deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-8902
Published: 2014-12-19
Description: Cross-site scripting (XSS) vulnerability in the Blog Portlet in IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0.0 through 7.0.0.2 CF29, 8.0.0 through 8.0.0.1 CF14, and 8.5.0 before CF04 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PI29956; http://www-01.ibm.com/support/docview.wss?uid=swg21692107; https://exchange.xforce.ibmcloud.com/vulnerabilities/99150
CVE: CVE-2014-7241
Published: 2014-12-19
Description: The TSUTAYA application 5.3 and earlier for Android allows remote attackers to execute arbitrary Java methods via a crafted HTML document.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://jvn.jp/en/jp/JVN97384696/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2014-000124; https://play.google.com/store/apps/details?id=jp.co.tsutaya.android.ranking
CVE: CVE-2014-7249
Published: 2014-12-19
Description: Buffer overflow on the Allied Telesis AR440S, AR441S, AR442S, AR745, AR750S, AR750S-DP, AT-8624POE, AT-8624T/2M, AT-8648T/2SP, AT-8748XL, AT-8848, AT-9816GB, AT-9924T, AT-9924Ts, CentreCOM AR415S, CentreCOM AR450S, CentreCOM AR550S, CentreCOM AR570S, CentreCOM 8700SL, CentreCOM 8948XL, CentreCOM 9924SP, CentreCOM 9924T/4SP, Rapier 48i, and SwitchBlade4000 with firmware before 2.9.1-21 allows remote attackers to execute arbitrary code via a crafted HTTP POST request.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://jvn.jp/en/jp/JVN22440986/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2014-000132; http://www.allied-telesis.co.jp/support/list/faq/vuls/20141111aen.html
CVE: CVE-2014-7267
Published: 2014-12-19
Description: Cross-site scripting (XSS) vulnerability in the output-page generator in the Ricksoft WBS Gantt-Chart add-on 7.8.1 and earlier for JIRA allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2014-7268.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN09289074/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2014-000151; https://www.ricksoft.jp/document/pages/viewpage.action?pageId=172425369
CVE: CVE-2014-7268
Published: 2014-12-19
Description: Cross-site scripting (XSS) vulnerability in the data-export feature in the Ricksoft WBS Gantt-Chart add-on 7.8.1 and earlier for JIRA allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2014-7267.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN76515134/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2014-000152; https://www.ricksoft.jp/document/pages/viewpage.action?pageId=172425369
CVE: CVE-2014-8272
Published: 2014-12-19
Description: The IPMI 1.5 functionality in Dell iDRAC6 modular before 3.65, iDRAC6 monolithic before 1.98, and iDRAC7 before 1.57.57 does not properly select session ID values, which makes it easier for remote attackers to execute arbitrary commands via a brute-force attack.
CVSS Score: 5.0 (MEDIUM)
References: http://www.exploit-db.com/exploits/35770; http://www.kb.cert.org/vuls/id/843044; http://www.kb.cert.org/vuls/id/BLUU-9RDQHM
CVE: CVE-2013-4440
Published: 2014-12-19
Description: Password Generator (aka Pwgen) before 2.07 generates weak non-tty passwords, which makes it easier for context-dependent attackers to guess the password via a brute-force attack.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-255
References: http://advisories.mageia.org/MGASA-2014-0535.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-December/146015.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-December/146237.html
CVE: CVE-2013-4442
Published: 2014-12-19
Description: Password Generator (aka Pwgen) before 2.07 uses weak pseudo generated numbers when /dev/urandom is unavailable, which makes it easier for context-dependent attackers to guess the numbers.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://advisories.mageia.org/MGASA-2014-0535.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-December/146015.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-December/146237.html
CVE: CVE-2014-2026
Published: 2014-12-19
Description: Cross-site scripting (XSS) vulnerability in the search functionality in United Planet Intrexx Professional before 5.2 Online Update 0905 and 6.x before 6.0 Online Update 10 allows remote attackers to inject arbitrary web script or HTML via the request parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/129590/Intrexx-Professional-6.0-5.2-Cross-Site-Scripting.html; http://www.christian-schneider.net/advisories/CVE-2014-2026.txt; http://www.securityfocus.com/archive/1/534230/100/0/threaded
CVE: CVE-2014-2716
Published: 2014-12-19
