Buffer overflow in client/mysql.cc in Oracle MySQL and MariaDB before 5.5.35 allows remote database servers to cause a denial of service (crash) and possibly execute arbitrary code via a long server version string.
[http://bazaar.launchpad.net/~maria-captains/maria/5.5/revision/2502.565.64]
[RHSA-2014:0164]
[RHSA-2014:0173]
[RHSA-2014:0186]
[RHSA-2014:0189]
[52161]
[GLSA-201409-04]
[MDVSA-2014:029]
[65298]
[1029708]
[https://bugzilla.redhat.com/show_bug.cgi?id=1054592]
[mysql-cve20140001-bo(90901)]
[https://mariadb.com/kb/en/mariadb-5535-changelog/]
The XSLT component in Apache Camel before 2.11.4 and 2.12.x before 2.12.3 allows remote attackers to read arbitrary files and possibly have other unspecified impact via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
[http://camel.apache.org/security-advisories.data/CVE-2014-0002.txt.asc]
[RHSA-2014:0371]
[RHSA-2014:0372]
[65901]
[[camel-commits] 20190524 svn commit: r1045395 - in /websites/production/camel/content: cache/main.pageCache security-advisories.data/CVE-2019-0188.txt.asc security-advisories.html]
[[camel-commits] 20190430 svn commit: r1044347 - in /websites/production/camel/content: cache/main.pageCache security-advisories.data/CVE-2019-0194.txt.asc security-advisories.html]
The XSLT component in Apache Camel 2.11.x before 2.11.4, 2.12.x before 2.12.3, and possibly earlier versions allows remote attackers to execute arbitrary Java methods via a crafted message.
[http://camel.apache.org/security-advisories.data/CVE-2014-0003.txt.asc]
[RHSA-2014:0245]
[RHSA-2014:0254]
[RHSA-2014:0371]
[RHSA-2014:0372]
[65902]
[[camel-commits] 20190524 svn commit: r1045395 - in /websites/production/camel/content: cache/main.pageCache security-advisories.data/CVE-2019-0188.txt.asc security-advisories.html]
[[camel-commits] 20190430 svn commit: r1044347 - in /websites/production/camel/content: cache/main.pageCache security-advisories.data/CVE-2019-0194.txt.asc security-advisories.html]
Stack-based buffer overflow in udisks before 1.0.5 and 2.x before 2.1.3 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a long mount point.
[[devkit-devel] 20140310 udisks 2.1.3 / 1.0.5 security updates]
[openSUSE-SU-2014:0388]
[openSUSE-SU-2014:0389]
[openSUSE-SU-2014:0390]
[RHSA-2014:0293]
[DSA-2872]
[66081]
[USN-2142-1]
PicketBox and JBossSX, as used in Red Hat JBoss Enterprise Application Platform (JBEAP) 6.2.2 and JBoss BRMS before 6.0.3 roll up patch 2, allows remote authenticated users to read and modify the application sever configuration and state by deploying a crafted application.
[RHSA-2014:0343]
[RHSA-2014:0344]
[RHSA-2014:0345]
[RHSA-2015:0234]
[RHSA-2015:0235]
[RHSA-2015:0720]
The TempURL middleware in OpenStack Object Storage (Swift) 1.4.6 through 1.8.0, 1.9.0 through 1.10.0, and 1.11.0 allows remote attackers to obtain secret URLs by leveraging an object name and a timing side-channel attack.
[RHSA-2014:0232]
[[oss-security] 20140117 [OSSA 2014-002] Swift TempURL timing attack (CVE-2014-0006)]
[https://bugs.launchpad.net/swift/+bug/1265665]
The Smart-Proxy in Foreman before 1.4.5 and 1.5.x before 1.5.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the path parameter to tftp/fetch_boot_file.
[http://projects.theforeman.org/issues/6086]
[RHSA-2014:0770]
lib/adminlib.php in Moodle through 2.3.11, 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 logs cleartext passwords, which allows remote authenticated administrators to obtain sensitive information by reading the Config Changes Report.
[http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-36721]
[FEDORA-2014-1377]
[FEDORA-2014-1396]
[[oss-security] 20140120 Moodle security notifications public]
[1029647]
[https://moodle.org/mod/forum/discuss.php?d=252414]
course/loginas.php in Moodle through 2.2.11, 2.3.x before 2.3.11, 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 does not enforce the moodle/site:accessallgroups capability requirement for outside-group users in a SEPARATEGROUPS configuration, which allows remote authenticated users to perform "login as" actions via a direct request.
[http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-42643]
[FEDORA-2014-1377]
[FEDORA-2014-1396]
[[oss-security] 20140120 Moodle security notifications public]
[1029648]
[https://moodle.org/mod/forum/discuss.php?d=252415]
Multiple cross-site request forgery (CSRF) vulnerabilities in user/profile/index.php in Moodle through 2.2.11, 2.3.x before 2.3.11, 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 allow remote attackers to hijack the authentication of administrators for requests that delete (1) categories or (2) fields.
[http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-42883]
[FEDORA-2014-1377]
[FEDORA-2014-1396]
[[oss-security] 20140120 Moodle security notifications public]
[1029649]
[https://moodle.org/mod/forum/discuss.php?d=252416]
FileSystemBytecodeCache in Jinja2 2.7.2 does not properly create temporary directories, which allows local users to gain privileges by pre-creating a temporary directory with a user's uid. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-1402.
[[oss-security] 20140110 CVE assignment for jinja2]
[GLSA-201408-13]
[https://bugzilla.redhat.com/show_bug.cgi?id=1051421]
[https://github.com/mitsuhiko/jinja2/commit/acb672b6a179567632e032f547582f30fa2f4aa7]
[https://github.com/mitsuhiko/jinja2/pull/292]
[https://github.com/mitsuhiko/jinja2/pull/296]
Ember.js 1.0.x before 1.0.1, 1.1.x before 1.1.3, 1.2.x before 1.2.1, 1.3.x before 1.3.1, and 1.4.x before 1.4.0-beta.2 allows remote attackers to conduct cross-site scripting (XSS) attacks by leveraging an application that contains templates whose context is set to a user-supplied primitive value and also contain the `{{this}}` special Handlebars variable.
[http://emberjs.com/blog/2014/01/14/ember-security-releases.html]
[https://groups.google.com/forum/#!topic/ember-security/2kpXXCxISS4]
Ember.js 1.0.x before 1.0.1, 1.1.x before 1.1.3, 1.2.x before 1.2.1, 1.3.x before 1.3.1, and 1.4.x before 1.4.0-beta.2 allows remote attackers to conduct cross-site scripting (XSS) attacks by leveraging an application using the "{{group}}" Helper and a crafted payload.
[http://emberjs.com/blog/2014/01/14/ember-security-releases.html]
[http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html]
[https://groups.google.com/forum/#!topic/ember-security/PSE4RzTi6l4]
cURL and libcurl 7.10.6 through 7.34.0, when more than one authentication method is enabled, re-uses NTLM connections, which might allow context-dependent attackers to authenticate as other users via a request.
[APPLE-SA-2014-06-30-2]
[http://curl.haxx.se/docs/adv_20140129.html]
[http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10743]
[FEDORA-2014-1876]
[FEDORA-2014-1864]
[openSUSE-SU-2014:0274]
[20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities]
[56912]
[http://support.apple.com/kb/HT6296]
[DSA-2849]
[http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html]
[http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html]
[http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html]
[20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities]
[65270]
[1029710]
[SSA:2014-044-01]
[USN-2097-1]
[http://www.vmware.com/security/advisories/VMSA-2014-0012.html]
[http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095862]
stunnel before 5.00, when using fork threading, does not properly update the state of the OpenSSL pseudo-random number generator (PRNG), which causes subsequent children with the same process ID to use the same entropy pool and allows remote attackers to obtain private keys for EC (ECDSA) or DSA certificates.
[[oss-security] 20140305 libssh and stunnel PRNG flaws]
[65964]
[https://bugzilla.redhat.com/attachment.cgi?id=870826&action=diff]
[https://bugzilla.redhat.com/show_bug.cgi?id=1072180]
[https://www.stunnel.org/sdf_ChangeLog.html]
The RAND_bytes function in libssh before 0.6.3, when forking is enabled, does not properly reset the state of the OpenSSL pseudo-random number generator (PRNG), which causes the state to be shared between children processes and allows local users to obtain sensitive information by leveraging a pid collision.
[openSUSE-SU-2014:0366]
[openSUSE-SU-2014:0370]
[DSA-2879]
[http://www.libssh.org/2014/03/04/libssh-0-6-3-security-release/]
[[oss-security] 20140305 libssh and stunnel PRNG flaws]
[USN-2145-1]
[https://bugzilla.redhat.com/show_bug.cgi?id=1072191]
Red Hat JBoss Enterprise Application Platform (JBEAP) 6.2.0 and JBoss WildFly Application Server, when run under a security manager, do not properly restrict access to the Modular Service Container (MSC) service registry, which allows local users to modify the server via a crafted deployment.
[RHSA-2014:0170]
[RHSA-2014:0171]
[RHSA-2014:0172]
[65591]
[https://bugzilla.redhat.com/show_bug.cgi?id=1052783]
Stack-based buffer overflow in socat 1.3.0.0 through 1.7.2.2 and 2.0.0-b1 through 2.0.0-b6 allows local users to cause a denial of service (segmentation fault) via a long server name in the PROXY-CONNECT address in the command line.
[FEDORA-2014-1811]
[FEDORA-2014-1795]
[openSUSE-SU-2015:0760]
[[oss-security] 20140128 Socat security advisory 5 - PROXY-CONNECT address overflow]
[http://www.dest-unreach.org/socat]
[http://www.dest-unreach.org/socat/contrib/socat-secadv5.txt]
[MDVSA-2014:033]
[65201]
The IRC protocol plugin in libpurple in Pidgin before 2.10.8 does not validate argument counts, which allows remote IRC servers to cause a denial of service (application crash) via a crafted message.
[http://hg.pidgin.im/pidgin/main/rev/4d9be297d399]
[http://hg.pidgin.im/pidgin/main/rev/5845d9fa7084]
[http://hg.pidgin.im/pidgin/main/rev/6b0e0566af20]
[http://hg.pidgin.im/pidgin/main/rev/7d0fb0c6d8d4]
[http://hg.pidgin.im/pidgin/main/rev/9f132a6855cd]
[http://hg.pidgin.im/pidgin/main/rev/a167504359e5]
[openSUSE-SU-2014:0239]
[openSUSE-SU-2014:0326]
[http://pidgin.im/news/security/?id=85]
[DSA-2859]
[USN-2100-1]
[RHSA-2014:0139]
The installUpdates function in yum-cron/yum-cron.py in yum 3.4.3 and earlier does not properly check the return value of the sigCheckPkg function, which allows remote attackers to bypass the RMP package signing restriction via an unsigned package.
[65119]
[http://yum.baseurl.org/gitweb?p=yum.git;a=commitdiff;h=9df69e5794]
[https://bugzilla.redhat.com/show_bug.cgi?id=1052440]
[https://bugzilla.redhat.com/show_bug.cgi?id=1057377]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-1690. Reason: This candidate is a reservation duplicate of CVE-2014-1690. Notes: All CVE users should reference CVE-2014-1690 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
The play_wave_from_socket function in audio/auserver.c in Flite 1.4 allows local users to modify arbitrary files via a symlink attack on /tmp/awb.wav. NOTE: some of these details are obtained from third party information.
[FEDORA-2014-0574]
[FEDORA-2014-0579]
[[oss-security] 20140110 temporary file issue in flite]
[MDVSA-2014:032]
[64791]
[https://bugzilla.redhat.com/show_bug.cgi?id=1048678]
libvirt 1.1.1 through 1.2.0 allows context-dependent attackers to bypass the domain:getattr and connect:search_domains restrictions in ACLs and obtain sensitive domain object information via a request to the (1) virConnectDomainEventRegister and (2) virConnectDomainEventRegisterAny functions in the event registration API.
[http://libvirt.org/news.html]
[openSUSE-SU-2014:0268]
[GLSA-201412-04]
[USN-2093-1]
[https://bugzilla.redhat.com/show_bug.cgi?id=1048637]
[[libvirt] 20140115 [PATCH 0/4] CVE-2014-0028: domain events vs. ACL filtering]
Multiple cross-site scripting (XSS) vulnerabilities in the SAM web application in Red Hat katello-headpin allow remote attackers to inject arbitrary web script or HTML via unspecified parameters.
[https://bugzilla.redhat.com/show_bug.cgi?id=1059433]
The XML-RPC protocol support in Apache Roller before 5.0.3 allows attackers to conduct XML External Entity (XXE) attacks via unspecified vectors.
[https://liftsecurity.io/advisories/Apache_Roller_XML-RPC_susceptible_to_XXE/]
[[roller-dev] 20140111 CVE-2014-0030 Apache Roller XML-RPC susceptible to XML Entended Entity attacks]
[45341]
The (1) ListNetworkACL and (2) listNetworkACLLists APIs in Apache CloudStack before 4.2.1 allow remote authenticated users to list network ACLS for other users via a crafted request.
[https://blogs.apache.org/cloudstack/entry/cve_2014_0031_cloudstack_listnetworkacl]
[https://issues.apache.org/jira/browse/CLOUDSTACK-5145]
The get_resource function in repos.c in the mod_dav_svn module in Apache Subversion before 1.7.15 and 1.8.x before 1.8.6, when SVNListParentPath is enabled, allows remote attackers to cause a denial of service (crash) via vectors related to the server root and request methods other than GET, as demonstrated by the "svn ls http://svn.example.com" command.
[openSUSE-SU-2014:0307]
[openSUSE-SU-2014:0334]
[[subversion-dev] 20140110 2 Re: Segfault in mod_dav_svn with repositories on /]
[[subversion-dev] 20140110 Re: Segfault in mod_dav_svn with repositories on /]
[[subversion-dev] 20140110 Sin mod_dav_svn with repositories on /]
[RHSA-2014:0255]
[61321]
[http://support.apple.com/kb/HT6444]
[http://svn.apache.org/repos/asf/subversion/tags/1.7.15/CHANGES]
[http://svn.apache.org/repos/asf/subversion/tags/1.8.6/CHANGES]
[http://svn.apache.org/viewvc?view=revision&revision=1557320]
[http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html]
[65434]
[USN-2316-1]
[apache-subversion-cve20140032-dos(90986)]
[GLSA-201610-05]
org/apache/catalina/connector/CoyoteAdapter.java in Apache Tomcat 6.0.33 through 6.0.37 does not consider the disableURLRewriting setting when handling a session ID in a URL, which allows remote attackers to conduct session fixation attacks via a crafted URL.
[20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities]
[http://svn.apache.org/viewvc?view=revision&revision=1558822]
[http://tomcat.apache.org/security-6.html]
[DSA-3530]
[http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html]
[http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html]
[20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities]
[65769]
[USN-2130-1]
[http://www.vmware.com/security/advisories/VMSA-2014-0012.html]
[http://www-01.ibm.com/support/docview.wss?uid=swg21675886]
[http://www-01.ibm.com/support/docview.wss?uid=swg21677147]
[http://www-01.ibm.com/support/docview.wss?uid=swg21678231]
[https://bugzilla.redhat.com/show_bug.cgi?id=1069919]
[[tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/]
[[tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/]
[[tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/]
[[tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/]
The SecurityTokenService (STS) in Apache CXF before 2.6.12 and 2.7.x before 2.7.9 does not properly validate SAML tokens when caching is enabled, which allows remote attackers to gain access via an invalid SAML token.
[http://cxf.apache.org/security-advisories.data/CVE-2014-0034.txt.asc]
[RHSA-2014:0797]
[RHSA-2014:0798]
[RHSA-2014:0799]
[RHSA-2014:1351]
[RHSA-2015:0850]
[RHSA-2015:0851]
[http://svn.apache.org/viewvc?view=revision&revision=1551228]
[68441]
The SymmetricBinding in Apache CXF before 2.6.13 and 2.7.x before 2.7.10, when EncryptBeforeSigning is enabled and the UsernameToken policy is set to an EncryptedSupportingToken, transmits the UsernameToken in cleartext, which allows remote attackers to obtain sensitive information by sniffing the network.
[http://cxf.apache.org/security-advisories.data/CVE-2014-0035.txt.asc]
[RHSA-2014:0797]
[RHSA-2014:0798]
[RHSA-2014:0799]
[RHSA-2014:1351]
[RHSA-2015:0850]
[RHSA-2015:0851]
[http://svn.apache.org/viewvc?view=revision&revision=1564724]
The rbovirt gem before 0.0.24 for Ruby uses the rest-client gem with SSL verification disabled, which allows remote attackers to conduct man-in-the-middle attacks via unspecified vectors.
[FEDORA-2014-3573]
[FEDORA-2014-3526]
[[oss-security] 20140306 CVE-2014-0036 rubygem-rbovirt: unsafe use of rest-client]
[https://bugzilla.redhat.com/show_bug.cgi?id=1058595]
The ValidateUserLogon function in provider/libserver/ECSession.cpp in Zarafa 5.00 before 7.1.8 beta2 allows remote attackers to cause a denial of service (crash) via vectors related to "a NULL pointer of the username."
[MDVSA-2014:044]
[[oss-security] 20140131 Security Flaw CVE-2014-0037]
[https://bugzilla.redhat.com/show_bug.cgi?id=1056767]
[https://bugzilla.redhat.com/show_bug.cgi?id=1059903]
The compat_sys_recvmmsg function in net/compat.c in the Linux kernel before 3.13.2, when CONFIG_X86_X32 is enabled, allows local users to gain privileges via a recvmmsg system call with a crafted timeout pointer parameter.
[http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=2def2ef2ae5f3990aabdbe8a755911902707d268]
[openSUSE-SU-2014:0204]
[openSUSE-SU-2014:0205]
[http://pastebin.com/raw.php?i=DH3Lbg54]
[56669]
[31346]
[31347]
[http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.13.2]
[MDVSA-2014:038]
[[oss-security] 20140131 Linux 3.4+: arbitrary write with CONFIG_X86_X32 (CVE-2014-0038)]
[65255]
[USN-2094-1]
[USN-2095-1]
[USN-2096-1]
[https://bugzilla.redhat.com/show_bug.cgi?id=1060023]
[https://code.google.com/p/chromium/issues/detail?id=338594]
[https://github.com/saelo/cve-2014-0038]
[https://github.com/torvalds/linux/commit/2def2ef2ae5f3990aabdbe8a755911902707d268]
[40503]
Untrusted search path vulnerability in fwsnort before 1.6.4, when not running as root, allows local users to execute arbitrary code via a Trojan horse fwsnort.conf in the current working directory.
Per: http://cwe.mitre.org/data/definitions/426.html
"CWE-426: Untrusted Search Path"
[FEDORA-2014-1975]
[FEDORA-2014-1972]
[[oss-security] 20140203 CVE-2014-0039: fwsnort loaded configuration file from cwd when run as a non-root user]
[65341]
[https://github.com/mrash/fwsnort/blob/master/ChangeLog]
[https://github.com/mrash/fwsnort/commit/fa977453120cc48e1654f373311f9cac468d3348]
OpenStack Heat Templates (heat-templates), as used in Red Hat Enterprise Linux OpenStack Platform 4.0, uses an HTTP connection to download (1) packages and (2) signing keys from Yum repositories, which allows man-in-the-middle attackers to prevent updates via unspecified vectors.
[RHSA-2014:0579]
[https://bugs.launchpad.net/heat-templates/+bug/1267635]
[https://bugzilla.redhat.com/show_bug.cgi?id=1059514]
[https://github.com/openstack/heat-templates/commit/65a4f8bebc72da71c616e2e378b7b1ac354db1a3]
OpenStack Heat Templates (heat-templates), as used in Red Hat Enterprise Linux OpenStack Platform 4.0, sets sslverify to false for certain Yum repositories, which disables SSL protection and allows man-in-the-middle attackers to prevent updates via unspecified vectors.
[RHSA-2014:0579]
[https://bugs.launchpad.net/heat-templates/+bug/1267635]
[https://bugzilla.redhat.com/show_bug.cgi?id=1059515]
OpenStack Heat Templates (heat-templates), as used in Red Hat Enterprise Linux OpenStack Platform 4.0, sets gpgcheck to 0 for certain templates, which disables GPG signature checking on downloaded packages and allows man-in-the-middle attackers to install arbitrary packages via unspecified vectors.
[RHSA-2014:0579]
[https://bugs.launchpad.net/heat-templates/+bug/1267635]
[https://bugzilla.redhat.com/show_bug.cgi?id=1059520]
[https://github.com/openstack/heat-templates/commit/65a4f8bebc72da71c616e2e378b7b1ac354db1a3]
In Apache Wicket 1.5.10 or 6.13.0, by issuing requests to special urls handled by Wicket, it is possible to check for the existence of particular classes in the classpath and thus check whether a third party library with a known security vulnerability is in use.
[[wicket-announce] 20140221 CVE-2014-0043]
The opus_packet_get_samples_per_frame function in client in Mumble 1.2.4 and the 1.2.3 pre-release snapshots allows remote attackers to cause a denial of service (crash) via a crafted length prefix value, which triggers a NULL pointer dereference or a heap-based buffer over-read (aka "out-of-bounds array access").
[openSUSE-SU-2014:0271]
[http://mumble.info/security/Mumble-SA-2014-001.txt]
[DSA-2854]
The needSamples method in AudioOutputSpeech.cpp in the client in Mumble 1.2.4 and the 1.2.3 pre-release snapshots, Mumble for iOS 1.1 through 1.2.2, and MumbleKit before commit fd190328a9b24d37382b269a5674b0c0c7a7e36d does not check the return value of the opus_decode_float function, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted Opus voice packet, which triggers an error in opus_decode_float, a conversion of a negative integer to an unsigned integer, and a heap-based buffer over-read and over-write.
[openSUSE-SU-2014:0271]
[http://mumble.info/security/Mumble-SA-2014-002.txt]
[http://mumble.info/security/Mumble-SA-2014-004.txt]
[DSA-2854]
[65374]
Cross-site scripting (XSS) vulnerability in the link-to helper in Ember.js 1.2.x before 1.2.2, 1.3.x before 1.3.2, and 1.4.x before 1.4.0-beta.6, when used in non-block form, allows remote attackers to inject arbitrary web script or HTML via the title attribute.
[http://emberjs.com/blog/2014/02/07/ember-security-releases.html]
[[oss-security] 20140214 [CVE-2014-0046] XSS Vulnerability With {{link-to}} Helper in Non-block Form]
[65579]
[emberjs-linkto-xss(91242)]
[https://groups.google.com/forum/#!topic/ember-security/1h6FRgr8lXQ]
Docker before 1.5 allows local users to have unspecified impact via vectors involving unsafe /tmp usage.
[[oss-security] 20150324 Re: 2 moderate (borderline low) docker flaws fixed in >=1.5 and possibly earlier]
[73315]
[https://bugzilla.redhat.com/show_bug.cgi?id=1063549]
Buffer overflow in the complete_emulated_mmio function in arch/x86/kvm/x86.c in the Linux kernel before 3.13.6 allows guest OS users to execute arbitrary code on the host OS by leveraging a loop that triggers an invalid memory copy affecting certain cancel_work_item data.
[http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=a08d3b3b99efd509133946056531cdf8f3a0c09b]
[http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.13.6]
[[oss-security] 20140303 CVE-2014-0049 -- Linux kernel: kvm: mmio_fragments out-of-the-bounds access]
[https://bugzilla.redhat.com/show_bug.cgi?id=1062368]
[https://github.com/torvalds/linux/commit/a08d3b3b99efd509133946056531cdf8f3a0c09b]
MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a loop's intended exit conditions.
The previous CVSS assessment ( Base Score: 5.0 - AV:N/AC:L/AU:N/C:N/I:N/A:P) was provided at the time of initial analysis based on the best available published information at that time. The score has been updated to reflect the impact to Oracle products per <a href=http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html> Oracle Critical Patch Update Advisory - October 2015 </a>. Other products listed as vulnerable may or may not be similarly impacted.
[http://advisories.mageia.org/MGASA-2014-0110.html]
[http://blog.spiderlabs.com/2014/02/cve-2014-0050-exploit-with-boundaries-loops-without-boundaries.html]
[JVN#14876762]
[JVNDB-2014-000017]
[[commons-dev] 20140206 [SECURITY] CVE-2014-0050 Apache Commons FileUpload and Apache Tomcat DoS]
[HPSBGN03329]
[http://packetstormsecurity.com/files/127215/VMware-Security-Advisory-2014-0007.html]
[RHSA-2014:0252]
[RHSA-2014:0253]
[RHSA-2014:0400]
[20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities]
[http://svn.apache.org/r1565143]
[http://tomcat.apache.org/security-7.html]
[http://tomcat.apache.org/security-8.html]
[DSA-2856]
[http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS14-015/index.html]
[http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS14-016/index.html]
[http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS14-017/index.html]
[http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-350733.htm]
[MDVSA-2015:084]
[http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html]
[http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html]
[http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html]
[http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html]
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html]
[http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html]
[http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html]
[20140625 NEW VMSA-2014-0007 - VMware product updates address security vulnerabilities in Apache Struts library]
[20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities]
[65400]
[USN-2130-1]
[http://www.vmware.com/security/advisories/VMSA-2014-0007.html]
[http://www.vmware.com/security/advisories/VMSA-2014-0008.html]
[http://www.vmware.com/security/advisories/VMSA-2014-0012.html]
[http://www-01.ibm.com/support/docview.wss?uid=swg21669554]
[http://www-01.ibm.com/support/docview.wss?uid=swg21675432]
[http://www-01.ibm.com/support/docview.wss?uid=swg21676091]
[http://www-01.ibm.com/support/docview.wss?uid=swg21676092]
[http://www-01.ibm.com/support/docview.wss?uid=swg21676401]
[http://www-01.ibm.com/support/docview.wss?uid=swg21676403]
[http://www-01.ibm.com/support/docview.wss?uid=swg21676405]
[http://www-01.ibm.com/support/docview.wss?uid=swg21676410]
[http://www-01.ibm.com/support/docview.wss?uid=swg21676656]
[http://www-01.ibm.com/support/docview.wss?uid=swg21676853]
[http://www-01.ibm.com/support/docview.wss?uid=swg21677691]
[http://www-01.ibm.com/support/docview.wss?uid=swg21677724]
[http://www-01.ibm.com/support/docview.wss?uid=swg21681214]
[https://bugzilla.redhat.com/show_bug.cgi?id=1062337]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324755]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05376917]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
The default configuration of the Resources plugin 1.0.0 before 1.2.6 for Pivotal Grails 2.0.0 before 2.3.6 does not properly restrict access to files in the WEB-INF directory, which allows remote attackers to obtain sensitive information via a direct request. NOTE: this identifier has been SPLIT due to different researchers and different vulnerability types. See CVE-2014-2857 for the META-INF variant and CVE-2014-2858 for the directory traversal.
[20140219 CVE-2014-0053 Information Disclosure when using Grails]
[20140227 Update: CVE-2014-0053 Information Disclosure when using Grails]
[http://www.gopivotal.com/security/cve-2014-0053]
[20140227 Update: CVE-2014-0053 Information Disclosure when using Grails]
[65678]
[grails-cve20140053-info-disc(91270)]
[https://twitter.com/Ramsharan065/status/434975409134792704]
The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4152, CVE-2013-7315, and CVE-2013-6429.
[RHSA-2014:0400]
[http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html]
[66148]
[https://jira.spring.io/browse/SPR-11376]
The get_rx_bufs function in drivers/vhost/net.c in the vhost-net subsystem in the Linux kernel package before 2.6.32-431.11.2 on Red Hat Enterprise Linux (RHEL) 6 does not properly handle vhost_get_vq_desc errors, which allows guest OS users to cause a denial of service (host OS crash) via unspecified vectors.
[RHSA-2014:0328]
[RHSA-2014:0339]
[66441]
[https://bugzilla.redhat.com/show_bug.cgi?id=1062577]
The l3-agent in OpenStack Neutron 2012.2 before 2013.2.3 does not check the tenant id when creating ports, which allows remote authenticated users to plug ports into the routers of arbitrary tenants via the device id in a port-create command.
[RHSA-2014:0516]
[[oss-security] 20140328 [OSSA 2014-008] Routers can be cross plugged by other tenants (CVE-2014-0056)]
[USN-2194-1]
[https://bugs.launchpad.net/neutron/+bug/1243327]
The x_button method in the ServiceController (vmdb/app/controllers/service_controller.rb) in Red Hat CloudForms 3.0 Management Engine 5.2 allows remote attackers to execute arbitrary methods via unspecified vectors.
[RHSA-2014:0215]
[https://bugzilla.redhat.com/show_bug.cgi?id=1064140]
The security audit functionality in Red Hat JBoss Enterprise Application Platform (EAP) 6.x before 6.2.1 logs request parameters in plaintext, which might allow local users to obtain passwords by reading the log files.
[RHSA-2014:0204]
[RHSA-2014:0205]
[RHSA-2015:0034]
[65762]
JBoss SX and PicketBox, as used in Red Hat JBoss Enterprise Application Platform (EAP) before 6.2.3, use world-readable permissions on audit.log, which allows local users to obtain sensitive information by reading this file.
[RHSA-2014:0563]
[RHSA-2014:0564]
[RHSA-2014:0565]
[RHSA-2015:0675]
[RHSA-2015:0850]
[RHSA-2015:0851]
PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 does not properly enforce the ADMIN OPTION restriction, which allows remote authenticated members of a role to add or remove arbitrary users to that role by calling the SET ROLE command before the associated GRANT command.
[APPLE-SA-2014-10-16-3]
[http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705]
[openSUSE-SU-2014:0345]
[openSUSE-SU-2014:0368]
[RHSA-2014:0211]
[RHSA-2014:0221]
[RHSA-2014:0249]
[RHSA-2014:0469]
[61307]
[http://support.apple.com/kb/HT6448]
[http://wiki.postgresql.org/wiki/20140220securityrelease]
[DSA-2864]
[DSA-2865]
[http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html]
[http://www.postgresql.org/about/news/1506/]
[USN-2120-1]
[https://puppet.com/security/cve/cve-2014-0060]
[https://support.apple.com/kb/HT6536]
The validator functions for the procedural languages (PLs) in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allow remote authenticated users to gain privileges via a function that is (1) defined in another language or (2) not allowed to be directly called by the user due to permissions.
[APPLE-SA-2014-10-16-3]
[http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705]
[openSUSE-SU-2014:0345]
[openSUSE-SU-2014:0368]
[RHSA-2014:0211]
[RHSA-2014:0221]
[RHSA-2014:0249]
[RHSA-2014:0469]
[61307]
[http://support.apple.com/kb/HT6448]
[http://wiki.postgresql.org/wiki/20140220securityrelease]
[DSA-2864]
[DSA-2865]
[http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html]
[http://www.postgresql.org/about/news/1506/]
[USN-2120-1]
[https://support.apple.com/kb/HT6536]
Race condition in the (1) CREATE INDEX and (2) unspecified ALTER TABLE commands in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allows remote authenticated users to create an unauthorized index or read portions of unauthorized tables by creating or deleting a table with the same name during the timing window.
[APPLE-SA-2014-10-16-3]
[http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705]
[openSUSE-SU-2014:0345]
[openSUSE-SU-2014:0368]
[RHSA-2014:0211]
[RHSA-2014:0221]
[RHSA-2014:0249]
[RHSA-2014:0469]
[61307]
[http://support.apple.com/kb/HT6448]
[http://wiki.postgresql.org/wiki/20140220securityrelease]
[DSA-2864]
[DSA-2865]
[http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html]
[http://www.postgresql.org/about/news/1506/]
[65727]
[USN-2120-1]
[https://support.apple.com/kb/HT6536]
Multiple stack-based buffer overflows in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allow remote authenticated users to cause a denial of service (crash) or possibly execute arbitrary code via vectors related to an incorrect MAXDATELEN constant and datetime values involving (1) intervals, (2) timestamps, or (3) timezones, a different vulnerability than CVE-2014-0065.
[APPLE-SA-2014-10-16-3]
[http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705]
[openSUSE-SU-2014:0345]
[openSUSE-SU-2014:0368]
[RHSA-2014:0211]
[RHSA-2014:0221]
[RHSA-2014:0249]
[RHSA-2014:0469]
[61307]
[http://support.apple.com/kb/HT6448]
[http://wiki.postgresql.org/wiki/20140220securityrelease]
[DSA-2864]
[DSA-2865]
[http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html]
[http://www.postgresql.org/about/news/1506/]
[http://www.postgresql.org/support/security/]
[65719]
[USN-2120-1]
[https://bugzilla.redhat.com/show_bug.cgi?id=1065226]
[https://github.com/postgres/postgres/commit/4318daecc959886d001a6e79c6ea853e8b1dfb4b]
[https://support.apple.com/kb/HT6536]
Multiple integer overflows in the path_in and other unspecified functions in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allow remote authenticated users to have unspecified impact and attack vectors, which trigger a buffer overflow. NOTE: this identifier has been SPLIT due to different affected versions; use CVE-2014-2669 for the hstore vector.
[APPLE-SA-2014-10-16-3]
[http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705]
[openSUSE-SU-2014:0345]
[openSUSE-SU-2014:0368]
[RHSA-2014:0211]
[RHSA-2014:0221]
[RHSA-2014:0249]
[RHSA-2014:0469]
[61307]
[http://support.apple.com/kb/HT6448]
[http://wiki.postgresql.org/wiki/20140220securityrelease]
[DSA-2864]
[DSA-2865]
[http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html]
[http://www.postgresql.org/about/news/1506/]
[http://www.postgresql.org/support/security/]
[65725]
[USN-2120-1]
[https://bugzilla.redhat.com/show_bug.cgi?id=1065230]
[https://github.com/postgres/postgres/commit/31400a673325147e1205326008e32135a78b4d8a]
[https://support.apple.com/kb/HT6536]
Multiple buffer overflows in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allow remote authenticated users to have unspecified impact and attack vectors, a different vulnerability than CVE-2014-0063.
[APPLE-SA-2014-10-16-3]
[http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705]
[openSUSE-SU-2014:0345]
[openSUSE-SU-2014:0368]
[RHSA-2014:0211]
[RHSA-2014:0221]
[RHSA-2014:0249]
[RHSA-2014:0469]
[http://support.apple.com/kb/HT6448]
[http://wiki.postgresql.org/wiki/20140220securityrelease]
[DSA-2864]
[DSA-2865]
[http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html]
[http://www.postgresql.org/about/news/1506/]
[65731]
[USN-2120-1]
[https://support.apple.com/kb/HT6536]
The chkpass extension in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 does not properly check the return value of the crypt library function, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and crash) via unspecified vectors.
[APPLE-SA-2014-10-16-3]
[http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705]
[openSUSE-SU-2014:0345]
[openSUSE-SU-2014:0368]
[RHSA-2014:0211]
[RHSA-2014:0221]
[RHSA-2014:0249]
[RHSA-2014:0469]
[http://support.apple.com/kb/HT6448]
[http://wiki.postgresql.org/wiki/20140220securityrelease]
[DSA-2864]
[DSA-2865]
[http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html]
[http://www.postgresql.org/about/news/1506/]
[USN-2120-1]
[https://support.apple.com/kb/HT6536]
The "make check" command for the test suites in PostgreSQL 9.3.3 and earlier does not properly invoke initdb to specify the authentication requirements for a database cluster to be used for the tests, which allows local users to gain privileges by leveraging access to this cluster.
[APPLE-SA-2015-08-13-2]
[APPLE-SA-2015-09-16-4]
[openSUSE-SU-2014:0345]
[openSUSE-SU-2014:0368]
[http://wiki.postgresql.org/wiki/20140220securityrelease]
[DSA-2864]
[DSA-2865]
[http://www.postgresql.org/about/news/1506/]
[65721]
[https://support.apple.com/HT205219]
[https://support.apple.com/kb/HT205031]
The cifs_iovec_write function in fs/cifs/file.c in the Linux kernel through 3.13.5 does not properly handle uncached write operations that copy fewer than the requested number of bytes, which allows local users to obtain sensitive information from kernel memory, cause a denial of service (memory corruption and system crash), or possibly gain privileges via a writev system call with a crafted pointer.
[[linux-cifs] 20140214 [PATCH] cifs: ensure that uncached writes handle unmapped areas correctly]
[http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=5d81de8e8667da7135d3a32a964087c0faf5483f]
[SUSE-SU-2014:0459]
[RHSA-2014:0328]
[[oss-security] 20140217 CVE-2014-0069 -- kernel: cifs: incorrect handling of bogus user pointers during uncached writes]
[65588]
[https://bugzilla.redhat.com/show_bug.cgi?id=1064253]
[https://github.com/torvalds/linux/commit/5d81de8e8667da7135d3a32a964087c0faf5483f]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
PackStack in Red Hat OpenStack 4.0 does not enforce the default security groups when deployed to Neutron, which allows remote attackers to bypass intended access restrictions and make unauthorized connections.
[RHSA-2014:0233]
[66001]
[https://bugzilla.redhat.com/show_bug.cgi?id=1064163]
ios/CDVFileTransfer.m in the Apache Cordova File-Transfer standalone plugin (org.apache.cordova.file-transfer) before 0.4.2 for iOS and the File-Transfer plugin for iOS from Cordova 2.4.0 through 2.9.0 might allow remote attackers to spoof SSL servers by leveraging a default value of true for the trustAllHosts option.
[http://d3adend.org/blog/?p=403]
[20140304 [CVE-2014-0072] Apache Cordova File-Transfer insecure defaults]
[20140304 [CVE-2014-0072] Apache Cordova File-Transfer insecure defaults]
[apache-cordova-cve20140072-weak-security(91561)]
[https://github.com/apache/cordova-plugin-file-transfer/commit/a1d6fc07e8a40c1b2b16f4103c403b30e1089668]
[[cordova-dev] 20140304 [CVE-2014-0072] Apache Cordova File-Transfer insecure defaults]
The CDVInAppBrowser class in the Apache Cordova In-App-Browser standalone plugin (org.apache.cordova.inappbrowser) before 0.3.2 for iOS and the In-App-Browser plugin for iOS from Cordova 2.6.0 through 2.9.0 does not properly validate callback identifiers, which allows remote attackers to execute arbitrary JavaScript in the host page and consequently gain privileges via a crafted gap-iab: URI.
[http://d3adend.org/blog/?p=403]
[20140304 [CVE-2014-0073] Apache Cordova In-App-Browser privilege escalation]
[20140304 [CVE-2014-0073] Apache Cordova In-App-Browser privilege escalation]
[65959]
[apache-cordova-cve20140073-priv-esc(91560)]
[https://github.com/apache/cordova-plugin-inappbrowser/commit/26702cb0720c5c394b407c23570136c53171fa55]
[[cordova-dev] 20140304 [CVE-2014-0073] Apache Cordova In-App-Browser privilege escalation]
Apache Shiro 1.x before 1.2.3, when using an LDAP server with unauthenticated bind enabled, allows remote attackers to bypass authentication via an empty (1) username or (2) password.
[RHSA-2014:1351]
[20140303 [Announce] Apache Shiro 1.2.3 Released - Security Advisory]
[https://issues.apache.org/jira/browse/SHIRO-460]
Integer overflow in the parseChunkHeader function in java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 allows remote attackers to cause a denial of service (resource consumption) via a malformed chunk size in chunked transfer coding of a request during the streaming of data.
[http://advisories.mageia.org/MGASA-2014-0268.html]
[http://linux.oracle.com/errata/ELSA-2014-0865.html]
[FEDORA-2015-2109]
[HPSBUX03102]
[HPSBUX03150]
[HPSBOV03503]
[RHSA-2015:0675]
[RHSA-2015:0720]
[RHSA-2015:0765]
[20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities]
[59121]
[http://svn.apache.org/viewvc?view=revision&revision=1578337]
[http://svn.apache.org/viewvc?view=revision&revision=1578341]
[http://svn.apache.org/viewvc?view=revision&revision=1579262]
[http://tomcat.apache.org/security-6.html]
[http://tomcat.apache.org/security-7.html]
[http://tomcat.apache.org/security-8.html]
[DSA-3447]
[DSA-3530]
[MDVSA-2015:052]
[MDVSA-2015:053]
[MDVSA-2015:084]
[http://www.novell.com/support/kb/doc.php?id=7010166]
[http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html]
[http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html]
[http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html]
[20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities]
[67671]
[http://www.vmware.com/security/advisories/VMSA-2014-0012.html]
[http://www-01.ibm.com/support/docview.wss?uid=swg21678231]
[http://www-01.ibm.com/support/docview.wss?uid=swg21680603]
[http://www-01.ibm.com/support/docview.wss?uid=swg21681528]
[https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013]
[[tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/]
[[tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/]
[[tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/]
[[tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/]
The Montgomery ladder implementation in OpenSSL through 1.0.0l does not ensure that certain swap operations have a constant-time behavior, which makes it easier for local users to obtain ECDSA nonces via a FLUSH+RELOAD cache side-channel attack.
[http://advisories.mageia.org/MGASA-2014-0165.html]
[http://eprint.iacr.org/2014/140]
[http://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=2198be3483259de374f91e57d247d0fc667aef29]
[http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10629]
[openSUSE-SU-2016:0640]
[openSUSE-SU-2014:0480]
[SSRT101590]
[HPSBOV03047]
[HPSBMU03057]
[HPSBMU03056]
[HPSBMU03051]
[HPSBGN03050]
[HPSBMU03074]
[HPSBMU03062]
[HPSBMU03076]
[58492]
[59040]
[59175]
[59264]
[59364]
[59374]
[59445]
[59454]
[http://support.apple.com/kb/HT6443]
[20140605 Multiple Vulnerabilities in OpenSSL Affecting Cisco Products]
[http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-345106.htm]
[MDVSA-2014:067]
[MDVSA-2015:062]
[http://www.novell.com/support/kb/doc.php?id=7015264]
[http://www.novell.com/support/kb/doc.php?id=7015300]
[http://www.openssl.org/news/secadv_20140605.txt]
[http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html]
[http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html]
[66363]
[USN-2165-1]
[http://www-01.ibm.com/support/docview.wss?uid=isg400001841]
[http://www-01.ibm.com/support/docview.wss?uid=isg400001843]
[http://www-01.ibm.com/support/docview.wss?uid=swg21673137]
[http://www-01.ibm.com/support/docview.wss?uid=swg21676035]
[http://www-01.ibm.com/support/docview.wss?uid=swg21676062]
[http://www-01.ibm.com/support/docview.wss?uid=swg21676092]
[http://www-01.ibm.com/support/docview.wss?uid=swg21676419]
[http://www-01.ibm.com/support/docview.wss?uid=swg21676424]
[http://www-01.ibm.com/support/docview.wss?uid=swg21676501]
[http://www-01.ibm.com/support/docview.wss?uid=swg21676655]
[http://www-01.ibm.com/support/docview.wss?uid=swg21677695]
[http://www-01.ibm.com/support/docview.wss?uid=swg21677828]
[https://bugs.gentoo.org/show_bug.cgi?id=505278]
[https://bugzilla.novell.com/show_bug.cgi?id=869945]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05301946]
[https://kc.mcafee.com/corporate/index?page=content&id=SB10075]
drivers/vhost/net.c in the Linux kernel before 3.13.10, when mergeable buffers are disabled, does not properly validate packet lengths, which allows guest OS users to cause a denial of service (memory corruption and host OS crash) or possibly gain privileges on the host OS via crafted packets, related to the handle_rx and get_rx_bufs functions.
[http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=d8316f3991d207fe32881a9ac20241be8fa2bad0]
[http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.13.10]
[66678]
[https://bugzilla.redhat.com/show_bug.cgi?id=1064440]
[https://github.com/torvalds/linux/commit/d8316f3991d207fe32881a9ac20241be8fa2bad0]
The CatalogController in Red Hat CloudForms Management Engine (CFME) before 5.2.3.2 allows remote authenticated users to delete arbitrary catalogs via vectors involving guessing the catalog ID.
[RHSA-2014:0469]
[https://bugzilla.redhat.com/show_bug.cgi?id=1064556]
The ValidateUserLogon function in provider/libserver/ECSession.cpp in Zarafa 7.1.8, 6.20.0, and earlier, when using certain build conditions, allows remote attackers to cause a denial of service (crash) via vectors related to "a NULL pointer of the password."
[MDVSA-2014:044]
[https://bugzilla.redhat.com/show_bug.cgi?id=1059903]
SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql/cast.rb in Active Record in Ruby on Rails 4.0.x before 4.0.3, and 4.1.0.beta1, when PostgreSQL is used, allows remote attackers to execute "add data" SQL commands via vectors involving \ (backslash) characters that are not properly handled in operations on array columns.
[[oss-security] 20140218 Data Injection Vulnerability in Active Record (CVE-2014-0080)]
[[rubyonrails-security] 20140218 Data Injection Vulnerability in Active Record (CVE-2014-0080)]
Multiple cross-site scripting (XSS) vulnerabilities in actionview/lib/action_view/helpers/number_helper.rb in Ruby on Rails before 3.2.17, 4.0.x before 4.0.3, and 4.1.x before 4.1.0.beta2 allow remote attackers to inject arbitrary web script or HTML via the (1) format, (2) negative_format, or (3) units parameter to the (a) number_to_currency, (b) number_to_percentage, or (c) number_to_human helper.
[openSUSE-SU-2014:0295]
[[oss-security] 20140218 XSS Vulnerability in number_to_currency, number_to_percentage and number_to_human (CVE-2014-0081)]
[RHSA-2014:0215]
[RHSA-2014:0306]
[65647]
[1029782]
[[rubyonrails-security] 20140218 XSS Vulnerability in number_to_currency, number_to_percentage and number_to_human (CVE-2014-0081)]
actionpack/lib/action_view/template/text.rb in Action View in Ruby on Rails 3.x before 3.2.17 converts MIME type strings to symbols during use of the :text option to the render method, which allows remote attackers to cause a denial of service (memory consumption) by including these strings in headers.
[openSUSE-SU-2014:0295]
[[oss-security] 20140218 Denial of Service Vulnerability in Action View when using render :text (CVE-2014-0082)]
[RHSA-2014:0215]
[RHSA-2014:0306]
[http://www.getchef.com/blog/2014/04/09/enterprise-chef-11-1-3-release/]
[[rubyonrails-security] 20140218 Denial of Service Vulnerability in Action View when using render :text (CVE-2014-0082)]
[https://puppet.com/security/cve/cve-2014-0082]
JBoss Fuse did not enable encrypted passwords by default in its usage of Apache Zookeeper. This permitted sensitive information disclosure via logging to local users. Note: this description has been updated; previous text mistakenly identified the source of the flaw as Zookeeper. Previous text: Apache Zookeeper logs cleartext admin passwords, which allows local users to obtain sensitive information by reading the log.
[https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-0085]
The doFilter function in webapp/PushHandlerFilter.java in JBoss RichFaces 4.3.4, 4.3.5, and 5.x allows remote attackers to cause a denial of service (memory consumption and out-of-memory error) via a large number of malformed atmosphere push requests.
[RHSA-2014:0335]
[https://bugzilla.redhat.com/show_bug.cgi?id=1067268]
[https://github.com/pslegr/core-1/commit/8131f15003f5bec73d475d2b724472e4b87d0757]
[https://issues.jboss.org/browse/RF-13250]
The check_privileges method in vmdb/app/controllers/application_controller.rb in ManageIQ, as used in Red Hat CloudForms Management Engine (CFME), allows remote authenticated users to bypass authorization and gain privileges by leveraging improper RBAC checking, related to the rbac_user_edit action.
[https://bugzilla.redhat.com/show_bug.cgi?id=1067623]
[https://github.com/ManageIQ/manageiq/issues/1581]
The SPDY implementation in the ngx_http_spdy_module module in nginx 1.5.10 before 1.5.11, when running on a 32-bit platform, allows remote attackers to execute arbitrary code via a crafted request.
[[nginx-announce] 20140304 nginx security advisory (CVE-2014-0088)]
[1030150]
Cross-site scripting (XSS) vulnerability in app/views/common/500.html.erb in Foreman 1.4.x before 1.4.2 allows remote authenticated users to inject arbitrary web script or HTML via the bookmark name when adding a bookmark.
[http://projects.theforeman.org/issues/4456]
[http://theforeman.org/security.html]
[https://bugzilla.redhat.com/show_bug.cgi?id=1071741]
Session fixation vulnerability in Foreman before 1.4.2 allows remote attackers to hijack web sessions via the session id cookie.
[http://projects.theforeman.org/issues/4457]
[http://theforeman.org/security.html]
[https://bugzilla.redhat.com/show_bug.cgi?id=1072151]
lib/x509/verify.c in GnuTLS before 3.1.22 and 3.2.x before 3.2.12 does not properly handle unspecified errors when verifying X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers via a crafted certificate.
[http://gnutls.org/security.html#GNUTLS-SA-2014-2]
[SUSE-SU-2014:0319]
[SUSE-SU-2014:0320]
[SUSE-SU-2014:0321]
[SUSE-SU-2014:0322]
[SUSE-SU-2014:0323]
[SUSE-SU-2014:0324]
[openSUSE-SU-2014:0325]
[openSUSE-SU-2014:0328]
[openSUSE-SU-2014:0346]
[SUSE-SU-2014:0445]
[RHSA-2014:0246]
[RHSA-2014:0247]
[RHSA-2014:0288]
[RHSA-2014:0339]
[DSA-2869]
[65919]
[USN-2127-1]
[https://bugzilla.redhat.com/show_bug.cgi?id=1069865]
Red Hat JBoss Enterprise Application Platform (JBEAP) 6.2.2, when using a Java Security Manager (JSM), does not properly apply permissions defined by a policy file, which causes applications to be granted the java.security.AllPermission permission and allows remote attackers to bypass intended access restrictions.
[RHSA-2014:0343]
[RHSA-2014:0344]
[RHSA-2014:0345]
[66596]
The ParametersInterceptor in Apache Struts before 2.3.16.2 allows remote attackers to "manipulate" the ClassLoader via the class parameter, which is passed to the getClass method.
[JVN#19294237]
[JVNDB-2014-000045]
[http://packetstormsecurity.com/files/127215/VMware-Security-Advisory-2014-0007.html]
[59178]
[http://struts.apache.org/release/2.3.x/docs/s2-020.html]
[http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-350733.htm]
[http://www.konakart.com/downloads/ver-7-3-0-0-whats-new]
[http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html]
[20140306 [ANN] Struts 2.3.16.1 GA release available - security fix]
[20140625 NEW VMSA-2014-0007 - VMware product updates address security vulnerabilities in Apache Struts library]
[65999]
[1029876]
[http://www.vmware.com/security/advisories/VMSA-2014-0007.html]
[http://www-01.ibm.com/support/docview.wss?uid=swg21676706]
java/org/apache/coyote/ajp/AbstractAjpProcessor.java in Apache Tomcat 8.x before 8.0.4 allows remote attackers to cause a denial of service (thread consumption) by using a "Content-Length: 0" AJP request to trigger a hang in request processing.
[20140527 [SECURITY] CVE-2014-0095 Apache Tomcat denial of service]
[http://svn.apache.org/viewvc?view=revision&revision=1578392]
[http://tomcat.apache.org/security-8.html]
[http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html]
[67673]
[1030300]
[http://www-01.ibm.com/support/docview.wss?uid=swg21678231]
[http://www-01.ibm.com/support/docview.wss?uid=swg21681528]
java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 does not properly restrict XSLT stylesheets, which allows remote attackers to bypass security-manager restrictions and read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
[http://advisories.mageia.org/MGASA-2014-0268.html]
[http://linux.oracle.com/errata/ELSA-2014-0865.html]
[FEDORA-2015-2109]
[HPSBUX03102]
[HPSBOV03503]
[RHSA-2015:0675]
[RHSA-2015:0720]
[RHSA-2015:0765]
[20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities]
[20140527 [SECURITY] CVE-2014-0096 Apache Tomcat information disclosure]
[59121]
[http://svn.apache.org/viewvc?view=revision&revision=1578610]
[http://svn.apache.org/viewvc?view=revision&revision=1578611]
[http://svn.apache.org/viewvc?view=revision&revision=1578637]
[http://svn.apache.org/viewvc?view=revision&revision=1578655]
[http://svn.apache.org/viewvc?view=revision&revision=1585853]
[http://tomcat.apache.org/security-6.html]
[http://tomcat.apache.org/security-7.html]
[http://tomcat.apache.org/security-8.html]
[DSA-3530]
[DSA-3552]
[MDVSA-2015:052]
[MDVSA-2015:053]
[MDVSA-2015:084]
[http://www.novell.com/support/kb/doc.php?id=7010166]
[http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html]
[http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html]
[http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html]
[20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities]
[67667]
[1030301]
[http://www.vmware.com/security/advisories/VMSA-2014-0012.html]
[http://www-01.ibm.com/support/docview.wss?uid=swg21678231]
[http://www-01.ibm.com/support/docview.wss?uid=swg21681528]
[https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013]
[[tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/]
[[tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/]
[[tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/]
[[tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/]
The ActiveDirectoryLdapAuthenticator in Spring Security 3.2.0 to 3.2.1 and 3.1.0 to 3.1.5 does not check the password length. If the directory allows anonymous binds then it may incorrectly authenticate a user who supplies an empty password.
[https://pivotal.io/security/cve-2014-0097]
The log_cookie function in mod_log_config.c in the mod_log_config module in the Apache HTTP Server before 2.4.8 allows remote attackers to cause a denial of service (segmentation fault and daemon crash) via a crafted cookie that is not properly handled during truncation.
[http://advisories.mageia.org/MGASA-2014-0135.html]
[APPLE-SA-2014-10-16-1]
[http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10698]
[APPLE-SA-2015-04-08-2]
[HPSBUX03102]
[HPSBUX03150]
[20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities]
[59219]
[GLSA-201408-12]
[http://support.f5.com/kb/en-us/solutions/public/15000/300/sol15320.html]
[http://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x/CHANGES]
[http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/loggers/mod_log_config.c]
[http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/loggers/mod_log_config.c?r1=1575394&r2=1575400&diff_format=h]
[http://www.apache.org/dist/httpd/CHANGES_2.4.9]
[http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html]
[http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html]
[20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities]
[66303]
[USN-2152-1]
[http://www.vmware.com/security/advisories/VMSA-2014-0012.html]
[http://www-01.ibm.com/support/docview.wss?uid=swg21668973]
[http://www-01.ibm.com/support/docview.wss?uid=swg21676091]
[http://www-01.ibm.com/support/docview.wss?uid=swg21676092]
[https://blogs.oracle.com/sunsecurity/entry/multiple_input_validation_vulnerabilities_in1]
[https://httpd.apache.org/security/vulnerabilities_24.html]
[[httpd-cvs] 20190815 svn commit: r1048743 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html]
[[httpd-cvs] 20190815 svn commit: r1048742 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html]
[https://puppet.com/security/cve/cve-2014-0098]
[https://support.apple.com/HT204659]
[https://support.apple.com/kb/HT6535]
Integer overflow in java/org/apache/tomcat/util/buf/Ascii.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4, when operated behind a reverse proxy, allows remote attackers to conduct HTTP request smuggling attacks via a crafted Content-Length HTTP header.
[http://advisories.mageia.org/MGASA-2014-0268.html]
[http://linux.oracle.com/errata/ELSA-2014-0865.html]
[FEDORA-2015-2109]
[HPSBUX03102]
[HPSBUX03150]
[HPSBOV03503]
[RHSA-2015:0675]
[RHSA-2015:0720]
[RHSA-2015:0765]
[20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities]
[20140527 [SECURITY] CVE-2014-0097 Apache Tomcat information disclosure]
[20140527 [SECURITY] Re: [SECURITY] CVE-2014-0099 Apache Tomcat information disclosure]
[59121]
[http://svn.apache.org/viewvc?view=revision&revision=1578812]
[http://svn.apache.org/viewvc?view=revision&revision=1578814]
[http://svn.apache.org/viewvc?view=revision&revision=1580473]
[http://tomcat.apache.org/security-6.html]
[http://tomcat.apache.org/security-7.html]
[http://tomcat.apache.org/security-8.html]
[DSA-3447]
[DSA-3530]
[MDVSA-2015:052]
[MDVSA-2015:053]
[MDVSA-2015:084]
[http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html]
[http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html]
[20140527 [SECURITY] CVE-2014-0097 Apache Tomcat information disclosure]
[20140527 Re: [SECURITY] CVE-2014-0099 Apache Tomcat information disclosure]
[20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities]
[67668]
[1030302]
[http://www.vmware.com/security/advisories/VMSA-2014-0012.html]
[http://www-01.ibm.com/support/docview.wss?uid=swg21678231]
[http://www-01.ibm.com/support/docview.wss?uid=swg21680603]
[http://www-01.ibm.com/support/docview.wss?uid=swg21681528]
[https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013]
[[tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/]
[[tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/]
[[tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/]
[[tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/]
Race condition in the inet_frag_intern function in net/ipv4/inet_fragment.c in the Linux kernel through 3.13.6 allows remote attackers to cause a denial of service (use-after-free error) or possibly have unspecified other impact via a large series of fragmented ICMP Echo Request packets to a system with a heavy CPU load.
[http://patchwork.ozlabs.org/patch/325844/]
[[oss-security] 20140304 CVE-2014-0100 -- Linux kernel: net: inet frag code race condition leading to user-after-free]
[https://bugzilla.redhat.com/show_bug.cgi?id=1070618]
The sctp_sf_do_5_1D_ce function in net/sctp/sm_statefuns.c in the Linux kernel through 3.13.6 does not validate certain auth_enable and auth_capable fields before making an sctp_sf_authenticate call, which allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) via an SCTP handshake with a modified INIT chunk and a crafted AUTH chunk before a COOKIE_ECHO chunk.
[http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=ec0223ec48a90cb605244b45f7c62de856403729]
[RHSA-2014:0328]
[RHSA-2014:0419]
[RHSA-2014:0432]
[59216]
[http://support.f5.com/kb/en-us/solutions/public/15000/300/sol15317.html]
[[oss-security] 20140304 CVE-2014-0101 -- Linux kernel: net: sctp: null pointer dereference when processing authenticated cookie_echo chunk]
[65943]
[USN-2173-1]
[USN-2174-1]
[https://bugzilla.redhat.com/show_bug.cgi?id=1070705]
[https://github.com/torvalds/linux/commit/ec0223ec48a90cb605244b45f7c62de856403729]
The keyring_detect_cycle_iterator function in security/keys/keyring.c in the Linux kernel through 3.13.6 does not properly determine whether keyrings are identical, which allows local users to cause a denial of service (OOPS) via crafted keyctl commands.
[[linux-kernel] 20140227 kernel BUG at security/keys/keyring.c:1003!]
[http://www.kernelhub.org/?msg=425013&p=2]
[[oss-security] 20140304 CVE-2014-0102 -- Linux kernel: security: keyring cycle detector DoS]
[https://bugzilla.redhat.com/show_bug.cgi?id=1072419]
WebAccess in Zarafa before 7.1.10 and WebApp before 1.6 stores credentials in cleartext, which allows local Apache users to obtain sensitive information by reading the PHP session files.
[http://advisories.mageia.org/MGASA-2014-0380.html]
[FEDORA-2014-7896]
[FEDORA-2014-7889]
[MDVSA-2014:182]
[68247]
[https://bugzilla.redhat.com/show_bug.cgi?id=1073618]
The auth_token middleware in the OpenStack Python client library for Keystone (aka python-keystoneclient) before 0.7.0 does not properly retrieve user tokens from memcache, which allows remote authenticated users to gain privileges in opportunistic circumstances via a large number of requests, related to an "interaction between eventlet and python-memcached."
[RHSA-2014:0382]
[RHSA-2014:0409]
[[oss-security] 20140327 [OSSA 2014-007] Potential context confusion in Keystone middleware (CVE-2014-0105)]
[https://bugs.launchpad.net/python-keystoneclient/+bug/1282865]
Sudo 1.6.9 before 1.8.5, when env_reset is disabled, does not properly check environment variables for the env_delete restriction, which allows local users with sudo permissions to bypass intended command restrictions via a crafted environment variable.
[APPLE-SA-2015-08-13-2]
[SUSE-SU-2014:0475]
[RHSA-2014:0266]
[[oss-security] 20140305 sudo: security policy bypass when env_reset is disabled]
[http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html]
[65997]
[http://www.sudo.ws/sudo/alerts/env_add.html]
[USN-2146-1]
[https://support.apple.com/kb/HT205031]
The TransformerFactory in Apache Xalan-Java before 2.7.2 does not properly restrict access to certain properties when FEATURE_SECURE_PROCESSING is enabled, which allows remote attackers to bypass expected restrictions and load arbitrary classes or access external resources via a crafted (1) xalan:content-header, (2) xalan:entities, (3) xslt:content-header, or (4) xslt:entities property, or a Java property that is bound to the XSLT 1.0 system-property function.
[RHSA-2014:0348]
[RHSA-2014:1351]
[RHSA-2015:1888]
[59151]
[59247]
[59290]
[59291]
[59515]
[http://svn.apache.org/viewvc?view=revision&revision=1581058]
[DSA-2886]
[http://www.ibm.com/support/docview.wss?uid=swg21677967]
[http://www.ocert.org/advisories/ocert-2014-002.html]
[http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html]
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[66397]
[1034711]
[1034716]
[http://www-01.ibm.com/support/docview.wss?uid=swg21674334]
[http://www-01.ibm.com/support/docview.wss?uid=swg21676093]
[http://www-01.ibm.com/support/docview.wss?uid=swg21677145]
[http://www-01.ibm.com/support/docview.wss?uid=swg21680703]
[http://www-01.ibm.com/support/docview.wss?uid=swg21681933]
[apache-xalanjava-cve20140107-sec-bypass(92023)]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324755]
[https://issues.apache.org/jira/browse/XALANJ-2435]
[GLSA-201604-02]
[https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html]
[https://www.tenable.com/security/tns-2018-15]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
Apache CXF before 2.6.14 and 2.7.x before 2.7.11 allows remote attackers to cause a denial of service (memory consumption) via a large request with the Content-Type set to text/html to a SOAP endpoint, which triggers an error.
[RHSA-2014:1351]
[RHSA-2015:0850]
[RHSA-2015:0851]
[1030201]
[https://cxf.apache.org/security-advisories.data/CVE-2014-0109.txt.asc?version=1&modificationDate=1398873370740&api=v2]
Apache CXF before 2.6.14 and 2.7.x before 2.7.11 allows remote attackers to cause a denial of service (/tmp disk consumption) via a large invalid SOAP message.
[http://cxf.apache.org/security-advisories.data/CVE-2014-0110.txt.asc?version=1&modificationDate=1398873378628&api=v2]
[RHSA-2014:1351]
[RHSA-2015:0850]
[RHSA-2015:0851]
[1030202]
Apache Syncope 1.0.0 before 1.0.9 and 1.1.0 before 1.1.7 allows remote administrators to execute arbitrary Java code via vectors related to Apache Commons JEXL expressions, "derived schema definition," "user / role templates," and "account links of resource mappings."
[[www-announce] 20140415 [SECURITY] CVE-2014-0111 Apache Syncope]
[http://syncope.apache.org/security.html]
[20140415 [SECURITY] CVE-2014-0111 Apache Syncope]
ParametersInterceptor in Apache Struts before 2.3.20 does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0094.
[JVN#19294237]
[JVNDB-2014-000045]
[http://packetstormsecurity.com/files/127215/VMware-Security-Advisory-2014-0007.html]
[59178]
[http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html]
[20140426 [ANN] Struts 2.3.16.2 GA release available - security fix]
[20140625 NEW VMSA-2014-0007 - VMware product updates address security vulnerabilities in Apache Struts library]
[67064]
[http://www.vmware.com/security/advisories/VMSA-2014-0007.html]
[http://www-01.ibm.com/support/docview.wss?uid=swg21676706]
[RHSA-2019:0910]
[https://bugzilla.redhat.com/show_bug.cgi?id=1091939]
[https://cwiki.apache.org/confluence/display/WW/S2-021]
CookieInterceptor in Apache Struts before 2.3.20, when a wildcard cookiesName value is used, does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0094.
[59178]
[http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html]
[20140426 [ANN] Struts 2.3.16.2 GA release available - security fix]
[http://www-01.ibm.com/support/docview.wss?uid=swg21676706]
[https://cwiki.apache.org/confluence/display/WW/S2-021]
Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via the class parameter, as demonstrated by the passing of this parameter to the getClass method of the ActionForm object in Struts 1.
[http://advisories.mageia.org/MGASA-2014-0219.html]
[[apache-ignite-developers] 20180601 [CVE-2014-0114]: Apache Ignite is vulnerable to existing CVE-2014-0114]
[http://commons.apache.org/proper/commons-beanutils/javadocs/v1.9.2/RELEASE-NOTES.txt]
[FEDORA-2014-9380]
[HPSBGN03041]
[HPSBMU03090]
[HPSBST03160]
[[oss-security] 20140616 CVE request for commons-beanutils: 'class' property is exposed, potentially leading to RCE]
[[oss-security] 20140707 Re: CVE request for commons-beanutils: 'class' property is exposed, potentially leading to RCE]
[20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities]
[57477]
[58710]
[58947]
[59118]
[59228]
[59245]
[59246]
[59430]
[59464]
[59479]
[59480]
[59718]
[DSA-2940]
[http://www.ibm.com/support/docview.wss?uid=swg21675496]
[MDVSA-2014:095]
[http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html]
[http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html]
[http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html]
[http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html]
[http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html]
[http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html]
[http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html]
[http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html]
[20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities]
[67121]
[http://www.vmware.com/security/advisories/VMSA-2014-0008.html]
[http://www.vmware.com/security/advisories/VMSA-2014-0012.html]
[http://www-01.ibm.com/support/docview.wss?uid=swg21674128]
[http://www-01.ibm.com/support/docview.wss?uid=swg21674812]
[http://www-01.ibm.com/support/docview.wss?uid=swg21675266]
[http://www-01.ibm.com/support/docview.wss?uid=swg21675387]
[http://www-01.ibm.com/support/docview.wss?uid=swg21675689]
[http://www-01.ibm.com/support/docview.wss?uid=swg21675898]
[http://www-01.ibm.com/support/docview.wss?uid=swg21675972]
[http://www-01.ibm.com/support/docview.wss?uid=swg21676091]
[http://www-01.ibm.com/support/docview.wss?uid=swg21676110]
[http://www-01.ibm.com/support/docview.wss?uid=swg21676303]
[http://www-01.ibm.com/support/docview.wss?uid=swg21676375]
[http://www-01.ibm.com/support/docview.wss?uid=swg21676931]
[http://www-01.ibm.com/support/docview.wss?uid=swg21677110]
[http://www-01.ibm.com/support/docview.wss?uid=swg27042296]
[RHSA-2018:2669]
[https://access.redhat.com/solutions/869353]
[https://bugzilla.redhat.com/show_bug.cgi?id=1091938]
[https://bugzilla.redhat.com/show_bug.cgi?id=1116665]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324755]
[https://issues.apache.org/jira/browse/BEANUTILS-463]
[[commons-dev] 20190525 Re: [beanutils2] CVE-2014-0114 Pull Request]
[[commons-issues] 20190522 [jira] [Work logged] (BEANUTILS-520) BeanUtils2 mitigate CVE-2014-0114]
[https://lists.apache.org/thread.html/084ae814e69178d2ce174cfdf149bc6e46d7524f3308c08d3adb43cb@%3Cissues.commons.apache.org%3E]
[[commons-issues] 20190528 [jira] [Closed] (BEANUTILS-520) BeanUtils2 mitigate CVE-2014-0114]
[https://lists.apache.org/thread.html/09981ae3df188a2ad1ce20f62ef76a5b2d27cf6b9ebab366cf1d6cc6@%3Cissues.commons.apache.org%3E]
[[commons-user] 20190814 [SECURITY] CVE-2019-10086. Apache Commons Beanutils does not suppresses the class property in PropertyUtilsBean by default.]
[[activemq-issues] 20190909 [jira] [Work logged] (ARTEMIS-2470) Update Apache BeanUtils to Address CVE-2014-0114]
[[commons-commits] 20190906 [commons-configuration] branch master updated: [CONFIGURATION-755][CVE-2014-0114] Update Apache Commons BeanUtils from 1.9.3 to 1.9.4.]
[https://lists.apache.org/thread.html/15fcdf27fa060de276edc0b4098526afc21c236852eb3de9be9594f3@%3Cissues.commons.apache.org%3E]
[[commons-issues] 20190906 [jira] [Closed] (CONFIGURATION-755) [CVE-2014-0114] Update Apache Commons BeanUtils from 1.9.3 to 1.9.4.]
[[commons-issues] 20190615 [jira] [Resolved] (BEANUTILS-520) BeanUtils2 mitigate CVE-2014-0114]
[https://lists.apache.org/thread.html/2ba22f2e3de945039db735cf6cbf7f8be901ab2537337c7b1dd6a0f0@%3Cissues.commons.apache.org%3E]
[[commons-commits] 20190528 [commons-beanutils] branch master updated: BEANUTILS-520: Mitigate CVE-2014-0114 by enabling SuppressPropertiesBeanIntrospector.SUPPRESS_CLASS by default. (#7)]
[[infra-devnull] 20190329 [GitHub] [pulsar] massakam opened pull request #3938: Upgrade third party libraries with security vulnerabilities]
[[activemq-issues] 20190904 [jira] [Created] (ARTEMIS-2470) Update Apache BeanUtils to Address CVE-2014-0114]
[[commons-dev] 20190522 [beanutils2] CVE-2014-0114 Pull Request]
[[commons-issues] 20190528 [jira] [Work logged] (BEANUTILS-520) BeanUtils2 mitigate CVE-2014-0114]
[https://lists.apache.org/thread.html/4c3fd707a049bfe0577dba8fc9c4868ffcdabe68ad86586a0a49242e@%3Cissues.commons.apache.org%3E]
[https://lists.apache.org/thread.html/65b39fa6d700e511927e5668a4038127432178a210aff81500eb36e5@%3Cissues.commons.apache.org%3E]
[https://lists.apache.org/thread.html/6afe2f935493e69a332b9c5a4f23cafe95c15ede1591a492cf612293@%3Cissues.commons.apache.org%3E]
[https://lists.apache.org/thread.html/6b30629b32d020c40d537f00b004d281c37528d471de15ca8aec2cd4@%3Cissues.commons.apache.org%3E]
[https://lists.apache.org/thread.html/869c08899f34c1a70c9fb42f92ac0d043c98781317e0c19d7ba3f5e3@%3Cissues.commons.apache.org%3E]
[[commons-dev] 20190814 [SECURITY] CVE-2019-10086. Apache Commons Beanutils does not suppresses the class property in PropertyUtilsBean by default.]
[[commons-issues] 20190522 [jira] [Commented] (BEANUTILS-520) BeanUtils2 mitigate CVE-2014-0114]
[[announce] 20190814 [SECURITY] CVE-2019-10086. Apache Commons Beanutils does not suppresses the class property in PropertyUtilsBean by default.]
[[commons-issues] 20190906 [jira] [Updated] (CONFIGURATION-755) [CVE-2014-0114] Update Apache Commons BeanUtils from 1.9.3 to 1.9.4.]
[[commons-issues] 20190521 [jira] [Created] (BEANUTILS-520) BeanUtils2 mitigate CVE-2014-0114]
[https://lists.apache.org/thread.html/9b5505632f5683ee17bda4f7878525e672226c7807d57709283ffa64@%3Cissues.commons.apache.org%3E]
[https://lists.apache.org/thread.html/aa4ca069c7aea5b1d7329bc21576c44a39bcc4eb7bb2760c4b16f2f6@%3Cissues.commons.apache.org%3E]
[[commons-commits] 20190528 [commons-beanutils] branch master updated: [BEANUTILS-520] BeanUtils2 mitigate CVE-2014-0114.]
[[pulsar-commits] 20190329 [GitHub] [pulsar] massakam opened a new pull request #3938: Upgrade third party libraries with security vulnerabilities]
[[commons-issues] 20190818 [jira] [Commented] (BEANUTILS-520) BeanUtils2 mitigate CVE-2014-0114]
[[commons-issues] 20190615 [jira] [Updated] (BEANUTILS-520) BeanUtils2 mitigate CVE-2014-0114]
[[activemq-gitbox] 20190903 [GitHub] [activemq-artemis] jeloba opened a new pull request #2820: Updated Apache BeanUtils to address CVE]
[[commons-dev] 20190605 Re: [beanutils] Towards 1.10]
[[commons-issues] 20190615 [jira] [Reopened] (BEANUTILS-520) BeanUtils2 mitigate CVE-2014-0114]
[[commons-notifications] 20190528 Build failed in Jenkins: commons-beanutils #75]
[https://lists.apache.org/thread.html/f3682772e62926b5c009eed63c62767021be6da0bb7427610751809f@%3Cissues.commons.apache.org%3E]
[[commons-notifications] 20190528 Build failed in Jenkins: commons-beanutils #74]
[https://lists.apache.org/thread.html/ffde3f266d3bde190b54c9202169e7918a92de7e7e0337d792dc7263@%3Cissues.commons.apache.org%3E]
[GLSA-201607-09]
[https://security.netapp.com/advisory/ntap-20140911-0001/]
[https://security.netapp.com/advisory/ntap-20180629-0006/]
[https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html]
[https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html]
[https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html]
Directory traversal vulnerability in the log viewer in Apache Storm 0.9.0.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter to log.
[https://issues.apache.org/jira/browse/STORM-269]
[[storm-dev] 20140429 [jira] [Commented] (STORM-269) Any readable file exposed via UI log viewer]
CookieInterceptor in Apache Struts 2.x before 2.3.20, when a wildcard cookiesName value is used, does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and modify session state via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0113.
[http://struts.apache.org/release/2.3.x/docs/s2-022.html]
[http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-350733.htm]
[http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html]
[67218]
The mod_proxy module in the Apache HTTP Server 2.4.x before 2.4.10, when a reverse proxy is enabled, allows remote attackers to cause a denial of service (child-process crash) via a crafted HTTP Connection header.
Per vendor advisory http://httpd.apache.org/security/vulnerabilities_24.html
"A flaw was found in mod_proxy in httpd versions 2.4.6 to 2.4.9."
[http://advisories.mageia.org/MGASA-2014-0305.html]
[http://httpd.apache.org/security/vulnerabilities_24.html]
[APPLE-SA-2015-04-08-2]
[20140722 Apache HTTPd - description of the CVE-2014-0117.]
[http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/proxy/mod_proxy_http.c]
[http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/proxy/mod_proxy_http.c?r1=1599486&r2=1610674&diff_format=h]
[http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/proxy/proxy_util.c]
[http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/proxy/proxy_util.c?r1=1609680&r2=1610674&diff_format=h]
[http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html]
[http://zerodayinitiative.com/advisories/ZDI-14-239/]
[https://bugzilla.redhat.com/show_bug.cgi?id=1120599]
[[httpd-cvs] 20190815 svn commit: r1048743 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html]
[https://support.apple.com/HT204659]
The deflate_in_filter function in mod_deflate.c in the mod_deflate module in the Apache HTTP Server before 2.4.10, when request body decompression is enabled, allows remote attackers to cause a denial of service (resource consumption) via crafted request data that decompresses to a much larger size.
[http://advisories.mageia.org/MGASA-2014-0304.html]
[http://advisories.mageia.org/MGASA-2014-0305.html]
[http://httpd.apache.org/security/vulnerabilities_24.html]
[APPLE-SA-2015-04-08-2]
[SSRT102066]
[HPSBMU03380]
[HPSBMU03409]
[HPSBUX03512]
[RHSA-2014:1019]
[RHSA-2014:1020]
[RHSA-2014:1021]
[http://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x/CHANGES]
[http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/filters/mod_deflate.c]
[http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/filters/mod_deflate.c?r1=1604353&r2=1610501&diff_format=h]
[DSA-2989]
[MDVSA-2014:142]
[http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html]
[68745]
[https://bugzilla.redhat.com/show_bug.cgi?id=1120601]
[https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04832246]
[[httpd-cvs] 20190815 svn commit: r1048743 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html]
[https://puppet.com/security/cve/cve-2014-0118]
[GLSA-201504-03]
[https://support.apple.com/HT204659]
Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loader that accesses the XML parser used with an XSLT stylesheet, which allows remote attackers to (1) read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, or (2) read files associated with different web applications on a single Tomcat instance via a crafted web application.
[http://advisories.mageia.org/MGASA-2014-0268.html]
[HPSBUX03102]
[HPSBOV03503]
[RHSA-2015:0675]
[RHSA-2015:0720]
[RHSA-2015:0765]
[20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities]
[20140527 [SECURITY] CVE-2014-0119 Apache Tomcat information disclosure]
[http://svn.apache.org/viewvc?view=revision&revision=1588193]
[http://svn.apache.org/viewvc?view=revision&revision=1588199]
[http://svn.apache.org/viewvc?view=revision&revision=1589640]
[http://svn.apache.org/viewvc?view=revision&revision=1589837]
[http://svn.apache.org/viewvc?view=revision&revision=1589980]
[http://svn.apache.org/viewvc?view=revision&revision=1589983]
[http://svn.apache.org/viewvc?view=revision&revision=1589985]
[http://svn.apache.org/viewvc?view=revision&revision=1589990]
[http://svn.apache.org/viewvc?view=revision&revision=1589992]
[http://svn.apache.org/viewvc?view=revision&revision=1589997]
[http://svn.apache.org/viewvc?view=revision&revision=1590028]
[http://svn.apache.org/viewvc?view=revision&revision=1590036]
[http://svn.apache.org/viewvc?view=revision&revision=1593815]
[http://svn.apache.org/viewvc?view=revision&revision=1593821]
[http://tomcat.apache.org/security-6.html]
[http://tomcat.apache.org/security-7.html]
[http://tomcat.apache.org/security-8.html]
[DSA-3530]
[DSA-3552]
[MDVSA-2015:052]
[MDVSA-2015:053]
[MDVSA-2015:084]
[http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html]
[http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html]
[http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html]
[20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities]
[67669]
[1030298]
[USN-2654-1]
[http://www.vmware.com/security/advisories/VMSA-2014-0012.html]
[http://www-01.ibm.com/support/docview.wss?uid=swg21678231]
[http://www-01.ibm.com/support/docview.wss?uid=swg21681528]
[https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013]
[[tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/]
[[tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/]
[[tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/]
[[tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/]
Cross-site request forgery (CSRF) vulnerability in the admin terminal in Hawt.io allows remote attackers to hijack the authentication of arbitrary users for requests that run commands on the Karaf server, as demonstrated by running "shutdown -f."
[https://bugzilla.redhat.com/show_bug.cgi?id=1072681]
[https://github.com/hawtio/hawtio/commit/b4e23e002639c274a2f687ada980118512f06113]
[https://infocon.org/cons/SyScan/SyScan%202015%20Singapore/SyScan%202015%20Singapore%20presentations/SyScan15%20David%20Jorm%20-%20Finding%20and%20exploiting%20novel%20flaws%20in%20Java%20software.pdf]
The admin terminal in Hawt.io does not require authentication, which allows remote attackers to execute arbitrary commands via the k parameter.
[https://bugzilla.redhat.com/show_bug.cgi?id=1072716]
[https://github.com/hawtio/hawtio/commit/5289715e4f2657562fdddcbad830a30969b96e1e]
[https://infocon.org/cons/SyScan/SyScan%202015%20Singapore/SyScan%202015%20Singapore%20presentations/SyScan15%20David%20Jorm%20-%20Finding%20and%20exploiting%20novel%20flaws%20in%20Java%20software.pdf]
mod/chat/chat_ajax.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 does not properly check for the mod/chat:chat capability during chat sessions, which allows remote authenticated users to bypass intended access restrictions in opportunistic circumstances by remaining in a chat session after an intra-session capability removal by an administrator.
[http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-44082]
[[oss-security] 20140317 Moodle security notifications public]
[https://moodle.org/mod/forum/discuss.php?d=256418]
The wiki subsystem in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 does not properly restrict (1) view and (2) edit access, which allows remote authenticated users to perform wiki operations by leveraging the student role and using the Recent Activity block to reach the individual wiki of an arbitrary student.
[http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-39990]
[[oss-security] 20140317 Moodle security notifications public]
[https://moodle.org/mod/forum/discuss.php?d=256419]
The identity-reporting implementations in mod/forum/renderer.php and mod/quiz/override_form.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 do not properly restrict the display of e-mail addresses, which allows remote authenticated users to obtain sensitive information by using the (1) Forum or (2) Quiz module.
[http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-43916]
[[oss-security] 20140317 Moodle security notifications public]
[https://moodle.org/mod/forum/discuss.php?d=256421]
repository/alfresco/lib.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 places a session key in a URL, which allows remote attackers to bypass intended Alfresco Repository file restrictions by impersonating a file's owner.
[http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-29409]
[[oss-security] 20140317 Moodle security notifications public]
[https://moodle.org/mod/forum/discuss.php?d=256422]
Cross-site request forgery (CSRF) vulnerability in enrol/imsenterprise/importnow.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 allows remote attackers to hijack the authentication of administrators for requests that import an IMS Enterprise file.
[http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-43146]
[[oss-security] 20140317 Moodle security notifications public]
[https://moodle.org/mod/forum/discuss.php?d=256423]
The time-validation implementation in (1) mod/feedback/complete.php and (2) mod/feedback/complete_guest.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 allows remote authenticated users to bypass intended restrictions on starting a Feedback activity by choosing an unavailable time.
[http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-43656]
[[oss-security] 20140317 Moodle security notifications public]
[https://moodle.org/mod/forum/discuss.php?d=256417]
Squid 3.1 before 3.3.12 and 3.4 before 3.4.4, when SSL-Bump is enabled, allows remote attackers to cause a denial of service (assertion failure) via a crafted range request, related to state management.
[SUSE-SU-2016:1996]
[SUSE-SU-2016:2089]
[openSUSE-SU-2014:0513]
[openSUSE-SU-2014:0559]
[http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html]
[66112]
[http://www.squid-cache.org/Advisories/SQUID-2014_1.txt]
badges/mybadges.php in Moodle 2.5.x before 2.5.5 and 2.6.x before 2.6.2 does not properly track the user to whom a badge was issued, which allows remote authenticated users to modify the visibility of an arbitrary badge via unspecified vectors.
[http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-44140]
[[oss-security] 20140317 Moodle security notifications public]
[https://moodle.org/mod/forum/discuss.php?d=256424]
Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails before 3.2.18, 4.0.x before 4.0.5, and 4.1.x before 4.1.1, when certain route globbing configurations are enabled, allows remote attackers to read arbitrary files via a crafted request.
[http://matasano.com/research/AnatomyOfRailsVuln-CVE-2014-0130.pdf]
[RHSA-2014:1863]
[67244]
[[rubyonrails-security] 20140506 [CVE-2014-0130] Directory Traversal Vulnerability With Certain Route Configurations]
Use-after-free vulnerability in the skb_segment function in net/core/skbuff.c in the Linux kernel through 3.13.6 allows attackers to obtain sensitive information from kernel memory by leveraging the absence of a certain orphaning operation.
[http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=1fd819ecb90cc9b822cd84d3056ddba315d3340f]
[SUSE-SU-2015:0481]
[openSUSE-SU-2015:0566]
[[oss-security] 20140310 CVE-2014-0131 -- kernel: net: use-after-free during segmentation with zerocopy]
[[netdev] 20140310 [PATCH 0/5] skbuff: fix skb_segment with zero copy skbs]
[[netdev] 20140310 [PATCH 5/5] skbuff: skb_segment: orphan frags before copying]
[https://bugzilla.redhat.com/show_bug.cgi?id=1074589]
[https://github.com/torvalds/linux/commit/1fd819ecb90cc9b822cd84d3056ddba315d3340f]
The SASL authentication functionality in 389 Directory Server before 1.2.11.26 allows remote authenticated users to connect as an arbitrary user and gain privileges via the authzid parameter in a SASL/GSSAPI bind.
[RHSA-2014:0292]
[https://fedorahosted.org/389/changeset/76acff12a86110d4165f94e2cba13ef5c7ebc38a/]
[https://fedorahosted.org/389/ticket/47739]
Heap-based buffer overflow in the SPDY implementation in nginx 1.3.15 before 1.4.7 and 1.5.x before 1.5.12 allows remote attackers to execute arbitrary code via a crafted request.
[openSUSE-SU-2014:0450]
[[nginx-announce] 20140318 nginx security advisory (CVE-2014-0133)]
[66537]
The instance rescue mode in OpenStack Compute (Nova) 2013.2 before 2013.2.3 and Icehouse before 2014.1, when using libvirt to spawn images and use_cow_images is set to false, allows remote authenticated users to read certain compute host files by overwriting an instance disk with a crafted image.
[[oss-security] 20140327 [OSSA 2014-009] Nova host data leak to vm instance in rescue mode (CVE-2014-0134)]
[USN-2247-1]
[https://bugs.launchpad.net/nova/+bug/1221190]
Kafo before 0.3.17 and 0.4.x before 0.5.2, as used by Foreman, uses world-readable permissions for default_values.yaml, which allows local users to obtain passwords and other sensitive information by reading the file.
[http://theforeman.org/security.html]
The (1) get and (2) log methods in the AgentController in Red Hat CloudForms 3.0 Management Engine (CFME) 5.x allow remote attackers to insert arbitrary text into log files via unspecified vectors.
[RHSA-2014:1037]
[69233]
SQL injection vulnerability in the saved_report_delete action in the ReportController in Red Hat CloudForms Management Engine (CFME) before 5.2.3.2 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, related to MiqReportResult.exists.
[RHSA-2014:0469]
The default configuration in cURL and libcurl 7.10.6 before 7.36.0 re-uses (1) SCP, (2) SFTP, (3) POP3, (4) POP3S, (5) IMAP, (6) IMAPS, (7) SMTP, (8) SMTPS, (9) LDAP, and (10) LDAPS connections, which might allow context-dependent attackers to connect as other users via a request, a similar issue to CVE-2014-0015.
