deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-3851
Published: 2014-08-07
Description: usr/lib/cgi-bin/create_passwd_file.py in Pyplate 0.08 uses world-readable permissions for passwd.db, which allows local users to obtain the administrator password by reading this file.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://www.openwall.com/lists/oss-security/2014/05/14/3; http://www.openwall.com/lists/oss-security/2014/05/23/1; http://www.openwall.com/lists/oss-security/2014/05/14/3
CVE: CVE-2014-3852
Published: 2014-08-07
Description: Pyplate 0.08 does not include the HTTPOnly flag in a Set-Cookie header for the id cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www.openwall.com/lists/oss-security/2014/05/14/3; http://www.openwall.com/lists/oss-security/2014/05/23/1; http://www.openwall.com/lists/oss-security/2014/05/14/3
CVE: CVE-2014-3853
Published: 2014-08-07
Description: Pyplate 0.08 does not set the secure flag for the id cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www.openwall.com/lists/oss-security/2014/05/14/3; http://www.openwall.com/lists/oss-security/2014/05/23/1; http://www.openwall.com/lists/oss-security/2014/05/14/3
CVE: CVE-2014-3854
Published: 2014-08-07
Description: Cross-site request forgery (CSRF) vulnerability in admin/addScript.py in Pyplate 0.08 allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the title parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2014/05/14/3; http://www.openwall.com/lists/oss-security/2014/05/23/1; http://www.openwall.com/lists/oss-security/2014/05/14/3
CVE: CVE-2014-3855
Published: 2014-08-07
Description: Directory traversal vulnerability in download.py in Pyplate 0.08 allows remote attackers to read arbitrary files via a .. (dot dot) in the filename parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://www.openwall.com/lists/oss-security/2014/05/14/3; http://www.openwall.com/lists/oss-security/2014/05/23/1; http://www.openwall.com/lists/oss-security/2014/05/14/3
CVE: CVE-2014-3914
Published: 2014-08-07
Description: Directory traversal vulnerability in the Admin Center for Tivoli Storage Manager (TSM) in Rocket ServerGraph 1.2 allows remote attackers to (1) create arbitrary files via a .. (dot dot) in the query parameter in a writeDataFile action to the fileRequestor servlet, execute arbitrary files via a .. (dot dot) in the query parameter in a (2) run or (3) runClear action to the fileRequestor servlet, (4) read arbitrary files via a readDataFile action to the fileRequestor servlet, (5) execute arbitrary code via a save_server_groups action to the userRequest servlet, or (6) delete arbitrary files via a del action in the fileRequestServlet servlet.
CVSS Score: 10.0 (HIGH)
CWE: CWE-22
References: http://www.exploit-db.com/exploits/33807; http://zerodayinitiative.com/advisories/ZDI-14-161/; http://zerodayinitiative.com/advisories/ZDI-14-162/
CVE: CVE-2014-4647
Published: 2014-08-07
Description: Stack-based buffer overflow in the loadExtensionFactory method in the TSVisualization ActiveX control in Embarcadero ER/Studio Data Architect allows remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://www.securityfocus.com/bid/68489; http://zerodayinitiative.com/advisories/ZDI-14-224/; https://exchange.xforce.ibmcloud.com/vulnerabilities/94480
CVE: CVE-2014-5188
Published: 2014-08-07
Description: Cross-site scripting (XSS) vulnerability in doemailpassword.tml in Lyris ListManager (LM) 8.95a allows remote attackers to inject arbitrary web script or HTML via the EmailAddr parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/127672/Lyris-ListManagerWeb-8.95a-Cross-Site-Scripting.html; http://www.securityfocus.com/bid/68973; http://xerosecurity.com/?p=94
CVE: CVE-2014-5189
Published: 2014-08-07
Description: SQL injection vulnerability in lib/optin/optin_page.php in the Lead Octopus plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/show/osvdb/109642; http://packetstormsecurity.com/files/127640/WordPress-Lead-Octopus-Power-SQL-Injection.html; http://www.securityfocus.com/bid/68934
CVE: CVE-2014-5190
Published: 2014-08-07
