deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-8870
Published: 2015-01-15
Description: Open redirect vulnerability in mobiquo/smartbanner/welcome.php in the Tapatalk (com.tapatalk.wbb4) plugin before 1.1.2 for Woltlab Burning Board 4.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the board_url parameter.
CVSS Score: 5.8 (MEDIUM)
References: http://seclists.org/fulldisclosure/2015/Jan/32; http://www.securityfocus.com/archive/1/534450/100/0/threaded; http://www.securityfocus.com/bid/71998
CVE: CVE-2014-9308
Published: 2015-01-15
Description: Unrestricted file upload vulnerability in inc/amfphp/administration/banneruploaderscript.php in the WP EasyCart (aka WordPress Shopping Cart) plugin before 3.0.9 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in products/banners/.
CVSS Score: 6.5 (MEDIUM)
References: http://osvdb.org/show/osvdb/116806; http://packetstormsecurity.com/files/129875/WordPress-Shopping-Cart-3.0.4-Unrestricted-File-Upload.html; http://security.szurek.pl/wordpress-shopping-cart-304-unrestricted-file-upload.html
CVE: CVE-2014-9560
Published: 2015-01-15
Description: SQL injection vulnerability in redir_last_post_list.php in SoftBB 0.1.3 allows remote attackers to execute arbitrary SQL commands via the post parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/129888/SoftBB-0.1.3-SQL-Injection.html; http://seclists.org/fulldisclosure/2015/Jan/20; http://tetraph.com/security/cves/cve-2014-9560-softbb-net-softbb-sql-injection-security-vulnerability/
CVE: CVE-2014-9561
Published: 2015-01-15
Description: Cross-site scripting (XSS) vulnerability in redir_last_post_list.php in SoftBB 0.1.3 allows remote attackers to inject arbitrary web script or HTML via the post parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/129889/SoftBB-0.1.3-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2015/Jan/21; http://tetraph.com/security/cves/cve-2014-9561-softbb-net-softbb-xss-cross-site-scripting-security-vulnerability/
CVE: CVE-2014-9570
Published: 2015-01-15
Description: Multiple cross-site scripting (XSS) vulnerabilities in the MyWebsiteAdvisor Simple Security plugin 1.1.5 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) datefilter parameter in the access_log page to wp-admin/users.php or (2) simple_security_ip_blacklist[] parameter in an add_blacklist_ip action in the ip_blacklist page to wp-admin/users.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/archive/1/534477/100/0/threaded; https://www.htbridge.com/advisory/HTB23244; http://www.securityfocus.com/archive/1/534477/100/0/threaded
CVE: CVE-2014-9587
Published: 2015-01-15
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in Roundcube Webmail before 1.0.4 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors, related to (1) address book operations or the (2) ACL or (3) Managesieve plugins.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://roundcube.net/news/2014/12/18/update-1.0.4-released/; http://www.openwall.com/lists/oss-security/2015/01/11/3; http://www.securityfocus.com/bid/71909
CVE: CVE-2014-9593
Published: 2015-01-15
Description: Apache CloudStack before 4.3.2 and 4.4.x before 4.4.2 allows remote attackers to obtain private keys via a listSslCerts API call.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://docs.cloudstack.apache.org/projects/cloudstack-release-notes/en/4.3.2/about.html; http://docs.cloudstack.apache.org/projects/cloudstack-release-notes/en/4.4.2/fixed_issues.html#issues-fixed-in-release; http://secunia.com/advisories/62216
CVE: CVE-2014-9594
Published: 2015-01-15
Description: Buffer overflow in the SAP NetWeaver Dispatcher in SAP Kernel 7.00 32-bit and 7.40 64-bit allows remote authenticated users to cause a denial of service or possibly execute arbitrary code via unspecified vectors, related to the ABAP VM, aka SAP Note 2059734.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: http://secunia.com/advisories/62150; https://erpscan.io/advisories/erpscan-14-025-sap-kernel-rce-dos/; https://erpscan.io/press-center/blog/sap-critical-patch-update-december-2014/
CVE: CVE-2014-9595
Published: 2015-01-15
Description: Buffer overflow in the SAP NetWeaver Dispatcher in SAP Kernel 7.00 32-bit and 7.40 64-bit allows remote authenticated users to cause a denial of service or possibly execute arbitrary code via unspecified vectors, related to the Spool System, aka SAP Note 2061271.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: http://secunia.com/advisories/62150; https://erpscan.io/advisories/erpscan-14-024-sap-kernel-rce-dos/; https://erpscan.io/press-center/blog/sap-critical-patch-update-december-2014/
CVE: CVE-2015-0552
Published: 2015-01-15
Description: Directory traversal vulnerability in the gcab_folder_extract function in libgcab/gcab-folder.c in gcab 0.4 allows remote attackers to write to arbitrary files via crafted path in a CAB file, as demonstrated by "\tmp\moo."
