deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-2242
Published: 2014-03-02
Description: includes/upload/UploadBase.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 does not prevent use of invalid namespaces in SVG files, which allows remote attackers to conduct cross-site scripting (XSS) attacks via an SVG upload, as demonstrated by use of a W3C XHTML namespace in conjunction with an IFRAME element.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-February/000141.html; http://openwall.com/lists/oss-security/2014/02/28/1; http://openwall.com/lists/oss-security/2014/03/01/2
CVE: CVE-2014-2243
Published: 2014-03-02
Description: includes/User.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 terminates validation of a user token upon encountering the first incorrect character, which makes it easier for remote attackers to obtain access via a brute-force attack that relies on timing differences in responses to incorrect token guesses.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-362
References: http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-February/000141.html; http://openwall.com/lists/oss-security/2014/02/28/1; http://openwall.com/lists/oss-security/2014/03/01/2
CVE: CVE-2014-2244
Published: 2014-03-02
Description: Cross-site scripting (XSS) vulnerability in the formatHTML function in includes/api/ApiFormatBase.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 allows remote attackers to inject arbitrary web script or HTML via a crafted string located after http:// in the text parameter to api.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-February/000141.html; http://openwall.com/lists/oss-security/2014/02/28/1; http://openwall.com/lists/oss-security/2014/03/01/2
CVE: CVE-2014-0334
Published: 2014-03-02
Description: Multiple cross-site scripting (XSS) vulnerabilities in CMS Made Simple allow remote authenticated users to inject arbitrary web script or HTML via (1) the group parameter to admin/addgroup.php, (2) the htmlblob parameter to admin/addhtmlblob.php, the (3) title or (4) url parameter to admin/addbookmark.php, (5) the stylesheet_name parameter to admin/copystylesheet.php, (6) the template_name parameter to admin/copytemplate.php, the (7) title or (8) url parameter to admin/editbookmark.php, (9) the template parameter to admin/listtemplates.php, or (10) the css_name parameter to admin/listcss.php, a different issue than CVE-2014-2092.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www.kb.cert.org/vuls/id/526062; http://www.securityfocus.com/bid/65898; http://www.kb.cert.org/vuls/id/526062
CVE: CVE-2014-2033
Published: 2014-03-02
Description: The caching feature in SGOS in Blue Coat ProxySG 5.5 through 5.5.11.3, 6.1 through 6.1.6.3, 6.2 through 6.2.15.3, 6.4 through 6.4.6.1, and 6.3 and 6.5 before 6.5.4 allows remote authenticated users to bypass intended access restrictions during a time window after account deletion or modification by leveraging knowledge of previously valid credentials.
CVSS Score: 7.9 (HIGH)
CWE: CWE-264
References: http://www.kb.cert.org/vuls/id/221620; https://kb.bluecoat.com/index?page=content&id=SA77; http://www.kb.cert.org/vuls/id/221620
CVE: CVE-2014-2088
Published: 2014-03-02
Description: Unrestricted file upload vulnerability in ilias.php in ILIAS 4.4.1 allows remote authenticated users to execute arbitrary PHP code by using a .php filename in an upload_files action to the uploadFiles command, and then accessing the .php file via a direct request to a certain client_id pathname.
CVSS Score: 6.5 (MEDIUM)
References: http://packetstormsecurity.com/files/125350/ILIAS-4.4.1-Cross-Site-Scripting-Shell-Upload.html; http://packetstormsecurity.com/files/125350/ILIAS-4.4.1-Cross-Site-Scripting-Shell-Upload.html
CVE: CVE-2014-2089
Published: 2014-03-02
Description: ILIAS 4.4.1 allows remote attackers to execute arbitrary PHP code via an e-mail attachment that leads to creation of a .php file with a certain client_id pathname.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://packetstormsecurity.com/files/125350/ILIAS-4.4.1-Cross-Site-Scripting-Shell-Upload.html; http://packetstormsecurity.com/files/125350/ILIAS-4.4.1-Cross-Site-Scripting-Shell-Upload.html
CVE: CVE-2014-2090
Published: 2014-03-02
Description: Multiple cross-site scripting (XSS) vulnerabilities in ilias.php in ILIAS 4.4.1 allow remote authenticated users to inject arbitrary web script or HTML via the (1) tar, (2) tar_val, or (3) title parameter.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://packetstormsecurity.com/files/125350/ILIAS-4.4.1-Cross-Site-Scripting-Shell-Upload.html; http://packetstormsecurity.com/files/125350/ILIAS-4.4.1-Cross-Site-Scripting-Shell-Upload.html