Description: Cross-site scripting (XSS) vulnerability in captcha-secureimage/test/index.php in the SI CAPTCHA Anti-Spam plugin 2.7.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/127723/WordPress-SI-CAPTCHA-Cross-Site-Scripting.html; http://www.securityfocus.com/bid/69011; https://exchange.xforce.ibmcloud.com/vulnerabilities/95104
CVE: CVE-2014-5191
Published: 2014-08-07
Description: Cross-site scripting (XSS) vulnerability in the Preview plugin before 4.4.3 in CKEditor allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://ckeditor.com/node/136981; http://secunia.com/advisories/60036; http://www.securityfocus.com/bid/69161
CVE: CVE-2014-5192
Published: 2014-08-07
Description: SQL injection vulnerability in admin/admin.php in Sphider 1.3.6 allows remote attackers to execute arbitrary SQL commands via the filter parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/34189; https://exchange.xforce.ibmcloud.com/vulnerabilities/95016; http://www.exploit-db.com/exploits/34189
CVE: CVE-2014-5193
Published: 2014-08-07
Description: Cross-site scripting (XSS) vulnerability in admin/admin.php in Sphider 1.3.6 allows remote attackers to inject arbitrary web script or HTML via the category parameter.  NOTE: the url parameter vector is already covered by CVE-2014-5082.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/show/osvdb/109799; http://osvdb.org/show/osvdb/109800; http://www.exploit-db.com/exploits/34189
CVE: CVE-2014-5194
Published: 2014-08-07
Description: Static code injection vulnerability in admin/admin.php in Sphider 1.3.6 allows remote authenticated users to inject arbitrary PHP code into settings/conf.php via the _word_upper_bound parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-94
References: http://packetstormsecurity.com/files/159715/Sphider-Search-Engine-1.3.6-Remote-Code-Execution.html; http://www.exploit-db.com/exploits/34189; http://packetstormsecurity.com/files/159715/Sphider-Search-Engine-1.3.6-Remote-Code-Execution.html
CVE: CVE-2014-5195
Published: 2014-08-07
Description: Unity before 7.2.3 and 7.3.x before 7.3.1, as used in Ubuntu, does not properly take focus of the keyboard when switching to the lock screen, which allows physically proximate attackers to bypass the lock screen by (1) leveraging a machine that had text selected when locking or (2) resuming from a suspension.
CVSS Score: 7.2 (HIGH)
CWE: CWE-362
References: http://www.osvdb.org/109788; http://www.securityfocus.com/bid/68987; http://www.ubuntu.com/usn/USN-2303-1
CVE: CVE-2014-3332
Published: 2014-08-11
Description: Cisco Unified Communications Manager (CM) 8.6(.2) and earlier has an incorrect CLI restrictions setting, which allows remote authenticated users to establish undetected concurrent logins via unspecified vectors, aka Bug ID CSCup98029.
CVSS Score: 4.0 (MEDIUM)
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3332; http://tools.cisco.com/security/center/viewAlert.x?alertId=35198; http://www.securityfocus.com/bid/69068
CVE: CVE-2014-3333
Published: 2014-08-11
Description: The server in Cisco Unity Connection 9.1(1) and 9.1(2) allows remote authenticated users to obtain privileged access by conducting an "HTTP Intercept" attack and leveraging the ability to read files within the context of the web-server user account, aka Bug ID CSCup41014.
CVSS Score: 9.0 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/59768; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3333; http://tools.cisco.com/security/center/viewAlert.x?alertId=35200
CVE: CVE-2014-3336
Published: 2014-08-11
Description: SQL injection vulnerability in the web framework in Cisco Unity Connection 9.1(2) and earlier allows remote authenticated users to execute arbitrary SQL commands via a crafted request, aka Bug ID CSCuq31016.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/59498; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3336; http://tools.cisco.com/security/center/viewAlert.x?alertId=35228
CVE: CVE-2014-2357
Published: 2014-08-11
Description: The GPT library in the Telegyr 8979 Master Protocol application in SUBNET SubSTATION Server 2 before SSNET 2.12 HF18808 allows remote attackers to cause a denial of service (persistent service crash) via a long RTU-to-Master message.
