deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-0544
Published: 2014-08-12
Description: Adobe Flash Player before 13.0.0.241 and 14.x before 14.0.0.176 on Windows and OS X and before 11.2.202.400 on Linux, Adobe AIR before 14.0.0.178 on Windows and OS X and before 14.0.0.179 on Android, Adobe AIR SDK before 14.0.0.178, and Adobe AIR SDK & Compiler before 14.0.0.178 do not properly restrict discovery of memory addresses, which allows attackers to bypass the ASLR protection mechanism via unspecified vectors, a different vulnerability than CVE-2014-0540, CVE-2014-0542, CVE-2014-0543, and CVE-2014-0545.
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://helpx.adobe.com/security/products/flash-player/apsb14-18.html; http://secunia.com/advisories/60710; http://secunia.com/advisories/60732
CVE: CVE-2014-0545
Published: 2014-08-12
Description: Adobe Flash Player before 13.0.0.241 and 14.x before 14.0.0.176 on Windows and OS X and before 11.2.202.400 on Linux, Adobe AIR before 14.0.0.178 on Windows and OS X and before 14.0.0.179 on Android, Adobe AIR SDK before 14.0.0.178, and Adobe AIR SDK & Compiler before 14.0.0.178 do not properly restrict discovery of memory addresses, which allows attackers to bypass the ASLR protection mechanism via unspecified vectors, a different vulnerability than CVE-2014-0540, CVE-2014-0542, CVE-2014-0543, and CVE-2014-0544.
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://helpx.adobe.com/security/products/flash-player/apsb14-18.html; http://secunia.com/advisories/60710; http://secunia.com/advisories/60732
CVE: CVE-2014-3337
Published: 2014-08-12
Description: The SIP implementation in Cisco Unified Communications Manager (CM) 8.6(.2) and earlier allows remote authenticated users to cause a denial of service (process crash) via a crafted SIP message that is not properly handled during processing of an XML document, aka Bug ID CSCtq76428.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/60088; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3337; http://tools.cisco.com/security/center/viewAlert.x?alertId=35257
CVE: CVE-2014-1222
Published: 2014-08-12
Description: Directory traversal vulnerability in kcfinder/browse.php in Vtiger CRM before 6.0.0 Security patch 1 allows remote authenticated users to read arbitrary files via a .. (dot dot) in the file parameter in a download action.  NOTE: it is likely that this issue is actually in the KCFinder third-party component, and it affects additional products besides Vtiger CRM.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-22
References: http://sourceforge.net/projects/vtigercrm/files/vtiger%20CRM%206.0.0/Add-ons/vtigercrm-600-security-patch1.zip/download; http://www.securityfocus.com/archive/1/531423/100/0/threaded; https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-1222/
CVE: CVE-2014-3251
Published: 2014-08-12
Description: The MCollective aes_security plugin, as used in Puppet Enterprise before 3.3.0 and Mcollective before 2.5.3, does not properly validate new server certificates based on the CA certificate, which allows local users to establish unauthorized Mcollective connections via unspecified vectors related to a race condition.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-362
References: http://puppetlabs.com/security/cve/cve-2014-3251; http://secunia.com/advisories/59356; http://secunia.com/advisories/60066
CVE: CVE-2014-3338
Published: 2014-08-12
Description: The CTIManager module in Cisco Unified Communications Manager (CM) 10.0(1), when single sign-on is enabled, does not properly validate Kerberos SSO tokens, which allows remote authenticated users to gain privileges and execute arbitrary commands via crafted token data, aka Bug ID CSCum95491.
