deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2013-0250
Published: 2014-06-06
Description: The init_nss_hash function in exec/totemcrypto.c in Corosync 2.0 before 2.3 does not properly initialize the HMAC key, which allows remote attackers to cause a denial of service (crash) via a crafted packet.
CVSS Score: 5.0 (MEDIUM)
References: http://seclists.org/oss-sec/2013/q1/212; http://seclists.org/oss-sec/2013/q1/213; http://seclists.org/oss-sec/2013/q1/214
CVE: CVE-2013-2602
Published: 2014-06-06
Description: Multiple array index errors in the MyHeritage SEQueryObject ActiveX control (SearchEngineQuery.dll) 1.0.2.0 allow remote attackers to execute arbitrary code via the (1) seTokensArray, or (2) seTokensValuesArray parameter to the AddTokens method; (3) seLastNameTokensArray parameter to the AddLastNameTokens method; (4) seFrameIdArray, (5) seSourceIdArray, (6) seHasBreakdownArray, (7) seIsIndexedArray, (8) seAllConcatArray, (9) seRefererURLArray, or (10) seMandatoryFieldsArray parameter to the AddMultipleSearches method; (11) seSourceIdArray, (12) seIsIndexedArray, (13) seAllConcatArray, (14) seRefererURLArray, (15) seQATestsArray, (16) seAllSourceIDsArray, (17) seAllSourceTitlesArray, (18) seMandatoryFieldsArray, or (19) seAllSourceRootURLArray parameter to the TestYourself method.
CVSS Score: 9.3 (HIGH)
References: http://osvdb.org/93498; http://osvdb.org/93499; http://osvdb.org/93500
CVE: CVE-2013-4724
Published: 2014-06-06
Description: DDSN Interactive cm3 Acora CMS 6.0.6/1a, 6.0.2/1a, 5.5.7/12b, 5.5.0/1b-p1, and possibly other versions, does not include the HTTPOnly flag in a Set-Cookie header for an unspecified cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://osvdb.org/96664; http://www.digitalsec.net/stuff/explt+advs/CM3.AcoraCMS.v6.txt; http://osvdb.org/96664
CVE: CVE-2013-4725
Published: 2014-06-06
Description: DDSN Interactive cm3 Acora CMS 6.0.6/1a, 6.0.2/1a, 5.5.7/12b, 5.5.0/1b-p1, and possibly other versions, does not set the secure flag for an unspecified cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://osvdb.org/96664; http://www.digitalsec.net/stuff/explt+advs/CM3.AcoraCMS.v6.txt; http://osvdb.org/96664
CVE: CVE-2013-4727
Published: 2014-06-06
Description: DDSN Interactive cm3 Acora CMS 6.0.6/1a, 6.0.2/1a, 5.5.7/12b, 5.5.0/1b-p1, and possibly other versions, allows remote attackers to obtain sensitive information via a request to Admin/top.aspx.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://osvdb.org/96666; http://www.digitalsec.net/stuff/explt+advs/CM3.AcoraCMS.v6.txt; http://osvdb.org/96666
CVE: CVE-2013-4728
Published: 2014-06-06
Description: DDSN Interactive cm3 Acora CMS 6.0.6/1a, 6.0.2/1a, 5.5.7/12b, 5.5.0/1b-p1, and possibly other versions, allows remote attackers to obtain sensitive information via a .. (dot dot) in the "l" parameter, which reveals the installation path in an error message.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://osvdb.org/96667; http://www.digitalsec.net/stuff/explt+advs/CM3.AcoraCMS.v6.txt; http://osvdb.org/96667
CVE: CVE-2014-2575
Published: 2014-06-06
Description: Directory traversal vulnerability in the File Manager component in DevExpress ASPxFileManager Control for ASP.NET WebForms and MVC before 13.1.10 and 13.2.x before 13.2.9 allows remote authenticated users to read or write arbitrary files via a .. (dot dot) in the __EVENTARGUMENT parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/show/osvdb/107742; http://packetstormsecurity.com/files/126953/DevExpress-ASP.NET-File-Manager-13.2.8-Directory-Traversal.html; http://seclists.org/fulldisclosure/2014/Jun/24
CVE: CVE-2014-3966
Published: 2014-06-06
Description: Cross-site scripting (XSS) vulnerability in Special:PasswordReset in MediaWiki before 1.19.16, 1.21.x before 1.21.10, and 1.22.x before 1.22.7, when wgRawHtml is enabled, allows remote attackers to inject arbitrary web script or HTML via an invalid username.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-May/000151.html; http://secunia.com/advisories/58834; http://secunia.com/advisories/58896
CVE: CVE-2014-3984
Published: 2014-06-06
Description: Multiple unspecified vulnerabilities in Libav before 0.8.12 allow remote attackers to have unknown impact and vectors.