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-22
References: http://lists.opensuse.org/opensuse-updates/2015-01/msg00018.html; http://secunia.com/advisories/62310; http://www.openwall.com/lists/oss-security/2015/01/05/7
CVE: CVE-2015-1039
Published: 2015-01-15
Description: Cross-site scripting (XSS) vulnerability in user/login.phtml in ZF-Commons ZfcUser before 1.2.2 allows remote attackers to inject arbitrary web script or HTML via the redirect parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2015/01/11/4; http://www.securityfocus.com/bid/71931; https://github.com/ZF-Commons/ZfcUser/commit/baf0e460
CVE: CVE-2015-1040
Published: 2015-01-15
Description: Multiple cross-site scripting (XSS) vulnerabilities in the administrative backend in BEdita 3.4.0 allow remote authenticated users to inject arbitrary web script or HTML via the (1) lrealname field in the editProfile form to index.php/home/profile; the (2) data[title] or (3) data[description] field in the addQuickItem form to index.php; the (4) "note text" field in the saveNote form to index.php/areas; or the (5) titleBEObject or (6) tagsArea field in the updateForm form to index.php/documents/view.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://packetstormsecurity.com/files/129865/CMS-BEdita-3.4.0-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2015/Jan/16; http://seclists.org/oss-sec/2015/q1/115
CVE: CVE-2015-1041
Published: 2015-01-15
Description: Cross-site scripting (XSS) vulnerability in e107_admin/filemanager.php in e107 1.0.4 allows remote attackers to inject arbitrary web script or HTML via the e107_files/ file path in the QUERY_STRING.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/129872/CMS-e107-1.0.4-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2015/Jan/18; http://sroesemann.blogspot.de/2014/12/sroeadv-2014-05.html
CVE: CVE-2015-1050
Published: 2015-01-15
Description: Cross-site scripting (XSS) vulnerability in F5 BIG-IP Application Security Manager (ASM) before 11.6 allows remote attackers to inject arbitrary web script or HTML via the Response Body field when creating a new user account.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/129911/F5-BIG-IP-Application-Security-Manager-ASM-XSS.html; http://seclists.org/fulldisclosure/2015/Jan/43; http://www.securityfocus.com/archive/1/534459/100/0/threaded
CVE: CVE-2015-1051
Published: 2015-01-15
Description: Open redirect vulnerability in the Context UI module in the Context module 7.x-3.x before 7.x-3.6 for Drupal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the destination parameter.
CVSS Score: 5.8 (MEDIUM)
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148782.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148800.html; http://www.securityfocus.com/bid/71925
CVE: CVE-2015-1052
Published: 2015-01-15
Description: Cross-site scripting (XSS) vulnerability in the poll archive in PHPKIT 1.6.6 (Build 160014) allows remote attackers to inject arbitrary web script or HTML via the result parameter to upload_files/pk/include.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/129917/CMS-PHPKit-WCMS-1.6.6-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2015/Jan/25; http://sroesemann.blogspot.de/2014/12/sroeadv-2014-07.html
CVE: CVE-2014-7881
Published: 2015-01-15
Description: Cross-site scripting (XSS) vulnerability in the server in HP Insight Control allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/62162; https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04537915; http://secunia.com/advisories/62162
CVE: CVE-2014-8022
Published: 2015-01-15
Description: Multiple cross-site scripting (XSS) vulnerabilities in Cisco Identity Services Engine allow remote attackers to inject arbitrary web script or HTML via input to unspecified web pages, aka Bug IDs CSCur69835 and CSCur69776.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-8022; http://www.securityfocus.com/bid/72083; http://www.securitytracker.com/id/1031560
CVE: CVE-2014-8034
Published: 2015-01-15
Description: Cisco WebEx Meetings Server 1.5 presents the same CAPTCHA challenge for each login attempt, which makes it easier for remote attackers to obtain access via a brute-force approach of guessing usernames, aka Bug ID CSCuj40321.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-255
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-8034; http://tools.cisco.com/security/center/viewAlert.x?alertId=36990; http://www.securityfocus.com/bid/71978
CVE: CVE-2014-8904
Published: 2015-01-15
Description: lquerylv in cmdlvm in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x allows local users to gain privileges via a crafted DBGCMD_LQUERYLV environment-variable value.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://aix.software.ibm.com/aix/efixes/security/lvm_advisory.asc; http://secunia.com/advisories/62195; http://www.ibm.com/support/docview.wss?uid=isg1IV67907