Description: Ekahau B4 staff badge tag 5.7 with firmware 1.4.52, Real-Time Location System (RTLS) Controller 6.0.5-FINAL, and Activator 3 reuses the RC4 cipher stream, which makes it easier for remote attackers to obtain plaintext messages via an XOR operation on two ciphertexts.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-310
References: http://packetstormsecurity.com/files/129585/Ekahau-Real-Time-Location-System-RC4-Cipher-Stream-Reuse-Weak-Key-Derivation.html; http://www.modzero.ch/advisories/MZ-14-01-Ekahau-RTLS.txt; http://www.securityfocus.com/archive/1/534241/100/0/threaded
CVE: CVE-2014-6395
Published: 2014-12-19
Description: Heap-based buffer overflow in the dissector_postgresql function in dissectors/ec_postgresql.c in Ettercap before 0.8.1 allows remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted password length value that is inconsistent with the actual length of the password.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/archive/1/534248/100/0/threaded; http://www.securityfocus.com/bid/71689; https://github.com/Ettercap/ettercap/commit/e3abe7d7585ecc420a7cab[PII_REDACTED]3aadad5a
CVE: CVE-2014-6396
Published: 2014-12-19
Description: The dissector_postgresql function in dissectors/ec_postgresql.c in Ettercap before 0.8.1 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted password length, which triggers a 0 character to be written to an arbitrary memory location.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/archive/1/534248/100/0/threaded; http://www.securityfocus.com/bid/71697; https://github.com/Ettercap/ettercap/commit/e3abe7d7585ecc420a7cab[PII_REDACTED]3aadad5a
CVE: CVE-2014-7208
Published: 2014-12-19
Description: GParted before 0.15.0 allows local users to execute arbitrary commands with root privileges via shell metacharacters in a crafted filesystem label.
CVSS Score: 7.2 (HIGH)
CWE: CWE-77
References: http://seclists.org/fulldisclosure/2014/Dec/77; http://www.oracle.com/technetwork/topics/security/bulletinjan2[PII_REDACTED].html; http://seclists.org/fulldisclosure/2014/Dec/77
CVE: CVE-2014-8135
Published: 2014-12-19
Description: The storageVolUpload function in storage/storage_driver.c in libvirt before 1.2.11 does not check a certain return value, which allows local users to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted offset value in a "virsh vol-upload" command.
CVSS Score: 2.1 (LOW)
References: http://libvirt.org/git/?p=libvirt.git%3Ba=commit%3Bh=87b9437f8951f9d24f9a85c6bbfff0e54df8c984; http://lists.opensuse.org/opensuse-updates/2015-01/msg00005.html; http://secunia.com/advisories/61111
CVE: CVE-2014-8136
Published: 2014-12-19
Description: The (1) qemuDomainMigratePerform and (2) qemuDomainMigrateFinish2 functions in qemu/qemu_driver.c in libvirt do not unlock the domain when an ACL check fails, which allow local users to cause a denial of service via unspecified vectors.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://advisories.mageia.org/MGASA-2015-0002.html; http://libvirt.org/git/?p=libvirt.git%3Ba=commit%3Bh=2bdcd29c713dfedd813c89f56ae98f6f3898313d; http://lists.opensuse.org/opensuse-updates/2015-01/msg00003.html
CVE: CVE-2014-8724
Published: 2014-12-19
Description: Cross-site scripting (XSS) vulnerability in the W3 Total Cache plugin before 0.9.4.1 for WordPress, when debug mode is enabled, allows remote attackers to inject arbitrary web script or HTML via the "Cache key" in the HTML-Comments, as demonstrated by the PATH_INFO to the default URI.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/129626/W3-Total-Cache-0.9.4-Cross-Site-Scripting.html; http://www.securityfocus.com/archive/1/534266/100/0/threaded; https://wordpress.org/plugins/w3-total-cache/changelog/
CVE: CVE-2014-8793
Published: 2014-12-19
Description: Cross-site scripting (XSS) vulnerability in lib/max/Admin/UI/Field/PublisherIdField.php in Revive Adserver before 3.0.6 allows remote attackers to inject arbitrary web script or HTML via the refresh_page parameter to www/admin/report-generate.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/129621/Revive-Adserver-3.0.5-Cross-Site-Scripting-Denial-Of-Service.html; http://packetstormsecurity.com/files/129622/Revive-Adserver-3.0.5-Cross-Site-Scripting.html; http://www.revive-adserver.com/security/revive-sa-2014-002/
CVE: CVE-2014-8875
Published: 2014-12-19
Description: The XML_RPC_cd function in lib/pear/XML/RPC.php in Revive Adserver before 3.0.6 allows remote attackers to cause a denial of service (CPU and memory consumption) via a crafted XML-RPC request, aka an XML Entity Expansion (XEE) attack.