CVSS Score: 10.0 (HIGH)
References: http://git.libav.org/?p=libav.git%3Ba=blob%3Bf=Changelog%3Bhb=refs/tags/v0.8.12; http://libav.org/news.html; http://secunia.com/advisories/59032
CVE: CVE-2014-3153
Published: 2014-06-07
Description: The futex_requeue function in kernel/futex.c in the Linux kernel through 3.14.5 does not ensure that calls have two different futex addresses, which allows local users to gain privileges via a crafted FUTEX_REQUEUE command that facilitates unsafe waiter modification.
CVSS Score: 7.8 (HIGH)
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=e9c243a5a6de0be8e584c604d353412584b592f8; http://linux.oracle.com/errata/ELSA-2014-0771.html; http://linux.oracle.com/errata/ELSA-2014-3037.html
CVE: CVE-2014-2506
Published: 2014-06-08
Description: EMC Documentum Content Server before 6.7 SP1 P28, 6.7 SP2 before P14, 7.0 before P15, and 7.1 before P05 allows remote authenticated users to obtain super-user privileges for system-object creation, and bypass intended restrictions on data access and server actions, via unspecified vectors.
CVSS Score: 8.5 (HIGH)
CWE: CWE-264
References: http://archives.neohapsis.com/archives/bugtraq/2014-06/0051.html; http://packetstormsecurity.com/files/126960/EMC-Documentum-Content-Server-Escalation-Injection.html; http://secunia.com/advisories/58954
CVE: CVE-2014-2507
Published: 2014-06-08
Description: EMC Documentum Content Server before 6.7 SP1 P28, 6.7 SP2 before P14, 7.0 before P15, and 7.1 before P05 allows remote authenticated users to execute arbitrary commands via shell metacharacters in arguments to unspecified methods.
CVSS Score: 8.5 (HIGH)
CWE: CWE-78
References: http://archives.neohapsis.com/archives/bugtraq/2014-06/0051.html; http://packetstormsecurity.com/files/126960/EMC-Documentum-Content-Server-Escalation-Injection.html; http://secunia.com/advisories/58954
CVE: CVE-2014-2508
Published: 2014-06-08
Description: EMC Documentum Content Server before 6.7 SP1 P28, 6.7 SP2 before P14, 7.0 before P15, and 7.1 before P05 allows remote authenticated users to conduct Documentum Query Language (DQL) injection attacks and bypass intended restrictions on database actions via vectors involving DQL hints.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://archives.neohapsis.com/archives/bugtraq/2014-06/0051.html; http://packetstormsecurity.com/files/126960/EMC-Documentum-Content-Server-Escalation-Injection.html; http://secunia.com/advisories/58954
CVE: CVE-2014-3278
Published: 2014-06-08
Description: The web framework in VOSS in Cisco Unified Communications Domain Manager (CDM) does not properly implement access control, which allows remote attackers to enumerate accounts by visiting an unspecified BVSMWeb web page, aka Bug IDs CSCun39619 and CSCun45572.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/58657; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3278; http://www.securityfocus.com/bid/67924
CVE: CVE-2014-3281
Published: 2014-06-08
Description: The web framework in VOSS in Cisco Unified Communications Domain Manager (CDM) does not properly implement access control, which allows remote attackers to obtain potentially sensitive user information by visiting an unspecified BVSMWeb web page, aka Bug IDs CSCun46071 and CSCun46101.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/58657; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3281; http://www.securityfocus.com/bid/67925
CVE: CVE-2014-3286
Published: 2014-06-08
Description: The web framework in Cisco WebEx Meeting Server does not properly restrict the content of reply messages, which allows remote attackers to obtain sensitive information via a crafted URL, aka Bug IDs CSCuj81685, CSCuj81688, CSCuj81665, CSCuj81744, and CSCuj81661.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/58571; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3286; http://www.securityfocus.com/bid/67922
CVE: CVE-2014-3291
Published: 2014-06-08
Description: Cisco Wireless LAN Controller (WLC) devices allow remote attackers to cause a denial of service (NULL pointer dereference and device restart) via a zero value in Cisco Discovery Protocol packet data that is not properly handled during SNMP polling, aka Bug ID CSCuo12321.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/57895; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3291; http://tools.cisco.com/security/center/viewAlert.x?alertId=34558
CVE: CVE-2014-0961
Published: 2014-06-08
Description: Cross-site request forgery (CSRF) vulnerability in IBM Tivoli Identity Manager (ITIM) 5.0 before 5.0.0.15 and 5.1 before 5.1.0.15 and IBM Security Identity Manager (ISIM) 6.0 before 6.0.0.2 allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS sequences.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-352
References: http://secunia.com/advisories/59080; http://www-01.ibm.com/support/docview.wss?uid=swg21674754; http://www.securityfocus.com/bid/67909
CVE: CVE-2014-3981
Published: 2014-06-08
Description: acinclude.m4, as used in the configure script in PHP 5.5.13 and earlier, allows local users to overwrite arbitrary files via a symlink attack on the /tmp/phpglibccheck file.