CVSS Score: 8.3 (HIGH)
CWE: CWE-20, CWE-119
References: https://www.cisa.gov/news-events/ics-advisories/icsa-14-196-01; https://ics-cert.us-cert.gov/advisories/ICSA-14-196-01
CVE: CVE-2014-3076
Published: 2014-08-11
Description: IBM Business Process Manager (BPM) 8.5 through 8.5.5 allows remote attackers to obtain potentially sensitive information by visiting an unspecified JSP diagnostic page.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://secunia.com/advisories/60614; http://www-01.ibm.com/support/docview.wss?uid=swg1JR50760; http://www-01.ibm.com/support/docview.wss?uid=swg21679976
CVE: CVE-2014-3327
Published: 2014-08-11
Description: The EnergyWise module in Cisco IOS 12.2, 15.0, 15.1, 15.2, and 15.4 and IOS XE 3.2.xXO, 3.3.xSG, 3.4.xSG, and 3.5.xE before 3.5.3E allows remote attackers to cause a denial of service (device reload) via a crafted IPv4 packet, aka Bug ID CSCup52101.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://secunia.com/advisories/60650; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140806-energywise; http://www.securityfocus.com/bid/69066
CVE: CVE-2014-3330
Published: 2014-08-11
Description: Cisco NX-OS 6.1(2)I2(1) on Nexus 9000 switches does not properly process packet-drop policy checks for logged packets, which allows remote attackers to bypass intended access restrictions via a flood of packets matching a policy that contains the log keyword, aka Bug ID CSCuo02489.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3330; http://tools.cisco.com/security/center/viewAlert.x?alertId=35181; http://www.securityfocus.com/bid/69057
CVE: CVE-2013-5433
Published: 2014-08-12
Description: The Data Growth Solution for JD Edwards EnterpriseOne in IBM InfoSphere Optim 3.0 through 9.1 has hardcoded database credentials, which allows remote authenticated users to obtain sensitive information by reading an unspecified field in an XML document.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-255
References: http://www-01.ibm.com/support/docview.wss?uid=swg21680575; https://exchange.xforce.ibmcloud.com/vulnerabilities/87639; http://www-01.ibm.com/support/docview.wss?uid=swg21680575
CVE: CVE-2014-2628
Published: 2014-08-12
Description: Unspecified vulnerability in HP Enterprise Maps 1 allows remote authenticated users to obtain sensitive information via unknown vectors.
CVSS Score: 4.0 (MEDIUM)
References: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04390793; https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04390793
CVE: CVE-2014-2631
Published: 2014-08-12
Description: Unspecified vulnerability in HP Application Lifecycle Management (aka Quality Center) 11.5x and 12.0x allows local users to gain privileges via unknown vectors, aka ZDI-CAN-2138.
CVSS Score: 4.6 (MEDIUM)
References: http://www.securitytracker.com/id/1030698; https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04394553; http://www.securitytracker.com/id/1030698
CVE: CVE-2014-3031
Published: 2014-08-12
Description: Cross-site scripting (XSS) vulnerability in IBM Tivoli Business Service Manager 4.2.0 before 4.2.0.0 IF12 and 4.2.1 before 4.2.1.3 IF9 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21680658; https://exchange.xforce.ibmcloud.com/vulnerabilities/93187; http://www-01.ibm.com/support/docview.wss?uid=swg21680658
CVE: CVE-2014-3069
Published: 2014-08-12
Description: Multiple CRLF injection vulnerabilities in the Universal Access component in IBM Curam Social Program Management (SPM) 6.0.5.5, when WebSphere Application Server is not used, allow remote authenticated users to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified parameters.
CVSS Score: 3.5 (LOW)
References: http://secunia.com/advisories/59688; http://www-01.ibm.com/support/docview.wss?uid=swg21681213; https://exchange.xforce.ibmcloud.com/vulnerabilities/94839
CVE: CVE-2014-3086
Published: 2014-08-12
Description: Unspecified vulnerability in the IBM Java Virtual Machine, as used in IBM WebSphere Real Time 3 before Service Refresh 7 FP1 and other products, allows remote attackers to gain privileges by leveraging the ability to execute code in the context of a security manager.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/59680; http://secunia.com/advisories/60081; http://secunia.com/advisories/60317
CVE: CVE-2014-4757
Published: 2014-08-12
Description: The Outlook Extension in IBM Content Collector 4.0.0.x before 4.0.0.0-ICC-OE-IF004 allows local users to bypass the intended Reviewer privilege requirement and read e-mail messages from an arbitrary mailbox by invoking the Search function.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://secunia.com/advisories/60619; http://www-01.ibm.com/support/docview.wss?uid=swg21679144; https://exchange.xforce.ibmcloud.com/vulnerabilities/94456
CVE: CVE-2014-0953
Published: 2014-08-12
Description: Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 6.1.0.0 through 6.1.0.6 CF27, 6.1.5.0 through 6.1.5.3 CF27, 7.0.0 through 7.0.0.2 CF28, and 8.0.0 before 8.0.0.1 CF12 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PI16127; http://www-01.ibm.com/support/docview.wss?uid=swg21680230; http://www.securitytracker.com/id/1030669
CVE: CVE-2014-2630
Published: 2014-08-12
Description: Unspecified vulnerability in HP Operations Agent 11.00, when Glance is used, allows local users to gain privileges via unknown vectors.
