deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-2016
Published: 2014-03-25
Description: Multiple cross-site scripting (XSS) vulnerabilities in OXID eShop Professional and Community Edition 4.6.8 and earlier, 4.7.x before 4.7.11, and 4.8.x before 4.8.4, and Enterprise Edition 4.6.8 and earlier, 5.0.x before 5.0.11 and 5.1.x before 5.1.4 allow remote attackers to inject arbitrary web script or HTML via the searchtag parameter to the getTag function in (1) application/controllers/details.php or (2) application/controllers/tag.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/57438; http://wiki.oxidforge.org/Security_bulletins/2014-001; http://secunia.com/advisories/57438
CVE: CVE-2014-2526
Published: 2014-03-25
Description: Multiple cross-site scripting (XSS) vulnerabilities in BarracudaDrive before 6.7 allow remote attackers to inject arbitrary web script or HTML via the (1) sForumName or (2) sDescription parameter to Forum/manage/ForumManager.lsp; (3) sHint, (4) sWord, or (5) nId parameter to Forum/manage/hangman.lsp; (6) user parameter to rtl/protected/admin/wizard/setuser.lsp; (7) name or (8) email parameter to feedback.lsp; (9) lname or (10) url parameter to private/manage/PageManager.lsp; (11) cmd parameter to fs; (12) newname, (13) description, (14) firstname, (15) lastname, or (16) id parameter to rtl/protected/mail/manage/list.lsp; or (17) PATH_INFO to fs/.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://barracudadrive.com/readme.txt; http://packetstormsecurity.com/files/125766; http://secpod.org/advisories/SecPod_BarracudaDrive_Mult_XSS_Vuln.txt
CVE: CVE-2014-2538
Published: 2014-03-25
Description: Cross-site scripting (XSS) vulnerability in lib/rack/ssl.rb in the rack-ssl gem before 1.4.0 for Ruby allows remote attackers to inject arbitrary web script or HTML via a URI, which might not be properly handled by third-party adapters such as JRuby-Rack.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-updates/2014-04/msg00032.html; http://secunia.com/advisories/57466; http://www.openwall.com/lists/oss-security/2014/03/19/20
CVE: CVE-2013-5443
Published: 2014-03-25
Description: Cross-site request forgery (CSRF) vulnerability in IBM Cognos Express 9.0 before IFIX 2, 9.5 before IFIX 2, 10.1 before IFIX 2, and 10.2.1 before FP1 allows remote attackers to hijack the authentication of arbitrary users.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www-01.ibm.com/support/docview.wss?uid=swg21667626; https://exchange.xforce.ibmcloud.com/vulnerabilities/87819; http://www-01.ibm.com/support/docview.wss?uid=swg21667626
CVE: CVE-2013-5444
Published: 2014-03-25
Description: The server in IBM Cognos Express 9.0 before IFIX 2, 9.5 before IFIX 2, 10.1 before IFIX 2, and 10.2.1 before FP1 allows remote attackers to read encrypted credentials via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://www-01.ibm.com/support/docview.wss?uid=swg21667626; https://exchange.xforce.ibmcloud.com/vulnerabilities/87820; http://www-01.ibm.com/support/docview.wss?uid=swg21667626
CVE: CVE-2013-5445
Published: 2014-03-25
Description: IBM Cognos Express 9.0 before IFIX 2, 9.5 before IFIX 2, 10.1 before IFIX 2, and 10.2.1 before FP1 allows local users to obtain sensitive cleartext information by leveraging knowledge of a static decryption key.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://www-01.ibm.com/support/docview.wss?uid=swg21667626; https://exchange.xforce.ibmcloud.com/vulnerabilities/87821; http://www-01.ibm.com/support/docview.wss?uid=swg21667626
CVE: CVE-2014-0343
Published: 2014-03-25
Description: The web interface on Virtual Access GW6110A routers with software 9.00 before 9.09.27, 9.50 before 9.50.21, and 10.00 before 10.00.21 allows remote authenticated users to gain privileges via a modified JavaScript variable.