[http://curl.haxx.se/docs/adv_20140326A.html]
[openSUSE-SU-2014:0530]
[20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities]
[58615]
[DSA-2902]
[http://www.getchef.com/blog/2014/04/09/chef-server-11-0-12-release/]
[http://www.getchef.com/blog/2014/04/09/enterprise-chef-11-1-3-release/]
[http://www.getchef.com/blog/2014/04/09/enterprise-chef-1-4-9-release/]
[http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html]
[20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities]
[USN-2167-1]
[http://www.vmware.com/security/advisories/VMSA-2014-0012.html]
[http://www-01.ibm.com/support/docview.wss?uid=swg21675820]
[http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095862]
cURL and libcurl 7.1 before 7.36.0, when using the OpenSSL, axtls, qsossl or gskit libraries for TLS, recognize a wildcard IP address in the subject's Common Name (CN) field of an X.509 certificate, which might allow man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority.
[http://advisories.mageia.org/MGASA-2015-0165.html]
[http://curl.haxx.se/docs/adv_20140326B.html]
[openSUSE-SU-2014:0530]
[58615]
[DSA-2902]
[http://www.getchef.com/blog/2014/04/09/chef-server-11-0-12-release/]
[http://www.getchef.com/blog/2014/04/09/enterprise-chef-11-1-3-release/]
[http://www.getchef.com/blog/2014/04/09/enterprise-chef-1-4-9-release/]
[MDVSA-2015:213]
[http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html]
[USN-2167-1]
[http://www-01.ibm.com/support/docview.wss?uid=swg21675820]
[http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095862]
Red Hat CloudForms 3.1 Management Engine (CFME) before 5.3 allows remote authenticated users to access sensitive controllers and actions via a direct HTTP or HTTPS request.
[RHSA-2014:1317]
[https://bugzilla.redhat.com/show_bug.cgi?id=1077359]
Cross-site scripting (XSS) vulnerability in Red Hat Satellite 6.0.3.
[https://bugzilla.redhat.com/show_bug.cgi?id=1187466]
QEMU, possibly before 2.0.0, allows local users to cause a denial of service (divide-by-zero error and crash) via a zero value in the (1) tracks field to the seek_to_sector function in block/parallels.c or (2) extent_size field in the bochs function in block/bochs.c.
[http://git.qemu.org/?p=qemu.git;a=commitdiff;h=8e53abbc20d08ae3ec30c2054e1161314ad9501d]
[http://git.qemu.org/?p=qemu.git;a=commitdiff;h=9302e863aa8baa5d932fc078967050c055fa1a7f]
[RHSA-2014:0420]
[RHSA-2014:0421]
[DSA-3044]
[https://bugzilla.redhat.com/show_bug.cgi?id=1078201]
Multiple integer overflows in the block drivers in QEMU, possibly before 2.0.0, allow local users to cause a denial of service (crash) via a crafted catalog size in (1) the parallels_open function in block/parallels.c or (2) bochs_open function in bochs.c, a large L1 table in the (3) qcow2_snapshot_load_tmp in qcow2-snapshot.c or (4) qcow2_grow_l1_table function in qcow2-cluster.c, (5) a large request in the bdrv_check_byte_request function in block.c and other block drivers, (6) crafted cluster indexes in the get_refcount function in qcow2-refcount.c, or (7) a large number of blocks in the cloop_open function in cloop.c, which trigger buffer overflows, memory corruption, large memory allocations and out-of-bounds read and writes.
[http://git.qemu.org/?p=qemu.git;a=commit;h=509a41bab5306181044b5fff02eadf96d9c8676a]
[http://git.qemu.org/?p=qemu.git;a=commit;h=6a83f8b5bec6f59e56cc49bd49e4c3f8f805d56f]
[http://git.qemu.org/?p=qemu.git;a=commit;h=8f4754ede56e3f9ea3fd7207f4a7c4453e59285b]
[http://git.qemu.org/?p=qemu.git;a=commit;h=afbcc40bee4ef51731102d7d4b499ee12fc182e1]
[http://git.qemu.org/?p=qemu.git;a=commit;h=cab60de930684c33f67d4e32c7509b567f8c445b]
[http://git.qemu.org/?p=qemu.git;a=commit;h=db8a31d11d6a60f48d6817530640d75aa72a9a2f]
[http://git.qemu.org/?p=qemu.git;a=commit;h=e3737b820b45e54b059656dc3f914f895ac7a88b]
[RHSA-2014:0420]
[RHSA-2014:0421]
[DSA-3044]
[https://bugzilla.redhat.com/show_bug.cgi?id=1079140]
Multiple buffer overflows in QEMU before 1.7.2 and 2.x before 2.0.0, allow local users to cause a denial of service (crash) or possibly execute arbitrary code via a large (1) L1 table in the qcow2_snapshot_load_tmp in the QCOW 2 block driver (block/qcow2-snapshot.c) or (2) uncompressed chunk, (3) chunk length, or (4) number of sectors in the DMG block driver (block/dmg.c).
[http://git.qemu.org/?p=qemu.git;a=commit;h=c05e4667be91b46ab42b5a11babf8e84d476cc6b]
[http://git.qemu.org/?p=qemu.git;a=commit;h=f0dce23475b5af5da6b17b97c1765271307734b6]
[http://git.qemu.org/?p=qemu.git;a=commitdiff;h=c165f7758009a4f793c1fc19ebb69cf55313450b]
[RHSA-2014:0420]
[RHSA-2014:0421]
[DSA-3044]
[[oss-security] 20140326 QEMU image format input validation fixes (multiple CVEs)]
[https://bugzilla.redhat.com/show_bug.cgi?id=1078885]
[https://lists.gnu.org/archive/html/qemu-devel/2014-03/msg04994.html]
The qcow2_open function in the (block/qcow2.c) in QEMU before 1.7.2 and 2.x before 2.0.0 allows local users to cause a denial of service (NULL pointer dereference) via a crafted image which causes an error, related to the initialization of the snapshot_offset and nb_snapshots fields.
[http://git.qemu.org/?p=qemu.git;a=commit;h=11b128f4062dd7f89b14abc8877ff20d41b28be9]
[RHSA-2014:0420]
[RHSA-2014:0421]
[DSA-3044]
[[oss-security] 20140326 QEMU image format input validation fixes (multiple CVEs)]
[https://bugzilla.redhat.com/show_bug.cgi?id=1078232]
Multiple cross-site scripting (XSS) vulnerabilities in Red Hat JBoss Web Framework Kit 2.5.0 allow remote attackers to inject arbitrary web script or HTML via a (1) parameter or (2) id name.
[RHSA-2014:0462]
[https://bugzilla.redhat.com/show_bug.cgi?id=1078646]
Integer overflow in the virtio_net_handle_mac function in hw/net/virtio-net.c in QEMU 2.0 and earlier allows local guest users to execute arbitrary code via a MAC addresses table update request, which triggers a heap-based buffer overflow.
[[Qemu-devel] 20140411 Re: [PATCH for-2.0] virtio-net: fix guest-triggerable buffer overrun]
[[Qemu-devel] 20140411 [PATCH for-2.0] virtio-net: fix guest-triggerable buffer overrun]
[DSA-2909]
[DSA-2910]
[USN-2182-1]
[https://bugzilla.redhat.com/show_bug.cgi?id=1078846]
Cross-site request forgery (CSRF) vulnerability in oVirt Engine before 3.5.0 beta2 allows remote attackers to hijack the authentication of users for requests that perform unspecified actions via a REST API request.
[RHSA-2015:0158]
[http://www.ovirt.org/OVirt_3.5_Release_Notes]
[https://bugzilla.redhat.com/show_bug.cgi?id=1077441]
Session fixation vulnerability in the web admin interface in oVirt 3.4.0 and earlier allows remote attackers to hijack web sessions via unspecified vectors.
[http://gerrit.ovirt.org/#/c/25959/]
[http://www.ovirt.org/Security_advisories]
The REST API in oVirt 3.4.0 and earlier stores session IDs in HTML5 local storage, which allows remote attackers to obtain sensitive information via a crafted web page.
[http://gerrit.ovirt.org/#/c/25987/]
[http://www.ovirt.org/Security_advisories]
oVirt Engine before 3.5.0 does not include the HTTPOnly flag in a Set-Cookie header for the session IDs, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.
[RHSA-2015:0158]
[https://bugzilla.redhat.com/show_bug.cgi?id=1077450]
The ioapic_deliver function in virt/kvm/ioapic.c in the Linux kernel through 3.14.1 does not properly validate the kvm_irq_delivery_to_apic return value, which allows guest OS users to cause a denial of service (host OS crash) via a crafted entry in the redirection table of an I/O APIC. NOTE: the affected code was moved to the ioapic_service function before the vulnerability was announced.
[http://git.kernel.org/cgit/virt/kvm/kvm.git/commit/?id=5678de3f15010b9022ee45673f33bcfc71d47b60]
[[oss-security] 20140407 CVE-2014-0155 -- kernel: kvm: BUG caused by invalid entry in guest ioapic redirection table]
[https://bugzilla.redhat.com/show_bug.cgi?id=1081589]
Cross-site scripting (XSS) vulnerability in the Horizon Orchestration dashboard in OpenStack Dashboard (aka Horizon) 2013.2 before 2013.2.4 and icehouse before icehouse-rc2 allows remote attackers to inject arbitrary web script or HTML via the description field of a Heat template.
[openSUSE-SU-2015:0078]
[[oss-security] 20140408 [OSSA 2014-010] XSS in Horizon orchestration dashboard (CVE-2014-0157)]
[66706]
[https://launchpad.net/bugs/1289033]
Heap-based buffer overflow in the JPEG2000 image tile decoder in OpenJPEG before 1.5.2 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file because of incorrect j2k_decode, j2k_read_eoc, and tcd_decode_tile interaction, a related issue to CVE-2013-6045. NOTE: this is not a duplicate of CVE-2013-1447, because the scope of CVE-2013-1447 was specifically defined in http://openwall.com/lists/oss-security/2013/12/04/6 as only "null pointer dereferences, division by zero, and anything that would just fit as DoS."
[https://bugzilla.redhat.com/show_bug.cgi?id=1082925]
[https://bugzilla.suse.com/show_bug.cgi?id=871412]
Buffer overflow in the GetStatistics64 remote procedure call (RPC) in OpenAFS 1.4.8 before 1.6.7 allows remote attackers to cause a denial of service (crash) via a crafted statsVersion argument.
[http://openafs.org/pages/security/OPENAFS-SA-2014-001.txt]
[DSA-2899]
[MDVSA-2014:244]
[http://www.openafs.org/frameset/dl/openafs/1.6.7/ChangeLog]
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c, aka the Heartbleed bug.
CVSS V2 scoring evaluates the impact of the vulnerability on the host where the vulnerability is located. When evaluating the impact of this vulnerability to your organization, take into account the nature of the data that is being protected and act according to your organization’s risk acceptance. While CVE-2014-0160 does not allow unrestricted access to memory on the targeted host, a successful exploit does leak information from memory locations which have the potential to contain particularly sensitive information, e.g., cryptographic keys and passwords. Theft of this information could enable other attacks on the information system, the impact of which would depend on the sensitivity of the data and functions of that system.
[http://advisories.mageia.org/MGASA-2014-0165.html]
[http://blog.fox-it.com/2014/04/08/openssl-heartbleed-bug-live-blog/]
[http://cogentdatahub.com/ReleaseNotes.html]
[http://download.schneider-electric.com/files?p_Doc_Ref=SEVD%202014-119-01]
[http://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=96db9023b881d7cd9f379b0c154650d6c108e9a3]
[http://heartbleed.com/]
[FEDORA-2014-4879]
[FEDORA-2014-4910]
[FEDORA-2014-9308]
[openSUSE-SU-2014:0492]
[SUSE-SA:2014:002]
[openSUSE-SU-2014:0560]
[HPSBMU02995]
[HPSBMU02994]
[HPSBMU02998]
[HPSBMU02997]
[HPSBST03001]
[HPSBMU02999]
[HPSBGN03008]
[HPSBGN03010]
[HPSBMU03012]
[HPSBMU03019]
[HPSBMU03017]
[HPSBMU03018]
[HPSBST03015]
[HPSBMU03013]
[HPSBGN03011]
[HPSBHF03021]
[HPSBPI03014]
[HPSBMU03020]
[HPSBST03016]
[HPSBMU03023]
[HPSBMU03025]
[HPSBMU03022]
[HPSBMU03024]
[HPSBPI03031]
[HPSBMU03029]
[HPSBMU03028]
[HPSBMU03033]
[HPSBMU03030]
[HPSBMU03032]
[HPSBMU03009]
[HPSBST03004]
[HPSBST03027]
[HPSBMU03040]
[HPSBMU03044]
[HPSBMU03037]
[HPSBMU03062]
[HPSBHF03136]
[SSRT101846]
[http://public.support.unisys.com/common/public/vulnerability/NVD_Detail_Rpt.aspx?ID=1]
[http://public.support.unisys.com/common/public/vulnerability/NVD_Detail_Rpt.aspx?ID=3]
[RHSA-2014:0376]
[RHSA-2014:0377]
[RHSA-2014:0378]
[RHSA-2014:0396]
[20140409 Re: heartbleed OpenSSL bug CVE-2014-0160]
[20140411 MRI Rubies may contain statically linked, vulnerable OpenSSL]
[20140412 Re: heartbleed OpenSSL bug CVE-2014-0160]
[20140408 heartbleed OpenSSL bug CVE-2014-0160]
[20140408 Re: heartbleed OpenSSL bug CVE-2014-0160]
[20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities]
[59139]
[59243]
[59347]
[http://support.citrix.com/article/CTX140605]
[20140409 OpenSSL Heartbeat Extension Vulnerability in Multiple Cisco Products]
[http://www.apcmedia.com/salestools/SJHN-7RKGNM/SJHN-7RKGNM_R4_EN.pdf]
[http://www.blackberry.com/btsc/KB35882]
[DSA-2896]
[32745]
[32764]
[http://www.f-secure.com/en/web/labs_global/fsc-2014-1]
[http://www.getchef.com/blog/2014/04/09/chef-server-11-0-12-release/]
[http://www.getchef.com/blog/2014/04/09/chef-server-heartbleed-cve-2014-0160-releases/]
[http://www.getchef.com/blog/2014/04/09/enterprise-chef-11-1-3-release/]
[http://www.getchef.com/blog/2014/04/09/enterprise-chef-1-4-9-release/]
[http://www.innominate.com/data/downloads/manuals/mdm_1.5.2.1_Release_Notes.pdf]
[VU#720951]
[http://www.kerio.com/support/kerio-control/release-history]
[MDVSA-2015:062]
[http://www.openssl.org/news/secadv_20140407.txt]
[http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html]
[http://www.oracle.com/technetwork/topics/security/opensslheartbleedcve-2014-0160-2188454.html]
[20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities]
[66690]
[1030026]
[1030074]
[1030077]
[1030078]
[1030079]
[1030080]
[1030081]
[1030082]
[http://www.splunk.com/view/SP-CAAAMB3]
[http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20160512_00]
[USN-2165-1]
[TA14-098A]
[http://www.vmware.com/security/advisories/VMSA-2014-0012.html]
[http://www.websense.com/support/article/kbarticle/Vulnerabilities-resolved-in-TRITON-APX-Version-8-0]
[http://www-01.ibm.com/support/docview.wss?uid=isg400001841]
[http://www-01.ibm.com/support/docview.wss?uid=isg400001843]
[http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004661]
[http://www-01.ibm.com/support/docview.wss?uid=swg21670161]
[https://blog.torproject.org/blog/openssl-bug-cve-2014-0160]
[https://bugzilla.redhat.com/show_bug.cgi?id=1084875]
[https://code.google.com/p/mod-spdy/issues/detail?id=85]
[https://filezilla-project.org/versions.php?type=server]
[https://gist.github.com/chapmajs/10473815]
[HPSBST03000]
[[tomcat-dev] 20190319 svn commit: r1855831 [26/30] - in /tomcat/site/trunk: ./ docs/ xdocs/]
[[tomcat-dev] 20190325 svn commit: r1856174 [26/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/]
[[syslog-ng-announce] 20140411 syslog-ng Premium Edition 5 LTS (5.0.4a) has been released]
[https://support.f5.com/kb/en-us/solutions/public/15000/100/sol15159.html]
[https://support.f5.com/kb/en-us/solutions/public/15000/100/sol15159.html?sr=36517217]
[https://www.cert.fi/en/reports/2014/vulnerability788210.html]
[https://www.mitel.com/en-ca/support/security-advisories/mitel-product-security-advisory-17-0008]
The Sheepdog backend in OpenStack Image Registry and Delivery Service (Glance) 2013.2 before 2013.2.4 and icehouse before icehouse-rc2 allows remote authenticated users with permission to insert or modify an image to execute arbitrary commands via a crafted location.
[RHSA-2014:0455]
[[oss-security] 20140410 [OSSA 2014-012] Remote code execution in Glance Sheepdog backend (CVE-2014-0162)]
[USN-2193-1]
[https://launchpad.net/bugs/1298698]
openshift-origin-broker-util, as used in Red Hat OpenShift Enterprise 1.2.7 and 2.0.5, uses world-readable permissions for the mcollective client.cfg configuration file, which allows local users to obtain credentials and other sensitive information by reading the file.
[RHSA-2014:0460]
[RHSA-2014:0461]
WordPress before 3.7.2 and 3.8.x before 3.8.2 allows remote authenticated users to publish posts by leveraging the Contributor role, related to wp-admin/includes/post.php and wp-admin/includes/class-wp-posts-list-table.php.
[http://codex.wordpress.org/Version_3.7.2]
[http://codex.wordpress.org/Version_3.8.2]
[http://core.trac.wordpress.org/changeset/27976]
[DSA-2901]
[https://bugzilla.redhat.com/show_bug.cgi?id=1085866]
The wp_validate_auth_cookie function in wp-includes/pluggable.php in WordPress before 3.7.2 and 3.8.x before 3.8.2 does not properly determine the validity of authentication cookies, which makes it easier for remote attackers to obtain access via a forged cookie.
[http://codex.wordpress.org/Version_3.7.2]
[http://codex.wordpress.org/Version_3.8.2]
[http://core.trac.wordpress.org/changeset/28054]
[DSA-2901]
[https://bugzilla.redhat.com/show_bug.cgi?id=1085858]
The Nova EC2 API security group implementation in OpenStack Compute (Nova) 2013.1 before 2013.2.4 and icehouse before icehouse-rc2 does not enforce RBAC policies for (1) add_rules, (2) remove_rules, (3) destroy, and other unspecified methods in compute/api.py when using non-default policies, which allows remote authenticated users to gain privileges via these API requests.
[[oss-security] 20140409 [OSSA 2014-011] RBAC policy not properly enforced in Nova EC2 API (CVE-2014-0167)]
[USN-2247-1]
[https://launchpad.net/bugs/1290537]
Cross-site request forgery (CSRF) vulnerability in Jolokia before 1.2.1 allows remote attackers to hijack the authentication of users for requests that execute MBeans methods via a crafted web page.
[RHSA-2014:1351]
[https://github.com/rhuss/jolokia/commit/2d9b168cfbbf5a6d16fa6e8a5b34503e3dc42364]
Teiid before 8.4.3 and before 8.7 and Red Hat JBoss Data Virtualization 6.0.0 before patch 3 allows remote attackers to read arbitrary files via a crafted request to a REST endpoint, related to an XML External Entity (XXE) issue.
<a href="http://cwe.mitre.org/data/definitions/611.html" target="_blank">CWE-611: Improper Restriction of XML External Entity Reference ('XXE')</a>
[RHSA-2014:1284]
[1030886]
[jboss-data-cve20140170-info-disc(96192)]
[https://issues.jboss.org/browse/TEIID-2911]
XML external entity (XXE) vulnerability in StaxXMLFactoryProvider2 in Odata4j, as used in Red Hat JBoss Data Virtualization before 6.0.0 patch 4, allows remote attackers to read arbitrary files via a crafted request to a REST endpoint.
<a href="http://cwe.mitre.org/data/definitions/611.html" target="_blank">CWE-611: Improper Restriction of XML External Entity Reference ('XXE')</a>
[RHSA-2015:0034]
[https://issues.jboss.org/browse/TEIID-2911]
Integer overflow in the check_section function in dwarf_begin_elf.c in the libdw library, as used in elfutils 0.153 and possibly through 0.158 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a malformed compressed debug section in an ELF file, which triggers a heap-based buffer overflow.
[[oss-security] 20140409 Heap-based buffer overflow in libdw/elfutils (CVE-2014-0172)]
[66714]
[USN-2188-1]
[https://bugzilla.redhat.com/show_bug.cgi?id=1085663]
[[elfutils-devel] 20140409 [PATCH] CVE-2014-0172 Check for overflow before calling malloc to uncompress data.]
[GLSA-201612-32]
The Jetpack plugin before 1.9 before 1.9.4, 2.0.x before 2.0.9, 2.1.x before 2.1.4, 2.2.x before 2.2.7, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.2, 2.6.x before 2.6.3, 2.7.x before 2.7.2, 2.8.x before 2.8.2, and 2.9.x before 2.9.3 for WordPress does not properly restrict access to the XML-RPC service, which allows remote attackers to bypass intended restrictions and publish posts via unspecified vectors. NOTE: some of these details are obtained from third party information.
[http://jetpack.me/2014/04/10/jetpack-security-update/]
[66789]
[jetpack-wordpress-cve20140173-sec-bypass(92560)]
Cumin (aka MRG Management Console), as used in Red Hat Enterprise MRG 2.5, does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.
[RHSA-2014:0858]
[RHSA-2014:0859]
Cross-site scripting (XSS) vulnerability in application/panel_control in CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
[RHSA-2014:0816]
The am function in lib/hub/commands.rb in hub before 1.12.1 allows local users to overwrite arbitrary files via a symlink attack on a temporary patch file.
[https://github.com/github/hub/commit/016ec99d25b1cb83cb4367e541177aa431beb600]
Samba 3.6.6 through 3.6.23, 4.0.x before 4.0.18, and 4.1.x before 4.1.8, when a certain vfs shadow copy configuration is enabled, does not properly initialize the SRV_SNAPSHOT_ARRAY response field, which allows remote authenticated users to obtain potentially sensitive information from process memory via a (1) FSCTL_GET_SHADOW_COPY_DATA or (2) FSCTL_SRV_ENUMERATE_SNAPSHOTS request.
Per: http://cwe.mitre.org/data/definitions/665.html
"CWE-665: Improper Initialization"
[http://advisories.mageia.org/MGASA-2014-0279.html]
[FEDORA-2014-9132]
[FEDORA-2014-7672]
[59407]
[GLSA-201502-15]
[MDVSA-2014:136]
[MDVSA-2015:082]
[http://www.samba.org/samba/security/CVE-2014-0178]
[20140711 [ MDVSA-2014:136 ] samba]
[67686]
[1030308]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05115993]
libvirt 0.7.5 through 1.2.x before 1.2.5 allows local users to cause a denial of service (read block and hang) via a crafted XML document containing an XML external entity declaration in conjunction with an entity reference to the (1) virConnectCompareCPU or (2) virConnectBaselineCPU API method, related to an XML External Entity (XXE) issue. NOTE: this issue was SPLIT per ADT3 due to different affected versions of some vectors. CVE-2014-5177 is used for other API methods.
[http://libvirt.org/news.html]
[openSUSE-SU-2014:0650]
[openSUSE-SU-2014:0674]
[RHSA-2014:0560]
[GLSA-201412-04]
[http://security.libvirt.org/2014/0003.html]
[DSA-3038]
[USN-2366-1]
The wait_for_task function in app/controllers/application_controller.rb in Red Hat CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via unspecified vectors.
[RHSA-2014:0816]
The Netlink implementation in the Linux kernel through 3.14.1 does not provide a mechanism for authorizing socket operations based on the opener of a socket, which allows local users to bypass intended access restrictions and modify network configurations by using a Netlink socket for the (1) stdout or (2) stderr of a setuid program.
[SUSE-SU-2015:0481]
[openSUSE-SU-2015:0566]
[SUSE-SU-2015:0652]
[SUSE-SU-2015:0736]
[SUSE-SU-2015:0812]
[[netdev] 20140423 [PATCH 0/5]: Preventing abuse when passing file descriptors]
[RHSA-2014:1959]
[[oss-security] 20140423 Re: CVE-2014-0181: Linux network reconfiguration due to incorrect netlink checks]
[https://git.kernel.org/cgit/linux/kernel/git/davem/net.git/commit/?id=90f62cf30a78721641e08737bda787552428061e]
[https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.10.45]
[https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.9]
Heap-based buffer overflow in the virtio_load function in hw/virtio/virtio.c in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via a crafted config length in a savevm image.
[http://git.qemu.org/?p=qemu.git;a=commitdiff;h=a890a2f9137ac3cf5b607649e66a6f3a5512d8dc]
[FEDORA-2014-6288]
[[Qemu-stable] 20140723 [ANNOUNCE] QEMU 1.7.2 Stable released]
[RHSA-2014:0743]
[RHSA-2014:0744]
Red Hat CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 logs the root password when deploying a VM, which allows local users to obtain sensitive information by reading the evm.log file.
[RHSA-2014:0816]
sapi/fpm/fpm/fpm_unix.c in the FastCGI Process Manager (FPM) in PHP before 5.4.28 and 5.5.x before 5.5.12 uses 0666 permissions for the UNIX socket, which allows local users to gain privileges via a crafted FastCGI client.
[openSUSE-SU-2015:1685]
[59061]
[59329]
[http://support.apple.com/kb/HT6443]
[[oss-security] 20140429 Fwd: [vs] php-fpm: privilege escalation due to insecure default config (CVE-2014-0185)]
[http://www.php.net/archive/2014.php#id2014-05-01-1]
[http://www.php.net/ChangeLog-5.php]
[https://bugs.launchpad.net/ubuntu/+source/php5/+bug/1307027]
[https://bugs.php.net/bug.php?id=67060]
[https://bugzilla.redhat.com/show_bug.cgi?id=1092815]
[https://github.com/php/php-src/commit/35ceea928b12373a3b1e3eecdc32ed323223a40d]
[https://hoffmann-christian.info/files/php-fpm/0001-Fix-bug-67060-use-default-mode-of-660.patch]
A certain tomcat7 package for Apache Tomcat 7 in Red Hat Enterprise Linux (RHEL) 7 allows remote attackers to cause a denial of service (CPU consumption) via a crafted request. NOTE: this vulnerability exists because of an unspecified regression.
[https://bugzilla.redhat.com/show_bug.cgi?id=1089884]
[RHSA-2014:0686]
[https://security-tracker.debian.org/tracker/CVE-2014-0186]
The openvswitch-agent process in OpenStack Neutron 2013.1 before 2013.2.4 and 2014.1 before 2014.1.1 allows remote authenticated users to bypass security group restrictions via an invalid CIDR in a security group rule, which prevents further rules from being applied.
[openSUSE-SU-2014:1051]
[[oss-security] 20140422 [OSSA 2014-014] Neutron security groups bypass through invalid CIDR (CVE-2014-0187)]
[USN-2255-1]
[https://bugs.launchpad.net/neutron/+bug/1300785]
The openshift-origin-broker in Red Hat OpenShift Enterprise 2.0.5, 1.2.7, and earlier does not properly handle authentication requests from the remote-user auth plugin, which allows remote attackers to bypass authentication and impersonate arbitrary users via the X-Remote-User header in a request to a passthrough trigger.
[RHSA-2014:0422]
[RHSA-2014:0423]
[https://bugzilla.redhat.com/show_bug.cgi?id=1090120]
virt-who uses world-readable permissions for /etc/sysconfig/virt-who, which allows local users to obtain password for hypervisors by reading the file.
[RHSA-2015:0430]
[[oss-security] 20140428 CVE-2014-0189: /etc/sysconfig/virt-who is world-readable (contains unencrypted passwords)]
[67089]
[https://bugzilla.redhat.com/show_bug.cgi?id=1081286]
[https://bugzilla.redhat.com/show_bug.cgi?id=1088732]
The GIF decoder in QtGui in Qt before 5.3 allows remote attackers to cause a denial of service (NULL pointer dereference) via invalid width and height values in a GIF image.
Per: http://cwe.mitre.org/data/definitions/476.html
"CWE-476: NULL Pointer Dereference"
[FEDORA-2014-6922]
[FEDORA-2014-6896]
[FEDORA-2014-5695]
[openSUSE-SU-2015:0573]
[[Announce] 20140424 Qt Security Advisory: DoS vulnerability in the GIF image handler]
[67087]
[USN-2626-1]
[https://bugs.kde.org/show_bug.cgi?id=333404]
The xmlParserHandlePEReference function in parser.c in libxml2 before 2.9.2, as used in Web Listener in Oracle HTTP Server in Oracle Fusion Middleware 11.1.1.7.0, 12.1.2.0, and 12.1.3.0 and other products, loads external parameter entities regardless of whether entity substitution or validation is enabled, which allows remote attackers to cause a denial of service (resource consumption) via a crafted XML document.
[APPLE-SA-2015-08-13-2]
[APPLE-SA-2015-08-13-3]
[openSUSE-SU-2015:2372]
[RHSA-2015:0749]
[http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html]
[http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html]
[67233]
[http://www-01.ibm.com/support/docview.wss?uid=swg21678183]
[http://xmlsoft.org/news.html]
[https://bugzilla.redhat.com/show_bug.cgi?id=1090976]
[libxml2-cve20140191-dos(93092)]
[https://git.gnome.org/browse/libxml2/commit/?id=9cd1c3cfbd32655d60572c0a413e017260c854df]
[https://support.apple.com/kb/HT205030]
[https://support.apple.com/kb/HT205031]
Foreman 1.4.0 before 1.5.0 does not properly restrict access to provisioning template previews, which allows remote attackers to obtain sensitive information via the hostname parameter, related to "spoof."
[http://projects.theforeman.org/issues/5436]
[http://theforeman.org/security.html]
[https://bugzilla.redhat.com/show_bug.cgi?id=1092354]
WebSocket08FrameDecoder in Netty 3.6.x before 3.6.9, 3.7.x before 3.7.1, 3.8.x before 3.8.2, 3.9.x before 3.9.1, and 4.0.x before 4.0.19 allows remote attackers to cause a denial of service (memory consumption) via a TextWebSocketFrame followed by a long stream of ContinuationWebSocketFrames.
[http://netty.io/news/2014/04/30/release-day.html]
[RHSA-2014:1019]
[RHSA-2014:1020]
[RHSA-2014:1021]
[RHSA-2014:1351]
[RHSA-2015:0675]
[RHSA-2015:0720]
[RHSA-2015:0765]
[59290]
[67182]
[https://github.com/netty/netty/issues/2441]
[[pulsar-commits] 20190416 [GitHub] [pulsar] one70six opened a new issue #4057: Security Vulnerabilities - Black Duck Scan - Pulsar v.2.3.1]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly validate fragment lengths in DTLS ClientHello messages, which allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) via a long non-initial fragment.
[http://aix.software.ibm.com/aix/efixes/security/openssl_advisory9.asc]
[http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Once-Bled-Twice-Shy-OpenSSL-CVE-2014-0195/ba-p/6501048]
[http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/ZDI-14-173-CVE-2014-0195-OpenSSL-DTLS-Fragment-Out-of-Bounds/ba-p/6501002]
[http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10629]
[FEDORA-2014-9301]
[FEDORA-2014-9308]
[SUSE-SU-2015:0743]
[openSUSE-SU-2016:0640]
[HPSBUX03046]
[HPSBOV03047]
[HPSBMU03057]
[HPSBMU03056]
[HPSBMU03055]
[HPSBMU03051]
[HPSBGN03050]
[HPSBMU03065]
[HPSBMU03069]
[HPSBMU03074]
[HPSBMU03062]
[HPSBMU03076]
[SSRT101846]
[20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities]
[58337]
[58615]
[58660]
[58713]
[58714]
[58945]
[58977]
[59040]
[59175]
[59188]
[59189]
[59192]
[59223]
[59287]
[59305]
[59306]
[59310]
[59364]
[59365]
[59429]
[59437]
[59441]
[59449]
[59454]
[59518]
[61254]
[GLSA-201407-05]
[http://support.apple.com/kb/HT6443]
[http://support.citrix.com/article/CTX140876]
[http://support.f5.com/kb/en-us/solutions/public/15000/300/sol15356.html]
[20140605 Multiple Vulnerabilities in OpenSSL Affecting Cisco Products]
[http://www.blackberry.com/btsc/KB36051]
[http://www.fortiguard.com/advisory/FG-IR-14-018/]
[http://www.f-secure.com/en/web/labs_global/fsc-2014-6]
[http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-345106.htm]
[http://www.ibm.com/support/docview.wss?uid=swg21676356]
[http://www.ibm.com/support/docview.wss?uid=swg21676793]
[http://www.ibm.com/support/docview.wss?uid=swg24037783]
[MDVSA-2014:106]
[MDVSA-2015:062]
[http://www.openssl.org/news/secadv_20140605.txt]
[http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html]
[http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html]
[http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html]
[http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html]
[20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities]
[67900]
[1030337]
[http://www.vmware.com/security/advisories/VMSA-2014-0006.html]
[http://www.vmware.com/security/advisories/VMSA-2014-0012.html]
[http://www-01.ibm.com/support/docview.wss?uid=isg400001841]
[http://www-01.ibm.com/support/docview.wss?uid=isg400001843]
[http://www-01.ibm.com/support/docview.wss?uid=nas8N1020163]
[http://www-01.ibm.com/support/docview.wss?uid=swg21673137]
[http://www-01.ibm.com/support/docview.wss?uid=swg21675821]
[http://www-01.ibm.com/support/docview.wss?uid=swg21676035]
[http://www-01.ibm.com/support/docview.wss?uid=swg21676062]
[http://www-01.ibm.com/support/docview.wss?uid=swg21676071]
[http://www-01.ibm.com/support/docview.wss?uid=swg21676419]
[http://www-01.ibm.com/support/docview.wss?uid=swg21676644]
[http://www-01.ibm.com/support/docview.wss?uid=swg21676879]
[http://www-01.ibm.com/support/docview.wss?uid=swg21676889]
[http://www-01.ibm.com/support/docview.wss?uid=swg21677527]
[http://www-01.ibm.com/support/docview.wss?uid=swg21677695]
[http://www-01.ibm.com/support/docview.wss?uid=swg21677828]
[http://www-01.ibm.com/support/docview.wss?uid=swg21678167]
[http://www-01.ibm.com/support/docview.wss?uid=swg21678289]
[http://www-01.ibm.com/support/docview.wss?uid=swg21683332]
[http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095754]
[http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095755]
[http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095756]
[http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095757]
[https://bugzilla.redhat.com/show_bug.cgi?id=1103598]
[https://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=1632ef744872edc2aa2a53d487d3e79c965a4ad3]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05301946]
[https://kb.bluecoat.com/index?page=content&id=SA80]
[https://kc.mcafee.com/corporate/index?page=content&id=SB10075]
[https://www.novell.com/support/kb/doc.php?id=7015271]
The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the "LECHO & !OPOST" case, which allows local users to cause a denial of service (memory corruption and system crash) or gain privileges by triggering a race condition involving read and write operations with long strings.
[http://bugzilla.novell.com/show_bug.cgi?id=875690]
[http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=4291086b1f081b869c6d79e5b7441633dc3ace00]
[http://linux.oracle.com/errata/ELSA-2014-0771.html]
[SUSE-SU-2014:0667]
[SUSE-SU-2014:0683]
[http://pastebin.com/raw.php?i=yTSFUBgZ]
[RHSA-2014:0512]
[59218]
[http://source.android.com/security/bulletin/2016-07-01.html]
[http://support.f5.com/kb/en-us/solutions/public/15000/300/sol15319.html]
[DSA-2926]
[DSA-2928]
[33516]
[[oss-security] 20140429 CVE-2014-0196: Linux kernel pty layer race condition memory corruption]
[106646]
[USN-2196-1]
[USN-2197-1]
[USN-2198-1]
[USN-2199-1]
[USN-2200-1]
[USN-2201-1]
[USN-2202-1]
[USN-2203-1]
[USN-2204-1]
[https://bugzilla.redhat.com/show_bug.cgi?id=1094232]
[https://github.com/torvalds/linux/commit/4291086b1f081b869c6d79e5b7441633dc3ace00]
The do_ssl3_write function in s3_pkt.c in OpenSSL 1.x through 1.0.1g, when SSL_MODE_RELEASE_BUFFERS is enabled, does not properly manage a buffer pointer during certain recursive calls, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via vectors that trigger an alert condition.
<a href="http://cwe.mitre.org/data/definitions/476.html">CWE-476: NULL Pointer Dereference</a>
[http://advisories.mageia.org/MGASA-2014-0204.html]
[http://aix.software.ibm.com/aix/efixes/security/openssl_advisory9.asc]
[http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10629]
[http://kb.juniper.net/InfoCenter/index?page=content&id=KB29195]
[FEDORA-2014-9301]
[FEDORA-2014-9308]
[SUSE-SU-2015:0743]
[openSUSE-SU-2014:0634]
[openSUSE-SU-2014:0635]
[HPSBMU03057]
[HPSBMU03056]
[HPSBMU03055]
[HPSBMU03051]
[HPSBGN03068]
[HPSBMU03074]
[HPSBMU03062]
[HPSBMU03076]
[HPSBHF03052]
[http://puppetlabs.com/security/cve/cve-2014-0198]
[20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities]
[58337]
[58667]
[58713]
[58714]
[58945]
[58977]
[59163]
[59190]
[59202]
[59264]
[59282]
[59284]
[59287]
[59306]
[59310]
[59374]
[59398]
[59437]
[59440]
[59449]
[59525]
[59529]
[61254]
[GLSA-201407-05]
[http://support.citrix.com/article/CTX140876]
[http://support.f5.com/kb/en-us/solutions/public/15000/300/sol15329.html]
[20140605 Multiple Vulnerabilities in OpenSSL Affecting Cisco Products]
[http://www.blackberry.com/btsc/KB36051]
[DSA-2931]
[http://www.fortiguard.com/advisory/FG-IR-14-018/]
[http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-345106.htm]
[http://www.ibm.com/support/docview.wss?uid=swg21676356]
[http://www.ibm.com/support/docview.wss?uid=swg24037783]
[MDVSA-2014:080]
[MDVSA-2015:062]
[[5.5] 005: RELIABILITY FIX: May 1, 2014]
[http://www.openssl.org/news/secadv_20140605.txt]
[http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html]
[http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html]
[http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html]
[http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html]
[20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities]
[67193]
[http://www.vmware.com/security/advisories/VMSA-2014-0006.html]
[http://www.vmware.com/security/advisories/VMSA-2014-0012.html]
[http://www-01.ibm.com/support/docview.wss?uid=nas8N1020163]
[http://www-01.ibm.com/support/docview.wss?uid=swg21673137]
[http://www-01.ibm.com/support/docview.wss?uid=swg21676035]
[http://www-01.ibm.com/support/docview.wss?uid=swg21676062]
[http://www-01.ibm.com/support/docview.wss?uid=swg21676419]
[http://www-01.ibm.com/support/docview.wss?uid=swg21676529]
[http://www-01.ibm.com/support/docview.wss?uid=swg21676655]
[http://www-01.ibm.com/support/docview.wss?uid=swg21676879]
[http://www-01.ibm.com/support/docview.wss?uid=swg21676889]
[http://www-01.ibm.com/support/docview.wss?uid=swg21677527]
[http://www-01.ibm.com/support/docview.wss?uid=swg21677695]
[http://www-01.ibm.com/support/docview.wss?uid=swg21677828]
[http://www-01.ibm.com/support/docview.wss?uid=swg21677836]
[http://www-01.ibm.com/support/docview.wss?uid=swg21678167]
[http://www-01.ibm.com/support/docview.wss?uid=swg21683332]
[http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095754]
[http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095755]
[http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095756]
[http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095757]
[https://bugzilla.redhat.com/show_bug.cgi?id=1093837]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05301946]
[https://kb.bluecoat.com/index?page=content&id=SA80]
[https://kc.mcafee.com/corporate/index?page=content&id=SB10075]
[https://rt.openssl.org/Ticket/Display.html?user=guest&pass=guest&id=3321]
[https://www.novell.com/support/kb/doc.php?id=7015271]
The setup script in ovirt-engine-reports, as used in the Red Hat Enterprise Virtualization reports (rhevm-reports) package before 3.3.3, stores the reports database password in cleartext, which allows local users to obtain sensitive information by reading an unspecified file.
[RHSA-2014:0558]
[67682]
The Red Hat Enterprise Virtualization Manager reports (rhevm-reports) package before 3.3.3-1 uses world-readable permissions on the datasource configuration file (js-jboss7-ds.xml), which allows local users to obtain sensitive information by reading the file.
[RHSA-2014:0558]
[67684]
ovirt-engine-reports, as used in the Red Hat Enterprise Virtualization reports package (rhevm-reports) before 3.3.3, uses world-readable permissions on configuration files, which allows local users to obtain sensitive information by reading the files.
[RHSA-2014:0558]
The setup script in ovirt-engine-dwh, as used in the Red Hat Enterprise Virtualization Manager data warehouse (rhevm-dwh) package before 3.3.3, stores the history database password in cleartext, which allows local users to obtain sensitive information by reading an unspecified file.
[RHSA-2014:0559]
The __do_follow_link function in fs/namei.c in the Linux kernel before 2.6.33 does not properly handle the last pathname component during use of certain filesystems, which allows local users to cause a denial of service (incorrect free operations and system crash) via an open system call.
[http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=86acdca1b63e6890540fa19495cfc708beff3d8b]
[http://linux.oracle.com/errata/ELSA-2014-0771.html]
[http://linux.oracle.com/errata/ELSA-2014-3043.html]
[http://mirror.linux.org.au/linux/kernel/v2.6/ChangeLog-2.6.33]
[68125]
[https://bugzilla.redhat.com/show_bug.cgi?id=1094363]
[https://github.com/torvalds/linux/commit/86acdca1b63e6890540fa19495cfc708beff3d8b]
OpenStack Identity (Keystone) before 2014.1.1 does not properly handle when a role is assigned to a group that has the same ID as a user, which allows remote authenticated users to gain privileges that are assigned to a group with the same ID.
[[oss-security] 20140521 [OSSA 2014-015] Keystone user and group id mismatch (CVE-2014-0204)]
[https://bugs.launchpad.net/keystone/+bug/1309228]
[https://review.openstack.org/#/c/94396/]
The futex_wait function in kernel/futex.c in the Linux kernel before 2.6.37 does not properly maintain a certain reference count during requeue operations, which allows local users to cause a denial of service (use-after-free and system crash) or possibly gain privileges via a crafted application that triggers a zero count.
[http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=7ada876a8703f23befbb20a7465a702ee39b1704]
[http://mirror.linux.org.au/linux/kernel/v2.6/ChangeLog-2.6.37]
[RHSA-2014:1365]
[RHSA-2014:1763]
[https://bugzilla.redhat.com/show_bug.cgi?id=1094455]
[https://github.com/torvalds/linux/commit/7ada876a8703f23befbb20a7465a702ee39b1704]
Array index error in the aio_read_events_ring function in fs/aio.c in the Linux kernel through 3.15.1 allows local users to obtain sensitive information from kernel memory via a large head value.
Per: http://cwe.mitre.org/data/definitions/129.html
"CWE-129: Improper Validation of Array Index"
[http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=edfbbf388f293d70bf4b7c0bc38774d05e6f711a]
[59278]
[68176]
[1030479]
[1038201]
[https://bugzilla.redhat.com/show_bug.cgi?id=1094602]
[https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=edfbbf388f29]
[https://github.com/torvalds/linux/commit/edfbbf388f293d70bf4b7c0bc38774d05e6f711a]
[https://source.android.com/security/bulletin/2017-04-01]
[https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.10.46]
[https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.12.24]
[https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.10]
[https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.15.3]
The cdf_read_short_sector function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted CDF file.
[APPLE-SA-2015-04-08-2]
[openSUSE-SU-2014:1236]
[SSRT101681]
[[file] 20140612 file-5.19 is now available]
[RHSA-2014:1765]
[RHSA-2014:1766]
[http://support.apple.com/kb/HT6443]
[DSA-2974]
[DSA-3021]
[http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html]
[http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html]
[http://www.php.net/ChangeLog-5.php]
[68243]
[https://bugs.php.net/bug.php?id=67326]
[https://bugzilla.redhat.com/show_bug.cgi?id=1091842]
[https://github.com/file/file/commit/6d209c1c489457397a5763bca4b28e43aac90391]
[https://support.apple.com/HT204659]
Cross-site scripting (XSS) vulnerability in the search auto-completion functionality in Foreman before 1.4.4 allows remote authenticated users to inject arbitrary web script or HTML via a crafted key name.
[http://projects.theforeman.org/issues/5471]
[https://bugzilla.redhat.com/show_bug.cgi?id=1094642]
[https://theforeman.org/security.html#2014-0208]
Multiple integer overflows in the (1) FontFileAddEntry and (2) lexAlias functions in X.Org libXfont before 1.4.8 and 1.4.9x before 1.4.99.901 might allow local users to gain privileges by adding a directory with a large fonts.dir or fonts.alias file to the font path, which triggers a heap-based buffer overflow, related to metadata.
[http://advisories.mageia.org/MGASA-2014-0278.html]
[openSUSE-SU-2014:0711]
[[xorg-announce] 20140513 [ANNOUNCE] X.Org Security Advisory: Multiple issues in libXfont]
[RHSA-2014:1893]
[20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities]
[59154]
[DSA-2927]
[MDVSA-2015:145]
[http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html]
[20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities]
[67382]
[USN-2211-1]
[http://www.vmware.com/security/advisories/VMSA-2014-0012.html]
Multiple buffer overflows in X.Org libXfont before 1.4.8 and 1.4.9x before 1.4.99.901 allow remote font servers to execute arbitrary code via a crafted xfs protocol reply to the (1) _fs_recv_conn_setup, (2) fs_read_open_font, (3) fs_read_query_info, (4) fs_read_extent_info, (5) fs_read_glyphs, (6) fs_read_list, or (7) fs_read_list_info function.
[http://advisories.mageia.org/MGASA-2014-0278.html]
[openSUSE-SU-2014:0711]
[[xorg-announce] 20140513 [ANNOUNCE] X.Org Security Advisory: Multiple issues in libXfont]
[RHSA-2014:1893]
[20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities]
[59154]
[DSA-2927]
[MDVSA-2015:145]
[http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html]
[20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities]
[67382]
[USN-2211-1]
[http://www.vmware.com/security/advisories/VMSA-2014-0012.html]
Multiple integer overflows in the (1) fs_get_reply, (2) fs_alloc_glyphs, and (3) fs_read_extent_info functions in X.Org libXfont before 1.4.8 and 1.4.9x before 1.4.99.901 allow remote font servers to execute arbitrary code via a crafted xfs reply, which triggers a buffer overflow.
[http://advisories.mageia.org/MGASA-2014-0278.html]
[openSUSE-SU-2014:0711]
[[xorg-announce] 20140513 [ANNOUNCE] X.Org Security Advisory: Multiple issues in libXfont]
[RHSA-2014:1893]
[20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities]
[59154]
[DSA-2927]
[MDVSA-2015:145]
[http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html]
[20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities]
[67382]
[USN-2211-1]
[http://www.vmware.com/security/advisories/VMSA-2014-0012.html]
Multiple cross-site request forgery (CSRF) vulnerabilities in mod/assign/locallib.php in the Assignment subsystem in Moodle through 2.3.11, 2.4.x before 2.4.10, 2.5.x before 2.5.6, and 2.6.x before 2.6.3 allow remote attackers to hijack the authentication of teachers for quick-grading requests.
[http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-44606]
[[oss-security] 20140519 Moodle security notifications public]
[https://moodle.org/mod/forum/discuss.php?d=260361]
login/token.php in Moodle through 2.3.11, 2.4.x before 2.4.10, 2.5.x before 2.5.6, and 2.6.x before 2.6.3 creates a MoodleMobile web-service token with an infinite lifetime, which makes it easier for remote attackers to hijack sessions via a brute-force attack.
[http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-43119]
[[oss-security] 20140519 Moodle security notifications public]
[https://moodle.org/mod/forum/discuss.php?d=260362]
The blind-marking implementation in Moodle through 2.3.11, 2.4.x before 2.4.10, 2.5.x before 2.5.6, and 2.6.x before 2.6.3 allows remote authenticated users to de-anonymize student identities by (1) using a screen reader or (2) reading the HTML source.
[http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-44750]
[[oss-security] 20140519 Moodle security notifications public]
[https://moodle.org/mod/forum/discuss.php?d=260363]
The My Home implementation in the block_html_pluginfile function in blocks/html/lib.php in Moodle through 2.3.11, 2.4.x before 2.4.10, 2.5.x before 2.5.6, and 2.6.x before 2.6.3 does not properly restrict file access, which allows remote attackers to obtain sensitive information by visiting an HTML block.
[http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-43877]
[[oss-security] 20140519 Moodle security notifications public]
[https://moodle.org/mod/forum/discuss.php?d=260364]
enrol/index.php in Moodle 2.6.x before 2.6.3 does not check for the moodle/course:viewhiddencourses capability before listing hidden courses, which allows remote attackers to obtain sensitive name and summary information about these courses by leveraging the guest role and visiting a crafted URL.
[http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-45126]
[[oss-security] 20140519 Moodle security notifications public]
[https://moodle.org/mod/forum/discuss.php?d=260365]
Cross-site scripting (XSS) vulnerability in the URL downloader repository in repository/url/lib.php in Moodle through 2.3.11, 2.4.x before 2.4.10, 2.5.x before 2.5.6, and 2.6.x before 2.6.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
[http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-45332]
[[oss-security] 20140519 Moodle security notifications public]
[67479]
[https://moodle.org/mod/forum/discuss.php?d=260366]
Apache Karaf before 4.0.10 enables a shutdown port on the loopback interface, which allows local users to cause a denial of service (shutdown) by sending a shutdown command to all listening high ports.
[http://karaf.apache.org/security/cve-2014-0219.txt]
[101872]
[https://bugzilla.redhat.com/show_bug.cgi?id=1095974]
Cloudera Manager before 4.8.3 and 5.x before 5.0.1 allows remote authenticated users to obtain sensitive configuration information via the API.
[http://packetstormsecurity.com/files/126956/Cloudera-Manager-4.8.2-5.0.0-Information-Disclosure.html]
[http://www.cloudera.com/content/cloudera-content/cloudera-docs/SecurityBulletins/Security-Bulletin/csb_topic_2.html]
[20140605 Details for CVE-2014-0220]
[67912]
The dtls1_get_message_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h allows remote attackers to cause a denial of service (recursion and client crash) via a DTLS hello message in an invalid DTLS handshake.
[http://aix.software.ibm.com/aix/efixes/security/openssl_advisory9.asc]
[http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10629]
[http://linux.oracle.com/errata/ELSA-2014-1053.html]
[FEDORA-2014-9301]
[FEDORA-2014-9308]
[SUSE-SU-2015:0743]
[openSUSE-SU-2016:0640]
[HPSBUX03046]
[HPSBOV03047]
[HPSBMU03057]
[HPSBMU03056]
[HPSBMU03055]
[HPSBMU03051]
[HPSBGN03050]
[HPSBMU03065]
[HPSBMU03069]
[HPSBMU03074]
[HPSBMU03062]
[HPSBMU03076]
[RHSA-2014:1021]
[20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities]
[58337]
[58615]
[58713]
[58714]
[58945]
[58977]
[59027]
[59167]
[59175]
[59189]
[59192]
[59284]
[59287]
[59306]
[59310]
[59364]
[59365]
[59429]
[59437]
[59441]
[59449]
[59454]
[59460]
[59518]
[61254]
[GLSA-201407-05]
[http://support.apple.com/kb/HT6443]
[http://support.citrix.com/article/CTX140876]
[20140605 Multiple Vulnerabilities in OpenSSL Affecting Cisco Products]
[http://www.blackberry.com/btsc/KB36051]
[http://www.fortiguard.com/advisory/FG-IR-14-018/]
[http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-345106.htm]
[http://www.ibm.com/support/docview.wss?uid=swg21676226]
[http://www.ibm.com/support/docview.wss?uid=swg21676356]
[http://www.ibm.com/support/docview.wss?uid=swg21676793]
[http://www.ibm.com/support/docview.wss?uid=swg24037783]
[MDVSA-2014:105]
[MDVSA-2014:106]
[MDVSA-2015:062]
[http://www.novell.com/support/kb/doc.php?id=7015264]
[http://www.novell.com/support/kb/doc.php?id=7015300]
[http://www.openssl.org/news/secadv_20140605.txt]
[http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html]
[http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html]
[http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html]
[http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html]
[20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities]
[67901]
[1030337]
[http://www.vmware.com/security/advisories/VMSA-2014-0006.html]
[http://www.vmware.com/security/advisories/VMSA-2014-0012.html]
[http://www-01.ibm.com/support/docview.wss?uid=isg400001841]
[http://www-01.ibm.com/support/docview.wss?uid=isg400001843]
[http://www-01.ibm.com/support/docview.wss?uid=nas8N1020163]
[http://www-01.ibm.com/support/docview.wss?uid=swg21673137]
[http://www-01.ibm.com/support/docview.wss?uid=swg21675821]
[http://www-01.ibm.com/support/docview.wss?uid=swg21676035]
[http://www-01.ibm.com/support/docview.wss?uid=swg21676062]
[http://www-01.ibm.com/support/docview.wss?uid=swg21676071]
[http://www-01.ibm.com/support/docview.wss?uid=swg21676419]
[http://www-01.ibm.com/support/docview.wss?uid=swg21676879]
[http://www-01.ibm.com/support/docview.wss?uid=swg21676889]
[http://www-01.ibm.com/support/docview.wss?uid=swg21677527]
[http://www-01.ibm.com/support/docview.wss?uid=swg21677695]
[http://www-01.ibm.com/support/docview.wss?uid=swg21677828]
[http://www-01.ibm.com/support/docview.wss?uid=swg21678167]
[http://www-01.ibm.com/support/docview.wss?uid=swg21678289]
[http://www-01.ibm.com/support/docview.wss?uid=swg21683332]
[http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd?mode=18&ID=6060&myns=phmc&mync=E]
[http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd?mode=18&ID=6061&myns=phmc&mync=E]
[http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095754]
[http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095755]
[http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095756]
[http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095757]
[https://bugzilla.redhat.com/show_bug.cgi?id=1103593]
[https://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=d3152655d5319ce883c8e3ac4b99f8de4c59d846]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05301946]
[https://kb.bluecoat.com/index?page=content&id=SA80]
[https://kc.mcafee.com/corporate/index?page=content&id=SB10075]
[https://www.novell.com/support/kb/doc.php?id=7015271]
Integer overflow in the qcow_open function in block/qcow.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service (crash) via a large L2 table in a QCOW version 1 image.
[FEDORA-2014-6970]
[FEDORA-2014-6288]
[[Qemu-stable] 20140723 [ANNOUNCE] QEMU 1.7.2 Stable released]
[SUSE-SU-2015:0929]
[openSUSE-SU-2015:1965]
[DSA-3044]
[67357]
[[Qemu-devel] 20140512 [PATCH 3/5] qcow1: Validate L2 table size (CVE-2014-0222)]
Integer overflow in the qcow_open function in block/qcow.c in QEMU before 1.7.2 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a large image size, which triggers a buffer overflow or out-of-bounds read.
[FEDORA-2014-6970]
[[Qemu-stable] 20140723 [ANNOUNCE] QEMU 1.7.2 Stable released]
[SUSE-SU-2015:0929]
[DSA-3044]
[67391]
[[Qemu-devel] 20140512 [PATCH 4/5] qcow1: Validate image size (CVE-2014-0223)]
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows man-in-the-middle attackers to trigger use of a zero-length master key in certain OpenSSL-to-OpenSSL communications, and consequently hijack sessions or obtain sensitive information, via a crafted TLS handshake, aka the "CCS Injection" vulnerability.
[http://aix.software.ibm.com/aix/efixes/security/openssl_advisory9.asc]
[http://ccsinjection.lepidum.co.jp]
[http://dev.mysql.com/doc/relnotes/workbench/en/wb-news-6-1-7.html]
[http://esupport.trendmicro.com/solution/en-US/1103813.aspx]
[http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10629]
[http://kb.juniper.net/InfoCenter/index?page=content&id=KB29195]
[http://kb.juniper.net/InfoCenter/index?page=content&id=KB29217]
[http://linux.oracle.com/errata/ELSA-2014-1053.html]
[FEDORA-2014-9301]
[FEDORA-2014-9308]
[SUSE-SU-2015:0578]
[SUSE-SU-2015:0743]
[openSUSE-SU-2016:0640]
[openSUSE-SU-2015:0229]
[HPSBUX03046]
[HPSBOV03047]
[HPSBMU03053]
[HPSBMU03058]
[HPSBMU03057]
[HPSBMU03056]
[HPSBMU03055]
[HPSBMU03051]
[HPSBGN03050]
[HPSBMU03065]
[HPSBMU03070]
[HPSBGN03068]
[HPSBMU03071]
[HPSBMU03074]
[HPSBMU03078]
[HPSBMU03062]
[HPSBMU03089]
[HPSBHF03088]
[HPSBMU03094]
[HPSBMU03101]
[HPSBST03098]
[HPSBMU03076]
[HPSBMU03083]
[HPSBST03106]
[HPSBPI03107]
[HPSBST03103]
[HPSBST03097]
[HPSBHF03145]
[HPSBHF03052]
[SSRT101818]
[HPSBST03265]
[HPSBST03195]
[http://puppetlabs.com/security/cve/cve-2014-0224]
[RHSA-2014:0624]
[RHSA-2014:0626]
[RHSA-2014:0627]
[RHSA-2014:0630]
[RHSA-2014:0631]
[RHSA-2014:0632]
[RHSA-2014:0633]
[RHSA-2014:0680]
[20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities]
[20140607 Re: More OpenSSL issues]
[58337]
[58433]
[58492]
[58615]
[58660]
[58667]
[58713]
[58714]
[58716]
[58719]
[58742]
[58945]
[58977]
[59004]
[59040]
[59093]
[59101]
[59132]
[59135]
[59142]
[59163]
[59167]
[59175]
[59186]
[59188]
[59189]
[59190]
[59192]
[59202]
[59211]
[59214]
[59215]
[59223]
[59231]
[59264]
[59282]
[59284]
[59287]
[59305]
[59306]
[59310]
[59338]
[59347]
[59362]
[59364]
[59365]
[59368]
[59374]
[59375]
[59380]
[59389]
[59429]
[59435]
[59437]
[59440]
[59441]
[59444]
[59445]
[59446]
[59447]
[59448]
[59449]
[59454]
[59460]
[59483]
[59502]
[59518]
[59525]
[59529]
[59661]
[59677]
[61254]
[GLSA-201407-05]
[http://support.apple.com/kb/HT6443]
[http://support.citrix.com/article/CTX140876]
[http://support.f5.com/kb/en-us/solutions/public/15000/300/sol15325.html]
[20140605 Multiple Vulnerabilities in OpenSSL Affecting Cisco Products]
[http://www.blackberry.com/btsc/KB36051]
[http://www.fortiguard.com/advisory/FG-IR-14-018/]
[http://www.f-secure.com/en/web/labs_global/fsc-2014-6]
[http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-345106.htm]
[http://www.ibm.com/support/docview.wss?uid=isg3T1020948]
[http://www.ibm.com/support/docview.wss?uid=ssg1S1004678]
[IT02314]
[http://www.ibm.com/support/docview.wss?uid=swg21676356]
[http://www.ibm.com/support/docview.wss?uid=swg21676793]
[http://www.ibm.com/support/docview.wss?uid=swg21676877]
[http://www.ibm.com/support/docview.wss?uid=swg24037783]
[http://www.innominate.com/data/downloads/manuals/mdm_1.5.2.1_Release_Notes.pdf]
[VU#978508]
[http://www.kerio.com/support/kerio-control/release-history]
[MDVSA-2014:105]
[MDVSA-2014:106]
[MDVSA-2015:062]
[http://www.novell.com/support/kb/doc.php?id=7015264]
[http://www.novell.com/support/kb/doc.php?id=7015300]
[http://www.openssl.org/news/secadv_20140605.txt]
[http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html]
[http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html]
[http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html]
[http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html]
[http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html]
[http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html]
[http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html]
[20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities]
[1031032]
[1031594]
[http://www.splunk.com/view/SP-CAAAM2D]
[http://www.tenable.com/blog/nessus-527-and-pvs-403-are-available-for-download]
[http://www.vmware.com/security/advisories/VMSA-2014-0006.html]
[http://www.vmware.com/security/advisories/VMSA-2014-0012.html]
[http://www.websense.com/support/article/kbarticle/Vulnerabilities-resolved-in-TRITON-APX-Version-8-0]
[http://www-01.ibm.com/support/docview.wss?uid=isg400001841]
[http://www-01.ibm.com/support/docview.wss?uid=isg400001843]
[http://www-01.ibm.com/support/docview.wss?uid=nas8N1020163]
[http://www-01.ibm.com/support/docview.wss?uid=nas8N1020172]
[http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004690]
[IV61506]
[http://www-01.ibm.com/support/docview.wss?uid=swg21673137]
[http://www-01.ibm.com/support/docview.wss?uid=swg21675626]
[http://www-01.ibm.com/support/docview.wss?uid=swg21675821]
[http://www-01.ibm.com/support/docview.wss?uid=swg21676035]
[http://www-01.ibm.com/support/docview.wss?uid=swg21676062]
[http://www-01.ibm.com/support/docview.wss?uid=swg21676071]
[http://www-01.ibm.com/support/docview.wss?uid=swg21676333]
[http://www-01.ibm.com/support/docview.wss?uid=swg21676334]
[http://www-01.ibm.com/support/docview.wss?uid=swg21676419]
[http://www-01.ibm.com/support/docview.wss?uid=swg21676478]
[http://www-01.ibm.com/support/docview.wss?uid=swg21676496]
[http://www-01.ibm.com/support/docview.wss?uid=swg21676501]
[http://www-01.ibm.com/support/docview.wss?uid=swg21676529]
[http://www-01.ibm.com/support/docview.wss?uid=swg21676536]
[http://www-01.ibm.com/support/docview.wss?uid=swg21676615]
[http://www-01.ibm.com/support/docview.wss?uid=swg21676644]
[http://www-01.ibm.com/support/docview.wss?uid=swg21676655]
[http://www-01.ibm.com/support/docview.wss?uid=swg21676786]
[http://www-01.ibm.com/support/docview.wss?uid=swg21676833]
[http://www-01.ibm.com/support/docview.wss?uid=swg21676845]
[http://www-01.ibm.com/support/docview.wss?uid=swg21676879]
[http://www-01.ibm.com/support/docview.wss?uid=swg21676889]
[http://www-01.ibm.com/support/docview.wss?uid=swg21677080]
[http://www-01.ibm.com/support/docview.wss?uid=swg21677131]
[http://www-01.ibm.com/support/docview.wss?uid=swg21677390]
[http://www-01.ibm.com/support/docview.wss?uid=swg21677527]
[http://www-01.ibm.com/support/docview.wss?uid=swg21677567]
[http://www-01.ibm.com/support/docview.wss?uid=swg21677695]
[http://www-01.ibm.com/support/docview.wss?uid=swg21677828]
[http://www-01.ibm.com/support/docview.wss?uid=swg21677836]
[http://www-01.ibm.com/support/docview.wss?uid=swg21678167]
[http://www-01.ibm.com/support/docview.wss?uid=swg21678233]
[http://www-01.ibm.com/support/docview.wss?uid=swg21678289]
[http://www-01.ibm.com/support/docview.wss?uid=swg21683332]
[http://www-01.ibm.com/support/docview.wss?uid=swg24037727]
[http://www-01.ibm.com/support/docview.wss?uid=swg24037729]
[http://www-01.ibm.com/support/docview.wss?uid=swg24037730]
[http://www-01.ibm.com/support/docview.wss?uid=swg24037731]
[http://www-01.ibm.com/support/docview.wss?uid=swg24037732]
[http://www-01.ibm.com/support/docview.wss?uid=swg24037761]
[http://www-01.ibm.com/support/docview.wss?uid=swg24037870]
[http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd?mode=18&ID=6060&myns=phmc&mync=E]
[http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd?mode=18&ID=6061&myns=phmc&mync=E]
[http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=migr-5095737]
[http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095740]
[http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095754]
[http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095755]
[http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095756]
[http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095757]
[https://access.redhat.com/site/blogs/766093/posts/908133]
[https://blogs.oracle.com/sunsecurity/entry/cve_2014_0224_cryptographic_issues]
[https://blogs.oracle.com/sunsecurity/entry/cve_2014_0224_cryptographic_issues1]
[https://bugzilla.redhat.com/show_bug.cgi?id=1103586]
[https://discussions.nessus.org/thread/7517]
[https://filezilla-project.org/versions.php?type=server]
[https://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=bc8923b1ec9c467755cd86f7848c50ee8812e441]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05301946]
[https://kb.bluecoat.com/index?page=content&id=SA80]
[https://kc.mcafee.com/corporate/index?page=content&id=SB10075]
[https://www.ibm.com/support/docview.wss?uid=ssg1S1004670]
[https://www.ibm.com/support/docview.wss?uid=ssg1S1004671]
[https://www.imperialviolet.org/2014/06/05/earlyccs.html]
[https://www.intersectalliance.com/wp-content/uploads/release_notes/ReleaseNotes_for_SNARE_for_MSSQL.pdf]
[https://www.intersectalliance.com/wp-content/uploads/release_notes/ReleaseNotes_for_Snare_for_Windows.pdf]
[https://www.novell.com/support/kb/doc.php?id=7015271]
When processing user provided XML documents, the Spring Framework 4.0.0 to 4.0.4, 3.0.0 to 3.2.8, and possibly earlier unsupported versions did not disable by default the resolution of URI references in a DTD declaration. This enabled an XXE attack.
[https://pivotal.io/security/cve-2014-0225]
Race condition in the mod_status module in the Apache HTTP Server before 2.4.10 allows remote attackers to cause a denial of service (heap-based buffer overflow), or possibly obtain sensitive credential information or execute arbitrary code, via a crafted request that triggers improper scoreboard handling within the status_handler function in modules/generators/mod_status.c and the lua_ap_scoreboard_worker function in modules/lua/lua_request.c.
[http://advisories.mageia.org/MGASA-2014-0304.html]
[http://advisories.mageia.org/MGASA-2014-0305.html]
[http://httpd.apache.org/security/vulnerabilities_24.html]
[APPLE-SA-2015-04-08-2]
[SSRT102066]
[HPSBMU03380]
[HPSBMU03409]
[HPSBUX03512]
[RHSA-2014:1019]
[RHSA-2014:1020]
[RHSA-2014:1021]
[20140721 Apache HTTPd - description of the CVE-2014-0226.]
[GLSA-201408-12]
[http://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x/CHANGES]
[http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/generators/mod_status.c]
[http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/generators/mod_status.c?r1=1450998&r2=1610491&diff_format=h]
[http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/lua/lua_request.c]
[http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/lua/lua_request.c?r1=1588989&r2=1610491&diff_format=h]
[DSA-2989]
[34133]
[MDVSA-2014:142]
[http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html]
[68678]
[http://zerodayinitiative.com/advisories/ZDI-14-236/]
[https://bugzilla.redhat.com/show_bug.cgi?id=1120603]
[https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04832246]
[[httpd-cvs] 20190815 svn commit: r1048743 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html]
[https://puppet.com/security/cve/cve-2014-0226]
[GLSA-201504-03]
[https://support.apple.com/HT204659]
java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat 6.x before 6.0.42, 7.x before 7.0.55, and 8.x before 8.0.9 does not properly handle attempts to continue reading data after an error has occurred, which allows remote attackers to conduct HTTP request smuggling attacks or cause a denial of service (resource consumption) by streaming data with malformed chunked transfer coding.
[http://advisories.mageia.org/MGASA-2015-0081.html]
[20150209 [SECURITY] CVE-2014-0227 Apache Tomcat Request Smuggling]
[FEDORA-2015-2109]
[HPSBUX03341]
[SSRT102066]
[RHSA-2015:0675]
[RHSA-2015:0720]
[RHSA-2015:0765]
[RHSA-2015:0983]
[RHSA-2015:0991]
[http://svn.apache.org/viewvc?view=revision&revision=1600984]
[http://tomcat.apache.org/security-6.html]
[http://tomcat.apache.org/security-7.html]
[http://tomcat.apache.org/security-8.html]
[DSA-3447]
[DSA-3530]
[MDVSA-2015:052]
[MDVSA-2015:053]
[MDVSA-2015:084]
[http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html]
[http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html]
[72717]
[1032791]
[USN-2654-1]
[USN-2655-1]
[https://bugzilla.redhat.com/show_bug.cgi?id=1109196]
[[tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/]
[[tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/]
[[tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/]
[[tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/]
[https://source.jboss.org/changelog/JBossWeb?cs=2455]
Apache Hive before 0.13.1, when in SQL standards based authorization mode, does not properly check the file permissions for (1) import and (2) export statements, which allows remote authenticated users to obtain sensitive information via a crafted URI.
[[hive-user] 20140612 CVE-2014-0228: Apache Hive Authorization vulnerability]
[http://packetstormsecurity.com/files/127091/Apache-Hive-0.13.0-Authorization-Failure.html]
[20140612 CVE-2014-0228: Apache Hive Authorization vulnerability]
Apache Hadoop 0.23.x before 0.23.11 and 2.x before 2.4.1, as used in Cloudera CDH 5.0.x before 5.0.2, do not check authorization for the (1) refreshNamenodes, (2) deleteBlockPool, and (3) shutdownDatanode HDFS admin commands, which allows remote authenticated users to cause a denial of service (DataNodes shutdown) or perform unnecessary operations by issuing a command.
[https://www.cloudera.com/documentation/other/security-bulletins/topics/csb_topic_1.html#concept_i1q_xvk_2r]
Apache Tomcat 6.x before 6.0.44, 7.x before 7.0.55, and 8.x before 8.0.9 does not properly handle cases where an HTTP response occurs before finishing the reading of an entire request body, which allows remote attackers to cause a denial of service (thread consumption) via a series of aborted upload attempts.
[[tomcat-announce] 20150505 [SECURITY] CVE-2014-0230: Apache Tomcat DoS]
[HPSBOV03503]
[HPSBUX03561]
[[oss-security] 20150409 Apache Tomcat partial file upload DoS CVE-2014-0230]
[RHSA-2015:1621]
[RHSA-2015:1622]
[RHSA-2015:2661]
[RHSA-2016:0595]
[RHSA-2016:0596]
[RHSA-2016:0597]
[RHSA-2016:0598]
[RHSA-2016:0599]
[http://svn.apache.org/viewvc?view=revision&revision=1603770]
[http://svn.apache.org/viewvc?view=revision&revision=1603775]
[http://svn.apache.org/viewvc?view=revision&revision=1603779]
[http://tomcat.apache.org/security-6.html]
[http://tomcat.apache.org/security-7.html]
[http://tomcat.apache.org/security-8.html]
[DSA-3447]
[DSA-3530]
[http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html]
[http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html]
[http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html]
[74475]
[USN-2654-1]
[USN-2655-1]
[RHSA-2015:2659]
[RHSA-2015:2660]
[https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05054964]
[https://issues.jboss.org/browse/JWS-219]
[https://issues.jboss.org/browse/JWS-220]
[[tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/]
[[tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/]
[[tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/]
[[tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/]
The mod_cgid module in the Apache HTTP Server before 2.4.10 does not have a timeout mechanism, which allows remote attackers to cause a denial of service (process hang) via a request to a CGI script that does not read from its stdin file descriptor.
[http://advisories.mageia.org/MGASA-2014-0304.html]
[http://advisories.mageia.org/MGASA-2014-0305.html]
[http://httpd.apache.org/security/vulnerabilities_24.html]
[APPLE-SA-2015-04-08-2]
[SSRT102066]
[HPSBMU03380]
[HPSBMU03409]
[HPSBUX03512]
[http://packetstormsecurity.com/files/130769/RSA-Digital-Certificate-Solution-XSS-Denial-Of-Service.html]
[RHSA-2014:1019]
[RHSA-2014:1020]
[RHSA-2014:1021]
[http://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x/CHANGES]
[http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/generators/mod_cgid.c]
[http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/generators/mod_cgid.c?r1=1482522&r2=1535125&diff_format=h]
[http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/generators/mod_cgid.c?r1=1565711&r2=1610509&diff_format=h]
[DSA-2989]
[MDVSA-2014:142]
[http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html]
[68742]
[https://bugzilla.redhat.com/show_bug.cgi?id=1120596]
[https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04832246]
[[httpd-cvs] 20190815 svn commit: r1048743 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html]
[https://puppet.com/security/cve/cve-2014-0231]
[GLSA-201504-03]
[https://support.apple.com/HT204659]
Multiple cross-site scripting (XSS) vulnerabilities in framework/common/webcommon/includes/messages.ftl in Apache OFBiz 11.04.01 before 11.04.05 and 12.04.01 before 12.04.04 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, which are not properly handled in a (1) result or (2) error message.
[http://ofbiz.apache.org/download.html#vulnerabilities]
[http://packetstormsecurity.com/files/127929/Apache-OFBiz-11.04.04-12.04.03-Cross-Site-Scripting.html]
[[oss-security] 20140819 [CVE-2014-0232] Apache OFBiz Cross-site scripting (XSS) vulnerability]
[http://svn.apache.org/viewvc?view=revision&revision=r1608698]
[20140819 [CVE-2014-0232] Apache OFBiz Cross-site scripting (XSS) vulnerability]
[69286]
[1030739]
[apache-ofbiz-cve20140232-xss(95356)]
Red Hat OpenShift Enterprise 2.0 and 2.1 and OpenShift Origin allow remote authenticated users to execute arbitrary commands via shell metacharacters in a directory name that is referenced by a cartridge using the file: URI scheme.
[RHSA-2014:0529]
[RHSA-2014:0530]
[https://bugzilla.redhat.com/show_bug.cgi?id=1096955]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-0325, CVE-2014-3538. Reason: This candidate is a duplicate of CVE-2014-0325 and/or CVE-2014-3538. A typo caused the wrong ID to be used. Notes: All CVE users should reference CVE-2014-0325 instead of this candidate for the issue in the Internet Explorer product, and should reference CVE-2014-3538 instead of this candidate for the issue in the file product. All references and descriptions in this candidate have been removed to prevent accidental usage.
file before 5.18, as used in the Fileinfo component in PHP before 5.6.0, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a zero root_storage value in a CDF file, related to cdf.c and readcdf.c.
<a href="http://cwe.mitre.org/data/definitions/476.html">CWE-476: NULL Pointer Dereference</a>
[http://git.php.net/?p=php-src.git;a=commit;h=f3f22ff5c697aef854ffc1918bce708b37481b0f]
[http://php.net/ChangeLog-5.php]
[https://bugs.php.net/bug.php?id=67329]
The cdf_unpack_summary_info function in cdf.c in the Fileinfo component in PHP before 5.4.29 and 5.5.x before 5.5.13 allows remote attackers to cause a denial of service (performance degradation) by triggering many file_printf calls.
[APPLE-SA-2015-04-08-2]
[SUSE-SU-2014:0869]
[RHSA-2014:1765]
[RHSA-2014:1766]
[59061]
[59329]
[59418]
[60998]
[http://support.apple.com/kb/HT6443]
[DSA-3021]
[http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html]
[http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html]
[http://www.php.net/ChangeLog-5.php]
[67759]
[http://www-01.ibm.com/support/docview.wss?uid=swg21683486]
[https://bugs.php.net/bug.php?id=67328]
[https://github.com/file/file/commit/b8acc83781d5a24cc5101e525d15efe0482c280d]
[https://support.apple.com/HT204659]
The cdf_read_property_info function in cdf.c in the Fileinfo component in PHP before 5.4.29 and 5.5.x before 5.5.13 allows remote attackers to cause a denial of service (infinite loop or out-of-bounds memory access) via a vector that (1) has zero length or (2) is too long.
[APPLE-SA-2015-04-08-2]
[SUSE-SU-2014:0869]
[RHSA-2014:1765]
[RHSA-2014:1766]
[59061]
[59329]
[59418]
[60998]
[http://support.apple.com/kb/HT6443]
[DSA-3021]
[http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html]
[http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html]
[http://www.php.net/ChangeLog-5.php]
[67765]
[http://www-01.ibm.com/support/docview.wss?uid=swg21683486]
[https://bugs.php.net/bug.php?id=67327]
[https://github.com/file/file/commit/f97486ef5dc3e8735440edc4fc8808c63e1a3ef0]
[https://support.apple.com/HT204659]
The internal DNS server in Samba 4.x before 4.0.18 does not check the QR field in the header section of an incoming DNS message before sending a response, which allows remote attackers to cause a denial of service (CPU and bandwidth consumption) via a forged response packet that triggers a communication loop, a related issue to CVE-1999-0103.
[GLSA-201502-15]
[http://www.samba.org/samba/security/CVE-2014-0239]
[67691]
[1030309]
The mod_wsgi module before 3.5 for Apache, when daemon mode is enabled, does not properly handle error codes returned by setuid when run on certain Linux kernels, which allows local users to gain privileges via vectors related to the number of running processes.
[http://blog.dscpl.com.au/2014/05/security-release-for-modwsgi-version-35.html]
[http://modwsgi.readthedocs.org/en/latest/release-notes/version-3.5.html]
[RHSA-2014:0789]
[59551]
[60094]
[[oss-security] 20140521 Security release for mod_wsgi (version 3.5)]
[67532]
Check_MK through 1.2.5i2p1 allows local users to read arbitrary files via a symlink attack to a file in /var/lib/check_mk_agent/job.
[http://git.mathias-kettner.de/git/?p=check_mk.git;a=commit;h=0426323df1641596c4f01ef5a716a3b65276f01c]
[http://git.mathias-kettner.de/git/?p=check_mk.git;a=commit;h=a2ef8d00c53ec9cbd05c4ae2f09b50761130e7ce]
[FEDORA-2014-6818]
[FEDORA-2014-6810]
[http://packetstormsecurity.com/files/126857/Check_MK-Arbitrary-File-Disclosure.html]
[20140528 LSE Leading Security Experts GmbH - LSE-2014-05-21 - Check_MK - Arbitrary File Disclosure Vulnerability]
[[oss-security] 20140528 LSE Leading Security Experts GmbH - LSE-2014-05-21 - Check_MK - Arbitrary File Disclosure Vulnerability]
[67674]
[https://bugzilla.redhat.com/show_bug.cgi?id=1101669]
[58536]
[20140528 LSE Leading Security Experts GmbH - LSE-2014-05-21 - Check_MK - Arbitrary File Disclosure Vulnerability]
The sys_recvfrom function in nmbd in Samba 3.6.x before 3.6.24, 4.0.x before 4.0.19, and 4.1.x before 4.1.9 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a malformed UDP packet.
[http://advisories.mageia.org/MGASA-2014-0279.html]
[http://linux.oracle.com/errata/ELSA-2014-0866.html]
[FEDORA-2014-9132]
[FEDORA-2014-7672]
[RHSA-2014:0866]
[59407]
[59433]
[61218]
[GLSA-201502-15]
[MDVSA-2014:136]
[MDVSA-2015:082]
[http://www.samba.org/samba/security/CVE-2014-0244]
[20140711 [ MDVSA-2014:136 ] samba]
[68148]
[1030455]
[https://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_samba1]
[https://bugzilla.redhat.com/show_bug.cgi?id=1097815]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05115993]
SOSreport stores the md5 hash of the GRUB bootloader password in an archive, which allows local users to obtain sensitive information by reading the archive.
[[oss-security] 20140527 CVE-2014-0246 sos: md5 hash of GRUB password collected when running sosreport]
[67634]
[https://bugzilla.redhat.com/show_bug.cgi?id=1101393]
LibreOffice 4.2.4 executes unspecified VBA macros automatically, which has unspecified impact and attack vectors, possibly related to doc/docmacromode.cxx.
[FEDORA-2014-7679]
[openSUSE-SU-2014:0860]
[http://people.canonical.com/~ubuntu-security/cve/2014/CVE-2014-0247.html]
[RHSA-2015:0377]
[GLSA-201408-19]
[68151]
[USN-2253-1]
[https://bugs.mageia.org/show_bug.cgi?id=13580]
[https://gerrit.libreoffice.org/gitweb?p=core.git;a=blobdiff;f=sfx2/source/doc/docmacromode.cxx;h=4d4ae52b4339582a039744d03671c1db0633d6c3;hp=2108d1920f8148ff60fd4a57684f295d6d733e7b;hb=1b0402f87c9b17fef2141130bfaa1798ece6ba0d;hpb=4d2113250fa7ed62fe2c53ed0f76e3de5875cb81]
[https://www.libreoffice.org/about-us/security/advisories/cve-2014-0247/]
org.jboss.seam.web.AuthenticationFilter in Red Hat JBoss Web Framework Kit 2.5.0, JBoss Enterprise Application Platform (JBEAP) 5.2.0, and JBoss Enterprise Web Platform (JBEWP) 5.2.0 allows remote attackers to execute arbitrary code via a crafted authentication header, related to Seam logging.
[RHSA-2014:0785]
[RHSA-2014:0791]
[RHSA-2014:0792]
[RHSA-2014:0793]
[RHSA-2014:0794]
[RHSA-2015:1888]
[59554]
[1030457]
The System Security Services Daemon (SSSD) 1.11.6 does not properly identify group membership when a non-POSIX group is in a group membership chain, which allows local users to bypass access restrictions via unspecified vectors.
[https://bugzilla.redhat.com/show_bug.cgi?id=1101751]
[[SSSD] 20140513 On POSIX and non-POSIX groups]
Multiple integer overflows in client/X11/xf_graphics.c in FreeRDP allow remote attackers to have an unspecified impact via the width and height to the (1) xf_Pointer_New or (2) xf_Bitmap_Decompress function, which causes an incorrect amount of memory to be allocated.
[http://advisories.mageia.org/MGASA-2014-0287.html]
[openSUSE-SU-2014:0862]
[[oss-security] 20140528 freerdp: integer overflows in memory allocations in client/X11/xf_graphics.c]
[GLSA-201412-18]
[MDVSA-2015:171]
[67670]
[https://bugzilla.redhat.com/show_bug.cgi?id=998934]
[https://github.com/FreeRDP/FreeRDP/issues/1871]
[https://github.com/FreeRDP/FreeRDP/pull/1874]
Microsoft Windows SharePoint Services 3.0 SP3; SharePoint Server 2007 SP3, 2010 SP1 and SP2, and 2013 Gold and SP1; SharePoint Foundation 2010 SP1 and SP2 and 2013 Gold and SP1; Project Server 2010 SP1 and SP2 and 2013 Gold and SP1; Web Applications 2010 SP1 and SP2; Office Web Apps Server 2013 Gold and SP1; SharePoint Server 2013 Client Components SDK; and SharePoint Designer 2007 SP3, 2010 SP1 and SP2, and 2013 Gold and SP1 allow remote authenticated users to execute arbitrary code via crafted page content, aka "SharePoint Page Content Vulnerability."
[1030227]
[MS14-022]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2014. Notes: none.
Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, 4.5, and 4.5.1 does not properly determine TCP connection states, which allows remote attackers to cause a denial of service (ASP.NET daemon hang) via crafted HTTP requests that trigger persistent resource consumption for a (1) stale or (2) closed connection, as exploited in the wild in February 2014, aka "POST Request DoS Vulnerability."
[103162]
[56793]
[65415]
[1029745]
[MS14-009]
The IPv6 implementation in Microsoft Windows 8, Windows Server 2012, and Windows RT does not properly validate packets, which allows remote attackers to cause a denial of service (system hang) via crafted ICMPv6 Router Advertisement packets, aka "TCP/IP Version 6 (IPv6) Denial of Service Vulnerability."
[103159]
[56775]
[65409]
[1029747]
[MS14-006]
[ms-ipv6-cve20140254-dos(90755)]
Microsoft Windows Server 2008 SP2 and R2 SP1 and Server 2012 Gold and R2 allow remote attackers to cause a denial of service (iSCSI service outage) by sending many crafted packets, aka "iSCSI Target Remote Denial of Service Vulnerability."
[MS14-028]
Microsoft Windows Server 2008 SP2 and R2 SP1 and Server 2012 Gold allow remote attackers to cause a denial of service (iSCSI service outage) by sending many crafted packets, aka "iSCSI Target Remote Denial of Service Vulnerability."
[MS14-028]
Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, 4.5, and 4.5.1 does not properly determine whether it is safe to execute a method, which allows remote attackers to execute arbitrary code via (1) a crafted web site or (2) a crafted .NET Framework application that exposes a COM server endpoint, aka "Type Traversal Vulnerability."
[http://packetstormsecurity.com/files/127246/MS14-009-.NET-Deployment-Service-IE-Sandbox-Escape.html]
[56793]
[33892]
[103163]
[65417]
[1029745]
[MS14-009]
Microsoft Word 2003 SP3 and 2007 SP3, Office Compatibility Pack SP3, and Word Viewer allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Word Memory Corruption Vulnerability."
[1029598]
[1029599]
[MS14-001]
Microsoft Word 2007 SP3 and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Word Memory Corruption Vulnerability."
[1029598]
[1029599]
[MS14-001]
Microsoft Word 2003 SP3, 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Office Compatibility Pack SP3; Word Viewer; SharePoint Server 2010 SP1 and SP2 and 2013; Office Web Apps 2010 SP1 and SP2; and Office Web Apps Server 2013 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Word Memory Corruption Vulnerability."