CVSS Score: 8.5 (HIGH)
CWE: CWE-20
References: http://secunia.com/advisories/60054; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3338; http://tools.cisco.com/security/center/viewAlert.x?alertId=35258
CVE: CVE-2014-3339
Published: 2014-08-12
Description: Multiple SQL injection vulnerabilities in the administrative web interface in Cisco Unified Communications Manager (CM) and Cisco Unified Presence Server (CUPS) allow remote authenticated users to execute arbitrary SQL commands via crafted input to unspecified pages, aka Bug ID CSCup74290.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3339; http://www.securityfocus.com/bid/69200; https://exchange.xforce.ibmcloud.com/vulnerabilities/95250
CVE: CVE-2014-3901
Published: 2014-08-12
Description: Raritan Japan Dominion KX2-101 switches before 2 allow remote attackers to cause a denial of service (device hang) via a crafted packet.
CVSS Score: 7.8 (HIGH)
References: http://jvn.jp/en/jp/JVN07957080/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2014-000097; http://jvn.jp/en/jp/JVN07957080/index.html
CVE: CVE-2014-5202
Published: 2014-08-12
Description: Cross-site scripting (XSS) vulnerability in compfight-search.php in the Compfight plugin 1.4 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the search-value parameter.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://downloads.wordpress.org/plugin/compfight.1.5.zip; http://packetstormsecurity.com/files/127430/WordPress-Compfight-1.4-Cross-Site-Scripting.html; http://wordpress.org/plugins/compfight/changelog/
CVE: CVE-2014-3165
Published: 2014-08-13
Description: Use-after-free vulnerability in modules/websockets/WorkerThreadableWebSocketChannel.cpp in the Web Sockets implementation in Blink, as used in Google Chrome before 36.0.1985.143, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger an unexpectedly long lifetime of a temporary object during method completion.
CVSS Score: 7.5 (HIGH)
References: http://googlechromereleases.blogspot.com/2014/08/stable-channel-update.html; http://secunia.com/advisories/59904; http://secunia.com/advisories/60798
CVE: CVE-2014-3166
Published: 2014-08-13
Description: The Public Key Pinning (PKP) implementation in Google Chrome before 36.0.1985.143 on Windows, OS X, and Linux, and before 36.0.1985.135 on Android, does not correctly consider the properties of SPDY connections, which allows remote attackers to obtain sensitive information by leveraging the use of multiple domain names.
CVSS Score: 4.3 (MEDIUM)
References: http://googlechromereleases.blogspot.com/2014/08/chrome-for-android-update.html; http://googlechromereleases.blogspot.com/2014/08/chrome-for-ios-update.html; http://googlechromereleases.blogspot.com/2014/08/stable-channel-update.html
CVE: CVE-2014-3167
Published: 2014-08-13
Description: Multiple unspecified vulnerabilities in Google Chrome before 36.0.1985.143 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://googlechromereleases.blogspot.com/2014/08/stable-channel-update.html; http://secunia.com/advisories/59904; http://secunia.com/advisories/60798
CVE: CVE-2014-5157
Published: 2014-08-13
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2014-5196.  Reason: This candidate is a reservation duplicate of CVE-2014-5196.  Notes: All CVE users should reference CVE-2014-5196 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2014-3505
Published: 2014-08-13
Description: Double free vulnerability in d1_both.c in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allows remote attackers to cause a denial of service (application crash) via crafted DTLS packets that trigger an error condition.