CVSS Score: 4.9 (MEDIUM)
References: http://www.kb.cert.org/vuls/id/213046; http://www.kb.cert.org/vuls/id/213046
CVE: CVE-2014-0884
Published: 2014-03-25
Description: Cross-site scripting (XSS) vulnerability in the Admin Web UI in IBM Lotus Protector for Mail Security 2.8.x before 2.8.1-22905 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21668124; https://exchange.xforce.ibmcloud.com/vulnerabilities/91170; http://www-01.ibm.com/support/docview.wss?uid=swg21668124
CVE: CVE-2014-0885
Published: 2014-03-25
Description: Cross-site request forgery (CSRF) vulnerability in the Admin Web UI in IBM Lotus Protector for Mail Security 2.8.x before 2.8.1-22905 allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www-01.ibm.com/support/docview.wss?uid=swg21668124; https://exchange.xforce.ibmcloud.com/vulnerabilities/91171; http://www-01.ibm.com/support/docview.wss?uid=swg21668124
CVE: CVE-2014-0886
Published: 2014-03-25
Description: The Admin Web UI in IBM Lotus Protector for Mail Security 2.8.x before 2.8.1-22905 allows remote authenticated users to bypass intended access restrictions and execute arbitrary commands via unspecified vectors.
CVSS Score: 7.1 (HIGH)
CWE: CWE-78
References: http://www-01.ibm.com/support/docview.wss?uid=swg21668124; https://exchange.xforce.ibmcloud.com/vulnerabilities/91172; http://www-01.ibm.com/support/docview.wss?uid=swg21668124
CVE: CVE-2014-0887
Published: 2014-03-25
Description: The Admin Web UI in IBM Lotus Protector for Mail Security 2.8.x before 2.8.1-22905 allows remote authenticated users to execute arbitrary commands with root privileges via unspecified vectors.
CVSS Score: 7.1 (HIGH)
CWE: CWE-78
References: http://www-01.ibm.com/support/docview.wss?uid=swg21668124; https://exchange.xforce.ibmcloud.com/vulnerabilities/91173; http://www-01.ibm.com/support/docview.wss?uid=swg21668124
CVE: CVE-2013-3976
Published: 2014-03-26
Description: The (1) Data Protection for Exchange component 6.1 before 6.1.3.4 and 6.3 before 6.3.1 in IBM Tivoli Storage Manager for Mail and the (2) FlashCopy Manager for Exchange component 2.2 and 3.1 before 3.1.1 in IBM Tivoli Storage FlashCopy Manager do not properly constrain mailbox contents during certain PST restore operations, which allows remote authenticated users to read the personal e-mail of other users in opportunistic circumstances by launching an e-mail client after an administrator performs a multiple-mailbox restore.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IC81223; http://www-01.ibm.com/support/docview.wss?uid=swg21644407; https://exchange.xforce.ibmcloud.com/vulnerabilities/84881
CVE: CVE-2013-3997
Published: 2014-03-26
Description: Open redirect vulnerability in the Web Application Enterprise Console in IBM InfoSphere BigInsights 1.1 and 2.x before 2.1 FP2 allows remote authenticated users to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-20
References: http://www-01.ibm.com/support/docview.wss?uid=swg21667812; http://www.securityfocus.com/bid/66360; https://exchange.xforce.ibmcloud.com/vulnerabilities/84986
CVE: CVE-2013-3998
Published: 2014-03-26
Description: CRLF injection vulnerability in the Web Application Enterprise Console in IBM InfoSphere BigInsights 1.1 and 2.x before 2.1 FP2 allows remote authenticated users to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-94
References: http://www-01.ibm.com/support/docview.wss?uid=swg21667812; https://exchange.xforce.ibmcloud.com/vulnerabilities/84987; http://www-01.ibm.com/support/docview.wss?uid=swg21667812
CVE: CVE-2014-0848
Published: 2014-03-26
Description: The (1) ssl.conf and (2) httpd.conf files in the Apache HTTP Server component in IBM Netezza Performance Portal 2.0 before 2.0.0.4 have weak SSLCipherSuite values, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via a brute-force attack.
CVSS Score: 3.5 (LOW)
CWE: CWE-310
References: http://www-01.ibm.com/support/docview.wss?uid=swg21665278; https://exchange.xforce.ibmcloud.com/vulnerabilities/90723; http://www-01.ibm.com/support/docview.wss?uid=swg21665278
CVE: CVE-2014-0904
Published: 2014-03-26
Description: The update process in IBM Security AppScan Standard 7.9 through 8.8 does not require integrity checks of downloaded files, which allows remote attackers to execute arbitrary code via a crafted file.