[1029598]
[1029599]
[MS14-001]
Microsoft Dynamics AX 4.0 SP2, 2009 SP1, 2012, and 2012 R2 allows remote authenticated users to cause a denial of service (instance outage) via crafted data to an Application Object Server (AOS) instance, aka "Query Filter DoS Vulnerability."
[1029601]
[MS14-004]
win32k.sys in the kernel-mode drivers in Microsoft Windows 7 SP1 and Server 2008 R2 SP1 does not properly consider thread-owned objects during the processing of window handles, which allows local users to gain privileges via a crafted application, aka "Win32k Window Handle Vulnerability."
[64725]
[1029600]
[MS14-003]
The Direct2D implementation in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code via a large 2D geometric figure that is encountered with Internet Explorer, aka "Microsoft Graphics Component Memory Corruption Vulnerability."
[56781]
[65393]
[1029743]
[MS14-007]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2014. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2014. Notes: none.
The XMLHTTP ActiveX controls in XML Core Services 3.0 in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote attackers to bypass the Same Origin Policy via a web page that is visited in Internet Explorer, aka "MSXML Information Disclosure Vulnerability."
[56771]
[1029746]
[MS14-005]
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0289 and CVE-2014-0290.
[103168]
[56796]
[65361]
[1029741]
[MS14-010]
[ms-ie-cve20140267-code-exec(90759)]
Microsoft Internet Explorer 8 through 11 does not properly restrict file installation and registry-key creation, which allows remote attackers to bypass the Mandatory Integrity Control protection mechanism via a crafted web site, aka "Internet Explorer Elevation of Privilege Vulnerability."
[103165]
[56796]
[65392]
[1029741]
[MS14-010]
[ms-ie-cve20140268-priv-esc(90756)]
Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
[103169]
[56796]
[65363]
[1029741]
[MS14-010]
[ms-ie-cve20140269-code-exec(90760)]
Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0273, CVE-2014-0274, and CVE-2014-0288.
[103170]
[56796]
[65367]
[1029741]
[MS14-010]
[ms-ie-cve20140270-code-exec(90761)]
The VBScript engine in Microsoft Internet Explorer 6 through 11, and VBScript 5.6 through 5.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "VBScript Memory Corruption Vulnerability."
[103166]
[56796]
[56814]
[65395]
[1029741]
[MS14-010]
[MS14-011]
[ms-ie-cve20140271-code-exec(90757)]
Microsoft Internet Explorer 8 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
[103171]
[56796]
[65370]
[1029741]
[MS14-010]
[ms-ie-cve20140272-code-exec(90762)]
Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0270, CVE-2014-0274, and CVE-2014-0288.
[103172]
[56796]
[65371]
[1029741]
[MS14-010]
[ms-ie-cve20140273-code-exec(90763)]
Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0270, CVE-2014-0273, and CVE-2014-0288.
[103173]
[56796]
[65372]
[1029741]
[MS14-010]
[ms-ie-cve20140274-code-exec(90764)]
Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0285 and CVE-2014-0286.
[103174]
[56796]
[65373]
[1029741]
[MS14-010]
[ms-ie-cve20140275-code-exec(90765)]
Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
[103175]
[56796]
[65375]
[1029741]
[MS14-010]
[ms-ie-cve20140276-code-exec(90766)]
Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0278 and CVE-2014-0279.
[HPSBOV03503]
[103176]
[56796]
[65376]
[1029741]
[MS14-010]
[ms-ie-cve20140277-code-exec(90767)]
[https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013]
Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0277 and CVE-2014-0279.
[103177]
[56796]
[65377]
[1029741]
[MS14-010]
[ms-ie-cve20140278-code-exec(90768)]
Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0277 and CVE-2014-0278.
[103178]
[56796]
[65378]
[1029741]
[MS14-010]
[ms-ie-cve20140279-code-exec(90769)]
Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
[103179]
[56796]
[65380]
[1029741]
[MS14-010]
[ms-ie-cve20140280-code-exec(90770)]
Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0287.
[103180]
[56796]
[65381]
[1029741]
[MS14-010]
[ms-ie-cve20140281-code-exec(90771)]
Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1775, CVE-2014-1779, CVE-2014-1799, CVE-2014-1803, and CVE-2014-2757.
[33860]
[107851]
[67862]
[1030370]
[MS14-035]
Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
[103181]
[56796]
[65382]
[1029741]
[MS14-010]
[ms-ie-cve20140283-code-exec(90773)]
Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
[103182]
[56796]
[65383]
[1029741]
[MS14-010]
[ms-ie-cve20140284-code-exec(90774)]
Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0275 and CVE-2014-0286.
[103183]
[56796]
[65384]
[1029741]
[MS14-010]
[ms-ie-cve20140285-code-exec(90775)]
Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0275 and CVE-2014-0285.
[103184]
[56796]
[65385]
[1029741]
[MS14-010]
[ms-ie-cve20140286-code-exec(90776)]
Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0281.
[103185]
[56796]
[65386]
[1029741]
[MS14-010]
[ms-ie-cve20140287-code-exec(90777)]
Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0270, CVE-2014-0273, and CVE-2014-0274.
[103186]
[56796]
[65388]
[1029741]
[MS14-010]
[ms-ie-cve20140288-code-exec(90778)]
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0267 and CVE-2014-0290.
[103187]
[56796]
[65389]
[1029741]
[MS14-010]
[ms-ie-cve20140289-code-exec(90779)]
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0267 and CVE-2014-0289.
[103188]
[56796]
[65390]
[1029741]
[MS14-010]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2014. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue requiring a CVE ID. Notes: none.
Microsoft Internet Explorer 9 through 11 allows remote attackers to read content from a different (1) domain or (2) zone via a crafted web site, aka "Internet Explorer Cross-domain Information Disclosure Vulnerability."
[103167]
[56796]
[65394]
[1029741]
[MS14-010]
[ms-ie-cve20140293-info-disc(90758)]
Microsoft Forefront Protection 2010 for Exchange Server does not properly parse e-mail content, which might allow remote attackers to execute arbitrary code via a crafted message, aka "RCE Vulnerability."
[103161]
[56788]
[65397]
[1029744]
[MS14-008]
VsaVb7rt.dll in Microsoft .NET Framework 2.0 SP2 and 3.5.1 does not implement the ASLR protection mechanism, which makes it easier for remote attackers to execute arbitrary code via a crafted web site, as exploited in the wild in February 2014, aka "VSAVB7RT ASLR Vulnerability."
[103164]
[56793]
[http://www.greyhathacker.net/?p=585]
[65418]
[1029745]
[MS14-009]
The Remote Desktop Protocol (RDP) implementation in Microsoft Windows 7 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 does not properly encrypt sessions, which makes it easier for man-in-the-middle attackers to obtain sensitive information by sniffing the network or modify session content by sending crafted RDP packets, aka "RDP MAC Vulnerability."
[http://blogs.technet.com/b/srd/archive/2014/06/10/assessing-risk-for-the-june-2014-security-updates.aspx]
[67865]
[MS14-030]
Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0308, CVE-2014-0312, and CVE-2014-0324.
[MS14-012]
Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
[MS14-012]
Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0305 and CVE-2014-0311.
[MS14-012]
win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability."
[MS14-015]
Double free vulnerability in qedit.dll in DirectShow in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via a crafted JPEG image, aka "DirectShow Memory Corruption Vulnerability."
[MS14-013]
Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0303.
[MS14-012]
Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0302.
[MS14-012]
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
[MS14-012]
Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0299 and CVE-2014-0311.
[MS14-012]
Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
[MS14-012]
Use-after-free vulnerability in Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a certain sequence of manipulations of a TextRange element, aka "Internet Explorer Memory Corruption Vulnerability."
[32438]
[MS14-012]
Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0297, CVE-2014-0312, and CVE-2014-0324.
[MS14-012]
Microsoft Internet Explorer 8 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
[MS14-012]
Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1815.
[MS14-029]
Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0299 and CVE-2014-0305.
[MS14-012]
Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0297, CVE-2014-0308, and CVE-2014-0324.
[MS14-012]
Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0321.
[MS14-012]
Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
[MS14-012]
Untrusted search path vulnerability in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a Trojan horse cmd.exe file in the current working directory, as demonstrated by a directory that contains a .bat or .cmd file, aka "Windows File Handling Vulnerability."
Per: http://cwe.mitre.org/data/definitions/426.html "CWE-426: Untrusted Search Path"
[http://blogs.technet.com/b/srd/archive/2014/04/08/ms14-019-fixing-a-binary-hijacking-via-cmd-or-bat-file.aspx]
[MS14-019]
Memory leak in the Local RPC (LRPC) server implementation in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to cause a denial of service (memory consumption) and bypass the ASLR protection mechanism via a crafted client that sends messages with an invalid data view, aka "LRPC ASLR Bypass Vulnerability."
[1030722]
[MS14-047]
The Security Account Manager Remote (SAMR) protocol implementation in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows Server 2012 Gold and R2 does not properly determine the user-lockout state, which makes it easier for remote attackers to bypass the account lockout policy and obtain access via a brute-force attack, aka "SAMR Security Feature Bypass Vulnerability."
[MS14-016]
win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly control access to thread-owned objects, which allows local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability."
[60673]
[69142]
[MS14-045]
Microsoft Silverlight 5 before 5.1.30214.0 and Silverlight 5 Developer Runtime before 5.1.30214.0 allow attackers to bypass the DEP and ASLR protection mechanisms via unspecified vectors, aka "Silverlight DEP/ASLR Bypass Vulnerability."
[MS14-014]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2014. Notes: none.
Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0313.
[MS14-012]
Use-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code via vectors involving crafted JavaScript code, CMarkup, and the onpropertychange attribute of a script element, as exploited in the wild in January and February 2014.
[http://community.websense.com/blogs/securitylabs/archive/2014/02/13/msie-0-day-exploit-cve-2014-0322-possibly-targeting-french-aerospace-organization.aspx]
[http://technet.microsoft.com/security/advisory/2934088]
[http://twitter.com/nanoc0re/statuses/434251658344673281]
[32851]
[32904]
[http://www.fireeye.com/blog/technical/cyber-exploits/2014/02/new-ie-zero-day-found-in-watering-hole-attack-2.html]
[http://www.fireeye.com/blog/uncategorized/2014/02/operation-snowman-deputydog-actor-compromises-us-veterans-of-foreign-wars-website.html]
[VU#732479]
[MS14-012]
[https://www.dropbox.com/s/pyxjgycmudirbqe/CVE-2014-0322.zip]
win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to obtain sensitive information from kernel memory or cause a denial of service (system hang) via a crafted application, aka "Win32k Information Disclosure Vulnerability."
[MS14-015]
Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0297, CVE-2014-0308, and CVE-2014-0312.
[MS14-012]
Use-after-free vulnerability in Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site that triggers improper processing of CElement objects, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1751 and CVE-2014-1755. NOTE: MS14-018 originally had a typo of CVE-2014-0235 for this.
<a href="http://cwe.mitre.org/data/definitions/416.html" target="_blank">CWE-416: Use After Free</a>
[66646]
[http://zerodayinitiative.com/advisories/ZDI-14-078/]
[MS14-018]
The Pilot Below Deck Equipment (BDE) and OpenPort implementations on Iridium satellite terminals allow remote attackers to read hardcoded credentials via the web interface.
<a href="http://cwe.mitre.org/data/definitions/798.html">CWE-798: Use of Hard-coded Credentials</a>
[VU#578598]
The Terminal Upgrade Tool in the Pilot Below Deck Equipment (BDE) and OpenPort implementations on Iridium satellite terminals allows remote attackers to execute arbitrary code by uploading new firmware to TCP port 54321.
<a href="http://cwe.mitre.org/data/definitions/306.html">CWE-306: Missing Authentication for Critical Function</a>
[VU#578598]
The thraneLINK protocol implementation on Cobham devices does not verify firmware signatures, which allows attackers to execute arbitrary code by leveraging physical access or terminal access to send an SNMP request and a TFTP response.
<a href="http://cwe.mitre.org/data/definitions/347.html">CWE-347: Improper Verification of Cryptographic Signature</a>
[VU#179732]
The TELNET service on the ZTE ZXV10 W300 router 2.1.0 has a hardcoded password ending with airocon for the admin account, which allows remote attackers to obtain administrative access by leveraging knowledge of the MAC address characters present at the beginning of the password.
[http://blog.alguien.at/2014/02/hackeando-el-router-zte-zxv10-w300-v21.html]
[http://packetstormsecurity.com/files/125142/ZTE-ZXV10-W300-Hardcoded-Credentials.html]
[VU#228886]
[65310]
[zxv10-w300-cve20140329-sec-bypass(90958)]
Cross-site scripting (XSS) vulnerability in adminui/user_list.php on the Dell KACE K1000 management appliance 5.5.90545 allows remote attackers to inject arbitrary web script or HTML via the LABEL_ID parameter.
[102855]
[VU#813382]
[65333]
[kace-cve20140330-xss(90954)]
Cross-site scripting (XSS) vulnerability in the web administration interface in FortiADC with firmware before 3.2.1 allows remote attackers to inject arbitrary web script or HTML via the locale parameter to gui_partA/.
[20140403 XSS Reflected vulnerabilities in OS of FortiADC v3.2 (CVE-2014-0331)]
[http://www.fortiguard.com/advisory/FG-IR-14-004]
[VU#667340]
[66642]
[1030018]
Cross-site scripting (XSS) vulnerability in mainPage in Dell SonicWALL GMS before 7.1 SP2, SonicWALL Analyzer before 7.1 SP2, and SonicWALL UMA E5000 before 7.1 SP2 might allow remote attackers to inject arbitrary web script or HTML via the node_id parameter in a ScreenDisplayManager genNetwork action.
[VU#727318]
[65498]
[http://www.sonicwall.com/us/shared/download/Support_Bulletin_GMS_Vulnerability_XSS_Resolved_in_7.1_SP2_and_7.2.pdf]
[sonicwall-cve20140332-nodeid-xss(91062)]
The png_push_read_chunk function in pngpread.c in the progressive decoder in libpng 1.6.x through 1.6.9 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via an IDAT chunk with a length of zero.
[ftp://ftp.simplesystems.org/pub/png/src/libpng16/patch-libpng16-vu684412.diff]
[openSUSE-SU-2014:0358]
[VU#684412]
[https://sourceforge.net/projects/libpng/files/libpng16/patch-libpng16-vu684412.diff]
Multiple cross-site scripting (XSS) vulnerabilities in CMS Made Simple allow remote authenticated users to inject arbitrary web script or HTML via (1) the group parameter to admin/addgroup.php, (2) the htmlblob parameter to admin/addhtmlblob.php, the (3) title or (4) url parameter to admin/addbookmark.php, (5) the stylesheet_name parameter to admin/copystylesheet.php, (6) the template_name parameter to admin/copytemplate.php, the (7) title or (8) url parameter to admin/editbookmark.php, (9) the template parameter to admin/listtemplates.php, or (10) the css_name parameter to admin/listcss.php, a different issue than CVE-2014-2092.
[VU#526062]
[65898]
Multiple cross-site scripting (XSS) vulnerabilities in the web client in Serena Dimensions CM 12.2 build 7.199.0 allow remote attackers to inject arbitrary web script or HTML via the (1) DB_CONN, (2) DB_NAME, (3) DM_HOST, (4) MAN_DB_NAME, (5) framecmd, (6) identifier, (7) merant.adm.adapters.AdmDialogPropertyMgr, (8) nav_frame, (9) nav_jsp, (10) target_frame, (11) id, or (12) type parameter to the dimensions/ URI.
[VU#823452]
Cross-site request forgery (CSRF) vulnerability in the web client in Serena Dimensions CM 12.2 build 7.199.0 allows remote attackers to hijack the authentication of administrators for requests that use the user_new_master parameter to the adminconsole/ URI.
[VU#823452]
Cross-site scripting (XSS) vulnerability in the web interface on Huawei Echo Life HG8247 routers with software before V100R006C00SPC127 allows remote attackers to inject arbitrary web script or HTML via an invalid TELNET connection attempt with a crafted username that is not properly handled during construction of the "failed log-in attempts over telnet" log view.
[VU#917700]
Multiple cross-site scripting (XSS) vulnerabilities in the firewall policy management pages in WatchGuard Fireware XTM before 11.8.3 allow remote attackers to inject arbitrary web script or HTML via the pol_name parameter.
[20140313 WatchGuard Fireware XTM devices contain a cross-site scripting vulnerability (CVE-2014-0338)]
[http://watchguardsecuritycenter.com/2014/03/13/fireware-xtm-11-8-3-update-corrects-xss-flaw/]
[VU#807134]
[66210]
[1029924]
Cross-site scripting (XSS) vulnerability in view.cgi in Webmin before 1.680 allows remote attackers to inject arbitrary web script or HTML via the search parameter.
[20140315 Reflected XSS Attacks XSS vulnerabilities in Webmin 1.670 (CVE-2014-0339)]
[VU#381692]
[66248]
[http://www.webmin.com/changes.html]
[http://www-01.ibm.com/support/docview.wss?uid=swg21679713]
Multiple cross-site scripting (XSS) vulnerabilities in PivotX before 2.3.9 allow remote authenticated users to inject arbitrary web script or HTML via the title field to (1) templates_internal/pages.tpl, (2) templates_internal/home.tpl, or (3) templates_internal/entries.tpl; (4) an event field to objects.php; or the (5) email or (6) nickname field to pages.php, related to templates_internal/users.tpl.
[http://blog.pivotx.net/archive/2014/03/03/pivotx-239-released]
[http://pivotx.net/page/security]
[http://sourceforge.net/p/pivot-weblog/code/4345/]
[http://sourceforge.net/p/pivot-weblog/code/4349/]
[VU#901156]
[66800]
Multiple unrestricted file upload vulnerabilities in fileupload.php in PivotX before 2.3.9 allow remote authenticated users to execute arbitrary PHP code by uploading a file with a (1) .php or (2) .php# extension, and then accessing it via unspecified vectors.
Per: http://cwe.mitre.org/data/definitions/434.html
"CWE-434: Unrestricted Upload of File with Dangerous Type"
[http://blog.pivotx.net/archive/2014/03/03/pivotx-239-released]
[http://pivotx.net/page/security]
[http://sourceforge.net/p/pivot-weblog/code/4347/]
[VU#901156]
The web interface on Virtual Access GW6110A routers with software 9.00 before 9.09.27, 9.50 before 9.50.21, and 10.00 before 10.00.21 allows remote authenticated users to gain privileges via a modified JavaScript variable.
Per: http://cwe.mitre.org/data/definitions/472.html
"CWE-472: External Control of Assumed-Immutable Web Parameter"
[VU#213046]
Properties.do in ZOHO ManageEngine OpStor before build 8500 does not properly check privilege levels, which allows remote authenticated users to obtain Admin access by using the name parameter in conjunction with a true value of the edit parameter.
[VU#140886]
[66499]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-0160. Reason: This candidate is a reservation duplicate of CVE-2014-0160. Notes: All CVE users should reference CVE-2014-0160 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
The Settings module in Websense Triton Unified Security Center 7.7.3 before Hotfix 31, Web Filter 7.7.3 before Hotfix 31, Web Security 7.7.3 before Hotfix 31, Web Security Gateway 7.7.3 before Hotfix 31, and Web Security Gateway Anywhere 7.7.3 before Hotfix 31 allows remote authenticated users to read cleartext passwords by replacing type="password" with type="text" in an INPUT element in the (1) Log Database or (2) User Directories component.
[VU#568252]
[https://www.websense.com/content/mywebsense-hotfixes.aspx?patchid=894&prodidx=20&osidx=0&intidx=0&versionidx=0]
The Artiva Agency Single Sign-On (SSO) implementation in Artiva Workstation 1.3.x before 1.3.9, Artiva Rm 3.1 MR7, Artiva Healthcare 5.2 MR5, and Artiva Architect 3.2 MR5, when the domain-name option is enabled, allows remote attackers to login to arbitrary domain accounts by using the corresponding username on a Windows client machine.
[VU#215284]
Multiple unspecified vulnerabilities in J2k-Codec allow remote attackers to execute arbitrary code via a crafted JPEG 2000 file.
[VU#345337]
The Poco::Net::X509Certificate::verify method in the NetSSL library in POCO C++ Libraries before 1.4.6p4 allows man-in-the-middle attackers to spoof SSL servers via crafted DNS PTR records that are requested during comparison of a server name to a wildcard domain name in an X.509 certificate.
[FEDORA-2016-0b3a611401]
[FEDORA-2016-4a3e5618eb]
[VU#118748]
[https://raw.githubusercontent.com/pocoproject/poco/poco-1.4.6p4-release/CHANGELOG]
The FortiManager protocol service in Fortinet FortiOS before 4.3.16 and 5.x before 5.0.8 on FortiGate devices does not prevent use of anonymous ciphersuites, which makes it easier for man-in-the-middle attackers to obtain sensitive information or interfere with communications by modifying the client-server data stream.
[http://www.fortiguard.com/advisory/FG-IR-14-006/]
[VU#730964]
[69754]
[fortios-cve20140351-mitm(96119)]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-2216. Reason: This candidate is a reservation duplicate of CVE-2014-2216. Notes: All CVE users should reference CVE-2014-2216 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
The ZyXEL Wireless N300 NetUSB NBG-419N router with firmware 1.00(BFQ.6)C0 allows remote attackers to bypass authentication by using %2F sequences in place of / (slash) characters.
[VU#939260]
The ZyXEL Wireless N300 NetUSB NBG-419N router with firmware 1.00(BFQ.6)C0 has a hardcoded password of qweasdzxc for an unspecified account, which allows remote attackers to obtain index.asp login access via an HTTP request.
[VU#939260]
Multiple stack-based buffer overflows on the ZyXEL Wireless N300 NetUSB NBG-419N router with firmware 1.00(BFQ.6)C0 allow man-in-the-middle attackers to execute arbitrary code via (1) a long temp attribute in a yweather:condition element in a forecastrss file that is processed by the checkWeather function; the (2) WeatherCity or (3) WeatherDegree variable to the detectWeather function; unspecified input to the (4) UpnpAddRunRLQoS, (5) UpnpDeleteRunRLQoS, or (6) UpnpDeletePortCheckType function; or (7) the SET COUNTRY udps command.
[VU#939260]
The ZyXEL Wireless N300 NetUSB NBG-419N router with firmware 1.00(BFQ.6)C0 allows remote attackers to execute arbitrary code via shell metacharacters in input to the (1) detectWeather, (2) set_language, (3) SystemCommand, or (4) NTPSyncWithHost function in management.c, or a (5) SET COUNTRY, (6) SET WLAN SSID, (7) SET WLAN CHANNEL, (8) SET WLAN STATUS, or (9) SET WLAN COUNTRY udps command.
[VU#939260]
Amtelco miSecureMessages allows remote attackers to read the messages of arbitrary users via an XML request containing a valid license key and a modified contactID value, as demonstrated by a request from the iOS or Android application.
[http://ics-cert.us-cert.gov/advisories/ICSA-14-121-01]
[VU#251628]
[https://service.amtelco.com/INFINITY/MSM/MSM6.2SecurityBriefing.pdf]
Multiple directory traversal vulnerabilities in Xangati XSR before 11 and XNR before 7 allow remote attackers to read arbitrary files via a .. (dot dot) in (1) the file parameter in a getUpgradeStatus action to servlet/MGConfigData, (2) the download parameter in a download action to servlet/MGConfigData, (3) the download parameter in a port_svc action to servlet/MGConfigData, (4) the file parameter in a getfile action to servlet/Installer, or (5) the binfile parameter to servlet/MGConfigData.
[VU#657622]
Xangati XSR before 11 and XNR before 7 allows remote attackers to execute arbitrary commands via shell metacharacters in a gui_input_test.pl params parameter to servlet/Installer.
[VU#657622]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-2741. Reason: This candidate is a duplicate of CVE-2014-2741. Notes: All CVE users should reference CVE-2014-2741 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
The default configuration of IBM 4690 OS, as used in Toshiba Global Commerce Solutions 4690 POS and other products, hashes passwords with the ADXCRYPT algorithm, which makes it easier for context-dependent attackers to obtain sensitive information via unspecified cryptanalysis of an ADXCSOUF.DAT file.
[VU#622950]
[http://www-01.ibm.com/support/docview.wss?uid=pos1R1005054]
Cross-site scripting (XSS) vulnerability on Google Search Appliance (GSA) devices before 7.0.14.G.216 and 7.2 before 7.2.0.G.114, when dynamic navigation is configured, allows remote attackers to inject arbitrary web script or HTML via input included in a SCRIPT element.
[VU#673313]
[67176]
The ServerTrustManager component in the Ignite Realtime Smack XMPP API before 4.0.0-rc1 does not verify basicConstraints and nameConstraints in X.509 certificate chains from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate chain.
Per: http://cwe.mitre.org/data/definitions/358.html
"CWE-358: Improperly Implemented Security Check for Standard"
[http://community.igniterealtime.org/blogs/ignite/2014/04/17/asmack-400-rc1-has-been-released]
[http://issues.igniterealtime.org/browse/SMACK-410]
[RHSA-2015:1176]
[59290]
[59291]
[VU#489228]
[67119]
The ParseRoster component in the Ignite Realtime Smack XMPP API before 4.0.0-rc1 does not verify the from attribute of a roster-query IQ stanza, which allows remote attackers to spoof IQ responses via a crafted attribute.
Per: http://cwe.mitre.org/data/definitions/345.html
"CWE-345: Insufficient Verification of Data Authenticity"
[http://community.igniterealtime.org/blogs/ignite/2014/04/17/asmack-400-rc1-has-been-released]
[RHSA-2015:1176]
[59290]
[59291]
[VU#489228]
[67124]
Unspecified vulnerability in the Oracle Applications Framework component in Oracle E-Business Suite 11.5.10.2, 12.0.6, 12.1.3, and 12.2.2 allows remote authenticated users to affect confidentiality via unknown vectors related to Attachments.
[http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html]
[64758]
[64828]
[1029619]
Unspecified vulnerability in the Hyperion Essbase Administration Services component in Oracle Hyperion 11.1.2.1, 11.1.2.2, and 11.1.2.3 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Admin Console.
[http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html]
[64758]
[64814]
Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45, and Java SE Embedded 7u45, allows remote attackers to affect confidentiality via unknown vectors related to Networking. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that the issue is related to incorrect permission checks when listening on a socket, which allows attackers to escape the sandbox.
Per: http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html
"Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets."
[http://hg.openjdk.java.net/jdk7u/jdk7u/jdk/rev/e6160aedadd5]
[SUSE-SU-2014:0246]
[SUSE-SU-2014:0266]
[SUSE-SU-2014:0451]
[openSUSE-SU-2014:0174]
[openSUSE-SU-2014:0177]
[openSUSE-SU-2014:0180]
[SSRT101454]
[SSRT101455]
[RHSA-2014:0026]
[RHSA-2014:0027]
[RHSA-2014:0030]
[RHSA-2014:0097]
[RHSA-2014:0134]
[RHSA-2014:0135]
[RHSA-2014:0136]
[59235]
[59339]
[http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html]
[64758]
[64930]
[1029608]
[USN-2089-1]
[USN-2124-1]
[http://www-01.ibm.com/support/docview.wss?uid=swg21676978]
[RHSA-2014:0414]
[https://bugzilla.redhat.com/show_bug.cgi?id=1052919]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04166777]
Unspecified vulnerability in the Siebel Core - EAI component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect confidentiality via unknown vectors related to Java Integration, a different vulnerability than CVE-2015-0366.
[http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html]
[64758]
[64832]
[1029622]
Unspecified vulnerability in the Siebel Life Sciences component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect availability via unknown vectors related to Clinical Trip Report.
[http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html]
[64758]
[64837]
[1029622]
Unspecified vulnerability in the Oracle Demantra Demand Management component in Oracle Supply Chain Products Suite 7.2.0.3 SQL-Server, 7.3.0.x, 7.3.1.x, 12.2.0, 12.2.1, and 12.2.2 allows remote authenticated users to affect integrity via unknown vectors related to DM Others.
[http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html]
[64758]
[64886]
[1029620]
Unspecified vulnerability in the Oracle Demantra Demand Management component in Oracle Supply Chain Products Suite 7.2.0.3 SQL-Server, 7.3.0, 7.3.1, 12.2.1, and 12.2.2 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to DM Others.
[31993]
[http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html]
[20140228 CVE-2014-0372 - SQL Injection in Oracle Demantra]
[64758]
[64826]
[1029620]
Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Serviceability. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that the issue is related to throwing of an incorrect exception when SnmpStatusException should have been used in the SNMP implementation, which allows attackers to escape the sandbox.
per http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html
Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets
[http://hg.openjdk.java.net/jdk7u/jdk7u/jdk/rev/496c51673dec]
[SUSE-SU-2014:0246]
[SUSE-SU-2014:0266]
[SUSE-SU-2014:0451]
[openSUSE-SU-2014:0174]
[openSUSE-SU-2014:0177]
[openSUSE-SU-2014:0180]
[SSRT101454]
[SSRT101455]
[RHSA-2014:0026]
[RHSA-2014:0027]
[RHSA-2014:0030]
[RHSA-2014:0097]
[RHSA-2014:0134]
[RHSA-2014:0135]
[RHSA-2014:0136]
[http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html]
[64758]
[64922]
[1029608]
[USN-2089-1]
[USN-2124-1]
[RHSA-2014:0414]
[https://bugzilla.redhat.com/show_bug.cgi?id=1051699]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04166777]
Unspecified vulnerability in the Oracle Portal component in Oracle Fusion Middleware 11.1.1.6 allows remote attackers to affect integrity via unknown vectors related to Page Parameters and Events.
[http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html]
[64758]
[64830]
[1029613]
Unspecified vulnerability in Oracle Java SE 6u65 and 7u45 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Deployment, a different vulnerability than CVE-2013-5898 and CVE-2014-0403.
per: http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html
Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets.
[SUSE-SU-2014:0246]
[SUSE-SU-2014:0266]
[SUSE-SU-2014:0451]
[SSRT101454]
[SSRT101455]
[RHSA-2014:0030]
[RHSA-2014:0134]
[RHSA-2014:0135]
[http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html]
[64758]
[64916]
[1029608]
[RHSA-2014:0414]
[oracle-cpujan2014-cve20140375(90339)]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04166777]
Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; Java SE Embedded 7u45; and OpenJDK 7 allows remote attackers to affect integrity via vectors related to JAXP. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that the issue is related to an improper check for "code permissions when creating document builder factories."
per: http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html
Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets.
[http://hg.openjdk.java.net/jdk7u/jdk7u/jaxp/rev/42be8e6266ab]
[http://hg.openjdk.java.net/jdk7u/jdk7u/jaxp/rev/783ceae9b736]
[SUSE-SU-2014:0246]
[SUSE-SU-2014:0266]
[SUSE-SU-2014:0451]
[openSUSE-SU-2014:0174]
[openSUSE-SU-2014:0177]
[openSUSE-SU-2014:0180]
[SSRT101454]
[SSRT101455]
[RHSA-2014:0026]
[RHSA-2014:0027]
[RHSA-2014:0030]
[RHSA-2014:0097]
[RHSA-2014:0134]
[RHSA-2014:0135]
[RHSA-2014:0136]
[http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html]
[64758]
[64907]
[1029608]
[USN-2089-1]
[USN-2124-1]
[RHSA-2014:0414]
[https://bugzilla.redhat.com/show_bug.cgi?id=1051923]
[oracle-cpujan2014-cve20140376(90350)]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04166777]
Unspecified vulnerability in the Core RDBMS component in Oracle Database Server 11.1.0.7, 11.2.0.3, 11.2.0.4, and 12.1.0.1 allows remote authenticated users to affect confidentiality via vectors related to SYS tables.
[SUSE-SU-2014:0130]
[http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html]
[64758]
[64824]
[1029607]
Unspecified vulnerability in the Spatial component in Oracle Database Server 11.1.0.7, 11.2.0.3, 11.2.0.4, and 12.1.0.1 allows local users to affect confidentiality, integrity, and availability via unknown vectors.
[SUSE-SU-2014:0130]
[http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html]
[64758]
[64812]
[1029607]
Unspecified vulnerability in the Oracle Demantra Demand Management component in Oracle Supply Chain Products Suite 7.2.0.3 SQL-Server, 7.3.0.x, 7.3.1.x, 12.2.0, 12.2.1, and 12.2.2 allows remote attackers to affect integrity via unknown vectors related to DM Others.
[31994]
[http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html]
[64758]
[64857]
[1029620]
Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.52 and 8.53 allows remote attackers to affect integrity via vectors related to MultiChannel Framework (MCF).
[http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html]
[64758]
[64865]
[1029623]
Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.52 and 8.53 allows remote attackers to affect integrity via vectors related to PIA Core Technology, a different vulnerability than CVE-2014-0445.
[http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html]
[64758]
[64892]
[1029623]
Unspecified vulnerability in Oracle Java SE 7u45 and JavaFX 2.2.45 allows remote attackers to affect availability via unknown vectors related to JavaFX.
Per: http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html
"Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets."
[SSRT101454]
[RHSA-2014:0030]
[http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html]
[64758]
[64936]
[1029608]
[oracle-cpujan2014-cve20140382(90355)]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04166777]
Unspecified vulnerability in the Oracle Identity Manager component in Oracle Fusion Middleware 11.1.2.0 and 11.1.2.1 allows remote authenticated users to affect confidentiality via unknown vectors related to Identity Console.
[http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html]
[64758]
[64842]
[1029613]
Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.35 and earlier and 5.6.15 and earlier allows remote authenticated users to affect availability via vectors related to XML.
[RHSA-2014:0522]
[RHSA-2014:0536]
[RHSA-2014:0537]
[RHSA-2014:0702]
[GLSA-201409-04]
[http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html]
Unspecified vulnerability in Oracle Java SE 7u45, when installing on OS X, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Install.
per:
http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html
Applies to installation process on client deployment of Java.
[http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html]
[64758]
[64901]
[1029608]
Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.71 and earlier, 5.5.33 and earlier, and 5.6.13 and earlier allows remote authenticated users to affect availability via unknown vectors related to Optimizer.
[RHSA-2014:0164]
[RHSA-2014:0173]
[RHSA-2014:0186]
[RHSA-2014:0189]
[GLSA-201409-04]
[USN-2086-1]
[DSA-2845]
[DSA-2848]
[http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html]
[64758]
[64904]
[oracle-cpujan2014-cve20140386(90380)]
Unspecified vulnerability in Oracle Java SE 6u65 and Java SE 7u45, when running on Firefox, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment.
Per: http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html
"Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets."
[SUSE-SU-2014:0246]
[SUSE-SU-2014:0266]
[SUSE-SU-2014:0451]
[SSRT101454]
[SSRT101455]
[RHSA-2014:0030]
[RHSA-2014:0134]
[RHSA-2014:0135]
[http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html]
[64758]
[64882]
[1029608]
[RHSA-2014:0414]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04166777]
Unspecified vulnerability in the PeopleSoft Enterprise HRMS Human Resources component in Oracle PeopleSoft Products 9.1 and 9.2 allows remote authenticated users to affect confidentiality via unknown vectors related to Org and Workforce Dev.
[http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html]
[64758]
[64878]
[1029623]
Unspecified vulnerability in Oracle iLearning 6.0 allows remote attackers to affect integrity via unknown vectors related to Learner Pages.
[http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html]
[64758]
[64845]
[1029621]
Unspecified vulnerability in Oracle Solaris 10 allows remote attackers to affect integrity via unknown vectors related to Java Web Console.
[http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html]
[64758]
[64859]
[oracle-cpujan2014-cve20140390(90362)]
Unspecified vulnerability in the Oracle Identity Manager component in Oracle Fusion Middleware 11.1.1.5, 11.1.1.7, 11.1.2.0, and 11.1.2.1 allows remote attackers to affect confidentiality via unknown vectors related to End User Self Service.
[http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html]
[64758]
[64829]
[1029613]
Unspecified vulnerability in the PeopleSoft Enterprise HRMS component in Oracle PeopleSoft Products 9.1 and 9.2 allows remote authenticated users to affect confidentiality via unknown vectors related to Security.
[http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html]
[64758]
[64874]
[1029623]
Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.71 and earlier, 5.5.33 and earlier, and 5.6.13 and earlier allows remote authenticated users to affect integrity via unknown vectors related to InnoDB.
[RHSA-2014:0164]
[RHSA-2014:0173]
[RHSA-2014:0186]
[RHSA-2014:0189]
[GLSA-201409-04]
[USN-2086-1]
[DSA-2845]
[DSA-2848]
[http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html]
[64758]
[64877]
[oracle-cpujan2014-cve20140393(90386)]
Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.52 and 8.53 allows remote attackers to affect confidentiality via unknown vectors related to Updates Environment Mgmt, a different vulnerability than CVE-2014-0395.
[http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html]
[64758]
[64848]
[1029623]
Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.52 and 8.53 allows remote attackers to affect confidentiality via unknown vectors related to Updates Environment Mgmt, a different vulnerability than CVE-2014-0394.
[http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html]
[64758]
[64852]
[1029623]
Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.52 and 8.53 allows remote attackers to affect confidentiality via unknown vectors related to Portal - Web Services.
[http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html]
[64758]
[64841]
[1029623]
Multiple unspecified vulnerabilities in libXtsol in Oracle Solaris 10 and 11.1 have unspecified impact and attack vectors related to "Buffer errors."
[65819]
[https://blogs.oracle.com/sunsecurity/entry/cve_2014_0397_buffer_errors]
[libxtsol-cve20140397-bo(91482)]
Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 11.5.10.2, 12.0.6, 12.1.3, and 12.2.2 allows remote attackers to affect confidentiality via unknown vectors related to Discoverer.
[http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html]
[64758]
[64818]
[1029619]
Unspecified vulnerability in the Oracle Transportation Management component in Oracle Supply Chain Products Suite 6.2, 6.3, 6.3.1, and 6.3.2 allows remote authenticated users to affect confidentiality via unknown vectors related to Data, Domain & Function Security.
[http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html]
[64758]
[64861]
[1029620]
Unspecified vulnerability in the Oracle Internet Directory component in Oracle Fusion Middleware 11.1.1.6 and 11.1.1.7 allows remote authenticated users to affect confidentiality via vectors related to OID LDAP server.
[http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html]
[64758]
[64822]
[1029618]
Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.72 and earlier, 5.5.34 and earlier, and 5.6.14 and earlier allows remote authenticated users to affect availability via unknown vectors.
[RHSA-2014:0164]
[RHSA-2014:0173]
[RHSA-2014:0186]
[RHSA-2014:0189]
[GLSA-201409-04]
[USN-2086-1]
[DSA-2845]
[DSA-2848]
[http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html]
[64758]
[64898]
[oracle-cpujan2014-cve20140401(90382)]
Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.71 and earlier, 5.5.33 and earlier, and 5.6.13 and earlier allows remote authenticated users to affect availability via unknown vectors related to Locking.
[RHSA-2014:0164]
[RHSA-2014:0173]
[RHSA-2014:0186]
[RHSA-2014:0189]
[GLSA-201409-04]
[USN-2086-1]
[DSA-2845]
[DSA-2848]
[http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html]
[64758]
[64908]
[oracle-cpujan2014-cve20140402(90379)]
Unspecified vulnerability in Oracle Java SE 6u65 and 7u45 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Deployment, a different vulnerability than CVE-2013-5898 and CVE-2014-0375.
Per: http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html
"Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets."
[SUSE-SU-2014:0246]
[SUSE-SU-2014:0266]
[SUSE-SU-2014:0451]
[SSRT101454]
[SSRT101455]
[RHSA-2014:0030]
[RHSA-2014:0134]
[RHSA-2014:0135]
[http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html]
[64758]
[64920]
[1029608]
[RHSA-2014:0414]
[oracle-cpujan2014-cve20140403(90338)]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04166777]
Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 3.2.20, 4.0.22, 4.1.30, 4.2.20, and 4.3.4 allows local users to affect integrity and availability via unknown vectors related to Core, a different vulnerability than CVE-2014-0406.
[DSA-2878]
[http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html]
[64758]
[64911]
[1029610]
[oracle-cpujan2014-cve20140404(90372)]
Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 3.2.20, 4.0.22, 4.1.30, 4.2.20, and 4.3.4 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Core, a different vulnerability than CVE-2014-0407.
[http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html]
[64758]
[64900]
[1029610]
[oracle-cpujan2014-cve20140405(90370)]
Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 3.2.20, 4.0.22, 4.1.30, 4.2.20, and 4.3.4 allows local users to affect integrity and availability via unknown vectors related to Core, a different vulnerability than CVE-2014-0404.
[DSA-2878]
[http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html]
[64758]
[64905]
[1029610]
[oracle-cpujan2014-cve20140406(90371)]
Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 3.2.20, 4.0.22, 4.1.30, 4.2.20, and 4.3.4 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Core, a different vulnerability than CVE-2014-0405.
[DSA-2878]
[http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html]
[64758]
[64913]
[1029610]
[oracle-cpujan2014-cve20140407(90369)]
Unspecified vulnerability in Oracle Java SE 7u45, when running on OS X, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot.
Per: http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html
"Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets."
[openSUSE-SU-2014:0174]
[openSUSE-SU-2014:0177]
[openSUSE-SU-2014:0180]
[http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html]
[64758]
[64910]
[1029608]
[USN-2089-1]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2014. Notes: none.
Unspecified vulnerability in Oracle Java SE 6u65 and 7u45 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2013-5889, CVE-2013-5902, CVE-2014-0415, CVE-2014-0418, and CVE-2014-0424.
[SUSE-SU-2014:0246]
[SUSE-SU-2014:0266]
[SUSE-SU-2014:0451]
[SSRT101454]
[SSRT101455]
[RHSA-2014:0030]
[RHSA-2014:0134]
[RHSA-2014:0135]
[http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html]
[64758]
[64915]
[1029608]
[RHSA-2014:0414]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04166777]
Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; JRockit R27.7.7 and R28.2.9; Java SE Embedded 7u45; and OpenJDK 7 allows remote attackers to affect confidentiality and integrity via vectors related to JSSE. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that this issue allows remote attackers to obtain sensitive information about encryption keys via a timing discrepancy during the TLS/SSL handshake.
[http://hg.openjdk.java.net/jdk7u/jdk7u/jdk/rev/d533e96c7acc]
[SUSE-SU-2014:0246]
[SUSE-SU-2014:0266]
[SUSE-SU-2014:0451]
[openSUSE-SU-2014:0174]
[openSUSE-SU-2014:0177]
[openSUSE-SU-2014:0180]
[SSRT101454]
[SSRT101455]
[RHSA-2014:0026]
[RHSA-2014:0027]
[RHSA-2014:0030]
[RHSA-2014:0097]
[RHSA-2014:0134]
[RHSA-2014:0135]
[RHSA-2014:0136]
[59194]
[59235]
[59283]
[59324]
[59339]
[59705]
[60833]
[60835]
[60836]
[http://www.ibm.com/support/docview.wss?uid=ssg1S1004745]
[http://www.ibm.com/support/docview.wss?uid=swg21672078]
[http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html]
[64758]
[64918]
[1029608]
[USN-2089-1]
[USN-2124-1]
[http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004656]
[http://www-01.ibm.com/support/docview.wss?uid=swg21669519]
[http://www-01.ibm.com/support/docview.wss?uid=swg21675938]
[http://www-01.ibm.com/support/docview.wss?uid=swg21676190]
[http://www-01.ibm.com/support/docview.wss?uid=swg21676373]
[http://www-01.ibm.com/support/docview.wss?uid=swg21676978]
[http://www-01.ibm.com/support/docview.wss?uid=swg21677388]
[http://www-01.ibm.com/support/docview.wss?uid=swg21680234]
[http://www-01.ibm.com/support/docview.wss?uid=swg21680387]
[http://www-01.ibm.com/support/docview.wss?uid=swg21682668]
[http://www-01.ibm.com/support/docview.wss?uid=swg21682669]
[http://www-01.ibm.com/support/docview.wss?uid=swg21682670]
[http://www-01.ibm.com/support/docview.wss?uid=swg21682671]
[http://www-01.ibm.com/support/docview.wss?uid=swg21682904]
[http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5096132]
[RHSA-2014:0414]
[https://bugzilla.redhat.com/show_bug.cgi?id=1053010]
[oracle-cpujan2014-cve20140411(90357)]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04166777]
[https://www.ibm.com/support/docview.wss?uid=swg21675223]
[https://www.ibm.com/support/docview.wss?uid=swg21677913]
Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.72 and earlier, 5.5.34 and earlier, and 5.6.14 and earlier allows remote authenticated users to affect availability via unknown vectors related to InnoDB.
[RHSA-2014:0164]
[RHSA-2014:0173]
[RHSA-2014:0186]
[RHSA-2014:0189]
[GLSA-201409-04]
[USN-2086-1]
[DSA-2845]
[DSA-2848]
[http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html]
[64758]
[64880]
[oracle-cpujan2014-cve20140412(90378)]
Unspecified vulnerability in the Oracle Containers for J2EE component in Oracle Fusion Middleware 10.1.3.5 allows remote attackers to affect integrity via vectors related to HTTP Request Handling, a different vulnerability than CVE-2014-0426.
[http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html]
Unspecified vulnerability in the Oracle Containers for J2EE component in Oracle Fusion Middleware 10.1.3.5 allows remote attackers to affect confidentiality via vectors related to HTTP Request Handling.
[http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html]
Unspecified vulnerability in Oracle Java SE 6u65 and 7u45 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2013-5889, CVE-2013-5902, CVE-2014-0410, CVE-2014-0418, and CVE-2014-0424.
[SUSE-SU-2014:0246]
[SUSE-SU-2014:0266]
[SUSE-SU-2014:0451]
[SSRT101454]
[SSRT101455]
[RHSA-2014:0030]
[RHSA-2014:0134]
[RHSA-2014:0135]
[http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html]
[64758]
[64899]
[1029608]
[RHSA-2014:0414]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04166777]
Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; Java SE Embedded 7u45; and OpenJDK 7 allows remote attackers to affect integrity via vectors related to JAAS. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that the issue is related to how principals are set for the Subject class, which allows attackers to escape the sandbox using deserialization of a crafted Subject instance.
[http://hg.openjdk.java.net/jdk7u/jdk7u/jdk/rev/abe1cb2d27cb]
[SUSE-SU-2014:0246]
[SUSE-SU-2014:0266]
[SUSE-SU-2014:0451]
[openSUSE-SU-2014:0174]
[openSUSE-SU-2014:0177]
[openSUSE-SU-2014:0180]
[SSRT101454]
[SSRT101455]
[RHSA-2014:0026]
[RHSA-2014:0027]
[RHSA-2014:0030]
[RHSA-2014:0097]
[RHSA-2014:0134]
[RHSA-2014:0135]
[RHSA-2014:0136]
[59235]
[59283]
[59307]
[59339]
[60568]
[http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html]
[64758]
[64937]
[1029608]
[USN-2089-1]
[USN-2124-1]
[http://www-01.ibm.com/support/docview.wss?uid=swg21676978]
[http://www-01.ibm.com/support/docview.wss?uid=swg21677294]
[http://www-01.ibm.com/support/docview.wss?uid=swg21677388]
[http://www-01.ibm.com/support/docview.wss?uid=swg21679287]
[RHSA-2014:0414]
[https://bugzilla.redhat.com/show_bug.cgi?id=1051912]
[oracle-cpujan2014-cve20140416(90349)]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04166777]
Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; JavaFX 2.2.45; and Java SE Embedded 7u45 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.
[SUSE-SU-2014:0246]
[SUSE-SU-2014:0266]
[SUSE-SU-2014:0451]
[SSRT101454]
[SSRT101455]
[RHSA-2014:0030]
[RHSA-2014:0134]
[RHSA-2014:0135]
[RHSA-2014:0136]
[http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html]
[64758]
[64932]
[1029608]
[RHSA-2014:0414]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04166777]
Unspecified vulnerability in Oracle Java SE 6u65 and 7u45 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2013-5889, CVE-2013-5902, CVE-2014-0410, CVE-2014-0415, and CVE-2014-0424.
[SSRT101454]
[SSRT101455]
[RHSA-2014:0030]
[http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html]
[64758]
[64917]
[1029608]
[RHSA-2014:0414]
[oracle-cpujan2014-cve20140418(90344)]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04166777]
Unspecified vulnerability in the Oracle Secure Global Desktop (SGD) component in Oracle Virtualization SGD before 4.63 with December 2013 PSU, 4.71, 5.0 with December 2013 PSU, and 5.10 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Administration Console and Workspace Web Applications.
[http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html]
[64758]
[64902]
[1029610]
[oracle-cpujan2014-cve20140419(90367)]
Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.34 and earlier, and 5.6.14 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Replication.
[102077]
[RHSA-2014:0173]
[RHSA-2014:0186]
[RHSA-2014:0189]
[GLSA-201409-04]
[USN-2086-1]
[DSA-2848]
[http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html]
[http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html]
[64758]
[64888]
[oracle-cpujan2014-cve20140420(90388)]
Unspecified vulnerability in Oracle Solaris 10, when running on the SPARC64-X Platform, allows local users to affect confidentiality, integrity, and availability via unknown vectors.
[http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html]
Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; Java SE Embedded 7u45; and OpenJDK 7 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JNDI. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that the issue is related to missing package access checks in the Naming / JNDI component, which allows attackers to escape the sandbox.
[SUSE-SU-2014:0246]
[SUSE-SU-2014:0266]
[SUSE-SU-2014:0451]
[openSUSE-SU-2014:0174]
[openSUSE-SU-2014:0177]
[openSUSE-SU-2014:0180]
[SSRT101454]
[SSRT101455]
[RHSA-2014:0026]
[RHSA-2014:0027]
[RHSA-2014:0030]
[RHSA-2014:0097]
[RHSA-2014:0134]
[RHSA-2014:0135]
[RHSA-2014:0136]
[http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html]
[64758]
[64921]
[1029608]
[USN-2089-1]
[USN-2124-1]
[RHSA-2014:0414]
[https://bugzilla.redhat.com/show_bug.cgi?id=1051528]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04166777]
Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; JRockit R27.7.7 and R28.2.9; Java SE Embedded 7u45; and OpenJDK 7 allows remote authenticated users to affect confidentiality and availability via unknown vectors related to Beans. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that this issue is an XML External Entity (XXE) vulnerability in DocumentHandler.java, related to Beans decoding.
Per: http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html
"Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service."
[http://hg.openjdk.java.net/jdk7u/jdk7u/jdk/rev/995b32f013f5]
[SUSE-SU-2014:0246]
[SUSE-SU-2014:0266]
[SUSE-SU-2014:0451]
[openSUSE-SU-2014:0174]
[openSUSE-SU-2014:0177]
[openSUSE-SU-2014:0180]
[SSRT101454]
[SSRT101455]
[RHSA-2014:0026]
[RHSA-2014:0027]
[RHSA-2014:0030]
[RHSA-2014:0097]
[RHSA-2014:0134]
[RHSA-2014:0135]
[RHSA-2014:0136]
[59283]
[60568]
[http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html]
[64758]
[64914]
[1029608]
[USN-2089-1]
[USN-2124-1]
[http://www-01.ibm.com/support/docview.wss?uid=swg21677388]
[http://www-01.ibm.com/support/docview.wss?uid=swg21679287]
[RHSA-2014:0414]
[https://bugzilla.redhat.com/show_bug.cgi?id=1053066]
[oracle-cpujan2014-cve20140423(90340)]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04166777]
Unspecified vulnerability in Oracle Java SE 6u65 and 7u45 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2013-5889, CVE-2013-5902, CVE-2014-0410, CVE-2014-0415, and CVE-2014-0418.
Per: http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html
"Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets."
[SUSE-SU-2014:0246]
[SUSE-SU-2014:0266]
[SUSE-SU-2014:0451]
[SSRT101454]
[SSRT101455]
[RHSA-2014:0030]
[RHSA-2014:0134]
[RHSA-2014:0135]
[http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html]
[64758]
[64919]
[1029608]
[RHSA-2014:0414]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04166777]
Unspecified vulnerability in the PeopleSoft Enterprise SCM Services Procurement component in Oracle PeopleSoft Products 9.2 allows remote authenticated users to affect confidentiality via unknown vectors related to Security.
[http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html]
[64758]
[64889]
[1029623]
Unspecified vulnerability in the Oracle Containers for J2EE component in Oracle Fusion Middleware 10.1.3.5 allows remote attackers to affect integrity via vectors related to HTTP Request Handling, a different vulnerability than CVE-2014-0413.
[http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html]
Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.6.13 and earlier allows remote authenticated users to affect availability via vectors related to FTS.
[GLSA-201409-04]
[http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html]
[64758]
[64868]
[oracle-cpujan2014-cve20140427(90383)]
Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; Java SE Embedded 7u45; and OpenJDK 7 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to CORBA. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that the issue is related to "insufficient security checks in IIOP streams," which allows attackers to escape the sandbox.
Per: http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html
"Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets."
[http://hg.openjdk.java.net/jdk7u/jdk7u/corba/rev/0a879f00b698]
[SUSE-SU-2014:0246]
[SUSE-SU-2014:0266]
[SUSE-SU-2014:0451]
[openSUSE-SU-2014:0174]
[openSUSE-SU-2014:0177]
[openSUSE-SU-2014:0180]
[SSRT101454]
[SSRT101455]
[RHSA-2014:0026]
[RHSA-2014:0027]
[RHSA-2014:0030]
[RHSA-2014:0097]
[RHSA-2014:0134]
[RHSA-2014:0135]
[RHSA-2014:0136]
[http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html]
[64758]
[64935]
[1029608]
[USN-2089-1]
[USN-2124-1]
[RHSA-2014:0414]
[https://bugzilla.redhat.com/show_bug.cgi?id=1051519]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04166777]
Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JRockit R27.8.1 and R28.3.1; and Java SE Embedded 7u51 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.
Per: http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html
"Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service."
[http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10698]
[SSRT101668]
[RHSA-2014:0675]
[RHSA-2014:0685]
[GLSA-201406-32]
[GLSA-201502-12]
[DSA-2912]
[http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html]
[66856]
[USN-2187-1]
[USN-2191-1]
[http://www-01.ibm.com/support/docview.wss?uid=swg21672080]
[http://www-01.ibm.com/support/docview.wss?uid=swg21676746]
[RHSA-2014:0413]
[RHSA-2014:0414]
[https://www.ibm.com/support/docview.wss?uid=swg21675973]
Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.6.13 and earlier allows remote authenticated users to affect availability via unknown vectors related to Performance Schema.
[GLSA-201409-04]
[http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html]
[64758]
[64893]
[oracle-cpujan2014-cve20140430(90387)]
Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.6.14 and earlier allows remote authenticated users to affect availability via unknown vectors related to InnoDB, a different vulnerability than CVE-2013-5881.
[GLSA-201409-04]
[http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html]
[64758]
[64897]
[oracle-cpujan2014-cve20140431(90384)]
Unspecified vulnerability in Oracle Java SE 7u51 and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2014-0455 and CVE-2014-2402.
[SSRT101667]
[GLSA-201502-12]
[http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html]
[66897]
[RHSA-2014:0413]
Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.6.13 and earlier allows remote attackers to affect availability via unknown vectors related to Thread Pooling.
[GLSA-201409-04]
[http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html]
[64758]
[64895]
[oracle-cpujan2014-cve20140433(90375)]
Unspecified vulnerability in the Oracle Agile Product Lifecycle Management for Process component in Oracle Supply Chain Products Suite 6.0, 6.1, and 6.1.1 allows remote attackers to affect integrity via unknown vectors related to Installation.
[http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html]
[64758]
[64851]
[1029620]
Unspecified vulnerability in the Oracle Transportation Management component in Oracle Supply Chain Products Suite 6.1, 6.2, 6.3, 6.3.1, and 6.3.2 allows remote authenticated users to affect availability via unknown vectors related to Data, Domain & Function Security.
[http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html]
[64758]
[64869]
[1029620]
Unspecified vulnerability in the Hyperion BI+ component in Oracle Hyperion 11.1.2.2 and 11.1.2.3 allows remote attackers to affect integrity via unknown vectors related to Web Analysis.
[20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities]
[http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html]
[20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities]
[68595]
[1030579]
[http://www.vmware.com/security/advisories/VMSA-2014-0012.html]
Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.72 and earlier, 5.5.34 and earlier, and 5.6.14 and earlier allows remote authenticated users to affect availability via unknown vectors related to Optimizer.
[RHSA-2014:0164]
[RHSA-2014:0173]
[RHSA-2014:0186]
[RHSA-2014:0189]
[GLSA-201409-04]
[USN-2086-1]
[DSA-2845]
[DSA-2848]
[http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html]
[64758]
[64849]
[oracle-cpujan2014-cve20140437(90385)]
Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.52 and 8.53 allows remote authenticated users to affect confidentiality via unknown vectors related to Panel Processor.
[http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html]
[64758]
[64887]
[1029623]
Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.52 and 8.53 allows remote authenticated users to affect integrity via unknown vectors related to Report Distribution.
[http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html]
[64758]
[64884]
[1029623]
Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.52 and 8.53 allows remote authenticated users to affect availability via vectors related to PIA Core Technology.
[http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html]
[64758]
[64881]
[1029623]
Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.52 and 8.53 allows remote attackers to affect availability via unknown vectors related to Integration Broker.
[http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html]
[64758]
[64839]
[1029623]
Unspecified vulnerability in Oracle Solaris 9, 10, and 11.1 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Print Filter Utility.
[http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html]
Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.52 allows remote attackers to affect integrity via unknown vectors related to Security.
[http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html]
[64758]
[64844]
[1029623]
Unspecified vulnerability in the Oracle AutoVue Electro-Mechanical Professional component in Oracle Supply Chain Products Suite 20.1.1 allows remote authenticated users to affect confidentiality via unknown vectors related to Web General, a different vulnerability than CVE-2013-5868 and CVE-2013-5871.
[http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html]
[64758]
[64883]
[1029620]
Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.52 and 8.53 allows remote attackers to affect integrity via vectors related to PIA Core Technology, a different vulnerability than CVE-2014-0381.
[http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html]
[64758]
[64867]
[1029623]
Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries.
[SSRT101667]
[SSRT101668]
[RHSA-2014:0675]
[RHSA-2014:0685]
[GLSA-201406-32]
[GLSA-201502-12]
[DSA-2912]
[http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html]
[66903]
[USN-2187-1]
[USN-2191-1]
[http://www-01.ibm.com/support/docview.wss?uid=swg21672080]
[http://www-01.ibm.com/support/docview.wss?uid=swg21676746]
[RHSA-2014:0413]
[RHSA-2014:0414]
Unspecified vulnerability in Oracle Solaris 10 and 11.1 allows local users to affect availability via unknown vectors related to Kernel, a different vulnerability than CVE-2013-5876.
[http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html]
Unspecified vulnerability in Oracle Java SE 7u51 and 8 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment.
[SSRT101667]
[GLSA-201502-12]
[http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html]
[66904]
[http://www-01.ibm.com/support/docview.wss?uid=swg21672080]
[RHSA-2014:0413]
Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality via unknown vectors related to Deployment.
Per: http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html
"Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets."
[SSRT101667]
[SSRT101668]
[GLSA-201502-12]
[http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html]
[66907]
[http://www-01.ibm.com/support/docview.wss?uid=swg21672080]
[RHSA-2014:0413]
[RHSA-2014:0414]
Unspecified vulnerability in the Oracle WebCenter Portal component in Oracle Fusion Middleware 11.1.1.7 and 11.1.1.8 allows remote attackers to affect confidentiality via unknown vectors related to People Connection.
[http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html]
Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT, a different vulnerability than CVE-2014-2412.
Per: http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html
"Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets."
[SSRT101667]
[SSRT101668]
[RHSA-2014:0675]
[RHSA-2014:0685]
[GLSA-201406-32]
[GLSA-201502-12]
[DSA-2912]
[http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html]
[66879]
[USN-2187-1]
[USN-2191-1]
[http://www-01.ibm.com/support/docview.wss?uid=swg21672080]
[RHSA-2014:0413]
[RHSA-2014:0414]
Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JAX-WS, a different vulnerability than CVE-2014-0458 and CVE-2014-2423.
[SSRT101667]
[SSRT101668]
[RHSA-2014:0675]
[RHSA-2014:0685]
[GLSA-201406-32]
[GLSA-201502-12]
[DSA-2912]
[http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html]
[66891]
[USN-2187-1]
[USN-2191-1]
[http://www-01.ibm.com/support/docview.wss?uid=swg21672080]
[RHSA-2014:0413]
[RHSA-2014:0414]
Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JRockit R27.8.1 and R28.3.1; and Java SE Embedded 7u51 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Security.
[http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10698]
[SSRT101667]
[SSRT101668]
[RHSA-2014:0675]
[RHSA-2014:0685]
[59194]
[59307]
[59324]
[59436]
[60574]
[60580]
[61264]
[GLSA-201406-32]
[GLSA-201502-12]
[DSA-2912]
[http://www.ibm.com/support/docview.wss?uid=swg21675343]
[http://www.ibm.com/support/docview.wss?uid=swg21675588]
[http://www.ibm.com/support/docview.wss?uid=swg21677387]
[http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html]
[66914]
[USN-2187-1]
[USN-2191-1]
[http://www-01.ibm.com/support/docview.wss?uid=swg21672080]
[http://www-01.ibm.com/support/docview.wss?uid=swg21673836]
[http://www-01.ibm.com/support/docview.wss?uid=swg21674539]
[http://www-01.ibm.com/support/docview.wss?uid=swg21675945]
[http://www-01.ibm.com/support/docview.wss?uid=swg21676190]
[http://www-01.ibm.com/support/docview.wss?uid=swg21676373]
[http://www-01.ibm.com/support/docview.wss?uid=swg21676672]
[http://www-01.ibm.com/support/docview.wss?uid=swg21676703]
[http://www-01.ibm.com/support/docview.wss?uid=swg21677294]
[http://www-01.ibm.com/support/docview.wss?uid=swg21678113]
[http://www-01.ibm.com/support/docview.wss?uid=swg21679610]
[http://www-01.ibm.com/support/docview.wss?uid=swg21679713]
[http://www-01.ibm.com/support/docview.wss?uid=swg21680387]
[http://www-01.ibm.com/support/docview.wss?uid=swg21680750]
[http://www-01.ibm.com/support/docview.wss?uid=swg21681018]
[http://www-01.ibm.com/support/docview.wss?uid=swg21681047]
[http://www-01.ibm.com/support/docview.wss?uid=swg21681256]
[http://www-01.ibm.com/support/docview.wss?uid=swg21683484]
[http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5096132]
[RHSA-2014:0413]
[RHSA-2014:0414]
[https://www.ibm.com/support/docview.wss?uid=swg21674530]
Unspecified vulnerability in Oracle Java SE 7u51 and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Security.
Per: http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html
"Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets."
[SSRT101667]
[RHSA-2014:0675]
[GLSA-201502-12]
[http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html]
[66905]
[USN-2187-1]
[http://www-01.ibm.com/support/docview.wss?uid=swg21672080]
[RHSA-2014:0413]
[https://www.ibm.com/support/docview.wss?uid=swg21675973]
Unspecified vulnerability in Oracle Java SE 7u51 and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2014-0432 and CVE-2014-2402.
Per: http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html
"Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets."
[SSRT101667]
[RHSA-2014:0675]
[GLSA-201502-12]
[http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html]
[66899]
[USN-2187-1]
[http://www-01.ibm.com/support/docview.wss?uid=swg21672080]
[RHSA-2014:0413]
[https://www.ibm.com/support/docview.wss?uid=swg21675973]
Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot.
[http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10698]
[SSRT101667]
[SSRT101668]
[RHSA-2014:0675]
[RHSA-2014:0685]
[GLSA-201406-32]
[GLSA-201502-12]
[DSA-2912]
[http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html]
[66877]
[USN-2187-1]
[USN-2191-1]
[RHSA-2014:0413]
[RHSA-2014:0414]
Unspecified vulnerability in Oracle Java SE 5.0u61, SE 6u71, 7u51, and 8; JRockit R27.8.1 and R28.3.1; and Java SE Embedded 7u51 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries.
[SSRT101668]
[RHSA-2014:0675]
[RHSA-2014:0685]
[GLSA-201406-32]
[GLSA-201502-12]
[DSA-2912]
[http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html]
[66866]
[USN-2187-1]
[USN-2191-1]
[http://www-01.ibm.com/support/docview.wss?uid=swg21672080]
[http://www-01.ibm.com/support/docview.wss?uid=swg21676746]
[RHSA-2014:0413]
[RHSA-2014:0414]
[https://www.ibm.com/support/docview.wss?uid=swg21675973]
Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JAX-WS, a different vulnerability than CVE-2014-0452 and CVE-2014-2423.
per: http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html
Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets.
[SSRT101667]
[SSRT101668]
[RHSA-2014:0675]
[RHSA-2014:0685]
[GLSA-201406-32]
[GLSA-201502-12]
[DSA-2912]
[http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html]
[66883]
[USN-2187-1]
[USN-2191-1]
[http://www-01.ibm.com/support/docview.wss?uid=swg21672080]
[RHSA-2014:0413]
[RHSA-2014:0414]
Unspecified vulnerability in Oracle Java SE 7u51 and 8, and Java SE Embedded 7u51, allows remote attackers to affect availability via unknown vectors related to 2D.
Per: http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html
"Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets."
[SSRT101667]
[RHSA-2014:0675]
[GLSA-201406-32]
[GLSA-201502-12]
[DSA-2912]
[http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html]
[66910]
[USN-2187-1]
[USN-2191-1]
[http://www-01.ibm.com/support/docview.wss?uid=swg21672080]
[RHSA-2014:0413]
Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JRockit R27.8.1 and R28.3.1; and Java SE Embedded 7u51 allows remote attackers to affect confidentiality and integrity via vectors related to JNDI.
[http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10698]
[SSRT101667]
[SSRT101668]
[RHSA-2014:0675]
[RHSA-2014:0685]
[59307]
[59436]
[59516]
[59705]
[59706]
[61264]
[GLSA-201406-32]
[GLSA-201502-12]
[DSA-2912]
[http://www.ibm.com/support/docview.wss?uid=swg21675343]
[http://www.ibm.com/support/docview.wss?uid=swg21675588]
[http://www.ibm.com/support/docview.wss?uid=swg21677387]
[http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html]
[66916]
[USN-2187-1]
[USN-2191-1]
[http://www-01.ibm.com/support/docview.wss?uid=swg21672080]
[http://www-01.ibm.com/support/docview.wss?uid=swg21673836]
[http://www-01.ibm.com/support/docview.wss?uid=swg21674539]
[http://www-01.ibm.com/support/docview.wss?uid=swg21676315]
[http://www-01.ibm.com/support/docview.wss?uid=swg21676672]
[http://www-01.ibm.com/support/docview.wss?uid=swg21676746]
[http://www-01.ibm.com/support/docview.wss?uid=swg21677294]
[http://www-01.ibm.com/support/docview.wss?uid=swg21679713]
[http://www-01.ibm.com/support/docview.wss?uid=swg21681018]
[http://www-01.ibm.com/support/docview.wss?uid=swg21681256]
[http://www-01.ibm.com/support/docview.wss?uid=swg21683484]
[http://www-01.ibm.com/support/docview.wss?uid=swg21686717]
[RHSA-2014:0413]
[RHSA-2014:0414]
Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries.
Per: http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html
"Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets."
[SSRT101667]
[SSRT101668]
[RHSA-2014:0675]
[RHSA-2014:0685]
[GLSA-201406-32]
[GLSA-201502-12]
[DSA-2912]
[http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html]
[66902]
[USN-2187-1]
[USN-2191-1]
[http://www-01.ibm.com/support/docview.wss?uid=swg21672080]
[http://www-01.ibm.com/support/docview.wss?uid=swg21676746]
[RHSA-2014:0413]
[RHSA-2014:0414]
[https://www.ibm.com/support/docview.wss?uid=swg21675973]
Unspecified vulnerability in OpenJDK 6 before 6b31 on Debian GNU/Linux and Ubuntu 12.04 LTS and 10.04 LTS has unknown impact and attack vectors, a different vulnerability than CVE-2014-2405.
[DSA-2912]
[USN-2191-1]
Unspecified vulnerability in Oracle Java SE 8 allows remote attackers to affect confidentiality via unknown vectors related to Scripting, a different vulnerability than CVE-2014-0464.
Per: http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html
"Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets."
[GLSA-201502-12]
[http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html]
[66908]
Unspecified vulnerability in Oracle Java SE 8 allows remote attackers to affect confidentiality via unknown vectors related to Scripting, a different vulnerability than CVE-2014-0463.
Per: http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html
"Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets."
[GLSA-201502-12]
[http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html]
[66913]
Unspecified vulnerability in the Oracle OpenSSO component in Oracle Fusion Middleware 8.0 Update 2 Patch 5 allows remote authenticated users to affect integrity via unknown vectors related to Admin Console.
[http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html]
The fixps script in a2ps 4.14 does not use the -dSAFER option when executing gs, which allows context-dependent attackers to delete arbitrary files or execute arbitrary commands via a crafted PostScript file.
[openSUSE-SU-2014:0499]
[DSA-2892]
[66660]
[https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=742902]
[GLSA-201701-67]
Buffer overflow in copy.c in Mutt before 1.5.23 allows remote attackers to cause a denial of service (crash) via a crafted RFC2047 header line, related to address expansion.
[SUSE-SU-2014:0471]
[openSUSE-SU-2014:0434]
[openSUSE-SU-2014:0436]
[RHSA-2014:0304]
[DSA-2874]
[http://www.mutt.org/doc/devel/ChangeLog]
[66165]
[1029919]
[USN-2147-1]
Stack-based buffer overflow in a certain Debian patch for xbuffy before 3.3.bl.3.dfsg-9 allows remote attackers to execute arbitrary code via the subject of an email, possibly related to indent subject lines.
[http://packages.qa.debian.org/x/xbuffy/news/20140427T181904Z.html]
[DSA-2921]
[[oss-security] 20140428 CVE-2014-0469: xbuffy stack-based buffer overflow in subject processing]
[67090]
super.c in Super 3.30.0 does not check the return value of the setuid function when the -F flag is set, which allows local users to gain privileges via unspecified vectors, aka an RLIMIT_NPROC attack.
[DSA-2917]
[[oss-security] 20140428 super unchecked setuid (CVE-2014-0470)]
Directory traversal vulnerability in the unpacking functionality in dpkg before 1.15.9, 1.16.x before 1.16.13, and 1.17.x before 1.17.8 allows remote attackers to write arbitrary files via a crafted source package, related to "C-style filename quoting."
[DSA-2915]
[67106]
[USN-2183-1]
The django.core.urlresolvers.reverse function in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 allows remote attackers to import and execute arbitrary Python modules by leveraging a view that constructs URLs using user input and a "dotted Python path."
[openSUSE-SU-2014:1132]
[RHSA-2014:0456]
[RHSA-2014:0457]
[61281]
[DSA-2934]
[USN-2169-1]
[https://www.djangoproject.com/weblog/2014/apr/21/security/]
The caching framework in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 reuses a cached CSRF token for all anonymous users, which allows remote attackers to bypass CSRF protections by reading the CSRF cookie for anonymous users.
[openSUSE-SU-2014:1132]
[RHSA-2014:0456]
[RHSA-2014:0457]
[61281]
[DSA-2934]
[USN-2169-1]
[https://www.djangoproject.com/weblog/2014/apr/21/security/]
The (1) FilePathField, (2) GenericIPAddressField, and (3) IPAddressField model field classes in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 do not properly perform type conversion, which allows remote attackers to have unspecified impact and vectors, related to "MySQL typecasting."
[openSUSE-SU-2014:1132]
[RHSA-2014:0456]
[RHSA-2014:0457]
[61281]
[DSA-2934]
[USN-2169-1]
[https://www.djangoproject.com/weblog/2014/apr/21/security/]
Multiple directory traversal vulnerabilities in GNU C Library (aka glibc or libc6) before 2.20 allow context-dependent attackers to bypass ForceCommand restrictions and possibly have other unspecified impact via a .. (dot dot) in a (1) LC_*, (2) LANG, or other locale environment variable.
[http://linux.oracle.com/errata/ELSA-2015-0092.html]
[DSA-2976]
[MDVSA-2014:152]
[[oss-security] 20140710 CVE-2014-0475: glibc directory traversal in LC_* locale handling]
[[oss-security] 20140714 Re: CVE-2014-0475: glibc directory traversal in LC_* locale handling]
[68505]
[1030569]
[RHSA-2014:1110]
[GLSA-201602-02]
[https://sourceware.org/bugzilla/show_bug.cgi?id=17137]
The slapper function in chkrootkit before 0.50 does not properly quote file paths, which allows local users to execute arbitrary code via a Trojan horse executable. NOTE: this is only a vulnerability when /tmp is not mounted with the noexec option.
[107710]
[http://packetstormsecurity.com/files/134484/Chkrootkit-Local-Privilege-Escalation.html]
[http://www.chkrootkit.org/]
[DSA-2945]
[[oss-security] 20140604 CVE-2014-0476 chkrootkit vulnerability]
[USN-2230-1]
[GLSA-201709-05]
[38775]
The parse function in Email::Address module before 1.905 for Perl uses an inefficient regular expression, which allows remote attackers to cause a denial of service (CPU consumption) via an empty quoted string in an RFC 2822 address.
<a href="http://cwe.mitre.org/data/definitions/185.html" target="_blank">CWE-185: CWE-185: Incorrect Regular Expression</a>
[[oss-security] 20140618 CVE-2014-0477: Email::Address: Denial-of-Service in Email::Address::parse]
[DSA-2969]
[https://bugzilla.redhat.com/show_bug.cgi?id=1110723]
[https://github.com/rjbs/Email-Address/blob/master/Changes]
[https://github.com/rjbs/Email-Address/commit/83f8306117115729ac9346523762c0c396251eb5]
[https://metacpan.org/release/RJBS/Email-Address-1.905]
APT before 1.0.4 does not properly validate source packages, which allows man-in-the-middle attackers to download and install Trojan horse packages by removing the Release signature.
[DSA-2958]
[USN-2246-1]
[https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=749795]
reportbug before 6.4.4+deb7u1 and 6.5.x before 6.5.0+nmu1 allows remote attackers to execute arbitrary commands via vectors related to compare_versions and reportbug/checkversions.py.
[59896]
[DSA-2997]
[109858]
[69055]
[https://bugs.launchpad.net/ubuntu/+source/reportbug/+bug/1353046]
[reportbug-cve20140479-code-exec(95149)]
The core.urlresolvers.reverse function in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not properly validate URLs, which allows remote attackers to conduct phishing attacks via a // (slash slash) in a URL, which triggers a scheme-relative URL to be generated.
[openSUSE-SU-2014:1132]
[61276]
[61281]
[DSA-3010]
[69425]
[https://www.djangoproject.com/weblog/2014/aug/20/security/]
The default configuration for the file upload handling system in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 uses a sequential file name generation process when a file with a conflicting name is uploaded, which allows remote attackers to cause a denial of service (CPU consumption) by unloading a multiple files with the same name.
[openSUSE-SU-2014:1132]
[61276]
[61281]
[DSA-3010]
[https://www.djangoproject.com/weblog/2014/aug/20/security/]
The contrib.auth.middleware.RemoteUserMiddleware middleware in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3, when using the contrib.auth.backends.RemoteUserBackend backend, allows remote authenticated users to hijack web sessions via vectors related to the REMOTE_USER header.
[openSUSE-SU-2014:1132]
[61276]
[61281]
[DSA-3010]
[https://www.djangoproject.com/weblog/2014/aug/20/security/]
The administrative interface (contrib.admin) in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not check if a field represents a relationship between models, which allows remote authenticated users to obtain sensitive information via a to_field parameter in a popup action to an admin change form page, as demonstrated by a /admin/auth/user/?pop=1&t=password URI.
[openSUSE-SU-2014:1132]
[61276]
[61281]
[DSA-3010]
[https://github.com/django/django/commit/2b31342cdf14fc20e07c43d258f1e7334ad664a6]
[https://www.djangoproject.com/weblog/2014/aug/20/security/]
The Debian acpi-support package before 0.140-5+deb7u3 allows local users to gain privileges via vectors related to the "user's environment."
[DSA-3020]
S3QL 1.18.1 and earlier uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object in (1) common.py or (2) local.py in backends/.
[DSA-3013]
[[oss-security] 20140828 CVE-2014-0485: unsafe Python pickle in s3ql]
[https://bitbucket.org/nikratio/s3ql/commits/091ac263809b4e8]
Knot DNS before 1.5.2 allows remote attackers to cause a denial of service (application crash) via a crafted DNS message.
[70097]
[knotdns-cve20140486-dos(96185)]
[https://gitlab.labs.nic.cz/knot/knot-dns/issues/294]
APT before 1.0.9 does not verify downloaded files if they have been modified as indicated using the If-Modified-Since header, which has unspecified impact and attack vectors.
[USN-2348-1]
[DSA-3025]
APT before 1.0.9 does not "invalidate repository data" when moving from an unauthenticated to authenticated state, which allows remote attackers to have unspecified impact via crafted repository data.
[USN-2348-1]
[DSA-3025]
APT before 1.0.9, when the Acquire::GzipIndexes option is enabled, does not validate checksums, which allows remote attackers to execute arbitrary code via a crafted package.
[USN-2348-1]
[DSA-3025]
The apt-get download command in APT before 1.0.9 does not properly validate signatures for packages, which allows remote attackers to execute arbitrary code via a crafted package.
[USN-2348-1]
[DSA-3025]
Adobe Flash Player before 11.7.700.260 and 11.8.x and 11.9.x before 12.0.0.38 on Windows and Mac OS X and before 11.2.202.335 on Linux, Adobe AIR before 4.0.0.1390, Adobe AIR SDK before 4.0.0.1390, and Adobe AIR SDK & Compiler before 4.0.0.1390 allow attackers to bypass unspecified protection mechanisms via unknown vectors.
[http://helpx.adobe.com/security/products/flash-player/apsb14-02.html]
[openSUSE-SU-2014:0128]
[RHSA-2014:0028]
[1029602]
Adobe Flash Player before 11.7.700.260 and 11.8.x and 11.9.x before 12.0.0.38 on Windows and Mac OS X and before 11.2.202.335 on Linux, Adobe AIR before 4.0.0.1390, Adobe AIR SDK before 4.0.0.1390, and Adobe AIR SDK & Compiler before 4.0.0.1390 allow attackers to defeat the ASLR protection mechanism by leveraging an "address leak."
[http://helpx.adobe.com/security/products/flash-player/apsb14-02.html]
[openSUSE-SU-2014:0128]
[RHSA-2014:0028]
[1029602]
Adobe Reader and Acrobat 10.x before 10.1.9 and 11.x before 11.0.06 on Windows and Mac OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0495.
[http://helpx.adobe.com/security/products/acrobat/apsb14-01.html]
[1029604]
Adobe Digital Editions 2.0.1 allows attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via unspecified vectors.
[http://helpx.adobe.com/security/products/Digital-Editions/apsb14-03.html]
[65091]
[1029680]
[adobe-digital-cve20140494-code-exec(90648)]
Adobe Reader and Acrobat 10.x before 10.1.9 and 11.x before 11.0.06 on Windows and Mac OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0493.
[http://helpx.adobe.com/security/products/acrobat/apsb14-01.html]
[1029604]
Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.9 and 11.x before 11.0.06 on Windows and Mac OS X allows attackers to execute arbitrary code via unspecified vectors.
[http://helpx.adobe.com/security/products/acrobat/apsb14-01.html]
[1029604]
Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Mac OS X, and before 11.2.202.336 on Linux, allows remote attackers to execute arbitrary code via unspecified vectors.
[http://googlechromereleases.blogspot.com/2014/02/stable-channel-update.html]
[http://helpx.adobe.com/security/products/flash-player/apsb14-04.html]
[openSUSE-SU-2014:0197]
[openSUSE-SU-2014:0203]
[SUSE-SU-2014:0221]
[RHSA-2014:0137]
[56437]
[56737]
[56780]
[56799]
[56839]
[33212]
[102849]
[65327]
[1029715]
[adobe-flash-cve20140497-code-exec(90884)]
Stack-based buffer overflow in Adobe Flash Player before 11.7.700.269 and 11.8.x through 12.0.x before 12.0.0.70 on Windows and Mac OS X and before 11.2.202.341 on Linux, Adobe AIR before 4.0.0.1628 on Android, Adobe AIR SDK before 4.0.0.1628, and Adobe AIR SDK & Compiler before 4.0.0.1628 allows attackers to execute arbitrary code via unspecified vectors.
[http://helpx.adobe.com/security/products/flash-player/apsb14-07.html]
[openSUSE-SU-2014:0277]
[openSUSE-SU-2014:0278]
[SUSE-SU-2014:0290]
[RHSA-2014:0196]
[GLSA-201405-04]
Adobe Flash Player before 11.7.700.269 and 11.8.x through 12.0.x before 12.0.0.70 on Windows and Mac OS X and before 11.2.202.341 on Linux, Adobe AIR before 4.0.0.1628 on Android, Adobe AIR SDK before 4.0.0.1628, and Adobe AIR SDK & Compiler before 4.0.0.1628 do not prevent access to address information, which makes it easier for attackers to bypass the ASLR protection mechanism via unspecified vectors.
[http://helpx.adobe.com/security/products/flash-player/apsb14-07.html]
[openSUSE-SU-2014:0277]
[openSUSE-SU-2014:0278]
[SUSE-SU-2014:0290]
[RHSA-2014:0196]
[GLSA-201405-04]
Adobe Shockwave Player before 12.0.9.149 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0501.
[http://helpx.adobe.com/security/products/shockwave/apsb14-06.html]
[103157]
[56740]
[65490]
[1029740]
[adobe-cve20140500-code-exec(91007)]
Adobe Shockwave Player before 12.0.9.149 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0500.
[http://helpx.adobe.com/security/products/shockwave/apsb14-06.html]
[103158]
[56740]
[65493]
[1029740]
[adobe-cve20140501-code-exec(91008)]
Double free vulnerability in Adobe Flash Player before 11.7.700.269 and 11.8.x through 12.0.x before 12.0.0.70 on Windows and Mac OS X and before 11.2.202.341 on Linux, Adobe AIR before 4.0.0.1628 on Android, Adobe AIR SDK before 4.0.0.1628, and Adobe AIR SDK & Compiler before 4.0.0.1628 allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in February 2014.
[http://helpx.adobe.com/security/products/flash-player/apsb14-07.html]
[openSUSE-SU-2014:0277]
[openSUSE-SU-2014:0278]
[SUSE-SU-2014:0290]
[RHSA-2014:0196]
[GLSA-201405-04]
[http://www.alienvault.com/open-threat-exchange/blog/analysis-of-an-attack-exploiting-the-adobe-zero-day-cve-2014-0502/]
[https://volatility-labs.blogspot.com/2014/04/building-decoder-for-cve-2014-0502.html]
Adobe Flash Player before 11.7.700.272 and 11.8.x through 12.0.x before 12.0.0.77 on Windows and OS X, and before 11.2.202.346 on Linux, allows remote attackers to bypass the Same Origin Policy via unspecified vectors.
[http://helpx.adobe.com/security/products/flash-player/apsb14-08.html]
[openSUSE-SU-2014:0379]
[SUSE-SU-2014:0387]
[RHSA-2014:0289]
[GLSA-201405-04]
Adobe Flash Player before 11.7.700.272 and 11.8.x through 12.0.x before 12.0.0.77 on Windows and OS X, and before 11.2.202.346 on Linux, allows attackers to read the clipboard via unspecified vectors.
[http://helpx.adobe.com/security/products/flash-player/apsb14-08.html]
[openSUSE-SU-2014:0379]
[SUSE-SU-2014:0387]
[RHSA-2014:0289]
[GLSA-201405-04]
Adobe Shockwave Player before 12.1.0.150 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
[http://helpx.adobe.com/security/products/shockwave/apsb14-10.html]
Use-after-free vulnerability in Adobe Flash Player before 11.7.700.275 and 11.8.x through 13.0.x before 13.0.0.182 on Windows and OS X and before 11.2.202.350 on Linux, Adobe AIR before 13.0.0.83 on Android, Adobe AIR SDK before 13.0.0.83, and Adobe AIR SDK & Compiler before 13.0.0.83 allows remote attackers to execute arbitrary code, and possibly bypass an Internet Explorer sandbox protection mechanism, via unspecified vectors, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2014.
[http://helpx.adobe.com/security/products/flash-player/apsb14-09.html]
[SUSE-SU-2014:0535]
[openSUSE-SU-2014:0520]
[openSUSE-SU-2014:0549]
[RHSA-2014:0380]
[GLSA-201405-04]
[http://twitter.com/thezdi/statuses/443886338077495296]
[http://www.pwn2own.com/2014/03/pwn2own-results-for-wednesday-day-one/]
Buffer overflow in Adobe Flash Player before 11.7.700.275 and 11.8.x through 13.0.x before 13.0.0.182 on Windows and OS X and before 11.2.202.350 on Linux, Adobe AIR before 13.0.0.83 on Android, Adobe AIR SDK before 13.0.0.83, and Adobe AIR SDK & Compiler before 13.0.0.83 allows attackers to execute arbitrary code via unspecified vectors.
[http://helpx.adobe.com/security/products/flash-player/apsb14-09.html]
[SUSE-SU-2014:0535]
[openSUSE-SU-2014:0520]
[openSUSE-SU-2014:0549]
[RHSA-2014:0380]
[GLSA-201405-04]
[66701]
[1030035]
Adobe Flash Player before 11.7.700.275 and 11.8.x through 13.0.x before 13.0.0.182 on Windows and OS X and before 11.2.202.350 on Linux, Adobe AIR before 13.0.0.83 on Android, Adobe AIR SDK before 13.0.0.83, and Adobe AIR SDK & Compiler before 13.0.0.83 allow attackers to bypass intended access restrictions and obtain sensitive information via unspecified vectors.
