deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-7794
Published: 2014-10-21
Description: The Knights of the Void (aka me.narr8.android.serial.knights_of_the_void) application 2.1.7 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/582497; http://www.kb.cert.org/vuls/id/753217; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-7795
Published: 2014-10-21
Description: The Harpers Bazaar Art (aka com.itp.harpersart) application @7F080181 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/582497; http://www.kb.cert.org/vuls/id/859257; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-7796
Published: 2014-10-21
Description: The House365 Radio (aka com.nobexinc.wls_27853803.rc) application 3.2.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/503825; http://www.kb.cert.org/vuls/id/582497; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-7797
Published: 2014-10-21
Description: The Thai food (aka com.foods.thaifood) application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/307849; http://www.kb.cert.org/vuls/id/582497; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-7798
Published: 2014-10-21
Description: The Coca-Cola FM Brasil (aka com.enyetech.radio.coca_cola.fm_br) application 2.0.41709 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/317353; http://www.kb.cert.org/vuls/id/582497; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-7799
Published: 2014-10-21
Description: The Squishy birds (aka com.tatmob.squishybirds) application 1.0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/582497; http://www.kb.cert.org/vuls/id/671993; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-7800
Published: 2014-10-21
Description: The Daily Green (aka it.opentt.blog.dailygreen) application 2014.07 dlygrn for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/284089; http://www.kb.cert.org/vuls/id/582497; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-7802
Published: 2014-10-21
Description: The Top Roller Coasters Europe 2 (aka com.appaapps.top10tallesteuropeanrollercoasters2) application @7F050001 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/582497; http://www.kb.cert.org/vuls/id/851953; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-7803
Published: 2014-10-21
Description: The Woodward Bail (aka com.onesolutionapps.woodwardbailandroid) application 1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/582497; http://www.kb.cert.org/vuls/id/634945; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-7804
Published: 2014-10-21
Description: The Gangsta Auto Thief III (aka com.apptreestudios.gdup3) application 1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/582497; http://www.kb.cert.org/vuls/id/896129; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2012-5242
Published: 2014-10-21
Description: Directory traversal vulnerability in functions/suggest.php in Banana Dance B.2.6 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the name parameter in a get_template action.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://www.exploit-db.com/exploits/23573; https://www.htbridge.com/advisory/HTB23118; http://www.exploit-db.com/exploits/23573
CVE: CVE-2012-5243
Published: 2014-10-21
Description: functions/suggest.php in Banana Dance B.2.6 and earlier allows remote attackers to read arbitrary database information via a crafted request.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://www.exploit-db.com/exploits/23573; https://www.htbridge.com/advisory/HTB23118; http://www.exploit-db.com/exploits/23573
CVE: CVE-2012-5702
Published: 2014-10-21
Description: Multiple cross-site scripting (XSS) vulnerabilities in dotProject before 2.1.7 allow remote attackers to inject arbitrary web script or HTML via the (1) callback parameter in a color_selector action, (2) field parameter in a date_format action, or (3) company_name parameter in an addedit action to index.php.  NOTE: the date parameter vector is already covered by CVE-2008-3886.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/87627; http://secunia.com/advisories/51332; http://sourceforge.net/projects/dotproject/files/dotproject/dotProject%20Version%202.1.7/
CVE: CVE-2013-7406
Published: 2014-10-21
Description: SQL injection vulnerability in the MRBS module for Drupal allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/95452; http://www.securityfocus.com/bid/61319; https://exchange.xforce.ibmcloud.com/vulnerabilities/85818
CVE: CVE-2014-7140
Published: 2014-10-21
Description: Unspecified vulnerability in the management interface in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway 10.x before 10.1-129.11 and 10.5 before 10.5-50.10 allows remote attackers to execute arbitrary code via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://support.citrix.com/article/CTX200206; http://www.securitytracker.com/id/1031129; http://support.citrix.com/article/CTX200206
CVE: CVE-2014-8375
Published: 2014-10-21