CVSS Score: 4.4 (MEDIUM)
References: http://packetstormsecurity.com/files/156206/xglance-bin-Local-Root-Privilege-Escalation.html; http://packetstormsecurity.com/files/157528/HP-Performance-Monitoring-xglance-Privilege-Escalation.html; http://seclists.org/fulldisclosure/2020/Feb/1
CVE: CVE-2014-3102
Published: 2014-08-12
Description: Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 7.0.0 through 7.0.0.2 CF28 and 8.0.0 before 8.0.0.1 CF13 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PI16174; http://www-01.ibm.com/support/docview.wss?uid=swg21680230; http://www.securitytracker.com/id/1030669
CVE: CVE-2014-3899
Published: 2014-08-12
Description: Gretech GOM Player 2.2.51.5149 and earlier allows remote attackers to cause a denial of service (launch outage) via a crafted image file.
CVSS Score: 4.3 (MEDIUM)
References: http://jvn.jp/en/jp/JVN32726697/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2014-000085; http://jvn.jp/en/jp/JVN32726697/index.html
CVE: CVE-2014-4746
Published: 2014-08-12
Description: IBM WebSphere Portal 8.0.0 before 8.0.0.1 CF13 and 8.5.0 through CF01 provides different error codes for firewall-traversal requests depending on whether the intranet host exists, which allows remote attackers to map the intranet network via a series of requests.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://secunia.com/advisories/60612; http://www-01.ibm.com/support/docview.wss?uid=swg1PI21858; http://www-01.ibm.com/support/docview.wss?uid=swg21680230
CVE: CVE-2014-4751
Published: 2014-08-12
Description: Cross-site scripting (XSS) vulnerability in IBM Security Access Manager for Mobile 8.0.0.0, 8.0.0.1, and 8.0.0.3 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/60562; http://www-01.ibm.com/support/docview.wss?uid=swg21680440; https://exchange.xforce.ibmcloud.com/vulnerabilities/94353
CVE: CVE-2014-4760
Published: 2014-08-12
Description: Open redirect vulnerability in IBM WebSphere Portal 6.1.0.0 through 6.1.0.6 CF27, 6.1.5.0 through 6.1.5.3 CF27, 7.0.0 through 7.0.0.2 CF28, 8.0.0 before 8.0.0.1 CF13, and 8.5.0 before CF01 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a crafted URL.
CVSS Score: 5.8 (MEDIUM)
References: http://secunia.com/advisories/60597; http://www-01.ibm.com/support/docview.wss?uid=swg1PI19877; http://www-01.ibm.com/support/docview.wss?uid=swg21680230
CVE: CVE-2014-2629
Published: 2014-08-12
Description: HP NonStop Safeguard Security Software G, H06.03 through H06.28.01, and J06.03 through J06.17.01 does not properly evaluate the DISKFILE-PATTERN ACL of a program object file, which allows remote authenticated users to bypass intended restrictions on program access via vectors related to process-creation time.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/59981; http://www.securityfocus.com/bid/69147; http://www.securitytracker.com/id/1030697
CVE: CVE-2014-3072
Published: 2014-08-12
Description: Unspecified vulnerability in the Automation Server in IBM Security AppScan Source 8 through 8.0.0.2, 8.5 through 8.5.0.1, 8.6 through 8.6.0.2, 8.7 through 8.7.0.1, 8.8, and 9.0 through 9.0.0.1 allows local users to gain privileges by executing a crafted service.
CVSS Score: 7.2 (HIGH)
References: http://www-01.ibm.com/support/docview.wss?uid=swg21680537; https://exchange.xforce.ibmcloud.com/vulnerabilities/93787; http://www-01.ibm.com/support/docview.wss?uid=swg21680537
CVE: CVE-2007-6756
Published: 2014-08-12
Description: ZOLL Defibrillator / Monitor M Series, E Series, and R Series have a default password for System Configuration mode, which allows physically proximate attackers to modify device configuration and cause a denial of service (adverse human health effects).