CVSS Score: 3.3 (LOW)
CWE: CWE-59
References: http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=91bcadd85e20e50d3f8c2e[PII_REDACTED]640e6f16; http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]5317&w=2
CVE: CVE-2014-3982
Published: 2014-06-08
Description: include/tests_webservers in Lynis before 1.5.5 on AIX allows local users to overwrite arbitrary files via a symlink attack on a /tmp/lynis.##### file.
CVSS Score: 3.3 (LOW)
CWE: CWE-59
References: http://cisofy.com/files/lynis-1.5.5.tar.gz; http://openwall.com/lists/oss-security/2014/06/05/14; http://openwall.com/lists/oss-security/2014/06/06/12
CVE: CVE-2014-3986
Published: 2014-06-08
Description: include/tests_webservers in Lynis before 1.5.5 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/lynis.*.unsorted file with an easily determined name.
CVSS Score: 3.3 (LOW)
CWE: CWE-59
References: http://cisofy.com/files/lynis-1.5.5.tar.gz; http://openwall.com/lists/oss-security/2014/06/05/14; http://openwall.com/lists/oss-security/2014/06/06/12
CVE: CVE-2014-0929
Published: 2014-06-08
Description: Cross-site request forgery (CSRF) vulnerability in the Profiles component in IBM Connections through 3.0.1.1 CR3 allows remote authenticated users to hijack the authentication of arbitrary users for requests that trigger follow actions.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-352
References: http://secunia.com/advisories/59046; http://www-01.ibm.com/support/docview.wss?uid=swg1LO79622; http://www-01.ibm.com/support/docview.wss?uid=swg21668509
CVE: CVE-2014-0936
Published: 2014-06-08
Description: IBM Security AppScan Source 8.0 through 9.0, when the publish-assessment permission is not properly restricted for the configured database server, transmits cleartext assessment data, which allows remote attackers to obtain sensitive information by sniffing the network.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264, CWE-310
References: http://www-01.ibm.com/support/docview.wss?uid=swg21674750; https://exchange.xforce.ibmcloud.com/vulnerabilities/92317; http://www-01.ibm.com/support/docview.wss?uid=swg21674750
CVE: CVE-2014-3036
Published: 2014-06-08
Description: Unspecified vulnerability in IBM API Management 3.0.0.0, when basic authentication is used for APIs, allows remote attackers to bypass intended restrictions on topology access, and obtain sensitive information, via unknown vectors.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/59044; http://www-01.ibm.com/support/docview.wss?uid=swg1LI78000; http://www-01.ibm.com/support/docview.wss?uid=swg21674232
CVE: CVE-2014-3038
Published: 2014-06-08
Description: IBM SPSS Modeler 16.0 before 16.0.0.1 on UNIX does not properly drop group privileges, which allows local users to bypass intended file-access restrictions by leveraging (1) gid 0 or (2) root's group memberships.
CVSS Score: 3.6 (LOW)
CWE: CWE-264
References: http://secunia.com/advisories/59244; http://www-01.ibm.com/support/docview.wss?uid=swg21675043; http://www.securityfocus.com/bid/67949
CVE: CVE-2014-3048
Published: 2014-06-08
Description: Unspecified vulnerability on the IBM System Storage Virtualization Engine TS7700 allows local users to gain privileges by leveraging the TSSC service-user role to enter a crafted SSH command.
