deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-9479
Published: 2015-01-16
Description: Cross-site scripting (XSS) vulnerability in the preview in the TemplateSandbox extension for MediaWiki allows remote attackers to inject arbitrary web script or HTML via the text parameter to Special:TemplateSandbox.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2014/12/21/2; http://www.openwall.com/lists/oss-security/2015/01/03/13; https://lists.wikimedia.org/pipermail/mediawiki-announce/2014-December/000173.html
CVE: CVE-2014-9480
Published: 2015-01-16
Description: Cross-site scripting (XSS) vulnerability in the Hovercards extension for MediaWiki allows remote attackers to inject arbitrary web script or HTML via vectors related to text extracts.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2014/12/21/2; http://www.openwall.com/lists/oss-security/2015/01/03/13; https://lists.wikimedia.org/pipermail/mediawiki-announce/2014-December/000173.html
CVE: CVE-2014-9496
Published: 2015-01-16
Description: The sd2_parse_rsrc_fork function in sd2.c in libsndfile allows attackers to have unspecified impact via vectors related to a (1) map offset or (2) rsrc marker, which triggers an out-of-bounds read.
CVSS Score: 2.1 (LOW)
References: http://advisories.mageia.org/MGASA-2015-0015.html; http://lists.opensuse.org/opensuse-updates/2015-01/msg00016.html; http://secunia.com/advisories/62320
CVE: CVE-2014-9601
Published: 2015-01-16
Description: Pillow before 2.7.0 allows remote attackers to cause a denial of service via a compressed text chunk in a PNG image that has a large size when it is decompressed.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148442.html; http://lists.opensuse.org/opensuse-updates/2015-04/msg00056.html; http://pillow.readthedocs.org/releasenotes/2.7.0.html
CVE: CVE-2015-0219
Published: 2015-01-16
Description: Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 allows remote attackers to spoof WSGI headers by using an _ (underscore) character instead of a - (dash) character in an HTTP header, as demonstrated by an X-Auth_User header.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-17
References: http://advisories.mageia.org/MGASA-2015-0026.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148485.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148608.html
CVE: CVE-2015-0220
Published: 2015-01-16
Description: The django.util.http.is_safe_url function in Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 does not properly handle leading whitespaces, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL, related to redirect URLs, as demonstrated by a "\njavascript:" URL.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://advisories.mageia.org/MGASA-2015-0026.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148485.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148608.html
CVE: CVE-2015-0221
Published: 2015-01-16
Description: The django.views.static.serve view in Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 reads files an entire line at a time, which allows remote attackers to cause a denial of service (memory consumption) via a long line in a file.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://advisories.mageia.org/MGASA-2015-0026.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148485.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148608.html
CVE: CVE-2015-0222
Published: 2015-01-16
Description: ModelMultipleChoiceField in Django 1.6.x before 1.6.10 and 1.7.x before 1.7.3, when show_hidden_initial is set to True, allows remote attackers to cause a denial of service by submitting duplicate values, which triggers a large number of SQL queries.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-17
References: http://advisories.mageia.org/MGASA-2015-0026.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148485.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148608.html
CVE: CVE-2015-1029
Published: 2015-01-16
Description: The puppetlabs-stdlib module 2.1 through 3.0 and 4.1.0 through 4.5.x before 4.5.1 for Puppet 2.8.8 and earlier allows remote authenticated users to gain privileges or obtain sensitive information by prepopulating the fact cache.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://puppetlabs.com/security/cve/cve-2015-1029; http://secunia.com/advisories/62328; http://puppetlabs.com/security/cve/cve-2015-1029
CVE: CVE-2014-9602
Published: 2015-01-16
Description: libavcodec/xface.h in FFmpeg before 2.5.2 establishes certain digits and words array dimensions that do not satisfy a required mathematical relationship, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted X-Face image data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-189
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=93a5a16f136d095d23610f57bdad10ba88120fba; https://security.gentoo.org/glsa/201603-06; http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=93a5a16f136d095d23610f57bdad10ba88120fba
CVE: CVE-2014-9603
Published: 2015-01-16
Description: The vmd_decode function in libavcodec/vmdvideo.c in FFmpeg before 2.5.2 does not validate the relationship between a certain length value and the frame width, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted Sierra VMD video data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=3030fb7e0d41836f8add6399e9a7c7b740b48bfd; https://security.gentoo.org/glsa/201603-06; http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=3030fb7e0d41836f8add6399e9a7c7b740b48bfd
CVE: CVE-2014-9604
Published: 2015-01-16
Description: libavcodec/utvideodec.c in FFmpeg before 2.5.2 does not check for a zero value of a slice height, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted Ut Video data, related to the (1) restore_median and (2) restore_median_il functions.
