deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-2611
Published: 2014-06-19
Description: Directory traversal vulnerability in the fndwar web application in HP Executive Scorecard 9.40 and 9.41 allows remote authenticated users to execute arbitrary code, or obtain sensitive information or delete data, via unspecified vectors, aka ZDI-CAN-2120.
CVSS Score: 9.0 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/59363; http://www.securityfocus.com/bid/68093; http://www.securitytracker.com/id/1030439
CVE: CVE-2014-2782
Published: 2014-06-19
Description: Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1773, CVE-2014-1783, CVE-2014-1784, CVE-2014-1786, CVE-2014-1795, CVE-2014-1805, CVE-2014-2758, CVE-2014-2759, CVE-2014-2765, CVE-2014-2766, and CVE-2014-2775.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/68101; http://www.securitytracker.com/id/1030370; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-035
CVE: CVE-2014-2962
Published: 2014-06-19
Description: Absolute path traversal vulnerability in the webproc cgi module on the Belkin N150 F9K1009 v1 router with firmware before 1.00.08 allows remote attackers to read arbitrary files via a full pathname in the getpage parameter.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: http://www.belkin.com/us/support-article?articleNum=109400; http://www.kb.cert.org/vuls/id/774788; https://www.exploit-db.com/exploits/38488/
CVE: CVE-2014-4329
Published: 2014-06-19
Description: Cross-site scripting (XSS) vulnerability in lua/host_details.lua in ntopng 1.1 allows remote attackers to inject arbitrary web script or HTML via the host parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/127329/Ntop-NG-1.1-Cross-Site-Scripting.html; http://www.ntop.org/ndpi/released-ndpi-1-5-1-and-ntopng-1-2-1/; http://www.securityfocus.com/bid/66456
CVE: CVE-2011-4367
Published: 2014-06-19
Description: Multiple directory traversal vulnerabilities in MyFaces JavaServer Faces (JSF) in Apache MyFaces Core 2.0.x before 2.0.12 and 2.1.x before 2.1.6 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) ln parameter to faces/javax.faces.resource/web.xml or (2) the PATH_INFO to faces/javax.faces.resource/.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://mail-archives.apache.org/mod_mbox/myfaces-announce/201202.mbox/%3C4F33ED1F.4070007%40apache.org%3E; http://osvdb.org/show/osvdb/79002; http://seclists.org/fulldisclosure/2012/Feb/150
CVE: CVE-2012-1621
Published: 2014-06-19
Description: Multiple cross-site scripting (XSS) vulnerabilities in Apache Open For Business Project (aka OFBiz) 10.04.x before 10.04.02 allow remote attackers to inject arbitrary web script or HTML via (1) a parameter array in freemarker templates, the (2) contentId or (3) mapKey parameter in a cms event request, which are not properly handled in an error message, or unspecified input in (4) an ajax request to the getServerError function in checkoutProcess.js or (5) a Webslinger component request.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://mail-archives.apache.org/mod_mbox/ofbiz-dev/201204.mbox/%3CA126EDA0-06A5-4B67-8CDD-FC5F5AABA147%40apache.org%3E; http://mail-archives.apache.org/mod_mbox/www-announce/201204.mbox/%3C2B984C00-EC65-4455-98D3-55735ABE8AF9%40apache.org%3E; http://ofbiz.apache.org/download.html#vulnerabilities
CVE: CVE-2012-2569
Published: 2014-06-19
Description: Cross-site scripting (XSS) vulnerability in Synametrics Technologies Xeams 4.4 Build 5720 allows remote attackers to inject arbitrary web script or HTML via the body of an email.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/84591; http://secunia.com/advisories/50190; http://www.exploit-db.com/exploits/20367
CVE: CVE-2012-2572
Published: 2014-06-19
Description: Cross-site scripting (XSS) vulnerability in the ThreeWP Email Reflector plugin before 1.16 for WordPress allows remote attackers to inject arbitrary web script or HTML via the Subject of an email.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/show/osvdb/85134; http://wordpress.org/plugins/threewp-email-reflector/changelog; http://www.exploit-db.com/exploits/20365
CVE: CVE-2014-3778
Published: 2014-06-19
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in goform/RgDdns in ARRIS (formerly Motorola) SBG901 SURFboard Wireless Cable Modem allow remote attackers to hijack the authentication of administrators for requests that (1) change the dns service via the DdnsService parameter, (2) change the username via the DdnsUserName parameter, (3) change the password via the DdnsPassword parameter, or (4) change the host name via the DdnsHostName parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www.exploit-db.com/exploits/33792; http://www.exploit-db.com/exploits/33792
CVE: CVE-2014-3810
Published: 2014-06-19