CVE: CVE-2015-0588
Published: 2015-01-15
Description: Cross-site request forgery (CSRF) vulnerability in Cisco Unified Communications Domain Manager (UCDM) 10 allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuo77055.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://secunia.com/advisories/62352; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015-0588; http://www.securityfocus.com/bid/72082
CVE: CVE-2015-0591
Published: 2015-01-15
Description: Cisco Unified Communications Domain Manager (UCDM) 10 allows remote attackers to cause a denial of service (daemon hang and GUI outage) via a flood of malformed TCP packets, aka Bug ID CSCur44177.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015-0591; http://www.securityfocus.com/bid/72084; http://www.securitytracker.com/id/1031561
CVE: CVE-2014-9596
Published: 2015-01-15
Description: Panasonic Arbitrator Back-End Server (BES) MK 2.0 VPU before 9.3.1 build 4.08.003.0, when USB Wi-Fi or Direct LAN is enabled, and MK 3.0 VPU before 9.3.1 build 5.06.000.0, when Embedded Wi-Fi or Direct LAN is enabled, does not use encryption, which allows remote attackers to obtain sensitive information by sniffing the network for client-server traffic, as demonstrated by Active Directory credential information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-310
References: http://us2.campaign-archive1.com/?u=8c9cff2e712e3b7d09a07ecef&id=21f059b3ab; http://www.kb.cert.org/vuls/id/117604; http://us2.campaign-archive1.com/?u=8c9cff2e712e3b7d09a07ecef&id=21f059b3ab
CVE: CVE-2014-9599
Published: 2015-01-16
Description: Cross-site scripting (XSS) vulnerability in the filemanager in b2evolution before 5.2.1 allows remote attackers to inject arbitrary web script or HTML via the fm_filter parameter to blogs/admin.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://b2evolution.net/downloads/5-2-1-stable; http://packetstormsecurity.com/files/129940/CMS-b2evolution-5.2.0-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2015/Jan/48
CVE: CVE-2014-9600
Published: 2015-01-16
Description: Untrusted search path vulnerability in Macroplant iExplorer 3.6.3.0 allows local users to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse itunesmobiledevice.dll.
CVSS Score: 7.2 (HIGH)
References: http://packetstormsecurity.com/files/129764/iExplorer-3.6.3.0-DLL-Hijacking.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/99833; http://packetstormsecurity.com/files/129764/iExplorer-3.6.3.0-DLL-Hijacking.html
CVE: CVE-2015-1053
Published: 2015-01-16
Description: Cross-site scripting (XSS) vulnerability in the administrative backend in Croogo before 2.2.1 allows remote attackers to inject arbitrary web script or HTML via the path parameter to admin/file_manager/file_manager/editfile.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/129916/CMS-Croogo-2.2.0-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2015/Jan/24; http://sroesemann.blogspot.de/2015/01/report-for-advisory-sroeadv-2015-02.html
CVE: CVE-2015-1054
Published: 2015-01-16
Description: Cross-site scripting (XSS) vulnerability in the Games feature in Crea8Social 2.0 allows remote authenticated users to inject arbitrary web script or HTML via the Game Content field in Add Game.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://codecanyon.net/item/crea8social-php-social-networking-platform-v31/9211270; http://codecanyon.net/item/crea8social-php-social-networking-platform-v31/9211270/support; http://osvdb.org/show/osvdb/116732
CVE: CVE-2015-1055
Published: 2015-01-16
Description: SQL injection vulnerability in the Photo Gallery plugin 1.2.7 for WordPress allows remote attackers to execute arbitrary SQL commands via the order_by parameter in a GalleryBox action to wp-admin/admin-ajax.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://seclists.org/fulldisclosure/2015/Jan/36; http://www.securityfocus.com/bid/72015; http://seclists.org/fulldisclosure/2015/Jan/36
CVE: CVE-2015-1056
Published: 2015-01-16
Description: Cross-site scripting (XSS) vulnerability in Brother MFC-J4410DW printer with firmware before L allows remote attackers to inject arbitrary web script or HTML via the url parameter to general/status.html and possibly other pages.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/129841/Brother-MFC-J4410DW-Cross-Site-Scripting.html; http://www.securityfocus.com/archive/1/534398/100/0/threaded; http://www.securityfocus.com/bid/71911
CVE: CVE-2015-1057
Published: 2015-01-16
Description: Cross-site scripting (XSS) vulnerability in usersettings.php in e107 2.0.0 allows remote attackers to inject arbitrary web script or HTML via the "Real Name" value.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/show/osvdb/116692; http://www.exploit-db.com/exploits/35679; https://exchange.xforce.ibmcloud.com/vulnerabilities/99627