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-255
References: http://www.zoll.com/WorkArea/DownloadAsset.aspx?id=10018; http://www.zoll.com/WorkArea/DownloadAsset.aspx?id=18473; http://www.zoll.com/WorkArea/DownloadAsset.aspx?id=2386
CVE: CVE-2013-7395
Published: 2014-08-12
Description: ZOLL Defibrillator / Monitor X Series has a default (1) supervisor password and (2) service password, which allows physically proximate attackers to modify device configuration and cause a denial of service (adverse human health effects).
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-255
References: http://www.zoll.com/WorkArea/DownloadAsset.aspx?id=25506; http://www.zoll.com/WorkArea/DownloadAsset.aspx?id=25506
CVE: CVE-2011-2593
Published: 2014-08-12
Description: Integer overflow in the StartEpa method in the nsepacom ActiveX control (nsepa.exe) in Citrix Access Gateway Enterprise Edition Plug-in for Windows 9.x before 9.3-57.5 and 10.0 before 10.0-69.4 allows remote attackers to execute arbitrary code via a crafted Content-Length HTTP header, which triggers a heap-based buffer overflow.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-189
References: http://secunia.com/advisories/45299; http://secunia.com/secunia_research/2012-26; http://support.citrix.com/article/CTX134303
CVE: CVE-2011-2944
Published: 2014-08-12
Description: SQL injection vulnerability in login.php in MegaLab The Uploader before 2.0.5 allows remote attackers to execute arbitrary SQL commands via the username parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/79508; http://packetstormsecurity.org/files/110166/The-Uploader-2.0.4-Eng-Ita-Remote-File-Upload.html; http://secunia.com/advisories/48141
CVE: CVE-2012-4241
Published: 2014-08-12
Description: Multiple cross-site scripting (XSS) vulnerabilities in Microcart 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) PATH_INFO or (2) query string to _admin/index.php or (3) first_name, (4) last_name, (5) cc, (6) exp, (7) cvv, (8) address1, (9) address2, (10) city, (11) state, (12) zip, (13) phone, or (14) email parameter to checkout.php, which is not properly handled in an error message.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/116714/Microcart-1.0-Checkout-Cross-Site-Scripting.html; http://packetstormsecurity.com/files/116721/Microcart-1.0-Cross-Site-Scripting.html; http://www.reactionpenetrationtesting.co.uk/microcart-_admin-xss.html
CVE: CVE-2014-5196
Published: 2014-08-12
Description: Cross-site request forgery (CSRF) vulnerability in improved-user-search-in-backend.php in the backend in the Improved user search in backend plugin before 1.2.5 for WordPress allows remote attackers to hijack the authentication of administrators for requests that insert XSS sequences via the iusib_meta_fields parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/60590; http://wordpress.org/plugins/improved-user-search-in-backend/changelog; https://security.dxw.com/advisories/csrf-and-xss-in-improved-user-search-allow-execution-of-arbitrary-javascript-in-wordpress-admin-area/
CVE: CVE-2014-5197
Published: 2014-08-12
Description: Directory traversal vulnerability in (1) Splunk Web or the (2) Splunkd HTTP Server in Splunk Enterprise 6.1.x before 6.1.3 allows remote authenticated users to read arbitrary files via a .. (dot dot) in a URI, related to search ids.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/59940; http://www.securitytracker.com/id/1030690; http://www.splunk.com/view/SP-CAAAM9H
CVE: CVE-2014-5198
Published: 2014-08-12
Description: Cross-site scripting (XSS) vulnerability in Splunk Web in Splunk Enterprise 6.1.x before 6.1.3 allows remote attackers to inject arbitrary web script or HTML via the Referer HTTP header.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/59940; http://www.securitytracker.com/id/1030690; http://www.splunk.com/view/SP-CAAAM9H
CVE: CVE-2014-5199
Published: 2014-08-12
Description: Cross-site request forgery (CSRF) vulnerability in the WordPress File Upload plugin (wp-file-upload) before 2.4.2 for WordPress allows remote attackers to hijack the authentication of administrators for requests that change plugin settings via unspecified vectors.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://secunia.com/advisories/60520; http://wordpress.org/plugins/wp-file-upload/changelog; http://secunia.com/advisories/60520
CVE: CVE-2014-5200
Published: 2014-08-12
Description: SQL injection vulnerability in game_play.php in the FB Gorilla plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/127639; https://exchange.xforce.ibmcloud.com/vulnerabilities/94916; http://packetstormsecurity.com/files/127639