CVSS Score: 5.0 (MEDIUM)
References: http://packetstormsecurity.com/files/129621/Revive-Adserver-3.0.5-Cross-Site-Scripting-Denial-Of-Service.html; http://www.revive-adserver.com/security/revive-sa-2014-002/; http://www.securityfocus.com/archive/1/534264/100/0/threaded
CVE: CVE-2014-9135
Published: 2014-12-19
Description: The PackageInstaller module in Huawei P7-L10 smartphones before V100R001C00B136 allows remote attackers to spoof the origin website and bypass the website whitelist protection mechanism via a crafted package.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-397472.htm; https://exchange.xforce.ibmcloud.com/vulnerabilities/99283; http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-397472.htm
CVE: CVE-2014-9185
Published: 2014-12-19
Description: Static code injection vulnerability in install.php in Morfy CMS 1.05 allows remote authenticated users to inject arbitrary PHP code into config.php via the site_url parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-94
References: http://packetstormsecurity.com/files/129624/Morfy-CMS-1.05-Remote-Command-Execution.html; http://seclists.org/fulldisclosure/2014/Dec/70; http://www.securityfocus.com/archive/1/534271/100/0/threaded
CVE: CVE-2014-9258
Published: 2014-12-19
Description: SQL injection vulnerability in ajax/getDropdownValue.php in GLPI before 0.85.1 allows remote authenticated users to execute arbitrary SQL commands via the condition parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://advisories.mageia.org/MGASA-2015-0017.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-January/147271.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-January/147296.html
CVE: CVE-2014-9324
Published: 2014-12-19
Description: The GenericInterface in OTRS Help Desk 3.2.x before 3.2.17, 3.3.x before 3.3.11, and 4.0.x before 4.0.3 allows remote authenticated users to access and modify arbitrary tickets via unspecified vectors.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-264
References: http://advisories.mageia.org/MGASA-2015-0031.html; http://secunia.com/advisories/59875; http://secunia.com/advisories/62188
CVE: CVE-2014-9335
Published: 2014-12-19
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the DandyID Services plugin 1.5.9 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) email_address or (2) sidebarTitle parameter in the dandyid-services.php page to wp-admin/options-general.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.com/files/129575/WordPress-DandyID-Services-ID-1.5.9-CSRF-XSS.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/99502; http://packetstormsecurity.com/files/129575/WordPress-DandyID-Services-ID-1.5.9-CSRF-XSS.html
CVE: CVE-2014-9336
Published: 2014-12-19
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the iTwitter plugin 0.04 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) itex_t_twitter_username or (2) itex_t_twitter_userpass parameter in the iTwitter.php page to wp-admin/options-general.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.com/files/129576/WordPress-iTwitter-WP-0.04-CSRF-XSS.html; http://seclists.org/fulldisclosure/2014/Dec/72; http://packetstormsecurity.com/files/129576/WordPress-iTwitter-WP-0.04-CSRF-XSS.html
CVE: CVE-2014-9337
Published: 2014-12-19
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the Mikiurl Wordpress Eklentisi plugin 2.0 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) twitter_kullanici or (2) twitter_sifre parameter in a kaydet action in the mikiurl.php page to wp-admin/options-general.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.com/files/129577/Mikiurl-WordPress-Eklentisi-2.0-CSRF-XSS.html; http://packetstormsecurity.com/files/129577/Mikiurl-WordPress-Eklentisi-2.0-CSRF-XSS.html
CVE: CVE-2014-9338
Published: 2014-12-19
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the O2Tweet plugin 0.0.4 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) o2t_username or (2) o2t_tags parameter to wp-admin/options-general.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.com/files/129578/WordPress-O2Tweet-0.0.4-CSRF-XSS.html; http://packetstormsecurity.com/files/129578/WordPress-O2Tweet-0.0.4-CSRF-XSS.html
CVE: CVE-2014-9339
Published: 2014-12-19