CVE: CVE-2015-1058
Published: 2015-01-16
Description: Multiple cross-site scripting (XSS) vulnerabilities in AdaptCMS 3.0.3 allow remote attackers to inject arbitrary web script or HTML via the (1) data[Category][title] parameter to admin/categories/add, (2) data[Field][title] parameter to admin/fields/ajax_fields/, (3) name property in a basicInfo JSON object to admin/tools/create_theme, (4) data[Link][link_title] parameter to admin/links/links/add, or (5) data[ForumTopic][subject] parameter to forums/off-topic/new.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/show/osvdb/116716; http://osvdb.org/show/osvdb/116717; http://osvdb.org/show/osvdb/116718
CVE: CVE-2015-1059
Published: 2015-01-16
Description: Unrestricted file upload vulnerability in admin/files/add in AdaptCMS 3.0.3 allows remote authenticated users to execute arbitrary PHP code by uploading a file with a PHP extension, then accessing it via a direct request to the file in /app/webroot/uploads.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-94
References: http://osvdb.org/show/osvdb/116722; http://packetstormsecurity.com/files/129814/AdaptCMS-3.0.3-Remote-Command-Execution.html; http://www.exploit-db.com/exploits/35710
CVE: CVE-2015-1060
Published: 2015-01-16
Description: Open redirect vulnerability in lib/Cake/Controller/Controller.php in AdaptCMS 3.0.3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the HTTP Referer header.
CVSS Score: 5.8 (MEDIUM)
References: http://osvdb.org/show/osvdb/116721; http://packetstormsecurity.com/files/129813/AdaptCMS-3.0.3-HTTP-Referer-Header-Open-Redirect.html; http://www.exploit-db.com/exploits/35710
CVE: CVE-2014-1949
Published: 2015-01-16
Description: GTK+ 3.10.9 and earlier, as used in cinnamon-screensaver, gnome-screensaver, and other applications, allows physically proximate attackers to bypass the lock screen by pressing the menu button.
CVSS Score: 7.2 (HIGH)
CWE: CWE-284
References: http://advisories.mageia.org/MGASA-2014-0374.html; http://seclists.org/oss-sec/2014/q1/327; http://seclists.org/oss-sec/2014/q1/331
CVE: CVE-2014-3692
Published: 2015-01-16
Description: The customization template in Red Hat CloudForms 3.1 Management Engine (CFME) 5.3 uses a default password for the root account when a password is not specified for a new image, which allows remote attackers to gain privileges.
CVSS Score: 10.0 (HIGH)
CWE: CWE-255
References: http://rhn.redhat.com/errata/RHSA-2015-0028.html; http://secunia.com/advisories/62255; http://rhn.redhat.com/errata/RHSA-2015-0028.html
CVE: CVE-2014-6382
Published: 2015-01-16
Description: The Juniper MX Series routers with Junos 13.3R3 through 13.3Rx before 13.3R6, 14.1 before 14.1R4, 14.1X50 before 14.1X50-D70, and 14.2 before 14.2R2, when configured as a broadband edge (BBE) router, allows remote attackers to cause a denial of service (jpppd crash and restart) by sending a crafted PAP Authenticate-Request after the PPPoE Discovery and LCP phase are complete.
CVSS Score: 7.1 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/72070; https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10665; http://www.securityfocus.com/bid/72070
CVE: CVE-2014-6383
Published: 2015-01-16
Description: The stateless firewall in Juniper Junos 13.3R3, 14.1R1, and 14.1R2, when using Trio-based PFE modules, does not properly match ports, which might allow remote attackers to bypass firewall rule.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-17
References: http://www.securityfocus.com/bid/72071; http://www.securitytracker.com/id/1031549; https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10666
CVE: CVE-2014-6384
Published: 2015-01-16
Description: Juniper Junos 12.1X44 before 12.1X44-D45, 12.1X46 before 12.1X46-D25, 12.1X47 before 12.1X47-D15, 12.3 before 12.3R9, 13.1 before 13.1R4-S3, 13.2 before 13.2R6, 13.3 before 13.3R5, 14.1 before 14.1R3, and 14.2 before 14.2R1 does not properly handle double quotes in authorization attributes in the TACACS+ configuration, which allows local users to bypass the security policy and execute commands via unspecified vectors.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-264
References: http://www.securityfocus.com/bid/72077; http://www.securitytracker.com/id/1031547; https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10667
CVE: CVE-2014-6385
Published: 2015-01-16
Description: Juniper Junos 11.4 before 11.4R13, 12.1X44 before 12.1X44-D45, 12.1X46 before 12.1X46-D30, 12.1X47 before 12.1X47-D15, 12.2 before 12.2R9, 12.3R7 before 12.3R7-S1, 12.3 before 12.3R8, 13.1 before 13.1R5, 13.2 before 13.2R6, 13.3 before 13.3R4, 14.1 before 14.1R2, and 14.2 before 14.2R1 allows remote attackers to cause a denial of service (kernel crash and restart) via a crafted fragmented OSPFv3 packet with an IPsec Authentication Header (AH).