[http://helpx.adobe.com/security/products/flash-player/apsb14-09.html]
[SUSE-SU-2014:0535]
[openSUSE-SU-2014:0520]
[openSUSE-SU-2014:0549]
[RHSA-2014:0380]
[GLSA-201405-04]
[1030035]
Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 11.7.700.275 and 11.8.x through 13.0.x before 13.0.0.182 on Windows and OS X and before 11.2.202.350 on Linux, Adobe AIR before 13.0.0.83 on Android, Adobe AIR SDK before 13.0.0.83, and Adobe AIR SDK & Compiler before 13.0.0.83 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
[http://helpx.adobe.com/security/products/flash-player/apsb14-09.html]
[SUSE-SU-2014:0535]
[openSUSE-SU-2014:0520]
[openSUSE-SU-2014:0549]
[RHSA-2014:0380]
[GLSA-201405-04]
[66703]
[1030035]
Heap-based buffer overflow in Adobe Flash Player 12.0.0.77 allows remote attackers to execute arbitrary code and bypass a sandbox protection mechanism via unspecified vectors, as demonstrated by Zeguang Zhao and Liang Chen during a Pwn2Own competition at CanSecWest 2014.
[http://helpx.adobe.com/security/products/flash-player/apsb14-14.html]
[SUSE-SU-2014:0671]
[RHSA-2014:0496]
[GLSA-201406-08]
[http://twitter.com/thezdi/statuses/444262022444621824]
[http://www.pwn2own.com/2014/03/pwn2own-results-thursday-day-two/]
[66241]
Heap-based buffer overflow in Adobe Reader 11.0.06 allows remote attackers to execute arbitrary code via unspecified vectors, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2014.
[http://helpx.adobe.com/security/products/reader/apsb14-15.html]
[http://twitter.com/thezdi/statuses/443827076580122624]
[http://www.pwn2own.com/2014/03/pwn2own-results-for-wednesday-day-one/]
Adobe Reader 11.0.06 allows attackers to bypass a PDF sandbox protection mechanism via unspecified vectors, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2014.
[http://helpx.adobe.com/security/products/reader/apsb14-15.html]
[http://twitter.com/thezdi/statuses/443827076580122624]
[http://www.pwn2own.com/2014/03/pwn2own-results-for-wednesday-day-one/]
Stack-based buffer overflow in Adobe Illustrator CS6 before 16.0.5 and 16.2.x before 16.2.2 allows remote attackers to execute arbitrary code via unspecified vectors.
[http://helpx.adobe.com/security/products/illustrator/apsb14-11.html]
The Adobe Reader Mobile application before 11.2 for Android does not properly restrict use of JavaScript, which allows remote attackers to execute arbitrary code via a crafted PDF document, a related issue to CVE-2012-6636.
[http://helpx.adobe.com/security/products/reader-mobile/apsb14-12.html]
[http://packetstormsecurity.com/files/127113/Adobe-Reader-for-Android-addJavascriptInterface-Exploit.html]
[20140413 Adobe Reader for Android exposes insecure Javascript interfaces]
[32884]
[33791]
[105781]
[http://www.securify.nl/advisory/SFY20140401/adobe_reader_for_android_exposes_insecure_javascript_interfaces.html]
[20140413 Adobe Reader for Android exposes insecure Javascript interfaces]
[66798]
Buffer overflow in Adobe Flash Player before 11.7.700.279 and 11.8.x through 13.0.x before 13.0.0.206 on Windows and OS X, and before 11.2.202.356 on Linux, allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in April 2014.
Per: http://helpx.adobe.com/security/products/flash-player/apsb14-13.html
"Affected software versions
Adobe Flash Player 13.0.0.182 and earlier versions for Windows
Adobe Flash Player 13.0.0.201 and earlier versions for Macintosh
Adobe Flash Player 11.2.202.350 and earlier versions for Linux"
[http://helpx.adobe.com/security/products/flash-player/apsb14-13.html]
[openSUSE-SU-2014:0585]
[openSUSE-SU-2014:0589]
[SUSE-SU-2014:0605]
[RHSA-2014:0447]
[GLSA-201405-04]
[67092]
[1030155]
Adobe Flash Player before 13.0.0.214 on Windows and OS X and before 11.2.202.359 on Linux, Adobe AIR SDK before 13.0.0.111, and Adobe AIR SDK & Compiler before 13.0.0.111 allow remote attackers to bypass the Same Origin Policy via unspecified vectors.
[http://helpx.adobe.com/security/products/flash-player/apsb14-14.html]
[SUSE-SU-2014:0671]
[openSUSE-SU-2014:0673]
[RHSA-2014:0496]
[GLSA-201406-08]
Adobe Flash Player before 13.0.0.214 on Windows and OS X and before 11.2.202.359 on Linux, Adobe AIR SDK before 13.0.0.111, and Adobe AIR SDK & Compiler before 13.0.0.111 allow attackers to bypass intended access restrictions via unspecified vectors, a different vulnerability than CVE-2014-0518, CVE-2014-0519, and CVE-2014-0520.
[http://helpx.adobe.com/security/products/flash-player/apsb14-14.html]
[SUSE-SU-2014:0671]
[openSUSE-SU-2014:0673]
[RHSA-2014:0496]
[GLSA-201406-08]
Adobe Flash Player before 13.0.0.214 on Windows and OS X and before 11.2.202.359 on Linux, Adobe AIR SDK before 13.0.0.111, and Adobe AIR SDK & Compiler before 13.0.0.111 allow attackers to bypass intended access restrictions via unspecified vectors, a different vulnerability than CVE-2014-0517, CVE-2014-0519, and CVE-2014-0520.
[http://helpx.adobe.com/security/products/flash-player/apsb14-14.html]
[SUSE-SU-2014:0671]
[openSUSE-SU-2014:0673]
[RHSA-2014:0496]
[GLSA-201406-08]
Adobe Flash Player before 13.0.0.214 on Windows and OS X and before 11.2.202.359 on Linux, Adobe AIR SDK before 13.0.0.111, and Adobe AIR SDK & Compiler before 13.0.0.111 allow attackers to bypass intended access restrictions via unspecified vectors, a different vulnerability than CVE-2014-0517, CVE-2014-0518, and CVE-2014-0520.
[http://helpx.adobe.com/security/products/flash-player/apsb14-14.html]
[SUSE-SU-2014:0671]
[openSUSE-SU-2014:0673]
[RHSA-2014:0496]
[GLSA-201406-08]
Adobe Flash Player before 13.0.0.214 on Windows and OS X and before 11.2.202.359 on Linux, Adobe AIR SDK before 13.0.0.111, and Adobe AIR SDK & Compiler before 13.0.0.111 allow attackers to bypass intended access restrictions via unspecified vectors, a different vulnerability than CVE-2014-0517, CVE-2014-0518, and CVE-2014-0519.
[http://helpx.adobe.com/security/products/flash-player/apsb14-14.html]
[SUSE-SU-2014:0671]
[openSUSE-SU-2014:0673]
[RHSA-2014:0496]
[GLSA-201406-08]
Adobe Reader and Acrobat 10.x before 10.1.10 and 11.x before 11.0.07 on Windows and OS X do not properly implement JavaScript APIs, which allows remote attackers to obtain sensitive information via a crafted PDF document.
[http://helpx.adobe.com/security/products/reader/apsb14-15.html]
Adobe Reader and Acrobat 10.x before 10.1.10 and 11.x before 11.0.07 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0523, CVE-2014-0524, and CVE-2014-0526.
[http://helpx.adobe.com/security/products/reader/apsb14-15.html]
Adobe Reader and Acrobat 10.x before 10.1.10 and 11.x before 11.0.07 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0522, CVE-2014-0524, and CVE-2014-0526.
[http://helpx.adobe.com/security/products/reader/apsb14-15.html]
[20141210 Adobe Reader U3D Processinng Memory Corruption Vulnerability]
Adobe Reader and Acrobat 10.x before 10.1.10 and 11.x before 11.0.07 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0522, CVE-2014-0523, and CVE-2014-0526.
[http://helpx.adobe.com/security/products/reader/apsb14-15.html]
The API in Adobe Reader and Acrobat 10.x before 10.1.10 and 11.x before 11.0.07 on Windows and OS X does not prevent access to unmapped memory, which allows attackers to execute arbitrary code via unspecified API calls.
[http://helpx.adobe.com/security/products/reader/apsb14-15.html]
Adobe Reader and Acrobat 10.x before 10.1.10 and 11.x before 11.0.07 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0522, CVE-2014-0523, and CVE-2014-0524.
[http://helpx.adobe.com/security/products/reader/apsb14-15.html]
Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.10 and 11.x before 11.0.07 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors.
[http://helpx.adobe.com/security/products/reader/apsb14-15.html]
Double free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.10 and 11.x before 11.0.07 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors.
[http://helpx.adobe.com/security/products/reader/apsb14-15.html]
Buffer overflow in Adobe Reader and Acrobat 10.x before 10.1.10 and 11.x before 11.0.07 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors.
[http://helpx.adobe.com/security/products/reader/apsb14-15.html]
[67362]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2014. Notes: none.
Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 13.0.0.223 and 14.x before 14.0.0.125 on Windows and OS X and before 11.2.202.378 on Linux, Adobe AIR before 14.0.0.110, Adobe AIR SDK before 14.0.0.110, and Adobe AIR SDK & Compiler before 14.0.0.110 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2014-0532 and CVE-2014-0533.
[http://helpx.adobe.com/security/products/flash-player/apsb14-16.html]
[SUSE-SU-2014:0806]
[openSUSE-SU-2014:0798]
[openSUSE-SU-2014:0799]
[RHSA-2014:0745]
[GLSA-201406-17]
[67962]
[1030368]
Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 13.0.0.223 and 14.x before 14.0.0.125 on Windows and OS X and before 11.2.202.378 on Linux, Adobe AIR before 14.0.0.110, Adobe AIR SDK before 14.0.0.110, and Adobe AIR SDK & Compiler before 14.0.0.110 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2014-0531 and CVE-2014-0533.
[http://helpx.adobe.com/security/products/flash-player/apsb14-16.html]
[SUSE-SU-2014:0806]
[openSUSE-SU-2014:0798]
[openSUSE-SU-2014:0799]
[RHSA-2014:0745]
[GLSA-201406-17]
[67973]
[1030368]
Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 13.0.0.223 and 14.x before 14.0.0.125 on Windows and OS X and before 11.2.202.378 on Linux, Adobe AIR before 14.0.0.110, Adobe AIR SDK before 14.0.0.110, and Adobe AIR SDK & Compiler before 14.0.0.110 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2014-0531 and CVE-2014-0532.
[http://helpx.adobe.com/security/products/flash-player/apsb14-16.html]
[SUSE-SU-2014:0806]
[openSUSE-SU-2014:0798]
[openSUSE-SU-2014:0799]
[RHSA-2014:0745]
[GLSA-201406-17]
[67974]
[1030368]
Adobe Flash Player before 13.0.0.223 and 14.x before 14.0.0.125 on Windows and OS X and before 11.2.202.378 on Linux, Adobe AIR before 14.0.0.110, Adobe AIR SDK before 14.0.0.110, and Adobe AIR SDK & Compiler before 14.0.0.110 allow attackers to bypass intended access restrictions via unspecified vectors, a different vulnerability than CVE-2014-0535.
[http://helpx.adobe.com/security/products/flash-player/apsb14-16.html]
[SUSE-SU-2014:0806]
[openSUSE-SU-2014:0798]
[openSUSE-SU-2014:0799]
[RHSA-2014:0745]
[GLSA-201406-17]
[67963]
[1030368]
Adobe Flash Player before 13.0.0.223 and 14.x before 14.0.0.125 on Windows and OS X and before 11.2.202.378 on Linux, Adobe AIR before 14.0.0.110, Adobe AIR SDK before 14.0.0.110, and Adobe AIR SDK & Compiler before 14.0.0.110 allow attackers to bypass intended access restrictions via unspecified vectors, a different vulnerability than CVE-2014-0534.
[http://helpx.adobe.com/security/products/flash-player/apsb14-16.html]
[SUSE-SU-2014:0806]
[openSUSE-SU-2014:0798]
[openSUSE-SU-2014:0799]
[RHSA-2014:0745]
[GLSA-201406-17]
[67970]
[1030368]
Adobe Flash Player before 13.0.0.223 and 14.x before 14.0.0.125 on Windows and OS X and before 11.2.202.378 on Linux, Adobe AIR before 14.0.0.110, Adobe AIR SDK before 14.0.0.110, and Adobe AIR SDK & Compiler before 14.0.0.110 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
[http://helpx.adobe.com/security/products/flash-player/apsb14-16.html]
[SUSE-SU-2014:0806]
[openSUSE-SU-2014:0798]
[openSUSE-SU-2014:0799]
[RHSA-2014:0745]
[GLSA-201406-17]
[67961]
[1030368]
Adobe Flash Player before 13.0.0.231 and 14.x before 14.0.0.145 on Windows and OS X and before 11.2.202.394 on Linux, Adobe AIR before 14.0.0.137 on Android, Adobe AIR SDK before 14.0.0.137, and Adobe AIR SDK & Compiler before 14.0.0.137 allow attackers to bypass intended access restrictions via unspecified vectors, a different vulnerability than CVE-2014-0539.
[http://helpx.adobe.com/security/products/flash-player/apsb14-17.html]
[RHSA-2014:0860]
[GLSA-201407-02]
[68455]
[1030533]
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.241 and 14.x before 14.0.0.176 on Windows and OS X and before 11.2.202.400 on Linux, Adobe AIR before 14.0.0.178 on Windows and OS X and before 14.0.0.179 on Android, Adobe AIR SDK before 14.0.0.178, and Adobe AIR SDK & Compiler before 14.0.0.178 allows attackers to execute arbitrary code via unspecified vectors.
<a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a>
[http://helpx.adobe.com/security/products/flash-player/apsb14-18.html]
[58593]
[59904]
[60710]
[60732]
[GLSA-201408-05]
[GLSA-201408-16]
[1030712]
Adobe Flash Player before 13.0.0.231 and 14.x before 14.0.0.145 on Windows and OS X and before 11.2.202.394 on Linux, Adobe AIR before 14.0.0.137 on Android, Adobe AIR SDK before 14.0.0.137, and Adobe AIR SDK & Compiler before 14.0.0.137 allow attackers to bypass intended access restrictions via unspecified vectors, a different vulnerability than CVE-2014-0537.
[http://helpx.adobe.com/security/products/flash-player/apsb14-17.html]
[RHSA-2014:0860]
[GLSA-201407-02]
[68454]
[1030533]
Adobe Flash Player before 13.0.0.241 and 14.x before 14.0.0.176 on Windows and OS X and before 11.2.202.400 on Linux, Adobe AIR before 14.0.0.178 on Windows and OS X and before 14.0.0.179 on Android, Adobe AIR SDK before 14.0.0.178, and Adobe AIR SDK & Compiler before 14.0.0.178 do not properly restrict discovery of memory addresses, which allows attackers to bypass the ASLR protection mechanism via unspecified vectors, a different vulnerability than CVE-2014-0542, CVE-2014-0543, CVE-2014-0544, and CVE-2014-0545.
[http://helpx.adobe.com/security/products/flash-player/apsb14-18.html]
[60710]
[60732]
[GLSA-201408-05]
[1030712]
Adobe Flash Player before 13.0.0.241 and 14.x before 14.0.0.176 on Windows and OS X and before 11.2.202.400 on Linux, Adobe AIR before 14.0.0.178 on Windows and OS X and before 14.0.0.179 on Android, Adobe AIR SDK before 14.0.0.178, and Adobe AIR SDK & Compiler before 14.0.0.178 allow attackers to bypass intended access restrictions via unspecified vectors.
[http://helpx.adobe.com/security/products/flash-player/apsb14-18.html]
[58593]
[59904]
[60710]
[60732]
[GLSA-201408-05]
[1030712]
Adobe Flash Player before 13.0.0.241 and 14.x before 14.0.0.176 on Windows and OS X and before 11.2.202.400 on Linux, Adobe AIR before 14.0.0.178 on Windows and OS X and before 14.0.0.179 on Android, Adobe AIR SDK before 14.0.0.178, and Adobe AIR SDK & Compiler before 14.0.0.178 do not properly restrict discovery of memory addresses, which allows attackers to bypass the ASLR protection mechanism via unspecified vectors, a different vulnerability than CVE-2014-0540, CVE-2014-0543, CVE-2014-0544, and CVE-2014-0545.
[http://helpx.adobe.com/security/products/flash-player/apsb14-18.html]
[60710]
[60732]
[GLSA-201408-05]
[1030712]
Adobe Flash Player before 13.0.0.241 and 14.x before 14.0.0.176 on Windows and OS X and before 11.2.202.400 on Linux, Adobe AIR before 14.0.0.178 on Windows and OS X and before 14.0.0.179 on Android, Adobe AIR SDK before 14.0.0.178, and Adobe AIR SDK & Compiler before 14.0.0.178 do not properly restrict discovery of memory addresses, which allows attackers to bypass the ASLR protection mechanism via unspecified vectors, a different vulnerability than CVE-2014-0540, CVE-2014-0542, CVE-2014-0544, and CVE-2014-0545.
[http://helpx.adobe.com/security/products/flash-player/apsb14-18.html]
[60710]
[60732]
[GLSA-201408-05]
[1030712]
Adobe Flash Player before 13.0.0.241 and 14.x before 14.0.0.176 on Windows and OS X and before 11.2.202.400 on Linux, Adobe AIR before 14.0.0.178 on Windows and OS X and before 14.0.0.179 on Android, Adobe AIR SDK before 14.0.0.178, and Adobe AIR SDK & Compiler before 14.0.0.178 do not properly restrict discovery of memory addresses, which allows attackers to bypass the ASLR protection mechanism via unspecified vectors, a different vulnerability than CVE-2014-0540, CVE-2014-0542, CVE-2014-0543, and CVE-2014-0545.
[http://helpx.adobe.com/security/products/flash-player/apsb14-18.html]
[60710]
[60732]
[GLSA-201408-05]
[1030712]
Adobe Flash Player before 13.0.0.241 and 14.x before 14.0.0.176 on Windows and OS X and before 11.2.202.400 on Linux, Adobe AIR before 14.0.0.178 on Windows and OS X and before 14.0.0.179 on Android, Adobe AIR SDK before 14.0.0.178, and Adobe AIR SDK & Compiler before 14.0.0.178 do not properly restrict discovery of memory addresses, which allows attackers to bypass the ASLR protection mechanism via unspecified vectors, a different vulnerability than CVE-2014-0540, CVE-2014-0542, CVE-2014-0543, and CVE-2014-0544.
[http://helpx.adobe.com/security/products/flash-player/apsb14-18.html]
[60710]
[60732]
[GLSA-201408-05]
[1030712]
Adobe Reader and Acrobat 10.x before 10.1.11 and 11.x before 11.0.08 on Windows allow attackers to bypass a sandbox protection mechanism, and consequently execute native code in a privileged context, via unspecified vectors.
[http://helpx.adobe.com/security/products/reader/apsb14-19.html]
[1030711]
Adobe Flash Player before 13.0.0.244 and 14.x and 15.x before 15.0.0.152 on Windows and OS X and before 11.2.202.406 on Linux, Adobe AIR before 15.0.0.249 on Windows and OS X and before 15.0.0.252 on Android, Adobe AIR SDK before 15.0.0.249, and Adobe AIR SDK & Compiler before 15.0.0.249 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0549, CVE-2014-0550, CVE-2014-0551, CVE-2014-0552, and CVE-2014-0555.
[http://helpx.adobe.com/security/products/flash-player/apsb14-21.html]
[openSUSE-SU-2014:1110]
[SUSE-SU-2014:1124]
[openSUSE-SU-2014:1130]
[61089]
[GLSA-201409-05]
[69695]
[1030822]
[adobe-flash-cve20140547-code-exec(95817)]
Adobe Flash Player before 13.0.0.244 and 14.x and 15.x before 15.0.0.152 on Windows and OS X and before 11.2.202.406 on Linux, Adobe AIR before 15.0.0.249 on Windows and OS X and before 15.0.0.252 on Android, Adobe AIR SDK before 15.0.0.249, and Adobe AIR SDK & Compiler before 15.0.0.249 allow remote attackers to bypass the Same Origin Policy via unspecified vectors.
[http://helpx.adobe.com/security/products/flash-player/apsb14-21.html]
[openSUSE-SU-2014:1110]
[SUSE-SU-2014:1124]
[openSUSE-SU-2014:1130]
[61089]
[GLSA-201409-05]
[69705]
[1030822]
[adobe-flash-cve20140548-sec-bypass(95818)]
Adobe Flash Player before 13.0.0.244 and 14.x and 15.x before 15.0.0.152 on Windows and OS X and before 11.2.202.406 on Linux, Adobe AIR before 15.0.0.249 on Windows and OS X and before 15.0.0.252 on Android, Adobe AIR SDK before 15.0.0.249, and Adobe AIR SDK & Compiler before 15.0.0.249 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0547, CVE-2014-0550, CVE-2014-0551, CVE-2014-0552, and CVE-2014-0555.
[http://helpx.adobe.com/security/products/flash-player/apsb14-21.html]
[openSUSE-SU-2014:1110]
[SUSE-SU-2014:1124]
[openSUSE-SU-2014:1130]
[61089]
[GLSA-201409-05]
[69699]
[1030822]
[adobe-flash-cve20140549-code-exec(95819)]
Adobe Flash Player before 13.0.0.244 and 14.x and 15.x before 15.0.0.152 on Windows and OS X and before 11.2.202.406 on Linux, Adobe AIR before 15.0.0.249 on Windows and OS X and before 15.0.0.252 on Android, Adobe AIR SDK before 15.0.0.249, and Adobe AIR SDK & Compiler before 15.0.0.249 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0547, CVE-2014-0549, CVE-2014-0551, CVE-2014-0552, and CVE-2014-0555.
[http://helpx.adobe.com/security/products/flash-player/apsb14-21.html]
[openSUSE-SU-2014:1110]
[SUSE-SU-2014:1124]
[openSUSE-SU-2014:1130]
[61089]
[GLSA-201409-05]
[69700]
[1030822]
[adobe-flash-cve20140550-code-exec(95820)]
Adobe Flash Player before 13.0.0.244 and 14.x and 15.x before 15.0.0.152 on Windows and OS X and before 11.2.202.406 on Linux, Adobe AIR before 15.0.0.249 on Windows and OS X and before 15.0.0.252 on Android, Adobe AIR SDK before 15.0.0.249, and Adobe AIR SDK & Compiler before 15.0.0.249 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0547, CVE-2014-0549, CVE-2014-0550, CVE-2014-0552, and CVE-2014-0555.
[http://helpx.adobe.com/security/products/flash-player/apsb14-21.html]
[openSUSE-SU-2014:1110]
[SUSE-SU-2014:1124]
[openSUSE-SU-2014:1130]
[61089]
[GLSA-201409-05]
[69702]
[1030822]
[adobe-flash-cve20140551-code-exec(95821)]
Adobe Flash Player before 13.0.0.244 and 14.x and 15.x before 15.0.0.152 on Windows and OS X and before 11.2.202.406 on Linux, Adobe AIR before 15.0.0.249 on Windows and OS X and before 15.0.0.252 on Android, Adobe AIR SDK before 15.0.0.249, and Adobe AIR SDK & Compiler before 15.0.0.249 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0547, CVE-2014-0549, CVE-2014-0550, CVE-2014-0551, and CVE-2014-0555.
[http://helpx.adobe.com/security/products/flash-player/apsb14-21.html]
[openSUSE-SU-2014:1110]
[SUSE-SU-2014:1124]
[openSUSE-SU-2014:1130]
[61089]
[GLSA-201409-05]
[69703]
[1030822]
[adobe-flash-cve20140552-code-exec(95822)]
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.244 and 14.x and 15.x before 15.0.0.152 on Windows and OS X and before 11.2.202.406 on Linux, Adobe AIR before 15.0.0.249 on Windows and OS X and before 15.0.0.252 on Android, Adobe AIR SDK before 15.0.0.249, and Adobe AIR SDK & Compiler before 15.0.0.249 allows attackers to execute arbitrary code via unspecified vectors.
<a href="http://cwe.mitre.org/data/definitions/416.html" target="_blank">CWE-416: Use After Free</a>
[http://helpx.adobe.com/security/products/flash-player/apsb14-21.html]
[openSUSE-SU-2014:1110]
[SUSE-SU-2014:1124]
[openSUSE-SU-2014:1130]
[61089]
[GLSA-201409-05]
[69707]
[1030822]
[adobe-flash-cve20140553-code-exec(95823)]
Adobe Flash Player before 13.0.0.244 and 14.x and 15.x before 15.0.0.152 on Windows and OS X and before 11.2.202.406 on Linux, Adobe AIR before 15.0.0.249 on Windows and OS X and before 15.0.0.252 on Android, Adobe AIR SDK before 15.0.0.249, and Adobe AIR SDK & Compiler before 15.0.0.249 allow attackers to bypass intended access restrictions via unspecified vectors.
[http://helpx.adobe.com/security/products/flash-player/apsb14-21.html]
[openSUSE-SU-2014:1110]
[SUSE-SU-2014:1124]
[openSUSE-SU-2014:1130]
[61089]
[GLSA-201409-05]
[69697]
[1030822]
[adobe-flash-cve20140554-sec-bypass(95824)]
Adobe Flash Player before 13.0.0.244 and 14.x and 15.x before 15.0.0.152 on Windows and OS X and before 11.2.202.406 on Linux, Adobe AIR before 15.0.0.249 on Windows and OS X and before 15.0.0.252 on Android, Adobe AIR SDK before 15.0.0.249, and Adobe AIR SDK & Compiler before 15.0.0.249 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0547, CVE-2014-0549, CVE-2014-0550, CVE-2014-0551, and CVE-2014-0552.
[http://helpx.adobe.com/security/products/flash-player/apsb14-21.html]
[openSUSE-SU-2014:1110]
[SUSE-SU-2014:1124]
[openSUSE-SU-2014:1130]
[61089]
[GLSA-201409-05]
[69706]
[1030822]
[adobe-flash-cve20140555-code-exec(95825)]
Heap-based buffer overflow in Adobe Flash Player before 13.0.0.244 and 14.x and 15.x before 15.0.0.152 on Windows and OS X and before 11.2.202.406 on Linux, Adobe AIR before 15.0.0.249 on Windows and OS X and before 15.0.0.252 on Android, Adobe AIR SDK before 15.0.0.249, and Adobe AIR SDK & Compiler before 15.0.0.249 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2014-0559.
[http://googleprojectzero.blogspot.com/2014/09/exploiting-cve-2014-0556-in-flash.html]
[http://helpx.adobe.com/security/products/flash-player/apsb14-21.html]
[openSUSE-SU-2014:1110]
[SUSE-SU-2014:1124]
[openSUSE-SU-2014:1130]
[http://packetstormsecurity.com/files/131516/Adobe-Flash-Player-copyPixelsToByteArray-Integer-Overflow.html]
[61089]
[GLSA-201409-05]
[69696]
[1030822]
[https://code.google.com/p/google-security-research/issues/detail?id=46]
[adobe-flash-cve20140556-bo(95826)]
[36808]
Adobe Flash Player before 13.0.0.244 and 14.x and 15.x before 15.0.0.152 on Windows and OS X and before 11.2.202.406 on Linux, Adobe AIR before 15.0.0.249 on Windows and OS X and before 15.0.0.252 on Android, Adobe AIR SDK before 15.0.0.249, and Adobe AIR SDK & Compiler before 15.0.0.249 do not properly restrict discovery of memory addresses, which allows attackers to bypass the ASLR protection mechanism via unspecified vectors.
[http://helpx.adobe.com/security/products/flash-player/apsb14-21.html]
[openSUSE-SU-2014:1110]
[SUSE-SU-2014:1124]
[openSUSE-SU-2014:1130]
[61089]
[GLSA-201409-05]
[69701]
[1030822]
[adobe-flash-cve20140557-sec-bypass(95827)]
Adobe Flash Player before 13.0.0.250 and 14.x and 15.x before 15.0.0.189 on Windows and OS X and before 11.2.202.411 on Linux, Adobe AIR before 15.0.0.293, Adobe AIR SDK before 15.0.0.302, and Adobe AIR SDK & Compiler before 15.0.0.302 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0564.
[http://helpx.adobe.com/security/products/flash-player/apsb14-22.html]
[SUSE-SU-2014:1360]
[openSUSE-SU-2015:0725]
[openSUSE-SU-2014:1329]
[RHSA-2014:1648]
[1031019]
Heap-based buffer overflow in Adobe Flash Player before 13.0.0.244 and 14.x and 15.x before 15.0.0.152 on Windows and OS X and before 11.2.202.406 on Linux, Adobe AIR before 15.0.0.249 on Windows and OS X and before 15.0.0.252 on Android, Adobe AIR SDK before 15.0.0.249, and Adobe AIR SDK & Compiler before 15.0.0.249 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2014-0556.
[http://helpx.adobe.com/security/products/flash-player/apsb14-21.html]
[openSUSE-SU-2014:1110]
[SUSE-SU-2014:1124]
[openSUSE-SU-2014:1130]
[61089]
[GLSA-201409-05]
[69704]
[1030822]
[adobe-flash-cve20140559-bo(95828)]
Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.12 and 11.x before 11.0.09 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors.
[http://helpx.adobe.com/security/products/reader/apsb14-20.html]
[69823]
[1030853]
[adobe-reader-cve20140560-code-exec(96001)]
Heap-based buffer overflow in Adobe Reader and Acrobat 10.x before 10.1.12 and 11.x before 11.0.09 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2014-0567.
[http://helpx.adobe.com/security/products/reader/apsb14-20.html]
[69821]
[1030853]
[adobe-reader-cve20140561-bo(95996)]
Cross-site scripting (XSS) vulnerability in Adobe Reader and Acrobat 10.x before 10.1.12 and 11.x before 11.0.09 on OS X allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Universal XSS (UXSS)."
[http://helpx.adobe.com/security/products/reader/apsb14-20.html]
[69822]
[1030853]
[adobe-reader-cve20140562-xss(95997)]
Adobe Reader and Acrobat 10.x before 10.1.12 and 11.x before 11.0.09 on Windows and OS X allow attackers to cause a denial of service (memory corruption) via unspecified vectors.
[http://helpx.adobe.com/security/products/reader/apsb14-20.html]
[69826]
[1030853]
[adobe-reader-cve20140563-code-exec(95998)]
Adobe Flash Player before 13.0.0.250 and 14.x and 15.x before 15.0.0.189 on Windows and OS X and before 11.2.202.411 on Linux, Adobe AIR before 15.0.0.293, Adobe AIR SDK before 15.0.0.302, and Adobe AIR SDK & Compiler before 15.0.0.302 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0558.
[http://helpx.adobe.com/security/products/flash-player/apsb14-22.html]
[SUSE-SU-2014:1360]
[openSUSE-SU-2015:0725]
[openSUSE-SU-2014:1329]
[RHSA-2014:1648]
[1031019]
Adobe Reader and Acrobat 10.x before 10.1.12 and 11.x before 11.0.09 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0566.
[http://helpx.adobe.com/security/products/reader/apsb14-20.html]
[69824]
[1030853]
[adobe-reader-cve20140565-code-exec(96002)]
Adobe Reader and Acrobat 10.x before 10.1.12 and 11.x before 11.0.09 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0565.
[http://helpx.adobe.com/security/products/reader/apsb14-20.html]
[69825]
[1030853]
[1032892]
[adobe-reader-cve20140566-code-exec(96003)]
[https://helpx.adobe.com/security/products/reader/apsb15-15.html]
Heap-based buffer overflow in Adobe Reader and Acrobat 10.x before 10.1.12 and 11.x before 11.0.09 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2014-0561.
[http://helpx.adobe.com/security/products/reader/apsb14-20.html]
[69827]
[1030853]
[adobe-reader-cve20140567-bo(95999)]
The NtSetInformationFile system call hook feature in Adobe Reader and Acrobat 10.x before 10.1.12 and 11.x before 11.0.09 on Windows allows attackers to bypass a sandbox protection mechanism, and consequently execute native code in a privileged context, via an NTFS junction attack.
[http://helpx.adobe.com/security/products/reader/apsb14-20.html]
[69828]
[1030853]
[https://code.google.com/p/google-security-research/issues/detail?id=94]
[adobe-reader-cve20140568-sec-bypass(96000)]
Integer overflow in Adobe Flash Player before 13.0.0.250 and 14.x and 15.x before 15.0.0.189 on Windows and OS X and before 11.2.202.411 on Linux, Adobe AIR before 15.0.0.293, Adobe AIR SDK before 15.0.0.302, and Adobe AIR SDK & Compiler before 15.0.0.302 allows attackers to execute arbitrary code via unspecified vectors.
[http://helpx.adobe.com/security/products/flash-player/apsb14-22.html]
[SUSE-SU-2014:1360]
[openSUSE-SU-2015:0725]
[openSUSE-SU-2014:1329]
[RHSA-2014:1648]
[70441]
[1031019]
[http://www.zerodayinitiative.com/advisories/ZDI-14-365/]
Cross-site request forgery (CSRF) vulnerability in Adobe ColdFusion 9.0 before Update 13, 9.0.1 before Update 12, 9.0.2 before Update 7, 10 before Update 14, and 11 before Update 2 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
[http://helpx.adobe.com/security/products/coldfusion/apsb14-23.html]
[1031020]
Cross-site scripting (XSS) vulnerability in Adobe ColdFusion 9.0 before Update 13, 9.0.1 before Update 12, 9.0.2 before Update 7, 10 before Update 14, and 11 before Update 2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
[http://helpx.adobe.com/security/products/coldfusion/apsb14-23.html]
[1031020]
Adobe ColdFusion 9.0 before Update 13, 9.0.1 before Update 12, 9.0.2 before Update 7, 10 before Update 14, and 11 before Update 2 allows local users to bypass intended IP-based access restrictions via unspecified vectors.
[http://helpx.adobe.com/security/products/coldfusion/apsb14-23.html]
[1031020]
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR before 15.0.0.356, Adobe AIR SDK before 15.0.0.356, and Adobe AIR SDK & Compiler before 15.0.0.356 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2014-0588 and CVE-2014-8438.
<a href="http://cwe.mitre.org/data/definitions/416.html" rel="nofollow">CWE-416: Use After Free</a>
[http://helpx.adobe.com/security/products/flash-player/apsb14-24.html]
[openSUSE-SU-2015:0725]
Double free vulnerability in Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR before 15.0.0.356, Adobe AIR SDK before 15.0.0.356, and Adobe AIR SDK & Compiler before 15.0.0.356 allows attackers to execute arbitrary code via unspecified vectors.
[http://googlechromereleases.blogspot.com/2014/11/stable-channel-update_18.html]
[http://helpx.adobe.com/security/products/flash-player/apsb14-24.html]
[openSUSE-SU-2015:0725]
[https://code.google.com/p/chromium/issues/detail?id=423703]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2014. Notes: none.
Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR before 15.0.0.356, Adobe AIR SDK before 15.0.0.356, and Adobe AIR SDK & Compiler before 15.0.0.356 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0581, CVE-2014-8440, and CVE-2014-8441.
[http://helpx.adobe.com/security/products/flash-player/apsb14-24.html]
[openSUSE-SU-2015:0725]
Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR before 15.0.0.356, Adobe AIR SDK before 15.0.0.356, and Adobe AIR SDK & Compiler before 15.0.0.356 allow attackers to execute arbitrary code by leveraging an unspecified "type confusion," a different vulnerability than CVE-2014-0584, CVE-2014-0585, CVE-2014-0586, and CVE-2014-0590.
[http://helpx.adobe.com/security/products/flash-player/apsb14-24.html]
[openSUSE-SU-2015:0725]
Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allow remote attackers to bypass the Same Origin Policy via unspecified vectors, a different vulnerability than CVE-2015-3115, CVE-2015-3116, CVE-2015-3125, and CVE-2015-5116.
[SUSE-SU-2015:1211]
[SUSE-SU-2015:1214]
[RHSA-2015:1214]
[75594]
[1032810]
[https://helpx.adobe.com/security/products/flash-player/apsb15-16.html]
[GLSA-201507-13]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2014. Notes: none.
Adobe Flash Player before 13.0.0.259 and 14.x through 16.x before 16.0.0.235 on Windows and OS X and before 11.2.202.425 on Linux allows remote attackers to bypass the Same Origin Policy via unspecified vectors.
[http://helpx.adobe.com/security/products/flash-player/apsb14-27.html]
Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR before 15.0.0.356, Adobe AIR SDK before 15.0.0.356, and Adobe AIR SDK & Compiler before 15.0.0.356 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0576, CVE-2014-8440, and CVE-2014-8441.
[http://helpx.adobe.com/security/products/flash-player/apsb14-24.html]
[openSUSE-SU-2015:0725]
Heap-based buffer overflow in Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR before 15.0.0.356, Adobe AIR SDK before 15.0.0.356, and Adobe AIR SDK & Compiler before 15.0.0.356 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2014-0589.
[http://helpx.adobe.com/security/products/flash-player/apsb14-24.html]
[openSUSE-SU-2015:0725]
[71039]
Heap-based buffer overflow in Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR before 15.0.0.356, Adobe AIR SDK before 15.0.0.356, and Adobe AIR SDK & Compiler before 15.0.0.356 allows attackers to complete a transition from Low Integrity to Medium Integrity via unspecified vectors.
[http://helpx.adobe.com/security/products/flash-player/apsb14-24.html]
[openSUSE-SU-2015:0725]
[71035]
Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR before 15.0.0.356, Adobe AIR SDK before 15.0.0.356, and Adobe AIR SDK & Compiler before 15.0.0.356 allow attackers to execute arbitrary code by leveraging an unspecified "type confusion," a different vulnerability than CVE-2014-0577, CVE-2014-0585, CVE-2014-0586, and CVE-2014-0590.
[http://helpx.adobe.com/security/products/flash-player/apsb14-24.html]
[openSUSE-SU-2015:0725]
Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR before 15.0.0.356, Adobe AIR SDK before 15.0.0.356, and Adobe AIR SDK & Compiler before 15.0.0.356 allow attackers to execute arbitrary code by leveraging an unspecified "type confusion," a different vulnerability than CVE-2014-0577, CVE-2014-0584, CVE-2014-0586, and CVE-2014-0590.
[http://helpx.adobe.com/security/products/flash-player/apsb14-24.html]
[openSUSE-SU-2015:0725]
Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR before 15.0.0.356, Adobe AIR SDK before 15.0.0.356, and Adobe AIR SDK & Compiler before 15.0.0.356 allow attackers to execute arbitrary code by leveraging an unspecified "type confusion," a different vulnerability than CVE-2014-0577, CVE-2014-0584, CVE-2014-0585, and CVE-2014-0590.
[http://helpx.adobe.com/security/products/flash-player/apsb14-24.html]
[openSUSE-SU-2015:0725]
Adobe Flash Player before 13.0.0.259 and 14.x through 16.x before 16.0.0.235 on Windows and OS X and before 11.2.202.425 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-9164.
[http://helpx.adobe.com/security/products/flash-player/apsb14-27.html]
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR before 15.0.0.356, Adobe AIR SDK before 15.0.0.356, and Adobe AIR SDK & Compiler before 15.0.0.356 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2014-0573 and CVE-2014-8438.
<a href="http://cwe.mitre.org/data/definitions/416.html" rel="nofollow">CWE-416: Use After Free</a>
[http://helpx.adobe.com/security/products/flash-player/apsb14-24.html]
[openSUSE-SU-2015:0725]
[20141112 Adobe Flash Player Byte Array Uncompress Use-after-Free Vulnerability]
Heap-based buffer overflow in Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR before 15.0.0.356, Adobe AIR SDK before 15.0.0.356, and Adobe AIR SDK & Compiler before 15.0.0.356 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2014-0582.
[http://helpx.adobe.com/security/products/flash-player/apsb14-24.html]
[openSUSE-SU-2015:0725]
[71051]
Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR before 15.0.0.356, Adobe AIR SDK before 15.0.0.356, and Adobe AIR SDK & Compiler before 15.0.0.356 allow attackers to execute arbitrary code by leveraging an unspecified "type confusion," a different vulnerability than CVE-2014-0577, CVE-2014-0584, CVE-2014-0585, and CVE-2014-0586.
[http://helpx.adobe.com/security/products/flash-player/apsb14-24.html]
[openSUSE-SU-2015:0725]
The query_findclosestnsec3 function in query.c in named in ISC BIND 9.6, 9.7, and 9.8 before 9.8.6-P2 and 9.9 before 9.9.4-P2, and 9.6-ESV before 9.6-ESV-R10-P2, allows remote attackers to cause a denial of service (INSIST assertion failure and daemon exit) via a crafted DNS query to an authoritative nameserver that uses the NSEC3 signing feature.
[APPLE-SA-2014-10-16-3]
[http://linux.oracle.com/errata/ELSA-2014-1244]
[FEDORA-2014-0858]
[FEDORA-2014-0811]
[SUSE-SU-2015:0480]
[openSUSE-SU-2014:0199]
[openSUSE-SU-2014:0202]
[HPSBUX02961]
[RHSA-2014:0043]
[56871]
[61117]
[61199]
[61343]
[DSA-3023]
[FreeBSD-SA-14:04]
[MDVSA-2014:002]
[64801]
[1029589]
[SSA:2014-175-01]
[SSA:2014-028-01]
[USN-2081-1]
[https://bugzilla.redhat.com/show_bug.cgi?id=1051717]
[https://kb.isc.org/article/AA-01078]
[https://kb.isc.org/article/AA-01085]
[https://support.apple.com/kb/HT6536]
Barclamp (aka barclamp-network) 1.7 for the Crowbar Framework, as used in SUSE Cloud 3, does not enable netfilter on bridges when creating new instances, which allows remote attackers to bypass security group restrictions via unspecified vectors, related to floating IPs.
[SUSE-SU-2014:0452]
[66519]
[https://bugzilla.novell.com/show_bug.cgi?id=864183]
[https://github.com/crowbar/barclamp-network/pull/269]
The set_version script as shipped with obs-service-set_version is a source validator for the Open Build Service (OBS). In versions prior to 0.5.3-1.1 this script did not properly sanitize the input provided by the user, allowing for code execution on the executing server.
[https://bugzilla.suse.com/show_bug.cgi?id=866966]
[https://github.com/openSUSE/obs-service-set_version/commit/10d5bddcea29f74a175f7f550924bf6407e52e93]
[[opensuse-buildservice] 20140303 EXE package format]
[https://www.suse.com/de-de/security/cve/CVE-2014-0593/]
In the Open Build Service (OBS) before version 2.4.6 the CSRF protection is incorrectly disabled in the web interface, allowing for requests without the user's consent.
[https://bugzilla.suse.com/show_bug.cgi?id=870606]
[https://github.com/openSUSE/open-build-service/commit/2188c059b67b82171d0e28ef59f77e62d22a09d8]
/opt/novell/ncl/bin/nwrights in Novell Client for Linux in Novell Open Enterprise Server (OES) 11 Linux SP2 does not properly manage a certain array, which allows local users to obtain the S permission in opportunistic circumstances by leveraging the granting of the F permission by an administrator.
[SUSE-SU-2014:0847]
[http://www.novell.com/support/kb/doc.php?id=7014932]
[67144]
Directory traversal vulnerability in iPrint in Novell Open Enterprise Server (OES) 11 SP1 before Maintenance Update 9151 on Linux has unspecified impact and remote attack vectors.
[68066]
[https://bugzilla.novell.com/show_bug.cgi?id=869970]
[https://www.novell.com/support/kb/doc.php?id=7010867]
Cross-site scripting (XSS) vulnerability in iPrint in Novell Open Enterprise Server (OES) 11 SP1 before Maintenance Update 9151 on Linux allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
[https://bugzilla.novell.com/show_bug.cgi?id=869975]
[https://www.novell.com/support/kb/doc.php?id=7010867]
FileUploadServlet in the Administration service in Novell GroupWise 2014 before SP1 allows remote attackers to read or write to arbitrary files via the poLibMaintenanceFileSave parameter, aka ZDI-CAN-2287.
[http://www.novell.com/support/kb/doc.php?id=7015566]
[1030801]
[http://www.zerodayinitiative.com/advisories/ZDI-14-296/]
[https://bugzilla.novell.com/show_bug.cgi?id=879192]
Directory traversal vulnerability in the DumpToFile method in the NQMcsVarSet ActiveX control in NetIQ Security Manager through 6.5.4 allows remote attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2014-3460.
[https://www.netiq.com/support/kb/doc.php?id=7015309]
The rftpcom.dll ActiveX control in Attachmate Reflection FTP Client before 14.1.429 allows remote attackers to cause a denial of service (memory corruption) and execute arbitrary code via vectors related to the (1) GetGlobalSettings or (2) GetSiteProperties3 methods, which triggers a dereference of an arbitrary memory address. NOTE: this issue was MERGED with CVE-2014-0606 because it is the same type of vulnerability, affecting the same set of versions, and discovered by the same researcher.
[http://support.attachmate.com/techdocs/2501.html]
[http://www.zerodayinitiative.com/advisories/ZDI-14-288/]
[http://www.zerodayinitiative.com/advisories/ZDI-14-291/]
Directory traversal vulnerability in the rftpcom.dll ActiveX control in Attachmate Reflection FTP Client before 14.1.429 allows remote attackers to execute arbitrary code via unspecified vectors to the StartLog method.
[http://support.attachmate.com/techdocs/2501.html]
[http://www.zerodayinitiative.com/advisories/ZDI-14-289/]
Directory traversal vulnerability in the rftpcom.dll ActiveX control in Attachmate Reflection FTP Client before 14.1.429 allows remote attackers to execute arbitrary code via unspecified vectors to the SaveSettings method.
[http://support.attachmate.com/techdocs/2501.html]
[http://www.zerodayinitiative.com/advisories/ZDI-14-290/]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-0603. Reason: This issue was MERGED into CVE-2014-0603 in accordance with CVE content decisions, because it is the same type of vulnerability and affects the same versions. Notes: All CVE users should reference CVE-2014-0603 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
Unrestricted file upload vulnerability in Attachmate Verastream Process Designer (VPD) before R6 SP1 Hotfix 1 allows remote attackers to execute arbitrary code by uploading and launching an executable file.
<a href="http://cwe.mitre.org/data/definitions/434.html" target="_blank">CWE-434: Unrestricted Upload of File with Dangerous Type</a>
[http://support.attachmate.com/techdocs/2700.html]
Unspecified vulnerability in Novell Open Enterprise Server (OES) 11 SP1 before Scheduled Maintenance Update 9415 and 11 SP2 before Scheduled Maintenance Update 9413 for Linux has unknown impact and attack vectors.
[59982]
[http://www.novell.com/support/kb/doc.php?id=7010867]
[http://www.novell.com/support/kb/doc.php?id=7014420]
The client in Novell GroupWise before 8.0.3 HP4, 2012 before SP3, and 2014 before SP1 on Windows allows remote attackers to execute arbitrary code or cause a denial of service (invalid pointer dereference) via unspecified vectors.
<a href="http://cwe.mitre.org/data/definitions/476.html">CWE-476: NULL Pointer Dereference</a>
[http://www.novell.com/support/kb/doc.php?id=7015565]
[1030802]
[https://bugzilla.novell.com/show_bug.cgi?id=874533]
[novell-groupwise-cve20140610-code-exec(95738)]
Multiple cross-site scripting (XSS) vulnerabilities in WebAccess in Novell GroupWise 2012 before Support Pack 4 and 2014 before Support Pack 2 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
[http://www.novell.com/support/kb/doc.php?id=7016653]
[1032978]
[https://bugzilla.novell.com/show_bug.cgi?id=909584]
[https://bugzilla.novell.com/show_bug.cgi?id=909586]
[https://bugzilla.novell.com/show_bug.cgi?id=909587]
[https://bugzilla.novell.com/show_bug.cgi?id=909588]
[https://bugzilla.novell.com/show_bug.cgi?id=909590]
[https://bugzilla.novell.com/show_bug.cgi?id=930467]
Unspecified vulnerability in Juniper Junos before 11.4R10-S1, before 11.4R11, 12.1X44 before 12.1X44-D26, 12.1X44 before 12.1X44-D30, 12.1X45 before 12.1X45-D20, and 12.1X46 before 12.1X46-D10, when Dynamic IPsec VPN is configured, allows remote attackers to cause a denial of service (new Dynamic VPN connection failures and CPU and disk consumption) via unknown vectors.
[http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10620]
[1030057]
[66759]
The XNM command processor in Juniper Junos 10.4 before 10.4R16, 11.4 before 11.4R10, 12.1R before 12.1R8-S2, 12.1X44 before 12.1X44-D30, 12.1X45 before 12.1X45-D20, 12.1X46 before 12.1X46-D10, 12.2 before 12.2R7, 12.3 before 12.3R5, 13.1 before 13.1R3-S1, 13.2 before 13.2R2-S2, and 13.3 before 13.3R1, when xnm-ssl or xnm-clear-text is enabled, allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors.
[http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10607]
[1029586]
Juniper Junos 13.2 before 13.2R3 and 13.3 before 13.3R1, when PIM is enabled, allows remote attackers to cause a denial of service (kernel panic and crash) via a large number of crafted IGMP packets.
[http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10618]
[1030062]
[66762]
Juniper Junos 10.4 before 10.4R16, 11.4 before 11.4R10, 12.1R before 12.1R8-S2, 12.1X44 before 12.1X44-D30, 12.1X45 before 12.1X45-D20, 12.1X46 before 12.1X46-D10, 12.2 before 12.2R7, 12.3 before 12.3R5, 13.1 before 13.1R3-S1, 13.2 before 13.2R2, and 13.3 before 13.3R1 allows local users to gain privileges via vectors related to "certain combinations of Junos OS CLI commands and arguments."
[http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10608]
[64762]
[1029585]
Juniper Junos 10.4 before 10.4R16, 11.4 before 11.4R10, 12.1R before 12.1R8-S2, 12.1X44 before 12.1X44-D30, 12.1X45 before 12.1X45-D20, 12.1X46 before 12.1X46-D10, 12.2 before 12.2R7, 12.3 before 12.3R4-S2, 13.1 before 13.1R3-S1, 13.2 before 13.2R2, and 13.3 before 13.3R1 allows remote attackers to cause a denial of service (rdp crash) via a large BGP UPDATE message which immediately triggers a withdraw message to be sent, as demonstrated by a long AS_PATH and a large number of BGP Communities.
[http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10609]
[64766]
[1029582]
Juniper Junos 10.4S before 10.4S15, 10.4R before 10.4R16, 11.4 before 11.4R9, and 12.1R before 12.1R7 on SRX Series service gateways allows remote attackers to cause a denial of service (flowd crash) via a crafted IP packet.
[http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10610]
[64764]
[1029583]
Juniper Junos before 10.4 before 10.4R16, 11.4 before 11.4R8, 12.1R before 12.1R7, 12.1X44 before 12.1X44-D20, and 12.1X45 before 12.1X45-D10 on SRX Series service gateways, when used as a UAC enforcer and captive portal is enabled, allows remote attackers to cause a denial of service (flowd crash) via a crafted HTTP message.
[64769]
[1029584]
[juniper-junos-srx-cve20140618-dos(90238)]
[https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10611]
Untrusted search path vulnerability in Hamster Free ZIP Archiver 2.0.1.7 allows local users to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse dwmapi.dll that is located in the current working directory.
<a href = http://cwe.mitre.org/data/definitions/426.html> CWE-426: Untrusted Search Path </a>
[http://packetstormsecurity.com/files/128739/Hamster-Free-ZIP-Archiver-2.0.1.7-DLL-Hijacking.html]
[hamster-dll-code-execution(97658)]
Multiple cross-site scripting (XSS) vulnerabilities in Technicolor (formerly Thomson) TC7200 STD6.01.12 allow remote attackers to inject arbitrary web script or HTML via the (1) ADDNewDomain parameter to parental/website-filters.asp or (2) VmTracerouteHost parameter to goform/status/diagnostics-route.
[30668]
[64672]
Multiple cross-site request forgery (CSRF) vulnerabilities in Technicolor (formerly Thomson) TC7200 STD6.01.12 allow remote attackers to hijack the authentication of administrators for requests that (1) perform a factory reset via a request to goform/system/factory, (2) disable advanced options via a request to goform/advanced/options, (3) remove ip-filters via the IpFilterAddressDelete1 parameter to goform/advanced/ip-filters, or (4) remove firewall settings via the cbFirewall parameter to goform/advanced/firewall.
[30667]
The web service in EMC Documentum Foundation Services (DFS) 6.5 through 6.7 before 6.7 SP1 P22, 6.7 SP2 before P08, 7.0 before P12, and 7.1 before P01 does not properly implement content uploading, which allows remote authenticated users to bypass intended content access restrictions via unspecified vectors.
[20140205 ESA-2014-005: EMC Documentum Foundation Services (DFS) Content Access Vulnerability]
[102949]
[56845]
[65398]
[emc-documentum-cve20140622-sec-bypass(90982)]
Cross-site scripting (XSS) vulnerability in the Self-Service Console in EMC RSA Authentication Manager 7.1 before SP4 P32 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to a "cross frame scripting" issue.
[20140326 ESA-2014-015: RSA Authentication Manager Cross Frame Scripting Vulnerability]
EMC RSA Data Loss Prevention (DLP) 9.x before 9.6-SP2 does not properly manage sessions, which allows remote authenticated users to gain privileges and bypass intended content-reading restrictions via unspecified vectors.
[20140228 ESA-2014-003: RSA Data Loss Prevention Improper Session Management Vulnerability]
The SSLSocket implementation in the (1) JSAFE and (2) JSSE APIs in EMC RSA BSAFE SSL-J 5.x before 5.1.3 and 6.x before 6.0.2 allows remote attackers to cause a denial of service (memory consumption) by triggering application-data processing during the TLS handshake, a time at which the data is internally buffered.
[20140214 ESA-2014-009: RSA BSAFE SSL-J Multiple Vulnerabilities]
The (1) JSAFE and (2) JSSE APIs in EMC RSA BSAFE SSL-J 5.x before 5.1.3 and 6.x before 6.0.2 make it easier for remote attackers to bypass intended cryptographic protection mechanisms by triggering application-data processing during the TLS handshake, a time at which the data is both unencrypted and unauthenticated.
[20140214 ESA-2014-009: RSA BSAFE SSL-J Multiple Vulnerabilities]
The SSLEngine API implementation in EMC RSA BSAFE SSL-J 5.x before 5.1.3 and 6.x before 6.0.2 allows remote attackers to trigger the selection of a weak cipher suite by using the wrap method during a certain incomplete-handshake state.
[20140214 ESA-2014-009: RSA BSAFE SSL-J Multiple Vulnerabilities]
The server in EMC RSA BSAFE Micro Edition Suite (MES) 4.0.x before 4.0.5 does not properly process certificate chains, which allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors.
[20140324 ESA-2014-011: RSA BSAFE Micro Edition Suite Server Crash Vulnerability]
EMC Documentum TaskSpace (TSP) 6.7SP1 before P25 and 6.7SP2 before P11 does not properly handle the interaction between the dm_world group and the dm_superusers_dynamic group, which allows remote authenticated users to obtain sensitive information and gain privileges in opportunistic circumstances by leveraging an incorrect group-addition implementation.
[20140305 ESA-2014-012: EMC Documentum TaskSpace Multiple Vulnerabilities]
EMC Documentum TaskSpace (TSP) 6.7SP1 before P25 and 6.7SP2 before P11 allows remote authenticated users to read arbitrary files via a modified imaging-service URL.
[20140305 ESA-2014-012: EMC Documentum TaskSpace Multiple Vulnerabilities]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2014. Notes: none.
Directory traversal vulnerability in EMC VPLEX GeoSynchrony 4.x and 5.x before 5.3 allows remote authenticated users to execute arbitrary code via unspecified vectors.
[20140326 ESA-2014-016: EMC VPLEX Multiple Vulnerabilities]
[66513]
The GUI in EMC VPLEX GeoSynchrony 4.x and 5.x before 5.3 does not properly validate session-timeout values, which might make it easier for remote attackers to execute arbitrary code by leveraging an unattended workstation.
[20140326 ESA-2014-016: EMC VPLEX Multiple Vulnerabilities]
EMC VPLEX GeoSynchrony 4.x and 5.x before 5.3 does not include the HTTPOnly flag in a Set-Cookie header for an unspecified cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.
[20140326 ESA-2014-016: EMC VPLEX Multiple Vulnerabilities]
Session fixation vulnerability in EMC VPLEX GeoSynchrony 4.x and 5.x before 5.3 allows remote attackers to hijack web sessions via unspecified vectors.
[20140326 ESA-2014-016: EMC VPLEX Multiple Vulnerabilities]
EMC RSA BSAFE Micro Edition Suite (MES) 3.2.x before 3.2.6 and 4.0.x before 4.0.5 does not properly validate X.509 certificate chains, which allows man-in-the-middle attackers to spoof SSL servers via a crafted certificate chain.
[20140411 ESA-2014-019: RSA BSAFE Micro Edition Suite Certificate Chain Processing Vulnerability]
[66791]
Cross-site scripting (XSS) vulnerability in the back-office case-management application in RSA Adaptive Authentication (On-Premise) 6.x and 7.x before 7.1 SP0 P2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
[20140401 ESA-2014-020: RSA Adaptive Authentication (On-Premise) Multiple Vulnerabilities]
Cross-site scripting (XSS) vulnerability in RSA Adaptive Authentication (On-Premise) 6.x and 7.x before 7.1 SP0 P2 allows remote attackers to inject arbitrary web script or HTML via vectors involving FRAME elements, related to a "cross-frame scripting" issue.
[20140401 ESA-2014-020: RSA Adaptive Authentication (On-Premise) Multiple Vulnerabilities]
Multiple cross-site scripting (XSS) vulnerabilities in EMC RSA Archer 5.x before GRC 5.4 SP1 P3 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
[20140523 ESA-2014-021: RSA Archer GRC Multiple Cross-Site Scripting Vulnerabilities]
[http://packetstormsecurity.com/files/126788/RSA-Archer-GRC-Cross-Site-Scripting.html]
[67602]
[1030281]
EMC RSA Archer GRC Platform 5.x before 5.5 SP1 allows remote authenticated users to bypass intended restrictions on resource access via unspecified vectors.
[20140819 ESA-2014-071: RSA Archer GRC Platform Multiple Vulnerabilities]
[69288]
[1030738]
[rsaarcher-cve20140640-info-disc(95362)]
Cross-site request forgery (CSRF) vulnerability in EMC RSA Archer GRC Platform 5.x before 5.5 SP1 allows remote attackers to hijack the authentication of arbitrary users.
[20140819 ESA-2014-071: RSA Archer GRC Platform Multiple Vulnerabilities]
[69289]
[1030738]
[rsaarcher-cve20140641-csrf (95361)]
EMC Documentum Content Server before 6.7 SP1 P26, 6.7 SP2 before P13, 7.0 before P13, and 7.1 before P02 allows remote authenticated users to bypass intended access restrictions and read metadata from certain folders via unspecified vectors.
[20140411 ESA-2014-026: EMC Documentum Content Server Information Disclosure Vulnerability]
[http://twitter.com/artika4biz/statuses/455358950116823040]
EMC RSA NetWitness before 9.8.5.19 and RSA Security Analytics before 10.2.4 and 10.3.x before 10.3.2, when Kerberos PAM is enabled, do not require a password, which allows remote attackers to bypass authentication by leveraging knowledge of a valid account name.
[20140512 ESA-2014-027: RSA NetWitness and RSA Security Analytics Authentication Bypass Vulnerability]
EMC Cloud Tiering Appliance (CTA) 10 through SP1 allows remote attackers to read arbitrary files via an api/login request containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, as demonstrated by reading the /etc/shadow file.
[20140416 ESA-2014-028: EMC Cloud Tiering Appliance XML External Entity (XXE) and Information Disclosure Vulnerabilities]
[20140331 EMC CTA v10.0 unauthenticated XXE with root perms]
[https://gist.github.com/brandonprry/9895721]
EMC Cloud Tiering Appliance (CTA) 9.x through 10 SP1 and File Management Appliance (FMA) 7.x store DES password hashes for the root, super, and admin accounts, which makes it easier for context-dependent attackers to obtain sensitive information via a brute-force attack.
[20140416 ESA-2014-028: EMC Cloud Tiering Appliance XML External Entity (XXE) and Information Disclosure Vulnerabilities]
[20140331 EMC CTA v10.0 unauthenticated XXE with root perms]
[https://gist.github.com/brandonprry/9895721]
The runtime WS component in the server in EMC RSA Access Manager 6.1.3 before 6.1.3.39, 6.1.4 before 6.1.4.22, 6.2.0 before 6.2.0.11, and 6.2.1 before 6.2.1.03, when INFO logging is enabled, allows local users to discover cleartext passwords by reading log files.
[20140430 ESA-2014-029: RSA Access Manager Sensitive Information Disclosure Vulnerability]
The Starbucks 2.6.1 application for iOS stores sensitive information in plaintext in the Crashlytics log file (/Library/Caches/com.crashlytics.data/com.starbucks.mystarbucks/session.clslog), which allows attackers to discover usernames, passwords, and e-mail addresses via an application that reads session.clslog.
[20140117 Re: [CVE-2014-0647] Insecure Data Storage of User Data Elements in Starbucks v2.6.1 iOS mobile application]
[20140113 [CVE-2014-0647] Insecure Data Storage of User Data Elements in Starbucks v2.6.1 iOS mobile application]
[20140114 [CVE-2014-0647] Insecure Data Storage of User Data Elements in Starbucks v2.6.1 iOS mobile application]
[64942]
[http://www.zdnet.com/starbucks-fixes-ios-app-bugs-7000025323/]
[http://www.zdnet.com/the-starbucks-bug-not-as-awful-as-reported-7000025269/]
[starbucks-cve20140647-info-disclosure(90412)]
[https://itunes.apple.com/us/app/starbucks/id331177714?mt=8]
The RMI interface in Cisco Secure Access Control System (ACS) 5.x before 5.5 does not properly enforce authentication and authorization requirements, which allows remote attackers to obtain administrative access via a request to this interface, aka Bug ID CSCud75187.
[20140115 Multiple Vulnerabilities in Cisco Secure Access Control System]
[http://tools.cisco.com/security/center/viewAlert.x?alertId=32379]
[64962]
[1029634]
[cisco-acs-cve20140648-unauth-access(90431)]
The RMI interface in Cisco Secure Access Control System (ACS) 5.x before 5.5 does not properly enforce authorization requirements, which allows remote authenticated users to obtain superadmin access via a request to this interface, aka Bug ID CSCud75180.
[20140115 Multiple Vulnerabilities in Cisco Secure Access Control System]
[http://tools.cisco.com/security/center/viewAlert.x?alertId=32378]
[64958]
[1029634]
[cisco-acs-cve20140649-priv-esc(90430)]
The web interface in Cisco Secure Access Control System (ACS) 5.x before 5.4 Patch 3 allows remote attackers to execute arbitrary operating-system commands via a request to this interface, aka Bug ID CSCue65962.
[20140115 Multiple Vulnerabilities in Cisco Secure Access Control System]
[http://tools.cisco.com/security/center/viewAlert.x?alertId=32380]
[64964]
[1029634]
[cisco-acs-cve20140650-command-exec(90432)]
The administrative interface in Cisco Context Directory Agent (CDA) does not properly enforce authorization requirements, which allows remote authenticated users to obtain administrative access by hijacking a session, aka Bug ID CSCuj45347.
[20140107 Cisco Context Directory Agent Privilege Escalation Vulnerability]
[http://tools.cisco.com/security/center/viewAlert.x?alertId=32364]
[64706]
[1029573]
[cisco-cda-cve20140651-priv-esc(90166)]
Cross-site scripting (XSS) vulnerability in the Mappings page in Cisco Context Directory Agent (CDA) allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCuj45358.
[20140107 Cisco Context Directory Agent Mappings Page Cross-Site Scripting Vulnerability]
[http://tools.cisco.com/security/center/viewAlert.x?alertId=32365]
[64703]
[1029572]
[cisco-cda-cve20140652-xss(90167)]
The Identity Firewall (IDFW) functionality in Cisco Adaptive Security Appliance (ASA) Software allows remote attackers to trigger authentication-state modifications via a crafted NetBIOS logout probe response, aka Bug ID CSCuj45340.
[20140107 Cisco Adaptive Security Appliance Identity Firewall NetBIOS Logout Probe Auth State Change Vulnerability]
[http://tools.cisco.com/security/center/viewAlert.x?alertId=32363]
[64708]
[1029570]
[cisco-asa-cve20140653-sec-bypass(90165)]
Cisco Context Directory Agent (CDA) allows remote attackers to modify the cache via a replay attack involving crafted RADIUS accounting messages, aka Bug ID CSCuj45383.
[20140107 Cisco Context Directory Agent Replayed RADIUS Accounting Message Vulnerability]
[http://tools.cisco.com/security/center/viewAlert.x?alertId=32366]
[64709]
[1029574]
[cisco-cda-cve20140654-sec-bypass(90168)]
The Identity Firewall (IDFW) functionality in Cisco Adaptive Security Appliance (ASA) Software allows remote attackers to change the user-cache contents via a replay attack involving crafted RADIUS Change of Authorization (CoA) messages, aka Bug ID CSCuj45332.
[20140107 Cisco Adaptive Security Appliance RADIUS Change of Authorization Message Replay Vulnerability]
[http://tools.cisco.com/security/center/viewAlert.x?alertId=32362]
[64700]
[1029575]
[cisco-asa-cve20140655-sec-bypass(90164)]
Cisco Context Directory Agent (CDA) allows remote authenticated users to trigger the omission of certain user-interface data via crafted field values, aka Bug ID CSCuj45353.
[20140107 Cisco Context Directory Agent Hidden Input Vulnerability]
[64701]
[1029569]
[cisco-cda-cve20140656-sec-bypass(90169)]
The administration portal in Cisco Unified Communications Manager (Unified CM) 9.1(1) and earlier does not properly handle role restrictions, which allows remote authenticated users to bypass role-based access control via multiple visits to a forbidden portal URL, aka Bug ID CSCuj83540.
[20140107 Cisco Unified Communications Manager Role Bypass Vulnerability]
[http://tools.cisco.com/security/center/viewAlert.x?alertId=32341]
[64690]
[1029571]
[cisco-ucm-cve20140657-sec-bypass(90120)]
Cisco 9900 Unified IP phones allow remote attackers to cause a denial of service (unregistration) via a crafted SIP header, aka Bug ID CSCul24898.
[20140110 Cisco 9900 Series IP Phone Crafted Header Unregister Vulnerability]
[http://tools.cisco.com/security/center/viewAlert.x?alertId=32402]
[64770]
[1029596]
[cisco-unified-cve20140658-dos(90236)]
The Cisco WAP4410N access point with firmware through 2.0.6.1, WRVS4400N router with firmware 1.x through 1.1.13 and 2.x through 2.0.2.1, and RVS4000 router with firmware through 2.0.3.2 allow remote attackers to read credential and configuration data, and execute arbitrary commands, via requests to the test interface on TCP port 32764, aka Bug IDs CSCum37566, CSCum43693, CSCum43700, and CSCum43685.
[20140110 Undocumented Test Interface in Cisco Small Business Devices]
[http://tools.cisco.com/security/center/viewAlert.x?alertId=32381]
[64776]
[1029579]
[1029580]
[cisco-small-cve20140659-priv-esc(90233)]
[https://github.com/elvanderb/TCP-32764]
Cisco TelePresence ISDN Gateway with software before 2.2(1.92) allows remote attackers to cause a denial of service (D-channel call outage) via a crafted Q.931 STATUS message, aka Bug ID CSCui50360.
[20140122 Cisco TelePresence ISDN Gateway D-Channel Denial of Service Vulnerability]
[http://tools.cisco.com/security/center/viewAlert.x?alertId=32460]
[65072]
[1029657]
[cisco-isdn-cve20140660-dos(90622)]
The System Status Collection Daemon (SSCD) in Cisco TelePresence System 500-37, 1000, 1300-65, and 3xxx before 1.10.2(42), and 500-32, 1300-47, TX1310 65, and TX9xxx before 6.0.4(11), allows remote attackers to execute arbitrary commands or cause a denial of service (stack memory corruption) via a crafted XML-RPC message, aka Bug ID CSCui32796.
[20140122 Cisco TelePresence System Software Command Execution Vulnerability]
[65071]
[1029656]
[cisco-telepresence-cve20140661-command-exec(90624)]
The SIP module in Cisco TelePresence Video Communication Server (VCS) before 8.1 allows remote attackers to cause a denial of service (process failure) via a crafted SDP message, aka Bug ID CSCue97632.
[20140122 Cisco TelePresence Video Communication Server SIP Denial of Service Vulnerability]
[http://tools.cisco.com/security/center/viewAMBAlert.x?alertId=32409]
[65076]
[1029655]
[cisco-vcs-cve20140662-dos(90621)]
Cross-site scripting (XSS) vulnerability in the web framework in Cisco Secure Access Control System (ACS) allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCum03625.
[20140110 Cisco Secure Access Control System Cross-Site Scripting Vulnerability]
[http://tools.cisco.com/security/center/viewAlert.x?alertId=32403]
[64773]
[1029595]
[cisco-acs-cve20140663-xss(90232)]
The server in Cisco Unity Connection allows remote authenticated users to cause a denial of service (CPU consumption) via unspecified IMAP commands, aka Bug ID CSCul49976.
[20140110 Cisco Unity Connection Internet Message Access Protocol Denial of Service Vulnerability]
[64772]
[1029593]
[cisco-unity-cve20140664-dos(90234)]
The RBAC implementation in Cisco Identity Services Engine (ISE) Software does not properly verify privileges for support-bundle downloads, which allows remote authenticated users to obtain sensitive information via a download action, as demonstrated by obtaining read access to the user database, aka Bug ID CSCul83904.
[20140115 Cisco ISE Unprivileged Support Bundle Download Vulnerability]
[http://tools.cisco.com/security/center/viewAlert.x?alertId=32448]
[64939]
[1029624]
[cisco-ise-cve2040665-unsuth-access(90463)]
Directory traversal vulnerability in the Send Screen Capture implementation in Cisco Jabber 9.2(.1) and earlier on Windows allows remote attackers to upload arbitrary types of files, and consequently execute arbitrary code, via modified packets, aka Bug ID CSCug48056.
[20140115 Cisco Jabber for Windows Remote Code Execution Vulnerability]
[http://tools.cisco.com/security/center/viewAlert.x?alertId=32451]
[64965]
[1029635]
[cisco-jabber-cve20140666-code-exec(90435)]
The RMI interface in Cisco Secure Access Control System (ACS) does not properly enforce authorization requirements, which allows remote authenticated users to read arbitrary files via a request to this interface, aka Bug ID CSCud75169.
[20140116 Cisco Secure ACS RMI Arbitrary File Read Vulnerability]
[http://tools.cisco.com/security/center/viewAlert.x?alertId=32468]
[64983]
[1029641]
[cisco-acs-cve20140667-info-disc(90497)]
Cross-site scripting (XSS) vulnerability in the portal in Cisco Secure Access Control System (ACS) allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCue65949.
[20140117 Cisco Secure ACS Portal Cross-Site Scripting Vulnerability]
[http://tools.cisco.com/security/center/viewAlert.x?alertId=32489]
[65016]
[1029654]
[cisco-acs-cve20140668-xss(90561)]
The Wireless Session Protocol (WSP) feature in the Gateway GPRS Support Node (GGSN) component on Cisco ASR 5000 series devices allows remote attackers to bypass intended Top-Up payment restrictions via unspecified WSP packets, aka Bug ID CSCuh28371.
[20140121 Cisco ASR 5000 Series Gateway GPRS Support Node Traffic Bypass Vulnerability]
[http://tools.cisco.com/security/center/viewAlert.x?alertId=32513]
[65052]
[1029666]
[cisco-ggsn-cve20140669-sec-bypass(90614)]
Cross-site scripting (XSS) vulnerability in the Search and Play interface in Cisco MediaSense allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCum16686.
[20140121 Cisco MediaSense Search and Play Cross-Site Scripting Vulnerability]
[http://tools.cisco.com/security/center/viewAlert.x?alertId=32514]
[65053]
[1029667]
[cisco-mediasense-cve20140670-xss(90615)]
Open redirect vulnerability in Cisco MediaSense allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via an unspecified parameter, aka Bug ID CSCum16749.
[20140121 Cisco MediaSense Open Redirection Vulnerability]
[http://tools.cisco.com/security/center/viewAlert.x?alertId=32517]
[65055]
[1029669]
[cisco-mediasense-cve20140671-open-redirect(90617)]
The Search and Play interface in Cisco MediaSense does not properly enforce authorization requirements, which allows remote authenticated users to download arbitrary recordings via a request to this interface.
[20140121 Cisco MediaSense Search and Play Authorization Vulnerability]
[http://tools.cisco.com/security/center/viewAlert.x?alertId=32516]
[65054]
[1029668]
[cisco-mediasense-cve20140672-info-disc(90616)]
Multiple cross-site scripting (XSS) vulnerabilities in the web interface on Cisco Video Surveillance 5000 HD IP Dome cameras allow remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug IDs CSCud10943 and CSCud10950.
[20140124 Cisco Video Surveillance 5000 Series HD IP Dome Camera Multiple Cross-Site Scripting Vulnerabilities]
[http://tools.cisco.com/security/center/viewAlert.x?alertId=32568]
[65145]
[1029689]
[cisco-video-cve20140673-xss(90733)]
Cisco Video Surveillance Operations Manager (VSOM) does not require authentication for MySQL database connections, which allows remote attackers to obtain sensitive information, modify data, or cause a denial of service by leveraging network connectivity from a client system with a crafted host name, aka Bug ID CSCud10992.
[20140123 Cisco Video Surveillance Operations Manager MySQL Database Insufficient Authentication Controls]
[65111]
[1029692]
[cisco-vsom-cve20140674-unauth-access(90651)]
The Expressway component in Cisco TelePresence Video Communication Server (VCS) uses the same default X.509 certificate across different customers' installations, which makes it easier for remote attackers to conduct man-in-the-middle attacks against SSL sessions by leveraging the certificate's trust relationship, aka Bug ID CSCue07471.
[20140122 Cisco TelePresence Video Communication Server Expressway Default SSL Certificate Vulnerability]
[http://tools.cisco.com/security/center/viewAlert.x?alertId=32540]
[65101]
[1029682]
[cisco-telepresence-cve20140675-mitm(90650)]
Cisco NX-OS allows local users to bypass intended TACACS+ command restrictions via a series of multiple commands, aka Bug ID CSCum47367.
[20140122 Cisco NX-OS Software TACACS+ Command Authorization Vulnerability]
[http://tools.cisco.com/security/center/viewAlert.x?alertId=32531]
[65083]
[1029690]
[cisco-nxos-cve20140676-priv-esc(90627)]
The Label Distribution Protocol (LDP) functionality in Cisco NX-OS allows remote attackers to cause a denial of service (temporary LDP session outage) via LDP discovery traffic containing malformed Hello messages, aka Bug ID CSCul88851.
[20140122 Cisco NX-OS Software Label Distribution Protocol Message Vulnerability]
[http://tools.cisco.com/security/center/viewAlert.x?alertId=32532]
[65074]
[1029691]
[cisco-nxos-cve20140677-dos(90623)]
The portal interface in Cisco Secure Access Control System (ACS) does not properly manage sessions, which allows remote authenticated users to hijack sessions and gain privileges via unspecified vectors, aka Bug ID CSCue65951.
[20140124 Cisco Secure ACS Portal Session Management Vulnerability]
[http://tools.cisco.com/security/center/viewAlert.x?alertId=32567]
[65144]
[1029688]
[cisco-acs-cve20140678-unauth-access(90732)]
Cisco Prime Infrastructure 1.2 and 1.3 before 1.3.0.20-2, 1.4 before 1.4.0.45-2, and 2.0 before 2.0.0.0.294-2 allows remote authenticated users to execute arbitrary commands with root privileges via an unspecified URL, aka Bug ID CSCum71308.
[20140226 Cisco Prime Infrastructure Command Execution Vulnerability]
Cross-site scripting (XSS) vulnerability in the HTTP control interface in the NAC Web Agent component in Cisco Identity Services Engine (ISE) allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCui15038.
[20140128 Cisco Identity Services Engine HTTP Control Interface for NAC Web Agent Cross-Site Scripting Vulnerability]
[http://tools.cisco.com/security/center/viewAlert.x?alertId=32617]
[65227]
[1029701]
Cross-site scripting (XSS) vulnerability in Cisco Identity Services Engine (ISE) 1.2 patch 2 and earlier allows remote attackers to inject arbitrary web script or HTML via a report containing a crafted URL that is not properly handled during generation of report-output pages, aka Bug ID CSCui15064.
[20140128 Cisco Identity Services Engine Reports Output Cross-Site Scripting Vulnerability]
[http://tools.cisco.com/security/center/viewAlert.x?alertId=32609]
[65183]
[1029699]
Cisco WebEx Meetings Server allows remote authenticated users to bypass authorization checks and (1) join arbitrary meetings, or (2) terminate a meeting without having a host role, via a crafted URL, aka Bug ID CSCuj42346.
[56668]
[20140128 Cisco WebEx Meetings Server Unauthorized Meeting Actions Vulnerability]
[http://tools.cisco.com/security/center/viewAlert.x?alertId=32618]
[65198]
[1029700]
The web management interface on the Cisco RV110W firewall with firmware 1.2.0.9 and earlier, RV215W router with firmware 1.1.0.5 and earlier, and CVR100W router with firmware 1.0.1.19 and earlier does not prevent replaying of modified authentication requests, which allows remote attackers to obtain administrative access by leveraging the ability to intercept requests, aka Bug IDs CSCul94527, CSCum86264, and CSCum86275.
[20140305 Cisco Small Business Router Password Disclosure Vulnerability]
[45986]
Cisco NX-OS 6.2(2) on Nexus 7000 switches allows local users to cause a denial of service via crafted sed input, aka Bug ID CSCui56136.
[20140505 Cisco Nexus 7000 Denial of Service Vulnerability]
[http://tools.cisco.com/security/center/viewAlert.x?alertId=34131]
Cisco Nexus 1000V InterCloud 5.2(1)IC1(1.2) and earlier for VMware allows remote attackers to bypass ACL deny statements via crafted (1) IGMPv2 or (2) IGMPv3 packets, aka Bug ID CSCug61691.
[20140505 Cisco Nexus 1000V Access Control List Bypass Vulnerability]
[http://tools.cisco.com/security/center/viewAlert.x?alertId=34130]
Cisco Unified Communications Manager (aka Unified CM) 9.1 (2.10000.28) and earlier allows local users to gain privileges by leveraging incorrect file permissions, aka Bug IDs CSCul24917 and CSCul24908.
[102750]
[56818]
[20140131 Cisco Unified Communications Manager Operating System-Level Privilege Escalation Vulnerability]
[http://tools.cisco.com/security/center/viewAlert.x?alertId=32683]
[65281]
[cisco-ucm-cve20140686-priv-esc(90852)]
Cisco WebEx Meetings Server before 1.1 uses meeting IDs with insufficient entropy, which makes it easier for remote attackers to bypass authentication and join arbitrary meetings without a password, aka Bug ID CSCuc79643.
[https://www.cisco.com/c/en/us/td/docs/collaboration/CWMS/1_1/b_Release_Notes.html]
Intelligent Automation for Cloud (IAC) in Cisco Cloud Portal 9.4.1 and earlier includes a cryptographic key in binary files, which makes it easier for remote attackers to obtain cleartext data from an arbitrary IAC installation by leveraging knowledge of this key, aka Bug IDs CSCui34764, CSCui34772, CSCui34776, CSCui34798, CSCui34800, CSCui34805, CSCui34809, CSCui34810, CSCui34813, CSCui34814, and CSCui34818.
[20140312 Cisco Intelligent Automation for Cloud Cryptographic Implementation Issues]
[http://tools.cisco.com/security/center/viewAlert.x?alertId=33336]
Cisco Wireless LAN Controller (WLC) devices 7.0 before 7.0.250.0, 7.2, 7.3, and 7.4 before 7.4.110.0 do not properly deallocate memory, which allows remote attackers to cause a denial of service (reboot) by sending WebAuth login requests at a high rate, aka Bug ID CSCuf52361.
[20140305 Multiple Vulnerabilities in Cisco Wireless LAN Controllers]
Cisco Wireless LAN Controller (WLC) devices 7.4 before 7.4.110.0 distribute Aironet IOS software with a race condition in the status of the administrative HTTP server, which allows remote attackers to bypass intended access restrictions by connecting to an Aironet access point on which this server had been disabled ineffectively, aka Bug ID CSCuf66202.
[20140305 Multiple Vulnerabilities in Cisco Wireless LAN Controllers]
The IGMP implementation on Cisco Wireless LAN Controller (WLC) devices 4.x, 5.x, 6.x, 7.0 before 7.0.250.0, 7.1, 7.2, and 7.3, when IGMPv3 Snooping is enabled, allows remote attackers to cause a denial of service (memory over-read and device restart) via a crafted field in an IGMPv3 message, aka Bug ID CSCuh33240.
[20140305 Multiple Vulnerabilities in Cisco Wireless LAN Controllers]
The multicast listener discovery (MLD) service on Cisco Wireless LAN Controller (WLC) devices 7.2, 7.3, 7.4 before 7.4.121.0, and 7.5, when MLDv2 Snooping is enabled, allows remote attackers to cause a denial of service (device restart) via a malformed IPv6 MLDv2 packet, aka Bug ID CSCuh74233.
[20140305 Multiple Vulnerabilities in Cisco Wireless LAN Controllers]
Cisco Wireless LAN Controller (WLC) devices 7.2 before 7.2.115.2, 7.3, and 7.4 before 7.4.110.0 allow remote attackers to cause a denial of service (device restart) via a crafted 802.11 Ethernet frame, aka Bug ID CSCue87929.
[20140305 Multiple Vulnerabilities in Cisco Wireless LAN Controllers]
Cisco Wireless LAN Controller (WLC) devices 7.2, 7.3, and 7.4 before 7.4.110.0 allow remote attackers to cause a denial of service (device restart) via a crafted 802.11 Ethernet frame, aka Bug ID CSCuf80681.
[20140305 Multiple Vulnerabilities in Cisco Wireless LAN Controllers]
WebEx Meeting Center in Cisco WebEx Business Suite does not properly compose URLs for HTTP GET requests, which allows remote attackers to obtain sensitive information by reading (1) web-server access logs, (2) web-server Referer logs, or (3) a browser's history, aka Bug ID CSCul98272.
[20140318 Cisco WebEx Business Suite HTTP GET Parameters Include Sensitive Information]
Cisco UCS Director (formerly Cloupia) before 4.0.0.3 has a hardcoded password for the root account, which makes it easier for remote attackers to obtain administrative access via an SSH session to the CLI interface, aka Bug ID CSCui73930.
[20140219 Cisco UCS Director Default Credentials Vulnerability]
Race condition in the cut-through proxy feature in Cisco Firewall Services Module (FWSM) Software 3.x before 3.2(28) and 4.x before 4.1(15) allows remote attackers to cause a denial of service (device reload) via certain matching traffic, aka Bug ID CSCuj16824.
[20140219 Cisco Firewall Services Module Cut-Through Proxy Denial of Service Vulnerability]
The produce-verbose-alert feature in Cisco IPS Software 7.1 before 7.1(8)E4 and 7.2 before 7.2(2)E4 allows remote attackers to cause a denial of service (Analysis Engine process outage) via fragmented packets, aka Bug ID CSCui91266.
[20140219 Multiple Vulnerabilities in Cisco IPS Software]
The control-plane access-list implementation in Cisco IPS Software before 7.1(8p2)E4 and 7.2 before 7.2(2)E4 allows remote attackers to cause a denial of service (MainApp process outage) via crafted packets to TCP port 7000, aka Bug ID CSCui67394.
[20140219 Multiple Vulnerabilities in Cisco IPS Software]
Cisco IPS Software 7.1 before 7.1(8)E4 and 7.2 before 7.2(2)E4 allows remote attackers to cause a denial of service (Analysis Engine process outage) via a flood of jumbo frames, aka Bug ID CSCuh94944.
[20140219 Multiple Vulnerabilities in Cisco IPS Software]
The Cisco Unified SIP Phone 3905 with firmware before 9.4(1) allows remote attackers to obtain root access via a session on the test interface on TCP port 7870, aka Bug ID CSCuh75574.
[20140219 Unauthorized Access Vulnerability in Cisco Unified SIP Phone 3905]
The log4jinit web application in Cisco Unified Communications Manager (UCM) does not properly validate authentication, which allows remote attackers to cause a denial of service (performance degradation) via unspecified use of this application, aka Bug ID CSCum05347.
[20140211 Cisco Unified Communications Manager Unauthenticated log4jinit Access Vulnerability]
Cross-site scripting (XSS) vulnerability in the IP Manager Assistant (IPMA) interface in Cisco Unified Communications Manager (UCM) allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCum05343.
[20140211 Cisco Unified Communications Manager IPMA Cross-Site Scripting Vulnerability]
[65495]
[1029756]
The bulk administration interface in Cisco Unified Communications Manager (UCM) 10.0(1) and earlier allows remote attackers to bypass authentication and read arbitrary files by using an unspecified prompt, aka Bug ID CSCum05340.
[20140211 Cisco Unified Communications Manager Arbitrary File Read Vulnerability]
[http://tools.cisco.com/security/center/viewAlert.x?alertId=32825]
Cisco Unified Communications Manager (UCM) does not require authentication for reading WAR files, which allows remote attackers to obtain sensitive information via unspecified access to a "file storage location," aka Bug ID CSCum05337.