CVSS Score: 7.6 (HIGH)
CWE: CWE-20
References: http://www-01.ibm.com/support/docview.wss?uid=swg21666775; https://exchange.xforce.ibmcloud.com/vulnerabilities/91536; http://www-01.ibm.com/support/docview.wss?uid=swg21666775
CVE: CVE-2014-1826
Published: 2014-03-26
Description: Cross-site scripting (XSS) vulnerability in the iThoughtsHD app 4.19 for iOS on iPad devices, when the WiFi Transfer feature is used, allows remote attackers to inject arbitrary web script or HTML via a crafted map name.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://www.madirish.net/559; http://www.madirish.net/559
CVE: CVE-2014-1827
Published: 2014-03-26
Description: The iThoughtsHD app 4.19 for iOS on iPad devices, when the WiFi Transfer feature is used, allows remote attackers to upload arbitrary files by placing a %00 sequence after a dangerous extension, as demonstrated by a .html%00.txt file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://www.madirish.net/559; http://www.madirish.net/559
CVE: CVE-2014-1828
Published: 2014-03-26
Description: The iThoughts web server in the iThoughtsHD app 4.19 for iOS on iPad devices allows remote attackers to cause a denial of service (disk consumption) by uploading a large file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://www.madirish.net/559; http://www.madirish.net/559
CVE: CVE-2014-0055
Published: 2014-03-26
Description: The get_rx_bufs function in drivers/vhost/net.c in the vhost-net subsystem in the Linux kernel package before 2.6.32-431.11.2 on Red Hat Enterprise Linux (RHEL) 6 does not properly handle vhost_get_vq_desc errors, which allows guest OS users to cause a denial of service (host OS crash) via unspecified vectors.
CVSS Score: 5.5 (MEDIUM)
References: http://rhn.redhat.com/errata/RHSA-2014-0328.html; http://rhn.redhat.com/errata/RHSA-2014-0339.html; http://secunia.com/advisories/59386
CVE: CVE-2014-1300
Published: 2014-03-26
Description: Unspecified vulnerability in Apple Safari 7.0.2 on OS X allows remote attackers to execute arbitrary code with root privileges via unknown vectors, as demonstrated by Google during a Pwn4Fun competition at CanSecWest 2014.
CVSS Score: 10.0 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2014-04/0009.html; http://archives.neohapsis.com/archives/bugtraq/2014-04/0135.html; http://archives.neohapsis.com/archives/bugtraq/2014-04/0136.html
CVE: CVE-2014-1303
Published: 2014-03-26
Description: Heap-based buffer overflow in Apple Safari 7.0.2 allows remote attackers to execute arbitrary code and bypass a sandbox protection mechanism via unspecified vectors, as demonstrated by Liang Chen during a Pwn2Own competition at CanSecWest 2014.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2014-04/0009.html; http://archives.neohapsis.com/archives/bugtraq/2014-04/0135.html; http://archives.neohapsis.com/archives/bugtraq/2014-04/0136.html
CVE: CVE-2014-0506
Published: 2014-03-27
Description: Use-after-free vulnerability in Adobe Flash Player before 11.7.700.275 and 11.8.x through 13.0.x before 13.0.0.182 on Windows and OS X and before 11.2.202.350 on Linux, Adobe AIR before 13.0.0.83 on Android, Adobe AIR SDK before 13.0.0.83, and Adobe AIR SDK & Compiler before 13.0.0.83 allows remote attackers to execute arbitrary code, and possibly bypass an Internet Explorer sandbox protection mechanism, via unspecified vectors, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2014.
CVSS Score: 10.0 (HIGH)
CWE: CWE-399
References: http://helpx.adobe.com/security/products/flash-player/apsb14-09.html; http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00012.html; http://lists.opensuse.org/opensuse-updates/2014-04/msg00036.html
CVE: CVE-2014-0510
Published: 2014-03-27
Description: Heap-based buffer overflow in Adobe Flash Player 12.0.0.77 allows remote attackers to execute arbitrary code and bypass a sandbox protection mechanism via unspecified vectors, as demonstrated by Zeguang Zhao and Liang Chen during a Pwn2Own competition at CanSecWest 2014.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://helpx.adobe.com/security/products/flash-player/apsb14-14.html; http://lists.opensuse.org/opensuse-security-announce/2014-05/msg00008.html; http://rhn.redhat.com/errata/RHSA-2014-0496.html
CVE: CVE-2014-0511
Published: 2014-03-27
Description: Heap-based buffer overflow in Adobe Reader 11.0.06 allows remote attackers to execute arbitrary code via unspecified vectors, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2014.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://helpx.adobe.com/security/products/reader/apsb14-15.html; http://twitter.com/thezdi/statuses/[PII_REDACTED]80122624; http://www.pwn2own.com/2014/03/pwn2own-results-for-wednesday-day-one/
CVE: CVE-2014-0512
Published: 2014-03-27
Description: Adobe Reader 11.0.06 allows attackers to bypass a PDF sandbox protection mechanism via unspecified vectors, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2014.
