic/la//kernel/msm/commit/?id=7beb04ea945a7178e61d935918d3cb152996b558
CVE: CVE-2014-0591
Published: 2014-01-14
Description: The query_findclosestnsec3 function in query.c in named in ISC BIND 9.6, 9.7, and 9.8 before 9.8.6-P2 and 9.9 before 9.9.4-P2, and 9.6-ESV before 9.6-ESV-R10-P2, allows remote attackers to cause a denial of service (INSIST assertion failure and daemon exit) via a crafted DNS query to an authoritative nameserver that uses the NSEC3 signing feature.
CVSS Score: 2.6 (LOW)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2014-10/0103.html; http://linux.oracle.com/errata/ELSA-2014-1244; http://lists.fedoraproject.org/pipermail/package-announce/2014-January/126761.html
CVE: CVE-2013-6398
Published: 2014-01-15
Description: The virtual router in Apache CloudStack before 4.2.1 does not preserve the source restrictions in firewall rules after being restarted, which allows remote attackers to bypass intended restrictions via a request.
CVSS Score: 2.8 (LOW)
CWE: CWE-264
References: http://secunia.com/advisories/55960; http://secunia.com/advisories/60284; http://support.citrix.com/article/CTX140989