CVSS Score: 5.0 (MEDIUM)
References: ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2014-008.txt.asc; http://aix.software.ibm.com/aix/efixes/security/openssl_advisory10.asc; http://linux.oracle.com/errata/ELSA-2014-1052.html
CVE: CVE-2014-3506
Published: 2014-08-13
Description: d1_both.c in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allows remote attackers to cause a denial of service (memory consumption) via crafted DTLS handshake messages that trigger memory allocations corresponding to large length values.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2014-008.txt.asc; http://aix.software.ibm.com/aix/efixes/security/openssl_advisory10.asc; http://linux.oracle.com/errata/ELSA-2014-1052.html
CVE: CVE-2014-3507
Published: 2014-08-13
Description: Memory leak in d1_both.c in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allows remote attackers to cause a denial of service (memory consumption) via zero-length DTLS fragments that trigger improper handling of the return value of a certain insert function.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2014-008.txt.asc; http://aix.software.ibm.com/aix/efixes/security/openssl_advisory10.asc; http://linux.oracle.com/errata/ELSA-2014-1052.html
CVE: CVE-2014-3508
Published: 2014-08-13
Description: The OBJ_obj2txt function in crypto/objects/obj_dat.c in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i, when pretty printing is used, does not ensure the presence of '\0' characters, which allows context-dependent attackers to obtain sensitive information from process stack memory by reading output from X509_name_oneline, X509_name_print_ex, and unspecified other functions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2014-008.txt.asc; http://aix.software.ibm.com/aix/efixes/security/openssl_advisory10.asc; http://linux.oracle.com/errata/ELSA-2014-1052.html
CVE: CVE-2014-3509
Published: 2014-08-13
Description: Race condition in the ssl_parse_serverhello_tlsext function in t1_lib.c in OpenSSL 1.0.0 before 1.0.0n and 1.0.1 before 1.0.1i, when multithreading and session resumption are used, allows remote SSL servers to cause a denial of service (memory overwrite and client application crash) or possibly have unspecified other impact by sending Elliptic Curve (EC) Supported Point Formats Extension data.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-362
References: ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2014-008.txt.asc; http://aix.software.ibm.com/aix/efixes/security/openssl_advisory10.asc; http://linux.oracle.com/errata/ELSA-2014-1052.html
CVE: CVE-2014-3510
Published: 2014-08-13
Description: The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allows remote DTLS servers to cause a denial of service (NULL pointer dereference and client application crash) via a crafted handshake message in conjunction with a (1) anonymous DH or (2) anonymous ECDH ciphersuite.
CVSS Score: 4.3 (MEDIUM)
References: ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2014-008.txt.asc; http://aix.software.ibm.com/aix/efixes/security/openssl_advisory10.asc; http://linux.oracle.com/errata/ELSA-2014-1052.html
CVE: CVE-2014-3511
Published: 2014-08-13
Description: The ssl23_get_client_hello function in s23_srvr.c in OpenSSL 1.0.1 before 1.0.1i allows man-in-the-middle attackers to force the use of TLS 1.0 by triggering ClientHello message fragmentation in communication between a client and server that both support later TLS versions, related to a "protocol downgrade" issue.
CVSS Score: 4.3 (MEDIUM)
References: ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2014-008.txt.asc; http://aix.software.ibm.com/aix/efixes/security/openssl_advisory10.asc; http://linux.oracle.com/errata/ELSA-2014-1052.html
CVE: CVE-2014-3512
Published: 2014-08-13
Description: Multiple buffer overflows in crypto/srp/srp_lib.c in the SRP implementation in OpenSSL 1.0.1 before 1.0.1i allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via an invalid SRP (1) g, (2) A, or (3) B parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2014-008.txt.asc; http://aix.software.ibm.com/aix/efixes/security/openssl_advisory10.asc; http://lists.opensuse.org/opensuse-updates/2014-08/msg00036.html
CVE: CVE-2014-5139
Published: 2014-08-13
Description: The ssl_set_client_disabled function in t1_lib.c in OpenSSL 1.0.1 before 1.0.1i allows remote SSL servers to cause a denial of service (NULL pointer dereference and client application crash) via a ServerHello message that includes an SRP ciphersuite without the required negotiation of that ciphersuite with the client.