CVSS Score: 7.5 (HIGH)
CWE: CWE-189
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=[PII_REDACTED]953b9275a247a1c98a567f3c44890f; http://www.ubuntu.com/usn/USN-2534-1; https://security.gentoo.org/glsa/201603-06
CVE: CVE-2014-2355
Published: 2015-01-17
Description: The (1) CimView and (2) CimEdit components in GE Proficy HMI/SCADA-CIMPLICITY 8.2 and earlier allow remote attackers to gain privileges via a crafted CIMPLICITY screen (aka .CIM) file.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-119, CWE-119
References: https://www.cisa.gov/news-events/ics-advisories/icsa-14-289-02; https://ics-cert.us-cert.gov/advisories/ICSA-14-289-02
CVE: CVE-2014-5418
Published: 2015-01-17
Description: GE Multilink ML800, ML1200, ML1600, and ML2400 switches with firmware 4.2.1 and earlier and Multilink ML810, ML3000, and ML3100 switches with firmware 5.2.0 and earlier allow remote attackers to cause a denial of service (resource consumption or reboot) via crafted packets.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-400, CWE-399
References: http://www.gedigitalenergy.com/products/support/multilink/MLSB1214.pdf; https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2015/icsa-15-013-04a.json; https://www.cisa.gov/news-events/ics-advisories/icsa-15-013-04a
CVE: CVE-2014-5419
Published: 2015-01-17
Description: GE Multilink ML800, ML1200, ML1600, and ML2400 switches with firmware 4.2.1 and earlier and Multilink ML810, ML3000, and ML3100 switches with firmware 5.2.0 and earlier use the same RSA private key across different customers' installations, which makes it easier for remote attackers to obtain the cleartext content of network traffic by reading this key from a firmware image and then sniffing the network.
CVSS Score: 10.0 (HIGH)
CWE: CWE-321, CWE-310
References: http://www.gedigitalenergy.com/products/support/multilink/MLSB1214.pdf; https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2015/icsa-15-013-04a.json; https://www.cisa.gov/news-events/ics-advisories/icsa-15-013-04a
CVE: CVE-2014-8143
Published: 2015-01-17
Description: Samba 4.0.x before 4.0.24, 4.1.x before 4.1.16, and 4.2.x before 4.2rc4, when an Active Directory Domain Controller (AD DC) is configured, allows remote authenticated users to set the LDB userAccountControl UF_SERVER_TRUST_ACCOUNT bit, and consequently gain privileges, by leveraging delegation of authority for user-account or computer-account creation.
CVSS Score: 8.5 (HIGH)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00031.html; http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00042.html; http://secunia.com/advisories/62594
CVE: CVE-2014-9194
Published: 2015-01-17
Description: Arbiter 1094B GPS Substation Clock allows remote attackers to cause a denial of service (disruption) via crafted radio transmissions that spoof GPS satellite broadcasts.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-345, CWE-19
References: http://www.arbiter.com/contact/index.php; https://www.cisa.gov/news-events/ics-advisories/icsa-14-345-01; https://ics-cert.us-cert.gov/advisories/ICSA-14-345-01
CVE: CVE-2014-9195
Published: 2015-01-17
Description: Phoenix Contact ProConOs and MultiProg do not require authentication, which allows remote attackers to execute arbitrary commands via protocol-compliant traffic.
CVSS Score: 10.0 (HIGH)
CWE: CWE-306, CWE-255
References: https://www.cisa.gov/news-events/ics-advisories/icsa-15-013-03; https://www.exploit-db.com/exploits/37066/; https://ics-cert.us-cert.gov/advisories/ICSA-15-013-03
CVE: CVE-2014-9199
Published: 2015-01-17
Description: The Clorius Controls Java web client before 01.00.0009g allows remote attackers to discover credentials by sniffing the network for cleartext-equivalent traffic.