CVSS Score: 6.0 (MEDIUM)
References: http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004653; http://www.securityfocus.com/bid/67942; https://exchange.xforce.ibmcloud.com/vulnerabilities/93434
CVE: CVE-2014-3977
Published: 2014-06-08
Description: libodm.a in IBM AIX 6.1 and 7.1, and VIOS 2.2.x, allows local users to overwrite arbitrary files via a symlink attack on a temporary file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-2179.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-59
References: http://aix.software.ibm.com/aix/efixes/security/libodm_advisory.asc; http://packetstormsecurity.com/files/127067/IBM-AIX-6.1.8-Privilege-Escalation.html; http://www.exploit-db.com/exploits/33725
CVE: CVE-2013-1756
Published: 2014-06-09
Description: The Dragonfly gem 0.7 before 0.8.6 and 0.9.x before 0.9.13 for Ruby, when used with Ruby on Rails, allows remote attackers to execute arbitrary code via a crafted request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/52380; http://www.securityfocus.com/bid/58225; https://exchange.xforce.ibmcloud.com/vulnerabilities/82476
CVE: CVE-2013-1973
Published: 2014-06-09
Description: The autocomplete callback in Autocomplete Widgets for Text and Number Fields (autocomplete_widgets) module 6.x-1.x before 6.x-1.4 and 7.x-1.x before 7.x-1.0-rc1 does not properly handle node permissions, which allows remote authenticated users to obtain sensitive field values via unspecified vectors.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/92532; http://secunia.com/advisories/52996; https://drupal.org/node/1971848
CVE: CVE-2013-2562
Published: 2014-06-09
Description: Mambo CMS 4.6.5 stores the MySQL database password in cleartext in the document root, which allows local users to obtain sensitive information via unspecified vectors.
CVSS Score: 2.1 (LOW)
CWE: CWE-255
References: http://packetstormsecurity.com/files/108462/mambocms465-permdosdisclose.txt; http://seclists.org/oss-sec/2013/q1/689; http://www.vapid.dhs.org/advisories/mambo_cms_4.6.5.html
CVE: CVE-2013-2563
Published: 2014-06-09
Description: Mambo CMS 4.6.5 uses world-readable permissions on configuration.php, which allows local users to obtain the admin password hash by reading the file.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://packetstormsecurity.com/files/108462/mambocms465-permdosdisclose.txt; http://seclists.org/oss-sec/2013/q1/689; http://www.vapid.dhs.org/advisories/mambo_cms_4.6.5.html
CVE: CVE-2013-2564
Published: 2014-06-09
Description: Mambo CMS 4.6.5 allows remote attackers to cause a denial of service (memory and bandwidth consumption) by uploading a crafted file.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://packetstormsecurity.com/files/108462/mambocms465-permdosdisclose.txt; http://seclists.org/oss-sec/2013/q1/689; http://www.vapid.dhs.org/advisories/mambo_cms_4.6.5.html
CVE: CVE-2013-3081
Published: 2014-06-09
Description: SQL injection vulnerability in the checkEmailFormat function in plugins/jojo_core/classes/Jojo.php in Jojo before 1.2.2 allows remote attackers to execute arbitrary SQL commands via the X-Forwarded-For HTTP header to /articles/test/.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/84285; https://github.com/JojoCMS/Jojo-CMS/commit/972757c4500d94b4b1306bf092e678add3a987d8; https://www.htbridge.com/advisory/HTB23153
CVE: CVE-2013-3082
Published: 2014-06-09
Description: Cross-site scripting (XSS) vulnerability in plugins/jojo_core/forgot_password.php in Jojo before 1.2.2 allows remote attackers to inject arbitrary web script or HTML via the search parameter to forgot-password/.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/84286; https://github.com/JojoCMS/Jojo-CMS/commit/9c000f961635e35e9984a8c16ca69c2cbf2d2236; https://www.htbridge.com/advisory/HTB23153
CVE: CVE-2013-4595
Published: 2014-06-09
Description: The Secure Pages module 6.x-2.x before 6.x-2.0 for Drupal does not properly match URLs, which causes HTTP to be used instead of HTTPS and makes it easier for remote attackers to obtain sensitive information via a crafted web page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-310
References: http://seclists.org/oss-sec/2013/q4/317; https://drupal.org/node/2128739; https://drupal.org/node/2129381
CVE: CVE-2013-4597
Published: 2014-06-09
Description: The Revisioning module 7.x-1.x before 7.x-1.6 for Drupal does not properly check node access permissions for content marked unpublished by the Scheduled module, which allows remote authenticated users to obtain sensitive information via unspecified vectors.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://seclists.org/oss-sec/2013/q4/317; https://drupal.org/node/2133555; https://drupal.org/node/2135257
CVE: CVE-2013-4599
Published: 2014-06-09
Description: The Misery module 6.x-2.x before 6.x-2.5 and 7.x-2.x before 7.x-2.2 for Drupal, when the "delay misery" configuration is set to a high value, allows remote attackers to cause a denial of service (process consumption) via multiple requests.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-399
References: http://seclists.org/oss-sec/2013/q4/317; http://www.securityfocus.com/bid/63705; https://drupal.org/node/2134409
CVE: CVE-2013-5760
Published: 2014-06-09
Description: QNAP Photo Station before firmware 4.0.3 build0912 allows remote attackers to list OS user accounts via a request to photo/p/api/list.php.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/89117; https://www3.trustwave.com/spiderlabs/advisories/TWSL2013-029.txt; https://exchange.xforce.ibmcloud.com/vulnerabilities/89117
CVE: CVE-2013-6223
Published: 2014-06-09
Description: LiveZilla before 5.1.1.0 stores the admin Base64 encoded username and password in a 1click file, which allows local users to obtain access by reading the file.