Description: SQL injection vulnerability in administration/profiles.php in BoonEx Dolphin 7.1.4 and earlier allows remote authenticated administrators to execute arbitrary SQL commands via the members[] parameter.  NOTE: this can be exploited by remote attackers by leveraging CVE-2014-4333.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://packetstormsecurity.com/files/127148/Dolphin-7.1.4-SQL-Injection.html; http://www.boonex.com/forums/topic/Medium-Risk-Security-Vulnerability-in-Dolphin-7-1.htm; http://www.securityfocus.com/archive/1/532468/100/0/threaded
CVE: CVE-2014-4155
Published: 2014-06-19
Description: Cross-site request forgery (CSRF) vulnerability in the ZTE ZXV10 W300 router with firmware W300V1.0.0a_ZRD_LK allows remote attackers to hijack the authentication of administrators for requests that change the admin password via a request to Forms/tools_admin_1.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.com/files/127129/ZTE-WXV10-W300-Disclosure-CSRF-Default.html; http://www.exploit-db.com/exploits/33803; https://osandamalith.wordpress.com/2014/06/15/zte-wxv10-w300-multiple-vulnerabilities
CVE: CVE-2014-4333
Published: 2014-06-19
Description: Cross-site request forgery (CSRF) vulnerability in administration/profiles.php in Dolphin 7.1.4 and earlier allows remote attackers to hijack the authentication of administrators for requests that conduct SQL injection attacks via the members[] parameter, related to CVE-2014-3810.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www.boonex.com/forums/topic/Medium-Risk-Security-Vulnerability-in-Dolphin-7-1.htm; http://www.securityfocus.com/archive/1/532468/100/0/threaded; https://www.htbridge.com/advisory/HTB23216
CVE: CVE-2014-4334
Published: 2014-06-19
Description: Stack-based buffer overflow in Ubisoft Rayman Legends before 1.3.140380 allows remote attackers to execute arbitrary code via a long string in the "second connection" to TCP port 1001.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://packetstormsecurity.com/files/127133/Ubisoft-Rayman-Legends-1.2.103716-Buffer-Overflow.html; http://www.exploit-db.com/exploits/33804; http://www.securityfocus.com/bid/68080
CVE: CVE-2014-4335
Published: 2014-06-19
Description: Multiple cross-site scripting (XSS) vulnerabilities in BarracudaDrive 6.7.2 allow remote attackers to inject arbitrary web script or HTML via the (1) host or (2) password parameter to rtl/protected/admin/ddns/.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/127128/BarracudaDrive-6.7.2-Cross-Site-Scripting.html; http://www.securityfocus.com/bid/68079; http://packetstormsecurity.com/files/127128/BarracudaDrive-6.7.2-Cross-Site-Scripting.html
CVE: CVE-2013-1068
Published: 2014-06-19
Description: The OpenStack Nova (python-nova) package 1:2013.2.3-0 before 1:2013.2.3-0ubuntu1.2 and 1:2014.1-0 before 1:2014.1-0ubuntu1.2 and Openstack Cinder (python-cinder) package 1:2013.2.3-0 before 1:2013.2.3-0ubuntu1.1 and 1:2014.1-0 before 1:2014.1-0ubuntu1.1 for Ubuntu 13.10 and 14.04 LTS does not properly set the sudo configuration, which makes it easier for attackers to gain privileges by leveraging another vulnerability.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://ubuntu.com/usn/usn-2248-1; http://www.ubuntu.com/usn/USN-2247-1; http://ubuntu.com/usn/usn-2248-1
CVE: CVE-2012-2052
Published: 2014-06-19
Description: Stack-based buffer overflow in the U3D.8BI library plugin in Adobe Photoshop CS5 12.x before 12.0.5 and CS5.1 12.1.x before 12.1.1 allows remote attackers to execute arbitrary code via a long Collada asset element in a DAE file, as demonstrated by the cameraYFov value in the contributor comments element.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/show/osvdb/81832; http://retrogod.altervista.org/9sg_photoshock_adv.htm; http://retrogod.altervista.org/9sg_photoshock_u3d.htm
CVE: CVE-2011-4821
Published: 2014-06-20
Description: Directory traversal vulnerability in the TFTP server in D-Link DIR-601 Wireless N150 Home Router with firmware 1.02NA allows remote attackers to read arbitrary files via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/47762; http://www.securityfocus.com/archive/1/521369; http://www.securityfocus.com/bid/51659
CVE: CVE-2012-0273
Published: 2014-06-20
Description: Multiple stack-based buffer overflows in MinaliC 2.0.0 allow remote attackers to execute arbitrary code via a (1) session_id cookie in a request to the get_cookie_value function in response.c, (2) directory name in a request to the add_default_file function in response.c, or (3) file name in a request to the retrieve_physical_file_name_or_brows function in response.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/45462; http://secunia.com/secunia_research/2012-5; http://www.securityfocus.com/bid/52873