CVE: CVE-2014-2091
Published: 2014-03-02
Description: Cross-site scripting (XSS) vulnerability in mods/_standard/forums/admin/forum_add.php in ATutor 2.1.1 allows remote authenticated administrators to inject arbitrary web script or HTML via the title parameter in an add_forum action.  NOTE: the original disclosure also reported issues that may not cross privilege boundaries.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://packetstormsecurity.com/files/125348/ATutor-2.1.1-Cross-Site-Scripting.html; http://www.securityfocus.com/bid/65744; http://packetstormsecurity.com/files/125348/ATutor-2.1.1-Cross-Site-Scripting.html
CVE: CVE-2014-2092
Published: 2014-03-02
Description: Cross-site scripting (XSS) vulnerability in lib/filemanager/ImageManager/editorFrame.php in CMS Made Simple 1.11.10 allows remote attackers to inject arbitrary web script or HTML via the action parameter, a different issue than CVE-2014-0334.  NOTE: the original disclosure also reported issues that may not cross privilege boundaries.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/125353/CMSMadeSimple-1.11.10-Cross-Site-Scripting.html; http://www.securityfocus.com/bid/65746; http://packetstormsecurity.com/files/125353/CMSMadeSimple-1.11.10-Cross-Site-Scripting.html
CVE: CVE-2014-2264
Published: 2014-03-02
Description: The OpenVPN module in Synology DiskStation Manager (DSM) 4.3-3810 update 1 has a hardcoded root password of synopass, which makes it easier for remote attackers to obtain access via a VPN session.
CVSS Score: 7.8 (HIGH)
CWE: CWE-200, CWE-255
References: http://forum.synology.com/enu/viewtopic.php?f=173&t=77644; http://www.kb.cert.org/vuls/id/534284; http://forum.synology.com/enu/viewtopic.php?f=173&t=77644
CVE: CVE-2012-6636
Published: 2014-03-03
Description: The Android API before 17 does not properly restrict the WebView.addJavascriptInterface method, which allows remote attackers to execute arbitrary methods of Java objects by using the Java Reflection API within crafted JavaScript code that is loaded into the WebView component in an application targeted to API level 16 or earlier, a related issue to CVE-2013-4710.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://50.56.33.56/blog/?p=314; http://developer.android.com/reference/android/os/Build.VERSION_CODES.html#JELLY_BEAN_MR1; http://developer.android.com/reference/android/webkit/WebView.html#addJavascriptInterface%28java.lang.Object%2C%20java.lang.String%29
CVE: CVE-2012-6637
Published: 2014-03-03
Description: Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier do not anchor the end of domain-name regular expressions, which allows remote attackers to bypass a whitelist protection mechanism via a domain name that contains an acceptable name as an initial substring.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://labs.mwrinfosecurity.com/blog/2012/04/30/building-android-javajavascript-bridges/; http://openwall.com/lists/oss-security/2014/02/07/9; http://packetstormsecurity.com/files/124954/apachecordovaphonegap-bypass.txt
CVE: CVE-2013-4710
Published: 2014-03-03
Description: Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly implement the WebView class, which allows remote attackers to execute arbitrary methods of Java objects or cause a denial of service (reboot) via a crafted web page, as demonstrated by use of the WebView.addJavascriptInterface method, a related issue to CVE-2012-6636.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://50.56.33.56/blog/?p=314; http://emobile.jp/products/sh/a01sh/systemsoftware.html; http://jvn.jp/en/jp/JVN53768697/113349/index.html
CVE: CVE-2014-1881
Published: 2014-03-03
Description: Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier allow remote attackers to bypass intended device-resource restrictions of an event-based bridge via a crafted library clone that leverages IFRAME script execution and waits a certain amount of time for an OnJsPrompt handler return value as an alternative to correct synchronization.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://openwall.com/lists/oss-security/2014/02/07/9; http://packetstormsecurity.com/files/124954/apachecordovaphonegap-bypass.txt; http://seclists.org/bugtraq/2014/Jan/96
CVE: CVE-2014-1882
Published: 2014-03-03
Description: Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier allow remote attackers to bypass intended device-resource restrictions of an event-based bridge via a crafted library clone that leverages IFRAME script execution and directly accesses bridge JavaScript objects, as demonstrated by certain cordova.require calls.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://openwall.com/lists/oss-security/2014/02/07/9; http://packetstormsecurity.com/files/124954/apachecordovaphonegap-bypass.txt; http://seclists.org/bugtraq/2014/Jan/96