[20140212 Cisco Unified Communications Manager WAR File Availability Vulnerability]
SQL injection vulnerability in the IP Manager Assistant (IPMA) interface in Cisco Unified Communications Manager (UCM) 10.0(1) and earlier allows remote attackers to execute arbitrary SQL commands via a crafted URL, aka Bug ID CSCum05326.
[20140212 Cisco Unified Communications Manager IPMA Blind SQL Injection Vulnerability]
[http://tools.cisco.com/security/center/viewAlert.x?alertId=32843]
[65514]
SQL injection vulnerability in the CallManager Interactive Voice Response (CMIVR) interface in Cisco Unified Communications Manager (UCM) allows remote attackers to execute arbitrary SQL commands via a crafted URL, aka Bug ID CSCum05318.
[20140212 Cisco Unified Communications Manager CMIVR Blind SQL Injection Vulnerability]
[65516]
SQL injection vulnerability in the Java database interface in Cisco Unified Communications Manager (UCM) 10.0(1) and earlier allows remote attackers to execute arbitrary SQL commands via a crafted URL, aka Bug ID CSCum05313.
[20140211 Cisco Unified Communications Manager Java Interface SQL Injection Vulnerability]
[http://tools.cisco.com/security/center/viewAlert.x?alertId=32834]
[65499]
SQL injection vulnerability in the Enterprise Mobility Application (EMApp) interface in Cisco Unified Communications Manager (UCM) allows remote attackers to execute arbitrary SQL commands via a crafted URL, aka Bug ID CSCum05302.
[20140211 Cisco Unified Communications Manager Enterprise Mobility Application Blind SQL Injection Vulnerability]
[65501]
Cisco Unified Computing System (UCS) Central Software 1.1 and earlier allows local users to gain privileges via a CLI copy command in a local-mgmt context, aka Bug ID CSCul53128.
[20140218 Cisco Unified Computing System Central Software Privilege Escalation Vulnerability]
[http://tools.cisco.com/security/center/viewAlert.x?alertId=32910]
The administration interface in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier allows remote attackers to bypass authentication and read Java class files via a direct request, aka Bug ID CSCum46497.
[20140218 Cisco Unified Communications Manager Java Class File Availability Vulnerability]
[http://tools.cisco.com/security/center/viewAlert.x?alertId=32915]
The Real Time Monitoring Tool (RTMT) web application in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier does not properly enforce authentication requirements, which allows remote attackers to read application files via a direct request to a URL, aka Bug ID CSCum46495.
[20140218 Cisco Unified Communications Manager Real Time Monitoring Tool Information Disclosure Vulnerability]
[http://tools.cisco.com/security/center/viewAlert.x?alertId=32913]
The Enterprise License Manager (ELM) component in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier does not properly enforce authentication requirements, which allows remote attackers to read ELM files via a direct request to a URL, aka Bug ID CSCum46494.
[20140218 Cisco Unified Communications Manager Enterprise License Manager Information Disclosure Vulnerability]
[http://tools.cisco.com/security/center/viewAlert.x?alertId=32914]
SQL injection vulnerability in the Certificate Authority Proxy Function (CAPF) implementation in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier allows remote attackers to execute arbitrary SQL commands via a crafted URL, aka Bug ID CSCum46483.
[20140218 Cisco Unified Communications Manager CAPF Unauthenticated Blind SQL Injection Vulnerability]
[http://tools.cisco.com/security/center/viewAlert.x?alertId=32916]
[65645]
Cross-site scripting (XSS) vulnerability in the IP Manager Assistant (IPMA) interface in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCum46470.
[20140218 Cisco Unified Communications Manager IPMA Reflected Cross-Site Scripting Vulnerability]
[http://tools.cisco.com/security/center/viewAlert.x?alertId=32912]
[65641]
[1029793]
Cross-site request forgery (CSRF) vulnerability in the Call Detail Records Analysis and Reporting (CAR) page in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier allows remote attackers to hijack the authentication of arbitrary users for requests that make CAR modifications, aka Bug ID CSCum46468.
[20140218 Cisco Unified Communications Manager CAR Page CSRF Vulnerability]
[http://tools.cisco.com/security/center/viewAlert.x?alertId=32911]
[1029792]
The Cisco Unified IP Phone 7960G 9.2(1) and earlier allows remote attackers to bypass authentication and change trust relationships by injecting a Certificate Trust List (CTL) file, aka Bug ID CSCuj66795.
[20140220 Cisco Third-Generation IP Phone CTL Trust Chain Enforcement Vulnerability]
[http://tools.cisco.com/security/center/viewAlert.x?alertId=32957]
The Phone Proxy component in Cisco Adaptive Security Appliance (ASA) Software 9.1(.3) and earlier allows remote attackers to bypass authentication and change trust relationships by injecting a Certificate Trust List (CTL) file, aka Bug ID CSCuj66770.
[20140220 Cisco Adaptive Security Appliance Phone Proxy CTL Authentication Vulnerability]
[http://tools.cisco.com/security/center/viewAlert.x?alertId=32956]
Race condition in the Phone Proxy component in Cisco Adaptive Security Appliance (ASA) Software 9.1(.3) and earlier allows remote attackers to bypass sec_db authentication and provide certain pass-through services to untrusted devices via a crafted configuration-file TFTP request, aka Bug ID CSCuj66766.
[20140220 Cisco Adaptive Security Appliance Phone Proxy sec_db Race Condition Vulnerability]
[http://tools.cisco.com/security/center/viewAlert.x?alertId=32955]
Cross-site request forgery (CSRF) vulnerability in the Call Detail Records Analysis and Reporting (CAR) interface in the OS Administration component in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier allows remote attackers to hijack the authentication of administrators for requests that make administrative changes, aka Bug ID CSCun00701.
[20140225 Cisco Unified Communications Manager OS Administration CSRF Vulnerability]
[http://tools.cisco.com/security/center/viewAlert.x?alertId=33049]
[1029843]
The certificate-import feature in the Certificate Authority Proxy Function (CAPF) CLI implementation in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier allows local users to read or modify arbitrary files via a crafted command, aka Bug ID CSCum95461.
[20140225 Cisco Unified Communications Manager CAPF Certificate Import Arbitrary File Read/Write Vulnerability]
[http://tools.cisco.com/security/center/viewAlert.x?alertId=33046]
[1029843]
The Certificate Authority Proxy Function (CAPF) CLI implementation in the CSR management feature in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier allows local users to read or modify arbitrary files via unspecified vectors, aka Bug ID CSCum95464.
[20140225 Cisco Unified Communications Manager CAPF CSR Arbitrary File Read/Write Vulnerability]
[http://tools.cisco.com/security/center/viewAlert.x?alertId=33045]
[1029843]
The Certificate Authority Proxy Function (CAPF) component in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier allows remote attackers to bypass authentication and modify registered-device information via crafted data, aka Bug ID CSCum95468.
[20140225 Cisco Unified Communications Manager CAPF Unauthenticated Device Information Update Vulnerability]
[http://tools.cisco.com/security/center/viewAlert.x?alertId=33044]
[1029843]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2014. Notes: none.
Cross-site request forgery (CSRF) vulnerability in the Unified Serviceability subsystem in Cisco Unified Contact Center Express (Unified CCX) allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCum95502.
[20140225 Cisco Unified Contact Center Express Serviceability Page CSRF Vulnerability]
[1029842]
The disaster recovery system (DRS) in Cisco Unified Contact Center Express (Unified CCX) allows remote authenticated users to obtain sensitive information by reading extraneous fields in an HTML document, aka Bug ID CSCum95536.
[20140225 Cisco Unified Contact Center Express DRS Sensitive Information Disclosure Vulnerability]
[1029842]
The Certificate Authority Proxy Function (CAPF) CLI implementation in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier allows local users to inject commands via unspecified CAPF programs, aka Bug ID CSCum95493.
[20140225 Cisco Unified Communications Manager CAPF CLI Command Injection Vulnerability]
[http://tools.cisco.com/security/center/viewAlert.x?alertId=33048]
[1029843]
apinit on Cray devices with CLE before 4.2.UP02 and 5.x before 5.1.UP00 does not use alpsauth data to validate the UID in a launch message, which allows local users to gain privileges via a modified aprun program, aka ID FN5912.
[https://labs.mwrinfosecurity.com/advisories/2014/01/31/cray-aprunapinit-privilege-escalation/]
Stack-based buffer overflow in lib/Libdis/disrsi_.c in Terascale Open-Source Resource and Queue Manager (aka TORQUE Resource Manager) 2.5.x through 2.5.13 allows remote attackers to execute arbitrary code via a large count value.
[http://packetstormsecurity.com/files/126651/Torque-2.5.13-Buffer-Overflow.html]
[http://packetstormsecurity.com/files/126855/TORQUE-Resource-Manager-2.5.13-Buffer-Overflow.html]
[DSA-2936]
[33554]
[20140515 [CVE-2014-0749] TORQUE Buffer Overflow]
[67420]
[https://github.com/adaptivecomputing/torque/commit/3ed749263abe3d69fa3626d142a5789dcb5a5684]
[https://github.com/adaptivecomputing/torque/pull/171]
[https://labs.mwrinfosecurity.com/advisories/2014/05/14/torque-buffer-overflow]
[https://labs.mwrinfosecurity.com/system/assets/662/original/torque-buffer-overflow_2014-05-14.pdf]
Directory traversal vulnerability in gefebt.exe in the WebView CimWeb components in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY through 8.2 SIM 24, and Proficy Process Systems with CIMPLICITY, allows remote attackers to execute arbitrary code via a crafted HTTP request, aka ZDI-CAN-1622.
[http://ics-cert.us-cert.gov/advisories/ICSA-14-023-01]
[http://support.ge-ip.com/support/index?page=kbchannel&id=KB15939]
[65124]
Directory traversal vulnerability in CimWebServer.exe (aka the WebView component) in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY before 8.2 SIM 24, and Proficy Process Systems with CIMPLICITY, allows remote attackers to execute arbitrary code via a crafted message to TCP port 10212, aka ZDI-CAN-1623.
[http://ics-cert.us-cert.gov/advisories/ICSA-14-023-01]
[http://support.ge-ip.com/support/index?page=kbchannel&id=KB15940]
[65117]
The SCADA server in Ecava IntegraXor before 4.1.4369 allows remote attackers to read arbitrary project backup files via a crafted URL.
[http://ics-cert.us-cert.gov/advisories/ICSA-14-008-01]
[http://www.integraxor.com/blog/category/security/vulnerability-note/]
Stack-based buffer overflow in the SCADA server in Ecava IntegraXor before 4.1.4390 allows remote attackers to cause a denial of service (system crash) by triggering access to DLL code located in the IntegraXor directory.
[http://ics-cert.us-cert.gov/advisories/ICSA-14-016-01]
[http://www.integraxor.com/blog/buffer-overflow-vulnerability-note/]
Directory traversal vulnerability in SchneiderWEB on Schneider Electric Modicon PLC Ethernet modules 140CPU65x Exec before 5.5, 140NOC78x Exec before 1.62, 140NOE77x Exec before 6.2, BMXNOC0401 before 2.05, BMXNOE0100 before 2.9, BMXNOE0110x Exec before 6.0, TSXETC101 Exec before 2.04, TSXETY4103x Exec before 5.7, TSXETY5103x Exec before 5.9, TSXP57x ETYPort Exec before 5.7, and TSXP57x Ethernet Copro Exec before 5.5 allows remote attackers to visit arbitrary resources via a crafted HTTP request.
[http://download.schneider-electric.com/files?p_Reference=SEVD-2014-260-01&p_EnDocType=Software%20-%20Updates&p_File_Id=608959359&p_File_Name=SEVD-2014-260-01.pdf]
[70193]
[https://ics-cert.us-cert.gov/advisories/ICSA-14-273-01]
Rockwell Automation RSLogix 5000 7 through 20.01, and 21.0, does not properly implement password protection for .ACD files (aka project files), which allows local users to obtain sensitive information or modify data via unspecified vectors.
[http://ics-cert.us-cert.gov/advisories/ICSA-14-021-01]
[65337]
[rslogix-cve20140755-info-disc(90981)]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2014. Notes: none.
Smart Software Solutions (3S) CoDeSys Runtime Toolkit before 2.4.7.44 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via unspecified vectors.
[http://ics-cert.us-cert.gov/advisories/ICSA-14-030-01]
An ActiveX control in GenLaunch.htm in ICONICS GENESIS32 8.0, 8.02, 8.04, and 8.05 allows remote attackers to execute arbitrary programs via a crafted HTML document.
[http://ics-cert.us-cert.gov/advisories/ICSA-14-051-01]
Unquoted Windows search path vulnerability in Schneider Electric Floating License Manager 1.0.0 through 1.4.0 allows local users to gain privileges via a Trojan horse application with a name composed of an initial substring of a path that contains a space character.
Per: http://cwe.mitre.org/data/definitions/428.html
"CWE-428: Unquoted Search Path or Element"
Per: http://ics-cert.us-cert.gov/advisories/ICSA-14-058-01
"This license manager is used in the following Schneider Electric products:
Power Monitoring Expert,
Struxureware process Expert (PES),
Struxureware process Expert libraries,
Vijeo Citect (SCADA), and
Vijeo Citect Historian."
[http://download.schneider-electric.com/files?p_Doc_Ref=SEVD%202014-015-01]
[http://ics-cert.us-cert.gov/advisories/ICSA-14-058-01]
The Festo CECX-X-C1 Modular Master Controller with CoDeSys and CECX-X-M1 Modular Controller with CoDeSys and SoftMotion provide an undocumented access method involving the FTP protocol, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via unspecified vectors.
[http://ics-cert.us-cert.gov/advisories/ICSA-14-084-01]
The DNP3 driver in CG Automation ePAQ-9410 Substation Gateway allows remote attackers to cause a denial of service (infinite loop or process crash) via a crafted TCP packet.
[https://ics-cert.us-cert.gov/advisories/ICSA-14-238-01]
The DNP3 driver in CG Automation ePAQ-9410 Substation Gateway allows physically proximate attackers to cause a denial of service (infinite loop or process crash) via crafted input over a serial line.
[https://ics-cert.us-cert.gov/advisories/ICSA-14-238-01]
Multiple SQL injection vulnerabilities in DBVisitor.dll in Advantech WebAccess before 7.2 allow remote attackers to execute arbitrary SQL commands via SOAP requests to unspecified functions.
[http://ics-cert.us-cert.gov/advisories/ICSA-14-079-03]
[66740]
Stack-based buffer overflow in Advantech WebAccess before 7.2 allows remote attackers to execute arbitrary code via a long NodeName parameter.
[http://ics-cert.us-cert.gov/advisories/ICSA-14-079-03]
[66718]
Stack-based buffer overflow in Advantech WebAccess before 7.2 allows remote attackers to execute arbitrary code via a long GotoCmd argument.
[http://ics-cert.us-cert.gov/advisories/ICSA-14-079-03]
[66722]
Stack-based buffer overflow in Advantech WebAccess before 7.2 allows remote attackers to execute arbitrary code via a long NodeName2 argument.
[http://ics-cert.us-cert.gov/advisories/ICSA-14-079-03]
[66725]
Stack-based buffer overflow in Advantech WebAccess before 7.2 allows remote attackers to execute arbitrary code via a long AccessCode argument.
[http://ics-cert.us-cert.gov/advisories/ICSA-14-079-03]
[66728]
Stack-based buffer overflow in Advantech WebAccess before 7.2 allows remote attackers to execute arbitrary code via a long AccessCode2 argument.
[http://ics-cert.us-cert.gov/advisories/ICSA-14-079-03]
[66732]
The Festo CECX-X-C1 Modular Master Controller with CoDeSys and CECX-X-M1 Modular Controller with CoDeSys and SoftMotion do not require authentication for connections to certain TCP ports, which allows remote attackers to (1) modify the configuration via a request to the debug service on port 4000 or (2) delete log entries via a request to the log service on port 4001.
[http://ics-cert.us-cert.gov/advisories/ICSA-14-084-01]
Stack-based buffer overflow in Advantech WebAccess before 7.2 allows remote attackers to execute arbitrary code via a long UserName parameter.
[http://ics-cert.us-cert.gov/advisories/ICSA-14-079-03]
The OpenUrlToBuffer method in the BWOCXRUN.BwocxrunCtrl.1 ActiveX control in bwocxrun.ocx in Advantech WebAccess before 7.2 allows remote attackers to read arbitrary files via a file: URL.
[http://ics-cert.us-cert.gov/advisories/ICSA-14-079-03]
The OpenUrlToBufferTimeout method in the BWOCXRUN.BwocxrunCtrl.1 ActiveX control in bwocxrun.ocx in Advantech WebAccess before 7.2 allows remote attackers to read arbitrary files via a file: URL.
[http://ics-cert.us-cert.gov/advisories/ICSA-14-079-03]
The CreateProcess method in the BWOCXRUN.BwocxrunCtrl.1 ActiveX control in bwocxrun.ocx in Advantech WebAccess before 7.2 allows remote attackers to execute (1) setup.exe, (2) bwvbprt.exe, and (3) bwvbprtl.exe programs from arbitrary pathnames via a crafted argument, as demonstrated by a UNC share pathname.
CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
[http://ics-cert.us-cert.gov/advisories/ICSA-14-079-03]
Stack-based buffer overflow in the C++ sample client in Schneider Electric OPC Factory Server (OFS) TLXCDSUOFS33 - 3.35, TLXCDSTOFS33 - 3.35, TLXCDLUOFS33 - 3.35, TLXCDLTOFS33 - 3.35, and TLXCDLFOFS33 - 3.35 allows local users to gain privileges via vectors involving a malformed configuration file.
[http://download.schneider-electric.com/files?p_Doc_Ref=SEVD%202014-031-01]
[http://ics-cert.us-cert.gov/advisories/ICSA-14-058-02]
[65871]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2014. Notes: none.
The Modbus slave/outstation driver in the OPC Drivers 1.0.20 and earlier in IOServer OPC Server allows remote attackers to cause a denial of service (out-of-bounds read and daemon crash) via a crafted packet.
[http://ics-cert.us-cert.gov/advisories/ICSA-14-100-01]
The TCPUploader module in Progea Movicon 11.4 before 11.4.1150 allows remote attackers to obtain potentially sensitive version information via network traffic to TCP port 10651.
[http://ics-cert.us-cert.gov/advisories/ICSA-14-105-01]
The PLC driver in ServerMain.exe in the Kepware KepServerEX 4 component in Schneider Electric StruxureWare SCADA Expert ClearSCADA 2010 R2 build 71.4165, 2010 R2.1 build 71.4325, 2010 R3 build 72.4560, 2010 R3.1 build 72.4644, 2013 R1 build 73.4729, 2013 R1.1 build 73.4832, 2013 R1.1a build 73.4903, 2013 R1.2 build 73.4955, and 2013 R2 build 74.5094 allows remote attackers to cause a denial of service (application crash) via a crafted OPF file (aka project file).
[http://download.schneider-electric.com/files?p_Doc_Ref=SEVD%202014-024-01]
[http://ics-cert.us-cert.gov/advisories/ICSA-14-072-01]
Directory traversal vulnerability in NTWebServer in InduSoft Web Studio 7.1 before SP2 Patch 4 allows remote attackers to read administrative passwords in APP files, and consequently execute arbitrary code, via unspecified web requests.
[http://ics-cert.us-cert.gov/advisories/ICSA-14-107-02]
[67056]
[42699]
Heap-based buffer overflow in BKCLogSvr.exe in Yokogawa CENTUM CS 3000 R3.09.50 and earlier allows remote attackers to execute arbitrary code via crafted UDP packets.
[http://ics-cert.us-cert.gov/advisories/ICSA-14-070-01]
[66130]
[https://community.rapid7.com/community/metasploit/blog/2014/03/10/yokogawa-centum-cs3000-vulnerabilities]
Stack-based buffer overflow in BKESimmgr.exe in the Expanded Test Functions package in Yokogawa CENTUM CS 1000, CENTUM CS 3000 Entry Class R3.09.50 and earlier, CENTUM VP R5.03.00 and earlier, CENTUM VP Entry Class R5.03.00 and earlier, Exaopc R3.71.02 and earlier, B/M9000CS R5.05.01 and earlier, and B/M9000 VP R7.03.01 and earlier allows remote attackers to execute arbitrary code via a crafted packet.
[http://ics-cert.us-cert.gov/advisories/ICSA-14-133-01]
[http://www.yokogawa.com/dcs/security/ysar/YSAR-14-0001E.pdf]
Stack-based buffer overflow in BKHOdeq.exe in Yokogawa CENTUM CS 3000 R3.09.50 and earlier allows remote attackers to execute arbitrary code via a crafted TCP packet.
[http://ics-cert.us-cert.gov/advisories/ICSA-14-070-01]
[66111]
[https://community.rapid7.com/community/metasploit/blog/2014/03/10/yokogawa-centum-cs3000-vulnerabilities]
Stack-based buffer overflow in BKBCopyD.exe in Yokogawa CENTUM CS 3000 R3.09.50 and earlier allows remote attackers to execute arbitrary code via a crafted TCP packet.
[http://ics-cert.us-cert.gov/advisories/ICSA-14-070-01]
[66114]
[https://community.rapid7.com/community/metasploit/blog/2014/03/10/yokogawa-centum-cs3000-vulnerabilities]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2014. Notes: none.
Ecava IntegraXor before 4.1.4393 allows remote attackers to read cleartext credentials for administrative accounts via SELECT statements that leverage the guest role.
[http://ics-cert.us-cert.gov/advisories/ICSA-14-091-01]
[http://www.integraxor.com/blog/category/security/vulnerability-note/]
Stack-based buffer overflow in WellinTech KingSCADA before 3.1.2.13 allows remote attackers to execute arbitrary code via a crafted packet.
[http://ics-cert.us-cert.gov/advisories/ICSA-14-098-02]
[66709]
[42724]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2014. Notes: none.
Multiple buffer overflows in the OPC Automation 2.0 Server Object ActiveX control in Schneider Electric OPC Factory Server (OFS) TLXCDSUOFS33 3.5 and earlier, TLXCDSTOFS33 3.5 and earlier, TLXCDLUOFS33 3.5 and earlier, TLXCDLTOFS33 3.5 and earlier, and TLXCDLFOFS33 3.5 and earlier allow remote attackers to cause a denial of service via long arguments to unspecified functions.
[http://ics-cert.us-cert.gov/advisories/ICSA-14-093-01]
[http://www.schneider-electric.com/corporate/en/support/cybersecurity/viewer-news.page?c_filepath=/templatedata/Content/News/data/en/local/cybersecurity/general_information/2014/03/20140325_vulnerability_disclosure_opc_factory_server.xml]
Integer overflow in the license_read_scope_list function in libfreerdp/core/license.c in FreeRDP through 1.0.2 allows remote RDP servers to cause a denial of service (application crash) or possibly have unspecified other impact via a large ScopeCount value in a Scope List in a Server License Request packet.
[http://advisories.mageia.org/MGASA-2014-0287.html]
[openSUSE-SU-2014:0862]
[openSUSE-SU-2016:2400]
[openSUSE-SU-2016:2402]
[[oss-security] 20140102 CVE for freerdp int overflow?]
[[oss-security] 20140103 Re: CVE for freerdp int overflow?]
[MDVSA-2015:171]
[https://bugzilla.redhat.com/show_bug.cgi?id=998941]
[https://github.com/FreeRDP/FreeRDP/pull/1649]
[https://github.com/sidhpurwala-huzaifa/FreeRDP/commit/e2745807c4c3e0a590c0f69a9b655dc74ebaa03e]
Sonatype Nexus 1.x and 2.x before 2.7.1 allows remote attackers to create arbitrary objects and execute arbitrary code via unspecified vectors related to unmarshalling of unintended Object types.
[http://www.sonatype.org/advisories/archive/2014-01-13-Nexus]
[https://sonatype.zendesk.com/entries/37551958-Configuring-Xstream-Whitelist]
[https://support.sonatype.com/entries/37828023-Nexus-Security-Vulnerability]
Multiple cross-site scripting (XSS) vulnerabilities in the StackIdeas Komento (com_komento) component before 1.7.3 for Joomla! allow remote attackers to inject arbitrary web script or HTML via the (1) website or (2) latitude parameter in a comment to the default URI.
[http://stackideas.com/downloads/changelog/komento]
[31174]
[20140123 Cross-Site Scripting (XSS) in Komento Joomla Extension]
[64659]
[https://www.htbridge.com/advisory/HTB23194]
SQL injection vulnerability in the JV Comment (com_jvcomment) component before 3.0.3 for Joomla! allows remote authenticated users to execute arbitrary SQL commands via the id parameter in a comment.like action to index.php.
[http://extensions.joomla.org/extensions/contacts-and-feedback/articles-comments/23394]
[31175]
[20140123 SQL Injection in JV Comment Joomla Extension]
[64661]
[joomla-jvcomment-unspecified-sql-injection(90532)]
[https://www.htbridge.com/advisory/HTB23195]
Directory traversal vulnerability in the aokitaka ZIP with Pass application 4.5.7 and earlier, and ZIP with Pass Pro application 6.3.8 and earlier, for Android allows attackers to overwrite or create arbitrary files via unspecified vectors.
[JVN#88313872]
[JVNDB-2014-000001]
Directory traversal vulnerability in the tetra filer application 2.3.1 and earlier for Android 4.0.3, tetra filer free application 2.3.1 and earlier for Android 4.0.3, tetra filer application 1.5.1 and earlier for Android before 4.0.3, and tetra filer free application 1.5.1 and earlier for Android before 4.0.3 allows attackers to overwrite or create arbitrary files via unspecified vectors.
[JVN#51285738]
[JVNDB-2014-000002]
[https://play.google.com/store/apps/details?id=jp.main.brits.android.filer.app]
[https://play.google.com/store/apps/details?id=jp.main.brits.android.filer.free]
Directory traversal vulnerability in the CGENE Security File Manager Pro application 1.0.6 and earlier, and Security File Manager Trial application 1.0.6 and earlier, for Android allows attackers to overwrite or create arbitrary files via unspecified vectors.
[JVN#44392991]
[JVNDB-2014-000003]
[https://play.google.com/store/apps/details?id=com.cgene.android.secret.filelock.free]
[https://play.google.com/store/apps/details?id=com.cgene.android.secret.filelock.pro]
Directory traversal vulnerability in the NeoFiler application 5.4.3 and earlier, NeoFiler Free application 5.4.3 and earlier, and NeoFiler Lite application 2.4.2 and earlier for Android allows attackers to overwrite or create arbitrary files via unspecified vectors.
[JVN#85716574]
[JVNDB-2014-000004]
[http://www.skyarts.com/products/android/neofiler/index.html]
[https://play.google.com/store/apps/details?id=com.skyarts.android.neofiler]
[https://play.google.com/store/apps/details?id=com.skyarts.android.neofilerfree]
[https://play.google.com/store/apps/details?id=com.skyarts.android.neofilerlite]
The Sleipnir Mobile application 2.12.1 and earlier and Sleipnir Mobile Black Edition application 2.12.1 and earlier for Android provide Geolocation API data without verifying user consent, which allows remote attackers to obtain sensitive location information via a web site that makes API calls.
[JVN#81637882]
[JVNDB-2014-000007]
data/class/pages/shopping/LC_Page_Shopping_Deliv.php in LOCKON EC-CUBE 2.4.4 and earlier, and 2.11.0 through 2.12.2, allows remote attackers to modify data via unspecified vectors.
[JVN#17849447]
[JVNDB-2014-000005]
[http://www.ec-cube.net/info/weakness/weakness.php?id=56]
The lfCheckError function in data/class/pages/shopping/LC_Page_Shopping_Multiple.php in LOCKON EC-CUBE 2.11.0 through 2.12.2 allows remote attackers to obtain sensitive shipping information via unspecified vectors.
[JVN#51770585]
[JVNDB-2014-000006]
[http://www.ec-cube.net/info/weakness/weakness.php?id=57]
Directory traversal vulnerability in the Gapless Player SimZip (aka Simple Zip Viewer) application before 1.2.1 for Android allows remote attackers to overwrite or create arbitrary files via a crafted filename.
[JVN#49384502]
[JVNDB-2014-000008]
[simple-zip-cve20140809-dir-traversal(90980)]
[https://play.google.com/store/apps/details?id=com.acidzazz.simzip]
Unspecified vulnerability in JustSystems Sanshiro 2007 before update 3, 2008 before update 5, 2009 before update 6, and 2010 before update 6, and Sanshiro Viewer before 2.0.2.0, allows remote attackers to execute arbitrary code via a crafted document.
[JVN#28011378]
[JVNDB-2014-000011]
[http://www.justsystems.com/jp/info/js14001.html]
Cross-site scripting (XSS) vulnerability in Blackboard Vista/CE 8.0 SP6 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
[JVN#24730765]
[JVNDB-2014-000012]
[65742]
Cross-site scripting (XSS) vulnerability in KENT-WEB Joyful Note 2.8 and earlier, when Internet Explorer 7 or earlier is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
[JVN#30718178]
[JVNDB-2014-000013]
[http://www.kent-web.com/bbs/joyful.html]
[65301]
Cross-site request forgery (CSRF) vulnerability in phpMyFAQ before 2.8.6 allows remote attackers to hijack the authentication of arbitrary users for requests that modify settings.
[JVN#50943964]
[JVNDB-2014-000016]
[http://www.phpmyfaq.de/advisory_2014-02-04.php]
[65368]
[phpmyfaq-cve20140813-csrf(90963)]
Cross-site scripting (XSS) vulnerability in phpMyFAQ before 2.8.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
[JVN#30050348]
[JVNDB-2014-000015]
[http://www.phpmyfaq.de/advisory_2014-02-04.php]
[65368]
The intent: URL implementation in Opera before 18 on Android allows attackers to read local files by leveraging an interaction error, as demonstrated by reading stored cookies.
[http://blogs.opera.com/security/2014/01/security-changes-features-opera-19/]
[JVN#23256725]
[JVNDB-2014-000014]
[65391]
[opera-android-cve20140815-info-disc(91090)]
Unspecified vulnerability in Norman Security Suite 10.1 and earlier allows local users to gain privileges via unknown vectors.
[http://jvn.jp/en/jp/JVN02017463/995510/index.html]
[JVN#02017463]
[JVNDB-2014-000026]
Cybozu Garoon 2.x through 2.5.4 and 3.x through 3.7 SP3 does not properly manage sessions, which allows remote authenticated users to impersonate arbitrary users via unspecified vectors.
[http://cs.cybozu.co.jp/information/gr20140225up03.php]
[JVN#24035499]
[JVNDB-2014-000021]
[https://support.cybozu.com/ja-jp/article/7992]
Untrusted search path vulnerability in Autodesk AutoCAD before 2014 allows local users to gain privileges and execute arbitrary VBScript code via a Trojan horse FAS file in the FAS file search path.
[JVN#33382534]
[JVNDB-2014-000019]
Untrusted search path vulnerability in Autodesk AutoCAD before 2014 allows local users to gain privileges via a Trojan horse DLL in the current working directory.
[JVN#43254599]
[JVNDB-2014-000020]
Directory traversal vulnerability in the download feature in Cybozu Garoon 2.x through 2.5.4 and 3.x through 3.7 SP3 allows remote authenticated users to read arbitrary files via unspecified vectors.
[http://cs.cybozu.co.jp/information/gr20140225up05.php]
[JVN#26393529]
[JVNDB-2014-000023]
[65815]
[https://support.cybozu.com/ja-jp/article/7994]
SQL injection vulnerability in the download feature in Cybozu Garoon 2.x through 2.5.4 and 3.x through 3.7 SP3 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, a different vulnerability than CVE-2013-6930 and CVE-2013-6931.
[http://cs.cybozu.co.jp/information/gr20140225up04.php]
[JVN#71045461]
[JVNDB-2014-000024]
[65809]
[https://support.cybozu.com/ja-jp/article/7993]
The IMAP server in IBM Domino 8.5.x before 8.5.3 FP6 IF1 and 9.0.x before 9.0.1 FP1 allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors, aka SPR KLYH9F4S2Z.
[102912]
[56791]
[http://www-01.ibm.com/support/docview.wss?uid=swg21663023]
[ibm-domino-cve20140822-dos(90235)]
IBM WebSphere Application Server (WAS) 8.x before 8.0.0.9 and 8.5.x before 8.5.5.2 allows remote attackers to read arbitrary files via a crafted URL.
[67329]
[PI05324]
[http://www-01.ibm.com/support/docview.wss?uid=swg21669554]
[http://www-01.ibm.com/support/docview.wss?uid=swg21676092]
[ibm-was-cve20140823-viewfiles(90498)]
Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 7.x before 7.1.1.8 LAFIX.20140319-0839 and 7.1.1.12 before IFIX.20140321-1336 and Tivoli IT Asset Management for IT, Tivoli Service Request Manager, Maximo Service Desk, and Change and Configuration Management Database (CCMDB) 7.x before 7.1.1.8 LAFIX.20140319-0839 and 7.1.1.12 before IFIX.20140218-1510 allows remote authenticated users to inject arbitrary web script or HTML via an attachment URL.
[IV52829]
[http://www-01.ibm.com/support/docview.wss?uid=swg21670870]
[ibm-maximo-cve20140824-xss(90500)]
Cross-site scripting (XSS) vulnerability in openreport.jsp in IBM Maximo Asset Management 7.x before 7.1.1.12 IFIX.20140321-1336 and 7.5.x before 7.5.0.5 IFIX006; SmartCloud Control Desk 7.x before 7.5.0.3 and 7.5.1.x before 7.5.1.2; and Tivoli IT Asset Management for IT, Tivoli Service Request Manager, Maximo Service Desk, and Change and Configuration Management Database (CCMDB) 7.x before 7.1.1.12 IFIX.20140218-1510 allows remote authenticated users to inject arbitrary web script or HTML via a crafted report parameter.
[IV53362]
[http://www-01.ibm.com/support/docview.wss?uid=swg21670870]
[ibm-maximo-cve20140825-xss(90501)]
Cross-site scripting (XSS) vulnerability in IBM InfoSphere Optim Workload Replay 1.1 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
[66621]
[http://www-01.ibm.com/support/docview.wss?uid=swg21669093]
[ibm-infosphere-cve20140827-xss(90503)]
Cross-site scripting (XSS) vulnerability in the WCM (Web Content Manager) UI in IBM WebSphere Portal 6.1.0.x through 6.1.0.6 CF27, 6.1.5.x through 6.1.5.3 CF27, 7.0.0.x through 7.0.0.2 CF27, and 8.0.0.x before 8.0.0.1 CF11 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
[66556]
[PI10734]
[http://www-01.ibm.com/support/docview.wss?uid=swg21667016]
[ibm-wsportal-cve20140828-wcm-xss(90566)]
Multiple buffer overflows in IBM Rational ClearCase 7.x before 7.1.2.13, 8.0.0.x before 8.0.0.10, and 8.0.1.x before 8.0.1.3 allow remote authenticated users to obtain privileged access via unspecified vectors.
[66339]
[http://www-01.ibm.com/support/docview.wss?&uid=swg21662086]
[ibm-clearcase-cve20140829-bo(90568)]
Directory traversal vulnerability in the table-export implementation in the OAC component in IBM Financial Transaction Manager (FTM) 2.0 before 2.0.0.3 and 2.1 before 2.1.0.1 allows remote authenticated users to read arbitrary files via a modified pathname.
[http://www-01.ibm.com/support/docview.wss?uid=swg21662714]
[ibm-ftm-cve20140830-trav(90584)]
Cross-site request forgery (CSRF) vulnerability in the OAC component in IBM Financial Transaction Manager (FTM) 2.0 before 2.0.0.3 allows remote attackers to hijack the authentication of arbitrary users for requests that modify configuration data.
[102766]
[http://www-01.ibm.com/support/docview.wss?uid=swg21662714]
[ibm-ftm-cve20140831-csrf(90585)]
Multiple cross-site scripting (XSS) vulnerabilities in configuration-details screens in the OAC component in IBM Financial Transaction Manager (FTM) 2.0 before 2.0.0.3 allow remote authenticated users to inject arbitrary web script or HTML via a crafted text value.
[http://www-01.ibm.com/support/docview.wss?uid=swg21662714]
[ibm-ftm-cve20140832-xss(90586)]
The OAC component in IBM Financial Transaction Manager (FTM) 2.0 before 2.0.0.3 does not properly enforce operator-intervention requirements, which allows remote authenticated users to bypass intended access restrictions via an unspecified process step.
[102767]
[http://www-01.ibm.com/support/docview.wss?uid=swg21662714]
[ibm-ftm-cve20140833-auth(90612)]
IBM General Parallel File System (GPFS) 3.4 through 3.4.0.27 and 3.5 through 3.5.0.16 allows attackers to cause a denial of service (daemon crash) via crafted arguments to a setuid program.
[65297]
[http://www-01.ibm.com/support/docview.wss?uid=isg3T1020542]
[IV52863]
[IV54381]
[ibm-gpfs-cve20140834-dos(90647)]
Cross-site request forgery (CSRF) vulnerability in IBM Security QRadar SIEM 7.2 MR1 and earlier allows remote attackers to hijack the authentication of administrators for requests that modify console Auto Update settings.
[20140124 ADV: IBM QRadar SIEM]
[http://thomaspollet.blogspot.be/2014/01/ibm-qradar-siem-csrf-xss-mitm-rce.html]
[65127]
[http://www-01.ibm.com/support/docview.wss?uid=swg21663066]
[ibm-qradar-cve20140835-csrf(90678)]
Cross-site scripting (XSS) vulnerability in IBM Security QRadar SIEM 7.2 MR1 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
[20140124 ADV: IBM QRadar SIEM]
[65127]
[http://www-01.ibm.com/support/docview.wss?uid=swg21663066]
[ibm-qradar-cve20140836-xss(90679)]
The AutoUpdate process in IBM Security QRadar SIEM 7.2 MR1 and earlier does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers via a crafted certificate.
[20140124 ADV: IBM QRadar SIEM]
[65127]
[http://www-01.ibm.com/support/docview.wss?uid=swg21663066]
[ibm-qradar-cve20140837-mitm(90680)]
The AutoUpdate package before 6.4 for IBM Security QRadar SIEM 7.2 MR1 and earlier allows remote attackers to execute arbitrary console commands by leveraging control of the server.
[65127]
[http://www-01.ibm.com/support/docview.wss?uid=swg21663066]
[ibm-qradar-cve20140838-command-exec(90681)]
IBM Rational Focal Point 6.4.x and 6.5.x before 6.5.2.3 and 6.6.x before 6.6.1 allows remote authenticated users to modify data via vectors involving a direct object reference.
[http://www-01.ibm.com/support/docview.wss?uid=swg21665005]
[ibm-focalpoint-cve20140839-sec-bypass(90696)]
Multiple cross-site scripting (XSS) vulnerabilities in IBM Rational Focal Point 6.4.x and 6.5.x before 6.5.2.3 and 6.6.x before 6.6.1 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
[65737]
[http://www-01.ibm.com/support/docview.wss?uid=swg21665005]
[ibm-focalpoint-cve20140840-xss(90698)]
IBM Rational Focal Point 6.4.0, 6.4.1, 6.5.1, 6.5.2, and 6.6.0 use a weak algorithm to hash passwords, which makes it easier for context-dependent attackers to obtain cleartext values via a brute-force attack. IBM X-Force ID: 90704.
[ibm-focalpoint-cve20140841-weak-sec(90704)]
[https://www.ibm.com/blogs/psirt/ibm-security-bulletin-weak-password-hash-vulnerability-in-rational-focalpoint-cve-2014-0841/]
The account-creation functionality in IBM Rational Focal Point 6.4.x and 6.5.x before 6.5.2.3 and 6.6.x before 6.6.1 places the new user's default password within the creation page, which allows remote attackers to obtain sensitive information by reading the HTML source code.
[http://www-01.ibm.com/support/docview.wss?uid=swg21665005]
[ibm-focalpoint-cve20140842-default-pw(90706)]
Cross-site scripting (XSS) vulnerability in IBM Rational Focal Point 6.4.x and 6.5.x before 6.5.2.3 and 6.6.x before 6.6.1 allows remote authenticated users to inject arbitrary web script or HTML by uploading a file.
[65730]
[http://www-01.ibm.com/support/docview.wss?uid=swg21665005]
[ibm-focalpoint-cve20140843-file-upload(90714)]
Unspecified vulnerability in IBM Rational Requirements Composer 3.x before 3.0.1.6 iFix2 and 4.x before 4.0.6, and Rational DOORS Next Generation 4.x before 4.0.6, allows remote authenticated users to read arbitrary data via unknown vectors.
[http://www-01.ibm.com/support/docview.wss?uid=swg21664412]
[ibm-rrc-cve20140844-retrieval(90718)]
Open redirect vulnerability in IBM Rational Requirements Composer 3.x before 3.0.1.6 iFix2 and 4.x before 4.0.6, and Rational DOORS Next Generation 4.x before 4.0.6, allows remote authenticated users to redirect users to arbitrary web sites and conduct phishing attacks via a crafted URL.
[65916]
[http://www-01.ibm.com/support/docview.wss?uid=swg21664412]
[ibm-rrc-cve20140845-redirect(90719)]
Cross-site scripting (XSS) vulnerability in IBM Rational Requirements Composer 3.x before 3.0.1.6 iFix2 and 4.x before 4.0.6, and Rational DOORS Next Generation 4.x before 4.0.6, allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
[65917]
[http://www-01.ibm.com/support/docview.wss?uid=swg21664412]
[ibm-rrc-cve20140846-xss(90720)]
The (1) ssl.conf and (2) httpd.conf files in the Apache HTTP Server component in IBM Netezza Performance Portal 2.0 before 2.0.0.4 have weak SSLCipherSuite values, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via a brute-force attack.
[http://www-01.ibm.com/support/docview.wss?uid=swg21665278]
[ibm-netezza-cve20140848-weak-sec(90723)]
IBM Maximo Asset Management 7.x before 7.5.0.3 IFIX027 and SmartCloud Control Desk 7.x before 7.5.0.3 and 7.5.1.x before 7.5.1.2 allow remote authenticated users to gain privileges by leveraging membership in two security groups.
[IV53952]
[http://www-01.ibm.com/support/docview.wss?uid=swg21670870]
[ibm-maximo-cve20140849-sec-bypass(90738)]
Cross-site scripting (XSS) vulnerability in IBM InfoSphere Master Data Management Reference Data Management (RDM) Hub 10.1 and 11.0 before 11.0.0.0-MDM-IF008 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
[http://www-01.ibm.com/support/docview.wss?uid=swg21666119]
[ibm-mdm-rdm-cve20140850-xss(90751)]
IBM WebSphere DataPower SOA appliances through 4.0.2.15, 5.x through 5.0.0.17, 6.0.0.x through 6.0.0.9, and 6.0.1.x through 6.0.1.5 make it easier for remote attackers to obtain a PreMasterSecret value and defeat cryptographic protection mechanisms by sending a large number of requests in an SSL/TLS side-channel timing attack.
[IT01111]
[http://www-01.ibm.com/support/docview.wss?uid=swg21678204]
[ibm-datapower-cve20140852-sidechannel(90753)]
Multiple cross-site scripting (XSS) vulnerabilities in the (1) ForwardController and (2) AttributeEditor scripts in IBM Rational Focal Point 6.4.x and 6.5.x before 6.5.2.3 and 6.6.x before 6.6.1 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
[65726]
[http://www-01.ibm.com/support/docview.wss?uid=swg21665005]
[ibm-focalpoint-cve20140853-xss(90754)]
The server in IBM Cognos Business Intelligence (BI) 8.4.1, 10.1 before IF6, 10.1.1 before IF5, 10.2 before IF7, 10.2.1 before IF4, and 10.2.1.1 before IF4 allows remote authenticated users to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
[http://www-01.ibm.com/support/docview.wss?uid=swg21662856]
[ibm-cognos-cve20140854-xxe(90794)]
Multiple cross-site scripting (XSS) vulnerabilities in IBM Connections Portlets 4.x before 4.5.1 FP1 for IBM WebSphere Portal 7.0.0.2 and 8.0.0.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
[http://www-01.ibm.com/support/docview.wss?uid=swg21663921]
[ibm-websphere-cve20140855-xss(90802)]
The Administrative Console in IBM WebSphere Application Server (WAS) 8.x before 8.0.0.9 and 8.5.x before 8.5.5.2 allows remote authenticated users to obtain sensitive information via a crafted request.
[67327]
[PI07808]
[http://www-01.ibm.com/support/docview.wss?uid=swg21669554]
[http://www-01.ibm.com/support/docview.wss?uid=swg21676092]
[ibm-was-cve20140857-info-disc(90863)]
IBM Content Navigator 2.x before 2.0.2.2-ICN-FP002 allows remote authenticated users to bypass intended access restrictions and conduct deleteAction attacks via a modified URL.
[http://www-01.ibm.com/support/docview.wss?uid=swg21665358]
[ibm-navigator-cve20140858-xss(90864)]
The web-server plugin in IBM WebSphere Application Server (WAS) 7.x before 7.0.0.33, 8.x before 8.0.0.9, and 8.5.x before 8.5.5.2, when POST retries are enabled, allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors.
[67335]
[PI08892]
[http://www-01.ibm.com/support/docview.wss?uid=swg21669554]
[http://www-01.ibm.com/support/docview.wss?uid=swg21676091]
[http://www-01.ibm.com/support/docview.wss?uid=swg21676092]
[ibm-was-cve20140859-retry(90879)]
The firmware before 3.66E in IBM BladeCenter Advanced Management Module (AMM), the firmware before 1.43 in IBM Integrated Management Module (IMM), and the firmware before 4.15 in IBM Integrated Management Module II (IMM2) contains cleartext IPMI credentials, which allows attackers to execute arbitrary IPMI commands, and consequently establish a blade remote-control session, by leveraging access to (1) the chassis internal network or (2) the Ethernet-over-USB interface.
[http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095840]
[ibm-bladecenter-cve20140860-info-disc(90880)]
Cross-site scripting (XSS) vulnerability in the server in IBM Cognos Business Intelligence (BI) 8.4.1, 10.1 before IF6, 10.1.1 before IF5, 10.2 before IF7, 10.2.1 before IF4, and 10.2.1.1 before IF4 allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter that is not properly handled during use of the Back button.
[http://www-01.ibm.com/support/docview.wss?uid=swg21662856]
Unspecified vulnerability in Jazz Team Server in IBM Rational Collaborative Lifecycle Management (CLM) 3.x before 3.0.1.6 iFix 2 and 4.x before 4.0.6 allows remote attackers to execute arbitrary code via unknown vectors.
[http://www-01.ibm.com/support/docview.wss?uid=swg21664566]
[ibm-rationalclm-cve20140862-rce(90895)]
The client in IBM Cognos TM1 9.5.2.3 before IF5, 10.1.1.2 before IF1, 10.2.0.2 before IF1, and 10.2.2.0 before IF1 stores obfuscated passwords in memory, which allows remote authenticated users to obtain sensitive cleartext information via an unspecified security tool.
[69594]
[1030805]
[http://www-01.ibm.com/support/docview.wss?uid=swg21682397]
[ibm-cognos-cve20140863-info-disc(90937)]
Multiple cross-site request forgery (CSRF) vulnerabilities in Executer in RICOS in IBM Algo Credit Limits (aka ACLM) 4.5.0 through 4.7.0 before 4.7.0.03 FP5 in IBM Algorithmics allow remote attackers to hijack the authentication of arbitrary users for requests that change (1) a deal's currency or (2) a limit via a crafted XML document.
[http://packetstormsecurity.com/files/127304/IBM-Algorithmics-RICOS-Disclosure-XSS-CSRF.html]
[20140630 SEC Consult SA-20140630-0 :: Multiple vulnerabilities in IBM Algorithmics RICOS]
[20140630 SEC Consult SA-20140630-0 :: Multiple vulnerabilities in IBM Algorithmics RICOS]
[http://www-01.ibm.com/support/docview.wss?uid=swg21675881]
[ibm-aclm-cve20140864-csrf(90938)]
[https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140630-0_IBM_Algorithmics_RICOS_multiple_vulnerabilities_v10.txt]
RICOS in IBM Algo Credit Limits (aka ACLM) 4.5.0 through 4.7.0 before 4.7.0.03 FP5 in IBM Algorithmics relies on client-side input validation, which allows remote authenticated users to bypass intended dual-control restrictions and modify data via crafted serialized objects, as demonstrated by limit manipulations.
[http://packetstormsecurity.com/files/127304/IBM-Algorithmics-RICOS-Disclosure-XSS-CSRF.html]
[20140630 SEC Consult SA-20140630-0 :: Multiple vulnerabilities in IBM Algorithmics RICOS]
[20140630 SEC Consult SA-20140630-0 :: Multiple vulnerabilities in IBM Algorithmics RICOS]
[http://www-01.ibm.com/support/docview.wss?uid=swg21675881]
[ibm-aclm-cve20140865-sec-bypass(90939)]
[https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140630-0_IBM_Algorithmics_RICOS_multiple_vulnerabilities_v10.txt]
RICOS in IBM Algo Credit Limits (aka ACLM) 4.5.0 through 4.7.0 before 4.7.0.03 FP5 in IBM Algorithmics sends cleartext credentials over HTTP, which allows remote attackers to obtain sensitive information by sniffing the network.
[http://packetstormsecurity.com/files/127304/IBM-Algorithmics-RICOS-Disclosure-XSS-CSRF.html]
[20140630 SEC Consult SA-20140630-0 :: Multiple vulnerabilities in IBM Algorithmics RICOS]
[20140630 SEC Consult SA-20140630-0 :: Multiple vulnerabilities in IBM Algorithmics RICOS]
[http://www-01.ibm.com/support/docview.wss?uid=swg21675881]
[ibm-aclm-cve20140866-plaintext(90940)]
[https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140630-0_IBM_Algorithmics_RICOS_multiple_vulnerabilities_v10.txt]
rcore6/main/addcookie.jsp in RICOS in IBM Algo Credit Limits (aka ACLM) 4.5.0 through 4.7.0 before 4.7.0.03 FP5 in IBM Algorithmics allows remote attackers to create or modify cookies via the query string.
[http://packetstormsecurity.com/files/127304/IBM-Algorithmics-RICOS-Disclosure-XSS-CSRF.html]
[20140630 SEC Consult SA-20140630-0 :: Multiple vulnerabilities in IBM Algorithmics RICOS]
[20140630 SEC Consult SA-20140630-0 :: Multiple vulnerabilities in IBM Algorithmics RICOS]
[http://www-01.ibm.com/support/docview.wss?uid=swg21675881]
[ibm-aclm-cve20140867-cookies(90941)]
[https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140630-0_IBM_Algorithmics_RICOS_multiple_vulnerabilities_v10.txt]
RICOS in IBM Algo Credit Limits (aka ACLM) 4.5.0 through 4.7.0 before 4.7.0.03 FP5 in IBM Algorithmics relies on client-side input validation, which allows remote authenticated users to bypass intended dual-control restrictions and modify data via a crafted XML document, as demonstrated by manipulation of read-only limit data.
[http://packetstormsecurity.com/files/127304/IBM-Algorithmics-RICOS-Disclosure-XSS-CSRF.html]
[20140630 SEC Consult SA-20140630-0 :: Multiple vulnerabilities in IBM Algorithmics RICOS]
[20140630 SEC Consult SA-20140630-0 :: Multiple vulnerabilities in IBM Algorithmics RICOS]
[http://www-01.ibm.com/support/docview.wss?uid=swg21675881]
[ibm-aclm-cve20140868-sec-bypass(90942)]
[https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140630-0_IBM_Algorithmics_RICOS_multiple_vulnerabilities_v10.txt]
The decrypt function in RICOS in IBM Algo Credit Limits (aka ACLM) 4.5.0 through 4.7.0 before 4.7.0.03 FP5 in IBM Algorithmics does not require a key, which makes it easier for remote attackers to obtain cleartext passwords by sniffing the network and then providing a string argument to this function.
[http://packetstormsecurity.com/files/127304/IBM-Algorithmics-RICOS-Disclosure-XSS-CSRF.html]
[20140630 SEC Consult SA-20140630-0 :: Multiple vulnerabilities in IBM Algorithmics RICOS]
[20140630 SEC Consult SA-20140630-0 :: Multiple vulnerabilities in IBM Algorithmics RICOS]
[http://www-01.ibm.com/support/docview.wss?uid=swg21675881]
[ibm-aclm-cve20140869-decrypt(90943)]
[https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140630-0_IBM_Algorithmics_RICOS_multiple_vulnerabilities_v10.txt]
Multiple cross-site scripting (XSS) vulnerabilities in RICOS in IBM Algo Credit Limits (aka ACLM) 4.5.0 through 4.7.0 before 4.7.0.03 FP5 in IBM Algorithmics allow remote attackers to inject arbitrary web script or HTML via (1) the Message parameter to rcore6/main/showerror.jsp, (2) the ButtonsetClass parameter to rcore6/main/buttonset.jsp, (3) the MBName parameter to rcore6/frameset.jsp, (4) the Init parameter to algopds/rcore6/main/browse.jsp, or the (5) Name, (6) StoreName, or (7) STYLESHEET parameter to algopds/rcore6/main/ibrowseheader.jsp.
[http://packetstormsecurity.com/files/127304/IBM-Algorithmics-RICOS-Disclosure-XSS-CSRF.html]
[20140630 SEC Consult SA-20140630-0 :: Multiple vulnerabilities in IBM Algorithmics RICOS]
[20140630 SEC Consult SA-20140630-0 :: Multiple vulnerabilities in IBM Algorithmics RICOS]
[http://www-01.ibm.com/support/docview.wss?uid=swg21675881]
[ibm-aclm-cve20140870-xss(90944)]
[https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140630-0_IBM_Algorithmics_RICOS_multiple_vulnerabilities_v10.txt]
RICOS in IBM Algo Credit Limits (aka ACLM) 4.5.0 through 4.7.0 before 4.7.0.03 FP5 in IBM Algorithmics allows remote attackers to obtain potentially sensitive Tomcat stack-trace information via non-printing characters in a cookie to the /classes/ URI, as demonstrated by the \x00 character.
[http://packetstormsecurity.com/files/127304/IBM-Algorithmics-RICOS-Disclosure-XSS-CSRF.html]
[20140630 SEC Consult SA-20140630-0 :: Multiple vulnerabilities in IBM Algorithmics RICOS]
[20140630 SEC Consult SA-20140630-0 :: Multiple vulnerabilities in IBM Algorithmics RICOS]
[http://www-01.ibm.com/support/docview.wss?uid=swg21675881]
[ibm-aclm-cve20140871-tomcat(90945)]
[https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140630-0_IBM_Algorithmics_RICOS_multiple_vulnerabilities_v10.txt]
The installation process in IBM Security Key Lifecycle Manager 2.5 stores unencrypted credentials, which might allow local users to obtain sensitive information by leveraging root access. IBM X-Force ID: 90988.
[ibm-tivoli-cve20140872-info-disc(90988)]
[https://www.ibm.com/blogs/psirt/ibm-security-bulletin-unencrypted-credentials-stored-on-ibm-security-key-lifecycle-manager-server-cve-2014-0872/]
Multiple cross-site request forgery (CSRF) vulnerabilities in the (1) Data Stewardship, (2) Business Admin, and (3) Product interfaces in IBM InfoSphere Master Data Management (MDM) Server 8.5 before 8.5.0.82, 9.0.1 before 9.0.1.38, 9.0.2 before 9.0.2.35, 10.0 before 10.0.0.0.26, and 10.1 before 10.1.0.0.15 allow remote attackers to hijack the authentication of arbitrary users.
[http://www-01.ibm.com/support/docview.wss?uid=swg21666462]
[ibm-infosphere-cve20140873-csrf(90994)]
Cross-site scripting (XSS) vulnerability in IBM Content Navigator 2.x before 2.0.2.2-ICN-FP002 allows remote authenticated users to inject arbitrary web script or HTML via an unspecified parameter.
[65852]
[1030011]
[http://www-01.ibm.com/support/docview.wss?uid=swg21665362]
[http://www-01.ibm.com/support/docview.wss?uid=swg21668907]
[ibm-cn-cve20140874-xss(91002)]
Active Cloud Engine (ACE) in IBM Storwize V7000 Unified 1.3.0.0 through 1.4.3.x allows remote attackers to bypass intended ACL restrictions in opportunistic circumstances by leveraging incorrect ACL synchronization over an unreliable NFS connection that requires retransmissions.
[http://www.ibm.com/support/docview.wss?uid=ssg1S1004738]
[68398]
Buffer overflow in the Java GUI Configuration Wizard and Preferences Editor in the backup-archive client in IBM Tivoli Storage Manager (TSM) 5.x and 6.x before 6.2.5.2, 6.3.x before 6.3.2, and 6.4.x before 6.4.2 on Windows and OS X allows local users to cause a denial of service (application crash or hang) via unspecified vectors.
[IC95875]
[http://www-01.ibm.com/support/docview.wss?uid=swg21673318]
[ibm-tsm-cve20140876-crash(91063)]
IBM Cognos TM1 10.2.0.2 before IF1 and 10.2.2.0 before IF1 allows remote attackers to bypass intended access restrictions by visiting the Rights page and then following a generated link.
[http://www-01.ibm.com/support/docview.wss?uid=swg21682395]
[ibm-cognos-cve20140877-sec-bypass(91064)]
The IBMSecureRandom component in the IBMJCE and IBMSecureRandom cryptographic providers in IBM SDK Java Technology Edition 5.0 before Service Refresh 16 FP6, 6 before Service Refresh 16, 6.0.1 before Service Refresh 8, 7 before Service Refresh 7, and 7R1 before Service Refresh 1 makes it easier for context-dependent attackers to defeat cryptographic protection mechanisms by predicting the random number generator's output.
[61264]
[http://www.ibm.com/support/docview.wss?uid=swg21675343]
[http://www.ibm.com/support/docview.wss?uid=swg21675588]
[http://www.ibm.com/support/docview.wss?uid=swg21677387]
[67601]
[http://www-01.ibm.com/support/docview.wss?uid=swg21672043]
[http://www-01.ibm.com/support/docview.wss?uid=swg21673836]
[http://www-01.ibm.com/support/docview.wss?uid=swg21674539]
[http://www-01.ibm.com/support/docview.wss?uid=swg21676672]
[http://www-01.ibm.com/support/docview.wss?uid=swg21676703]
[http://www-01.ibm.com/support/docview.wss?uid=swg21676746]
[http://www-01.ibm.com/support/docview.wss?uid=swg21679610]
[http://www-01.ibm.com/support/docview.wss?uid=swg21679713]
[http://www-01.ibm.com/support/docview.wss?uid=swg21680750]
[http://www-01.ibm.com/support/docview.wss?uid=swg21681256]
[http://www-01.ibm.com/support/docview.wss?uid=swg21683484]
[http://www-01.ibm.com/support/docview.wss?uid=swg21686717]
[http://www-01.ibm.com/support/docview.wss?uid=swg21689593]
[ibm-java-cve20140878-weak-sec(91084)]
Stack-based buffer overflow in the Taskmaster Capture ActiveX control in IBM Datacap Taskmaster Capture 8.0.1, and 8.1 before FP2, allows remote attackers to execute arbitrary code via unspecified vectors.
[http://www-01.ibm.com/support/docview.wss?uid=swg21666888]
[ibm-taskmaster-cve20140879-code-exec(91115)]
IBM SAN Volume Controller; Storwize V3500, V3700, V5000, and V7000; and Flex System V7000 with software 6.3 and 6.4 before 6.4.1.8, and 7.1 and 7.2 before 7.2.0.3, allow remote attackers to obtain CLI access, and consequently cause a denial of service, via unspecified traffic to the administrative IP address.
[http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004570]
[ibm-storwize-cve20140880-cli(91145)]
The TPM on Integrated Management Module II (IMM2) on IBM Flex System x222 servers with firmware 1.00 through 3.56 allows remote attackers to obtain sensitive key information or cause a denial of service by leveraging an incorrect configuration. IBM X-Force ID: 91146.
[https://support.lenovo.com/us/en/solutions/ht114524]
[https://www.ibm.com/blogs/psirt/security-bulletin-tpm-on-the-integrated-management-module-ii-imm2-of-flex-system-x222-compute-node-is-not-configured-correctly-cve-2014-0881/]
[https://www.ibm.com/support/home/docdisplay?lndocid=MIGR-5094725]
Integrated Management Module II (IMM2) on IBM Flex System, NeXtScale, System x3xxx, and System x iDataPlex systems might allow remote authenticated users to obtain sensitive account information via vectors related to generated Service Advisor data (FFDC). IBM X-Force ID: 91149.
[https://support.lenovo.com/us/en/solutions/ht114525]
[https://www.ibm.com/blogs/psirt/security-bulletin-account-specific-information-likely-to-be-present-in-service-advisor-data-ffdc-on-the-integrated-management-module-ii-imm2-cve-2014-0882/]
[https://www.ibm.com/support/home/docdisplay?lndocid=MIGR-5094726]
Cross-site scripting (XSS) vulnerability in IBM Power Hardware Management Console (HMC) 7R7.1.0, 7R7.2.0, 7R7.3.0 through 7R7.3.5, 7R7.7.0 through SP3, and 7R7.8.0 before SP1 allows remote attackers to inject arbitrary web script or HTML via the user name on the logon screen. IBM X-Force ID: 91163.
[http://www-01.ibm.com/support/docview.wss?uid=nas8N1019972]
Cross-site scripting (XSS) vulnerability in the Admin Web UI in IBM Lotus Protector for Mail Security 2.8.x before 2.8.1-22905 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
[http://www-01.ibm.com/support/docview.wss?uid=swg21668124]
[ibm-lpms-cve20140884-xss(91170)]
Cross-site request forgery (CSRF) vulnerability in the Admin Web UI in IBM Lotus Protector for Mail Security 2.8.x before 2.8.1-22905 allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors.
[http://www-01.ibm.com/support/docview.wss?uid=swg21668124]
[ibm-lpms-cve20140885-csrf(91171)]
The Admin Web UI in IBM Lotus Protector for Mail Security 2.8.x before 2.8.1-22905 allows remote authenticated users to bypass intended access restrictions and execute arbitrary commands via unspecified vectors.
[http://www-01.ibm.com/support/docview.wss?uid=swg21668124]
[ibm-lpms-cve20140886-command(91172)]
The Admin Web UI in IBM Lotus Protector for Mail Security 2.8.x before 2.8.1-22905 allows remote authenticated users to execute arbitrary commands with root privileges via unspecified vectors.
[http://www-01.ibm.com/support/docview.wss?uid=swg21668124]
[ibm-lpms-cve20140887-command-root(91173)]
IBM Worklight Foundation 5.x and 6.x before 6.2.0.0, as used in Worklight and Mobile Foundation, allows remote authenticated users to bypass the application-authenticity feature via unspecified vectors.
[http://www-01.ibm.com/support/docview.wss?uid=swg21682798]
[ibm-worklight-cve20140888-tamper(91239)]
Multiple cross-site scripting (XSS) vulnerabilities in IBM Atlas Suite (aka Atlas Policy Suite), as used in Atlas eDiscovery Process Management through 6.0.3, Disposal and Governance Management for IT through 6.0.3, and Global Retention Policy and Schedule Management through 6.0.3, allow remote attackers to inject arbitrary web script or HTML via unspecified parameters.
[59681]
[http://www.ibm.com/connections/blogs/PSIRT/entry/security_bulletin_atlas_suite_atlas_policy_suite_cross_site_scripting_vulnerabilities_cve_2014_0889]
[http://www-01.ibm.com/support/entdocview.wss?uid=swg21679081]
[ibm-atlas-cve20140889-xss(91241)]
The Connect client in IBM Sametime 8.5.1, 8.5.1.1, 8.5.1.2, 8.5.2, 8.5.2.1, 9.0, and 9.0.0.1, when a certain com.ibm.collaboration.realtime.telephony.*.level setting is used, logs cleartext passwords during Audio/Video chat sessions, which allows local users to obtain sensitive information by reading a log file.
[http://www-01.ibm.com/support/docview.wss?uid=swg21665658]
[ibm-lotus-cve20148090-info-disc(91282)]
IBM WebSphere Application Server (WAS) 7.0.x before 7.0.0.33, 8.0.x before 8.0.0.9, and 8.5.x before 8.5.5.2 allows remote attackers to obtain sensitive information by leveraging incorrect request handling by the (1) Proxy or (2) ODR server.
[PI09786]
[http://www-01.ibm.com/support/docview.wss?uid=swg21669554]
[http://www-01.ibm.com/support/docview.wss?uid=swg21676091]
[http://www-01.ibm.com/support/docview.wss?uid=swg21676092]
[ibm-was-cve20140891-info-disc(91286)]
IBM Notes and Domino 8.5.x before 8.5.3 FP6 IF3 and 9.x before 9.0.1 FP1 on 32-bit Linux platforms use incorrect gcc options, which makes it easier for remote attackers to execute arbitrary code by leveraging the absence of the NX protection mechanism and placing crafted x86 code on the stack, aka SPR KLYH9GGS9W.
[VU#350089]
[http://www-01.ibm.com/support/docview.wss?uid=swg21670264]
[ibm-notes-cve20140892-linux32-rce(91286)]
Cross-site scripting (XSS) vulnerability in customreport.jsp in IBM Maximo Asset Management 7.5.x before 7.5.0.5 IFIX006 and SmartCloud Control Desk 7.x before 7.5.0.3 and 7.5.1.x before 7.5.1.2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified parameters.
[IV55019]
[http://www-01.ibm.com/support/docview.wss?uid=swg21670870]
[ibm-maximo-cve20140893-xss(91287)]
RICOS in IBM Algo Credit Limits (aka ACLM) 4.5.0 through 4.7.0 before 4.7.0.03 FP5 in IBM Algorithmics allows context-dependent attackers to discover database credentials by reading the DbUser and DbPass fields in an XML document.
[http://packetstormsecurity.com/files/127304/IBM-Algorithmics-RICOS-Disclosure-XSS-CSRF.html]
[20140630 SEC Consult SA-20140630-0 :: Multiple vulnerabilities in IBM Algorithmics RICOS]
[20140630 SEC Consult SA-20140630-0 :: Multiple vulnerabilities in IBM Algorithmics RICOS]
[http://www-01.ibm.com/support/docview.wss?uid=swg21675881]
[ibm-aclm-cve20140894-database-pw(91313)]
[https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140630-0_IBM_Algorithmics_RICOS_multiple_vulnerabilities_v10.txt]
Buffer overflow in the vsflex8l ActiveX control in IBM SPSS SamplePower 3.0.1 before FP1 3.0.1-IM-S3SAMPC-WIN32-FP001-IF02 allows remote attackers to execute arbitrary code via a crafted ComboList property value.
[http://www.solarwinds.com/documentation/orion/docs/releasenotes/releasenotes.htm]
[PI09800]
[http://www-01.ibm.com/support/docview.wss?uid=swg21666790]
[ibm-spss-cve20140895-code-exec(91314)]
IBM WebSphere Application Server (WAS) Liberty Profile 8.5.x before 8.5.5.2 allows remote attackers to obtain sensitive information via a crafted request.
[PI10134]
[http://www-01.ibm.com/support/docview.wss?uid=swg21669554]
[ibm-was-cve20140896-info-disc(91326)]
The Configuration Patterns component in IBM Flex System Manager (FSM) 1.2.0.x, 1.2.1.x, 1.3.0.x, and 1.3.1.x uses a weak algorithm in an encryption step during Chassis Management Module (CMM) account creation, which makes it easier for remote authenticated users to defeat cryptographic protection mechanisms via unspecified vectors.
[http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5096153]
[IT03824]
[ibm-flex-cve20140897-weak-encryption(91395)]
ftpd in IBM AIX 7.1.1 before SP10 and 7.1.2 before SP5, when a Workload Partition (aka WPAR) for AIX 5.2 or 5.3 is used, allows remote authenticated users to bypass intended permission settings and modify arbitrary files via FTP commands.
[http://aix.software.ibm.com/aix/efixes/security/wparcre_advisory.asc]
[IV51420]
[IV51421]
[ibm-aix-wpar-ftpd(91396)]
The Device Administrator code in Android before 4.4.1_r1 might allow attackers to spoof device administrators and consequently bypass MDM restrictions by leveraging failure to update the mAdminMap data structure.
[https://securityintelligence.com/how-to-cheat-your-mdm-compliance-without-a-password/]
Cross-site scripting (XSS) vulnerability in the Social Rendering implementation in the IBM Connections integration in IBM WebSphere Portal 8.0.0.x before 8.0.0.1 CF11 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
[66559]
[PI12659]
[http://www-01.ibm.com/support/docview.wss?uid=swg21667016]
[ibm-wsportal-cve20140901-sr-xss(91398)]
The update process in IBM Security AppScan Standard 7.9 through 8.8 does not require integrity checks of downloaded files, which allows remote attackers to execute arbitrary code via a crafted file.
[http://www-01.ibm.com/support/docview.wss?uid=swg21666775]
[ibm-appscan-cve20140904-code-exec(91536)]
IBM InfoSphere BigInsights 2.0 through 2.1.2 does not set the secure flag for the LTPA cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.
[http://www-01.ibm.com/support/docview.wss?uid=swg21680830]
[ibm-infosphere-cve20140905-info-disc(91720)]
The Meeting Server in IBM Sametime 8.x through 8.5.2.1 and 9.x through 9.0.0.1 does not check whether a session cookie is current, which allows remote attackers to conduct user-search actions by leveraging possession of a (1) expired or (2) invalidated cookie.
[http://www-01.ibm.com/support/docview.wss?uid=swg21671201]
[sametime-cve20140906-cookie-validity(91854)]
Multiple untrusted search path vulnerabilities in unspecified (1) setuid and (2) setgid programs in IBM DB2 9.5, 9.7 before FP9a, 9.8, 10.1 before FP3a, and 10.5 before FP3a on Linux and UNIX allow local users to gain root privileges via a Trojan horse library.
Per http://cwe.mitre.org/data/definitions/426.html
"CWE-426: Untrusted Search Path"
[http://packetstormsecurity.com/files/126940/IBM-DB2-Privilege-Escalation.html]
[20140603 CVE-2014-0907 - SetUID/SetGID Programs Allow Privilege Escalation Via Insecure RPATH In IBM DB2]
[http://www.ibm.com/support/docview.wss?uid=swg1IT00686]
[http://www.ibm.com/support/docview.wss?uid=swg21610582#4]
[http://www.ibm.com/support/docview.wss?uid=swg21672100]
[67617]
[1030670]
[1030671]
[http://www-01.ibm.com/support/docview.wss?uid=isg400001841]
[http://www-01.ibm.com/support/docview.wss?uid=isg400001843]
[IT00627]
[IT00684]
[IT00685]
[IT00686]
[IT00687]
[http://www-01.ibm.com/support/docview.wss?uid=swg21680454]
[http://www-304.ibm.com/support/docview.wss?uid=swg21676135]
[ibm-cve20140907-priv-escalation(91869)]
[https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-0907/]
The User Attribute implementation in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.2, and 8.5.x through 8.5.0.1 does not verify authorization for read or write access to attribute values, which allows remote authenticated users to obtain sensitive information, configure e-mail notifications, or modify task assignments via REST API calls.
[JR49505]
[http://www-01.ibm.com/support/docview.wss?uid=swg21669330]
[ibm-bpm-cve20140908-priv-escalation(91870)]
The Administration and Reporting Tool in IBM Rational License Key Server (RLKS) 8.1.4.x before 8.1.4.4 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.
[69642]
[http://www-01.ibm.com/support/docview.wss?uid=swg21681449]
[http://www-01.ibm.com/support/docview.wss?uid=swg24038045]
[ibm-rlksart-cve20140909-cookie(91872)]
Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 6.1.0.0 through 6.1.0.6 CF27, 6.1.5.0 through 6.1.5.3 CF27, and 7.0.0 through 7.0.0.2 CF28 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
[PI18845]
[http://www-01.ibm.com/support/docview.wss?uid=swg21675257]
[ibm-wcm-cve20140910-xss(91875)]
inetd in IBM WebSphere MQ 7.1.x before 7.1.0.5 and 7.5.x before 7.5.0.4 allows remote attackers to cause a denial of service (disk or CPU consumption) via unspecified vectors.
[IV55886]
[http://www-01.ibm.com/support/docview.wss?uid=swg21670374]
[ibm-websphere-cve20140911-dos(91876)]
IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 allow remote attackers to obtain sensitive product information via vectors related to an error page. IBM X-Force ID: 92072.
[http://www-01.ibm.com/support/docview.wss?uid=swg21674739]
[ibm-sterling-cve20140912-info-disc(92072)]
Cross-site scripting (XSS) vulnerability in IBM iNotes and Domino 8.5.3 FP6 before IF2 and 9.0.1 before FP1 allows remote attackers to inject arbitrary web script or HTML via an e-mail message, aka SPR BFEY9GXHZE.
[1030215]
[http://www-01.ibm.com/support/docview.wss?uid=swg21671981]
[ibm-inotes-cve20140913-xss(91880)]
Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 6.2 through 6.2.8 and 6.x and 7.x through 7.5.0.6, Maximo Asset Management 7.5 through 7.5.0.3 and 7.5.1 through 7.5.1.2 for SmartCloud Control Desk, and Maximo Asset Management 6.2 through 6.2.8 for Tivoli IT Asset Management for IT and Maximo Service Desk allows remote authenticated users to inject arbitrary web script or HTML via the Query Description Field.
[59570]
[59640]
[20140811 IBM Maximo: Cross-site Scripting Vulnerability Addressed in Asset and Service Management (CVE-2014-0914 and -0915)]
[68839]
[IV56679]
[http://www-01.ibm.com/support/docview.wss?uid=swg21678885]
[ibm-maximo-cve20140914-xss(91883)]
Multiple cross-site scripting (XSS) vulnerabilities in IBM Maximo Asset Management 6.2 through 6.2.8, 6.x and 7.1 through 7.1.1.2, and 7.5 through 7.5.0.6; Maximo Asset Management 7.5 through 7.5.0.3 and 7.5.1 through 7.5.1.2 for SmartCloud Control Desk; and Maximo Asset Management 6.2 through 6.2.8, 7.1 through 7.1.1.2, and 7.2 for Tivoli Asset Management for IT and certain other products allow remote authenticated users to inject arbitrary web script or HTML via (1) the KPI display name field or (2) a portlet field.
[59570]
[59640]
[20140811 IBM Maximo: Cross-site Scripting Vulnerability Addressed in Asset and Service Management (CVE-2014-0914 and -0915)]
[IV56680]
[http://www-01.ibm.com/support/docview.wss?uid=swg21678894]
[ibm-maximo-cve20140915-xss(91884)]
Cross-site scripting (XSS) vulnerability in IBM Eclipse Help System (IEHS) in IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0 through 7.0.0.2 CF27, and 8.0 before 8.0.0.1 CF06 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
[67339]
[PI14125]
[http://www-01.ibm.com/support/docview.wss?uid=swg21670753]
[ibm-iehs-cve20140917-xss(91979)]
Directory traversal vulnerability in IBM Eclipse Help System (IEHS) in IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0 through 7.0.0.2 CF27, and 8.0 before 8.0.0.1 CF06 allows remote attackers to read arbitrary files via a crafted URL.
[67340]
[PI14125]
[http://www-01.ibm.com/support/docview.wss?uid=swg21670753]
[ibm-iehs-cve20140918-traversal(91980)]
IBM DB2 9.5 through 10.5 on Linux, UNIX, and Windows stores passwords during the processing of certain SQL statements by the monitoring and audit facilities, which allows remote authenticated users to obtain sensitive information via commands associated with these facilities.
[74217]
[1032247]
[IT07397]
[IT07547]
[IT07552]
[IT07553]
[IT07554]
[http://www-01.ibm.com/support/docview.wss?uid=swg21698021]
IBM SPSS Analytic Server 1.0 before IF002 and 1.0.1 before IF004 logs cleartext passwords, which allows remote authenticated users to obtain sensitive information via unspecified vectors.
[PI13527]
[http://www-01.ibm.com/support/docview.wss?uid=swg21669506]
[ibm-spssas-cve20140920-plaintext-pw(92073)]
The server in IBM MessageSight 1.x before 1.1.0.0-IBM-IMA-IT01015 allows remote attackers to cause a denial of service (daemon crash and message data loss) via malformed headers during a WebSockets connection upgrade.
[IC98583]
[http://www-01.ibm.com/support/docview.wss?uid=swg21670278]
[ibm-messagesight-cve20140921-dos(92074)]
IBM MessageSight 1.x before 1.1.0.0-IBM-IMA-IT01015 allows remote attackers to cause a denial of service (resource consumption) via WebSockets MQ Telemetry Transport (MQTT) data.
[IC98692]
[http://www-01.ibm.com/support/docview.wss?uid=swg21670278]
[ibm-messagesight-cve20140922-dos(92075)]
IBM MessageSight 1.x before 1.1.0.0-IBM-IMA-IT01015 allows remote attackers to cause a denial of service (daemon restart) via crafted MQ Telemetry Transport (MQTT) authentication data.
[IT00582]
[http://www-01.ibm.com/support/docview.wss?uid=swg21670278]
[ibm-messagesight-cve20140923-dos(92076)]
IBM MessageSight 1.x before 1.1.0.0-IBM-IMA-IT01015 does not verify that all of the characters of a password are correct, which makes it easier for remote authenticated users to bypass intended access restrictions by leveraging knowledge of a password substring.
[IT00583]
[http://www-01.ibm.com/support/docview.wss?uid=swg21670278]
[ibm-messagesight-cve20140924-sec-bypass(92077)]
Open redirect vulnerability in IBM Sterling Control Center 5.4.0 before 5.4.0.1 iFix 3 and 5.4.1 before 5.4.1.0 iFix 2 allows remote authenticated users to redirect users to arbitrary web sites and conduct phishing attacks via a crafted URL.
Per: http://cwe.mitre.org/data/definitions/601.html
CWE-601: URL Redirection to Untrusted Site
[http://www-01.ibm.com/support/docview.wss?uid=swg21673004]
[ibm-sterlingcc-cve20140925-redirect(92078)]
The ActiveMQ admin user interface in IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 allows remote attackers to bypass authentication by leveraging knowledge of the port number and webapp path. IBM X-Force ID: 92259.
[http://www-01.ibm.com/support/docview.wss?uid=swg21674739]
[ibm-sterling-cve20140927-sec-bypass(92259)]
Cross-site request forgery (CSRF) vulnerability in the Profiles component in IBM Connections through 3.0.1.1 CR3 allows remote authenticated users to hijack the authentication of arbitrary users for requests that trigger follow actions.
[LO79622]
[http://www-01.ibm.com/support/docview.wss?uid=swg21668509]
[ibm-connections-cve20140929-csrf(92261)]
The ptrace system call in IBM AIX 5.3, 6.1, and 7.1, and VIOS 2.2.x, allows local users to cause a denial of service (system crash) or obtain sensitive information from kernel memory via a crafted PT_LDINFO operation.
[http://aix.software.ibm.com/aix/efixes/security/ptrace_advisory.asc]
[20140506 CVE-2014-0930 - Kernel Memory Leak And Denial Of Service Condition in IBM AIX]
[IV58766]
[IV58840]
[IV58861]
[IV58888]
[IV58948]
[IV59045]
[IV59675]
[ibm-aix-cve20140930-dos(92262)]
[https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-0930/]
Multiple XML external entity (XXE) vulnerabilities in the (1) CCRC WAN Server / CM Server, (2) Perl CC/CQ integration trigger scripts, (3) CMAPI Java interface, (4) ClearCase remote client, and (5) CMI and OSLC-based ClearQuest integrations components in IBM Rational ClearCase 7.1.0.x, 7.1.1.x, 7.1.2 through 7.1.2.13, 8.0 through 8.0.0.10, and 8.0.1 through 8.0.1.3 allow remote attackers to cause a denial of service or access other servers via crafted XML data. IBM X-Force ID: 92263.
[http://www-01.ibm.com/support/docview.wss?uid=swg21668868]
[ibm-clearcase-cve20140931-xxe(92263)]
Cross-site scripting (XSS) vulnerability in IBM Sterling Order Management 8.5 before HF105 and Sterling Selling and Fulfillment Foundation 9.0 before HF85 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
[66993]
[IT00419]
[http://www-01.ibm.com/support/docview.wss?uid=swg21670912]
[ibm-sterlingom-cve20140932-xss(92264)]
Cross-site request forgery (CSRF) vulnerability in IBM InfoSphere Information Server Metadata Workbench 8.1 through 9.1 allows remote attackers to hijack the authentication of arbitrary users.
[JR49605]
[http://www-01.ibm.com/support/docview.wss?uid=swg21671141]
[ibm-iismw-cve20140933-csrf(92273)]
Unspecified vulnerability in IBM Smart Analytics System 7700 before FP 2.1.3.0 and 7710 before FP 2.1.3.0 allows local users to gain privileges via vectors related to events.
[http://www-01.ibm.com/support/docview.wss?uid=swg21672887]
[ibm-smartanalytics-cve20140935-priv-esc(92298)]
IBM Security AppScan Source 8.0 through 9.0, when the publish-assessment permission is not properly restricted for the configured database server, transmits cleartext assessment data, which allows remote attackers to obtain sensitive information by sniffing the network.
[http://www-01.ibm.com/support/docview.wss?uid=swg21674750]
[ibm-appscan-cve20140936-priv-escalation(92317)]
Multiple cross-site scripting (XSS) vulnerabilities in IBM Tivoli Service Automation Manager 7.2.2.2 before 7.2.2.2-TIV-TSAM-LA0041 allow remote attackers to inject arbitrary web script or HTML via vectors involving the (1) REST API or (2) Self Service UI.
[70247]
[IV46530]
[IV47175]
[http://www-01.ibm.com/support/docview.wss?uid=swg21686189]
[ibm-tivoli-cve20140940-xss(92381)]
Cross-site scripting (XSS) vulnerability in webtop/eventviewer/eventViewer.jsp in the Web GUI in IBM Netcool/OMNIbus 7.4.0 before FP2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2014-0942.
[http://www-01.ibm.com/support/docview.wss?uid=swg21671686]
[ibm-netcoolomnibus-cve20140941-xss(92400)]
Cross-site scripting (XSS) vulnerability in webtop/eventviewer/eventViewer.jsp in the Web GUI in IBM Netcool/OMNIbus 7.4.0 before FP2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2014-0941.
[http://www-01.ibm.com/support/docview.wss?uid=swg21671686]
[ibm-netcoolomnibus-cve20140942-xss(92401)]
IBM WebSphere Commerce 6.0 Feature Pack 2 through Feature Pack 5, 7.0.0.0 through 7.0.0.8, and 7.0 Feature Pack 1 through Feature Pack 7 allows remote attackers to cause a denial of service (resource consumption and daemon crash) via a malformed id parameter in a request.
[1030284]
[JR49881]
[JR49996]
[http://www-01.ibm.com/support/docview.wss?uid=swg21671377]
[ibm-websphere-cve20140943-dos(92402)]
Cross-site request forgery (CSRF) vulnerability in the RES Console in Rule Execution Server in IBM Operational Decision Manager 7.5 before FP3 IF37, 8.0 before MP1 FP2, and 8.5 before MP1 IF26 allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS sequences.
[http://www-01.ibm.com/support/docview.wss?uid=swg21671324]
[ibm-odm-cve20140944-csrf(92559)]
Cross-site scripting (XSS) vulnerability in the RES Console in Rule Execution Server in IBM Operational Decision Manager 7.5 before FP3 IF37, 8.0 before MP1 FP2, and 8.5 before MP1 IF26 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
[http://www-01.ibm.com/support/docview.wss?uid=swg21671324]
[ibm-odm-cve20140945-xss(92562)]
The RES Console in Rule Execution Server in IBM Operational Decision Manager 7.5 before FP3 IF37, 8.0 before MP1 FP2, and 8.5 before MP1 IF26 does not send appropriate Cache-Control HTTP headers, which allows remote attackers to obtain sensitive information by leveraging an unattended workstation.
[http://www-01.ibm.com/support/docview.wss?uid=swg21671324]
[ibm-odm-cve20140946-cache(92573)]
Unspecified vulnerability in the server in IBM Rational Software Architect Design Manager 4.0.6 allows remote authenticated users to execute arbitrary code via a crafted update site.
[http://www-01.ibm.com/support/docview.wss?uid=swg21678323]
[ibm-rsadm-cve20140947-update(92620)]
Unspecified vulnerability in IBM Rational Software Architect Design Manager and Rational Rhapsody Design Manager 3.x and 4.x before 4.0.7 allows remote authenticated users to execute arbitrary code via a crafted ZIP archive.
[http://www-01.ibm.com/support/docview.wss?uid=swg21678323]
[ibm-rsadm-cve20140948-zip(92621)]
IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0 through 7.0.0.2 CF28, and 8.0 before 8.0.0.1 CF12 allows remote attackers to cause a denial of service (resource consumption and daemon crash) via a crafted web request.
[PI15692]
[http://www-01.ibm.com/support/docview.wss?uid=swg21672572]
[ibm-websphere-cve20140949-dos(92622)]
Multiple XML external entity (XXE) vulnerabilities in (1) CQWeb / CM Server, (2) ClearQuest Native client, (3) ClearQuest Eclipse client, and (4) ClearQuest Eclipse Designer components in IBM Rational ClearQuest 7.1.1 through 7.1.1.9, 7.1.2 through 7.1.2.13, 8.0.0 through 8.0.0.10, and 8.0.1 through 8.0.1.3 allow remote attackers to cause a denial of service or access other servers via crafted XML data. IBM X-Force ID: 92623.