CVE: CVE-2012-2579
Published: 2014-06-20
Description: Multiple cross-site scripting (XSS) vulnerabilities in the WP SimpleMail plugin 1.0.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) To, (2) From, (3) Date, or (4) Subject field of an email.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/84534; http://secunia.com/advisories/50208; http://www.exploit-db.com/exploits/20361
CVE: CVE-2012-2580
Published: 2014-06-20
Description: Cross-site scripting (XSS) vulnerability in the Postie plugin 1.4.3, and possibly before 1.5.15, for WordPress allows remote attackers to inject arbitrary web script or HTML via the From field of an email.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/84532; http://secunia.com/advisories/50207; http://www.exploit-db.com/exploits/20360
CVE: CVE-2012-2591
Published: 2014-06-20
Description: Multiple cross-site scripting (XSS) vulnerabilities in EmailArchitect Email Server 10.0 and 10.0.0.3 allow remote attackers to inject arbitrary web script or HTML via the (1) From or (2) Date field in an email.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/84520; http://packetstormsecurity.org/files/115354/EmailArchitect-Enterprise-Email-Server-10.0-Cross-Site-Scripting.html; http://secunia.com/advisories/50203
CVE: CVE-2014-0007
Published: 2014-06-20
Description: The Smart-Proxy in Foreman before 1.4.5 and 1.5.x before 1.5.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the path parameter to tftp/fetch_boot_file.
CVSS Score: 7.5 (HIGH)
References: http://projects.theforeman.org/issues/6086; http://rhn.redhat.com/errata/RHSA-2014-0770.html; http://projects.theforeman.org/issues/6086
CVE: CVE-2014-3496
Published: 2014-06-20
Description: cartridge_repository.rb in OpenShift Origin and Enterprise 1.2.8 through 2.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in a Source-Url ending with a (1) .tar.gz, (2) .zip, (3) .tgz, or (4) .tar file extension in a cartridge manifest file.
CVSS Score: 10.0 (HIGH)
CWE: CWE-94
References: http://rhn.redhat.com/errata/RHSA-2014-0762.html; http://rhn.redhat.com/errata/RHSA-2014-0763.html; http://rhn.redhat.com/errata/RHSA-2014-0764.html
CVE: CVE-2014-4505
Published: 2014-06-20
Description: Cross-site scripting (XSS) vulnerability in the Easy Breadcrumb module 7.x-2.x before 7.x-2.10 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/59379; http://www.securityfocus.com/bid/68106; https://www.drupal.org/node/2286121
CVE: CVE-2014-4506
Published: 2014-06-20
Description: Cross-site scripting (XSS) vulnerability in the Custom Meta module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.3 for Drupal allows remote authenticated users with the "administer custom meta settings" permission to inject arbitrary web script or HTML via the (1) attribute or (2) content value for a meta tag.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://secunia.com/advisories/59367; http://www.securityfocus.com/bid/68108; https://www.drupal.org/node/2288415
CVE: CVE-2014-4507
Published: 2014-06-20
Description: Directory traversal vulnerability in Smart-Proxy in Foreman before 1.4.5 and 1.5.x before 1.5.1 allows remote attackers to overwrite arbitrary files via a .. (dot dot) in the dst parameter to tftp/fetch_boot_file.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-22
References: http://projects.theforeman.org/issues/6086; http://projects.theforeman.org/issues/6086
CVE: CVE-2012-5106
Published: 2014-06-20
Description: Stack-based buffer overflow in FreeFloat FTP Server 1.0 allows remote authenticated users to execute arbitrary code via a long string in a PUT command.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://infosec42.blogspot.com/2012/09/freefloatftp-10-put-buffer-overflow.html; http://www.exploit-db.com/exploits/22351; http://www.osvdb.org/88358
CVE: CVE-2013-6737
Published: 2014-06-21
Description: IBM System Storage Storwize V7000 Unified 1.3.x and 1.4.x before 1.4.3.0 does not properly restrict the content of a dump file upon encountering a 1691 hardware fault, which allows remote authenticated users to obtain sensitive customer-data fragments by reading this file after it is copied.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://www.ibm.com/support/docview.wss?uid=ssg1S1004676; http://www.securityfocus.com/bid/68133; https://exchange.xforce.ibmcloud.com/vulnerabilities/89782
CVE: CVE-2014-3052
Published: 2014-06-21
Description: The reverse-proxy feature in IBM Security Access Manager (ISAM) for Web 8.0 with firmware 8.0.0.2 and 8.0.0.3 interprets the jct-nist-compliance parameter in the opposite of the intended manner, which makes it easier for remote attackers to obtain sensitive information by leveraging weak SSL encryption settings that lack NIST SP 800-131A compliance.