CVE: CVE-2014-1883
Published: 2014-03-03
Description: Adobe PhoneGap before 2.6.0 on Android uses the shouldOverrideUrlLoading callback instead of the proper shouldInterceptRequest callback, which allows remote attackers to bypass intended device-resource restrictions via content that is accessed (1) in an IFRAME element or (2) with the XMLHttpRequest method by a crafted application.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://openwall.com/lists/oss-security/2014/02/07/9; http://packetstormsecurity.com/files/124954/apachecordovaphonegap-bypass.txt; http://seclists.org/bugtraq/2014/Jan/96
CVE: CVE-2014-1884
Published: 2014-03-03
Description: Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier on Windows Phone 7 and 8 do not properly restrict navigation events, which allows remote attackers to bypass intended device-resource restrictions via content that is accessed (1) in an IFRAME element or (2) with the XMLHttpRequest method by a crafted application.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://openwall.com/lists/oss-security/2014/02/07/9; http://packetstormsecurity.com/files/124954/apachecordovaphonegap-bypass.txt; http://seclists.org/bugtraq/2014/Jan/96
CVE: CVE-2014-1885
Published: 2014-03-03
Description: The ForzeArmate application for Android, when Adobe PhoneGap 2.9.0 or earlier is used, allows remote attackers to execute arbitrary JavaScript code, and consequently obtain write access to external-storage resources, by leveraging control over any Google syndication advertising domain.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-264
References: http://openwall.com/lists/oss-security/2014/02/07/9; http://www.cs.utexas.edu/~shmat/shmat_ndss14nofrak.pdf; http://www.internetsociety.org/ndss2014/programme#session3
CVE: CVE-2014-1886
Published: 2014-03-03
Description: The Edinburgh by Bus application for Android, when Adobe PhoneGap 2.9.0 or earlier is used, allows remote attackers to execute arbitrary JavaScript code, and consequently access external-storage resources, by leveraging control over one of a number of "obscure Eastern European dating sites."
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://openwall.com/lists/oss-security/2014/02/07/9; http://www.cs.utexas.edu/~shmat/shmat_ndss14nofrak.pdf; http://www.internetsociety.org/ndss2014/programme#session3
CVE: CVE-2014-1887
Published: 2014-03-03
Description: The DrinkedIn BarFinder application for Android, when Adobe PhoneGap 2.9.0 or earlier is used, allows remote attackers to execute arbitrary JavaScript code, and consequently obtain sensitive fine-geolocation information, by leveraging control over one of a number of adult sites, as demonstrated by (1) freelifetimecheating.com and (2) www.babesroulette.com.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://openwall.com/lists/oss-security/2014/02/07/9; http://www.cs.utexas.edu/~shmat/shmat_ndss14nofrak.pdf; http://www.internetsociety.org/ndss2014/programme#session3
CVE: CVE-2014-1939
Published: 2014-03-03
Description: java/android/webkit/BrowserFrame.java in Android before 4.4 uses the addJavascriptInterface API in conjunction with creating an object of the SearchBoxImpl class, which allows attackers to execute arbitrary Java code by leveraging access to the searchBoxJavaBridge_ interface at certain Android API levels.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://blog.chromium.org/2013/11/introducing-chromium-powered-android.html; http://openwall.com/lists/oss-security/2014/02/11/2; https://support.lenovo.com/us/en/product_security/len_6421
CVE: CVE-2011-4696
Published: 2014-03-03
Description: Directory traversal vulnerability in Eye-Fi Helper before 3.4.23 allows man-in-the-middle attackers to create arbitrary files via a .. (dot dot) in the filesignature in a GetPhotoStatus request.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: http://www.pentest.co.uk/documents/ptl-2013-01.html; http://www.securityfocus.com/bid/57163; https://exchange.xforce.ibmcloud.com/vulnerabilities/80995
CVE: CVE-2013-1409
Published: 2014-03-03
Description: Cross-site scripting (XSS) vulnerability in the CommentLuv plugin before 2.92.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the _ajax_nonce parameter to wp-admin/admin-ajax.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2013-02/0031.html; http://osvdb.org/89925; http://packetstormsecurity.com/files/120090/WordPress-CommentLuv-2.92.3-Cross-Site-Scripting.html
CVE: CVE-2013-3259
Published: 2014-03-03