Description: SQL injection vulnerability in GBgallery.php in the GB Gallery Slideshow plugin 1.5 for WordPress allows remote administrators to execute arbitrary SQL commands via the selected_group parameter in a gb_ajax_get_group action to wp-admin/admin-ajax.php.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://packetstormsecurity.com/files/127833/WordPress-GB-Gallery-Slideshow-1.5-SQL-Injection.html; http://www.homelab.it/index.php/2014/08/10/wordpress-gb-gallery-slideshow; http://www.securityfocus.com/bid/69181
CVE: CVE-2014-4514
Published: 2014-10-21
Description: Cross-site scripting (XSS) vulnerability in includes/api_tenpay/inc.tenpay_notify.php in the Alipay plugin 3.6.0 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via vectors related to the getDebugInfo function.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://codevigilant.com/disclosure/wp-plugin-alipay-a3-cross-site-scripting-xss; https://plugins.trac.wordpress.org/changeset/847094; http://codevigilant.com/disclosure/wp-plugin-alipay-a3-cross-site-scripting-xss
CVE: CVE-2014-4517
Published: 2014-10-21
Description: Cross-site scripting (XSS) vulnerability in getNetworkSites.php in the CBI Referral Manager plugin 1.2.1 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the searchString parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://codevigilant.com/disclosure/wp-plugin-cbi-referral-manager-a3-cross-site-scripting-xss; http://codevigilant.com/disclosure/wp-plugin-cbi-referral-manager-a3-cross-site-scripting-xss
CVE: CVE-2014-4577
Published: 2014-10-21
Description: Absolute path traversal vulnerability in reviews.php in the WP AmASIN - The Amazon Affiliate Shop plugin 0.9.6 and earlier for WordPress allows remote attackers to read arbitrary files via a full pathname in the url parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://codevigilant.com/disclosure/wp-plugin-wp-amasin-the-amazon-affiliate-shop-local-file-inclusion; http://plugins.svn.wordpress.org/wp-amasin-the-amazon-affiliate-shop/trunk/readme.txt; http://codevigilant.com/disclosure/wp-plugin-wp-amasin-the-amazon-affiliate-shop-local-file-inclusion
CVE: CVE-2014-5005
Published: 2014-10-21
Description: Directory traversal vulnerability in ZOHO ManageEngine Desktop Central (DC) before 9 build 90055 allows remote attackers to execute arbitrary code via a .. (dot dot) in the fileName parameter in an LFU action to statusUpdate.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://osvdb.org/show/osvdb/110643; http://seclists.org/fulldisclosure/2014/Aug/88; http://www.exploit-db.com/exploits/34594
CVE: CVE-2014-5006
Published: 2014-10-21
Description: Directory traversal vulnerability in ZOHO ManageEngine Desktop Central (DC) before 9 build 90055 allows remote attackers to execute arbitrary code via a .. (dot dot) in the fileName parameter to mdm/mdmLogUploader.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://osvdb.org/show/osvdb/110644; http://seclists.org/fulldisclosure/2014/Aug/88; http://www.exploit-db.com/exploits/34594
CVE: CVE-2014-7280
Published: 2014-10-21
Description: Cross-site scripting (XSS) vulnerability in the Web UI before 2.3.4 Build #85 for Tenable Nessus 5.x allows remote web servers to inject arbitrary web script or HTML via the server header.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/112728; http://packetstormsecurity.com/files/128579/Nessus-Web-UI-2.3.3-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2014/Oct/26
CVE: CVE-2014-8376
Published: 2014-10-21
Description: Cross-site scripting (XSS) vulnerability in the context administration sub-panel in the Site Banner module before 7.x-4.1 for Drupal allows remote authenticated users with the "Administer contexts" Context UI module permission to inject arbitrary web script or HTML via vectors related to context settings.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://secunia.com/advisories/60758; http://www.securityfocus.com/bid/69343; https://www.drupal.org/node/2324303
CVE: CVE-2014-8377
Published: 2014-10-21
Description: Cross-site scripting (XSS) vulnerability in Webasyst Shop-Script 5.2.2.30933 allows remote attackers to inject arbitrary web script or HTML via the phone number field in a new contact to phpecom/index.php/webasyst/contacts/.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/127946/Webasyst-Shop-Script-5.2.2.30933-Cross-Site-Scripting.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/95414; http://packetstormsecurity.com/files/127946/Webasyst-Shop-Script-5.2.2.30933-Cross-Site-Scripting.html
CVE: CVE-2014-8378
Published: 2014-10-21
Description: Cross-site scripting (XSS) vulnerability in the TableField module 7.x-2.x before 7.x-2.3 allows remote authenticated users with the "administer content types" or "administer taxonomy" permission to inject arbitrary web script or HTML via vectors related to the field help text in an entity edit form.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://secunia.com/advisories/60688; http://www.securityfocus.com/bid/69227; https://exchange.xforce.ibmcloud.com/vulnerabilities/95312
CVE: CVE-2014-8379
Published: 2014-10-21
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Marketo MA module before 7.x-1.5 for Drupal allow remote authenticated users with certain permissions to inject arbitrary web script or HTML via vectors related to field titles to the (1) Webform or (2) User sub-modules.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://secunia.com/advisories/60734; http://www.securityfocus.com/bid/69340; https://www.drupal.org/node/2324777