CVSS Score: 10.0 (HIGH)
CWE: CWE-326, CWE-200
References: http://www.cloriuscontrols.com; https://www.cisa.gov/news-events/ics-advisories/icsa-15-013-02; https://ics-cert.us-cert.gov/advisories/ICSA-15-013-02
CVE: CVE-2014-3018
Published: 2015-01-17
Description: IBM BladeCenter SAS Connectivity Module (aka NSSM) and SAS RAID Module (aka RSSM) before 1.3.3.006 allow remote attackers to cause a denial of service (reboot) via a flood of IP packets.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5096774; https://exchange.xforce.ibmcloud.com/vulnerabilities/93052; http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5096774
CVE: CVE-2014-3019
Published: 2015-01-17
Description: IBM BladeCenter SAS Connectivity Module (aka NSSM) and SAS RAID Module (aka RSSM) before 1.3.3.006 allow remote attackers to obtain blade and storage-pool access via a TELNET session.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5096774; https://exchange.xforce.ibmcloud.com/vulnerabilities/93054; http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5096774
CVE: CVE-2014-3032
Published: 2015-01-17
Description: Cross-site scripting (XSS) vulnerability in the Web GUI in IBM Tivoli Netcool/OMNIbus 7.3.0 before 7.3.0.6, 7.3.1 before 7.3.1.7, and 7.4.0 before 7.4.0.3 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21694026; https://exchange.xforce.ibmcloud.com/vulnerabilities/93188; http://www-01.ibm.com/support/docview.wss?uid=swg21694026
CVE: CVE-2014-4835
Published: 2015-01-17
Description: IBM ServerGuide before 9.63, UpdateXpress System Packs Installer (UXSPI) before 9.63, and ToolsCenter Suite before 9.63 place credentials in logs, which allows local users to obtain sensitive information by reading a file.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5096777; https://exchange.xforce.ibmcloud.com/vulnerabilities/95629; http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5096777
CVE: CVE-2014-6197
Published: 2015-01-17
Description: IBM Security Network Protection 5.1.x and 5.2.x before 5.2.0.0 FP5 and 5.3.x before 5.3.0.0 FP1 allows remote attackers to conduct clickjacking attacks via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://www-01.ibm.com/support/docview.wss?uid=swg21693542; https://exchange.xforce.ibmcloud.com/vulnerabilities/98609; http://www-01.ibm.com/support/docview.wss?uid=swg21693542
CVE: CVE-2015-0590
Published: 2015-01-17
Description: Cisco WebEx Meeting Center allows remote attackers to activate disabled meeting attributes, and consequently obtain sensitive information, by providing crafted parameters during a meeting-join action, aka Bug ID CSCuo34165.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015-0590; http://www.securitytracker.com/id/1031558; https://exchange.xforce.ibmcloud.com/vulnerabilities/100576
CVE: CVE-2015-0924
Published: 2015-01-17
Description: Ceragon FibeAir IP-10 bridges have a default password for the root account, which makes it easier for remote attackers to obtain access via a (1) HTTP, (2) SSH, (3) TELNET, or (4) CLI session.
CVSS Score: 7.8 (HIGH)
CWE: CWE-255
References: http://www.kb.cert.org/vuls/id/936356; http://www.kb.cert.org/vuls/id/936356
CVE: CVE-2014-7865
Published: 2015-01-18
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its requester.  Further investigation showed that it was not a security issue.  Notes: none
CVE: CVE-2013-7252
Published: 2015-01-18
Description: kwalletd in KWallet before KDE Applications 14.12.0 uses Blowfish with ECB mode instead of CBC mode when encrypting the password store, which makes it easier for attackers to guess passwords via a codebook attack.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://gaganpreet.in/blog/2013/07/24/kwallet-security-analysis/; http://www.openwall.com/lists/oss-security/2014/01/02/3; http://www.openwall.com/lists/oss-security/2015/01/09/7
CVE: CVE-2015-0862
Published: 2015-01-18
Description: Multiple cross-site scripting (XSS) vulnerabilities in the management web UI in the RabbitMQ management plugin before 3.4.3 allow remote authenticated users to inject arbitrary web script or HTML via (1) message details when a message is unqueued, such as headers or arguments; (2) policy names, which are not properly handled when viewing policies; (3) details for AMQP network clients, such as the version; allow remote authenticated administrators to inject arbitrary web script or HTML via (4) user names, (5) the cluster name; or allow RabbitMQ cluster administrators to (6) modify unspecified content.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www.rabbitmq.com/news.html#2015-01-08T10:14:05+0100; http://www.rabbitmq.com/news.html#2015-01-08T10:14:05+0100
CVE: CVE-2015-0973
Published: 2015-01-18