CVSS Score: 6.1 (MEDIUM)
References: http://www.securityfocus.com/bid/72072; https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10668; http://www.securityfocus.com/bid/72072
CVE: CVE-2014-6386
Published: 2015-01-16
Description: Juniper Junos 11.4 before 11.4R8, 12.1X44 before 12.1X44-D35, 12.1X45 before 12.1X45-D25, 12.1X46 before 12.1X46-D20, 12.1X47 before 12.1X47-D10, 12.2 before 12.2R9, 12.3R2 before 12.3R2-S3, 12.3 before 12.3R3, 13.1 before 13.1R4, and 13.2 before 13.2R1 allows remote attackers to cause a denial of service (assertion failure and rpd restart) via a crafted BGP FlowSpec prefix.
CVSS Score: 7.8 (HIGH)
CWE: CWE-17
References: http://www.securityfocus.com/bid/72067; http://www.securitytracker.com/id/1031548; https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10670
CVE: CVE-2014-7814
Published: 2015-01-16
Description: SQL injection vulnerability in Red Hat CloudForms 3.1 Management Engine (CFME) 5.3 allows remote authenticated users to execute arbitrary SQL commands via a crafted REST API request to an SQL filter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://rhn.redhat.com/errata/RHSA-2015-0028.html; http://secunia.com/advisories/62255; http://rhn.redhat.com/errata/RHSA-2015-0028.html
CVE: CVE-2014-9471
Published: 2015-01-16
Description: The parse_datetime function in GNU coreutils allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted date string, as demonstrated by the "--date=TZ="123"345" @1" string to the touch or date command.
CVSS Score: 7.5 (HIGH)
References: http://advisories.mageia.org/MGASA-2015-0029.html; http://debbugs.gnu.org/cgi/bugreport.cgi?bug=16872; http://secunia.com/advisories/62226
CVE: CVE-2014-9475
Published: 2015-01-16
Description: Cross-site scripting (XSS) vulnerability in thumb.php in MediaWiki before 1.19.23, 1.2x before 1.22.15, 1.23.x before 1.23.8, and 1.24.x before 1.24.1 allows remote authenticated users to inject arbitrary web script or HTML via a wikitext message.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www.debian.org/security/2014/dsa-3110; http://www.mandriva.com/security/advisories?name=MDVSA-2015:006; http://www.openwall.com/lists/oss-security/2014/12/21/2
CVE: CVE-2014-9476
Published: 2015-01-16
Description: MediaWiki 1.2x before 1.22.15, 1.23.x before 1.23.8, and 1.24.x before 1.24.1 allows remote attackers to bypass CORS restrictions in $wgCrossSiteAJAXdomains via a domain that has a partial match to an allowed origin, as demonstrated by "http://en.wikipedia.org.evilsite.example/."
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://www.mandriva.com/security/advisories?name=MDVSA-2015:006; http://www.openwall.com/lists/oss-security/2014/12/21/2; http://www.openwall.com/lists/oss-security/2015/01/03/13
CVE: CVE-2014-9477
Published: 2015-01-16
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Listings extension for MediaWiki allow remote attackers to inject arbitrary web script or HTML via the (1) name or (2) url parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2014/12/21/2; http://www.openwall.com/lists/oss-security/2015/01/03/13; https://lists.wikimedia.org/pipermail/mediawiki-announce/2014-December/000173.html
CVE: CVE-2014-9478
Published: 2015-01-16
Description: Cross-site scripting (XSS) vulnerability in the preview in the ExpandTemplates extension for MediaWiki, when $wgRawHTML is set to true, allows remote attackers to inject arbitrary web script or HTML via the wpInput parameter to the Special:ExpandTemplates page.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2014/12/21/2; http://www.openwall.com/lists/oss-security/2015/01/03/13; https://lists.wikimedia.org/pipermail/mediawiki-announce/2014-December/000173.html