CVE: CVE-2014-8380
Published: 2014-10-21
Description: Cross-site scripting (XSS) vulnerability in Splunk 6.1.1 allows remote attackers to inject arbitrary web script or HTML via the HTTP Referer Header in a "404 Not Found" response.  NOTE: this vulnerability might exist because of a CVE-2010-2429 regression.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/126813/Splunk-6.1.1-Cross-Site-Scripting.html; http://www.securityfocus.com/bid/67655; https://www.exploit-db.com/exploits/40997/
CVE: CVE-2014-2531
Published: 2014-10-21
Description: SQL injection vulnerability in xhr.php in InterWorx Web Control Panel (aka InterWorx Hosting Control Panel and InterWorx-CP) before 5.0.14 build 577 allows remote authenticated users to execute arbitrary SQL commands via the i parameter in a search action to the (1) NodeWorx , (2) SiteWorx, or (3) Resellers interface, as demonstrated by the "or" key in a pgn8state object in an i object in a JSON object.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://forums.interworx.com/threads/8000-InterWorx-Version-5-0-14-Released-on-Beta-Channel%21; http://www.exploit-db.com/exploits/32516; http://www.securityfocus.com/archive/1/531601/100/0/threaded
CVE: CVE-2014-3111
Published: 2014-10-21
Description: Multiple cross-site scripting (XSS) vulnerabilities in FOG 0.27 through 0.32 allow remote authenticated users to inject arbitrary web script or HTML via the (1) Printer Model field to the Printer Management page, (2) Image Name field to the Image Management page, (3) Storage Group Name field to the Storage Management page, (4) Username field to the User Cleanup FOG Configuration page, or (5) Directory Path field to the Directory Cleaner FOG Configuration page.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://fogproject.org/forum/threads/stored-xss-vulnerability-in-fog-project-version-0-27-through-0-32.10394; http://seclists.org/fulldisclosure/2014/May/60; http://www.openwall.com/lists/oss-security/2014/04/30/2
CVE: CVE-2014-4448
Published: 2014-10-22
Description: House Arrest in Apple iOS before 8.1 relies on the hardware UID for its encryption key, which makes it easier for physically proximate attackers to obtain sensitive information from a Documents directory by obtaining this UID.
CVSS Score: 1.9 (LOW)
CWE: CWE-310
References: http://www.securityfocus.com/archive/1/533747; http://www.securityfocus.com/bid/70661; http://www.securitytracker.com/id/1031077
CVE: CVE-2014-4449
Published: 2014-10-22
Description: iCloud Data Access in Apple iOS before 8.1 does not verify X.509 certificates from TLS servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-310
References: http://secunia.com/advisories/61825; http://www.securityfocus.com/archive/1/533747; http://www.securityfocus.com/bid/70659
CVE: CVE-2014-4450
Published: 2014-10-22
Description: The QuickType feature in the Keyboards subsystem in Apple iOS before 8.1 collects typing-prediction data from fields with an off autocomplete attribute, which makes it easier for attackers to discover credentials by reading credential values within unintended DOM input elements.
CVSS Score: 1.9 (LOW)
CWE: CWE-255
References: http://www.securityfocus.com/archive/1/533747; http://www.securityfocus.com/bid/70660; http://www.securitytracker.com/id/1031077
CVE: CVE-2013-7407
Published: 2014-10-22
Description: Cross-site request forgery (CSRF) vulnerability in the MRBS module for Drupal allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: https://www.drupal.org/node/2044173; https://www.drupal.org/node/2044173
CVE: CVE-2014-3675
Published: 2014-10-22
Description: Shim allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted DHCPv6 packet.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-125
References: http://rhn.redhat.com/errata/RHSA-2014-1801.html; http://www.openwall.com/lists/oss-security/2014/10/13/4; http://www.securityfocus.com/bid/70407
CVE: CVE-2014-3676
Published: 2014-10-22
Description: Heap-based buffer overflow in Shim allows remote attackers to execute arbitrary code via a crafted IPv6 address, related to the "tftp:// DHCPv6 boot option."
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: http://rhn.redhat.com/errata/RHSA-2014-1801.html; http://www.openwall.com/lists/oss-security/2014/10/13/4; http://www.securityfocus.com/bid/70409
CVE: CVE-2014-3677
Published: 2014-10-22
Description: Unspecified vulnerability in Shim might allow attackers to execute arbitrary code via a crafted MOK list, which triggers memory corruption.
CVSS Score: 7.5 (HIGH)
References: http://rhn.redhat.com/errata/RHSA-2014-1801.html; http://www.openwall.com/lists/oss-security/2014/10/13/4; http://www.securityfocus.com/bid/70410
CVE: CVE-2014-6352
Published: 2014-10-22
Description: Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote attackers to execute arbitrary code via a crafted OLE object, as exploited in the wild in October 2014 with a crafted PowerPoint document.