CVSS Score: 3.3 (LOW)
CWE: CWE-16
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IV61553; http://www-01.ibm.com/support/docview.wss?uid=swg21676705; https://exchange.xforce.ibmcloud.com/vulnerabilities/93454
CVE: CVE-2014-3053
Published: 2014-06-21
Description: The Local Management Interface (LMI) in IBM Security Access Manager (ISAM) for Mobile 8.0 with firmware 8.0.0.0 through 8.0.0.3 and IBM Security Access Manager for Web 7.0, and 8.0 with firmware 8.0.0.2 and 8.0.0.3, allows remote attackers to bypass authentication via a login action with invalid credentials.
CVSS Score: 8.0 (HIGH)
CWE: CWE-287
References: http://secunia.com/advisories/59381; http://secunia.com/advisories/59438; http://www-01.ibm.com/support/docview.wss?uid=swg1IV61557
CVE: CVE-2014-3073
Published: 2014-06-21
Description: Unspecified vulnerability in IBM Security Access Manager (ISAM) for Mobile 8.0 and IBM Security Access Manager for Web 7.0 and 8.0 allows remote attackers to execute arbitrary code via unknown vectors.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/59438; http://www-01.ibm.com/support/docview.wss?uid=swg1IV61563; http://www-01.ibm.com/support/docview.wss?uid=swg21676699
CVE: CVE-2014-3296
Published: 2014-06-21
Description: The XML programmatic interface (XML PI) in Cisco WebEx Meeting Server 1.5(.1.131) and earlier allows remote authenticated users to obtain sensitive meeting information via a crafted URL, aka Bug ID CSCum03527.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://secunia.com/advisories/59263; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3296; http://tools.cisco.com/security/center/viewAlert.x?alertId=34663
CVE: CVE-2014-3431
Published: 2014-06-21
Description: Symantec PGP Desktop 10.x, and Encryption Desktop Professional 10.3.x before 10.3.2 MP2, on OS X uses world-writable permissions for temporary files, which allows local users to bypass intended restrictions on file reading, modification, creation, and permission changes via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/59421; http://www.securityfocus.com/bid/68077; http://www.securitytracker.com/id/1030454
CVE: CVE-2014-3883
Published: 2014-06-21
Description: Usermin before 1.600 allows remote attackers to execute arbitrary operating-system commands via unspecified vectors related to a user action.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-78
References: http://jvn.jp/en/jp/JVN48805624/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2014-000057; https://www.ipa.go.jp/security/ciadr/vul/20140620-jvn.html
CVE: CVE-2014-4509
Published: 2014-06-21
Description: The MKDQUOTESAFE function in the Fan-out driver scripts in Fan-Out Platform Services in Novell Identity Manager (aka IDM) 4.0.2 allows local users to execute arbitrary commands by leveraging eDirectory POSIX attribute changes to insert shell metacharacters.