Description: Stack-based buffer overflow in INMATRIX Zoom Player before 8.7 beta 11 allows remote attackers to execute arbitrary code via a large biClrUsed value in a BMP file.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://osvdb.org/94037; http://secunia.com/advisories/52698; http://www.securityfocus.com/bid/60418
CVE: CVE-2013-3260
Published: 2014-03-03
Description: Heap-based buffer overflow in INMATRIX Zoom Player before 8.7 beta 11 allows remote attackers to execute arbitrary code via a large biClrUsed value in a BMP file.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://osvdb.org/94036; http://secunia.com/advisories/52698; http://secunia.com/secunia_research/2013-05
CVE: CVE-2013-3487
Published: 2014-03-03
Description: Multiple cross-site scripting (XSS) vulnerabilities in the security log in the BulletProof Security plugin before .49 for WordPress allow remote attackers to inject arbitrary web script or HTML via unspecified HTML header fields to (1) 400.php, (2) 403.php, or (3) 403.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/95928; http://osvdb.org/95929; http://osvdb.org/95930
CVE: CVE-2013-4977
Published: 2014-03-03
Description: Buffer overflow in the RTSP Packet Handler in Hikvision DS-2CD7153-E IP camera with firmware 4.1.0 b130111 (Jan 2013), and possibly other devices, allows remote attackers to cause a denial of service (device crash and reboot) and possibly execute arbitrary code via a long string in the Range header field in an RTSP transaction.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2013-08/0046.html; http://packetstormsecurity.com/files/122718/Hikvision-IP-Cameras-Overflow-Bypass-Privilege-Escalation.html; http://www.coresecurity.com/advisories/hikvision-ip-cameras-multiple-vulnerabilities
CVE: CVE-2013-4980
Published: 2014-03-03
Description: Buffer overflow in the RTSP Packet Handler in AVTECH AVN801 DVR with firmware [PII_REDACTED] and earlier, and possibly other devices, allows remote attackers to cause a denial of service (device crash) and possibly execute arbitrary code via a long string in the URI in an RTSP SETUP request.
CVSS Score: 9.0 (HIGH)
CWE: CWE-119
References: http://osvdb.org/96692; http://seclists.org/fulldisclosure/2013/Aug/284; http://www.coresecurity.com/advisories/avtech-dvr-multiple-vulnerabilities
CVE: CVE-2013-4981
Published: 2014-03-03
Description: Buffer overflow in cgi-bin/user/Config.cgi in AVTECH AVN801 DVR with firmware [PII_REDACTED] and earlier, and possibly other devices, allows remote attackers to cause a denial of service (device crash) and possibly execute arbitrary code via a long string in the Network.SMTP.Receivers parameter.
CVSS Score: 9.0 (HIGH)
CWE: CWE-119
References: http://osvdb.org/96693; http://seclists.org/fulldisclosure/2013/Aug/284; http://www.coresecurity.com/advisories/avtech-dvr-multiple-vulnerabilities
CVE: CVE-2013-6493
Published: 2014-03-03
Description: The LiveConnect implementation in plugin/icedteanp/IcedTeaNPPlugin.cc in IcedTea-Web before 1.4.2 allows local users to read the messages between a Java applet and a web browser by pre-creating a temporary socket file with a predictable name in /tmp.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://icedtea.classpath.org/hg/icedtea-web/rev/228e3652214a; http://lists.opensuse.org/opensuse-updates/2014-02/msg00089.html; http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2014-February/026192.html
CVE: CVE-2014-1684
Published: 2014-03-03
Description: The ASF_ReadObject_file_properties function in modules/demux/asf/libasf.c in the ASF Demuxer in VideoLAN VLC Media Player before 2.1.3 allows remote attackers to cause a denial of service (divide-by-zero error and crash) via a zero minimum and maximum data packet size in an ASF file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-189
References: http://git.videolan.org/gitweb.cgi/vlc.git/?p=vlc.git%3Ba=commitdiff%3Bh=98787d[PII_REDACTED]e99d62bee0dfd8197f0cf404; http://www.elsherei.com/?p=269; https://security.gentoo.org/glsa/201603-08
CVE: CVE-2014-1840
Published: 2014-03-03
Description: Cross-site scripting (XSS) vulnerability in Upload/search.php in MyBB 1.6.12 and earlier allows remote attackers to inject arbitrary web script or HTML via the keywords parameter in a do_search action, which is not properly handled in a forced SQL error message.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osandamalith.wordpress.com/2014/02/02/mybb-1-6-12-post-xss-0day/; http://packetstormsecurity.com/files/125038/MyBB-1.6.12-POST-Cross-Site-Scripting.html; http://osandamalith.wordpress.com/2014/02/02/mybb-1-6-12-post-xss-0day/
CVE: CVE-2014-2013
Published: 2014-03-03