CVSS Score: 4.3 (MEDIUM)
References: ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2014-008.txt.asc; http://aix.software.ibm.com/aix/efixes/security/openssl_advisory10.asc; http://lists.opensuse.org/opensuse-updates/2014-08/msg00036.html
CVE: CVE-2014-1980
Published: 2014-08-14
Description: Cross-site scripting (XSS) vulnerability in include/functions_metadata.inc.php in Piwigo before 2.4.6 allows remote attackers to inject arbitrary web script or HTML via the Make field in IPTC Exif metadata within an image uploaded to the Community plugin.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN80310172/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2014-000092; http://piwigo.org/bugs/view.php?id=2805
CVE: CVE-2014-3898
Published: 2014-08-14
Description: Cross-site scripting (XSS) vulnerability in Fujitsu ServerView Operations Manager 5.00.09 through 6.30.05 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jp.fujitsu.com/platform/server/primequest/products/2000/catalog/manual/support/note_140729_svom.html; http://jp.fujitsu.com/platform/server/primergy/note/page20.html; http://jvn.jp/en/jp/JVN22534185/index.html
CVE: CVE-2014-4343
Published: 2014-08-14
Description: Double free vulnerability in the init_ctx_reselect function in the SPNEGO initiator in lib/gssapi/spnego/spnego_mech.c in MIT Kerberos 5 (aka krb5) 1.10.x through 1.12.x before 1.12.2 allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via network traffic that appears to come from an intended acceptor, but specifies a security mechanism different from the one proposed by the initiator.
CVSS Score: 7.6 (HIGH)
CWE: CWE-415
References: http://advisories.mageia.org/MGASA-2014-0345.html; http://aix.software.ibm.com/aix/efixes/security/nas_advisory1.asc; http://krbdev.mit.edu/rt/Ticket/Display.html?id=7969
CVE: CVE-2014-4344
Published: 2014-08-14
Description: The acc_ctx_cont function in the SPNEGO acceptor in lib/gssapi/spnego/spnego_mech.c in MIT Kerberos 5 (aka krb5) 1.5.x through 1.12.x before 1.12.2 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an empty continuation token at a certain point during a SPNEGO negotiation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-476
References: http://advisories.mageia.org/MGASA-2014-0345.html; http://aix.software.ibm.com/aix/efixes/security/nas_advisory1.asc; http://krbdev.mit.edu/rt/Ticket/Display.html?id=7970
CVE: CVE-2014-4345
Published: 2014-08-14
Description: Off-by-one error in the krb5_encode_krbsecretkey function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in the LDAP KDB module in kadmind in MIT Kerberos 5 (aka krb5) 1.6.x through 1.11.x before 1.11.6 and 1.12.x before 1.12.2 allows remote authenticated users to cause a denial of service (buffer overflow) or possibly execute arbitrary code via a series of "cpw -keepold" commands.
CVSS Score: 8.5 (HIGH)
CWE: CWE-189
References: http://advisories.mageia.org/MGASA-2014-0345.html; http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705; http://krbdev.mit.edu/rt/Ticket/Display.html?id=7980
CVE: CVE-2014-5239
Published: 2014-08-14
Description: The Microsoft Outlook.com application before 7.8.2.12.49.7090 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-310
References: http://jvn.jp/en/jp/JVN72950786/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2014-000086; http://www.securitytracker.com/id/1030733
CVE: CVE-2014-1384
Published: 2014-08-14
Description: WebKit, as used in Apple Safari before 6.1.6 and 7.x before 7.0.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in HT6367.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2014-09/0106.html; http://archives.neohapsis.com/archives/bugtraq/2014-09/0107.html; http://secunia.com/advisories/60705
CVE: CVE-2014-1385
Published: 2014-08-14
Description: WebKit, as used in Apple Safari before 6.1.6 and 7.x before 7.0.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in HT6367.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2014-09/0106.html; http://archives.neohapsis.com/archives/bugtraq/2014-09/0107.html; http://secunia.com/advisories/60705
CVE: CVE-2014-1386
Published: 2014-08-14
Description: WebKit, as used in Apple Safari before 6.1.6 and 7.x before 7.0.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in HT6367.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://secunia.com/advisories/60705; http://support.apple.com/kb/HT6367; http://www.securityfocus.com/bid/69223
CVE: CVE-2014-1387
Published: 2014-08-14