CVSS Score: 4.6 (MEDIUM)
References: http://download.novell.com/Download?buildid=5XLmBl54_Rg~; http://www.securityfocus.com/bid/68139; http://download.novell.com/Download?buildid=5XLmBl54_Rg~
CVE: CVE-2014-4336
Published: 2014-06-22
Description: The generate_local_queue function in utils/cups-browsed.c in cups-browsed in cups-filters before 1.0.53 allows remote IPP printers to execute arbitrary commands via shell metacharacters in the host name.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2707.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-77
References: http://bzr.linuxfoundation.org/loggerhead/openprinting/cups-filters/revision/7194; http://openwall.com/lists/oss-security/2014/04/25/7; http://openwall.com/lists/oss-security/2014/06/19/12
CVE: CVE-2014-4337
Published: 2014-06-22
Description: The process_browse_data function in utils/cups-browsed.c in cups-browsed in cups-filters before 1.0.53 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via crafted packet data.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://bzr.linuxfoundation.org/loggerhead/openprinting/cups-filters/revision/7194; http://openwall.com/lists/oss-security/2014/06/19/12; http://rhn.redhat.com/errata/RHSA-2014-1795.html
CVE: CVE-2014-4338
Published: 2014-06-22
Description: cups-browsed in cups-filters before 1.0.53 allows remote attackers to bypass intended access restrictions in opportunistic circumstances by leveraging a malformed cups-browsed.conf BrowseAllow directive that is interpreted as granting browse access to all IP addresses.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://openwall.com/lists/oss-security/2014/04/25/7; http://openwall.com/lists/oss-security/2014/06/19/12; http://rhn.redhat.com/errata/RHSA-2014-1795.html
CVE: CVE-2014-0203
Published: 2014-06-23
Description: The __do_follow_link function in fs/namei.c in the Linux kernel before 2.6.33 does not properly handle the last pathname component during use of certain filesystems, which allows local users to cause a denial of service (incorrect free operations and system crash) via an open system call.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=86acdca1b63e6890540fa19495cfc708beff3d8b; http://linux.oracle.com/errata/ELSA-2014-0771.html; http://linux.oracle.com/errata/ELSA-2014-3043.html
CVE: CVE-2014-1739
Published: 2014-06-23
Description: The media_device_enum_entities function in drivers/media/media-device.c in the Linux kernel before 3.14.6 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel memory by leveraging /dev/media0 read access for a MEDIA_IOC_ENUM_ENTITIES ioctl call.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=e6a623460e5fc960ac3ee9f946d3106233fd28d8; http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00006.html; http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00007.html
CVE: CVE-2014-4014
Published: 2014-06-23
Description: The capabilities implementation in the Linux kernel before 3.14.8 does not properly consider that namespaces are inapplicable to inodes, which allows local users to bypass intended chmod restrictions by first creating a user namespace, as demonstrated by setting the setgid bit on a file with group ownership of root.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-264
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=23adbe12ef7d3d4195e80800ab36b37bee28cd03; http://secunia.com/advisories/59220; http://www.exploit-db.com/exploits/33824
CVE: CVE-2014-4027
Published: 2014-06-23
Description: The rd_build_device_space function in drivers/target/target_core_rd.c in the Linux kernel before 3.14 does not properly initialize a certain data structure, which allows local users to obtain sensitive information from ramdisk_mcp memory by leveraging access to a SCSI initiator.
CVSS Score: 2.3 (LOW)
CWE: CWE-200
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=4442dc8a92b8f9ad8ee9e7f8438f4c04c03a22dc; http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00006.html; http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00007.html
CVE: CVE-2014-4157
Published: 2014-06-23
Description: arch/mips/include/asm/thread_info.h in the Linux kernel before 3.14.8 on the MIPS platform does not configure _TIF_SECCOMP checks on the fast system-call path, which allows local users to bypass intended PR_SET_SECCOMP restrictions by executing a crafted application without invoking a trace or audit subsystem.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-264
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=137f7df8cead00688524c[PII_REDACTED]5396b8a21; http://openwall.com/lists/oss-security/2014/06/16/1; http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.8
CVE: CVE-2014-4171
Published: 2014-06-23
Description: mm/shmem.c in the Linux kernel through 3.15.1 does not properly implement the interaction between range notification and hole punching, which allows local users to cause a denial of service (i_mutex hold) by using the mmap system call to access a hole, as demonstrated by interfering with intended shmem activity by blocking completion of (1) an MADV_REMOVE madvise call or (2) an FALLOC_FL_PUNCH_HOLE fallocate call.
CVSS Score: 4.7 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00006.html; http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00007.html; http://marc.info/?l=linux-mm-commits&m=[PII_REDACTED]0549&w=2
CVE: CVE-2014-4508
Published: 2014-06-23
Description: arch/x86/kernel/entry_32.S in the Linux kernel through 3.15.1 on 32-bit x86 platforms, when syscall auditing is enabled and the sep CPU feature flag is set, allows local users to cause a denial of service (OOPS and system crash) via an invalid syscall number, as demonstrated by number 1000.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-189
References: http://article.gmane.org/gmane.linux.kernel/1726110; http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00006.html; http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00007.html