Description: Stack-based buffer overflow in the xps_parse_color function in xps/xps-common.c in MuPDF 1.3 and earlier allows remote attackers to execute arbitrary code via a large number of entries in the ContextColor value of the Fill attribute in a Path element.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://bugs.ghostscript.com/show_bug.cgi?id=694957; http://git.ghostscript.com/?p=mupdf.git%3Ba=commitdiff%3Bh=60dabde18d7fe12b19da8b509bdfee9cc886aafc; http://lists.opensuse.org/opensuse-updates/2014-02/msg00088.html
CVE: CVE-2014-2211
Published: 2014-03-03
Description: SQL injection vulnerability in portal/addtoapplication.php in POSH (aka Posh portal or Portaneo) 3.0 before 3.3.0 allows remote attackers to execute arbitrary SQL commands via the rssurl parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://seclists.org/oss-sec/2014/q1/444; http://sourceforge.net/p/posh/svn/3540/; http://www.securityfocus.com/bid/65817
CVE: CVE-2014-2040
Published: 2014-03-03
Description: Multiple cross-site scripting (XSS) vulnerabilities in the (1) callback_multicheck, (2) callback_radio, and (3) callback_wysiwygin functions in mfrh_class.settings-api.php in the Media File Renamer plugin 1.7.0 for WordPress allow remote authenticated users with permissions to add media or edit media to inject arbitrary web script or HTML via unspecified parameters, as demonstrated by the title of an uploaded file.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://www.securityfocus.com/archive/1/531270/100/0/threaded; http://www.securityfocus.com/bid/65715; http://www.vapid.dhs.org/advisories/wordpress/plugins/MediaFileRenamer-1.7.0/index.html
CVE: CVE-2013-6730
Published: 2014-03-04
Description: IBM WebSphere Portal 6.1.0.x through 6.1.0.6 CF27, 6.1.5.x through 6.1.5.3 CF27, 7.0.0.x before 7.0.0.2 CF27, and 8.0.0.x before 8.0.0.1 CF10, when the wcm.path.traversal.security setting is enabled, allows remote attackers to bypass intended read restrictions on an item by accessing that item within search results.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PI07185; http://www-01.ibm.com/support/docview.wss?uid=swg21665915; https://exchange.xforce.ibmcloud.com/vulnerabilities/89363
CVE: CVE-2014-0844
Published: 2014-03-04
Description: Unspecified vulnerability in IBM Rational Requirements Composer 3.x before 3.0.1.6 iFix2 and 4.x before 4.0.6, and Rational DOORS Next Generation 4.x before 4.0.6, allows remote authenticated users to read arbitrary data via unknown vectors.
CVSS Score: 3.5 (LOW)
References: http://www-01.ibm.com/support/docview.wss?uid=swg21664412; https://exchange.xforce.ibmcloud.com/vulnerabilities/90718; http://www-01.ibm.com/support/docview.wss?uid=swg21664412
CVE: CVE-2014-0845
Published: 2014-03-04
Description: Open redirect vulnerability in IBM Rational Requirements Composer 3.x before 3.0.1.6 iFix2 and 4.x before 4.0.6, and Rational DOORS Next Generation 4.x before 4.0.6, allows remote authenticated users to redirect users to arbitrary web sites and conduct phishing attacks via a crafted URL.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-20
References: http://www-01.ibm.com/support/docview.wss?uid=swg21664412; http://www.securityfocus.com/bid/65916; https://exchange.xforce.ibmcloud.com/vulnerabilities/90719
CVE: CVE-2014-0846
Published: 2014-03-04
Description: Cross-site scripting (XSS) vulnerability in IBM Rational Requirements Composer 3.x before 3.0.1.6 iFix2 and 4.x before 4.0.6, and Rational DOORS Next Generation 4.x before 4.0.6, allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21664412; http://www.securityfocus.com/bid/65917; https://exchange.xforce.ibmcloud.com/vulnerabilities/90720
CVE: CVE-2013-6663
Published: 2014-03-05
Description: Use-after-free vulnerability in the SVGImage::setContainerSize function in core/svg/graphics/SVGImage.cpp in the SVG implementation in Blink, as used in Google Chrome before 33.0.1750.146, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the resizing of a view.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://archives.neohapsis.com/archives/bugtraq/2014-09/0106.html; http://archives.neohapsis.com/archives/bugtraq/2014-09/0107.html; http://googlechromereleases.blogspot.com/2014/03/stable-channel-update.html
CVE: CVE-2013-6664
Published: 2014-03-05
Description: Use-after-free vulnerability in the FormAssociatedElement::formRemovedFromTree function in core/html/FormAssociatedElement.cpp in Blink, as used in Google Chrome before 33.0.1750.146, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving FORM elements, as demonstrated by use of the speech-recognition feature.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://googlechromereleases.blogspot.com/2014/03/stable-channel-update.html; http://www.debian.org/security/2014/dsa-2883; http://www.securityfocus.com/bid/65930