Description: WebKit, as used in Apple Safari before 6.1.6 and 7.x before 7.0.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in HT6367.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2014-09/0106.html; http://archives.neohapsis.com/archives/bugtraq/2014-09/0107.html; http://secunia.com/advisories/60705
CVE: CVE-2014-1388
Published: 2014-08-14
Description: WebKit, as used in Apple Safari before 6.1.6 and 7.x before 7.0.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in HT6367.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2014-09/0106.html; http://archives.neohapsis.com/archives/bugtraq/2014-09/0107.html; http://secunia.com/advisories/60705
CVE: CVE-2014-1389
Published: 2014-08-14
Description: WebKit, as used in Apple Safari before 6.1.6 and 7.x before 7.0.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in HT6367.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2014-09/0106.html; http://archives.neohapsis.com/archives/bugtraq/2014-09/0107.html; http://secunia.com/advisories/60705
CVE: CVE-2014-1390
Published: 2014-08-14
Description: WebKit, as used in Apple Safari before 6.1.6 and 7.x before 7.0.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in HT6367.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://secunia.com/advisories/60705; http://support.apple.com/kb/HT6367; http://www.securityfocus.com/bid/69223
CVE: CVE-2014-1546
Published: 2014-08-14
Description: The response function in the JSONP endpoint in WebService/Server/JSONRPC.pm in jsonrpc.cgi in Bugzilla 3.x and 4.x before 4.0.14, 4.1.x and 4.2.x before 4.2.10, 4.3.x and 4.4.x before 4.4.5, and 4.5.x before 4.5.5 accepts certain long callback values and does not restrict the initial bytes of a JSONP response, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks, and obtain sensitive information, via a crafted OBJECT element with SWF content consistent with the _bz_callback character set.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: http://advisories.mageia.org/MGASA-2014-0349.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136217.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136369.html
CVE: CVE-2012-0938
Published: 2014-08-14
Description: Multiple SQL injection vulnerabilities in TestLink 1.9.3, 1.8.5b, and earlier allow remote authenticated users with certain permissions to execute arbitrary SQL commands via the root_node parameter in the display_children function to (1) getrequirementnodes.php or (2) gettprojectnodes.php in lib/ajax/; the (3) cfield_id parameter in an edit action to lib/cfields/cfieldsEdit.php; the (4) id parameter in an edit action or (5) plan_id parameter in a create action to lib/plan/planMilestonesEdit.php; or the req_spec_id parameter to (6) reqImport.php or (7) in a create action to reqEdit.php in lib/requirements/.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://archives.neohapsis.com/archives/bugtraq/2012-02/0104.html; http://osvdb.org/79450; http://osvdb.org/79451
CVE: CVE-2012-0939
Published: 2014-08-14
Description: Multiple SQL injection vulnerabilities in TestLink 1.8.5b and earlier allow remote authenticated users with the Requirement view permission to execute arbitrary SQL commands via the req_spec_id parameter to (1) reqSpecAnalyse.php, (2) reqSpecPrint.php, or (3) reqSpecView.php in requirements/.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://archives.neohapsis.com/archives/bugtraq/2012-02/0104.html; http://osvdb.org/79447; http://osvdb.org/79448
CVE: CVE-2012-3820
Published: 2014-08-14
Description: Multiple SQL injection vulnerabilities in Campaign11.exe in Arial Software Campaign Enterprise before 11.0.551 allow remote attackers to execute arbitrary SQL commands via the (1) SerialNumber field to activate.asp or (2) UID field to User-Edit.asp.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/86491; http://osvdb.org/86492; http://sadgeeksinsnow.blogspot.dk/2012/10/my-first-experiences-bug-hunting-part-2.html
CVE: CVE-2012-5683
Published: 2014-08-14
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in ZPanel 10.0.1 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) create new FTP users via a CreateFTP action in the ftp_management module to the default URI, (2) conduct cross-site scripting (XSS) attacks via the inFullname parameter in an UpdateAccountSettings action in the my_account module to zpanel/, or (3) conduct SQL injection attacks via the inEmailAddress parameter in an UpdateClient action in the manage_clients module to the default URI.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://osvdb.org/show/osvdb/87140; http://packetstormsecurity.com/files/117894/ZPanel-10.0.1-XSS-CSRF-SQL-Injection.html; http://secunia.com/advisories/51172