Description: Buffer overflow in the png_read_IDAT_data function in pngrutil.c in libpng before 1.5.21 and 1.6.x before 1.6.16 allows context-dependent attackers to execute arbitrary code via IDAT data with a large width, a different vulnerability than CVE-2014-9495.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120
References: http://lists.apple.com/archives/security-announce/2016/Mar/msg00004.html; http://secunia.com/advisories/62725; http://sourceforge.net/p/png-mng/mailman/message/33173461/
CVE: CVE-2014-8386
Published: 2015-01-20
Description: Multiple stack-based buffer overflows in Advantech AdamView 4.3 and earlier allow remote attackers to execute arbitrary code via a crafted (1) display properties or (2) conditional bitmap parameter in a GNI file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://seclists.org/fulldisclosure/2014/Nov/57; http://www.coresecurity.com/advisories/advantech-adamView-buffer-overflow; http://www.exploit-db.com/exploits/35503
CVE: CVE-2014-8625
Published: 2015-01-20
Description: Multiple format string vulnerabilities in the parse_error_msg function in parsehelp.c in dpkg before 1.17.22 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via format string specifiers in the (1) package or (2) architecture name.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-134
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157387.html; http://seclists.org/oss-sec/2014/q4/539; http://seclists.org/oss-sec/2014/q4/551
CVE: CVE-2014-8790
Published: 2015-01-20
Description: XML external entity (XXE) vulnerability in admin/api.php in GetSimple CMS 3.1.1 through 3.3.x before 3.3.5 Beta 1, when in certain configurations, allows remote attackers to read arbitrary files via the data parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://get-simple.info/start/changelog/; http://karmainsecurity.com/KIS-2014-17; http://packetstormsecurity.com/files/129778/GetSimple-CMS-3.3.4-XML-External-Entity-Injection.html
CVE: CVE-2014-9330
Published: 2015-01-20
Description: Integer overflow in tif_packbits.c in bmp2tif in libtiff 4.0.3 allows remote attackers to cause a denial of service (crash) via crafted BMP image, related to dimensions, which triggers an out-of-bounds read.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://bugzilla.maptools.org/show_bug.cgi?id=2494; http://rhn.redhat.com/errata/RHSA-2016-1546.html; http://rhn.redhat.com/errata/RHSA-2016-1547.html
CVE: CVE-2014-9490
Published: 2015-01-20
Description: The numtok function in lib/raven/okjson.rb in the raven-ruby gem before 0.12.2 for Ruby allows remote attackers to cause a denial of service via a large exponent value in a scientific number.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://seclists.org/oss-sec/2015/q1/26; https://exchange.xforce.ibmcloud.com/vulnerabilities/99687; https://github.com/getsentry/raven-ruby/commit/477ee93a3f735be33bc1e726820654cdf6e22d8f
CVE: CVE-2014-9491
Published: 2015-01-20
Description: The devzvol_readdir function in illumos does not check the return value of a strchr call, which allows remote attackers to cause a denial of service (NULL pointer dereference and panic) via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://seclists.org/oss-sec/2015/q1/27; https://exchange.xforce.ibmcloud.com/vulnerabilities/99686; https://github.com/illumos/illumos-gate/commit/d[PII_REDACTED][PII_REDACTED]b5c40ae2c479460b4b5
CVE: CVE-2014-9494
Published: 2015-01-20
Description: RabbitMQ before 3.4.0 allows remote attackers to bypass the loopback_users restriction via a crafted X-Forwareded-For header.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://seclists.org/oss-sec/2015/q1/30; http://www.rabbitmq.com/release-notes/README-3.4.0.txt; https://exchange.xforce.ibmcloud.com/vulnerabilities/99685
CVE: CVE-2015-1030
Published: 2015-01-20
Description: Memory leak in the rfc2553_connect_to function in jbsocket.c in Privoxy before 3.0.22 allows remote attackers to cause a denial of service (memory consumption) via a large number of requests that are rejected because the socket limit is reached.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://secunia.com/advisories/62123; http://www.openwall.com/lists/oss-security/2015/01/11/1; http://www.privoxy.org/announce.txt
CVE: CVE-2015-1201
Published: 2015-01-20
Description: Privoxy before 3.0.22 allows remote attackers to cause a denial of service (file descriptor consumption) via unspecified vectors.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/62123; http://secunia.com/advisories/62123
CVE: CVE-2014-0191
Published: 2015-01-21
Description: The xmlParserHandlePEReference function in parser.c in libxml2 before 2.9.2, as used in Web Listener in Oracle HTTP Server in Oracle Fusion Middleware 11.1.1.7.0, 12.1.2.0, and 12.1.3.0 and other products, loads external parameter entities regardless of whether entity substitution or validation is enabled, which allows remote attackers to cause a denial of service (resource consumption) via a crafted XML document.