[http://www-01.ibm.com/support/docview.wss?uid=swg21675164]
[ibm-clearquest-cve20140950-info-disc(92623)]
Cross-site scripting (XSS) vulnerability in FilterForm.jsp in IBM WebSphere Portal 7.0 before 7.0.0.2 CF28 and 8.0 before 8.0.0.1 CF12 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
[PI15690]
[http://www-01.ibm.com/support/docview.wss?uid=swg21672572]
[ibm-websphere-cve20140951-xss(92624)]
Cross-site scripting (XSS) vulnerability in boot_config.jsp in IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF28, 7.0 through 7.0.0.2 CF28, and 8.0 before 8.0.0.1 CF12 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
[PI16041]
[http://www-01.ibm.com/support/docview.wss?uid=swg21672572]
[ibm-websphere-cve20140952-xss(92625)]
Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 6.1.0.0 through 6.1.0.6 CF27, 6.1.5.0 through 6.1.5.3 CF27, 7.0.0 through 7.0.0.2 CF28, and 8.0.0 before 8.0.0.1 CF12 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
[1030669]
[PI16127]
[http://www-01.ibm.com/support/docview.wss?uid=swg21680230]
[ibm-wesphere-cve20140953-xss(92626)]
IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0 through 7.0.0.2 CF28, and 8.0 before 8.0.0.1 CF12 does not validate JSP includes, which allows remote attackers to obtain sensitive information, bypass intended request-dispatcher access restrictions, or cause a denial of service (memory consumption) via a crafted URL.
[PI15723]
[http://www-01.ibm.com/support/docview.wss?uid=swg21672572]
[ibm-websphere-cve20140954-dos(92627)]
Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 8.0 before 8.0.0.1 CF12, when Social Rendering in Connections integration is enabled, allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
[PI15583]
[http://www-01.ibm.com/support/docview.wss?uid=swg21672572]
[ibm-websphere-cve20140955-xss(92628)]
Cross-site scripting (XSS) vulnerability in googlemap.jsp in IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0 through 7.0.0.2 CF28, and 8.0 before 8.0.0.1 CF12 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
[PI16040]
[http://www-01.ibm.com/support/docview.wss?uid=swg21672572]
[ibm-websphere-cve20140956-xss(92629)]
Cross-site scripting (XSS) vulnerability in IBM Business Process Manager 7.5 through 8.5.5, and WebSphere Lombardi Edition 7.2, allows remote attackers to inject arbitrary web script or HTML via a crafted URL that triggers a service failure.
[59557]
[JR49990]
[http://www-01.ibm.com/support/docview.wss?uid=swg21679064]
[ibm-bpm-cve20140957-xss(92738)]
Open redirect vulnerability in IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0 through 7.0.0.2 CF28, and 8.0 before 8.0.0.1 CF12 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
CWE-601: URL Redirection to Untrusted Site ('Open Redirect') http://cwe.mitre.org/data/definitions/601.html
[PI15689]
[http://www-01.ibm.com/support/docview.wss?uid=swg21672572]
[ibm-websphere-cve20140958-url-redirect(92739)]
IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0 through 7.0.0.2 CF28, and 8.0 before 8.0.0.1 CF12 allows remote authenticated users to cause a denial of service (infinite loop) via a login redirect.
[PI16462]
[http://www-01.ibm.com/support/docview.wss?uid=swg21672572]
[ibm-websphere-cve20140959-dos(92741)]
IBM PureApplication System 1.0 before 1.0.0.4 cfix8 and 1.1 before 1.1.0.4 IF1 allows remote authenticated users to bypass intended access restrictions by establishing an SSH session from a deployed virtual machine.
[http://www-01.ibm.com/support/docview.wss?uid=swg21675216]
[ibm-pure-cve20140960-sec-bypass(92743)]
Cross-site request forgery (CSRF) vulnerability in IBM Tivoli Identity Manager (ITIM) 5.0 before 5.0.0.15 and 5.1 before 5.1.0.15 and IBM Security Identity Manager (ISIM) 6.0 before 6.0.0.2 allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS sequences.
[67909]
[http://www-01.ibm.com/support/docview.wss?uid=swg21674754]
[ibm-sim-cve20140961-csrf(92747)]
The Reverse Proxy feature in IBM Global Security Kit (aka GSKit) in IBM Security Access Manager (ISAM) for Web 7.0 before 7.0.0-ISS-SAM-IF0006 and 8.0 before 8.0.0.3-ISS-WGA-IF0002 allows remote attackers to cause a denial of service (infinite loop) via crafted SSL messages.
Per: http://www-01.ibm.com/support/docview.wss?uid=swg21672192
"Affected Products and Versions
All versions of IBM Security Access Manager for Web, both software and appliance: 7.0, 8.0"
[59245]
[http://www.ibm.com/support/docview.wss?uid=swg21675496]
[67238]
[1030707]
[IV59660]
[http://www-01.ibm.com/support/docview.wss?uid=swg21672192]
[http://www-01.ibm.com/support/docview.wss?uid=swg21676091]
[http://www-01.ibm.com/support/docview.wss?uid=swg21676092]
[http://www-304.ibm.com/support/docview.wss?uid=swg21680803]
[ibm-gskit-cve20140963-dos(92844)]
IBM WebSphere Application Server (WAS) 6.1.0.0 through 6.1.0.47 and 6.0.2.0 through 6.0.2.43 allows remote attackers to cause a denial of service via crafted TLS traffic, as demonstrated by traffic from a CVE-2014-0160 vulnerability-assessment tool.
[1030280]
[PI14306]
[PI16981]
[PI17128]
[http://www-01.ibm.com/support/docview.wss?uid=swg21671835]
[http://www-304.ibm.com/support/docview.wss?uid=swg21673808]
[ibm-was-cve20140964-scan(92877)]
IBM WebSphere Application Server (WAS) 7.0.x before 7.0.0.33, 8.0.x before 8.0.0.9, and 8.5.x before 8.5.5.3 allows remote attackers to obtain sensitive information via a crafted SOAP response.
[68210]
[PI11434]
[http://www-01.ibm.com/support/docview.wss?uid=swg21676091]
[http://www-01.ibm.com/support/docview.wss?uid=swg21676092]
[http://www-01.ibm.com/support/docview.wss?uid=swg21681249]
[ibm-websphere-cve20140965-info-disc(92878)]
SQL injection vulnerability in the GDS component in IBM InfoSphere Master Data Management - Collaborative Edition 10.x and 11.x before 11.0-FP5 and InfoSphere Master Data Management Server for Product Information Management 9.x through 11.x before 11.3-IF2 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
[60679]
[60693]
[60695]
[http://www-01.ibm.com/support/docview.wss?uid=swg21681651]
[ibm-infospheremdm-cve20140966-sql-injection(92880)]
Cross-site scripting (XSS) vulnerability in the GDS component in IBM InfoSphere Master Data Management - Collaborative Edition 10.x and 11.x before 11.0 FP4 and InfoSphere Master Data Management Server for Product Information Management 9.0 and 9.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
[http://www-01.ibm.com/support/docview.wss?uid=swg21677300]
[ibm-imdm-cve20140967-xss(92882)]
Cross-site scripting (XSS) vulnerability in the GDS component in IBM InfoSphere Master Data Management - Collaborative Edition 10.x and 11.x before 11.0 FP4 and InfoSphere Master Data Management Server for Product Information Management 9.0 and 9.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL for an MHTML document.
[http://www-01.ibm.com/support/docview.wss?uid=swg21677301]
[ibm-imdm-cve20140968-xss(92884)]
Cross-site request forgery (CSRF) vulnerability in the GDS component in IBM InfoSphere Master Data Management - Collaborative Edition 10.x and 11.x before 11.0-FP5 and InfoSphere Master Data Management Server for Product Information Management 9.x through 11.x before 11.3-IF2 allows remote authenticated users to hijack the authentication of arbitrary users.
[60679]
[60693]
[60695]
[69262]
[http://www-01.ibm.com/support/docview.wss?uid=swg21681649]
[ibm-infospheremdm-cve20140969-csrf(92885)]
The GDS component in IBM InfoSphere Master Data Management - Collaborative Edition 10.x and 11.x before 11.0 FP4 and InfoSphere Master Data Management Server for Product Information Management 9.0 and 9.1 allows remote authenticated users to inject links via unspecified vectors.
[http://www-01.ibm.com/support/docview.wss?uid=swg21677304]
[ibm-imdm-cve20140970-link-inj(92950)]
The kgsl graphics driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, does not properly prevent write access to IOMMU context registers, which allows local users to select a custom page table, and consequently write to arbitrary memory locations, by using a crafted GPU command stream to modify the contents of a certain register.
[https://www.codeaurora.org/projects/security-advisories/unprivileged-gpu-command-streams-can-change-the-iommu-page-table-cve-2014-0972]
The image_verify function in platform/msm_shared/image_verify.c in the Little Kernel (LK) bootloader, as distributed with Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, does not check whether a certain digest size is consistent with the RSA_public_decrypt API specification, which makes it easier for attackers to bypass boot-image authentication requirements via trailing data.
[http://source.android.com/security/bulletin/2016-07-01.html]
[https://www.codeaurora.org/projects/security-advisories/incomplete-signature-parsing-during-boot-image-authentication-leads-to-signature-forgery-cve-2014-0973]
The boot_linux_from_mmc function in app/aboot/aboot.c in the Little Kernel (LK) bootloader, as distributed with Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, does not properly validate a certain address value, which allows attackers to write data to a controllable memory location by leveraging the ability to initiate an attempted boot of an arbitrary image.
[http://source.android.com/security/bulletin/2016-07-01.html]
[https://www.codeaurora.org/projects/security-advisories/lk-insufficient-verification-tagaddr-when-loading-device-tree-cve-2014-0974]
Cross-site scripting (XSS) vulnerability in the Rich Text Editor in Movable Type 5.0x, 5.1x before 5.161, 5.2.x before 5.2.9, and 6.0.x before 6.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=734304]
[http://movabletype.org/news/2013/11/movable_type_601_529_and_5161_released_to_close_security_vul.html]
[[oss-security] 20140106 CVE Request: cross-site scripting vulnerabilities in movable type 6.0.1, 5.2.9, and 5.161]
[[oss-security] 20140107 Re: CVE Request: cross-site scripting vulnerabilities in movable type 6.0.1, 5.2.9, and 5.161]
[DSA-2841]
[64657]
[1029588]
[movabletype-richtexteditor-xss(90095)]
Stack-based buffer overflow in the yyerror function in lib/cgraph/scan.l in Graphviz 2.34.0 allows remote attackers to have unspecified impact via a long line in a dot file.
[[oss-security] 20140107 CVE Request: graphviz: stack-based buffer overflow in yyerror()]
[[oss-security] 20140107 Re: CVE Request: graphviz: stack-based buffer overflow in yyerror()]
[DSA-2843]
[MDVSA-2014:024]
[64674]
[https://bugs.gentoo.org/show_bug.cgi?id=497274]
[https://bugzilla.redhat.com/show_bug.cgi?id=1049165]
[graphviz-yyerror-bo(90085)]
[https://github.com/ellson/graphviz/commit/7aaddf52cd98589fb0c3ab72a393f8411838438a]
[GLSA-201702-06]
The start_authentication function in lightdm-gtk-greeter.c in LightDM GTK+ Greeter before 1.7.1 does not properly handle the return value from the lightdm_greeter_get_authentication_user function, which allows local users to cause a denial of service (NULL pointer dereference) via an empty username.
Per: http://cwe.mitre.org/data/definitions/476.html
"CWE-476: NULL Pointer Dereference"
[FEDORA-2014-1647]
[FEDORA-2014-1648]
[openSUSE-SU-2014:0071]
[[oss-security] 20140107 Re: CVE request: lightdm-gtk-greeter - local DOS due to NULL pointer dereference]
[64679]
[https://bugs.launchpad.net/lightdm-gtk-greeter/+bug/1266449]
[https://bugzilla.novell.com/show_bug.cgi?id=857303]
Buffer overflow in Poster Software PUBLISH-iT 3.6d allows remote attackers to execute arbitrary code via a crafted PUI file.
[http://packetstormsecurity.com/files/125089]
[20140205 CORE-2014-0001 - Publish-It Buffer Overflow Vulnerability]
[http://www.coresecurity.com/advisories/publish-it-buffer-overflow-vulnerability]
[31461]
[20140205 CORE-2014-0001 - Publish-It Buffer Overflow Vulnerability]
[65366]
[publishit-cve20140980-bo(90989)]
VBox/GuestHost/OpenGL/util/net.c in Oracle VirtualBox before 3.2.22, 4.0.x before 4.0.24, 4.1.x before 4.1.32, 4.2.x before 4.2.24, and 4.3.x before 4.3.8, when using 3D Acceleration allows local guest OS users to execute arbitrary code on the Chromium server via crafted Chromium network pointer in a (1) CR_MESSAGE_READBACK or (2) CR_MESSAGE_WRITEBACK message to the VBoxSharedCrOpenGL service, which triggers an arbitrary pointer dereference and memory corruption. NOTE: this issue was MERGED with CVE-2014-0982 because it is the same type of vulnerability affecting the same set of versions. All CVE users should reference CVE-2014-0981 instead of CVE-2014-0982.
[20140311 CORE-2014-0002 - Oracle VirtualBox 3D Acceleration Multiple Memory Corruption Vulnerabilities]
[http://www.coresecurity.com/advisories/oracle-virtualbox-3d-acceleration-multiple-memory-corruption-vulnerabilities]
[DSA-2904]
[32208]
[http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html]
[20140311 CORE-2014-0002 - Oracle VirtualBox 3D Acceleration Multiple Memory Corruption Vulnerabilities]
[GLSA-201612-27]
[https://www.virtualbox.org/changeset/50437/vbox]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-0981. Reason: This issue was MERGED into CVE-2014-0981 in accordance with CVE content decisions, because it is the same type of vulnerability and affects the same versions. Notes: All CVE users should reference CVE-2014-0981 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
Multiple array index errors in programs that are automatically generated by VBox/HostServices/SharedOpenGL/crserverlib/server_dispatch.py in Oracle VirtualBox 4.2.x through 4.2.20 and 4.3.x before 4.3.8, when using 3D Acceleration, allow local guest OS users to execute arbitrary code on the Chromium server via certain CR_MESSAGE_OPCODES messages with a crafted index, which are not properly handled by the (1) CR_VERTEXATTRIB4NUBARB_OPCODE to the crServerDispatchVertexAttrib4NubARB function, (2) CR_VERTEXATTRIB1DARB_OPCODE to the crServerDispatchVertexAttrib1dARB function, (3) CR_VERTEXATTRIB1FARB_OPCODE to the crServerDispatchVertexAttrib1fARB function, (4) CR_VERTEXATTRIB1SARB_OPCODE to the crServerDispatchVertexAttrib1sARB function, (5) CR_VERTEXATTRIB2DARB_OPCODE to the crServerDispatchVertexAttrib2dARB function, (6) CR_VERTEXATTRIB2FARB_OPCODE to the crServerDispatchVertexAttrib2fARB function, (7) CR_VERTEXATTRIB2SARB_OPCODE to the crServerDispatchVertexAttrib2sARB function, (8) CR_VERTEXATTRIB3DARB_OPCODE to the crServerDispatchVertexAttrib3dARB function, (9) CR_VERTEXATTRIB3FARB_OPCODE to the crServerDispatchVertexAttrib3fARB function, (10) CR_VERTEXATTRIB3SARB_OPCODE to the crServerDispatchVertexAttrib3sARB function, (11) CR_VERTEXATTRIB4DARB_OPCODE to the crServerDispatchVertexAttrib4dARB function, (12) CR_VERTEXATTRIB4FARB_OPCODE to the crServerDispatchVertexAttrib4fARB function, and (13) CR_VERTEXATTRIB4SARB_OPCODE to the crServerDispatchVertexAttrib4sARB function.
[20140311 CORE-2014-0002 - Oracle VirtualBox 3D Acceleration Multiple Memory Corruption Vulnerabilities]
[http://www.coresecurity.com/advisories/oracle-virtualbox-3d-acceleration-multiple-memory-corruption-vulnerabilities]
[DSA-2904]
[32208]
[http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html]
[20140311 CORE-2014-0002 - Oracle VirtualBox 3D Acceleration Multiple Memory Corruption Vulnerabilities]
[GLSA-201612-27]
[https://www.virtualbox.org/changeset/50441/vbox]
The passwordCheck function in SAP Router 721 patch 117, 720 patch 411, 710 patch 029, and earlier terminates validation of a Route Permission Table entry password upon encountering the first incorrect character, which allows remote attackers to obtain passwords via a brute-force attack that relies on timing differences in responses to incorrect password guesses, aka a timing side-channel attack.
[http://scn.sap.com/docs/DOC-8218]
[http://www.coresecurity.com/advisories/sap-router-password-timing-attack]
[32919]
[20140416 [CORE-2014-0003] - SAP Router Password Timing Attack]
[https://service.sap.com/sap/support/notes/1986895]
Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the NodeName parameter.
[69529]
[https://ics-cert.us-cert.gov/advisories/ICSA-14-261-01]
Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the GotoCmd parameter.
[69531]
[https://ics-cert.us-cert.gov/advisories/ICSA-14-261-01]
Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the NodeName2 parameter.
[69532]
[https://ics-cert.us-cert.gov/advisories/ICSA-14-261-01]
Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the AccessCode parameter.
[69533]
[https://ics-cert.us-cert.gov/advisories/ICSA-14-261-01]
Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the AccessCode2 parameter.
[69534]
[https://ics-cert.us-cert.gov/advisories/ICSA-14-261-01]
Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the UserName parameter.
[69535]
[https://ics-cert.us-cert.gov/advisories/ICSA-14-261-01]
Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the projectname parameter.
[69536]
[https://ics-cert.us-cert.gov/advisories/ICSA-14-261-01]
Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the password parameter.
[69538]
[https://ics-cert.us-cert.gov/advisories/ICSA-14-261-01]
Buffer overflow in the Vcl.Graphics.TPicture.Bitmap implementation in the Visual Component Library (VCL) in Embarcadero Delphi XE6 20.0.15596.9843 and C++ Builder XE6 20.0.15596.9843 allows remote attackers to execute arbitrary code via a crafted BMP file.
[http://support.embarcadero.com/article/44015]
[http://www.coresecurity.com/advisories/delphi-and-c-builder-vcl-library-buffer-overflow]
[VU#646748]
Heap-based buffer overflow in the ReadDIB function in the Vcl.Graphics.TPicture.Bitmap implementation in the Visual Component Library (VCL) in Embarcadero Delphi XE6 20.0.15596.9843 and C++ Builder XE6 20.0.15596.9843 allows context-dependent attackers to execute arbitrary code via the BITMAPINFOHEADER.biClrUsed field in a BMP file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0993.
[20140916 [CORE-2014-0006] - Delphi and C++ Builder VCL library Heap Buffer Overflow]
[http://support.embarcadero.com/article/44015]
[http://www.coresecurity.com/advisories/delphi-and-c-builder-vcl-library-heap-buffer-overflow]
The Standalone Enqueue Server in SAP Netweaver 7.20, 7.01, and earlier allows remote attackers to cause a denial of service (uncontrolled recursion and crash) via a trace level with a wildcard in the Trace Pattern.
[http://blog.onapsis.com/analyzing-sap-security-notes-october-2014-edition/]
[http://packetstormsecurity.com/files/128726/SAP-Netweaver-Enqueue-Server-Trace-Pattern-Denial-Of-Service.html]
[20141016 [CORE-2014-0007] -SAP Netweaver Enqueue Server Trace Pattern Denial of Service Vulnerability]
[http://www.coresecurity.com/advisories/sap-netweaver-enqueue-server-trace-pattern-denial-service-vulnerability]
[20141016 [CORE-2014-0007] -SAP Netweaver Enqueue Server Trace Pattern Denial of Service Vulnerability]
[netweaver-trace-pattern-dos(97610)]
[https://twitter.com/SAP_Gsupport/status/522750365780160513]
WiFiMonitor in Android 4.4.4 as used in the Nexus 5 and 4, Android 4.2.2 as used in the LG D806, Android 4.2.2 as used in the Samsung SM-T310, Android 4.1.2 as used in the Motorola RAZR HD, and potentially other unspecified Android releases before 5.0.1 and 5.0.2 does not properly handle exceptions, which allows remote attackers to cause a denial of service (reboot) via a crafted 802.11 probe response frame.
[http://packetstormsecurity.com/files/130107/Android-WiFi-Direct-Denial-Of-Service.html]
[20150126 [CORE-2015-0002] - Android WiFi-Direct Denial of Service]
[20150126 [CORE-2015-0002] - Android WiFi-Direct Denial of Service]
[72311]
[https://www.coresecurity.com/advisories/android-wifi-direct-denial-service]
[35913]
Integer signedness error in the vt console driver (formerly Newcons) in FreeBSD 9.3 before p10 and 10.1 before p6 allows local users to cause a denial of service (crash) and possibly gain privileges via a negative value in a VT_WAITACTIVE ioctl call, which triggers an array index error and out-of-bounds kernel memory access.
[20150127 [CORE-2015-0003] - FreeBSD Kernel Multiple Vulnerabilities]
[http://www.coresecurity.com/advisories/freebsd-kernel-multiple-vulnerabilities]
[20150127 [CORE-2015-0003] - FreeBSD Kernel Multiple Vulnerabilities]
[FreeBSD-EN-15:01]
Sendio before 7.2.4 includes the session identifier in URLs in emails, which allows remote attackers to obtain sensitive information and hijack sessions by reading the jsessionid parameter in the Referrer HTTP header.
[http://packetstormsecurity.com/files/132022/Sendio-ESP-Information-Disclosure.html]
[20150522 [CORE-2015-0010] - Sendio ESP Information Disclosure Vulnerability]
[37114]
[20150522 [CORE-2015-0010] - Sendio ESP Information Disclosure Vulnerability]
[http://www.sendio.com/software-release-history/]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: None. Reason: This ID is frequently used as an example of the 2014 CVE-ID syntax change, which allows more than 4 digits in the sequence number. Notes: See references.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: None. Reason: This ID is frequently used as an example of the 2014 CVE-ID syntax change, which allows more than 4 digits in the sequence number. Notes: See references.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. This CVE id is an example number in https://cve.mitre.org/cve/identifiers/syntaxchange.html. Notes: none.
Cross-site request forgery (CSRF) vulnerability in the SEO Plugin LiveOptim plugin before 1.1.4-free for WordPress allows remote attackers to hijack the authentication of administrators for requests that change plugin settings via unspecified vectors. NOTE: some of these details are obtained from third party information.
[seoplugin-wordpress-csrf(92586)]
[https://wordpress.org/plugins/liveoptim/changelog/]
Directory traversal vulnerability in ManageEngine SupportCenter Plus 7.9 before 7917 allows remote attackers to read arbitrary files via a ..%2f (dot dot encoded slash) in the attach parameter to WorkOrder.do in the file attachment for a new ticket.
[31262]
[support-center-directory-traversal(90806)]
[https://supportcenter.wiki.zoho.com/ReadMe-V2.html]
SQL injection vulnerability in includes/ym-download_functions.include.php in the Code Futures YourMembers plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the ym_download_id parameter to the default URI.
[http://packetstormsecurity.com/files/128668/YourMembers-Blind-SQL-Injection.html]
[34968]
Cross-site scripting (XSS) vulnerability in Sitecore CMS before 7.0 Update-4 (rev. 140120) allows remote attackers to inject arbitrary web script or HTML via the xmlcontrol parameter to the default URI. NOTE: some of these details are obtained from third party information.
[http://sitecorekh.blogspot.dk/2014/01/sitecore-releases-70-update-4-rev-140120.html]
[20140129 SiteCore XML Control Script Insertion]
[65254]
[sitecore-xmlcontrol-xss(90833)]
Multiple cross-site request forgery (CSRF) vulnerabilities in D-Link DIR-600 router (rev. Bx) with firmware before 2.17b02 allow remote attackers to hijack the authentication of administrators for requests that (1) create an administrator account or (2) enable remote management via a crafted configuration module to hedwig.cgi, (3) activate new configuration settings via a SETCFG,SAVE,ACTIVATE action to pigwidgeon.cgi, or (4) send a ping via a ping action to diagnostic.php.
[http://resources.infosecinstitute.com/csrf-unauthorized-remote-admin-access/]
[http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10018]
[dir600-settings-csrf(91794)]
Multiple cross-site scripting (XSS) vulnerabilities in modules_v3/googlemap/wt_v3_street_view.php in webtrees before 1.5.2 allow remote attackers to inject arbitrary web script or HTML via the (1) map, (2) streetview, or (3) reset parameter.
[http://www.rusty-ice.de/advisory/advisory_2014001.txt]
[webtrees-wtv3streetview-xss(91133)]
Cross-site scripting (XSS) vulnerability in the HK Exif Tags plugin before 1.12 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via an EXIF tag. NOTE: some of these details are obtained from third party information.
[hkexif-wordpress-xss(92555)]
[https://wordpress.org/plugins/hk-exif-tags/changelog/]
Cross-site scripting (XSS) vulnerability in includes/delete_img.php in the Joomlaskin JS Multi Hotel (aka JS MultiHotel and Js-Multi-Hotel) plugin 2.2.1 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the path parameter.
[http://packetstormsecurity.com/files/125959]
[http://websecurity.com.ua/7087/]
[jsmulti-wordpress-xss(92207)]
The Joomlaskin JS Multi Hotel (aka JS MultiHotel and Js-Multi-Hotel) plugin 2.2.1 and earlier for WordPress allows remote attackers to obtain the installation path via a request to (1) functions.php, (2) myCalendar.php, (3) refreshDate.php, (4) show_image.php, (5) widget.php, (6) phpthumb/GdThumb.inc.php, or (7) phpthumb/thumb_plugins/gd_reflection.inc.php in includes/.
[http://packetstormsecurity.com/files/125959]
[http://websecurity.com.ua/7087/]
Multiple cross-site request forgery (CSRF) vulnerabilities in PHPJabbers Appointment Scheduler 2.0 allow remote attackers to hijack the authentication of administrators for requests that (1) conduct cross-site scripting (XSS) attacks via the i18n[1][name] parameter in a pjActionCreate action to the pjAdminServices controller or (2) add an administrator via a pjActionCreate action to the pjAdminUsers controller.
[http://packetstormsecurity.com/files/124755]
[30911]
[appointmentscheduler-index-xss(90419)]
[appointmentscheduler-index-csrf(90420)]
Cross-site scripting (XSS) vulnerability in ClanSphere 2011.4 allows remote attackers to inject arbitrary web script or HTML via the where parameter in a list action to index.php.
[20140310 [HTTPCS] ClanSphere 'where' Cross Site Scripting Vulnerability]
[20140307 [HTTPCS] ClanSphere 'where' Cross Site Scripting Vulnerability]
[66058]
[https://www.httpcs.com/advisory/httpcs127]
SQL injection vulnerability in /send-to in Sendy 1.1.9.1 allows remote attackers to execute arbitrary SQL commands via the c parameter.
[32814]
[20140410 Sendy 1.1.9.1 - SQL Injection Vulnerability]
[66771]
[sendy-sendto-sql-injection(92520)]
SQL injection vulnerability in /app in Sendy 1.1.8.4 allows remote attackers to execute arbitrary SQL commands via the i parameter.
[31898]
Multiple cross-site scripting (XSS) vulnerabilities in clientResponse 4.1 allow remote attackers to inject arbitrary web script or HTML via the (1) Subject or (2) Message field.
[35248]
[clientmanagement-subject-xss(98734)]
Multiple stack-based buffer overflows in pdmwService.exe in SolidWorks Workgroup PDM 2014 SP2 allow remote attackers to execute arbitrary code via a long string in a (1) 2001, (2) 2002, or (3) 2003 opcode to port 3000.
[31763]
[workgroup-pdmwservice-bo(91264)]
Directory traversal vulnerability in pdmwService.exe in SolidWorks Workgroup PDM 2014 allows remote attackers to write to arbitrary files via a .. (dot dot) in the filename in a file upload.
[http://packetstormsecurity.com/files/125361]
[31831]
[32163]
[workgroup-pdm-dir-traversal(91518)]
Cross-site scripting (XSS) vulnerability in photocrati-gallery/ecomm-sizes.php in the Photocrati theme for WordPress allows remote attackers to inject arbitrary web script or HTML via the prod_id parameter.
[http://packetstormsecurity.com/files/124986/WordPress-Photocrati-Cross-Site-Scripting.html]
[65238]
[photocrati-ecommsizes-xss(90812)]
Cross-site scripting (XSS) vulnerability in canned_opr.php in PhpOnlineChat 3.0 allows remote attackers to inject arbitrary web script or HTML via the message field.
[http://packetstormsecurity.com/files/128179/PhpOnlineChat-3.0-Cross-Site-Scripting.html]
[34555]
[69669]
[phponlinechat-cannedopr-xss(95801)]
Cross-site scripting (XSS) vulnerability in the Unconfirmed plugin before 1.2.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter in the unconfirmed page to wp-admin/network/users.php.
[66781]
[https://security.dxw.com/advisories/xss-in-unconfirmed-1-2-3/]
[https://wordpress.org/plugins/unconfirmed/changelog/]
SQL injection vulnerability in the LTree converter in Pomm before 1.1.5 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
[http://www.pomm-project.org/news/pomm-1-1-5-is-out.html]
[65711]
[pomm-ltree-sql-injection(91276)]
[https://github.com/chanmix51/Pomm/issues/122]
Unspecified vulnerability in JetBrains TeamCity before 8.1 allows remote attackers to obtain sensitive information via unknown vectors.
[http://confluence.jetbrains.com/display/TCD8/What%27s+New+in+TeamCity+8.1]
SQL injection vulnerability in ChangeEmail.php in iTechClassifieds 3.03.057 allows remote attackers to execute arbitrary SQL commands via the PreviewNum parameter. NOTE: the CatID parameter is already covered by CVE-2008-0685.
[31140]
[65089]
[itechclassifieds-multiple-sql-injection(90683)]
Cross-site scripting (XSS) vulnerability in symfony/web/index.php/pim/viewEmployeeList in OrangeHRM before 3.1.2 allows remote attackers to inject arbitrary web script or HTML via the empsearch[employee_name][empId] parameter.
[http://hauntit.blogspot.com/2014/02/en-xss-in-orangehrm.html]
[http://sourceforge.net/projects/orangehrm/files/stable/3.1.2/]
[65904]
SQL injection vulnerability in question.php in the mTouch Quiz before 3.0.7 for WordPress allows remote attackers to execute arbitrary SQL commands via the quiz parameter to wp-admin/edit.php.
[mtouch-quiz-wordpress-sql-injection(91950)]
[https://security.dxw.com/advisories/admin-xss-and-sqli-in-mtouch-quiz-3-0-6/]
[https://wordpress.org/plugins/mtouch-quiz/changelog/]
Multiple cross-site scripting (XSS) vulnerabilities in question.php in the mTouch Quiz before 3.0.7 for WordPress allow remote attackers to inject arbitrary web script or HTML via the quiz parameter to wp-admin/edit.php.
[mtouch-quiz-wordpress-xss(91949)]
[mtouch-quiz-wordpress-sql-injection(91950)]
[https://security.dxw.com/advisories/admin-xss-and-sqli-in-mtouch-quiz-3-0-6/]
[https://wordpress.org/plugins/mtouch-quiz/changelog/]
Cross-site scripting (XSS) vulnerability in Seo Panel before 3.4.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
[http://blog.seopanel.in/2014/01/seo-panel-3-4-0-released/]
[seo-panel-unspecified-xss(90700)]
Cross-site request forgery (CSRF) vulnerability in index.php/user_data/insert_user in Savsoft Quiz allows remote attackers to hijack the authentication of administrators for requests that create an administrator account via a crafted request.
[http://packetstormsecurity.com/files/125379]
[66287]
[savsoft-quiz-csrf(91548)]
Cross-site scripting (XSS) vulnerability in readme.php in the April's Super Functions Pack plugin before 1.4.8 for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter. NOTE: some of these details are obtained from third party information.
[64699]
[aprilsuperfunctions-readme-xss(90172)]
[https://wordpress.org/plugins/aprils-super-functions-pack/changelog/]
Cross-site scripting (XSS) vulnerability in the WP SlimStat plugin before 3.5.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
[66146]
[wpslimstat-wordpress-xss(91840)]
[https://github.com/getusedtoit/wp-slimstat/issues/3]
Cross-site scripting (XSS) vulnerability in /signup in WEBCrafted allows remote attackers to inject arbitrary web script or HTML via the username.
[http://packetstormsecurity.com/files/124682]
[64681]
[webcrafted-useraccount-xss(90140)]
Multiple directory traversal vulnerabilities in class/session.php in Ganesha Digital Library (GDL) 4.2 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) newlang or (2) newtheme parameter.
[http://packetstormsecurity.com/files/125464]
[ganesha-gdl-dir-traversal(91555)]
Multiple cross-site scripting (XSS) vulnerabilities in Maian Uploader 4.0 allow remote attackers to inject arbitrary web script or HTML via the width parameter to (1) uploader/admin/js/load_flv.js.php or (2) uploader/js/load_flv.js.php.
[http://packetstormsecurity.com/files/124918]
[maian-uploader-loadflv-xss(90716)]
Cross-site scripting (XSS) vulnerability in module/search/function.php in Ganesha Digital Library (GDL) 4.2 allows remote attackers to inject arbitrary web script or HTML via the keyword parameter in a ByEge action.
[http://packetstormsecurity.com/files/125464]
[ganesha-gdl-xss(91553)]
Multiple SQL injection vulnerabilities in Ganesha Digital Library (GDL) 4.2 allow remote attackers to execute arbitrary SQL commands via the id parameter in (1) download.php or (2) main.php.
[http://packetstormsecurity.com/files/125464]
[ganesha-gdl-sql-injection(91554)]
Cross-site scripting (XSS) vulnerability in top.html in the Airties Air 6372 modem allows remote attackers to inject arbitrary web script or HTML via the productboardtype parameter.
[http://packetstormsecurity.com/files/128213/Airties-Air6372SO-Modem-Web-Interface-Cross-Site-Scripting.html]
[airties-air6372so-xss(95957)]
Directory traversal vulnerability in LicensePal ArcticDesk before 1.2.5 allows remote attackers to read arbitrary files via unspecified vectors.
[http://www.arcticdesk.com/support/announcements/arcticdesk-v1-2-5-maintenance-release-18.html]
[https://blog.rack911.com/security-advisories/arcticdesk-custom-module-local-file-inclusion-vulnerability-r911-0132/]
Cross-site scripting (XSS) vulnerability in the frontend interface in LicensePal ArcticDesk before 1.2.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
[http://www.arcticdesk.com/support/announcements/arcticdesk-v1-2-5-maintenance-release-18.html]
[arcticdesk-interface-xss(91792)]
SQL injection vulnerability in the ticket grid in the admin interface in LicensePal ArcticDesk before 1.2.5 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
[http://www.arcticdesk.com/support/announcements/arcticdesk-v1-2-5-maintenance-release-18.html]
Cross-site scripting (XSS) vulnerability in FlatPress 1.0.2 allows remote attackers to inject arbitrary web script or HTML via the content parameter to the default URI.
[flatpress-content-xss(92538)]
[https://github.com/evacchi/flatpress/issues/14]
[https://www.netsparker.com/critical-xss-vulnerabilities-in-flatpress/]
Cross-site scripting (XSS) vulnerability in Storytlr 1.3.dev and earlier allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to archives/.
[https://www.netsparker.com/xss-vulnerability-in-storytlr/]
Cross-site scripting (XSS) vulnerability in Storytlr 1.3.dev and earlier allows remote attackers to inject arbitrary web script or HTML via the search parameter to search/.
[storytlr-index-xss(91762)]
[https://www.netsparker.com/critical-xss-vulnerabilities-in-storytlr/]
mbae.sys in Malwarebytes Anti-Exploit before 1.05.1.2014 allows local users to cause a denial of service (crash) via a crafted size in an unspecified IOCTL call, which triggers an out-of-bounds read. NOTE: some of these details are obtained from third party information.
[https://www.malwarebytes.org/support/releasehistory/]
SQL injection vulnerability in admin/data_files/move.php in Maian Uploader 4.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.
[http://packetstormsecurity.com/files/124918]
[maian-uploader-move-sql-injection(90715)]
Maian Uploader 4.0 allows remote attackers to obtain sensitive information via a request without the height parameter to load_flv.js.php, which reveals the installation path in an error message.
[http://packetstormsecurity.com/files/124918]
Multiple cross-site request forgery (CSRF) vulnerabilities in Maian Uploader 4.0 allow remote attackers to hijack the authentication of unspecified users for requests that conduct cross-site scripting (XSS) attacks via the width parameter to (1) uploader/admin/js/load_flv.js.php or (2) uploader/js/load_flv.js.php.
[http://packetstormsecurity.com/files/124918]
Multiple cross-site scripting (XSS) vulnerabilities in Maian Weblog 4.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) name, (2) email, or (3) subject parameter in a contact action to index.php.
[maian-weblog-multiple-xss(90961)]
[https://www.netsparker.com/critical-xss-vulnerabilities-in-maian-weblog/]
Multiple cross-site request forgery (CSRF) vulnerabilities in Stark CRM 1.0 allow remote attackers to hijack the authentication of administrators for requests that add (1) an administrator via a crafted request to the admin page, (2) an agent via a crafted request to the agent page, (3) a sub-agent via a crafted request to the sub_agent page, (4) a partner via a crafted request to the partner page, or (5) a client via a crafted request to the client page.
[http://www.zeroscience.mk/codes/starkcrm_mv.txt]
[http://www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5169.php]
[starkcrm-index-xss(91267)]
[starkcrm-index-csrf(91268)]
Multiple cross-site scripting (XSS) vulnerabilities in Stark CRM 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) first_name, (2) last_name, or (3) notes parameter to the client page; (4) insu_name or (5) price parameter to the add_insurance_cat page; or (6) status[] parameter to the add_status page.
[http://www.zeroscience.mk/codes/starkcrm_mv.txt]
[http://www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5169.php]
[starkcrm-index-xss(91267)]
Directory traversal vulnerability in PHPJabbers Appointment Scheduler 2.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the id parameter in a pjActionDownload action to the pjBackup controller.
[http://packetstormsecurity.com/files/124755]
[30911]
[appointmentscheduler-index-dir-traversal(90421)]
Stack-based buffer overflow in UltraCamLib in the UltraCam ActiveX Control (UltraCamX.ocx) for the TRENDnet SecurView camera TV-IP422WN allows remote attackers to execute arbitrary code via a long string to the (1) CGI_ParamSet, (2) OpenFileDlg, (3) SnapFileName, (4) Password, (5) SetCGIAPNAME, (6) AccountCode, or (7) RemoteHost function.
[http://packetstormsecurity.com/files/129262/TRENDnet-SecurView-Wireless-Network-Camera-TV-IP422WN-Buffer-Overflow.html]
[71292]
[http://www.zeroscience.mk/codes/trendnet_bof.txt]
[http://www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5211.php]
[trendnet-tvip422wn-bo(98948)]
Cross-site scripting (XSS) vulnerability in the Another WordPress Classifieds Plugin plugin for WordPress allows remote attackers to inject arbitrary web script or HTML via the query string to the default URI.
[http://packetstormsecurity.com/files/129035/Another-WordPress-Classifieds-Cross-Site-Scripting-SQL-Injection.html]
[wp-anotherwpclassifieds-url-xss(98588)]
SQL injection vulnerability in the Another WordPress Classifieds Plugin plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the keywordphrase parameter in a dosearch action.
[http://packetstormsecurity.com/files/129035/Another-WordPress-Classifieds-Cross-Site-Scripting-SQL-Injection.html]
[35204]
[wp-anotherwpclassifieds-sql-injection(98589)]
Multiple cross-site request forgery (CSRF) vulnerabilities in PHPJabbers Event Booking Calendar 2.0 allow remote attackers to hijack the authentication of administrators for requests that (1) change the username and password of the administrator via an update action to the AdminOptions controller or conduct cross-site scripting (XSS) attacks via the (2) event_title parameter in a create action to the AdminEvents controller or (3) category_title parameter in a create action to the AdminCategories controller.
[http://packetstormsecurity.com/files/124753/eventbookingcalendar-xssxsrfsql.txt]
[eventbookingcalendar-index-csrf(90413)]
[eventbookingcalendar-index-xss(90414)]
SQL injection vulnerability in load-calendar.php in PHPJabbers Event Booking Calendar 2.0 allows remote attackers to execute arbitrary SQL commands via the cid parameter.
[http://packetstormsecurity.com/files/124753/eventbookingcalendar-xssxsrfsql.txt]
Multiple cross-site scripting (XSS) vulnerabilities in the Welcart e-Commerce plugin 1.3.12 for WordPress allow remote attackers to inject arbitrary web script or HTML via (1) unspecified vectors related to purchase_limit or the (2) name, (3) intl, (4) nocod, or (5) time parameter in an add_delivery_method action to wp-admin/admin-ajax.php.
[http://packetstormsecurity.com/files/125513]
[65954]
[welcart-adminajax-xss(91541)]
Multiple SQL injection vulnerabilities in the Welcart e-Commerce plugin 1.3.12 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) changeSort or (2) switch parameter in the usces_itemedit page to wp-admin/admin.php.
[http://packetstormsecurity.com/files/125513]
[65954]
[welcart-wordpress-admin-sql-injection(91542)]
Cross-site scripting (XSS) vulnerability in webconfig/wlan/country.html/country in the Teracom T2-B-Gawv1.4U10Y-BI modem allows remote attackers to inject arbitrary web script or HTML via the essid parameter.
[31087]
[65056]
[teracom-essid-xss(90642)]
Multiple cross-site request forgery (CSRF) vulnerabilities in webconfig/wlan/country.html/country in the Teracom T2-B-Gawv1.4U10Y-BI modem allow remote attackers to hijack the authentication of administrators for requests that (1) change the SSID or (2) change the password via a crafted request.
[32943]
[teracom-t2b-country-csrf(92715)]
SQL injection vulnerability in login.php in Simple e-document 1.31 allows remote attackers to execute arbitrary SQL commands via the username parameter.
[http://packetstormsecurity.com/files/124914]
[31142]
[simple-edocument-login-sql-injection(90711)]
Unrestricted file upload vulnerability in UploadHandler.php in the WP Symposium plugin 14.11 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in server/php/.
<a href="http://cwe.mitre.org/data/definitions/434.html">CWE-434: Unrestricted Upload of File with Dangerous Type</a>
[35543]
[71686]
Apache Traffic Server before 5.1.2 allows remote attackers to cause a denial of service via unspecified vectors, related to internal buffer sizing.
[[trafficserver-users] 20141216 [ANNOUNCE] Apache Traffic Server 5.1.2 is released]
[1031499]
[https://issues.apache.org/jira/browse/TS-3223]
Multiple SQL injection vulnerabilities in TopicsViewer 3.0 Beta 1 allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) edit_block.php, (2) edit_cat.php, (3) edit_note.php, or (4) rmv_topic.php in admincp/.
[http://packetstormsecurity.com/files/125007]
[31419]
[65283]
[topicsviewer-id-sql-injection(90918)]
Multiple integer signedness errors in DirectShowDemuxFilter, as used in Divx Web Player, Divx Player, and other Divx plugins, allow remote attackers to execute arbitrary code via a (1) negative or (2) large value in a Stream Format (STRF) chunk in an AVI file, which triggers a heap-based buffer overflow.
[20140426 Divx plugin suite heap-based buffer overflow]
[67086]
Multiple cross-site request forgery (CSRF) vulnerabilities in D-Link DAP-1360 with firmware 2.5.4 and earlier allow remote attackers to hijack the authentication of unspecified users for requests that change the (1) Enable Wireless, (2) MBSSID, (3) BSSID, (4) Hide Access Point, (5) SSID, (6) Country, (7) Channel, (8) Wireless mode, or (9) Max Associated Clients setting via a crafted request to index.cgi.
[20141109 IL and CSRF vulnerabilities in D-Link DAP-1360]
[http://websecurity.com.ua/7179/]
index.cgi in D-Link DAP-1360 with firmware 2.5.4 and earlier allows remote attackers to bypass authentication and obtain sensitive information by setting the client_login cookie to admin.
[20141109 IL and CSRF vulnerabilities in D-Link DAP-1360]
[http://websecurity.com.ua/7179/]
Multiple cross-site request forgery (CSRF) vulnerabilities in D-Link DAP-1360 router with firmware 2.5.4 and earlier allow remote attackers to hijack the authentication of unspecified users for requests that (1) change the MAC filter restrict mode, (2) add a MAC address to the filter, or (3) remove a MAC address from the filter via a crafted request to index.cgi.
[20141129 CSRF and XSS vulnerabilities in D-Link DAP-1360]
[http://websecurity.com.ua/7215/]
Cross-site scripting (XSS) vulnerability in D-Link DAP-1360 router with firmware 2.5.4 and later allows remote attackers to inject arbitrary web script or HTML via the res_buf parameter to index.cgi when res_config_id is set to 41.
[20141129 CSRF and XSS vulnerabilities in D-Link DAP-1360]
[http://websecurity.com.ua/7215/]
SQL injection vulnerability in profile.php in FluxBB before 1.4.13 and 1.5.x before 1.5.7 allows remote attackers to execute arbitrary SQL commands via the req_new_email parameter.
[http://fluxbb.org/forums/viewtopic.php?id=8001]
[http://packetstormsecurity.com/files/129225/FluxBB-1.5.6-SQL-Injection.html]
[20141121 FluxBB <= 1.5.6 SQL Injection]
[fluxbb-profile-sql-injection(98890)]
[https://fluxbb.org/development/core/tickets/990/]
Open redirect vulnerability in forums/login.php in FluxBB before 1.4.13 and 1.5.x before 1.5.7 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the redirect_url parameter.
<a href="http://cwe.mitre.org/data/definitions/601.html">CWE-601: URL Redirection to Untrusted Site ('Open Redirect')</a>
[http://fluxbb.org/forums/viewtopic.php?id=8001]
[https://fluxbb.org/development/core/tickets/961/]
Buffer overflow in the IMAPd service in Qualcomm Eudora WorldMail 9.0.333.0 allows remote attackers to execute arbitrary code via a long string in a UID command.
[31694]
[worldmail-uid-bo(91833)]
SQL injection vulnerability in news_popup.php in Taboada MacroNews 1.0 allows remote authenticated users to execute arbitrary SQL commands via the id parameter.
[30689]
[taboadamacronews-newspopup-sql-injection(90459)]
SQL injection vulnerability in the update_zone function in catalog/admin/geo_zones.php in osCommerce Online Merchant 2.3.3.4 and earlier allows remote administrators to execute arbitrary SQL commands via the zID parameter in a list action.
[31515]
[http://www.secgeek.net/oscommerce-v2x-sql-injection-vulnerability/]
[oscommerce-geozones-sql-injection(91113)]
[https://github.com/gburton/oscommerce2/commit/e4d90eccd7d9072ebe78da4c38fb048bfe31c902]
Multiple SQL injection vulnerabilities in the admin area in couponPHP before 1.2.0 allow remote administrators to execute arbitrary SQL commands via the (1) iDisplayLength or (2) iDisplayStart parameter to (a) comments_paginate.php or (b) stores_paginate.php in admin/ajax/.
[http://couponphp.com/changelog]
[http://packetstormsecurity.com/files/125480]
[32037]
[http://www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5170.php]
[couponphp-commentspaginate-sql-injection(91550)]
Multiple cross-site scripting (XSS) vulnerabilities in the admin area in couponPHP before 1.2.0 allow remote administrators to inject arbitrary web script or HTML via the (1) sEcho parameter to comments_paginate.php or (2) stores_paginate.php or the (3) affiliate_url, (4) description, (5) domain, (6) seo[description], (7) seo[heading], (8) seo[title], (9) seo[keywords], (10) setting[logo], (11) setting[perpage], or (12) setting[sitename] to admin/index.php.
[http://couponphp.com/changelog]
[http://packetstormsecurity.com/files/125480]
[32037]
[http://www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5170.php]
Cross-site scripting (XSS) vulnerability in JetBrains TeamCity before 8.1 allows remote attackers to inject arbitrary web script or HTML via the cameFromUrl parameter to feed/generateFeedUrl.html.
[http://confluence.jetbrains.com/display/TCD8/What%27s+New+in+TeamCity+8.1]
[teamcity-camefromurl-xss(91768)]
[https://www.netsparker.com/critical-xss-vulnerabilities-in-teamcity/]
Directory traversal vulnerability in DomPHP 0.83 and earlier allows remote attackers to have unspecified impact via a .. (dot dot) in the url parameter to photoalbum/index.php.
[30865]
[domphp-index-dir-traversal(90582)]
SQL injection vulnerability in agenda/indexdate.php in DomPHP 0.83 and earlier allows remote attackers to execute arbitrary SQL commands via the ids parameter.
[http://packetstormsecurity.com/files/124801]
[30872]
[domphp-indexdate-sql-injection(90528)]
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9625, SD 400, and SD 800, calling qsee_app_entry_return() without first calling qsee_app_entry() will cause the stack to be restored to an older state resulting in a return to an unexpected location.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-9456. Reason: This candidate is not authorized for use because it is part of the 2014 CVE-ID ID-Syntax protection block, which protects against accidental truncation of CVE IDs with sequence numbers containing more than 4 digits. See references. Notes: All CVE users should reference CVE-2014-9456 instead of this candidate.
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, and SD 800, while reading PlayReady rights string information from command buffer (which is sent from non-secure side), if length of rights string is very large, a buffer over read occurs, exposing TZ App memory to non-secure side.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9615, MDM9625, MDM9635M, SD 210/SD 212/SD 205, SD 400, SD 617, SD 800, and SD 820, in the time daemon, unauthorized users can potentially modify system time and cause an array index to be out-of-bound.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear IPQ4019, MDM9206, MDM9607, MDM9615, MDM9625, MDM9635M, MDM9640, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 615/16/SD 415, SD 820, and SDX20, buffer overflow vulnerability exist in Sahara boot when program header are parsing.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9615, MDM9625, MDM9635M, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 615/16/SD 415, SD 800, SD 808, and SD 810, use after free vulnerability when the PDN throttle info block is freed without clearing the corresponding active timer.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile SD 400 and SD 800, when writing the Full Disk Encryption key to crypto engine, information leak could occur.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9650, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 600, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 835, and SDX20, while setting the offsets, time-services allows the user to set bases greater than valid base value which will lead to array index out-of-bound.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2014. Notes: none.
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MSM8996, MSM8939, MSM8976, MSM8917, SDM845, and SDM660, access control collision vulnerability when accessing the replay protected memory block.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, and SDX20, after loading a dynamically loaded code section, I-Cache is not invalidated, which could lead to executing code from stale cache lines.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile, Snapdragon Wear, and Small Cell SoC FSM9055, IPQ4019, MDM9206, MDM9607, MDM9625, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 600, SD 615/16/SD 415, SD 617, SD 650/52, SD 800, SD 808, SD 810, SD 835, and SDX20, the reserved memory of TZ subsystem (like TZ apps and some PIL image subsystem) is not cleared after being used.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9650, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 615/16/SD 415, SD 450, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 820A, SD 835, SD 845, and SD 850, data access is not properly validated in the Widevine secure application.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9607, MDM9635M, MDM9640, MDM9650, MSM8909W, QCA6174A, QCA6574AU, QCA9377, QCA9379, SD 210/SD 212/SD 205, SD 400, SD 450, SD 410/12, SD 425, SD 430, SD 600, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, and SDX20, lack of input validation on BT HCI commands processing allows privilege escalation.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile SD 400 and SD 800, there could be leakage of protected contents if HLOS doesn't request for security restoration for OCMEM xPU's.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile SD 210/SD 212/SD 205, A buffer overflow can potentially occur in any OpenCL application that calls clBuildProgram() with a device of type CL_DEVICE_TYPE_CPU in its device_list argument.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9615, MDM9625, MDM9635M, MDM9640, MDM9650, SD 210/SD 212/SD 205, SD 400, SD 425, SD 430, SD 435, SD 617, SD 625, and Snapdragon_High_Med_2016, binary Calibration files under data/misc/audio have 777 permissions.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile SD 210/SD 212/SD 205, SD 400, SD 425, SD 427, SD 430, SD 435, SD 450, SD 617, SD 625, SD 650/52, SD 800, SD 845, and Snapdragon_High_Med_2016, unauthorized users can potentially modify system time.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9615, MDM9625, SD 210/SD 212/SD 205, SD 400, and SD 800, improper access control on ATCMD service allows third party services to access without user knowledge.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2014. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2014. Notes: none.
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 600, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 835, and SDX20, LocationService is being exported, which is a way for a service to expose its methods to other services. This makes it possible for any other services to import LocationService and call into the exposed method for bringing up a data connection.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9625 and SD 800, a fuse is not correctly blown on a secure device.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
The qs module before 1.0.0 does not have an option or default for specifying object depth and when parsing a string representing a deeply nested object will block the event loop for long periods of time. An attacker could leverage this to cause a temporary denial-of-service condition, for example, in a web application, other requests would not be processed while this blocking is occurring.
[https://nodesecurity.io/advisories/28]
Certain input when passed into remarkable before 1.4.1 will bypass the bad protocol check that disallows the javascript: scheme allowing for javascript: url's to be injected into the rendered content.
[https://github.com/jonschlinkert/remarkable/issues/97]
[https://nodesecurity.io/advisories/30]
Versions less than 0.1.4 of the static file server module fancy-server are vulnerable to directory traversal. An attacker can provide input such as `../` to read files outside of the served directory.
[https://nodesecurity.io/advisories/9]
paypal-ipn before 3.0.0 uses the `test_ipn` parameter (which is set by the PayPal IPN simulator) to determine if it should use the production PayPal site or the sandbox. With a bit of time, an attacker could craft a request using the simulator that would fool any application which does not explicitly check for test_ipn in production.
[https://github.com/andzdroid/paypal-ipn/issues/11]
[https://nodesecurity.io/advisories/26]
The inert directory handler in inert node module before 1.1.1 always allows files in hidden directories to be served, even when `showHidden` is false.
[https://github.com/hapijs/inert/commit/e8f99f94da4cb08e8032eda984761c3f111e3e82]
[https://github.com/hapijs/inert/pull/15]
[https://nodesecurity.io/advisories/14]
Hitron CVE-30360 devices use a 578A958E3DD933FC DES key that is shared across different customers' installations, which makes it easier for attackers to obtain sensitive information by decrypting a backup configuration file, as demonstrated by a password hash in the um_auth_account_password field.
[https://blogger.davidmanouchehri.com/2018/01/hitrons-encryption.html]
[https://github.com/habohitron/habohitron/blob/6add0d002fe553f0924a3bba197994c53ca7d52d/firmwares/3.1.1.21/analyse/hc.c#L17]
[https://github.com/Manouchehri/hitron-cfg-decrypter]
zsh before 5.0.7 allows evaluation of the initial values of integer variables imported from the environment (instead of treating them as literal numbers). That could allow local privilege escalation, under some specific and atypical conditions where zsh is being invoked in privilege-elevation contexts when the environment has not been properly sanitized, such as when zsh is invoked by sudo on systems where "env_reset" has been disabled.
[http://zsh.sourceforge.net/releases.html]
[https://sourceforge.net/p/zsh/code/ci/546203a770cec329e73781c3c8ab1078390aee72]
[USN-3593-1]
In exec.c in zsh before 5.0.7, there is a buffer overflow for very long fds in the ">& fd" syntax.
[RHSA-2018:3073]
[https://sourceforge.net/p/zsh/code/ci/49a3086bb67575435251c70ee598e2fd406ef055]
[USN-3593-1]
In utils.c in zsh before 5.0.6, there is a buffer overflow when scanning very long directory paths for symbolic links.
[RHSA-2018:1932]
[RHSA-2018:3073]
[https://sourceforge.net/p/zsh/code/ci/3e06aeabd8a9e8384ebaa8b08996cd1f64737210]
[USN-3593-1]
The create_response function in server/server.c in Psensor before 1.1.4 allows Directory Traversal because it lacks a check for whether a file is under the webserver directory.
[http://git.wpitchoune.net/gitweb/?p=psensor.git;a=blob;f=NEWS]
[http://git.wpitchoune.net/gitweb/?p=psensor.git;a=commit;h=48739caa745f9f8002e87af574f03e5dc6ae3447]
[http://git.wpitchoune.net/gitweb/?p=psensor.git;a=commit;h=8b10426dcc0246c1712a99460dd470dcb1cc4d9c]
[[debian-lts-announce] 20180424 [SECURITY] [DLA 1361-1] psensor security update]
Umbraco before 7.2.0 has a remote PHP code execution vulnerability because Umbraco.Web.UI/config/umbracoSettings.Release.config does not block the upload of .php files.
[http://issues.umbraco.org/issue/U4-5901]
[https://github.com/Umbraco/Umbraco-CMS/commit/cad06502235acabf7fb7dca779d2f78f08547e39]
The karo gem 2.3.8 for Ruby allows Remote command injection via the host field.
[http://www.vapid.dhs.org/advisories/karo-2.3.8.html]
[http://www.vapidlabs.com/advisory.php?v=63]
The wp-db-backup plugin 2.2.4 for WordPress relies on a five-character string for access control, which makes it easier for remote attackers to read backup archives via a brute-force attack.
[http://www.vapidlabs.com/advisory.php?v=81]
Hash#slice in lib/i18n/core_ext/hash.rb in the i18n gem before 0.8.0 for Ruby allows remote attackers to cause a denial of service (application crash) via a call in a situation where :some_key is present in keep_keys but not present in the hash.
[https://github.com/rubysec/ruby-advisory-db/pull/182/files]
[https://github.com/svenfuchs/i18n/pull/289]
[https://github.com/svenfuchs/i18n/releases/tag/v0.8.0]
[[debian-lts-announce] 20181121 [SECURITY] [DLA 1584-1] ruby-i18n security update]
Vembu StoreGrid 4.4.x has XSS in interface/registercustomer/onlineregsuccess.php, interface/registerreseller/onlineregfailure.php, interface/registerclient/onlineregfailure.php, and interface/registercustomer/onlineregfailure.php.
[https://cxsecurity.com/issue/WLB-2018120091]
[https://seclists.org/fulldisclosure/2014/Aug/8]
[46549]
In Vembu StoreGrid 4.4.x, the front page of the server web interface leaks the private IP address in the "ipaddress" hidden form value of the HTML source code, which is disclosed because of incorrect processing of an index.php/ trailing slash.
[https://cxsecurity.com/issue/WLB-2018120091]
[https://packetstormsecurity.com/files/127786/Vembu-Backup-Disaster-Recovery-6.1-Follow-Up.html]
[https://seclists.org/fulldisclosure/2014/Aug/8]
[46549]
On Fitbit activity-tracker devices, certain addresses never change. According to the popets-2019-0036.pdf document, this leads to "permanent trackability" and "considerable privacy concerns" without a user-accessible anonymization feature. The devices, such as Charge 2, transmit Bluetooth Low Energy (BLE) advertising packets with a TxAdd flag indicating random addresses, but the addresses remain constant. If devices come within BLE range at one or more locations where an adversary has set up passive sniffing, the adversary can determine whether the same device has entered one of these locations.
[https://petsymposium.org/2019/files/papers/issue3/popets-2019-0036.pdf]
[https://twitter.com/TedOnPrivacy/status/1151390589990187008]
handle_messages in eXtl_tls.c in eXosip before 5.0.0 mishandles a negative value in a content-length header.
[http://git.savannah.nongnu.org/cgit/exosip.git/commit/?id=2549e421c14aff886629b8482c14af800f411070]
The i-recommend-this plugin before 3.7.3 for WordPress has SQL injection.
[https://wordpress.org/plugins/i-recommend-this/#developers]
The cforms2 plugin before 13.2 for WordPress has XSS in lib_ajax.php.
[https://wordpress.org/plugins/cforms2/#developers]
[https://wpvulndb.com/vulnerabilities/9812]
The duplicate-post plugin before 2.6 for WordPress has XSS.
[https://wordpress.org/plugins/duplicate-post/#developers]
The duplicate-post plugin before 2.6 for WordPress has SQL injection.
[https://wordpress.org/plugins/duplicate-post/#developers]
The profile-builder plugin before 1.1.66 for WordPress has multiple XSS issues in forms.
[https://wordpress.org/plugins/profile-builder/#developers]
The user-domain-whitelist plugin before 1.5 for WordPress has CSRF.
[https://wordpress.org/plugins/user-domain-whitelist/#developers]
The feature-comments plugin before 1.2.5 for WordPress has CSRF for featuring or burying a comment.
[https://wordpress.org/plugins/feature-comments/#developers]
The memphis-documents-library plugin before 3.0 for WordPress has Remote File Inclusion.
[https://wordpress.org/plugins/memphis-documents-library/#developers]
The memphis-documents-library plugin before 3.0 for WordPress has Local File Inclusion.
[https://wordpress.org/plugins/memphis-documents-library/#developers]
The memphis-documents-library plugin before 3.0 for WordPress has XSS via $_REQUEST.
[https://wordpress.org/plugins/memphis-documents-library/#developers]
The wp-live-chat-support plugin before 4.1.0 for WordPress has JavaScript injections.
[https://wordpress.org/plugins/wp-live-chat-support/#developers]
The wp-support-plus-responsive-ticket-system plugin before 4.2 for WordPress has SQL injection.
[https://wordpress.org/plugins/wp-support-plus-responsive-ticket-system/#developers]
The wp-support-plus-responsive-ticket-system plugin before 4.2 for WordPress has full path disclosure.
[https://wordpress.org/plugins/wp-support-plus-responsive-ticket-system/#developers]
The wp-support-plus-responsive-ticket-system plugin before 4.2 for WordPress has incorrect authentication.
[https://wordpress.org/plugins/wp-support-plus-responsive-ticket-system/#developers]
The wp-support-plus-responsive-ticket-system plugin before 4.2 for WordPress has directory traversal.
[https://wordpress.org/plugins/wp-support-plus-responsive-ticket-system/#developers]
The wp-support-plus-responsive-ticket-system plugin before 4.1 for WordPress has JavaScript injection.
[https://wordpress.org/plugins/wp-support-plus-responsive-ticket-system/#developers]
The cforms2 plugin before 10.2 for WordPress has XSS.
[https://wordpress.org/plugins/cforms2/#developers]
[https://wpvulndb.com/vulnerabilities/9621]
The cforms2 plugin before 10.5 for WordPress has XSS.
[https://wordpress.org/plugins/cforms2/#developers]
The rich-counter plugin before 1.2.0 for WordPress has JavaScript injection via a User-Agent header.
[https://wordpress.org/plugins/rich-counter/#developers]
The cp-polls plugin before 1.0.1 for WordPress has XSS in the votes list.
[https://wordpress.org/plugins/cp-polls/#developers]
The epic theme through 2014-09-07 for WordPress allows arbitrary file downloads via the file parameter to includes/download.php.
[https://packetstormsecurity.com/files/128186/]
The Antioch theme through 2014-09-07 for WordPress allows arbitrary file downloads via the file parameter to lib/scripts/download.php.
[https://packetstormsecurity.com/files/128188/]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-9445, CVE-2014-9581, CVE-2014-9582. Reason: This candidate is not authorized for use because it is part of the 2014 CVE-ID ID-Syntax protection block, which protects against accidental truncation of CVE IDs with sequence numbers containing more than 4 digits. See references. Notes: All CVE users should reference CVE-2014-9445, CVE-2014-9581, or CVE-2014-9582 instead of this candidate.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-9580. Reason: This candidate is not authorized for use because it is part of the 2014 CVE-ID ID-Syntax protection block, which protects against accidental truncation of CVE IDs with sequence numbers containing more than 4 digits. See references. Notes: All CVE users should reference CVE-2014-9580 instead of this candidate.
Buffer overflow in the INetViewX ActiveX control in the Lorex Edge LH310 and Edge+ LH320 series with firmware 7-35-28-1B26E, Edge2 LH330 series with firmware 11.17.38-33_1D97A, and Edge3 LH340 series with firmware 11.19.85_1FE3A allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in the HTTP_PORT parameter.
[20140110 [CVE -2014-1201] Lorex security DVR ActiveX control buffer overflow]
[lorex-cve20141201-bo(90223)]
[https://github.com/pedrib/PoC/blob/master/lorexActivex/lorex-report.txt]
[https://github.com/pedrib/PoC/blob/master/lorexActivex/lorex-testcase.html]
The WSDL/WADL import functionality in SoapUI before 4.6.4 allows remote attackers to execute arbitrary Java code via a crafted request parameter in a WSDL file.
[http://baraktawily.blogspot.com/2014/01/soapui-code-execution-vulnerability-cve.html]
[http://packetstormsecurity.com/files/124773/SoapUI-Remote-Code-Execution.html]
[30908]
[http://www.youtube.com/watch?v=3lCLE64rsc0]
[https://github.com/SmartBear/soapui/blob/master/RELEASENOTES.txt]
The get_login_ip_config_file function in Eyou Mail System before 3.6 allows remote attackers to execute arbitrary commands via shell metacharacters in the domain parameter to admin/domain/ip_login_set/d_ip_login_get.php.
[20140108 [CVE-2014-1203] Eyou Mail System Remote Code Execution]
SQL injection vulnerability in Tableau Server 8.0.x before 8.0.7 and 8.1.x before 8.1.2 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors. NOTE: this can be exploited by unauthenticated remote attackers if the guest user is enabled.
[31578]
[65171]
[1029706]
[http://www.tableausoftware.com/support/releases/8.0.7]
[http://www.tableausoftware.com/support/releases/812]
[tableau-server-cve20141204-sql-injection(90730)]
[https://www.trustwave.com/spiderlabs/advisories/TWSL2014-003.txt]
SQL injection vulnerability in the password reset page in Open Web Analytics (OWA) before 1.5.5 allows remote attackers to execute arbitrary SQL commands via the owa_email_address parameter in a base.passwordResetRequest action to index.php.
[http://wiki.openwebanalytics.com/index.php?title=1.5.5]
[31738]
[http://www.secureworks.com/advisories/SWRX-2014-001/SWRX-2014-001.pdf]
[20140214 [SWRX-2014-001] Open Web Analytics Pre-Auth SQL Injection]
[64774]
VMware ESXi 4.0 through 5.1 and ESX 4.0 and 4.1 allow remote attackers to cause a denial of service (NULL pointer dereference) by intercepting and modifying Network File Copy (NFC) traffic.
Per: http://cwe.mitre.org/data/definitions/476.html
"CWE-476: NULL Pointer Dereference"
[64995]
[1029643]
[http://www.vmware.com/security/advisories/VMSA-2014-0001.html]
[vmware-esx-cve20141207-dos(90559)]
VMware Workstation 9.x before 9.0.1, VMware Player 5.x before 5.0.1, VMware Fusion 5.x before 5.0.1, VMware ESXi 4.0 through 5.1, and VMware ESX 4.0 and 4.1 allow guest OS users to cause a denial of service (VMX process disruption) by using an invalid port.
[64994]
[1029643]
[1029644]
[http://www.vmware.com/security/advisories/VMSA-2014-0001.html]
[vmware-esx-cve20141208-dos(90558)]
VMware vSphere Client 4.0, 4.1, 5.0 before Update 3, and 5.1 before Update 2 does not properly validate updates to Client files, which allows remote attackers to trigger the downloading and execution of an arbitrary program via unspecified vectors.
[http://www.vmware.com/security/advisories/VMSA-2014-0003.html]
VMware vSphere Client 5.0 before Update 3 and 5.1 before Update 2 does not properly validate X.509 certificates, which allows man-in-the-middle attackers to spoof SSL servers via a crafted certificate.
[http://www.vmware.com/security/advisories/VMSA-2014-0003.html]
Cross-site request forgery (CSRF) vulnerability in VMware vCloud Director 5.1.x before 5.1.3 allows remote attackers to hijack the authentication of arbitrary users for requests that trigger a logout.
[64993]
[1029645]
[http://www.vmware.com/security/advisories/VMSA-2014-0001.html]
[vmware-vcloud-cve20141211-csrf(90560)]
Sophos Anti-Virus engine (SAVi) before 3.50.1, as used in VDL 4.97G 9.7.x before 9.7.9, 10.0.x before 10.0.11, and 10.3.x before 10.3.1 does not set an ACL for certain global and session objects, which allows local users to bypass anti-virus protection, cause a denial of service (resource consumption, CPU consumption, and eventual crash) or spoof "ready for update" messages by performing certain operations on mutexes or events including (1) DataUpdateRequest, (2) MmfMutexSAV-****, (3) MmfMutexSAV-Info, (4) ReadyForUpdateSAV-****, (5) ReadyForUpdateSAV-Info, (6) SAV-****, (7) SAV-Info, (8) StateChange, (9) SuspendedSAV-****, (10) SuspendedSAV-Info, (11) UpdateComplete, (12) UpdateMutex, (13) UpdateRequest, or (14) SophosALMonSessionInstance, as demonstrated by triggering a ReadyForUpdateSAV event and modifying the UpdateComplete, UpdateMutex, and UpdateRequest objects.
[http://packetstormsecurity.com/files/125024/Sophos-Anti-Virus-Denial-Of-Service.html]
[20140131 CVE-2014-1213 - Denial of Service in Sophos Anti Virus]
[http://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-1213/]
[20140131 CVE-2014-1213 - Denial of Service in Sophos Anti Virus]
[65286]
[1029713]
[http://www.sophos.com/en-us/support/knowledgebase/2300/7200/1031/120401.aspx]
Multiple buffer overflows in Core FTP Server before 1.2 build 508 allow local users to gain privileges via vectors related to reading data from config.dat and Windows Registry.
[20140218 CVE-2014-1215 - Local Code Execution in CoreFTP Core FTP Server]
[https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-1215/]
FitNesse Wiki 20131110, 20140201, and earlier allows remote attackers to execute arbitrary commands by defining a COMMAND_PATTERN and TEST_RUNNER in the pageContent parameter when editing a page.
Per: https://cwe.mitre.org/data/definitions/77.html
"CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')"
[32568]
[https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-1216/]
Livetecs Timelive before 6.2.8 does not properly restrict access to systemsetting.aspx, which allows remote attackers to change configurations and obtain the database connection string and credentials via unspecified vectors.
[20140423 CVE-2014-1217 - Unauthenticated access to sensitive information and functionality in Livetecs Timelive]
[20140423 CVE-2014-1217 - Unauthenticated access to sensitive information and functionality in Livetecs Timelive]
[67043]
[https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-1217/]
CA 2E Web Option r8.1.2 accepts a predictable substring of a W2E_SSNID session token in place of the entire token, which allows remote attackers to hijack sessions by changing characters at the end of this substring, as demonstrated by terminating a session via a modified SSNID parameter to web2edoc/close.htm.
[http://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-1219/]
[65537]
Directory traversal vulnerability in kcfinder/browse.php in Vtiger CRM before 6.0.0 Security patch 1 allows remote authenticated users to read arbitrary files via a .. (dot dot) in the file parameter in a download action. NOTE: it is likely that this issue is actually in the KCFinder third-party component, and it affects additional products besides Vtiger CRM.
[http://sourceforge.net/projects/vtigercrm/files/vtiger%20CRM%206.0.0/Add-ons/vtigercrm-600-security-patch1.zip/download]
[20140312 CVE-2014-1222 - Local File Inclusion in Vtiger CRM]
[https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-1222/]
Cross-site scripting (XSS) vulnerability in controlpanel/loading.aspx in Telligent Evolution before 6.1.19.36103, 7.x before 7.1.12.36162, 7.5.x, and 7.6.x before 7.6.7.36651 allows remote attackers to inject arbitrary web script or HTML via the msg parameter. NOTE: some of these details are obtained from third party information.
[20140221 CVE-2014-1223 - Cross-site Scripting in Telligent Evolution]
[65739]
[https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-1223]
Incomplete blacklist vulnerability in the user registration feature in rexx Recruitment R6.1 and R7 without "fixes from 2014-01-15" allows remote attackers to conduct cross-site scripting (XSS) attacks via the oninput event handler in the fname parameter to the default URI in /reg.
[20140327 [RT-SA-2014-002] rexx Recruitment: Cross-Site Scripting in User Registration]
[20140327 [RT-SA-2014-002] rexx Recruitment: Cross-Site Scripting in User Registration]
[https://www.redteam-pentesting.de/en/advisories/rt-sa-2014-002/-rexx-recruitment-cross-site-scripting-in-user-registration]
The pipe_init_terminal function in main.c in s3dvt allows local users to gain privileges by leveraging setuid permissions and usage of bash 4.3 and earlier. NOTE: This vulnerability exists because of an incomplete fix for CVE-2013-6876.
[http://hmarco.org/bugs/CVE-2014-1226-s3dvt_0.2.2-root-shell.html]
[20140604 CVE-2014-1226 s3dvt Root shell (still)]
[[oss-security] 20140603 CVE-2014-1226 s3dvt Root shell (still)]
[20140603 CVE-2014-1226 s3dvt Root shell (still)]
Cross-site scripting (XSS) vulnerability in the Foliopress WYSIWYG plugin before 2.6.8.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
[http://wordpress.org/plugins/foliopress-wysiwyg/changelog]
[64666]
[foliopress-unspecified-xss(90102)]
The paratrooper-pingdom gem 1.0.0 for Ruby allows local users to obtain the App-Key, username, and password values by listing the curl process.
[[oss-security] 20140107 paratrooper-pingdom-1.0.0 ruby gem exposes API login credentials]
[http://www.vapid.dhs.org/advisories/paratrooper-api-key-pingdom.html]
The paratrooper-newrelic gem 1.0.1 for Ruby allows local users to obtain the X-Api-Key value by listing the curl process.
[[oss-security] 20140107 Paratrooper-newrelic 1.0.1 Ruby Gem exposes API key]
[http://www.vapid.dhs.org/advisories/paratrooper-newrelic-api.html]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: None. Reason: This ID is frequently used as an example of the 2014 CVE-ID syntax change, which allows more than 4 digits in the sequence number. Notes: See references.
Stack-based buffer overflow in the "yyerror" function in Graphviz 2.34.0 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted file. NOTE: This vulnerability exists due to an incomplete fix for CVE-2014-0978.
[[oss-security] 20140108 Re: CVE Request: graphviz: stack-based buffer overflow in yyerror()]
[64736]
[https://bugzilla.redhat.com/show_bug.cgi?id=1050871]
[graphviz-cve20141235-bo(90198)]
[https://github.com/ellson/graphviz/commit/d266bb2b4154d11c27252b56d86963aef4434750]
[GLSA-201702-06]
Stack-based buffer overflow in the chkNum function in lib/cgraph/scan.l in Graphviz 2.34.0 allows remote attackers to have unspecified impact via vectors related to a "badly formed number" and a "long digit list."
[[oss-security] 20140108 Re: Re: CVE Request: graphviz: stack-based buffer overflow in yyerror()]
[[oss-security] 20140108 Re: Re: CVE Request: graphviz: stack-based buffer overflow in yyerror()]
[[oss-security] 20140108 Re: CVE Request: graphviz: stack-based buffer overflow in yyerror()]
[DSA-2843]
[MDVSA-2014:024]
[64737]
[https://bugzilla.redhat.com/show_bug.cgi?id=1050872]
[https://github.com/ellson/graphviz/commit/1d1bdec6318746f6f19f245db589eddc887ae8ff]
[GLSA-201702-06]
Cross-site scripting (XSS) vulnerability in synetics i-doit pro before 1.2.4 allows remote attackers to inject arbitrary web script or HTML via the call parameter.
[http://packetstormsecurity.com/files/125062]
[20140205 CVE-2014-1237 (XSS in i-doit Pro)]
[http://www.csnc.ch/misc/files/advisories/CVE-2014-1237_i-doit_Cross-site_Scripting_-_XSS.txt]
[http://www.i-doit.com/en/company/news/single-news/?tx_ttnews%5Btt_news%5D=136]
[65353]
[idoit-cve20141237-xss(90969)]
Apple iTunes before 11.1.4 uses HTTP for the iTunes Tutorials window, which allows man-in-the-middle attackers to spoof content by gaining control over the client-server data stream.
[http://support.apple.com/kb/HT6001]
[65088]
[1029671]
[apple-itunes-cve20141242-mitm(90653)]
Apple QuickTime before 7.7.5 does not initialize an unspecified pointer, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted track list in a movie file.
[http://support.apple.com/kb/HT6151]
Buffer overflow in Apple QuickTime before 7.7.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted movie file with H.264 encoding.
[http://support.apple.com/kb/HT6151]
[65786]
Integer signedness error in Apple QuickTime before 7.7.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted stsz atom in a movie file.
[http://support.apple.com/kb/HT6150]
[http://support.apple.com/kb/HT6151]
Buffer overflow in Apple QuickTime before 7.7.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted ftab atom in a movie file.
[http://support.apple.com/kb/HT6150]
[http://support.apple.com/kb/HT6151]
Apple QuickTime before 7.7.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted dref atom in a movie file.
[http://support.apple.com/kb/HT6150]
[http://support.apple.com/kb/HT6151]
Buffer overflow in Apple QuickTime before 7.7.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted ldat atom in a movie file.
[http://support.apple.com/kb/HT6150]
[http://support.apple.com/kb/HT6151]
Buffer overflow in Apple QuickTime before 7.7.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted PSD image.
[http://support.apple.com/kb/HT6150]
[http://support.apple.com/kb/HT6151]
Apple QuickTime before 7.7.5 does not properly perform a byte-swapping operation, which allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds memory access and application crash) via a crafted ttfo element in a movie file.
[http://support.apple.com/kb/HT6150]
[http://support.apple.com/kb/HT6151]
Buffer overflow in Apple QuickTime before 7.7.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted clef atom in a movie file.
[http://support.apple.com/kb/HT6151]
[65787]
Double free vulnerability in Apple Pages 2.x before 2.1 and 5.x before 5.1 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted Microsoft Word file.
[http://support.apple.com/kb/HT6117]
[http://support.apple.com/kb/HT6150]
[http://support.apple.com/kb/HT6162]
[65113]
[1029683]
[apple-pages-cve20141252-code-exec(90672)]
AppleMNT.sys in Apple Boot Camp 5 before 5.1 allows local users to cause a denial of service (kernel memory corruption) or possibly have unspecified other impact via a malformed header in a Portable Executable (PE) file.
[APPLE-SA-2014-02-11-1]
[http://support.apple.com/kb/HT6126]
Apple Type Services (ATS) in Apple OS X before 10.9.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Type 1 font that is embedded in a document.
[http://support.apple.com/kb/HT6150]
Apple Type Services (ATS) in Apple OS X before 10.9.2 does not properly validate calls to the free function, which allows attackers to bypass the App Sandbox protection mechanism via crafted Mach messages.
[http://support.apple.com/kb/HT6150]
Buffer overflow in Apple Type Services (ATS) in Apple OS X before 10.9.2 allows attackers to bypass the App Sandbox protection mechanism via crafted Mach messages.
[http://support.apple.com/kb/HT6150]
CFNetwork in Apple OS X through 10.8.5 does not remove session cookies upon a Safari reset action, which allows physically proximate attackers to bypass intended access restrictions by leveraging an unattended workstation.
[http://support.apple.com/kb/HT6150]
Heap-based buffer overflow in CoreAnimation in Apple OS X before 10.9.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted image.
[http://support.apple.com/kb/HT6150]
Buffer overflow in File Bookmark in Apple OS X before 10.9.2 allows attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted filename.
[http://support.apple.com/kb/HT6150]
QuickLook in Apple OS X through 10.8.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted Microsoft Office document.
[http://support.apple.com/kb/HT6150]
Integer signedness error in CoreText in Apple OS X before 10.9.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted Unicode font.
[http://support.apple.com/kb/HT6150]
Apple Type Services (ATS) in Apple OS X before 10.9.2 allows attackers to bypass the App Sandbox protection mechanism via crafted Mach messages that trigger memory corruption.
[http://support.apple.com/kb/HT6150]
curl and libcurl 7.27.0 through 7.35.0, when using the SecureTransport/Darwinssl backend, as used in in Apple OS X 10.9.x before 10.9.2, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate when accessing a URL that uses a numerical IP address, which allows man-in-the-middle attackers to spoof servers via an arbitrary valid certificate.
[http://curl.haxx.se/docs/adv_20140326C.html]
[http://support.apple.com/kb/HT6150]
[http://twitter.com/agl__/statuses/437029812046422016]
[http://twitter.com/okoeroo/statuses/437272014043496449]
[http://www.getchef.com/blog/2014/04/09/chef-server-11-0-12-release/]
[http://www.getchef.com/blog/2014/04/09/enterprise-chef-11-1-3-release/]
[http://www.getchef.com/blog/2014/04/09/enterprise-chef-1-4-9-release/]
[https://gist.github.com/rmoriz/fb2b0a6a0ce10550ab73]
Finder in Apple OS X before 10.9.2 does not ensure ACL integrity after the viewing of file ACL information, which allows local users to bypass intended access restrictions in opportunistic circumstances via standard filesystem operations on a file with a damaged ACL.
[http://support.apple.com/kb/HT6150]
The systemsetup program in the Date and Time subsystem in Apple OS X before 10.9.2 allows local users to bypass intended access restrictions by changing the current time on the system clock.
[http://support.apple.com/kb/HT6150]
The SSLVerifySignedServerKeyExchange function in libsecurity_ssl/lib/sslKeyExchange.c in the Secure Transport feature in the Data Security component in Apple iOS 6.x before 6.1.6 and 7.x before 7.0.6, Apple TV 6.x before 6.0.2, and Apple OS X 10.9.x before 10.9.2 does not check the signature in a TLS Server Key Exchange message, which allows man-in-the-middle attackers to spoof SSL servers by (1) using an arbitrary private key for the signing step or (2) omitting the signing step.
[http://it.slashdot.org/comments.pl?sid=4821073&cid=46310187]
[http://support.apple.com/kb/HT6146]
[http://support.apple.com/kb/HT6147]
[http://support.apple.com/kb/HT6148]
[http://support.apple.com/kb/HT6150]
[https://news.ycombinator.com/item?id=7281378]
[https://www.cs.columbia.edu/~smb/blog/2014-02/2014-02-23.html]
[https://www.cs.columbia.edu/~smb/blog/2014-02/2014-02-24.html]
[https://www.imperialviolet.org/2014/02/22/applebug.html]
The Configuration Profiles component in Apple iOS before 7.1 and Apple TV before 6.1 does not properly evaluate the expiration date of a mobile configuration profile, which allows attackers to bypass intended access restrictions by using a profile after the date has passed.
[http://support.apple.com/kb/HT6162]
[http://support.apple.com/kb/HT6163]
WebKit, as used in Apple Safari before 6.1.2 and 7.x before 7.0.2, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2014-1269 and CVE-2014-1270.
[http://support.apple.com/kb/HT6145]
[https://support.apple.com/kb/HT6537]
WebKit, as used in Apple Safari before 6.1.2 and 7.x before 7.0.2, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2014-1268 and CVE-2014-1270.
[http://support.apple.com/kb/HT6145]
[http://support.apple.com/kb/HT6162]
[http://support.apple.com/kb/HT6163]
[https://support.apple.com/kb/HT6537]
WebKit, as used in Apple Safari before 6.1.2 and 7.x before 7.0.2, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2014-1268 and CVE-2014-1269.
[http://support.apple.com/kb/HT6145]
[http://support.apple.com/kb/HT6162]
[http://support.apple.com/kb/HT6163]
[https://support.apple.com/kb/HT6537]
CoreCapture in Apple iOS before 7.1 and Apple TV before 6.1 does not properly validate IOKit API calls, which allows attackers to cause a denial of service (assertion failure and device crash) via a crafted app.
[http://support.apple.com/kb/HT6162]
[http://support.apple.com/kb/HT6163]
CrashHouseKeeping in Crash Reporting in Apple iOS before 7.1 and Apple TV before 6.1 allows local users to change arbitrary file permissions by leveraging a symlink.
[http://support.apple.com/kb/HT6162]
[http://support.apple.com/kb/HT6163]
dyld in Apple iOS before 7.1 and Apple TV before 6.1 allows attackers to bypass code-signing requirements by leveraging use of text-relocation instructions in a dynamic library.
[http://support.apple.com/kb/HT6162]
[http://support.apple.com/kb/HT6163]
FaceTime in Apple iOS before 7.1 allows physically proximate attackers to obtain sensitive FaceTime contact information by using the lock screen for an invalid FaceTime call.
[http://support.apple.com/kb/HT6162]
Buffer overflow in ImageIO in Apple iOS before 7.1 and Apple TV before 6.1 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted JPEG2000 data in a PDF document.
[http://support.apple.com/kb/HT6162]
[http://support.apple.com/kb/HT6163]
IOKit HID Event in Apple iOS before 7.1 allows attackers to conduct user-action monitoring attacks against arbitrary apps via a crafted app that accesses an IOKit framework interface.
[http://support.apple.com/kb/HT6162]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2013-3948. Reason: This candidate is a duplicate of CVE-2013-3948. Notes: All CVE users should reference CVE-2013-3948 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
The ptmx_get_ioctl function in the ARM kernel in Apple iOS before 7.1 and Apple TV before 6.1 allows local users to gain privileges or cause a denial of service (out-of-bounds memory access and device crash) via a crafted call.
[http://support.apple.com/kb/HT6162]
[http://support.apple.com/kb/HT6163]
Apple TV before 6.1 does not properly restrict logging, which allows local users to obtain sensitive information by reading log data.
[http://support.apple.com/kb/HT6163]
Video Driver in Apple iOS before 7.1 and Apple TV before 6.1 allows remote attackers to cause a denial of service (NULL pointer dereference and device hang) via a crafted video file with MPEG-4 encoding.
Per: http://cwe.mitre.org/data/definitions/476.html
"CWE-476: NULL Pointer Dereference"
[http://support.apple.com/kb/HT6162]
[http://support.apple.com/kb/HT6163]
Photos Backend in Apple iOS before 7.1 does not properly manage the asset-library cache during deletions, which allows physically proximate attackers to obtain sensitive photo data by launching the Photos app and looking under a transparent image.