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the SPNbabble plugin 1.4.1 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) username or (2) password parameter in the spnbabble.php page to wp-admin/options-general.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.com/files/129580/WordPress-SPNbabble-1.4.1-CSRF-XSS.html; http://packetstormsecurity.com/files/129580/WordPress-SPNbabble-1.4.1-CSRF-XSS.html
CVE: CVE-2014-9340
Published: 2014-12-19
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the wpCommentTwit plugin 0.5 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) username or (2) password parameter in the wpCommentTwit.php page to wp-admin/options-general.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.com/files/129581/WordPress-wpCommentTwit-0.5-CSRF-XSS.html; http://packetstormsecurity.com/files/129581/WordPress-wpCommentTwit-0.5-CSRF-XSS.html
CVE: CVE-2014-9341
Published: 2014-12-19
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the yURL ReTwitt plugin 1.4 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) yurl_login or (2) yurl_anchor parameter in the yurl page to wp-admin/options-general.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.com/files/129582/WordPress-yURL-ReTwitt-WP-1.4-CSRF-XSS.html; http://packetstormsecurity.com/files/129582/WordPress-yURL-ReTwitt-WP-1.4-CSRF-XSS.html
CVE: CVE-2014-9355
Published: 2014-12-19
Description: Puppet Enterprise before 3.7.1 allows remote authenticated users to obtain licensing and certificate signing request information by leveraging access to an unspecified API endpoint.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://puppetlabs.com/security/cve/cve-2014-9355; http://secunia.com/advisories/61265; http://puppetlabs.com/security/cve/cve-2014-9355
CVE: CVE-2014-9368
Published: 2014-12-19
Description: Cross-site request forgery (CSRF) vulnerability in the twitterDash plugin 2.1 and earlier for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the username_twitterDash parameter in the twitterDash.php page to wp-admin/options-general.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.com/files/129579/WordPress-twitterDash-2.1-CSRF-XSS.html; http://packetstormsecurity.com/files/129579/WordPress-twitterDash-2.1-CSRF-XSS.html
CVE: CVE-2014-9376
Published: 2014-12-19
Description: Integer underflow in Ettercap 0.8.1 allows remote attackers to cause a denial of service (out-of-bounds write) and possibly execute arbitrary code via a small (1) size variable value in the dissector_dhcp function in dissectors/ec_dhcp.c, (2) length value to the dissector_gg function in dissectors/ec_gg.c, or (3) string length to the get_decode_len function in ec_utils.c or a request without a (4) username or (5) password to the dissector_TN3270 function in dissectors/ec_TN3270.c.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/archive/1/534248/100/0/threaded; http://www.securityfocus.com/bid/71696; https://github.com/Ettercap/ettercap/pull/602
CVE: CVE-2014-9377
Published: 2014-12-19
Description: Heap-based buffer overflow in the nbns_spoof function in plug-ins/nbns_spoof/nbns_spoof.c in Ettercap 0.8.1 allows remote attackers to cause a denial of service or possibly execute arbitrary code via a large netbios packet.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/archive/1/534248/100/0/threaded; http://www.securityfocus.com/bid/71690; https://github.com/Ettercap/ettercap/pull/603
CVE: CVE-2014-9378
Published: 2014-12-19
Description: Ettercap 0.8.1 does not validate certain return values, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted (1) name to the parse_line function in mdns_spoof/mdns_spoof.c or (2) base64 encoded password to the dissector_imap function in dissectors/ec_imap.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/archive/1/534248/100/0/threaded; http://www.securityfocus.com/bid/71695; https://github.com/Ettercap/ettercap/pull/604
CVE: CVE-2014-9379
Published: 2014-12-19
Description: The radius_get_attribute function in dissectors/ec_radius.c in Ettercap 0.8.1 performs an incorrect cast, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via unspecified vectors, which triggers a stack-based buffer overflow.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/archive/1/534248/100/0/threaded; http://www.securityfocus.com/bid/71698; https://github.com/Ettercap/ettercap/pull/607