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://helpx.adobe.com/security/products/reader/apsb14-15.html; http://twitter.com/thezdi/statuses/[PII_REDACTED]80122624; http://www.pwn2own.com/2014/03/pwn2own-results-for-wednesday-day-one/
CVE: CVE-2014-0623
Published: 2014-03-27
Description: Cross-site scripting (XSS) vulnerability in the Self-Service Console in EMC RSA Authentication Manager 7.1 before SP4 P32 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to a "cross frame scripting" issue.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2014-03/0146.html; http://archives.neohapsis.com/archives/bugtraq/2014-03/0146.html
CVE: CVE-2014-2653
Published: 2014-03-27
Description: The verify_host_key function in sshconnect.c in the client in OpenSSH 6.6 and earlier allows remote servers to trigger the skipping of SSHFP DNS RR checking by presenting an unacceptable HostCertificate.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://advisories.mageia.org/MGASA-2014-0166.html; http://aix.software.ibm.com/aix/efixes/security/openssh_advisory4.asc; http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134026.html
CVE: CVE-2013-0732
Published: 2014-03-27
Description: Heap-based buffer overflow in PDFCore8.dll in Nuance PDF Reader before 8.1 allows remote attackers to execute arbitrary code via crafted font table directory values in a TTF file, related to naming table entries.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/93870; http://secunia.com/advisories/51943; http://www.securityfocus.com/bid/60315
CVE: CVE-2013-2559
Published: 2014-03-27
Description: SQL injection vulnerability in Symphony CMS before 2.3.2 allows remote authenticated users to execute arbitrary SQL commands via the sort parameter to system/authors/.  NOTE: this can be leveraged using CSRF to allow remote unauthenticated attackers to execute arbitrary SQL commands.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://archives.neohapsis.com/archives/bugtraq/2013-04/0018.html; http://www.getsymphony.com/download/releases/version/2.3.2; http://www.securityfocus.com/bid/58843
CVE: CVE-2013-3481
Published: 2014-03-27
Description: Stack-based buffer overflow in Artweaver Plus and Free before 3.1.5 allows remote attackers to execute arbitrary code via a crafted JPG image file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://forum.artweaver.de/viewtopic.php?f=5&t=2247; http://forum.artweaver.de/viewtopic.php?f=5&t=2248; http://osvdb.org/93751
CVE: CVE-2013-7346
Published: 2014-03-27
Description: Cross-site request forgery (CSRF) vulnerability in Symphony CMS before 2.3.2 allows remote attackers to hijack the authentication of administrators for requests that conduct SQL injection attacks via the sort parameter to system/authors/, related to CVE-2013-2559.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://archives.neohapsis.com/archives/bugtraq/2013-04/0018.html; https://www.htbridge.com/advisory/HTB23148; http://archives.neohapsis.com/archives/bugtraq/2013-04/0018.html
CVE: CVE-2014-0089
Published: 2014-03-27
Description: Cross-site scripting (XSS) vulnerability in app/views/common/500.html.erb in Foreman 1.4.x before 1.4.2 allows remote authenticated users to inject arbitrary web script or HTML via the bookmark name when adding a bookmark.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://projects.theforeman.org/issues/4456; http://secunia.com/advisories/57575; http://theforeman.org/security.html
CVE: CVE-2014-2326
Published: 2014-03-27
Description: Cross-site scripting (XSS) vulnerability in cdef.php in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to inject arbitrary web  script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://bugs.cacti.net/view.php?id=2431; http://lists.fedoraproject.org/pipermail/package-announce/2014-April/131821.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-April/131842.html
CVE: CVE-2014-5795
Published: 2014-03-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2013-5795.  Reason: This candidate is a duplicate of CVE-2013-5795.  A typo caused the wrong ID to be used.  Notes: All CVE users should reference CVE-2013-5795 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2014-5880
Published: 2014-03-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2013-5880.  Reason: This candidate is a duplicate of CVE-2013-5880.  A typo caused the wrong ID to be used.  Notes: All CVE users should reference CVE-2013-5880 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2014-2106
Published: 2014-03-27
Description: Cisco IOS 15.3M before 15.3(3)M2 and IOS XE 3.10.xS before 3.10.2S allow remote attackers to cause a denial of service (device reload) via crafted SIP messages, aka Bug ID CSCug45898.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140326-sip; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140326-sip
CVE: CVE-2014-2107
Published: 2014-03-27
Description: Cisco IOS 12.2 and 15.0 through 15.3, when used with the Kailash FPGA before 2.6 on RSP720-3C-10GE and RSP720-3CXL-10GE devices, allows remote attackers to cause a denial of service (route switch processor outage) via crafted IP packets, aka Bug ID CSCug84789.