[http://support.apple.com/kb/HT6162]
The Profiles component in Apple iOS before 7.1 and Apple TV before 6.1 allows attackers to bypass intended configuration-profile visibility requirements via a long name.
[http://support.apple.com/kb/HT6162]
[http://support.apple.com/kb/HT6163]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2014. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-2019. Reason: This candidate is a duplicate of CVE-2014-2019. Notes: All CVE users should reference CVE-2014-2019 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
Springboard in Apple iOS before 7.1 allows physically proximate attackers to bypass intended access restrictions and read the home screen by leveraging an application crash during activation of an unactivated device.
[http://support.apple.com/kb/HT6162]
SpringBoard Lock Screen in Apple iOS before 7.1 allows remote attackers to cause a denial of service (lock-screen hang) by leveraging a state-management error.
Per: https://cwe.mitre.org/data/definitions/361.html
"CWE-361: Time and State"
[http://support.apple.com/kb/HT6162]
USB Host in Apple iOS before 7.1 and Apple TV before 6.1 allows physically proximate attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted USB messages.
[http://support.apple.com/kb/HT6162]
[http://support.apple.com/kb/HT6163]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2014. Notes: none.
WebKit, as used in Apple iOS before 7.1 and Apple TV before 6.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2014-1290, CVE-2014-1291, CVE-2014-1292, CVE-2014-1293, and CVE-2014-1294.
[APPLE-SA-2014-04-01-1]
[http://support.apple.com/kb/HT6162]
[http://support.apple.com/kb/HT6163]
[https://support.apple.com/kb/HT6537]
WebKit, as used in Apple iOS before 7.1 and Apple TV before 6.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2014-1289, CVE-2014-1291, CVE-2014-1292, CVE-2014-1293, and CVE-2014-1294.
[APPLE-SA-2014-04-01-1]
[http://support.apple.com/kb/HT6162]
[http://support.apple.com/kb/HT6163]
[https://support.apple.com/kb/HT6537]
WebKit, as used in Apple iOS before 7.1 and Apple TV before 6.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2014-1289, CVE-2014-1290, CVE-2014-1292, CVE-2014-1293, and CVE-2014-1294.
[APPLE-SA-2014-04-01-1]
[http://support.apple.com/kb/HT6162]
[http://support.apple.com/kb/HT6163]
[https://support.apple.com/kb/HT6537]
WebKit, as used in Apple iOS before 7.1 and Apple TV before 6.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2014-1289, CVE-2014-1290, CVE-2014-1291, CVE-2014-1293, and CVE-2014-1294.
[APPLE-SA-2014-04-01-1]
[http://support.apple.com/kb/HT6162]
[http://support.apple.com/kb/HT6163]
[https://support.apple.com/kb/HT6537]
WebKit, as used in Apple iOS before 7.1 and Apple TV before 6.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2014-1289, CVE-2014-1290, CVE-2014-1291, CVE-2014-1292, and CVE-2014-1294.
[APPLE-SA-2014-04-01-1]
[http://support.apple.com/kb/HT6162]
[http://support.apple.com/kb/HT6163]
[https://support.apple.com/kb/HT6537]
WebKit, as used in Apple iOS before 7.1 and Apple TV before 6.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2014-1289, CVE-2014-1290, CVE-2014-1291, CVE-2014-1292, and CVE-2014-1293.
[APPLE-SA-2014-04-01-1]
[http://support.apple.com/kb/HT6162]
[http://support.apple.com/kb/HT6163]
[https://support.apple.com/kb/HT6537]
Secure Transport in Apple iOS before 7.1.1, Apple OS X 10.8.x and 10.9.x through 10.9.2, and Apple TV before 6.1.1 does not ensure that a server's X.509 certificate is the same during renegotiation as it was before renegotiation, which allows man-in-the-middle attackers to obtain sensitive information or modify TLS session data via a "triple handshake attack."
[APPLE-SA-2014-04-22-1]
[APPLE-SA-2014-04-22-3]
[APPLE-SA-2014-04-22-2]
[https://secure-resumption.com/]
CFNetwork in Apple iOS before 7.1.1, Apple OS X through 10.9.2, and Apple TV before 6.1.1 does not ensure that a Set-Cookie HTTP header is complete before interpreting the header's value, which allows remote attackers to bypass intended access restrictions by triggering the closing of a TCP connection during transmission of a header, as demonstrated by an HTTPOnly restriction.
[APPLE-SA-2014-04-22-1]
[APPLE-SA-2014-04-22-3]
[APPLE-SA-2014-04-22-2]
WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, does not properly validate WebProcess IPC messages, which allows remote attackers to bypass a sandbox protection mechanism and read arbitrary files by leveraging WebProcess access.
[APPLE-SA-2014-04-01-1]
WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1.
[APPLE-SA-2014-04-01-1]
[APPLE-SA-2014-04-22-3]
[APPLE-SA-2014-04-22-2]
[https://support.apple.com/kb/HT6537]
WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1.
[APPLE-SA-2014-04-01-1]
[APPLE-SA-2014-04-22-3]
[APPLE-SA-2014-04-22-2]
[https://support.apple.com/kb/HT6537]
Unspecified vulnerability in Apple Safari 7.0.2 on OS X allows remote attackers to execute arbitrary code with root privileges via unknown vectors, as demonstrated by Google during a Pwn4Fun competition at CanSecWest 2014.
[APPLE-SA-2014-04-01-1]
[APPLE-SA-2014-04-22-3]
[APPLE-SA-2014-04-22-2]
[http://twitter.com/thezdi/statuses/443796547872903168]
[http://www.pwn2own.com/2014/03/pwn2own-results-for-wednesday-day-one/]
[https://support.apple.com/kb/HT6537]
WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1.
[APPLE-SA-2014-04-01-1]
[https://support.apple.com/kb/HT6537]
WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1.
[APPLE-SA-2014-04-01-1]
[APPLE-SA-2014-04-22-3]
[APPLE-SA-2014-04-22-2]
[https://support.apple.com/kb/HT6537]
Heap-based buffer overflow in Apple Safari 7.0.2 allows remote attackers to execute arbitrary code and bypass a sandbox protection mechanism via unspecified vectors, as demonstrated by Liang Chen during a Pwn2Own competition at CanSecWest 2014.
[APPLE-SA-2014-04-01-1]
[APPLE-SA-2014-04-22-3]
[APPLE-SA-2014-04-22-2]
[http://twitter.com/thezdi/statuses/444157530139136000]
[http://www.pwn2own.com/2014/03/pwn2own-results-thursday-day-two/]
[https://support.apple.com/kb/HT6537]
WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1.
[APPLE-SA-2014-04-01-1]
[APPLE-SA-2014-04-22-3]
[APPLE-SA-2014-04-22-2]
[https://support.apple.com/kb/HT6537]
WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1.
[APPLE-SA-2014-04-01-1]
[APPLE-SA-2014-04-22-3]
[APPLE-SA-2014-04-22-2]
[https://support.apple.com/kb/HT6537]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2014. Notes: none.
WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1.
[APPLE-SA-2014-04-01-1]
[APPLE-SA-2014-04-22-3]
[APPLE-SA-2014-04-22-2]
[https://support.apple.com/kb/HT6537]
WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1.
[APPLE-SA-2014-04-01-1]
[APPLE-SA-2014-04-22-3]
[APPLE-SA-2014-04-22-2]
[https://support.apple.com/kb/HT6537]
WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1.
[APPLE-SA-2014-04-01-1]
[APPLE-SA-2014-04-22-3]
[APPLE-SA-2014-04-22-2]
[https://support.apple.com/kb/HT6537]
WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1.
[APPLE-SA-2014-04-01-1]
[APPLE-SA-2014-04-22-3]
[APPLE-SA-2014-04-22-2]
[https://support.apple.com/kb/HT6537]
WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1.
[APPLE-SA-2014-04-01-1]
[APPLE-SA-2014-04-22-3]
[APPLE-SA-2014-04-22-2]
[https://support.apple.com/kb/HT6537]
WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1.
[APPLE-SA-2014-04-01-1]
[APPLE-SA-2014-04-22-3]
[APPLE-SA-2014-04-22-2]
[https://support.apple.com/kb/HT6537]
WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1.
[APPLE-SA-2014-04-01-1]
[APPLE-SA-2014-04-22-3]
[APPLE-SA-2014-04-22-2]
[https://support.apple.com/kb/HT6537]
WindowServer in Apple OS X through 10.9.2 does not prevent session creation by a sandboxed application, which allows attackers to bypass the sandbox protection mechanism and execute arbitrary code via a crafted application.
[APPLE-SA-2014-04-22-1]
Format string vulnerability in CoreServicesUIAgent in Apple OS X 10.9.x through 10.9.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via format string specifiers in a URL.
[APPLE-SA-2014-04-22-1]
Heimdal, as used in Apple OS X through 10.9.2, allows remote attackers to cause a denial of service (abort and daemon exit) via ASN.1 data encountered in the Kerberos 5 protocol.
[APPLE-SA-2014-04-22-1]
iBooks Commerce in Apple OS X before 10.9.4 places Apple ID credentials in the iBooks log, which allows local users to obtain sensitive information by reading this file.
[APPLE-SA-2014-06-30-2]
[http://support.apple.com/kb/HT6296]
[1030505]
The Intel Graphics Driver in Apple OS X through 10.9.2 does not properly validate a certain pointer, which allows attackers to execute arbitrary code via a crafted application.
[APPLE-SA-2014-04-22-1]
Buffer overflow in ImageIO in Apple OS X 10.9.x through 10.9.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted JPEG image.
[APPLE-SA-2014-04-22-1]
IOKit in Apple iOS before 7.1.1, Apple OS X through 10.9.2, and Apple TV before 6.1.1 places kernel pointers into an object data structure, which makes it easier for local users to bypass the ASLR protection mechanism by reading unspecified attributes of the object.
[APPLE-SA-2014-04-22-1]
[APPLE-SA-2014-04-22-3]
[APPLE-SA-2014-04-22-2]
Power Management in Apple OS X 10.9.x through 10.9.2 allows physically proximate attackers to bypass an intended transition into the locked-screen state by touching (1) a key or (2) the trackpad during a lid-close action.
[APPLE-SA-2014-04-22-1]
The kernel in Apple OS X through 10.9.2 places a kernel pointer into an XNU object data structure accessible from user space, which makes it easier for local users to bypass the ASLR protection mechanism by reading an unspecified attribute of the object.
[APPLE-SA-2014-04-22-1]
WebKit, as used in Apple Safari before 6.1.4 and 7.x before 7.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-05-21-1.
[APPLE-SA-2014-05-21-1]
[APPLE-SA-2014-06-30-3]
[APPLE-SA-2014-06-30-4]
[http://support.apple.com/kb/HT6254]
[67553]
[https://support.apple.com/kb/HT6537]
WebKit, as used in Apple Safari before 6.1.4 and 7.x before 7.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-05-21-1.
[APPLE-SA-2014-05-21-1]
[http://support.apple.com/kb/HT6254]
[67553]
[https://support.apple.com/kb/HT6537]
WebKit, as used in Apple iOS before 7.1.2, Apple Safari before 6.1.5 and 7.x before 7.0.5, and Apple TV before 6.1.2, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-06-30-1, APPLE-SA-2014-06-30-3, and APPLE-SA-2014-06-30-4.
[APPLE-SA-2014-06-30-1]
[APPLE-SA-2014-06-30-3]
[APPLE-SA-2014-06-30-4]
[1030495]
[https://support.apple.com/kb/HT6537]
WebKit, as used in Apple Safari before 6.1.4 and 7.x before 7.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-05-21-1.
[APPLE-SA-2014-05-21-1]
[APPLE-SA-2014-06-30-3]
[APPLE-SA-2014-06-30-4]
[http://support.apple.com/kb/HT6254]
[67553]
[https://support.apple.com/kb/HT6537]
WebKit, as used in Apple Safari before 6.1.4 and 7.x before 7.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-05-21-1.
[APPLE-SA-2014-05-21-1]
[APPLE-SA-2014-06-30-3]
[APPLE-SA-2014-06-30-4]
[http://support.apple.com/kb/HT6254]
[67553]
[https://support.apple.com/kb/HT6537]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2014. Notes: none.
WebKit, as used in Apple Safari before 6.1.4 and 7.x before 7.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-05-21-1.
[APPLE-SA-2014-05-21-1]
[APPLE-SA-2014-06-30-3]
[APPLE-SA-2014-06-30-4]
[http://support.apple.com/kb/HT6254]
[67553]
[https://support.apple.com/kb/HT6537]
WebKit, as used in Apple Safari before 6.1.4 and 7.x before 7.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-05-21-1.
[APPLE-SA-2014-05-21-1]
[APPLE-SA-2014-06-30-3]
[APPLE-SA-2014-06-30-4]
[http://support.apple.com/kb/HT6254]
[67553]
[https://support.apple.com/kb/HT6537]
WebKit, as used in Apple Safari before 6.1.4 and 7.x before 7.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-05-21-1.
[APPLE-SA-2014-05-21-1]
[APPLE-SA-2014-06-30-3]
[APPLE-SA-2014-06-30-4]
[http://support.apple.com/kb/HT6254]
[67553]
[https://support.apple.com/kb/HT6537]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2014. Notes: none.
WebKit, as used in Apple Safari before 6.1.4 and 7.x before 7.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-05-21-1.
[APPLE-SA-2014-05-21-1]
[APPLE-SA-2014-06-30-3]
[APPLE-SA-2014-06-30-4]
[http://support.apple.com/kb/HT6254]
[67553]
[https://support.apple.com/kb/HT6537]
WebKit, as used in Apple Safari before 6.1.4 and 7.x before 7.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-05-21-1.
[APPLE-SA-2014-05-21-1]
[APPLE-SA-2014-06-30-3]
[APPLE-SA-2014-06-30-4]
[http://support.apple.com/kb/HT6254]
[67553]
[https://support.apple.com/kb/HT6537]
WebKit, as used in Apple Safari before 6.1.4 and 7.x before 7.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-05-21-1.
[APPLE-SA-2014-05-21-1]
[APPLE-SA-2014-06-30-3]
[APPLE-SA-2014-06-30-4]
[http://support.apple.com/kb/HT6254]
[67553]
[https://support.apple.com/kb/HT6537]
WebKit, as used in Apple Safari before 6.1.4 and 7.x before 7.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-05-21-1.
[APPLE-SA-2014-05-21-1]
[APPLE-SA-2014-06-30-3]
[APPLE-SA-2014-06-30-4]
[http://support.apple.com/kb/HT6254]
[67553]
[https://support.apple.com/kb/HT6537]
WebKit, as used in Apple Safari before 6.1.4 and 7.x before 7.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-05-21-1.
[APPLE-SA-2014-05-21-1]
[APPLE-SA-2014-06-30-3]
[APPLE-SA-2014-06-30-4]
[http://support.apple.com/kb/HT6254]
[67553]
[https://support.apple.com/kb/HT6537]
WebKit, as used in Apple Safari before 6.1.4 and 7.x before 7.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-05-21-1.
[APPLE-SA-2014-05-21-1]
[APPLE-SA-2014-06-30-3]
[APPLE-SA-2014-06-30-4]
[http://support.apple.com/kb/HT6254]
[67553]
[https://support.apple.com/kb/HT6537]
WebKit, as used in Apple Safari before 6.1.4 and 7.x before 7.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-05-21-1.
[APPLE-SA-2014-05-21-1]
[APPLE-SA-2014-06-30-3]
[APPLE-SA-2014-06-30-4]
[http://support.apple.com/kb/HT6254]
[67553]
[https://support.apple.com/kb/HT6537]
WebKit, as used in Apple Safari before 6.1.5 and 7.x before 7.0.5, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-06-30-1.
[APPLE-SA-2014-06-30-1]
[1030495]
[https://support.apple.com/kb/HT6537]
WebKit, as used in Apple Safari before 6.1.4 and 7.x before 7.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-05-21-1.
[APPLE-SA-2014-05-21-1]
[APPLE-SA-2014-06-30-3]
[APPLE-SA-2014-06-30-4]
[http://support.apple.com/kb/HT6254]
[67553]
[https://support.apple.com/kb/HT6537]
WebKit, as used in Apple Safari before 6.1.4 and 7.x before 7.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-05-21-1.
[APPLE-SA-2014-05-21-1]
[APPLE-SA-2014-06-30-3]
[APPLE-SA-2014-06-30-4]
[http://support.apple.com/kb/HT6254]
[67553]
[https://support.apple.com/kb/HT6537]
WebKit, as used in Apple Safari before 6.1.4 and 7.x before 7.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-05-21-1.
[APPLE-SA-2014-05-21-1]
[APPLE-SA-2014-06-30-3]
[APPLE-SA-2014-06-30-4]
[http://support.apple.com/kb/HT6254]
[67553]
[https://support.apple.com/kb/HT6537]
WebKit, as used in Apple Safari before 6.1.4 and 7.x before 7.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-05-21-1.
[APPLE-SA-2014-05-21-1]
[http://support.apple.com/kb/HT6254]
[67553]
[GLSA-201601-02]
[https://support.apple.com/kb/HT6537]
WebKit in Apple iOS before 7.1.2 and Apple Safari before 6.1.5 and 7.x before 7.0.5 does not properly encode domain names in URLs, which allows remote attackers to spoof the address bar via a crafted web site.
Per: http://cwe.mitre.org/data/definitions/172.html
"CWE-172: Encoding Error"
[APPLE-SA-2014-06-30-1]
[APPLE-SA-2014-06-30-3]
[68276]
[1030495]
WebKit, as used in Apple Safari before 6.1.4 and 7.x before 7.0.4, does not properly interpret Unicode encoding, which allows remote attackers to spoof a postMessage origin, and bypass intended restrictions on sending a message to a connected frame or window, via crafted characters in a URL.
[APPLE-SA-2014-05-21-1]
[APPLE-SA-2014-06-30-3]
[http://support.apple.com/kb/HT6254]
[67554]
Apple iTunes before 11.2.1 on OS X sets world-writable permissions for /Users and /Users/Shared during reboots, which allows local users to modify files, and consequently obtain access to arbitrary user accounts, via standard filesystem operations.
[http://support.apple.com/kb/HT6251]
Mail in Apple iOS before 7.1.2 advertises the availability of data protection for attachments but stores cleartext attachments under mobile/Library/Mail/, which makes it easier for physically proximate attackers to obtain sensitive information by mounting the data partition.
[APPLE-SA-2014-06-30-3]
[APPLE-SA-2014-09-17-1]
[http://support.apple.com/kb/HT6441]
[http://www.andreas-kurtz.de/2014/04/what-apple-missed-to-fix-in-ios-711.html]
[67263]
[68276]
[1030500]
Use-after-free vulnerability in Safari in Apple iOS before 7.1.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via an invalid URL.
Per: http://cwe.mitre.org/data/definitions/416.html
"CWE-416: Use After Free"
[APPLE-SA-2014-06-30-3]
[68276]
[1030500]
Settings in Apple iOS before 7.1.2 allows physically proximate attackers to bypass an intended iCloud password requirement, and turn off the Find My iPhone service, by leveraging incorrect state management.
[APPLE-SA-2014-06-30-3]
[68276]
[1030500]
Siri in Apple iOS before 7.1.2 allows physically proximate attackers to bypass an intended lock-screen passcode requirement, and read a contact list, via a Siri request that refers to a contact ambiguously.
[APPLE-SA-2014-06-30-3]
[68276]
[1030500]
Lock Screen in Apple iOS before 7.1.2 does not properly enforce the limit on failed passcode attempts, which makes it easier for physically proximate attackers to conduct brute-force passcode-guessing attacks via unspecified vectors.
[APPLE-SA-2014-06-30-3]
[68276]
[1030500]
Lock Screen in Apple iOS before 7.1.2 does not properly manage the telephony state in Airplane Mode, which allows physically proximate attackers to bypass the lock protection mechanism, and access a certain foreground application, via unspecified vectors.
[APPLE-SA-2014-06-30-3]
[68276]
[1030500]
CoreGraphics in Apple iOS before 7.1.2 does not properly restrict allocation of stack memory for processing of XBM images, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted image data.
[APPLE-SA-2014-06-30-3]
[68276]
[1030500]
The IOKit implementation in the kernel in Apple iOS before 7.1.2 and Apple TV before 6.1.2, and in IOReporting in Apple OS X before 10.9.4, allows local users to cause a denial of service (NULL pointer dereference and reboot) via crafted API arguments.
Per: http://cwe.mitre.org/data/definitions/476.html
"CWE-476: NULL Pointer Dereference"
[APPLE-SA-2014-06-30-2]
[APPLE-SA-2014-06-30-3]
[APPLE-SA-2014-06-30-4]
[http://support.apple.com/kb/HT6296]
[1030500]
Heap-based buffer overflow in launchd in Apple iOS before 7.1.2, Apple OS X before 10.9.4, and Apple TV before 6.1.2 allows attackers to execute arbitrary code via a crafted application that sends IPC messages.
[APPLE-SA-2014-06-30-2]
[APPLE-SA-2014-06-30-3]
[APPLE-SA-2014-06-30-4]
[http://support.apple.com/kb/HT6296]
[1030500]
Heap-based buffer overflow in launchd in Apple iOS before 7.1.2, Apple OS X before 10.9.4, and Apple TV before 6.1.2 allows attackers to execute arbitrary code via a crafted application that generates log messages.
[APPLE-SA-2014-06-30-2]
[APPLE-SA-2014-06-30-3]
[APPLE-SA-2014-06-30-4]
[http://support.apple.com/kb/HT6296]
[1030500]
Integer overflow in launchd in Apple iOS before 7.1.2, Apple OS X before 10.9.4, and Apple TV before 6.1.2 allows attackers to execute arbitrary code via a crafted application.
[APPLE-SA-2014-06-30-2]
[APPLE-SA-2014-06-30-3]
[APPLE-SA-2014-06-30-4]
[http://support.apple.com/kb/HT6296]
[1030500]
Integer underflow in launchd in Apple iOS before 7.1.2, Apple OS X before 10.9.4, and Apple TV before 6.1.2 allows attackers to execute arbitrary code via a crafted application.
[APPLE-SA-2014-06-30-2]
[APPLE-SA-2014-06-30-3]
[APPLE-SA-2014-06-30-4]
[http://support.apple.com/kb/HT6296]
[1030500]
Lockdown in Apple iOS before 7.1.2 does not properly verify data from activation servers, which makes it easier for physically proximate attackers to bypass the Activation Lock protection mechanism via unspecified vectors.
[APPLE-SA-2014-06-30-3]
[APPLE-SA-2014-09-17-1]
[http://support.apple.com/kb/HT6441]
[68276]
[1030500]
Secure Transport in Apple iOS before 7.1.2, Apple OS X before 10.9.4, and Apple TV before 6.1.2 does not ensure that a DTLS message is accepted only for a DTLS connection, which allows remote attackers to obtain potentially sensitive information from uninitialized process memory by providing a DTLS message within a TLS connection.
[APPLE-SA-2014-06-30-2]
[APPLE-SA-2014-06-30-3]
[APPLE-SA-2014-06-30-4]
[http://support.apple.com/kb/HT6296]
[1030500]
WebKit, as used in Apple iOS before 7.1.2, Apple Safari before 6.1.5 and 7.x before 7.0.5, and Apple TV before 6.1.2, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-06-30-1, APPLE-SA-2014-06-30-3, and APPLE-SA-2014-06-30-4.
[APPLE-SA-2014-06-30-1]
[APPLE-SA-2014-06-30-3]
[APPLE-SA-2014-06-30-4]
[1030495]
[https://support.apple.com/kb/HT6537]
WebKit, as used in Apple iOS before 7.1.2, Apple Safari before 6.1.5 and 7.x before 7.0.5, and Apple TV before 6.1.2, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-06-30-1, APPLE-SA-2014-06-30-3, and APPLE-SA-2014-06-30-4.
[APPLE-SA-2014-06-30-1]
[APPLE-SA-2014-06-30-3]
[APPLE-SA-2014-06-30-4]
[1030495]
[https://support.apple.com/kb/HT6537]
WebKit, as used in Apple iOS before 7.1.2, Apple Safari before 6.1.5 and 7.x before 7.0.5, and Apple TV before 6.1.2, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-06-30-1, APPLE-SA-2014-06-30-3, and APPLE-SA-2014-06-30-4.
[APPLE-SA-2014-06-30-1]
[APPLE-SA-2014-06-30-3]
[APPLE-SA-2014-06-30-4]
[1030495]
[https://support.apple.com/kb/HT6537]
WebKit, as used in Apple iOS before 7.1.2, Apple Safari before 6.1.5 and 7.x before 7.0.5, and Apple TV before 6.1.2, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-06-30-1, APPLE-SA-2014-06-30-3, and APPLE-SA-2014-06-30-4.
[APPLE-SA-2014-06-30-1]
[APPLE-SA-2014-06-30-3]
[APPLE-SA-2014-06-30-4]
[1030495]
[https://support.apple.com/kb/HT6537]
WebKit, as used in Apple iOS before 7.1.2, Apple Safari before 6.1.5 and 7.x before 7.0.5, and Apple TV before 6.1.2, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-06-30-1, APPLE-SA-2014-06-30-3, and APPLE-SA-2014-06-30-4.
[APPLE-SA-2014-06-30-1]
[APPLE-SA-2014-06-30-3]
[APPLE-SA-2014-06-30-4]
[1030495]
[https://support.apple.com/kb/HT6537]
WebKit, as used in Apple iOS before 7.1.2, Apple Safari before 6.1.5 and 7.x before 7.0.5, and Apple TV before 6.1.2, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-06-30-1, APPLE-SA-2014-06-30-3, and APPLE-SA-2014-06-30-4.
[APPLE-SA-2014-06-30-1]
[APPLE-SA-2014-06-30-3]
[APPLE-SA-2014-06-30-4]
[1030495]
[https://support.apple.com/kb/HT6537]
WebKit, as used in Apple iOS before 7.1.2, Apple Safari before 6.1.5 and 7.x before 7.0.5, and Apple TV before 6.1.2, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-06-30-1, APPLE-SA-2014-06-30-3, and APPLE-SA-2014-06-30-4.
[APPLE-SA-2014-06-30-1]
[APPLE-SA-2014-06-30-3]
[APPLE-SA-2014-06-30-4]
[1030495]
[https://support.apple.com/kb/HT6537]
WebKit in Apple Safari before 6.1.5 and 7.x before 7.0.5 allows user-assisted remote attackers to access file: URLs by leveraging a URL drag operation that originates at a crafted web site.
[APPLE-SA-2014-06-30-1]
[1030495]
The byte-swapping implementation in copyfile in Apple OS X before 10.9.4 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds memory access and application crash) via a crafted AppleDouble file in a ZIP archive.
[APPLE-SA-2014-06-30-2]
[http://support.apple.com/kb/HT6296]
[1030505]
[20141210 Apple Mac OS X Archive Utility Heap Memory Corruption Vulnerability]
Array index error in Dock in Apple OS X before 10.9.4 allows attackers to execute arbitrary code or cause a denial of service (incorrect function-pointer dereference and application crash) by leveraging access to a sandboxed application for sending a message.
[APPLE-SA-2014-06-30-2]
[http://support.apple.com/kb/HT6296]
[1030505]
Graphics Driver in Apple OS X before 10.9.4 does not properly restrict read operations during processing of an unspecified system call, which allows local users to obtain sensitive information from kernel memory and bypass the ASLR protection mechanism via a crafted call.
[APPLE-SA-2014-06-30-2]
[http://support.apple.com/kb/HT6296]
[1030505]
[https://code.google.com/p/google-security-research/issues/detail?id=18]
Intel Graphics Driver in Apple OS X before 10.9.4 does not properly restrict an unspecified OpenGL API call, which allows attackers to execute arbitrary code via a crafted application.
[APPLE-SA-2014-06-30-2]
[http://support.apple.com/kb/HT6296]
[1030505]
[https://code.google.com/p/google-security-research/issues/detail?id=22]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2014. Notes: none.
Intel Graphics Driver in Apple OS X before 10.9.4 allows local users to bypass the ASLR protection mechanism by leveraging read access to a kernel pointer in an IOKit object.
[APPLE-SA-2014-06-30-2]
[http://support.apple.com/kb/HT6296]
[1030505]
Intel Compute in Apple OS X before 10.9.4 does not properly restrict an unspecified OpenCL API call, which allows attackers to execute arbitrary code via a crafted application.
[APPLE-SA-2014-06-30-2]
[http://support.apple.com/kb/HT6296]
[1030505]
[https://code.google.com/p/google-security-research/issues/detail?id=19]
Array index error in IOAcceleratorFamily in Apple OS X before 10.9.4 allows attackers to execute arbitrary code via a crafted application.
Per: http://cwe.mitre.org/data/definitions/129.html
"CWE-129: Improper Validation of Array Index"
[APPLE-SA-2014-06-30-2]
[http://support.apple.com/kb/HT6296]
[1030505]
[https://code.google.com/p/google-security-research/issues/detail?id=17]
IOGraphicsFamily in Apple OS X before 10.9.4 allows local users to bypass the ASLR protection mechanism by leveraging read access to a kernel pointer in an IOKit object.
[APPLE-SA-2014-06-30-2]
[http://support.apple.com/kb/HT6296]
[1030505]
Graphics Drivers in Apple OS X before 10.9.4 allows attackers to gain privileges or cause a denial of service (NULL pointer dereference and system crash) via a 32-bit executable file for a crafted application.
Per: http://cwe.mitre.org/data/definitions/476.html
"CWE-476: NULL Pointer Dereference"
[APPLE-SA-2014-06-30-2]
[http://support.apple.com/kb/HT6296]
[1030505]
[https://code.google.com/p/google-security-research/issues/detail?id=20]
The Security - Keychain component in Apple OS X before 10.9.4 does not properly implement keystroke observers, which allows physically proximate attackers to bypass the screen-lock protection mechanism, and enter characters into an arbitrary window under the lock window, via keyboard input.
[APPLE-SA-2014-06-30-2]
[http://support.apple.com/kb/HT6296]
[1030505]
Thunderbolt in Apple OS X before 10.9.4 does not properly restrict IOThunderBoltController API calls, which allows attackers to execute arbitrary code or cause a denial of service (out-of-bounds memory access and application crash) via a crafted call.
[APPLE-SA-2014-06-30-2]
[http://support.apple.com/kb/HT6296]
[1030505]
WebKit, as used in Apple iOS before 7.1.2, Apple Safari before 6.1.5 and 7.x before 7.0.5, and Apple TV before 6.1.2, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-06-30-1, APPLE-SA-2014-06-30-3, and APPLE-SA-2014-06-30-4.
[APPLE-SA-2014-06-30-1]
[APPLE-SA-2014-06-30-3]
[APPLE-SA-2014-06-30-4]
[1030495]
[https://support.apple.com/kb/HT6537]
Apple TV before 6.1.2 allows remote authenticated users to bypass an intended password requirement for iTunes Store purchase transactions via unspecified vectors.
[APPLE-SA-2014-06-30-4]
[1030503]
WebKit, as used in Apple Safari before 6.1.6 and 7.x before 7.0.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in HT6367.
[APPLE-SA-2014-09-17-1]
[APPLE-SA-2014-09-17-2]
[60705]
[61318]
[http://support.apple.com/kb/HT6367]
[http://support.apple.com/kb/HT6441]
[http://support.apple.com/kb/HT6442]
[69223]
[1030731]
[apple-safari-cve20141384-code-exec(95267)]
[GLSA-201601-02]
[https://support.apple.com/kb/HT6537]
WebKit, as used in Apple Safari before 6.1.6 and 7.x before 7.0.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in HT6367.
[APPLE-SA-2014-09-17-1]
[APPLE-SA-2014-09-17-2]
[60705]
[61318]
[http://support.apple.com/kb/HT6367]
[http://support.apple.com/kb/HT6441]
[http://support.apple.com/kb/HT6442]
[69223]
[1030731]
[apple-safari-cve20141385-code-exec(95268)]
[GLSA-201601-02]
[https://support.apple.com/kb/HT6537]
WebKit, as used in Apple Safari before 6.1.6 and 7.x before 7.0.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in HT6367.
[60705]
[http://support.apple.com/kb/HT6367]
[69223]
[1030731]
[apple-safari-cve20141386-code-exec(95269)]
[GLSA-201601-02]
[https://support.apple.com/kb/HT6537]
WebKit, as used in Apple Safari before 6.1.6 and 7.x before 7.0.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in HT6367.
[APPLE-SA-2014-09-17-1]
[APPLE-SA-2014-09-17-2]
[60705]
[61318]
[http://support.apple.com/kb/HT6367]
[http://support.apple.com/kb/HT6441]
[http://support.apple.com/kb/HT6442]
[69223]
[1030731]
[apple-safari-cve20141387-code-exec(95270)]
[GLSA-201601-02]
[https://support.apple.com/kb/HT6537]
WebKit, as used in Apple Safari before 6.1.6 and 7.x before 7.0.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in HT6367.
[APPLE-SA-2014-09-17-1]
[APPLE-SA-2014-09-17-2]
[60705]
[61318]
[http://support.apple.com/kb/HT6367]
[http://support.apple.com/kb/HT6441]
[http://support.apple.com/kb/HT6442]
[69223]
[1030731]
[apple-safari-cve20141388-code-exec(95271)]
[GLSA-201601-02]
[https://support.apple.com/kb/HT6537]
WebKit, as used in Apple Safari before 6.1.6 and 7.x before 7.0.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in HT6367.
[APPLE-SA-2014-09-17-1]
[APPLE-SA-2014-09-17-2]
[60705]
[61318]
[http://support.apple.com/kb/HT6367]
[http://support.apple.com/kb/HT6441]
[http://support.apple.com/kb/HT6442]
[69223]
[1030731]
[apple-safari-cve20141389-code-exec(95272)]
[GLSA-201601-02]
[https://support.apple.com/kb/HT6537]
WebKit, as used in Apple Safari before 6.1.6 and 7.x before 7.0.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in HT6367.
[60705]
[http://support.apple.com/kb/HT6367]
[69223]
[1030731]
[apple-safari-cve20141390-code-exec(95273)]
[GLSA-201601-02]
[https://support.apple.com/kb/HT6537]
QT Media Foundation in Apple OS X before 10.9.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file with RLE encoding.
[http://support.apple.com/kb/HT6443]
[69907]
[1030868]
[macosx-cve20141391-code-exec(96049)]
[https://support.apple.com/kb/HT6493]
The entity wrapper access API in the Entity API module 7.x-1.x before 7.x-1.3 for Drupal might allow remote authenticated users to bypass intended access restrictions on comment, user and node statistics properties via unspecified vectors.
[FEDORA-2014-0508]
[FEDORA-2014-0509]
[[oss-security] 20140109 Re: CVE Request: drupal7-entity: multiple access bypass vulnerabilities]
[64729]
[https://bugzilla.redhat.com/show_bug.cgi?id=1050802]
[drupal-entityapi-cve20141398-security-bypass(90215)]
[https://www.drupal.org/node/2169595]
The entity wrapper access API in the Entity API module 7.x-1.x before 7.x-1.3 for Drupal might allow remote authenticated users to bypass intended access restrictions on referenced entities via unspecified vectors.
[FEDORA-2014-0508]
[FEDORA-2014-0509]
[[oss-security] 20140109 Re: CVE Request: drupal7-entity: multiple access bypass vulnerabilities]
[64729]
[https://bugzilla.redhat.com/show_bug.cgi?id=1050802]
[drupal-entityapi-cve20141399-security-bypass(90216)]
[https://www.drupal.org/node/2169595]
The entity_access API in the Entity API module 7.x-1.x before 7.x-1.3 for Drupal might allow remote authenticated users to bypass intended access restrictions and read unpublished comments via unspecified vectors.
[FEDORA-2014-0508]
[FEDORA-2014-0509]
[[oss-security] 20140109 Re: CVE Request: drupal7-entity: multiple access bypass vulnerabilities]
[64729]
[https://bugzilla.redhat.com/show_bug.cgi?id=1050802]
[drupal-entity-cve20141400-sec-bypass(90396)]
[https://www.drupal.org/node/2169595]
Multiple SQL injection vulnerabilities in AuraCMS 2.3 and earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) search parameter to mod/content/content.php or (2) CLIENT_IP, (3) X_FORWARDED_FOR, (4) X_FORWARDED, (5) FORWARDED_FOR, or (6) FORWARDED HTTP header to index.php.
[http://packetstormsecurity.com/files/125079]
[31520]
[20140205 Multiple SQL Injection Vulnerabilities in AuraCMS]
[auracms-cve20141401-sql-injection(90965)]
[https://github.com/auracms/AuraCMS/commit/4fe9d0d31a32df392f4d6ced8e5c25ed4af19ade]
[https://github.com/auracms/AuraCMS/commit/790f66ffbc4f23a6e13636fc79d0aa1a7d81e747]
[https://www.htbridge.com/advisory/HTB23196]
The default configuration for bccache.FileSystemBytecodeCache in Jinja2 before 2.7.2 does not properly create temporary files, which allows local users to gain privileges via a crafted .cache file with a name starting with __jinja2_ in /tmp.
[http://advisories.mageia.org/MGASA-2014-0028.html]
[http://jinja.pocoo.org/docs/changelog/]
[[oss-security] 20140110 CVE Request: python-jinja2: arbitrary code execution vulnerability]
[[oss-security] 20140110 Re: CVE Request: python-jinja2: arbitrary code execution vulnerability]
[RHSA-2014:0747]
[RHSA-2014:0748]
[58783]
[GLSA-201408-13]
[MDVSA-2014:096]
[https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=734747]
[https://bugzilla.redhat.com/show_bug.cgi?id=1051421]
[[El-errata] 20140611 Oracle Linux Security Advisory ELSA-2014-0747]
Cross-site scripting (XSS) vulnerability in name.html in easyXDM before 2.4.19 allows remote attackers to inject arbitrary web script or HTML via the location.hash value.
[http://blog.kotowicz.net/2014/01/xssing-with-shakespeare-name-calling.html]
[20140131 [CVE-2014-1403] DOM XSS in EasyXDM 2.4.18]
[65291]
[easyxdm-cve20141403-xss(90876)]
[https://github.com/oyvindkinsey/easyXDM/commit/a3194d32c25a0d27a10a47304eb9c9be93ffbf13#diff-6489956f1e1f52236929b4d33cbeb2db]
[https://github.com/oyvindkinsey/easyXDM/releases/tag/2.4.19]
Multiple open redirect vulnerabilities on the Conceptronic C54APM access point with runtime code 1.26 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via (1) the submit-url parameter in a Refresh action to goform/formWlSiteSurvey or (2) the wlan-url parameter to goform/formWlanSetup.
[http://antoniovazquezblanco.github.io/docs/advisories/Advisory_C54APM_Multiple.pdf]
CRLF injection vulnerability in goform/formWlSiteSurvey on the Conceptronic C54APM access point with runtime code 1.26 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the submit-url parameter in a Refresh action.
[http://antoniovazquezblanco.github.io/docs/advisories/Advisory_C54APM_Multiple.pdf]
Multiple cross-site scripting (XSS) vulnerabilities on the Conceptronic C54APM access point with runtime code 1.26 allow remote attackers to inject arbitrary web script or HTML via (1) the submit-url parameter in a Refresh action to goform/formWlSiteSurvey or (2) the wlan-url parameter to goform/formWlanSetup.
[http://antoniovazquezblanco.github.io/docs/advisories/Advisory_C54APM_Multiple.pdf]
The Conceptronic C54APM access point with runtime code 1.26 has a default password of admin for the admin account, which makes it easier for remote attackers to obtain access via an HTTP request, as demonstrated by stored XSS attacks.
[http://antoniovazquezblanco.github.io/docs/advisories/Advisory_C54APM_Multiple.pdf]
[http://download.conceptronic.net/manuals/C04-058_C54APM_v2.0_Quick_Guide_ML.pdf]
Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly include the (1) Vary: Cookie or (2) Cache-Control header in responses, which allows remote attackers to obtain sensitive information or poison the cache via a request from certain browsers.
[openSUSE-SU-2014:1132]
[61281]
[USN-2212-1]
[DSA-2934]
[[oss-security] 20140514 CVE Reuest: Django: Malformed URLs from user input incorrectly validated]
[[oss-security] 20140514 Re: CVE Reuest: Django: Malformed URLs from user input incorrectly validated]
[https://www.djangoproject.com/weblog/2014/may/14/security-releases-issued/]
Race condition in the power policy functions in policy-funcs in acpi-support before 0.142 allows local users to gain privileges via unspecified vectors.
[60319]
[DSA-2984]
[USN-2297-1]
[https://bugs.launchpad.net/ubuntu/%2Bsource/acpi-support/%2Bbug/1340812]
mountall 1.54, as used in Ubuntu 14.10, does not properly handle the umask when using the mount utility, which allows local users to bypass intended access restrictions via unspecified vectors.
[USN-2411-1]
apparmor_parser in the apparmor package before 2.8.95~2430-0ubuntu5.1 in Ubuntu 14.04 allows attackers to bypass AppArmor policies via unspecified vectors, related to a "miscompilation flaw."
[USN-2413-1]
cmanager 0.32 does not properly enforce nesting when modifying cgroup properties, which allows local users to set cgroup values for all cgroups via unspecified vectors.
[USN-2451-1]
A vulnerability in maasserver.api.get_file_by_name of Ubuntu MAAS allows unauthenticated network clients to download any file. This issue affects: Ubuntu MAAS versions prior to 1.9.2.
[https://launchpad.net/maas/+milestone/1.9.2]
A vulnerability in the REST API of Ubuntu MAAS allows an attacker to cause a logged-in user to execute commands via cross-site scripting. This issue affects MAAS versions prior to 1.9.2.
[https://launchpad.net/maas/+milestone/1.9.2]
A vulnerability in generate_filestorage_key of Ubuntu MAAS allows an attacker to brute-force filenames. This issue affects Ubuntu MAAS versions prior to 1.9.2.
[https://launchpad.net/maas/+milestone/1.9.2]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2014. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2014. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2014. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2014. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2014. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2014. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2014. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2014. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2014. Notes: none.
The restore_fpu_checking function in arch/x86/include/asm/fpu-internal.h in the Linux kernel before 3.12.8 on the AMD K7 and K8 platforms does not clear pending exceptions before proceeding to an EMMS instruction, which allows local users to cause a denial of service (task kill) or possibly gain privileges via a crafted application.
[http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=26bef1318adc1b3a530ecc807ef99346db2aa8b0]
[FEDORA-2014-1072]
[FEDORA-2014-1062]
[http://www.halfdog.net/Security/2013/Vm86SyscallTaskSwitchKernelPanic/]
[http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.12.8]
[MDVSA-2014:038]
[[oss-security] 20140114 Re: Linux kernel: missing CPU-state sanitation during task-switch causes DOS / privilege escalation]
[64781]
[1029592]
[USN-2113-1]
[USN-2117-1]
[USN-2133-1]
[USN-2134-1]
[USN-2135-1]
[USN-2136-1]
[USN-2138-1]
[USN-2139-1]
[USN-2141-1]
[https://bugzilla.redhat.com/show_bug.cgi?id=1052914]
[https://github.com/torvalds/linux/commit/26bef1318adc1b3a530ecc807ef99346db2aa8b0]
[[linux-kernel] 20140110 Re: Sanitize CPU-state when switching tasks (was sanitize CPU-state when switching from virtual-8086 mode to other task)]
The libxml_disable_entity_loader function in runtime/ext/ext_simplexml.cpp in HipHop Virtual Machine for PHP (HHVM) before 2.4.0 and 2.3.x before 2.3.3 does not properly disable a certain libxml handler, which allows remote attackers to conduct XML External Entity (XXE) attacks.
CWE-611: Improper Restriction of XML External Entity Reference ('XXE')
[http://www.hhvm.com/blog/3287/hhvm-2-4-0]
[hhvm-cve20141439-info-disc(90979)]
[https://github.com/facebook/hhvm/commit/95f96e7287effe2fcdfb9a5338d1a7e4f55b083b]
Core FTP Server 1.2 before build 515 allows remote attackers to cause a denial of service (reachable assertion and crash) via an AUTH SSL command with malformed data, as demonstrated by pressing the enter key twice.
[http://coreftp.com/forums/viewtopic.php?t=2985707]
[http://packetstormsecurity.com/files/125073/Core-FTP-Server-1.2-DoS-Traversal-Disclosure.html]
[20140205 Core FTP Server Vulnerabilities]
Directory traversal vulnerability in Core FTP Server 1.2 before build 515 allows remote authenticated users to determine the existence of arbitrary files via a /../ sequence in an XCRC command.
[http://coreftp.com/forums/viewtopic.php?t=2985707]
[http://packetstormsecurity.com/files/125073/Core-FTP-Server-1.2-DoS-Traversal-Disclosure.html]
[20140205 Core FTP Server Vulnerabilities]
Core FTP Server 1.2 before build 515 allows remote authenticated users to obtain sensitive information (password for the previous user) via a USER command with a specific length, possibly related to an out-of-bounds read.
[http://coreftp.com/forums/viewtopic.php?t=2985707]
[http://packetstormsecurity.com/files/125073/Core-FTP-Server-1.2-DoS-Traversal-Disclosure.html]
[20140205 Core FTP Server Vulnerabilities]
The fst_get_iface function in drivers/net/wan/farsync.c in the Linux kernel before 3.11.7 does not properly initialize a certain data structure, which allows local users to obtain sensitive information from kernel memory by leveraging the CAP_NET_ADMIN capability for an SIOCWANDEV ioctl call.
[http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=96b340406724d87e4621284ebac5e059d67b2194]
[http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.11.7]
[[oss-security] 20140115 Re: CVE request: assorted kernel infoleak security fixes]
[64952]
[USN-2128-1]
[USN-2129-1]
[https://bugzilla.redhat.com/show_bug.cgi?id=1053610]
[linux-kernel-cve20141444-info-disc(90443)]
[https://github.com/torvalds/linux/commit/96b340406724d87e4621284ebac5e059d67b2194]
The wanxl_ioctl function in drivers/net/wan/wanxl.c in the Linux kernel before 3.11.7 does not properly initialize a certain data structure, which allows local users to obtain sensitive information from kernel memory via an ioctl call.
[http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=2b13d06c9584b4eb773f1e80bbaedab9a1c344e1]
[http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.11.7]
[[oss-security] 20140115 Re: CVE request: assorted kernel infoleak security fixes]
[64953]
[USN-2128-1]
[USN-2129-1]
[https://bugzilla.redhat.com/show_bug.cgi?id=1053613]
[linux-kernel-cve20141445-info-disc(90444)]
[https://github.com/torvalds/linux/commit/2b13d06c9584b4eb773f1e80bbaedab9a1c344e1]
The yam_ioctl function in drivers/net/hamradio/yam.c in the Linux kernel before 3.12.8 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel memory by leveraging the CAP_NET_ADMIN capability for an SIOCYAMGCFG ioctl call.
[http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=8e3fbf870481eb53b2d3a322d1fc395ad8b367ed]
[FEDORA-2014-1072]
[FEDORA-2014-1062]
[http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.12.8]
[MDVSA-2014:038]
[[oss-security] 20140115 Re: CVE request: assorted kernel infoleak security fixes]
[64954]
[USN-2113-1]
[USN-2117-1]
[USN-2128-1]
[USN-2129-1]
[USN-2133-1]
[USN-2134-1]
[USN-2135-1]
[USN-2136-1]
[USN-2138-1]
[USN-2139-1]
[USN-2141-1]
[https://bugzilla.redhat.com/show_bug.cgi?id=1053620]
[linux-kernel-cve20141446-info-disc(90445)]
[https://github.com/torvalds/linux/commit/8e3fbf870481eb53b2d3a322d1fc395ad8b367ed]
Race condition in the virNetServerClientStartKeepAlive function in libvirt before 1.2.1 allows remote attackers to cause a denial of service (libvirtd crash) by closing a connection before a keepalive response is sent.
[http://libvirt.org/news.html]
[openSUSE-SU-2014:0268]
[openSUSE-SU-2014:0270]
[RHSA-2014:0103]
[GLSA-201412-04]
[DSA-2846]
[1029695]
[USN-2093-1]
[https://bugzilla.redhat.com/show_bug.cgi?id=1047577]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-1447. Reason: This candidate is a reservation duplicate of CVE-2014-1447. Only one candidate was needed for the disclosure in question. Notes: All CVE users should reference CVE-2014-1447 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
The Maxthon Cloud Browser application before 4.1.6.2000 for Android allows remote attackers to spoof the address bar via crafted JavaScript code that uses the history API.
[http://browser-shredders.blogspot.com/2014/01/cve-2014-1449-maxthon-cloud-browser-for.html]
[http://www.maxthon.com/android/changelog/]
Stack-based buffer overflow in lib/snmpagent.c in bsnmpd, as used in FreeBSD 8.3 through 10.0, allows remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via a crafted GETBULK PDU request.
[http://svnweb.freebsd.org/base?view=revision&revision=260636]
[FreeBSD-SA-14:01]
[64967]
[1029616]
The NFS server (nfsserver) in FreeBSD 8.3 through 10.0 does not acquire locks in the proper order when converting a directory file handle to a vnode, which allows remote authenticated users to cause a denial of service (deadlock) via vectors involving a thread that uses the correct locking order.
[DSA-2952]
[FreeBSD-SA-14:05]
[66726]
[1030041]
SQL injection vulnerability in the password reset functionality in Pearson eSIS Enterprise Student Information System, possibly 3.3.0.13 and earlier, allows remote attackers to execute arbitrary SQL commands via the new password.
[20140406 Pearson eSIS Enterprise Student Information System SQL Injection]
[66689]
Cross-site scripting (XSS) vulnerability in the login page in Open Web Analytics (OWA) before 1.5.6 allows remote attackers to inject arbitrary web script or HTML via the owa_user_id parameter to index.php.
[http://www.openwebanalytics.com/?p=384]
[http://www.secureworks.com/cyber-threat-intelligence/advisories/SWRX-2014-004]
[65571]
[owa-cve20141456-xss(91124)]
Open Web Analytics (OWA) before 1.5.6 improperly generates random nonce values, which makes it easier for remote attackers to bypass a CSRF protection mechanism by leveraging knowledge of an OWA user name.
[http://www.openwebanalytics.com/?p=384]
[65573]
[owa-cve20141457-csrf(91125)]
[https://www.secureworks.com/research/swrx-2014-006]
Cross-site scripting (XSS) vulnerability in the web administration interface in FortiGuard FortiWeb 5.0.3 and earlier allows remote authenticated administrators to inject arbitrary web script or HTML via unspecified vectors.
[http://www.fortiguard.com/advisory/FG-IR-14-001/]
[fortiweb-cve20141458-xss(90978)]
SQL injection vulnerability in dg-admin/index.php in doorGets CMS 5.2 and earlier allows remote authenticated administrators to execute arbitrary SQL commands via the _position_down_id parameter. NOTE: this can be leveraged using CSRF to allow remote attackers to execute arbitrary SQL commands.
[http://packetstormsecurity.com/files/125078]
[31521]
[20140205 SQL Injection in doorGets CMS]
[65439]
[doorgets-cve20141459-sql-injection(90967)]
[https://github.com/doorgets/doorGets/commit/6b81541fc1e5dd1c70614585c1a04d04ccdb3b19]
[https://www.htbridge.com/advisory/HTB23197]
SQL injection vulnerability in CSP MySQL User Manager 2.3 allows remote attackers to execute arbitrary SQL commands via the login field of the login page.
[http://packetstormsecurity.com/files/124724/cspmysql-sql.txt]
[64731]
[cpsmysql-login-sql-injection(90210)]
BlackBerry Enterprise Service 10 before 10.2.1, Universal Device Service 6, Enterprise Server Express for Domino through 5.0.4, Enterprise Server Express for Exchange through 5.0.4, Enterprise Server for Domino through 5.0.4 MR6, Enterprise Server for Exchange through 5.0.4 MR6, and Enterprise Server for GroupWise through 5.0.4 MR6 log cleartext credentials during exception handling, which might allow context-dependent attackers to obtain sensitive information by reading a log file.
[http://www.blackberry.com/btsc/KB35647]
BlackBerry Enterprise Server 5.x before 5.0.4 MR7 and Enterprise Service 10.x before 10.2.2 log cleartext credentials during exception handling, which allows local users to obtain sensitive information by reading the exception log file.
[60154]
[http://www.blackberry.com/btsc/KB36175]
[69211]
[blackberry-cve20141469-info-disc(95264)]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-2388. Reason: This candidate is a reservation duplicate of CVE-2014-2388. Notes: All CVE users should reference CVE-2014-2388 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
SQL injection vulnerability in the StateGetStatesByType function in Kernel/System/State.pm in Open Ticket Request System (OTRS) 3.1.x before 3.1.19, 3.2.x before 3.2.14, and 3.3.x before 3.3.4 allows remote attackers to execute arbitrary SQL commands via vectors related to a ticket search URL.
[DSA-2867]
[[oss-security] 20140129 Re: CVE Request: otrs: CSRF issue in customer web interface]
[65241]
[https://github.com/OTRS/otrs/commit/0680603a07b8dc37c2ddca6ff14e0236babefc82]
[https://github.com/OTRS/otrs/commit/2997b36a7c84e933c4b025930cabe93efc4d261d]
[https://github.com/OTRS/otrs/commit/c4ec9205bde9c49770ddad94c1a980c006164949]
[https://www.otrs.com/release-notes-otrs-help-desk-3-3-4]
[https://www.otrs.com/security-advisory-2014-02-sql-injection-issue]
Multiple cross-site scripting (XSS) vulnerabilities in the Enterprise Manager in McAfee Vulnerability Manager (MVM) 7.5.5 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
[64795]
[1029591]
[mcafee-vm-unspec-xss(90244)]
[https://kc.mcafee.com/corporate/index?page=content&id=SB10061]
Multiple cross-site request forgery (CSRF) vulnerabilities in the Enterprise Manager in McAfee Vulnerability Manager (MVM) 7.5.5 and earlier allow remote attackers to hijack the authentication of users for requests that modify HTML via unspecified vectors related to the "response web page."
[64795]
[1029591]
[mcafee-vm-unspec-csrf(90245)]
[https://kc.mcafee.com/corporate/index?page=content&id=SB10061]
Algorithmic complexity vulnerability in Email::Address::List before 0.02, as used in RT 4.2.0 through 4.2.2, allows remote attackers to cause a denial of service (CPU consumption) via a string without an address.
[http://blog.bestpractical.com/2014/01/security-vulnerability-in-rt-42.html]
[[rt-announce] 20140612 RT 4.2.5 released]
[https://metacpan.org/changes/release/ALEXMV/Email-Address-List-0.02]
The OpenID module in Drupal 6.x before 6.30 and 7.x before 7.26 allows remote OpenID users to authenticate as other users via unspecified vectors.
[DSA-2847]
[DSA-2851]
[MDVSA-2014:031]
[64973]
[https://drupal.org/SA-CORE-2014-001]
The Taxonomy module in Drupal 7.x before 7.26, when upgraded from an earlier version of Drupal, does not properly restrict access to unpublished content, which allows remote authenticated users to obtain sensitive information via a listing page.
[DSA-2847]
[MDVSA-2014:031]
[64973]
[https://drupal.org/SA-CORE-2014-001]
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
[http://download.novell.com/Download?buildid=VYQsgaFpQ2k]
[http://download.novell.com/Download?buildid=Y2fux-JW1Qc]
[FEDORA-2014-2041]
[FEDORA-2014-2083]
[openSUSE-SU-2014:0212]
[openSUSE-SU-2014:0213]
[SUSE-SU-2014:0248]
[openSUSE-SU-2014:0419]
[102864]
[RHSA-2014:0132]
[RHSA-2014:0133]
[56761]
[56763]
[56767]
[56787]
[56858]
[56888]
[DSA-2858]
[http://www.mozilla.org/security/announce/2014/mfsa2014-01.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[65317]
[1029717]
[1029720]
[1029721]
[USN-2102-1]
[USN-2102-2]
[USN-2119-1]
[https://8pecxstudios.com/?page_id=44080]
[https://bugzilla.mozilla.org/show_bug.cgi?id=921470]
[https://bugzilla.mozilla.org/show_bug.cgi?id=925896]
[https://bugzilla.mozilla.org/show_bug.cgi?id=936808]
[https://bugzilla.mozilla.org/show_bug.cgi?id=937132]
[https://bugzilla.mozilla.org/show_bug.cgi?id=937697]
[https://bugzilla.mozilla.org/show_bug.cgi?id=945334]
[https://bugzilla.mozilla.org/show_bug.cgi?id=945939]
[https://bugzilla.mozilla.org/show_bug.cgi?id=950000]
[https://bugzilla.mozilla.org/show_bug.cgi?id=950438]
[https://bugzilla.mozilla.org/show_bug.cgi?id=951366]
[https://bugzilla.mozilla.org/show_bug.cgi?id=953114]
[firefox-cve20141477-code-exec(90899)]
[GLSA-201504-01]
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 27.0 and SeaMonkey before 2.24 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to the MPostWriteBarrier class in js/src/jit/MIR.h and stack alignment in js/src/jit/AsmJS.cpp in OdinMonkey, and unknown other vectors.
[openSUSE-SU-2014:0212]
[openSUSE-SU-2014:0213]
[openSUSE-SU-2014:0419]
[102865]
[56767]
[56787]
[56888]
[56922]
[http://www.mozilla.org/security/announce/2014/mfsa2014-01.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[65324]
[1029717]
[1029720]
[1029721]
[USN-2102-1]
[USN-2102-2]
[https://8pecxstudios.com/?page_id=44080]
[https://bugzilla.mozilla.org/show_bug.cgi?id=867597]
[https://bugzilla.mozilla.org/show_bug.cgi?id=911707]
[https://bugzilla.mozilla.org/show_bug.cgi?id=911845]
[https://bugzilla.mozilla.org/show_bug.cgi?id=916635]
[https://bugzilla.mozilla.org/show_bug.cgi?id=922603]
[https://bugzilla.mozilla.org/show_bug.cgi?id=924348]
[https://bugzilla.mozilla.org/show_bug.cgi?id=925308]
[https://bugzilla.mozilla.org/show_bug.cgi?id=932162]
[https://bugzilla.mozilla.org/show_bug.cgi?id=938431]
[https://bugzilla.mozilla.org/show_bug.cgi?id=939472]
[https://bugzilla.mozilla.org/show_bug.cgi?id=942152]
[https://bugzilla.mozilla.org/show_bug.cgi?id=942940]
[https://bugzilla.mozilla.org/show_bug.cgi?id=944278]
[https://bugzilla.mozilla.org/show_bug.cgi?id=944321]
[https://bugzilla.mozilla.org/show_bug.cgi?id=944851]
[https://bugzilla.mozilla.org/show_bug.cgi?id=945585]
[https://bugzilla.mozilla.org/show_bug.cgi?id=946733]
[https://bugzilla.mozilla.org/show_bug.cgi?id=950452]
[https://bugzilla.mozilla.org/show_bug.cgi?id=953373]
[firefox-cve20141478-code-exec(90900)]
[GLSA-201504-01]
The System Only Wrapper (SOW) implementation in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 does not prevent certain cloning operations, which allows remote attackers to bypass intended restrictions on XUL content via vectors involving XBL content scopes.
[http://download.novell.com/Download?buildid=VYQsgaFpQ2k]
[http://download.novell.com/Download?buildid=Y2fux-JW1Qc]
[FEDORA-2014-2041]
[FEDORA-2014-2083]
[openSUSE-SU-2014:0212]
[openSUSE-SU-2014:0213]
[SUSE-SU-2014:0248]
[openSUSE-SU-2014:0419]
[102866]
[RHSA-2014:0132]
[RHSA-2014:0133]
[56761]
[56763]
[56767]
[56787]
[56858]
[56888]
[56922]
[DSA-2858]
[http://www.mozilla.org/security/announce/2014/mfsa2014-02.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[65320]
[1029717]
[1029720]
[1029721]
[USN-2102-1]
[USN-2102-2]
[USN-2119-1]
[https://8pecxstudios.com/?page_id=44080]
[https://bugzilla.mozilla.org/show_bug.cgi?id=911864]
[firefox-cve20141479-sec-bypass(90898)]
[GLSA-201504-01]
The file-download implementation in Mozilla Firefox before 27.0 and SeaMonkey before 2.24 does not properly restrict the timing of button selections, which allows remote attackers to conduct clickjacking attacks, and trigger unintended launching of a downloaded file, via a crafted web site.
[openSUSE-SU-2014:0212]
[SUSE-SU-2014:0248]
[openSUSE-SU-2014:0419]
[102867]
[56888]
[http://www.mozilla.org/security/announce/2014/mfsa2014-03.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[65331]
[1029717]
[1029720]
[USN-2102-1]
[USN-2102-2]
[https://bugzilla.mozilla.org/show_bug.cgi?id=916726]
[firefox-cve20141480-spoofing(90897)]
[GLSA-201504-01]
Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 allow remote attackers to bypass intended restrictions on window objects by leveraging inconsistency in native getter methods across different JavaScript engines.
[http://download.novell.com/Download?buildid=VYQsgaFpQ2k]
[http://download.novell.com/Download?buildid=Y2fux-JW1Qc]
[FEDORA-2014-2041]
[FEDORA-2014-2083]
[openSUSE-SU-2014:0212]
[openSUSE-SU-2014:0213]
[SUSE-SU-2014:0248]
[openSUSE-SU-2014:0419]
[102863]
[RHSA-2014:0132]
[RHSA-2014:0133]
[56761]
[56763]
[56767]
[56787]
[56858]
[56888]
[56922]
[DSA-2858]
[http://www.mozilla.org/security/announce/2014/mfsa2014-13.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[65326]
[1029717]
[1029720]
[1029721]
[USN-2102-1]
[USN-2102-2]
[USN-2119-1]
[https://8pecxstudios.com/?page_id=44080]
[https://bugzilla.mozilla.org/show_bug.cgi?id=936056]
[firefox-cve20141481-sec-bypass(90883)]
[GLSA-201504-01]
RasterImage.cpp in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 does not prevent access to discarded data, which allows remote attackers to execute arbitrary code or cause a denial of service (incorrect write operations) via crafted image data, as demonstrated by Goo Create.
[http://download.novell.com/Download?buildid=VYQsgaFpQ2k]
[http://download.novell.com/Download?buildid=Y2fux-JW1Qc]
[FEDORA-2014-2041]
[FEDORA-2014-2083]
[openSUSE-SU-2014:0212]
[openSUSE-SU-2014:0213]
[SUSE-SU-2014:0248]
[openSUSE-SU-2014:0419]
[102868]
[RHSA-2014:0132]
[RHSA-2014:0133]
[56761]
[56763]
[56767]
[56787]
[56858]
[56888]
[56922]
[DSA-2858]
[http://www.mozilla.org/security/announce/2014/mfsa2014-04.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[65328]
[1029717]
[1029720]
[1029721]
[USN-2102-1]
[USN-2102-2]
[USN-2119-1]
[https://8pecxstudios.com/?page_id=44080]
[https://bugzilla.mozilla.org/show_bug.cgi?id=943803]
[firefox-cve20141482-code-exec(90894)]
[GLSA-201504-01]
Mozilla Firefox before 27.0 and SeaMonkey before 2.24 allow remote attackers to bypass the Same Origin Policy and obtain sensitive information by using an IFRAME element in conjunction with certain timing measurements involving the document.caretPositionFromPoint and document.elementFromPoint functions.
[openSUSE-SU-2014:0212]
[SUSE-SU-2014:0248]
[openSUSE-SU-2014:0419]
[102869]
[56767]
[56787]
[56888]
[http://www.mozilla.org/security/announce/2014/mfsa2014-05.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[65316]
[1029717]
[1029720]
[USN-2102-1]
[USN-2102-2]
[https://8pecxstudios.com/?page_id=44080]
[https://bugzilla.mozilla.org/show_bug.cgi?id=950427]
[firefox-cve20141483-info-disc(90893)]
[GLSA-201504-01]
Mozilla Firefox before 27.0 on Android 4.2 and earlier creates system-log entries containing profile paths, which allows attackers to obtain sensitive information via a crafted application.
[20140326 Firefox for Android Profile Directory Derandomization and Data Exfiltration (CVE-2014-1484, CVE-2014-1506, CVE-2014-1515, CVE-2014-1516)]
[openSUSE-SU-2014:0212]
[SUSE-SU-2014:0248]
[102870]
[http://www.mozilla.org/security/announce/2014/mfsa2014-06.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[65323]
[1029719]
[https://bugzilla.mozilla.org/show_bug.cgi?id=953993]
[firefox-android-cve20141484-info-disc(90892)]
The Content Security Policy (CSP) implementation in Mozilla Firefox before 27.0 and SeaMonkey before 2.24 operates on XSLT stylesheets according to style-src directives instead of script-src directives, which might allow remote attackers to execute arbitrary XSLT code by leveraging insufficient style-src restrictions.
[openSUSE-SU-2014:0212]
[SUSE-SU-2014:0248]
[openSUSE-SU-2014:0419]
[102871]
[56767]
[56787]
[56888]
[http://www.mozilla.org/security/announce/2014/mfsa2014-07.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[65322]
[1029717]
[1029720]
[USN-2102-1]
[USN-2102-2]
[https://8pecxstudios.com/?page_id=44080]
[https://bugzilla.mozilla.org/show_bug.cgi?id=910139]
[firefox-xslt-cve20141485xss(90891)]
[GLSA-201504-01]
Use-after-free vulnerability in the imgRequestProxy function in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 allows remote attackers to execute arbitrary code via vectors involving unspecified Content-Type values for image data.
[http://download.novell.com/Download?buildid=VYQsgaFpQ2k]
[http://download.novell.com/Download?buildid=Y2fux-JW1Qc]
[FEDORA-2014-2041]
[FEDORA-2014-2083]
[openSUSE-SU-2014:0212]
[openSUSE-SU-2014:0213]
[SUSE-SU-2014:0248]
[openSUSE-SU-2014:0419]
[102872]
[RHSA-2014:0132]
[RHSA-2014:0133]
[56761]
[56763]
[56767]
[56787]
[56858]
[56888]
[56922]
[DSA-2858]
[http://www.mozilla.org/security/announce/2014/mfsa2014-08.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[65334]
[1029717]
[1029720]
[1029721]
[USN-2102-1]
[USN-2102-2]
[USN-2119-1]
[https://8pecxstudios.com/?page_id=44080]
[https://bugzilla.mozilla.org/show_bug.cgi?id=942164]
[firefox-cve20141486-code-exec(90890)]
[GLSA-201504-01]
The Web workers implementation in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 allows remote attackers to bypass the Same Origin Policy and obtain sensitive authentication information via vectors involving error messages.
[http://download.novell.com/Download?buildid=VYQsgaFpQ2k]
[http://download.novell.com/Download?buildid=Y2fux-JW1Qc]
[FEDORA-2014-2041]
[FEDORA-2014-2083]
[openSUSE-SU-2014:0212]
[openSUSE-SU-2014:0213]
[SUSE-SU-2014:0248]
[openSUSE-SU-2014:0419]
[102873]
[RHSA-2014:0132]
[RHSA-2014:0133]
[56761]
[56763]
[56767]
[56787]
[56858]
[56888]
[56922]
[DSA-2858]
[http://www.mozilla.org/security/announce/2014/mfsa2014-09.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[65330]
[1029717]
[1029720]
[1029721]
[USN-2102-1]
[USN-2102-2]
[USN-2119-1]
[https://8pecxstudios.com/?page_id=44080]
[https://bugzilla.mozilla.org/show_bug.cgi?id=947592]
[mozilla-cve20141487-info-disc(90889)]
[GLSA-201504-01]
The Web workers implementation in Mozilla Firefox before 27.0 and SeaMonkey before 2.24 allows remote attackers to execute arbitrary code via vectors involving termination of a worker process that has performed a cross-thread object-passing operation in conjunction with use of asm.js.
[openSUSE-SU-2014:0212]
[SUSE-SU-2014:0248]
[openSUSE-SU-2014:0419]
[102875]
[56767]
[56787]
[56888]
[http://www.mozilla.org/security/announce/2014/mfsa2014-11.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[65321]
[1029717]
[1029720]
[USN-2102-1]
[USN-2102-2]
[https://8pecxstudios.com/?page_id=44080]
[https://bugzilla.mozilla.org/show_bug.cgi?id=950604]
[firefox-cve20141488-dos(90887)]
[GLSA-201504-01]
Mozilla Firefox before 27.0 does not properly restrict access to about:home buttons by script on other pages, which allows user-assisted remote attackers to cause a denial of service (session restore) via a crafted web site.
[openSUSE-SU-2014:0212]
[SUSE-SU-2014:0248]
[102874]
[56888]
[http://www.mozilla.org/security/announce/2014/mfsa2014-10.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[65329]
[1029717]
[USN-2102-1]
[USN-2102-2]
[https://bugzilla.mozilla.org/show_bug.cgi?id=959531]
[firefox-cve20141489-sec-bypass(90888)]
[GLSA-201504-01]
Race condition in libssl in Mozilla Network Security Services (NSS) before 3.15.4, as used in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, SeaMonkey before 2.24, and other products, allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via vectors involving a resumption handshake that triggers incorrect replacement of a session ticket.
[http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761]
[FEDORA-2014-2041]
[FEDORA-2014-2083]
[openSUSE-SU-2014:0212]
[openSUSE-SU-2014:0213]
[SUSE-SU-2014:0248]
[openSUSE-SU-2014:0419]
[102876]
[20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities]
[56767]
[56787]
[56858]
[56888]
[56922]
[DSA-2858]
[http://www.mozilla.org/security/announce/2014/mfsa2014-12.html]
[http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html]
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html]
[http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html]
[http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html]
[20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities]
[65335]
[1029717]
[1029720]
[1029721]
[USN-2102-1]
[USN-2102-2]
[USN-2119-1]
[http://www.vmware.com/security/advisories/VMSA-2014-0012.html]
[https://8pecxstudios.com/?page_id=44080]
[https://bugzilla.mozilla.org/show_bug.cgi?id=930857]
[https://bugzilla.mozilla.org/show_bug.cgi?id=930874]
[mozilla-nss-cve20141490-code-exec(90885)]
[GLSA-201504-01]
Mozilla Network Security Services (NSS) before 3.15.4, as used in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, SeaMonkey before 2.24, and other products, does not properly restrict public values in Diffie-Hellman key exchanges, which makes it easier for remote attackers to bypass cryptographic protection mechanisms in ticket handling by leveraging use of a certain value.
[http://hg.mozilla.org/projects/nss/rev/12c42006aed8]
[http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761]
[FEDORA-2014-2041]
[FEDORA-2014-2083]
[openSUSE-SU-2014:0212]
[openSUSE-SU-2014:0213]
[SUSE-SU-2014:0248]
[openSUSE-SU-2014:0419]
[20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities]
[56858]
[56888]
[56922]
[DSA-2858]
[DSA-2994]
[http://www.mozilla.org/security/announce/2014/mfsa2014-12.html]
[http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html]
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html]
[http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html]
[http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html]
[20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities]
[65332]
[1029717]
[1029720]
[1029721]
[USN-2102-1]
[USN-2102-2]
[USN-2119-1]
[http://www.vmware.com/security/advisories/VMSA-2014-0012.html]
[https://bugzilla.mozilla.org/show_bug.cgi?id=934545]
[firefox-nss-cve20141491-unspecified(90886)]
[GLSA-201504-01]
The cert_TestHostName function in lib/certdb/certdb.c in the certificate-checking implementation in Mozilla Network Security Services (NSS) before 3.16 accepts a wildcard character that is embedded in an internationalized domain name's U-label, which might allow man-in-the-middle attackers to spoof SSL servers via a crafted certificate.
[http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761]
[FEDORA-2014-5829]
[SUSE-SU-2014:0665]
[SUSE-SU-2014:0727]
[openSUSE-SU-2014:0599]
[openSUSE-SU-2014:0629]
[20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities]
[60621]
[60794]
[DSA-2994]
[http://www.mozilla.org/security/announce/2014/mfsa2014-45.html]
[http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html]
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html]
[http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html]
[http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html]
[20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities]
[66356]
[USN-2159-1]
[USN-2185-1]
[http://www.vmware.com/security/advisories/VMSA-2014-0012.html]
[https://bugzilla.mozilla.org/show_bug.cgi?id=903885]
[https://bugzilla.redhat.com/show_bug.cgi?id=1079851]
[https://developer.mozilla.org/en-US/docs/NSS/NSS_3.16_release_notes]
[https://hg.mozilla.org/projects/nss/rev/709d4e597979]
[GLSA-201504-01]
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
[SUSE-SU-2014:0418]
[openSUSE-SU-2014:0419]
[openSUSE-SU-2014:0448]
[openSUSE-SU-2014:0584]
[RHSA-2014:0310]
[RHSA-2014:0316]
[DSA-2881]
[DSA-2911]
[http://www.mozilla.org/security/announce/2014/mfsa2014-15.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[66412]
[USN-2151-1]
[https://bugzilla.mozilla.org/show_bug.cgi?id=896268]
[https://bugzilla.mozilla.org/show_bug.cgi?id=958867]
[https://bugzilla.mozilla.org/show_bug.cgi?id=960145]
[https://bugzilla.mozilla.org/show_bug.cgi?id=963974]
[https://bugzilla.mozilla.org/show_bug.cgi?id=965982]
[https://bugzilla.mozilla.org/show_bug.cgi?id=967341]
[https://bugzilla.mozilla.org/show_bug.cgi?id=977538]
[GLSA-201504-01]
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 28.0 and SeaMonkey before 2.25 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
[SUSE-SU-2014:0418]
[openSUSE-SU-2014:0419]
[openSUSE-SU-2014:0448]
[openSUSE-SU-2014:0584]
[http://www.mozilla.org/security/announce/2014/mfsa2014-15.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[https://bugzilla.mozilla.org/show_bug.cgi?id=627295]
[https://bugzilla.mozilla.org/show_bug.cgi?id=909586]
[https://bugzilla.mozilla.org/show_bug.cgi?id=927579]
[https://bugzilla.mozilla.org/show_bug.cgi?id=932496]
[https://bugzilla.mozilla.org/show_bug.cgi?id=933219]
[https://bugzilla.mozilla.org/show_bug.cgi?id=938615]
[https://bugzilla.mozilla.org/show_bug.cgi?id=938626]
[https://bugzilla.mozilla.org/show_bug.cgi?id=949843]
[https://bugzilla.mozilla.org/show_bug.cgi?id=964462]
[GLSA-201504-01]
Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 might allow local users to gain privileges by modifying the extracted Mar contents during an update.
[SUSE-SU-2014:0418]
[http://www.mozilla.org/security/announce/2014/mfsa2014-16.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[https://bugzilla.mozilla.org/show_bug.cgi?id=925747]
[GLSA-201504-01]
The mozilla::WaveReader::DecodeAudioData function in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to obtain sensitive information from process heap memory, cause a denial of service (out-of-bounds read and application crash), or possibly have unspecified other impact via a crafted WAV file.
[SUSE-SU-2014:0418]
[openSUSE-SU-2014:0419]
[openSUSE-SU-2014:0448]
[openSUSE-SU-2014:0584]
[RHSA-2014:0310]
[RHSA-2014:0316]
[DSA-2881]
[DSA-2911]
[http://www.mozilla.org/security/announce/2014/mfsa2014-17.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[66423]
[USN-2151-1]
[https://bugzilla.mozilla.org/show_bug.cgi?id=966311]
[GLSA-201504-01]
The crypto.generateCRMFRequest method in Mozilla Firefox before 28.0 and SeaMonkey before 2.25 does not properly validate a certain key type, which allows remote attackers to cause a denial of service (application crash) via vectors that trigger generation of a key that supports the Elliptic Curve ec-dual-use algorithm.
[SUSE-SU-2014:0418]
[openSUSE-SU-2014:0419]
[openSUSE-SU-2014:0448]
[openSUSE-SU-2014:0584]
[http://www.mozilla.org/security/announce/2014/mfsa2014-18.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[https://bugzilla.mozilla.org/show_bug.cgi?id=935618]
[GLSA-201504-01]
Mozilla Firefox before 28.0 and SeaMonkey before 2.25 allow remote attackers to spoof the domain name in the WebRTC (1) camera or (2) microphone permission prompt by triggering navigation at a certain time during generation of this prompt.
[SUSE-SU-2014:0418]
[openSUSE-SU-2014:0419]
[openSUSE-SU-2014:0448]
[openSUSE-SU-2014:0584]
[http://www.mozilla.org/security/announce/2014/mfsa2014-19.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[https://bugzilla.mozilla.org/show_bug.cgi?id=961512]
[GLSA-201504-01]
Mozilla Firefox before 28.0 and SeaMonkey before 2.25 allow remote attackers to cause a denial of service (resource consumption and application hang) via onbeforeunload events that trigger background JavaScript execution.
[SUSE-SU-2014:0418]
[openSUSE-SU-2014:0419]
[openSUSE-SU-2014:0448]
[openSUSE-SU-2014:0584]
[http://www.mozilla.org/security/announce/2014/mfsa2014-20.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[https://bugzilla.mozilla.org/show_bug.cgi?id=956524]
[GLSA-201504-01]
Mozilla Firefox before 28.0 on Android allows remote attackers to bypass the Same Origin Policy and access arbitrary file: URLs via vectors involving the "Open Link in New Tab" menu selection.
[SUSE-SU-2014:0418]
[http://www.mozilla.org/security/announce/2014/mfsa2014-21.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[https://bugzilla.mozilla.org/show_bug.cgi?id=960135]
The (1) WebGL.compressedTexImage2D and (2) WebGL.compressedTexSubImage2D functions in Mozilla Firefox before 28.0 and SeaMonkey before 2.25 allow remote attackers to bypass the Same Origin Policy and render content in a different domain via unspecified vectors.
[SUSE-SU-2014:0418]
[openSUSE-SU-2014:0419]
[openSUSE-SU-2014:0448]
[openSUSE-SU-2014:0584]
[http://www.mozilla.org/security/announce/2014/mfsa2014-22.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[https://bugzilla.mozilla.org/show_bug.cgi?id=972622]
[GLSA-201504-01]
The session-restore feature in Mozilla Firefox before 28.0 and SeaMonkey before 2.25 does not consider the Content Security Policy of a data: URL, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted document that is accessed after a browser restart.
[SUSE-SU-2014:0418]
[openSUSE-SU-2014:0419]
[openSUSE-SU-2014:0448]
[openSUSE-SU-2014:0584]
[http://www.mozilla.org/security/announce/2014/mfsa2014-23.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[https://bugzilla.mozilla.org/show_bug.cgi?id=911547]
[GLSA-201504-01]
The SVG filter implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to obtain sensitive displacement-correlation information, and possibly bypass the Same Origin Policy and read text from a different domain, via a timing attack involving feDisplacementMap elements, a related issue to CVE-2013-1693.
[SUSE-SU-2014:0418]
[openSUSE-SU-2014:0419]
[openSUSE-SU-2014:0448]
[openSUSE-SU-2014:0584]
[RHSA-2014:0310]
[RHSA-2014:0316]
[DSA-2881]
[DSA-2911]
[http://www.mozilla.org/security/announce/2014/mfsa2014-28.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[66418]
[USN-2151-1]
[https://bugzilla.mozilla.org/show_bug.cgi?id=941887]
[GLSA-201504-01]
Directory traversal vulnerability in Android Crash Reporter in Mozilla Firefox before 28.0 on Android allows attackers to trigger the transmission of local files to arbitrary servers, or cause a denial of service (application crash), via a crafted application that specifies Android Crash Reporter arguments.
[20140326 Firefox for Android Profile Directory Derandomization and Data Exfiltration (CVE-2014-1484, CVE-2014-1506, CVE-2014-1515, CVE-2014-1516)]
[http://www.mozilla.org/security/announce/2014/mfsa2014-24.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[66420]
[https://bugzilla.mozilla.org/show_bug.cgi?id=944374]
Directory traversal vulnerability in the DeviceStorage API in Mozilla FirefoxOS before 1.2.2 allows attackers to bypass the media sandbox protection mechanism, and read or modify arbitrary files, via a crafted application that uses a relative pathname for a DeviceStorageFile object.
[http://www.mozilla.org/security/announce/2014/mfsa2014-25.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[https://bugzilla.mozilla.org/show_bug.cgi?id=940684]
The libxul.so!gfxContext::Polygon function in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to obtain sensitive information from process memory, cause a denial of service (out-of-bounds read and application crash), or possibly bypass the Same Origin Policy via vectors involving MathML polygon rendering.
[SUSE-SU-2014:0418]
[openSUSE-SU-2014:0419]
[openSUSE-SU-2014:0448]
[openSUSE-SU-2014:0584]
[RHSA-2014:0310]
[RHSA-2014:0316]
[DSA-2881]
[DSA-2911]
[http://www.mozilla.org/security/announce/2014/mfsa2014-26.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[66426]
[USN-2151-1]
[https://bugzilla.mozilla.org/show_bug.cgi?id=963198]
[GLSA-201504-01]
Buffer overflow in the _cairo_truetype_index_to_ucs4 function in cairo, as used in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25, allows remote attackers to execute arbitrary code via a crafted extension that renders fonts in a PDF document.
[SUSE-SU-2014:0418]
[openSUSE-SU-2014:0419]
[openSUSE-SU-2014:0448]
[openSUSE-SU-2014:0584]
[RHSA-2014:0310]
[RHSA-2014:0316]
[http://www.mozilla.org/security/announce/2014/mfsa2014-27.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[66425]
[USN-2151-1]
[https://bugzilla.mozilla.org/show_bug.cgi?id=966021]
[GLSA-201504-01]
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to execute arbitrary JavaScript code with chrome privileges by using an IDL fragment to trigger a window.open call.
[SUSE-SU-2014:0418]
[openSUSE-SU-2014:0419]
[openSUSE-SU-2014:0448]
[openSUSE-SU-2014:0584]
[RHSA-2014:0310]
[RHSA-2014:0316]
[DSA-2881]
[DSA-2911]
[http://www.mozilla.org/security/announce/2014/mfsa2014-29.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[66206]
[USN-2151-1]
[https://bugzilla.mozilla.org/show_bug.cgi?id=982906]
[GLSA-201504-01]
Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remote attackers to bypass the popup blocker via unspecified vectors.
[SUSE-SU-2014:0418]
[openSUSE-SU-2014:0419]
[openSUSE-SU-2014:0448]
[openSUSE-SU-2014:0584]
[RHSA-2014:0310]
[RHSA-2014:0316]
[DSA-2881]
[DSA-2911]
[http://www.mozilla.org/security/announce/2014/mfsa2014-29.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[66207]
[USN-2151-1]
[https://bugzilla.mozilla.org/show_bug.cgi?id=982909]
[GLSA-201504-01]
Use-after-free vulnerability in the TypeObject class in the JavaScript engine in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to execute arbitrary code by triggering extensive memory consumption while garbage collection is occurring, as demonstrated by improper handling of BumpChunk objects.
[20140326 VUPEN Security Research - Mozilla Firefox "BumpChunk" Object Processing Use-after-free (Pwn2Own)]
[SUSE-SU-2014:0418]
[openSUSE-SU-2014:0419]
[openSUSE-SU-2014:0448]
[openSUSE-SU-2014:0584]
[RHSA-2014:0310]
[RHSA-2014:0316]
[DSA-2881]
[DSA-2911]
[http://www.mozilla.org/security/announce/2014/mfsa2014-30.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[66209]
[USN-2151-1]
[https://bugzilla.mozilla.org/show_bug.cgi?id=982957]
[GLSA-201504-01]
TypedArrayObject.cpp in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 does not prevent a zero-length transition during use of an ArrayBuffer object, which allows remote attackers to execute arbitrary code or cause a denial of service (heap-based out-of-bounds write or read) via a crafted web site.
[SUSE-SU-2014:0418]
[openSUSE-SU-2014:0419]
[openSUSE-SU-2014:0448]
[openSUSE-SU-2014:0584]
[RHSA-2014:0310]
[RHSA-2014:0316]
[DSA-2881]
[DSA-2911]
[http://www.mozilla.org/security/announce/2014/mfsa2014-31.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[66203]
[USN-2151-1]
[https://bugzilla.mozilla.org/show_bug.cgi?id=982974]
[GLSA-201504-01]
vmtypedarrayobject.cpp in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 does not validate the length of the destination array before a copy operation, which allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds write and application crash) by triggering incorrect use of the TypedArrayObject class.
[SUSE-SU-2014:0418]
[openSUSE-SU-2014:0419]
[openSUSE-SU-2014:0448]
[openSUSE-SU-2014:0584]
[RHSA-2014:0310]
[RHSA-2014:0316]
[DSA-2881]
[DSA-2911]
[http://www.mozilla.org/security/announce/2014/mfsa2014-32.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[66240]
[USN-2151-1]
[https://bugzilla.mozilla.org/show_bug.cgi?id=983344]
[GLSA-201504-01]
Mozilla Firefox before 28.0.1 on Android processes a file: URL by copying a local file onto the SD card, which allows attackers to obtain sensitive information from the Firefox profile directory via a crafted application.
[20140326 Firefox for Android Profile Directory Derandomization and Data Exfiltration (CVE-2014-1484, CVE-2014-1506, CVE-2014-1515, CVE-2014-1516)]
[https://bugzilla.mozilla.org/show_bug.cgi?id=945429]
[https://www.mozilla.org/security/announce/2014/mfsa2014-33.html]
The saltProfileName function in base/GeckoProfileDirectories.java in Mozilla Firefox through 28.0.1 on Android relies on Android's weak approach to seeding the Math.random function, which makes it easier for attackers to bypass a profile-randomization protection mechanism via a crafted application.