CVSS Score: 2.1 (LOW)
CWE: CWE-255
References: http://blog.curesec.com/article/blog/27.html; http://forums.livezilla.net/index.php?/topic/163-livezilla-changelog/; http://osvdb.org/100400
CVE: CVE-2013-7323
Published: 2014-06-09
Description: python-gnupg before 0.3.5 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in unspecified vectors.
CVSS Score: 7.5 (HIGH)
References: http://seclists.org/oss-sec/2014/q1/243; http://seclists.org/oss-sec/2014/q1/244; http://seclists.org/oss-sec/2014/q1/294
CVE: CVE-2014-4003
Published: 2014-06-09
Description: The System Landscape Directory (SLD) in SAP NetWeaver allows remote attackers to modify information via vectors related to adding a system.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://packetstormsecurity.com/files/126986/SAP-SLD-Information-Tampering.html; http://scn.sap.com/docs/DOC-8218; http://seclists.org/fulldisclosure/2014/Jun/37
CVE: CVE-2014-4004
Published: 2014-06-09
Description: The (1) Structures and (2) Project-Oriented Procurement components in SAP Project System has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-255
References: http://scn.sap.com/docs/DOC-8218; http://seclists.org/fulldisclosure/2014/Jun/36; http://www.layersevensecurity.com/docs/Layer%20Seven%20Security_Advisory_February%202014.pdf
CVE: CVE-2014-4005
Published: 2014-06-09
Description: SAP Brazil add-on has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-255
References: http://scn.sap.com/docs/DOC-8218; http://seclists.org/fulldisclosure/2014/Jun/36; http://www.layersevensecurity.com/docs/Layer%20Seven%20Security_Advisory_February%202014.pdf
CVE: CVE-2014-4006
Published: 2014-06-09
Description: The SAP Trader's and Scheduler's Workbench (TSW) for SAP Oil & Gas has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-255
References: http://scn.sap.com/docs/DOC-8218; http://seclists.org/fulldisclosure/2014/Jun/36; http://www.layersevensecurity.com/docs/Layer%20Seven%20Security_Advisory_February%202014.pdf
CVE: CVE-2014-4007
Published: 2014-06-09
Description: The SAP Upgrade tools for ABAP has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-255
References: http://scn.sap.com/docs/DOC-8218; http://seclists.org/fulldisclosure/2014/Jun/36; http://www.securityfocus.com/bid/67920
CVE: CVE-2014-4008
Published: 2014-06-09
Description: SAP Web Services Tool (CA-WUI-WST) has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-255
References: http://scn.sap.com/docs/DOC-8218; http://seclists.org/fulldisclosure/2014/Jun/36; http://www.securityfocus.com/bid/67920
CVE: CVE-2014-4009
Published: 2014-06-09
Description: SAP CCMS Monitoring (BC-CCM-MON) has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-255
References: http://scn.sap.com/docs/DOC-8218; http://seclists.org/fulldisclosure/2014/Jun/36; http://www.securityfocus.com/bid/67920
CVE: CVE-2014-4010
Published: 2014-06-09
Description: SAP Transaction Data Pool has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-255
References: http://scn.sap.com/docs/DOC-8218; http://seclists.org/fulldisclosure/2014/Jun/36; http://www.securityfocus.com/bid/67920
CVE: CVE-2014-4011
Published: 2014-06-09
Description: SAP Capacity Leveling has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-255
References: http://scn.sap.com/docs/DOC-8218; http://seclists.org/fulldisclosure/2014/Jun/36; http://www.securityfocus.com/bid/67920
CVE: CVE-2014-4012
Published: 2014-06-09
Description: SAP Open Hub Service has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-255
References: http://scn.sap.com/docs/DOC-8218; http://seclists.org/fulldisclosure/2014/Jun/36; http://www.securityfocus.com/bid/67920
CVE: CVE-2013-5643
Published: 2014-06-10
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not a security issue.  Notes: none