CVSS Score: 4.3 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html; http://lists.apple.com/archives/security-announce/2015/Aug/msg00002.html; http://lists.opensuse.org/opensuse-updates/2015-12/msg00120.html
CVE: CVE-2014-4259
Published: 2015-01-21
Description: Unspecified vulnerability in the Solaris Cluster component in Oracle Sun Systems Products Suite 3.3 and 4.1 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors related to System management.
CVSS Score: 9.0 (HIGH)
References: http://www.oracle.com/technetwork/topics/security/cpujan2[PII_REDACTED].html; http://www.securitytracker.com/id/1031583; http://www.oracle.com/technetwork/topics/security/cpujan2[PII_REDACTED].html
CVE: CVE-2014-4279
Published: 2015-01-21
Description: Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.53 allows remote authenticated users to affect integrity via vectors related to PIA Core Technology.
CVSS Score: 3.5 (LOW)
References: http://www.oracle.com/technetwork/topics/security/cpujan2[PII_REDACTED].html; http://www.securitytracker.com/id/1031577; http://www.oracle.com/technetwork/topics/security/cpujan2[PII_REDACTED].html
CVE: CVE-2014-6480
Published: 2015-01-21
Description: Unspecified vulnerability in the Solaris Cluster component in Oracle Sun Systems Products Suite 3.3 and 4.1 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to System management.
CVSS Score: 6.5 (MEDIUM)
References: http://www.oracle.com/technetwork/topics/security/cpujan2[PII_REDACTED].html; http://www.securitytracker.com/id/1031583; http://www.oracle.com/technetwork/topics/security/cpujan2[PII_REDACTED].html
CVE: CVE-2014-6481
Published: 2015-01-21
Description: Unspecified vulnerability in Oracle Solaris 10 and 11 allows remote attackers to affect confidentiality via vectors related to KSSL.
CVSS Score: 4.3 (MEDIUM)
References: http://www.oracle.com/technetwork/topics/security/cpujan2[PII_REDACTED].html; http://www.securitytracker.com/id/1031583; http://www.oracle.com/technetwork/topics/security/cpujan2[PII_REDACTED].html
CVE: CVE-2014-6509
Published: 2015-01-21
Description: Unspecified vulnerability in Oracle Solaris 10 allows local users to affect availability via unknown vectors related to Kernel.
CVSS Score: 4.9 (MEDIUM)
References: http://www.oracle.com/technetwork/topics/security/cpujan2[PII_REDACTED].html; http://www.securitytracker.com/id/1031583; http://www.oracle.com/technetwork/topics/security/cpujan2[PII_REDACTED].html
CVE: CVE-2014-6510
Published: 2015-01-21
Description: Unspecified vulnerability in Oracle Solaris 11 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Power Management Utility.
CVSS Score: 7.2 (HIGH)
References: http://www.oracle.com/technetwork/topics/security/cpujan2[PII_REDACTED].html; http://www.securitytracker.com/id/1031583; http://www.oracle.com/technetwork/topics/security/cpujan2[PII_REDACTED].html
CVE: CVE-2014-6514
Published: 2015-01-21
Description: Unspecified vulnerability in the PL/SQL component in Oracle Database Server 11.1.0.7, 11.2.0.3, 11.2.0.4, and 12.1.0.1 allows remote authenticated users to affect confidentiality via unknown vectors.
CVSS Score: 4.0 (MEDIUM)
References: http://www.oracle.com/technetwork/topics/security/cpujan2[PII_REDACTED].html; http://www.securityfocus.com/bid/72166; http://www.securitytracker.com/id/1031572