CVSS Score: 7.8 (HIGH)
References: http://blogs.technet.com/b/srd/archive/2014/11/11/assessing-risk-for-the-november-2014-security-updates.aspx; http://secunia.com/advisories/61803; http://twitter.com/ohjeongwook/statuses/[PII_REDACTED]70653440
CVE: CVE-2014-6387
Published: 2014-10-22
Description: gpc_api.php in MantisBT 1.2.17 and earlier allows remote attackers to bypass authenticated via a password starting will a null byte, which triggers an unauthenticated bind.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-287
References: http://www.mantisbt.org/bugs/view.php?id=17640; http://www.openwall.com/lists/oss-security/2014/09/12/11; http://www.openwall.com/lists/oss-security/2014/09/12/14
CVE: CVE-2014-7182
Published: 2014-10-22
Description: Multiple cross-site scripting (XSS) vulnerabilities in the WP Google Maps plugin before 6.0.27 for WordPress allow remote attackers to inject arbitrary web script or HTML via the poly_id parameter in an (1) edit_poly, (2) edit_polyline, or (3) edit_marker action in the wp-google-maps-menu page to wp-admin/admin.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/128694/WordPress-WP-Google-Maps-6.0.26-Cross-Site-Scripting.html; http://www.securityfocus.com/archive/1/533699/100/0/threaded; http://www.securityfocus.com/bid/70597
CVE: CVE-2014-7183
Published: 2014-10-22
Description: Multiple cross-site scripting (XSS) vulnerabilities in the search.php in LiteCart 1.1.2.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) query parameter or (2) QUERY_STRING.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/128768/LiteCart-1.1.2.1-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2015/Nov/84; http://www.securityfocus.com/archive/1/533748/100/0/threaded
CVE: CVE-2014-7968
Published: 2014-10-22
Description: VDSM allows remote attackers to cause a denial of service (connection blocking) by keeping an SSL connection open.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://www.openwall.com/lists/oss-security/2014/10/08/16; http://www.openwall.com/lists/oss-security/2014/10/08/18; http://www.openwall.com/lists/oss-security/2014/10/08/6
CVE: CVE-2014-8088
Published: 2014-10-22
Description: The (1) Zend_Ldap class in Zend before 1.12.9 and (2) Zend\Ldap component in Zend 2.x before 2.2.8 and 2.3.x before 2.3.3 allows remote attackers to bypass authentication via a password starting with a null byte, which triggers an unauthenticated bind.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-287
References: http://lists.fedoraproject.org/pipermail/package-announce/2014-October/141070.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-October/141106.html; http://www.debian.org/security/2015/dsa-3265
CVE: CVE-2014-8325
Published: 2014-10-22
Description: The Calendar Base (cal) extension before 1.5.9 and 1.6.x before 1.6.1 for TYPO3 allows remote attackers to cause a denial of service (resource consumption) via vectors related to the PHP PCRE library.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://typo3.org/extensions/repository/view/cal; http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2014-013/; http://www.openwall.com/lists/oss-security/2014/10/17/11
CVE: CVE-2014-8381
Published: 2014-10-22
Description: Multiple cross-site scripting (XSS) vulnerabilities in Megapolis.Portal Manager allow remote attackers to inject arbitrary web script or HTML via the (1) dateFrom or (2) dateTo parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/128725/Megapolis.Portal-Manager-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2014/Oct/77; http://websecurity.com.ua/7398/
CVE: CVE-2014-8761
Published: 2014-10-22
Description: inc/template.php in DokuWiki before 2014-05-05a only checks for access to the root namespace, which allows remote attackers to access arbitrary images via a media file details ajax call.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://advisories.mageia.org/MGASA-2014-0438.html; http://secunia.com/advisories/61983; http://www.debian.org/security/2014/dsa-3059
CVE: CVE-2014-8762
Published: 2014-10-22
Description: The ajax_mediadiff function in DokuWiki before 2014-05-05a allows remote attackers to access arbitrary images via a crafted namespace in the ns parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://advisories.mageia.org/MGASA-2014-0438.html; http://secunia.com/advisories/61983; http://www.debian.org/security/2014/dsa-3059
CVE: CVE-2014-8763
Published: 2014-10-22
Description: DokuWiki before 2014-05-05b, when using Active Directory for LDAP authentication, allows remote attackers to bypass authentication via a password starting with a null (\0) character and a valid user name, which triggers an unauthenticated bind.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-287
References: http://advisories.mageia.org/MGASA-2014-0438.html; http://secunia.com/advisories/61983; http://www.debian.org/security/2014/dsa-3059
CVE: CVE-2014-8764
Published: 2014-10-22
Description: DokuWiki 2014-05-05a and earlier, when using Active Directory for LDAP authentication, allows remote attackers to bypass authentication via a user name and password starting with a null (\0) character, which triggers an anonymous bind.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-287
References: http://advisories.mageia.org/MGASA-2014-0438.html; http://secunia.com/advisories/61983; http://www.debian.org/security/2014/dsa-3059