CVSS Score: 7.1 (HIGH)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140326-RSP72010GE; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140326-RSP72010GE
CVE: CVE-2014-2108
Published: 2014-03-27
Description: Cisco IOS 12.2 and 15.0 through 15.3 and IOS XE 3.2 through 3.7 before 3.7.5S and 3.8 through 3.10 before 3.10.1S allow remote attackers to cause a denial of service (device reload) via a malformed IKEv2 packet, aka Bug ID CSCui88426.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140326-ikev2; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140326-ikev2
CVE: CVE-2014-2109
Published: 2014-03-27
Description: The TCP Input module in Cisco IOS 12.2 through 12.4 and 15.0 through 15.4, when NAT is used, allows remote attackers to cause a denial of service (memory consumption or device reload) via crafted TCP packets, aka Bug IDs CSCuh33843 and CSCuj41494.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140326-nat; http://www.securityfocus.com/bid/66470; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140326-nat
CVE: CVE-2014-2111
Published: 2014-03-27
Description: The Application Layer Gateway (ALG) module in Cisco IOS 12.2 through 12.4 and 15.0 through 15.4, when NAT is used, allows remote attackers to cause a denial of service (device reload) via crafted DNS packets, aka Bug ID CSCue00996.
CVSS Score: 7.1 (HIGH)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140326-nat; http://www.securityfocus.com/bid/66470; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140326-nat
CVE: CVE-2014-2112
Published: 2014-03-27
Description: The SSL VPN (aka WebVPN) feature in Cisco IOS 15.1 through 15.4 allows remote attackers to cause a denial of service (memory consumption) via crafted HTTP requests, aka Bug ID CSCuf51357.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140326-ios-sslvpn; http://www.securityfocus.com/bid/66462; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140326-ios-sslvpn
CVE: CVE-2014-2113
Published: 2014-03-27
Description: Cisco IOS 15.1 through 15.3 and IOS XE 3.3 and 3.5 before 3.5.2E; 3.7 before 3.7.5S; and 3.8, 3.9, and 3.10 before 3.10.2S allow remote attackers to cause a denial of service (I/O memory consumption and device reload) via a malformed IPv6 packet, aka Bug ID CSCui59540.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140326-ipv6; http://www.securityfocus.com/bid/66467; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140326-ipv6
CVE: CVE-2014-2118
Published: 2014-03-27
Description: Multiple cross-site scripting (XSS) vulnerabilities in dashboard-related HTML documents in Cisco Prime Security Manager (aka PRSM) 9.2(.1-2) and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug ID CSCun50687.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2118; http://tools.cisco.com/security/center/viewAlert.x?alertId=33542; http://www.securityfocus.com/bid/66488
CVE: CVE-2013-0734
Published: 2014-03-28
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Mingle Forum plugin before 1.0.34 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) search_words parameter in a search action to wpf.class.php or (2) togroupusers parameter in an add_user_togroup action to fs-admin/fs-admin.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/90432; http://osvdb.org/90433; http://secunia.com/advisories/52167
CVE: CVE-2013-0807
Published: 2014-03-28
Description: Cross-site scripting (XSS) vulnerability in the NewSectionPrompt function in include/tool/editing_page.php in gpEasy CMS 3.5.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the section parameter in a new_section action to index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2013-01/0104.html; http://osvdb.org/89536; http://packetstormsecurity.com/files/119805/gpEasy-3.5.2-Cross-Site-Scripting.html
CVE: CVE-2013-2694
Published: 2014-03-28
Description: Open redirect vulnerability in invite.php in the WP Symposium plugin 13.04 for WordPress allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the u parameter.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://osvdb.org/92274; http://secunia.com/advisories/52925; http://www.securityfocus.com/bid/59045