CVE: CVE-2014-9380
Published: 2014-12-19
Description: The dissector_cvs function in dissectors/ec_cvs.c in Ettercap 0.8.1 allows remote attackers to cause a denial of service (out-of-bounds read) via a packet containing only a CVS_LOGIN signature.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://www.securityfocus.com/archive/1/534248/100/0/threaded; http://www.securityfocus.com/bid/71691; https://github.com/Ettercap/ettercap/pull/608
CVE: CVE-2014-9381
Published: 2014-12-19
Description: Integer signedness error in the dissector_cvs function in dissectors/ec_cvs.c in Ettercap 0.8.1 allows remote attackers to cause a denial of service (crash) via a crafted password, which triggers a large memory allocation.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://www.securityfocus.com/archive/1/534248/100/0/threaded; http://www.securityfocus.com/bid/71693; https://github.com/Ettercap/ettercap/pull/609
CVE: CVE-2014-9403
Published: 2014-12-19
Description: The CWebAdminMod::ChanPage function in modules/webadmin.cpp in ZNC before 1.4 allows remote authenticated users to cause a denial of service (NULL pointer dereference and crash) by adding a channel with the same name as an existing channel but without the leading # character, related to a "use-after-delete" error.
CVSS Score: 4.0 (MEDIUM)
References: http://advisories.mageia.org/MGASA-2014-0543.html; http://secunia.com/advisories/57795; http://www.mandriva.com/security/advisories?name=MDVSA-2015:013
CVE: CVE-2014-9407
Published: 2014-12-19
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in Revive Adserver before 3.0.5 allow remote attackers to hijack the authentication of administrators for requests that (1) delete data via a request to agency-delete.php, (2) tracker-delete.php, or (3) userlog-delete.php in admin/ or (4) unlink accounts via a request to admin-user-unlink.php. (5) advertiser-user-unlink.php, or (6) affiliate-user-unlink.php in admin/.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www.revive-adserver.com/security/revive-sa-2014-001/; http://www.revive-adserver.com/security/revive-sa-2014-001/
CVE: CVE-2014-9408
Published: 2014-12-19
Description: Ekahau B4 staff badge tag 5.7 with firmware 1.4.52, Real-Time Location System (RTLS) Controller 6.0.5-FINAL, and Activator 3 uses part of the MAC address as part of the RC4 setup key, which makes it easier for remote attackers to guess the key via a brute-force attack.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://packetstormsecurity.com/files/129585/Ekahau-Real-Time-Location-System-RC4-Cipher-Stream-Reuse-Weak-Key-Derivation.html; http://www.modzero.ch/advisories/MZ-14-01-Ekahau-RTLS.txt; http://www.securityfocus.com/archive/1/534241/100/0/threaded
CVE: CVE-2014-5212
Published: 2014-12-19
Description: Cross-site scripting (XSS) vulnerability in nds/search/data in iMonitor in Novell eDirectory before 8.8 SP8 Patch 4 allows remote attackers to inject arbitrary web script or HTML via the rdn parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/archive/1/534284; http://www.securitytracker.com/id/1031408; https://bugzilla.novell.com/show_bug.cgi?id=904134
CVE: CVE-2014-5213
Published: 2014-12-19
Description: nds/files/opt/novell/eDirectory/lib64/ndsimon/public/images in iMonitor in Novell eDirectory before 8.8 SP8 Patch 4 allows remote authenticated users to obtain sensitive information from process memory via a direct request.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/archive/1/534284; http://www.securitytracker.com/id/1031408; https://bugzilla.novell.com/show_bug.cgi?id=904135
CVE: CVE-2013-7401
Published: 2014-12-19
Description: The parse_request function in request.c in c-icap 0.2.x allows remote attackers to cause a denial of service (crash) via a URI without a " " or "?" character in an ICAP request, as demonstrated by use of the OPTIONS method.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://advisories.mageia.org/MGASA-2014-0530.html; http://openwall.com/lists/oss-security/2014/09/15/6; http://osvdb.org/ref/89/c-icap.txt