[20140326 Firefox for Android Profile Directory Derandomization and Data Exfiltration (CVE-2014-1484, CVE-2014-1506, CVE-2014-1515, CVE-2014-1516)]
[http://securityintelligence.com/vulnerabilities-firefox-android-overtaking-firefox-profiles/]
[http://www.slideshare.net/ibmsecurity/overtaking-firefox-profiles-vulnerabilities-in-firefox-for-android]
The login form in Bugzilla 2.x, 3.x, 4.x before 4.4.3, and 4.5.x before 4.5.3 does not properly handle a correctly authenticated but unintended login attempt, which makes it easier for remote authenticated users to obtain sensitive information by arranging for a victim to login to the attacker's account and then submit a vulnerability report, related to a "login CSRF" issue.
[http://git.mozilla.org/?p=bugzilla/bugzilla.git;a=commit;h=0e390970ba51b14a5dc780be7c6f0d6d7baa67e3]
[FEDORA-2014-5414]
[FEDORA-2014-5433]
[http://www.bugzilla.org/security/4.0.11/]
[1030128]
[https://bugzilla.mozilla.org/show_bug.cgi?id=713926]
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
[FEDORA-2014-5833]
[FEDORA-2014-5829]
[SUSE-SU-2014:0665]
[SUSE-SU-2014:0727]
[openSUSE-SU-2014:0599]
[openSUSE-SU-2014:0602]
[openSUSE-SU-2014:0629]
[openSUSE-SU-2014:0640]
[RHSA-2014:0448]
[RHSA-2014:0449]
[DSA-2918]
[DSA-2924]
[http://www.mozilla.org/security/announce/2014/mfsa2014-34.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[67123]
[1030163]
[1030164]
[USN-2185-1]
[USN-2189-1]
[https://bugzilla.mozilla.org/show_bug.cgi?id=944353]
[https://bugzilla.mozilla.org/show_bug.cgi?id=952022]
[https://bugzilla.mozilla.org/show_bug.cgi?id=966630]
[https://bugzilla.mozilla.org/show_bug.cgi?id=980537]
[https://bugzilla.mozilla.org/show_bug.cgi?id=986678]
[https://bugzilla.mozilla.org/show_bug.cgi?id=986843]
[https://bugzilla.mozilla.org/show_bug.cgi?id=991471]
[https://bugzilla.mozilla.org/show_bug.cgi?id=992968]
[https://bugzilla.mozilla.org/show_bug.cgi?id=993546]
[GLSA-201504-01]
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 29.0 and SeaMonkey before 2.26 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
[FEDORA-2014-5833]
[FEDORA-2014-5829]
[openSUSE-SU-2014:0599]
[openSUSE-SU-2014:0629]
[http://www.mozilla.org/security/announce/2014/mfsa2014-34.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[1030163]
[1030164]
[USN-2185-1]
[https://bugzilla.mozilla.org/show_bug.cgi?id=919592]
[https://bugzilla.mozilla.org/show_bug.cgi?id=946658]
[https://bugzilla.mozilla.org/show_bug.cgi?id=953104]
[https://bugzilla.mozilla.org/show_bug.cgi?id=977955]
[https://bugzilla.mozilla.org/show_bug.cgi?id=986864]
[https://bugzilla.mozilla.org/show_bug.cgi?id=990794]
[https://bugzilla.mozilla.org/show_bug.cgi?id=995607]
[https://bugzilla.mozilla.org/show_bug.cgi?id=996883]
[GLSA-201504-01]
maintenservice_installer.exe in the Maintenance Service Installer in Mozilla Firefox before 29.0 and Firefox ESR 24.x before 24.5 on Windows allows local users to gain privileges by placing a Trojan horse DLL file into a temporary directory at an unspecified point in the update process.
[FEDORA-2014-5833]
[FEDORA-2014-5829]
[http://www.mozilla.org/security/announce/2014/mfsa2014-35.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[1030163]
[https://bugzilla.mozilla.org/show_bug.cgi?id=961676]
[GLSA-201504-01]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2014. Notes: none.
The mozilla::dom::OscillatorNodeEngine::ComputeCustom function in the Web Audio subsystem in Mozilla Firefox before 29.0 and SeaMonkey before 2.26 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read, memory corruption, and application crash) via crafted content.
[FEDORA-2014-5829]
[openSUSE-SU-2014:0599]
[openSUSE-SU-2014:0629]
[http://www.mozilla.org/security/announce/2014/mfsa2014-36.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[1030163]
[1030164]
[USN-2185-1]
[https://bugzilla.mozilla.org/show_bug.cgi?id=995289]
[GLSA-201504-01]
Heap-based buffer overflow in the read_u32 function in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted JPEG image.
[FEDORA-2014-5833]
[FEDORA-2014-5829]
[SUSE-SU-2014:0665]
[SUSE-SU-2014:0727]
[openSUSE-SU-2014:0599]
[openSUSE-SU-2014:0602]
[openSUSE-SU-2014:0629]
[openSUSE-SU-2014:0640]
[RHSA-2014:0448]
[RHSA-2014:0449]
[DSA-2918]
[DSA-2924]
[http://www.mozilla.org/security/announce/2014/mfsa2014-37.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[67129]
[1030163]
[1030164]
[1030165]
[USN-2185-1]
[USN-2189-1]
[https://bugzilla.mozilla.org/show_bug.cgi?id=969226]
[GLSA-201504-01]
The nsXBLProtoImpl::InstallImplementation function in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 does not properly check whether objects are XBL objects, which allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow) via crafted JavaScript code that accesses a non-XBL object as if it were an XBL object.
[FEDORA-2014-5833]
[FEDORA-2014-5829]
[SUSE-SU-2014:0665]
[SUSE-SU-2014:0727]
[openSUSE-SU-2014:0599]
[openSUSE-SU-2014:0602]
[openSUSE-SU-2014:0629]
[openSUSE-SU-2014:0640]
[RHSA-2014:0448]
[RHSA-2014:0449]
[DSA-2918]
[DSA-2924]
[http://www.mozilla.org/security/announce/2014/mfsa2014-38.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[67131]
[1030163]
[1030164]
[1030165]
[USN-2185-1]
[USN-2189-1]
[https://bugzilla.mozilla.org/show_bug.cgi?id=989183]
[GLSA-201504-01]
The mozilla::dom::TextTrack::AddCue function in Mozilla Firefox before 29.0 and SeaMonkey before 2.26 does not properly perform garbage collection for Text Track Manager variables, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and heap memory corruption) via a crafted VIDEO element in an HTML document.
[FEDORA-2014-5829]
[openSUSE-SU-2014:0599]
[openSUSE-SU-2014:0629]
[http://www.mozilla.org/security/announce/2014/mfsa2014-39.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[1030163]
[1030164]
[USN-2185-1]
[https://bugzilla.mozilla.org/show_bug.cgi?id=989210]
[GLSA-201504-01]
The XrayWrapper implementation in Mozilla Firefox before 29.0 and SeaMonkey before 2.26 allows user-assisted remote attackers to bypass intended access restrictions via a crafted web site that is visited in the debugger, leading to unwrapping operations and calls to DOM methods on the unwrapped objects.
[FEDORA-2014-5829]
[openSUSE-SU-2014:0599]
[openSUSE-SU-2014:0629]
[http://www.mozilla.org/security/announce/2014/mfsa2014-47.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[1030163]
[1030164]
[USN-2185-1]
[https://bugzilla.mozilla.org/show_bug.cgi?id=988106]
[GLSA-201504-01]
Mozilla Firefox before 29.0 on Android allows remote attackers to spoof the address bar via crafted JavaScript code that uses DOM events to prevent the reemergence of the actual address bar after scrolling has taken it off of the screen.
[FEDORA-2014-5829]
[http://www.mozilla.org/security/announce/2014/mfsa2014-40.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[1030163]
[https://bugzilla.mozilla.org/show_bug.cgi?id=960146]
The sse2_composite_src_x888_8888 function in Pixman, as used in Cairo in Mozilla Firefox 28.0 and SeaMonkey 2.25 on Windows, allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds write and application crash) by painting on a CANVAS element.
[FEDORA-2014-5829]
[openSUSE-SU-2014:0599]
[openSUSE-SU-2014:0629]
[http://www.mozilla.org/security/announce/2014/mfsa2014-41.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[1030163]
[1030164]
[USN-2185-1]
[https://bugzilla.mozilla.org/show_bug.cgi?id=963962]
The Web Notification API in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allows remote attackers to bypass intended source-component restrictions and execute arbitrary JavaScript code in a privileged context via a crafted web page for which Notification.permission is granted.
[FEDORA-2014-5833]
[FEDORA-2014-5829]
[SUSE-SU-2014:0665]
[SUSE-SU-2014:0727]
[openSUSE-SU-2014:0599]
[openSUSE-SU-2014:0602]
[openSUSE-SU-2014:0629]
[openSUSE-SU-2014:0640]
[RHSA-2014:0448]
[RHSA-2014:0449]
[DSA-2918]
[DSA-2924]
[http://www.mozilla.org/security/announce/2014/mfsa2014-42.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[67135]
[1030163]
[1030164]
[1030165]
[USN-2185-1]
[USN-2189-1]
[https://bugzilla.mozilla.org/show_bug.cgi?id=987003]
[GLSA-201504-01]
The docshell implementation in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allows remote attackers to trigger the loading of a URL with a spoofed baseURI property, and conduct cross-site scripting (XSS) attacks, via a crafted web site that performs history navigation.
[FEDORA-2014-5833]
[FEDORA-2014-5829]
[SUSE-SU-2014:0665]
[SUSE-SU-2014:0727]
[openSUSE-SU-2014:0599]
[openSUSE-SU-2014:0602]
[openSUSE-SU-2014:0629]
[openSUSE-SU-2014:0640]
[RHSA-2014:0448]
[RHSA-2014:0449]
[DSA-2918]
[DSA-2924]
[http://www.mozilla.org/security/announce/2014/mfsa2014-43.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[67137]
[1030163]
[1030164]
[1030165]
[USN-2185-1]
[USN-2189-1]
[https://bugzilla.mozilla.org/show_bug.cgi?id=895557]
[GLSA-201504-01]
Use-after-free vulnerability in the nsGenericHTMLElement::GetWidthHeightForImage function in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via vectors involving an imgLoader object that is not properly handled during an image-resize operation.
[FEDORA-2014-5833]
[FEDORA-2014-5829]
[SUSE-SU-2014:0665]
[SUSE-SU-2014:0727]
[openSUSE-SU-2014:0599]
[openSUSE-SU-2014:0602]
[openSUSE-SU-2014:0629]
[openSUSE-SU-2014:0640]
[RHSA-2014:0448]
[RHSA-2014:0449]
[DSA-2918]
[DSA-2924]
[http://www.mozilla.org/security/announce/2014/mfsa2014-44.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[67134]
[1030163]
[1030164]
[1030165]
[USN-2185-1]
[USN-2189-1]
[https://bugzilla.mozilla.org/show_bug.cgi?id=987140]
[GLSA-201504-01]
Use-after-free vulnerability in the nsHostResolver::ConditionallyRefreshRecord function in libxul.so in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via vectors related to host resolution.
[FEDORA-2014-5833]
[FEDORA-2014-5829]
[SUSE-SU-2014:0665]
[SUSE-SU-2014:0727]
[openSUSE-SU-2014:0599]
[openSUSE-SU-2014:0602]
[openSUSE-SU-2014:0629]
[openSUSE-SU-2014:0640]
[RHSA-2014:0448]
[RHSA-2014:0449]
[DSA-2918]
[DSA-2924]
[http://www.mozilla.org/security/announce/2014/mfsa2014-46.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[67130]
[1030163]
[1030164]
[1030165]
[USN-2185-1]
[USN-2189-1]
[https://bugzilla.mozilla.org/show_bug.cgi?id=966006]
[GLSA-201504-01]
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 30.0, Firefox ESR 24.x before 24.6, and Thunderbird before 24.6 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
[http://linux.oracle.com/errata/ELSA-2014-0741.html]
[http://linux.oracle.com/errata/ELSA-2014-0742.html]
[openSUSE-SU-2014:0797]
[SUSE-SU-2014:0824]
[openSUSE-SU-2014:0819]
[openSUSE-SU-2014:0855]
[openSUSE-SU-2014:0858]
[RHSA-2014:0741]
[RHSA-2014:0742]
[59328]
[59425]
[59486]
[DSA-2955]
[DSA-2960]
[http://www.mozilla.org/security/announce/2014/mfsa2014-48.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[67965]
[1030386]
[1030388]
[USN-2243-1]
[USN-2250-1]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1009952]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1011007]
[https://bugzilla.mozilla.org/show_bug.cgi?id=921622]
[https://bugzilla.mozilla.org/show_bug.cgi?id=967354]
[https://bugzilla.mozilla.org/show_bug.cgi?id=978811]
[https://bugzilla.mozilla.org/show_bug.cgi?id=988719]
[https://bugzilla.mozilla.org/show_bug.cgi?id=991981]
[https://bugzilla.mozilla.org/show_bug.cgi?id=992274]
[https://bugzilla.mozilla.org/show_bug.cgi?id=994907]
[https://bugzilla.mozilla.org/show_bug.cgi?id=995679]
[https://bugzilla.mozilla.org/show_bug.cgi?id=996715]
[https://bugzilla.mozilla.org/show_bug.cgi?id=999651]
[GLSA-201504-01]
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 30.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
[openSUSE-SU-2014:0797]
[SUSE-SU-2014:0824]
[openSUSE-SU-2014:0819]
[openSUSE-SU-2014:0855]
[openSUSE-SU-2014:0858]
[59425]
[59486]
[http://www.mozilla.org/security/announce/2014/mfsa2014-48.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[67964]
[1030386]
[1030388]
[USN-2243-1]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1000598]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1000960]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1002340]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1005578]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1007223]
[https://bugzilla.mozilla.org/show_bug.cgi?id=969517]
[https://bugzilla.mozilla.org/show_bug.cgi?id=969549]
[https://bugzilla.mozilla.org/show_bug.cgi?id=973874]
[https://bugzilla.mozilla.org/show_bug.cgi?id=978652]
[https://bugzilla.mozilla.org/show_bug.cgi?id=990868]
[https://bugzilla.mozilla.org/show_bug.cgi?id=995816]
[https://bugzilla.mozilla.org/show_bug.cgi?id=995817]
[https://bugzilla.mozilla.org/show_bug.cgi?id=996536]
[GLSA-201504-01]
The PropertyProvider::FindJustificationRange function in Mozilla Firefox before 30.0 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read) via unspecified vectors.
Per: http://cwe.mitre.org/data/definitions/125.html
"CWE-125: Out-of-bounds Read"
[openSUSE-SU-2014:0797]
[SUSE-SU-2014:0824]
[openSUSE-SU-2014:0819]
[openSUSE-SU-2014:0855]
[openSUSE-SU-2014:0858]
[59425]
[59486]
[http://www.mozilla.org/security/announce/2014/mfsa2014-49.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[67966]
[1030386]
[1030388]
[USN-2243-1]
[https://bugzilla.mozilla.org/show_bug.cgi?id=989994]
[GLSA-201504-01]
Use-after-free vulnerability in the mozilla::dom::workers::WorkerPrivateParent function in Mozilla Firefox before 30.0 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.
Per http://cwe.mitre.org/data/definitions/416.html: "CWE-416: Use After Free"
[openSUSE-SU-2014:0797]
[SUSE-SU-2014:0824]
[openSUSE-SU-2014:0819]
[openSUSE-SU-2014:0855]
[openSUSE-SU-2014:0858]
[59425]
[59486]
[http://www.mozilla.org/security/announce/2014/mfsa2014-49.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[67971]
[1030386]
[1030388]
[USN-2243-1]
[https://bugzilla.mozilla.org/show_bug.cgi?id=999274]
[GLSA-201504-01]
Use-after-free vulnerability in the nsTextEditRules::CreateMozBR function in Mozilla Firefox before 30.0, Firefox ESR 24.x before 24.6, and Thunderbird before 24.6 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.
Per: http://cwe.mitre.org/data/definitions/416.html
"CWE-416: Use After Free"
[http://linux.oracle.com/errata/ELSA-2014-0741.html]
[http://linux.oracle.com/errata/ELSA-2014-0742.html]
[openSUSE-SU-2014:0797]
[SUSE-SU-2014:0824]
[openSUSE-SU-2014:0819]
[openSUSE-SU-2014:0855]
[openSUSE-SU-2014:0858]
[RHSA-2014:0741]
[RHSA-2014:0742]
[59328]
[59425]
[59486]
[DSA-2955]
[DSA-2960]
[http://www.mozilla.org/security/announce/2014/mfsa2014-49.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[67976]
[1030386]
[1030388]
[USN-2243-1]
[USN-2250-1]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1005584]
[https://bugzilla.redhat.com/show_bug.cgi?id=1107421]
[GLSA-201504-01]
Mozilla Firefox before 30.0 and Thunderbird through 24.6 on OS X do not ensure visibility of the cursor after interaction with a Flash object and a DIV element, which makes it easier for remote attackers to conduct clickjacking attacks via JavaScript code that produces a fake cursor image.
[openSUSE-SU-2014:0819]
[openSUSE-SU-2014:0855]
[59486]
[http://www.mozilla.org/security/announce/2014/mfsa2014-50.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[67967]
[1030388]
[https://bugzilla.mozilla.org/show_bug.cgi?id=995603]
[GLSA-201504-01]
Use-after-free vulnerability in the nsEventListenerManager::CompileEventHandlerInternal function in the Event Listener Manager in Mozilla Firefox before 30.0 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via crafted web content.
Per http://cwe.mitre.org/data/definitions/416.html:
"CWE-416: Use After Free"
[openSUSE-SU-2014:0819]
[openSUSE-SU-2014:0855]
[59486]
[http://www.mozilla.org/security/announce/2014/mfsa2014-51.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[67978]
[1030388]
[USN-2243-1]
[https://bugzilla.mozilla.org/show_bug.cgi?id=978862]
[GLSA-201504-01]
Use-after-free vulnerability in the RefreshDriverTimer::TickDriver function in the SMIL Animation Controller in Mozilla Firefox before 30.0, Firefox ESR 24.x before 24.6, and Thunderbird before 24.6 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via crafted web content.
Per http://cwe.mitre.org/data/definitions/416.html:
"CWE-416: Use After Free"
[http://linux.oracle.com/errata/ELSA-2014-0741.html]
[http://linux.oracle.com/errata/ELSA-2014-0742.html]
[openSUSE-SU-2014:0797]
[SUSE-SU-2014:0824]
[openSUSE-SU-2014:0819]
[openSUSE-SU-2014:0855]
[openSUSE-SU-2014:0858]
[RHSA-2014:0741]
[RHSA-2014:0742]
[59328]
[59425]
[59486]
[DSA-2955]
[DSA-2960]
[http://www.mozilla.org/security/announce/2014/mfsa2014-52.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[67979]
[1030386]
[1030388]
[USN-2243-1]
[USN-2250-1]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1000185]
[GLSA-201504-01]
Buffer overflow in the Speex resampler in the Web Audio subsystem in Mozilla Firefox before 30.0 allows remote attackers to execute arbitrary code via vectors related to a crafted AudioBuffer channel count and sample rate.
[openSUSE-SU-2014:0819]
[openSUSE-SU-2014:0855]
[59486]
[http://www.mozilla.org/security/announce/2014/mfsa2014-53.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[67968]
[1030388]
[USN-2243-1]
[https://bugzilla.mozilla.org/show_bug.cgi?id=991533]
[GLSA-201504-01]
Multiple heap-based buffer overflows in the navigator.getGamepads function in the Gamepad API in Mozilla Firefox before 30.0 allow remote attackers to execute arbitrary code by using non-contiguous axes with a (1) physical or (2) virtual Gamepad device.
[openSUSE-SU-2014:0819]
[openSUSE-SU-2014:0855]
[59486]
[http://www.mozilla.org/security/announce/2014/mfsa2014-54.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[67969]
[1030388]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1011859]
[GLSA-201504-01]
Use-after-free vulnerability in the CERT_DestroyCertificate function in libnss3.so in Mozilla Network Security Services (NSS) 3.x, as used in Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7, allows remote attackers to execute arbitrary code via vectors that trigger certain improper removal of an NSSCertificate structure from a trust domain.
<a href="http://cwe.mitre.org/data/definitions/416.html" target="_blank">CWE-416: Use After Free</a>
[59591]
[59719]
[59760]
[60083]
[60486]
[60621]
[60628]
[DSA-2986]
[DSA-2996]
[http://www.mozilla.org/security/announce/2014/mfsa2014-63.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html]
[68816]
[1030617]
[https://bugzilla.mozilla.org/show_bug.cgi?id=963150]
[GLSA-201504-01]
Mozilla Netscape Portable Runtime (NSPR) before 4.10.6 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds write) via vectors involving the sprintf and console functions.
Per: http://cwe.mitre.org/data/definitions/787.html
"CWE-787: Out-of-bounds Write"
[http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761]
[openSUSE-SU-2014:0797]
[SUSE-SU-2014:0824]
[openSUSE-SU-2014:0819]
[openSUSE-SU-2014:0855]
[openSUSE-SU-2014:0858]
[59425]
[59486]
[DSA-2955]
[DSA-2960]
[DSA-2962]
[http://www.mozilla.org/security/announce/2014/mfsa2014-55.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html]
[67975]
[1030404]
[USN-2265-1]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1018783]
[https://bugzilla.redhat.com/show_bug.cgi?id=1107432]
[GLSA-201504-01]
The response function in the JSONP endpoint in WebService/Server/JSONRPC.pm in jsonrpc.cgi in Bugzilla 3.x and 4.x before 4.0.14, 4.1.x and 4.2.x before 4.2.10, 4.3.x and 4.4.x before 4.4.5, and 4.5.x before 4.5.5 accepts certain long callback values and does not restrict the initial bytes of a JSONP response, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks, and obtain sensitive information, via a crafted OBJECT element with SWF content consistent with the _bz_callback character set.
[http://advisories.mageia.org/MGASA-2014-0349.html]
[FEDORA-2014-8920]
[FEDORA-2014-8919]
[MDVSA-2014:169]
[20140724 Security advisory for Bugzilla 4.5.5, 4.4.5, 4.2.10, and 4.0.14]
[1030648]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1036213]
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
[http://linux.oracle.com/errata/ELSA-2014-0918.html]
[59591]
[59719]
[59760]
[60083]
[60306]
[60486]
[60621]
[60628]
[DSA-2986]
[DSA-2996]
[http://www.mozilla.org/security/announce/2014/mfsa2014-56.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[68811]
[1030619]
[1030620]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1012694]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1019684]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1024765]
[https://bugzilla.mozilla.org/show_bug.cgi?id=985070]
[GLSA-201504-01]
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 31.0 and Thunderbird before 31.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
[59719]
[59760]
[60083]
[60621]
[60628]
[http://www.mozilla.org/security/announce/2014/mfsa2014-56.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[68818]
[1030619]
[1030620]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1002702]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1009675]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1013056]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1020008]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1020041]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1020219]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1021240]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1021312]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1021969]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1022773]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1028358]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1034383]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1035438]
[https://bugzilla.mozilla.org/show_bug.cgi?id=990096]
[https://bugzilla.mozilla.org/show_bug.cgi?id=994444]
[GLSA-201504-01]
The mozilla::dom::AudioBufferSourceNodeEngine::CopyFromInputBuffer function in Mozilla Firefox before 31.0 and Thunderbird before 31.0 does not properly allocate Web Audio buffer memory, which allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) via crafted audio content that is improperly handled during playback buffering.
[59760]
[60628]
[http://www.mozilla.org/security/announce/2014/mfsa2014-57.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[68820]
[1030619]
[1030620]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1020205]
[GLSA-201504-01]
Use-after-free vulnerability in the MediaInputPort class in Mozilla Firefox before 31.0 and Thunderbird before 31.0 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) by leveraging incorrect Web Audio control-message ordering.
<a href="http://cwe.mitre.org/data/definitions/416.html" target="_blank">CWE-416: Use After Free</a>
[59760]
[60628]
[http://www.mozilla.org/security/announce/2014/mfsa2014-58.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[1030619]
[1030620]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1020411]
[GLSA-201504-01]
Use-after-free vulnerability in the FontTableRec destructor in Mozilla Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7 on Windows allows remote attackers to execute arbitrary code via crafted use of fonts in MathML content, leading to improper handling of a DirectWrite font-face object.
<a href="http://cwe.mitre.org/data/definitions/416.html" target="_blank">CWE-416: Use After Free</a>
[59760]
[http://www.mozilla.org/security/announce/2014/mfsa2014-59.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[1030619]
[1030620]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1018234]
[GLSA-201504-01]
Mozilla Firefox before 31.0 and Thunderbird before 31.0 do not properly implement the sandbox attribute of the IFRAME element, which allows remote attackers to bypass intended restrictions on same-origin content via a crafted web site in conjunction with a redirect.
[59760]
[60628]
[http://www.mozilla.org/security/announce/2014/mfsa2014-66.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[1030619]
[1030620]
[https://bugzilla.mozilla.org/show_bug.cgi?id=985135]
[GLSA-201504-01]
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 32.0, Firefox ESR 31.x before 31.1, and Thunderbird 31.x before 31.1 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
[openSUSE-SU-2014:1098]
[openSUSE-SU-2015:0138]
[openSUSE-SU-2015:1266]
[openSUSE-SU-2014:1099]
[60148]
[61114]
[http://www.mozilla.org/security/announce/2014/mfsa2014-67.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[69524]
[1030793]
[1030794]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1022945]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1027359]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1033121]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1035007]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1037666]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1041148]
[https://bugzilla.mozilla.org/show_bug.cgi?id=995075]
[GLSA-201504-01]
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 32.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
[openSUSE-SU-2014:1099]
[openSUSE-SU-2014:1344]
[openSUSE-SU-2014:1345]
[http://www.mozilla.org/security/announce/2014/mfsa2014-67.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[69526]
[1030793]
[1030794]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1004480]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1016519]
[https://bugzilla.mozilla.org/show_bug.cgi?id=990247]
[https://bugzilla.mozilla.org/show_bug.cgi?id=995704]
[GLSA-201504-01]
Use-after-free vulnerability in the nsDocLoader::OnProgress function in Mozilla Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7 allows remote attackers to execute arbitrary code via vectors that trigger a FireOnStateChange event.
<a href="http://cwe.mitre.org/data/definitions/416.html" target="_blank">CWE-416: Use After Free</a>
[http://linux.oracle.com/errata/ELSA-2014-0918.html]
[59591]
[59719]
[59760]
[60083]
[60306]
[60486]
[60621]
[60628]
[DSA-2986]
[DSA-2996]
[http://www.mozilla.org/security/announce/2014/mfsa2014-61.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[68814]
[1030619]
[1030620]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1023121]
[GLSA-201504-01]
Mozilla Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7 allow remote attackers to execute arbitrary code via crafted WebGL content constructed with the Cesium JavaScript library.
[http://linux.oracle.com/errata/ELSA-2014-0918.html]
[59591]
[59719]
[59760]
[60083]
[60306]
[60486]
[60621]
[60628]
[DSA-2986]
[DSA-2996]
[http://www.mozilla.org/security/announce/2014/mfsa2014-62.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[68822]
[1030619]
[1030620]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1028891]
[GLSA-201504-01]
The ConvolveHorizontally function in Skia, as used in Mozilla Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7, does not properly handle the discarding of image data during function execution, which allows remote attackers to execute arbitrary code by triggering prolonged image scaling, as demonstrated by scaling of a high-quality image.
[http://linux.oracle.com/errata/ELSA-2014-0918.html]
[59591]
[59719]
[59760]
[60083]
[60306]
[60486]
[60621]
[60628]
[DSA-2986]
[DSA-2996]
[http://www.mozilla.org/security/announce/2014/mfsa2014-64.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[68824]
[1030619]
[1030620]
[https://bugzilla.mozilla.org/show_bug.cgi?id=913805]
[GLSA-201504-01]
Mozilla Firefox before 31.0 and Thunderbird before 31.0 allow remote attackers to cause a denial of service (X.509 certificate parsing outage) via a crafted certificate that does not use UTF-8 character encoding in a required context, a different vulnerability than CVE-2014-1559.
<a href="http://cwe.mitre.org/data/definitions/176.html" target="_blank">CWE-176: CWE-176: Improper Handling of Unicode Encoding</a>
[60628]
[http://www.mozilla.org/security/announce/2014/mfsa2014-65.html]
[1030619]
[1030620]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1015973]
[GLSA-201504-01]
Mozilla Firefox before 31.0 and Thunderbird before 31.0 allow remote attackers to cause a denial of service (X.509 certificate parsing outage) via a crafted certificate that does not use UTF-8 character encoding in a required context, a different vulnerability than CVE-2014-1558.
<a href="http://cwe.mitre.org/data/definitions/176.html" target="_blank">CWE-176: CWE-176: Improper Handling of Unicode Encoding</a>
[60628]
[http://www.mozilla.org/security/announce/2014/mfsa2014-65.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[1030619]
[1030620]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1026022]
[GLSA-201504-01]
Mozilla Firefox before 31.0 and Thunderbird before 31.0 allow remote attackers to cause a denial of service (X.509 certificate parsing outage) via a crafted certificate that does not use ASCII character encoding in a required context.
<a href="http://cwe.mitre.org/data/definitions/176.html" target="_blank">CWE-176: CWE-176: Improper Handling of Unicode Encoding</a>
[60628]
[http://www.mozilla.org/security/announce/2014/mfsa2014-65.html]
[1030619]
[1030620]
[https://bugzilla.mozilla.org/show_bug.cgi?id=997795]
[GLSA-201504-01]
Mozilla Firefox before 31.0 does not properly restrict use of drag-and-drop events to spoof customization events, which allows remote attackers to alter the placement of UI icons via crafted JavaScript code that is encountered during (1) page, (2) panel, or (3) toolbar customization.
[59760]
[60628]
[http://www.mozilla.org/security/announce/2014/mfsa2014-60.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[1030619]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1000514]
[https://bugzilla.mozilla.org/show_bug.cgi?id=910375]
[GLSA-201504-01]
Unspecified vulnerability in the browser engine in Mozilla Firefox before 32.0, Firefox ESR 24.x before 24.8 and 31.x before 31.1, and Thunderbird 24.x before 24.8 and 31.x before 31.1 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
[openSUSE-SU-2014:1098]
[SUSE-SU-2014:1107]
[SUSE-SU-2014:1112]
[SUSE-SU-2014:1120]
[openSUSE-SU-2015:0138]
[openSUSE-SU-2015:1266]
[openSUSE-SU-2014:1099]
[60148]
[60186]
[61114]
[61390]
[DSA-3018]
[DSA-3028]
[http://www.mozilla.org/security/announce/2014/mfsa2014-67.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[69519]
[1030793]
[1030794]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1054359]
[GLSA-201504-01]
Use-after-free vulnerability in the mozilla::DOMSVGLength::GetTearOff function in Mozilla Firefox before 32.0, Firefox ESR 31.x before 31.1, and Thunderbird 31.x before 31.1 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via an SVG animation with DOM interaction that triggers incorrect cycle collection.
<a href="http://cwe.mitre.org/data/definitions/416.html" target="_blank">CWE-416: Use After Free</a>
[openSUSE-SU-2014:1098]
[openSUSE-SU-2015:0138]
[openSUSE-SU-2015:1266]
[openSUSE-SU-2014:1099]
[60148]
[61114]
[http://www.mozilla.org/security/announce/2014/mfsa2014-68.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[69523]
[1030793]
[1030794]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1018524]
[GLSA-201504-01]
Mozilla Firefox before 32.0, Firefox ESR 31.x before 31.1, and Thunderbird 31.x before 31.1 do not properly initialize memory for GIF rendering, which allows remote attackers to obtain sensitive information from process memory via crafted web script that interacts with a CANVAS element associated with a malformed GIF image.
<a href="http://cwe.mitre.org/data/definitions/824.html" target="_blank">CWE-824: Access of Uninitialized Pointer</a>
[openSUSE-SU-2014:1098]
[openSUSE-SU-2015:0138]
[openSUSE-SU-2015:1266]
[openSUSE-SU-2014:1099]
[http://packetstormsecurity.com/files/128132/Mozilla-Firefox-Secret-Leak.html]
[20140903 Uninit memory disclosure via truncated images in Firefox]
[60148]
[61114]
[http://www.mozilla.org/security/announce/2014/mfsa2014-69.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[20140904 Uninit memory disclosure via truncated images in Firefox]
[69525]
[1030793]
[1030794]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1045977]
[GLSA-201504-01]
The mozilla::dom::AudioEventTimeline function in the Web Audio API implementation in Mozilla Firefox before 32.0, Firefox ESR 31.x before 31.1, and Thunderbird 31.x before 31.1 does not properly create audio timelines, which allows remote attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read) via crafted API calls.
[openSUSE-SU-2014:1098]
[openSUSE-SU-2015:0138]
[openSUSE-SU-2015:1266]
[openSUSE-SU-2014:1099]
[60148]
[61114]
[http://www.mozilla.org/security/announce/2014/mfsa2014-70.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[69521]
[1030793]
[1030794]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1047831]
[GLSA-201504-01]
Mozilla Firefox before 31.1 on Android does not properly restrict copying of local files onto the SD card during processing of file: URLs, which allows attackers to obtain sensitive information from the Firefox profile directory via a crafted application. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-1515.
[http://www.mozilla.org/security/announce/2014/mfsa2014-71.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[69522]
[1030792]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1050690]
[GLSA-201504-01]
Use-after-free vulnerability in DirectionalityUtils.cpp in Mozilla Firefox before 32.0, Firefox ESR 24.x before 24.8 and 31.x before 31.1, and Thunderbird 24.x before 24.8 and 31.x before 31.1 allows remote attackers to execute arbitrary code via text that is improperly handled during the interaction between directionality resolution and layout.
<a href="http://cwe.mitre.org/data/definitions/416.html" target="_blank">CWE-416: Use After Free</a>
[openSUSE-SU-2014:1098]
[SUSE-SU-2014:1107]
[SUSE-SU-2014:1112]
[SUSE-SU-2014:1120]
[openSUSE-SU-2015:0138]
[openSUSE-SU-2015:1266]
[openSUSE-SU-2014:1099]
[60148]
[60186]
[61114]
[61390]
[DSA-3018]
[DSA-3028]
[http://www.mozilla.org/security/announce/2014/mfsa2014-72.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[69520]
[1030793]
[1030794]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1037641]
[GLSA-201504-01]
Mozilla Network Security Services (NSS) before 3.16.2.1, 3.16.x before 3.16.5, and 3.17.x before 3.17.1, as used in Mozilla Firefox before 32.0.3, Mozilla Firefox ESR 24.x before 24.8.1 and 31.x before 31.1.1, Mozilla Thunderbird before 24.8.1 and 31.x before 31.1.2, Mozilla SeaMonkey before 2.29.1, Google Chrome before 37.0.2062.124 on Windows and OS X, and Google Chrome OS before 37.0.2062.120, does not properly parse ASN.1 values in X.509 certificates, which makes it easier for remote attackers to spoof RSA signatures via a crafted certificate, aka a "signature malleability" issue.
[http://googlechromereleases.blogspot.com/2014/09/stable-channel-update_24.html]
[http://googlechromereleases.blogspot.com/2014/09/stable-channel-update-for-chrome-os_24.html]
[http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10698]
[http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761]
[SUSE-SU-2014:1220]
[openSUSE-SU-2014:1224]
[openSUSE-SU-2014:1232]
[RHSA-2014:1307]
[RHSA-2014:1354]
[RHSA-2014:1371]
[61540]
[61574]
[61575]
[61576]
[61583]
[DSA-3033]
[DSA-3034]
[DSA-3037]
[VU#772676]
[http://www.mozilla.org/security/announce/2014/mfsa2014-73.html]
[http://www.novell.com/support/kb/doc.php?id=7015701]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html]
[http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html]
[http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html]
[http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html]
[70116]
[USN-2360-1]
[USN-2360-2]
[USN-2361-1]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1064636]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1069405]
[mozilla-nss-cve20141568-sec-bypass(96194)]
[GLSA-201504-01]
The definite_length_decoder function in lib/util/quickder.c in Mozilla Network Security Services (NSS) before 3.16.2.4 and 3.17.x before 3.17.3 does not ensure that the DER encoding of an ASN.1 length is properly formed, which allows remote attackers to conduct data-smuggling attacks by using a long byte sequence for an encoding, as demonstrated by the SEC_QuickDERDecodeItem function's improper handling of an arbitrary-length encoding of 0x00.
<a href="http://cwe.mitre.org/data/definitions/444.html">CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')</a>
[openSUSE-SU-2015:0138]
[SUSE-SU-2015:0171]
[SUSE-SU-2015:0173]
[SUSE-SU-2015:0180]
[openSUSE-SU-2015:0404]
[DSA-3186]
[http://www.intelsecurity.com/resources/wp-berserk-analysis-part-1.pdf]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html]
[http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html]
[1032909]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1064670]
[https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.17.3_release_notes]
[https://www.imperialviolet.org/2014/09/26/pkcs1.html]
[https://www.reddit.com/r/netsec/comments/2hd1m8/rsa_signature_forgery_in_nss/cksnr02]
Bugzilla 2.x through 4.0.x before 4.0.15, 4.1.x and 4.2.x before 4.2.11, 4.3.x and 4.4.x before 4.4.6, and 4.5.x before 4.5.6 allows remote authenticated users to obtain sensitive private-comment information by leveraging a role as a flag recipient, related to Bug.pm, Flag.pm, and a mail template.
[http://advisories.mageia.org/MGASA-2014-0412.html]
[FEDORA-2014-12591]
[FEDORA-2014-12584]
[FEDORA-2014-12530]
[http://packetstormsecurity.com/files/128578/Bugzilla-Account-Creation-XSS-Information-Leak.html]
[http://www.bugzilla.org/security/4.0.14/]
[MDVSA-2014:200]
[1030978]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1064140]
The confirm_create_account function in the account-creation feature in token.cgi in Bugzilla 2.x through 4.0.x before 4.0.15, 4.1.x and 4.2.x before 4.2.11, 4.3.x and 4.4.x before 4.4.6, and 4.5.x before 4.5.6 does not specify a scalar context for the realname parameter, which allows remote attackers to create accounts with unverified e-mail addresses by sending three realname values with realname=login_name as the second, as demonstrated by selecting an e-mail address with a domain name for which group privileges are automatically granted.
[http://advisories.mageia.org/MGASA-2014-0412.html]
[http://blog.gerv.net/2014/10/new-class-of-vulnerability-in-perl-web-applications/]
[FEDORA-2014-12591]
[FEDORA-2014-12584]
[FEDORA-2014-12530]
[[oss-security] 20141007 "New Class of Vulnerability in Perl Web Applications"]
[http://packetstormsecurity.com/files/128578/Bugzilla-Account-Creation-XSS-Information-Leak.html]
[http://www.bugzilla.org/security/4.0.14/]
[MDVSA-2014:200]
[http://www.opennet.ru/opennews/art.shtml?num=40766]
[http://www.reddit.com/r/netsec/comments/2ihen0/new_class_of_vulnerability_in_perl_web/]
[1030978]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1074812]
[GLSA-201607-11]
Bugzilla 2.x through 4.0.x before 4.0.15, 4.1.x and 4.2.x before 4.2.11, 4.3.x and 4.4.x before 4.4.6, and 4.5.x before 4.5.6 does not ensure that a scalar context is used for certain CGI parameters, which allows remote attackers to conduct cross-site scripting (XSS) attacks by sending three values for a single parameter name.
[http://advisories.mageia.org/MGASA-2014-0412.html]
[http://blog.gerv.net/2014/10/new-class-of-vulnerability-in-perl-web-applications/]
[FEDORA-2014-12591]
[FEDORA-2014-12584]
[FEDORA-2014-12530]
[[oss-security] 20141007 "New Class of Vulnerability in Perl Web Applications"]
[http://packetstormsecurity.com/files/128578/Bugzilla-Account-Creation-XSS-Information-Leak.html]
[http://www.bugzilla.org/security/4.0.14/]
[MDVSA-2014:200]
[http://www.opennet.ru/opennews/art.shtml?num=40766]
[http://www.reddit.com/r/netsec/comments/2ihen0/new_class_of_vulnerability_in_perl_web/]
[70257]
[1030978]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1075578]
[GLSA-201607-11]
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 33.0, Firefox ESR 31.x before 31.2, and Thunderbird 31.x before 31.2 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
[FEDORA-2014-14084]
[FEDORA-2014-13042]
[openSUSE-SU-2015:0138]
[openSUSE-SU-2015:1266]
[openSUSE-SU-2014:1343]
[openSUSE-SU-2014:1344]
[openSUSE-SU-2014:1345]
[openSUSE-SU-2014:1346]
[RHSA-2014:1635]
[RHSA-2014:1647]
[DSA-3050]
[DSA-3061]
[http://www.mozilla.org/security/announce/2014/mfsa2014-74.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html]
[70436]
[1031028]
[1031030]
[USN-2372-1]
[USN-2373-1]
[https://advisories.mageia.org/MGASA-2014-0421.html]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1011354]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1061214]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1061600]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1064346]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1072044]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1072174]
[GLSA-201504-01]
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 33.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to improper interaction between threading and garbage collection in the GCRuntime::triggerGC function in js/src/jsgc.cpp, and unknown other vectors.
[FEDORA-2014-14084]
[FEDORA-2014-13042]
[openSUSE-SU-2014:1344]
[openSUSE-SU-2014:1345]
[http://www.mozilla.org/security/announce/2014/mfsa2014-74.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[70439]
[1031028]
[1031030]
[USN-2372-1]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1001994]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1018916]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1020034]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1023035]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1032208]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1033020]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1034230]
[GLSA-201504-01]
Heap-based buffer overflow in the nsTransformedTextRun function in Mozilla Firefox before 33.0, Firefox ESR 31.x before 31.2, and Thunderbird 31.x before 31.2 allows remote attackers to execute arbitrary code via Cascading Style Sheets (CSS) token sequences that trigger changes to capitalization style.
[FEDORA-2014-14084]
[FEDORA-2014-13042]
[openSUSE-SU-2015:0138]
[openSUSE-SU-2015:1266]
[openSUSE-SU-2014:1343]
[openSUSE-SU-2014:1344]
[openSUSE-SU-2014:1345]
[openSUSE-SU-2014:1346]
[RHSA-2014:1635]
[DSA-3050]
[DSA-3061]
[http://www.mozilla.org/security/announce/2014/mfsa2014-75.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html]
[70430]
[1031028]
[1031030]
[USN-2372-1]
[USN-2373-1]
[https://advisories.mageia.org/MGASA-2014-0421.html]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1041512]
[GLSA-201504-01]
The mozilla::dom::OscillatorNodeEngine::ComputeCustom function in the Web Audio subsystem in Mozilla Firefox before 33.0, Firefox ESR 31.x before 31.2, and Thunderbird 31.x before 31.2 allows remote attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read, memory corruption, and application crash) via an invalid custom waveform that triggers a calculation of a negative frequency value.
[FEDORA-2014-14084]
[FEDORA-2014-13042]
[openSUSE-SU-2015:0138]
[openSUSE-SU-2015:1266]
[openSUSE-SU-2014:1343]
[openSUSE-SU-2014:1344]
[openSUSE-SU-2014:1345]
[openSUSE-SU-2014:1346]
[RHSA-2014:1635]
[RHSA-2014:1647]
[DSA-3050]
[DSA-3061]
[http://www.mozilla.org/security/announce/2014/mfsa2014-76.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html]
[70440]
[1031028]
[1031030]
[USN-2372-1]
[USN-2373-1]
[https://advisories.mageia.org/MGASA-2014-0421.html]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1012609]
[GLSA-201504-01]
The get_tile function in Mozilla Firefox before 33.0, Firefox ESR 31.x before 31.2, and Thunderbird 31.x before 31.2 allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or possibly execute arbitrary code via WebM frames with invalid tile sizes that are improperly handled in buffering operations during video playback.
[FEDORA-2014-14084]
[FEDORA-2014-13042]
[openSUSE-SU-2015:0138]
[openSUSE-SU-2015:1266]
[openSUSE-SU-2014:1343]
[openSUSE-SU-2014:1344]
[openSUSE-SU-2014:1345]
[openSUSE-SU-2014:1346]
[RHSA-2014:1635]
[RHSA-2014:1647]
[DSA-3050]
[DSA-3061]
[http://www.mozilla.org/security/announce/2014/mfsa2014-77.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html]
[70428]
[1031028]
[1031030]
[USN-2372-1]
[USN-2373-1]
[https://advisories.mageia.org/MGASA-2014-0421.html]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1063327]
[GLSA-201504-01]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2014. Notes: none.
Mozilla Firefox before 33.0 does not properly initialize memory for GIF images, which allows remote attackers to obtain sensitive information from process memory via a crafted web page that triggers a sequence of rendering operations for truncated GIF data within a CANVAS element.
[FEDORA-2014-14084]
[FEDORA-2014-13042]
[openSUSE-SU-2014:1344]
[openSUSE-SU-2014:1345]
[http://www.mozilla.org/security/announce/2014/mfsa2014-78.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[70431]
[1031028]
[USN-2372-1]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1063733]
[GLSA-201504-01]
Use-after-free vulnerability in DirectionalityUtils.cpp in Mozilla Firefox before 33.0, Firefox ESR 31.x before 31.2, and Thunderbird 31.x before 31.2 allows remote attackers to execute arbitrary code via text that is improperly handled during the interaction between directionality resolution and layout.
<a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a>
[FEDORA-2014-14084]
[FEDORA-2014-13042]
[openSUSE-SU-2015:0138]
[openSUSE-SU-2015:1266]
[openSUSE-SU-2014:1343]
[openSUSE-SU-2014:1344]
[openSUSE-SU-2014:1345]
[openSUSE-SU-2014:1346]
[RHSA-2014:1635]
[RHSA-2014:1647]
[DSA-3050]
[DSA-3061]
[http://www.mozilla.org/security/announce/2014/mfsa2014-79.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html]
[70426]
[1031028]
[1031030]
[USN-2372-1]
[USN-2373-1]
[https://advisories.mageia.org/MGASA-2014-0421.html]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1068218]
[GLSA-201504-01]
The Public Key Pinning (PKP) implementation in Mozilla Firefox before 33.0 does not properly consider the connection-coalescing behavior of SPDY and HTTP/2 in the case of a shared IP address, which allows man-in-the-middle attackers to bypass an intended pinning configuration and spoof a web site by providing a valid certificate from an arbitrary recognized Certification Authority.
[FEDORA-2014-14084]
[FEDORA-2014-13042]
[openSUSE-SU-2014:1344]
[openSUSE-SU-2014:1345]
[http://www.mozilla.org/security/announce/2014/mfsa2014-80.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[70432]
[1031028]
[USN-2372-1]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1049095]
[GLSA-201504-01]
The Alarm API in Mozilla Firefox before 33.0 and Firefox ESR 31.x before 31.2 does not properly restrict toJSON calls, which allows remote attackers to bypass the Same Origin Policy via crafted API calls that access sensitive information within the JSON data of an alarm.
[FEDORA-2014-14084]
[FEDORA-2014-13042]
[openSUSE-SU-2014:1344]
[openSUSE-SU-2014:1345]
[RHSA-2014:1635]
[DSA-3050]
[http://www.mozilla.org/security/announce/2014/mfsa2014-82.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html]
[70424]
[1031028]
[1031030]
[USN-2372-1]
[https://advisories.mageia.org/MGASA-2014-0421.html]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1015540]
[GLSA-201504-01]
The Public Key Pinning (PKP) implementation in Mozilla Firefox before 33.0 skips pinning checks upon an unspecified issuer-verification error, which makes it easier for remote attackers to bypass an intended pinning configuration and spoof a web site via a crafted certificate that leads to presentation of the Untrusted Connection dialog to the user.
[FEDORA-2014-14084]
[FEDORA-2014-13042]
[openSUSE-SU-2014:1344]
[openSUSE-SU-2014:1345]
[http://www.mozilla.org/security/announce/2014/mfsa2014-80.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[70434]
[1031028]
[USN-2372-1]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1066190]
[GLSA-201504-01]
The WebRTC video-sharing feature in dom/media/MediaManager.cpp in Mozilla Firefox before 33.0, Firefox ESR 31.x before 31.2, and Thunderbird 31.x before 31.2 does not properly recognize Stop Sharing actions for videos in IFRAME elements, which allows remote attackers to obtain sensitive information from the local camera by maintaining a session after the user tries to discontinue streaming.
[FEDORA-2014-14084]
[FEDORA-2014-13042]
[openSUSE-SU-2015:0138]
[openSUSE-SU-2015:1266]
[openSUSE-SU-2014:1343]
[openSUSE-SU-2014:1344]
[openSUSE-SU-2014:1345]
[openSUSE-SU-2014:1346]
[DSA-3050]
[DSA-3061]
[http://www.mozilla.org/security/announce/2014/mfsa2014-81.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html]
[70425]
[1031028]
[1031030]
[USN-2372-1]
[USN-2373-1]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1062876]
[GLSA-201504-01]
content/base/src/nsDocument.cpp in Mozilla Firefox before 33.0, Firefox ESR 31.x before 31.2, and Thunderbird 31.x before 31.2 does not consider whether WebRTC video sharing is occurring, which allows remote attackers to obtain sensitive information from the local camera in certain IFRAME situations by maintaining a session after the user temporarily navigates away.
[FEDORA-2014-14084]
[FEDORA-2014-13042]
[openSUSE-SU-2015:0138]
[openSUSE-SU-2015:1266]
[openSUSE-SU-2014:1343]
[openSUSE-SU-2014:1344]
[openSUSE-SU-2014:1345]
[openSUSE-SU-2014:1346]
[DSA-3050]
[DSA-3061]
[http://www.mozilla.org/security/announce/2014/mfsa2014-81.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html]
[70427]
[1031028]
[1031030]
[USN-2372-1]
[USN-2373-1]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1062981]
[GLSA-201504-01]
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 34.0, Firefox ESR 31.x before 31.3, Thunderbird before 31.3, and SeaMonkey before 2.31 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
[openSUSE-SU-2015:0138]
[openSUSE-SU-2015:1266]
[DSA-3090]
[DSA-3092]
[http://www.mozilla.org/security/announce/2014/mfsa2014-83.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html]
[71391]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1042567]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1072847]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1079729]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1080312]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1089207]
[GLSA-201504-01]
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 34.0 and SeaMonkey before 2.31 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
[http://www.mozilla.org/security/announce/2014/mfsa2014-83.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1013001]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1023158]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1026037]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1037830]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1048517]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1064835]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1073577]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1075546]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1077687]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1086842]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1096026]
[GLSA-201504-01]
Mozilla Firefox before 34.0 and SeaMonkey before 2.31 provide stylesheets with an incorrect primary namespace, which allows remote attackers to bypass intended access restrictions via an XBL binding.
[http://www.mozilla.org/security/announce/2014/mfsa2014-84.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1043787]
[GLSA-201504-01]
The XMLHttpRequest.prototype.send method in Mozilla Firefox before 34.0, Firefox ESR 31.x before 31.3, Thunderbird before 31.3, and SeaMonkey before 2.31 allows remote attackers to cause a denial of service (application crash) via a crafted JavaScript object.
[openSUSE-SU-2015:0138]
[openSUSE-SU-2015:1266]
[DSA-3090]
[DSA-3092]
[http://www.mozilla.org/security/announce/2014/mfsa2014-85.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html]
[71397]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1087633]
[GLSA-201504-01]
Mozilla Firefox 33.0 and SeaMonkey before 2.31 include path strings in CSP violation reports, which allows remote attackers to obtain sensitive information via a web site that receives a report after a redirect.
[http://www.mozilla.org/security/announce/2014/mfsa2014-86.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1069762]
[GLSA-201504-01]
Use-after-free vulnerability in the nsHtml5TreeOperation function in xul.dll in Mozilla Firefox before 34.0, Firefox ESR 31.x before 31.3, Thunderbird before 31.3, and SeaMonkey before 2.31 allows remote attackers to execute arbitrary code by adding a second root element to an HTML5 document during parsing.
<a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a>
[openSUSE-SU-2015:0138]
[openSUSE-SU-2015:1266]
[DSA-3090]
[DSA-3092]
[http://www.mozilla.org/security/announce/2014/mfsa2014-87.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html]
[71398]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1088635]
[GLSA-201504-01]
Stack-based buffer overflow in the mozilla::FileBlockCache::Read function in Mozilla Firefox before 34.0, Firefox ESR 31.x before 31.3, Thunderbird before 31.3, and SeaMonkey before 2.31 allows remote attackers to execute arbitrary code via crafted media content.
[openSUSE-SU-2015:0138]
[openSUSE-SU-2015:1266]
[DSA-3090]
[DSA-3092]
[http://www.mozilla.org/security/announce/2014/mfsa2014-88.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html]
[71395]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1085175]
[GLSA-201504-01]
Mozilla Firefox before 34.0, Firefox ESR 31.x before 31.3, Thunderbird before 31.3, and SeaMonkey before 2.31 might allow remote attackers to execute arbitrary code by leveraging an incorrect cast from the BasicThebesLayer data type to the BasicContainerLayer data type.
[openSUSE-SU-2015:0138]
[openSUSE-SU-2015:1266]
[DSA-3090]
[DSA-3092]
[http://www.mozilla.org/security/announce/2014/mfsa2014-89.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html]
[71396]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1074280]
[GLSA-201504-01]
Mozilla Firefox before 34.0, Firefox ESR 31.x before 31.3, and Thunderbird before 31.3 on Apple OS X 10.10 omit a CoreGraphics disable-logging action that is needed by jemalloc-based applications, which allows local users to obtain sensitive information by reading /tmp files, as demonstrated by credential information.
[APPLE-SA-2015-01-27-4]
[http://support.apple.com/HT204244]
[http://www.mozilla.org/security/announce/2014/mfsa2014-90.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[http://www.reddit.com/r/netsec/comments/2ocxac/apple_coregraphics_framework_on_os_x_1010_is/]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1092855]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2014. Notes: none.
SQL injection vulnerability in the CMDB web application in synetics i-doit pro before 1.2.5 and i-doit open allows remote attackers to execute arbitrary SQL commands via the objID parameter to the default URI.
[20140217 SQL Injection i-doit Pro (CVE-2014-1597)]
[http://www.csnc.ch/misc/files/advisories/CVE-2014-1597_i-doit_SQL_Injection.txt]
[http://www.i-doit.com/en/company/news/single-news/?tx_ttnews%5Btt_news%5D=141]
[65557]
[idoit-cve20141597-sql-injection(91269)]
Multiple cross-site scripting (XSS) vulnerabilities in the SFR Box router with firmware NB6-MAIN-R3.3.4 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters to (1) dns, (2) dhcp, (3) nat, (4) route, or (5) lan in network/; or (6) wifi/config.
[20140305 CVE-2014-1599 - 39 Type-1 XSS in SFR DSL/Fiber Box]
[65973]
Multiple cross-site scripting (XSS) vulnerabilities in GetSimple CMS 3.3.1 allow remote attackers to inject arbitrary web script or HTML via the (1) param parameter to admin/load.php or (2) user, (3) email, or (4) name parameter in a Save Settings action to admin/settings.php.
[20140513 [CVE-2014-1603] XSS in GetSimple CMS 3.3.1]
[67337]
[https://raw.githubusercontent.com/pedrib/PoC/master/getsimplecms-3.3.1.txt]
The parser cache functionality in parsergenerator.py in RPLY (aka python-rply) before 0.7.1 allows local users to spoof cache data by pre-creating a temporary rply-*.json file with a predictable name.
[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=735263]
[[oss-security] 20140114 Fwd: [Python-modules-team] Bug#735263: python-rply: insecure use of /tmp]
[[oss-security] 20140117 Re: Fwd: [Python-modules-team] Bug#735263: python-rply: insecure use of /tmp]
[rply-cve20141604-insecure-permissions(90593)]
[https://github.com/alex/rply/commit/fc9bbcd25b0b4f09bbd6339f710ad24c129d5d7c]
** DISPUTED ** Cross-site scripting (XSS) vulnerability in the EventCalendar module for Drupal 7.14 allows remote attackers to inject arbitrary web script or HTML via the year parameter to eventcalander/. NOTE: this issue has been disputed by the Drupal Security Team; it may be site-specific. If so, then this CVE will be REJECTed in the future.
[20140123 [CVE-2014-1607.] Cross Site Scripting(XSS) in Drupal Event calendar module]
[https://groups.drupal.org/node/402023]
SQL injection vulnerability in the mci_file_get function in api/soap/mc_file_api.php in MantisBT before 1.2.16 allows remote attackers to execute arbitrary SQL commands via a crafted envelope tag in a mc_issue_attachment_get SOAP request.
[61432]
[DSA-3030]
[http://www.mantisbt.org/bugs/view.php?id=16879]
[http://www.ocert.org/advisories/ocert-2014-001.html]
[65445]
[https://bugzilla.redhat.com/show_bug.cgi?id=1063111]
[https://github.com/mantisbt/mantisbt/commit/00b4c17088fa56594d85fe46b6c6057bb3421102]
Multiple SQL injection vulnerabilities in MantisBT before 1.2.16 allow remote attackers to execute arbitrary SQL commands via unspecified parameters to the (1) mc_project_get_attachments function in api/soap/mc_project_api.php; the (2) news_get_limited_rows function in core/news_api.php; the (3) summary_print_by_enum, (4) summary_print_by_age, (5) summary_print_by_developer, (6) summary_print_by_reporter, or (7) summary_print_by_category function in core/summary_api.php; the (8) create_bug_enum_summary or (9) enum_bug_group function in plugins/MantisGraph/core/graph_api.php; (10) bug_graph_bycategory.php or (11) bug_graph_bystatus.php in plugins/MantisGraph/pages/; or (12) proj_doc_page.php, related to use of the db_query function, a different vulnerability than CVE-2014-1608.
[61432]
[DSA-3030]
[http://www.mantisbt.org/bugs/view.php?id=16880]
[http://www.ocert.org/advisories/ocert-2014-001.html]
[65461]
[https://bugzilla.redhat.com/show_bug.cgi?id=1063111]
[https://github.com/mantisbt/mantisbt/commit/7efe0175f0853e18ebfacedfd2374c4179028b3f]
MediaWiki 1.22.x before 1.22.2, 1.21.x before 1.21.5, and 1.19.x before 1.19.11, when DjVu or PDF file upload support is enabled, allows remote attackers to execute arbitrary commands via shell metacharacters in (1) the page parameter to includes/media/DjVu.php; (2) the w parameter (aka width field) to thumb.php, which is not properly handled by includes/media/PdfHandler_body.php; and possibly unspecified vectors in (3) includes/media/Bitmap.php and (4) includes/media/ImageHandler.php.
[FEDORA-2014-1802]
[FEDORA-2014-1745]
[[MediaWiki-announce] 20140128 MediaWiki Security Releases: 1.22.2, 1.21.5 and 1.19.11]
[http://www.checkpoint.com/defense/advisories/public/2014/cpai-26-jan.html]
[http://www.checkpoint.com/threatcloud-central/articles/2014-01-28-tc-researchers-discover.html]
[DSA-2891]
[31329]
[65223]
[1029707]
[https://bugzilla.wikimedia.org/attachment.cgi?id=14361&action=diff]
[https://bugzilla.wikimedia.org/attachment.cgi?id=14384&action=diff]
[https://bugzilla.wikimedia.org/show_bug.cgi?id=60339]
[https://gerrit.wikimedia.org/r/#/c/110069/]
[https://gerrit.wikimedia.org/r/#/c/110069/2/includes/media/Bitmap.php]
[https://gerrit.wikimedia.org/r/#/c/110215/]
Cross-site scripting (XSS) vulnerability in the Anonymous Posting module 7.x-1.2 and 7.x-1.3 for Drupal allows remote attackers to inject arbitrary web script or HTML via the contact name field.
[http://packetstormsecurity.com/files/124803/Drupal-Anonymous-Posting-7.x-Cross-Site-Scripting.html]
[20140115 [Security-news] SA-CONTRIB-2014-002 - Anonymous Posting - Cross Site Scripting (XSS)]
[https://drupal.org/node/2173321]
[https://drupal.org/node/2173437]
[anonymousposting-contactname-xss(90526)]
Cross-site scripting (XSS) vulnerability in login.esp in the Web Management Interface in Media5 Mediatrix 4402 VoIP Gateway with firmware Dgw 1.1.13.186 and earlier allows remote attackers to inject arbitrary web script or HTML via the username parameter.
[http://packetstormsecurity.com/files/124931/Mediatrix-4402-Cross-Site-Scripting.html]
[VU#252294]
[20140123 Reflected cross-site scripting (XSS) vulnerability in Mediatrix Web Management Interface login page]
[65108]
[mediatrixwebmanagement-cve20141612-xss(90656)]
Dotclear before 2.6.2 allows remote attackers to execute arbitrary PHP code via a serialized object in the dc_passwd cookie to a password-protected page, which is not properly handled by (1) inc/public/lib.urlhandlers.php or (2) plugins/pages/_public.php.
[http://dotclear.org/blog/post/2014/01/20/Dotclear-2.6.2]
[https://labs.mwrinfosecurity.com/advisories/2014/05/14/dotclear-php-object-injection/]
Multiple cross-site request forgery (CSRF) vulnerabilities in Carbon Black before 4.1.0 allow remote attackers to hijack the authentication of administrators for requests that add new administrative users and have other unspecified action, as demonstrated by a request to api/user.
[http://www.secureworks.com/advisories/SWRX-2014-007/SWRX-2014-007.pdf]
Multiple SQL injection vulnerabilities in UAEPD Shopping Cart Script allow remote attackers to execute arbitrary SQL commands via the (1) cat_id or (2) p_id parameter to products.php or id parameter to (3) page.php or (4) news.php.
[http://packetstormsecurity.com/files/124723/uaepdshopping-sql.txt]
[http://www.iphobos.com/blog/2014/01/04/uaepd-script-multiple-sql-injection-vulnerabilty]
[64734]
[uaepd-multiple-sql-injection(90214)]
Multiple SQL injection vulnerabilities in Cubic CMS 5.1.1, 5.1.2, and 5.2 allow remote attackers to execute arbitrary SQL commands via the (1) resource_id or (2) version_id parameter to recursos/agent.php or (3) login or (4) pass parameter to login.usuario.
[http://packetstormsecurity.com/files/124652]
[http://www.cubicfactory.com/es/cubic-cms/changelog/id/260]
[cubiccms-agent-login-sql-injection(90153)]
Multiple cross-site scripting (XSS) vulnerabilities in add.php in HIOX Guest Book (HGB) 5.0 allow remote attackers to inject arbitrary web script or HTML via the (1) name1, (2) email, or (3) cmt parameter.
[http://packetstormsecurity.com/files/124681/Hiox-Guest-Book-5.0-Cross-Site-Scripting.html]
[64683]
[hiox-guestbook-add-xss(90156)]
Race condition in the xdg.BaseDirectory.get_runtime_dir function in python-xdg 0.25 allows local users to overwrite arbitrary files by pre-creating /tmp/pyxdg-runtime-dir-fallback-victim to point to a victim-owned location, then replacing it with a symlink to an attacker-controlled location once the get_runtime_dir function is called.
[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=736247]
[[oss-security] 20140121 Fwd: [Python-modules-team] Bug#736247: python-xdg: get_runtime_dir(strict=False): insecure use of /tmp]
[[oss-security] 20140121 Re: Fwd: [Python-modules-team] Bug#736247: python-xdg: get_runtime_dir(strict=False): insecure use of /tmp]
[65042]
[pythonxdg-cve20141624-symlink(90618)]
XML External Entity (XXE) vulnerability in MARC::File::XML module before 1.0.2 for Perl, as used in Evergreen, Koha, perl4lib, and possibly other products, allows context-dependent attackers to read arbitrary files via a crafted XML file.
[[OPEN-ILS-GENERAL] 20140121 SECURITY release: MARC::File::XML 1.0.2]
[[Koha] 20140122 SECURITY release: MARC::File::XML 1.0.2]
[http://www.nntp.perl.org/group/perl.perl4lib/2014/01/msg3073.html]
[65057]
[marcfile-xml-info-disc(90620)]
[https://metacpan.org/source/GMCHARLT/MARC-XML-1.0.2/Changes]
Eventum before 2.3.5 allows remote attackers to reinstall the application via direct request to /setup/index.php.
[http://bazaar.launchpad.net/~eventum-developers/eventum/trunk/revision/4666]
[20140127 Multiple Vulnerabilities in Eventum]
[https://bugs.launchpad.net/eventum/+bug/1271499]
[https://www.htbridge.com/advisory/HTB23198]
htdocs/setup/index.php in Eventum before 2.3.5 allows remote attackers to inject and execute arbitrary PHP code via the hostname parameter.
[http://bazaar.launchpad.net/~eventum-developers/eventum/trunk/revision/4665]
[20140127 Multiple Vulnerabilities in Eventum]
[https://bugs.launchpad.net/eventum/+bug/1271499]
[https://www.htbridge.com/advisory/HTB23198]
Buffer overflow in login.cgi in MiniHttpd in Belkin N750 Router with firmware before F9K1103_WW_1.10.17m allows remote attackers to execute arbitrary code via a long string in the jump parameter.
[http://www.belkin.com/us/support-article?articleNum=4831]
[35184]
[70977]
[1031210]
[https://labs.integrity.pt/advisories/cve-2014-1635/]
[https://labs.integrity.pt/articles/from-0-day-to-exploit-buffer-overflow-in-belkin-n750-cve-2014-1635/]
Multiple SQL injection vulnerabilities in Command School Student Management System 1.06.01 allow remote attackers to execute arbitrary SQL commands via the id parameter in an edit action to (1) admin_school_names.php, (2) admin_subjects.php, (3) admin_grades.php, (4) admin_terms.php, (5) admin_school_years.php, (6) admin_sgrades.php, (7) admin_media_codes_1.php, (8) admin_infraction_codes.php, (9) admin_generations.php, (10) admin_relations.php, (11) admin_titles.php, or (12) health_allergies.php in sw/.
[http://packetstormsecurity.com/files/124708/Command-School-Student-Management-System-1.06.01-SQL-Injection-CSRF-XSS.html]
[64707]
[commandschool-id-sql-injection(90175)]
Command School Student Management System 1.06.01 does not properly restrict access to sw/backup/backup_ray2.php, which allows remote attackers to download a database backup via a direct request.
[http://packetstormsecurity.com/files/124708/Command-School-Student-Management-System-1.06.01-SQL-Injection-CSRF-XSS.html]
[64707]
(1) debian/postrm and (2) debian/localepurge.config in localepurge before 0.7.3.2 use tempfile to create a safe temporary file but appends a suffix to the original filename and writes to this new filename, which allows local users to overwrite arbitrary files via a symlink attack on the new filename.
[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=736359]
[[oss-security] 20140122 Getting tempfile/mktemp wrong]
[[oss-security] 20140122 Re: Getting tempfile/mktemp wrong]
[65098]
[localepurge-cve20141638-symlink(90669)]
syncevo/installcheck-local.sh in syncevolution before 1.3.99.7 uses mktemp to create a safe temporary file but appends a suffix to the original filename and writes to this new filename, which allows local users to overwrite arbitrary files via a symlink attack on the new filename.
[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=736357]
[[oss-security] 20140122 Getting tempfile/mktemp wrong]
[[oss-security] 20140122 Re: Getting tempfile/mktemp wrong]
[65098]
[syncevolution-cve20141639-symlink(90662)]
axiom-test.sh in axiom 20100701-1.1 uses tempfile to create a safe temporary file but appends a suffix to the original filename and writes to this new filename, which allows local users to overwrite arbitrary files via a symlink attack on the new filename.
[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=736358]
[[oss-security] 20140122 Getting tempfile/mktemp wrong]
[[oss-security] 20140122 Re: Getting tempfile/mktemp wrong]
[axiom-cve20141640-symlink(90663)]
The IRQ setup in Xen 4.2.x and 4.3.x, when using device passthrough and configured to support a large number of CPUs, frees certain memory that may still be intended for use, which allows local guest administrators to cause a denial of service (memory corruption and hypervisor crash) and possibly execute arbitrary code via vectors related to an out-of-memory error that triggers a (1) use-after-free or (2) double free.
[FEDORA-2014-1559]
[FEDORA-2014-1552]
[SUSE-SU-2014:0373]
[GLSA-201407-03]
[[oss-security] 20140123 Xen Security Advisory 83 (CVE-2014-1642) - Out-of-memory condition yielding memory corruption during IRQ setup]
[65097]
[1029679]
[http://xenbits.xen.org/xsa/advisory-83.html]
[xen-irq-cve20141642-code-exec(90649)]
The Web Email Protection component in Symantec Encryption Management Server (aka PGP Universal Server) before 3.3.2 allows remote authenticated users to read the stored outbound e-mail messages of arbitrary users via a modified URL.
[65300]
[1029729]
[http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20140205_00]
[symantec-cve20141643-info-disc(90946)]
The forgotten-password feature in forcepasswd.do in the management GUI in Symantec LiveUpdate Administrator (LUA) 2.x before 2.3.2.110 allows remote attackers to reset arbitrary passwords by providing the e-mail address associated with a user account.
[20140328 SEC Consult SA-20140328-0 :: Multiple vulnerabilities in Symantec LiveUpdate Administrator]
[66399]
[http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20140327_00]
[https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140328-0_Symantec_LiveUpdate_Administrator_Multiple_vulnerabilities_wo_poc_v10.txt]
SQL injection vulnerability in forcepasswd.do in the management GUI in Symantec LiveUpdate Administrator (LUA) 2.x before 2.3.2.110 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
[20140328 SEC Consult SA-20140328-0 :: Multiple vulnerabilities in Symantec LiveUpdate Administrator]
[66400]
[http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20140327_00]
[https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140328-0_Symantec_LiveUpdate_Administrator_Multiple_vulnerabilities_wo_poc_v10.txt]
Symantec PGP Desktop 10.0.x through 10.2.x and Encryption Desktop Professional 10.3.x before 10.3.2 MP1 do not properly perform memory copies, which allows remote attackers to cause a denial of service (read access violation and application crash) via a malformed certificate.
[67016]
[http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20140423_00]
Symantec PGP Desktop 10.0.x through 10.2.x and Encryption Desktop Professional 10.3.x before 10.3.2 MP1 do not properly perform block-data moves, which allows remote attackers to cause a denial of service (read access violation and application crash) via a malformed certificate.
[67020]
[http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20140423_00]
Cross-site scripting (XSS) vulnerability in brightmail/setting/compliance/DlpConnectFlow$view.flo in the management console in Symantec Messaging Gateway 10.x before 10.5.2 allows remote attackers to inject arbitrary web script or HTML via the displayTab parameter.
[20140422 (CVE-2014-1648) Symantec Messaging Gateway Management Console Cross Site Scripting Vulnerability]
[66966]
[1030136]
[http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20140422_00]
The server in Symantec Workspace Streaming (SWS) before 7.5.0.749 allows remote attackers to access files and functionality by sending a crafted XMLRPC request over HTTPS.
[33521]
[67189]
[http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20140512_00]
[http://zerodayinitiative.com/advisories/ZDI-14-127/]
SQL injection vulnerability in user.php in the management console in Symantec Web Gateway (SWG) before 5.2.1 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
[67753]
[1030443]
[http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=securit%20y_advisory&pvid=security_advisory&year=&suid=20140616_00]
[http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2014&suid=20140616_00]
SQL injection vulnerability in clientreport.php in the management console in Symantec Web Gateway (SWG) before 5.2 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
[VU#719172]
[67754]
[1030443]
[http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=securit%20y_advisory&pvid=security_advisory&year=&suid=20140616_00]
[http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2014&suid=20140616_00]
Multiple cross-site scripting (XSS) vulnerabilities in the management console in Symantec Web Gateway (SWG) before 5.2 allow remote authenticated users to inject arbitrary web script or HTML via unspecified report parameters.
[VU#719172]
[67755]
[1030443]
[http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=securit%20y_advisory&pvid=security_advisory&year=&suid=20140616_00]
[http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2014&suid=20140616_00]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2014. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2014. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2014. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2014. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2014. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2014. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2014. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2014. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2014. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2014. Notes: none.
Unspecified vulnerability in Citrix XenMobile Device Manager server (formerly Zenprise Device Manager server) 8.5, 8.6, and MDM 8.0.1 allows remote attackers to obtain sensitive information via unknown vectors.
[102884]
[http://support.citrix.com/article/CTX140044]
[65348]
[1029728]
[citrix-xenmobile-cve20141663-info-disc(90959)]
The Citrix GoToMeeting application 5.0.799.1238 for Android logs HTTP requests containing sensitive information, which allows attackers to obtain user IDs, meeting details, and authentication tokens via an application that reads the system log file.
[20140124 [CVE-2014-1664] GoToMeeting Information Disclosure via Logging Output (Android)]
[65123]
[gotomeeting-cve20141664-info-disc(90695)]
Cross-site scripting (XSS) vulnerability in ownCloud before 6.0.1 allows remote authenticated users to inject arbitrary web script or HTML via the filename of an uploaded file.
[http://blog.noobroot.com/2014/02/owncloud-600a-when-xss-vulnerability.html]
[65457]
[owncloud-indexphp-xss(91012)]
[https://packetstormsecurity.com/files/125086]
[31427]
The do_physdev_op function in Xen 4.1.5, 4.1.6.1, 4.2.2 through 4.2.3, and 4.3.x does not properly restrict access to the (1) PHYSDEVOP_prepare_msix and (2) PHYSDEVOP_release_msix operations, which allows local PV guests to cause a denial of service (host or guest malfunction) or possibly gain privileges via unspecified vectors.
[FEDORA-2014-1559]
[FEDORA-2014-1552]
[SUSE-SU-2014:0372]
[SUSE-SU-2014:0373]
[GLSA-201407-03]
[http://support.citrix.com/article/CTX200288]
[[oss-security] 20140123 Xen Security Advisory 87 (CVE-2014-1666) - PHYSDEVOP_{prepare,release}_msix exposed to unprivileged guests]
[65125]
[1029684]
[http://xenbits.xen.org/xsa/advisory-87.html]
[http://xenbits.xen.org/xsa/xsa87-unstable-4.3.patch]
[xen-cve20141666-priv-esc(90675)]
The Microsoft Bing application before 4.2.1 for Android allows remote attackers to install arbitrary APK files via vectors involving a crafted DNS response.
[http://blog.trustlook.com/2014/01/23/trustlook-reported-microsofts-first-ever-android-vulnerability/]
[65128]
[http://www.youtube.com/watch?v=_j1RKtTxZ3k]
[ms-bing-cve20141670-code-exec(90977)]
[https://play.google.com/store/apps/details?id=com.microsoft.bing]
Multiple SQL injection vulnerabilities in Dell KACE K1000 5.4.76847 and possibly earlier allow remote attackers or remote authenticated users to execute arbitrary SQL commands via the macAddress element in a (1) getUploadPath or (2) getKBot SOAP request to service/kbot_service.php; the ID parameter to (3) userui/advisory_detail.php or (4) userui/ticket.php; and the (5) ORDER[] parameter to userui/ticket_list.php.
[http://www.baesystemsdetica.com.au/Research/Advisories/Dell-KACE-K1000-SQL-Injection-(DS-2014-001)]
[65029]
[kace-multiple-sql-injection(90592)]
Check Point R75.47 Security Gateway and Management Server does not properly enforce Anti-Spoofing when the routing table is modified and the "Get - Interfaces with Topology" action is performed, which allows attackers to bypass intended access restrictions.
Per: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk98087
"This issue affects only R75.47 Security Gateway and R75.47 Management Server."
[checkpoint-gateway-cve20141672-sec-bypass(90976)]
[https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk98087]
Check Point Session Authentication Agent allows remote attackers to obtain sensitive information (user credentials) via unspecified vectors.
[http://packetstormsecurity.com/files/124967]
[20140127 [CVE-2014-1673] Check Point Session Authentication Agent vulnerability]
[check-point-cve20141673-unauth-access(90746)]
[https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk98263]
Technicolor TC7200 with firmware STD6.01.12 could allow remote attackers to obtain sensitive information.
[20160725 [SEARCH-LAB advisory] Technicolor TC7200 modem/router multiple vulnerabilities]
[31894]
[20160720 [SEARCH-LAB advisory] Technicolor TC7200 modem/router multiple vulnerabilities]
[tc7200-cve20141677-info-disc(91578)]
[https://packetstormsecurity.com/files/125388]
Cross-site scripting (XSS) vulnerability in Open-Xchange (OX) AppSuite before 7.2.2-rev31, 7.4.0 before 7.4.0-rev27, and 7.4.1 before 7.4.1-rev17 allows remote attackers to inject arbitrary web script or HTML via the header in an attached SVG file.
[20140210 Open-Xchange Security Advisory 2014-02-10]
[openxchange-cve20141679-xss(91059)]
[https://forum.open-xchange.com/showthread.php?8259-Open-Xchange-releases-Security-Patch-2014-01-29-for-v7-2-2-v7-4-0-and-v7-4-1]
Untrusted search path vulnerability in Bandisoft Bandizip before 3.10 allows local users to gain privileges via a Trojan horse dwmapi.dll file in the current working directory.
Per: http://cwe.mitre.org/data/definitions/426.html
"CWE-426: Untrusted Search Path"
[http://packetstormsecurity.com/files/125059]
[http://www.bandisoft.com/bandizip/history]
[bandzip-dll-cve20141680-code-exec(90966)]
Multiple unspecified vulnerabilities in Google Chrome before 32.0.1700.102 have unknown impact and attack vectors, related to 12 "security fixes [that were not] either contributed by external researchers or particularly interesting."
[http://googlechromereleases.blogspot.com/2014/01/stable-channel-update_27.html]
[google-chrome-cve20141681-unspec(90975)]
The API in Zabbix before 1.8.20rc1, 2.0.x before 2.0.11rc1, and 2.2.x before 2.2.2rc1 allows remote authenticated users to spoof arbitrary users via the user name in a user.login request.
[FEDORA-2014-5551]
[FEDORA-2014-5540]
[65402]
[https://support.zabbix.com/browse/ZBX-7703]
The bashMail function in cms/data/skins/techjunkie/fragments/contacts/functions.php in SkyBlueCanvas CMS before 1.1 r248-04, when the pid parameter is 4, allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) name, (2) email, (3) subject, or (4) message parameter to index.php.
[http://packetstormsecurity.com/files/124948/SkyBlueCanvas-CMS-1.1-r248-03-Command-Injection.html]
[20140123 Remote Command Injection Vulnerability in SkyBlueCanvas CMS]
[31183]
[31432]
[65129]
[skybluecanvas-index-command-exec(90670)]
The ASF_ReadObject_file_properties function in modules/demux/asf/libasf.c in the ASF Demuxer in VideoLAN VLC Media Player before 2.1.3 allows remote attackers to cause a denial of service (divide-by-zero error and crash) via a zero minimum and maximum data packet size in an ASF file.
[http://git.videolan.org/gitweb.cgi/vlc.git/?p=vlc.git;a=commitdiff;h=98787d0843612271e99d62bee0dfd8197f0cf404]
[http://www.elsherei.com/?p=269]
[GLSA-201603-08]
[https://trac.videolan.org/vlc/ticket/10482]
The Frontend in Zabbix before 1.8.20rc2, 2.0.x before 2.0.11rc2, and 2.2.x before 2.2.2rc1 allows remote "Zabbix Admin" users to modify the media of arbitrary users via unspecified vectors.
[FEDORA-2014-5551]
[FEDORA-2014-5540]
[https://support.zabbix.com/browse/ZBX-7693]
MediaWiki 1.18.0 allows remote attackers to obtain the installation path via vectors related to thumbnail creation.
[20140312 CVE-2014-1686 -- Information disclosure: webserver source path in Mediawiki 1.18.0]
[66141]
[mediawiki-cve20141686-path-disclosure(91847)]
[https://packetstormsecurity.com/files/125682]
The help function in net/netfilter/nf_nat_irc.c in the Linux kernel before 3.12.8 allows remote attackers to obtain sensitive information from kernel memory by establishing an IRC DCC session in which incorrect packet data is transmitted during use of the NAT mangle feature.
[http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=2690d97ade05c5325cbf7c72b94b90d265659886]
[http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.12.8]
[[oss-security] 20140128 Re: CVE request Linux kernel: netfilter: nf_nat: leakage of uninitialized buffer in IRC NAT helper]
[USN-2137-1]
[USN-2140-1]
[USN-2158-1]
[https://bugzilla.redhat.com/show_bug.cgi?id=1058748]
[https://github.com/torvalds/linux/commit/2690d97ade05c5325cbf7c72b94b90d265659886]
The framework/Util/lib/Horde/Variables.php script in the Util library in Horde before 5.1.1 allows remote attackers to conduct object injection attacks and execute arbitrary PHP code via a crafted serialized object in the _formvars form.
[[oss-security] 20140128 Remote code execution in horde < 5.1.1]
[[oss-security] 20140128 Re: Remote code execution in horde < 5.1.1]
[[oss-security] 20140129 Re: Remote code execution in horde < 5.1.1]
[DSA-2853]
[https://github.com/horde/horde/blob/82c400788537cfc0106b68447789ff53793ac086/bundles/groupware/docs/CHANGES#L215]
[https://github.com/horde/horde/commit/da6afc7e9f4e290f782eca9dbca794f772caccb3]
The hash_buffer function in schnorr.c in OpenSSH through 6.4, when Makefile.inc is modified to enable the J-PAKE protocol, does not initialize certain data structures, which might allow remote attackers to cause a denial of service (memory corruption) or have unspecified other impact via vectors that trigger an error condition.
[SSRT101487]
[HPSBMU03409]
[[oss-security] 20140129 Re: OpenSSH J-PAKE vulnerability (no cause for panic! remain calm!)]
[[oss-security] 20140128 OpenSSH J-PAKE vulnerability (no cause for panic! remain calm!)]
[60184]
[http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/Attic/schnorr.c.diff?r1=1.9;r2=1.10;f=h]
[http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/schnorr.c#rev1.10]
[65230]
[http://www-01.ibm.com/support/docview.wss?uid=isg3T1020637]
[openssh-cve20141692-code-exec(90819)]
Multiple CRLF injection vulnerabilities in the FTP module in Erlang/OTP R15B03 allow context-dependent attackers to inject arbitrary FTP commands via CRLF sequences in the (1) user, (2) account, (3) cd, (4) ls, (5) nlist, (6) rename, (7) delete, (8) mkdir, (9) rmdir, (10) recv, (11) recv_bin, (12) recv_chunk_start, (13) send, (14) send_bin, (15) send_chunk_start, (16) append_chunk_start, (17) append, or (18) append_bin command.
<a href="http://cwe.mitre.org/data/definitions/93.html" target="_blank">CWE-93: CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')</a>
[http://advisories.mageia.org/MGASA-2014-0553.html]
[FEDORA-2014-15394]
[[oss-security] 20140128 CVE Request: Erlang OTP - ftp module - FTP Command Injection]
[MDVSA-2015:174]
[https://bugzilla.redhat.com/show_bug.cgi?id=1059331]
[USN-3571-1]
Multiple cross-site request forgery (CSRF) vulnerabilities in (1) CustomerPreferences.pm, (2) CustomerTicketMessage.pm, (3) CustomerTicketProcess.pm, and (4) CustomerTicketZoom.pm in Kernel/Modules/ in Open Ticket Request System (OTRS) 3.1.x before 3.1.19, 3.2.x before 3.2.14, and 3.3.x before 3.3.4 allow remote attackers to hijack the authentication of arbitrary users for requests that (5) create tickets or (6) send follow-ups to existing tickets.
[http://bugs.otrs.org/show_bug.cgi?id=10099]
[DSA-2867]
[[oss-security] 20140129 Re: CVE Request: otrs: CSRF issue in customer web interface]
[[oss-security] 20140129 CVE Request: otrs: CSRF issue in customer web interface]
[https://github.com/OTRS/otrs/commit/6f324aaf8647729d509eebf063a0181f9f9196f7]
[https://github.com/OTRS/otrs/commit/92f417277f43832f1a0462f2485fe1fd3fd52312]
[https://github.com/OTRS/otrs/commit/ca2c3390fd60d9a3f810ed2c22cbc2c193457b77]
[https://www.otrs.com/release-notes-otrs-help-desk-3-3-4]
[https://www.otrs.com/security-advisory-2014-01-csrf-issue-customer-web-interface]
Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) 3.1.x before 3.1.20, 3.2.x before 3.2.15, and 3.3.x before 3.3.5 allows remote attackers to inject arbitrary web script or HTML via a crafted HTML email.
[http://adamziaja.com/poc/201401-xss-otrs.html]
[openSUSE-SU-2014:0360]
[http://packetstormsecurity.com/files/131654/OTRS-3.x-Cross-Site-Scripting.html]
[65844]
[36842]
[https://www.otrs.com/security-advisory-2014-03-xss-issue]
Siemens SIMATIC WinCC OA before 3.12 P002 January uses a weak hash algorithm for passwords, which makes it easier for remote attackers to obtain access via a brute-force attack.
[http://ics-cert.us-cert.gov/advisories/ICSA-14-035-01]
[http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-342587.pdf]
[simatic-wincc-cve20141696-priv-esc(90934)]
The integrated web server in Siemens SIMATIC WinCC OA before 3.12 P002 January allows remote attackers to execute arbitrary code via crafted packets to TCP port 4999.
[http://ics-cert.us-cert.gov/advisories/ICSA-14-035-01]
[65351]
[http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-342587.pdf]
[simatic-wincc-cve20141697-code-exec(90933)]
Directory traversal vulnerability in Siemens SIMATIC WinCC OA before 3.12 P002 January allows remote attackers to read arbitrary files via crafted packets to TCP port 4999.
[http://ics-cert.us-cert.gov/advisories/ICSA-14-035-01]
[65349]
[http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-342587.pdf]
[simatic-wincc-cve20141698-dir-trav(90935)]
Siemens SIMATIC WinCC OA before 3.12 P002 January allows remote attackers to cause a denial of service (monitoring-service outage) via malformed HTTP requests to port 4999.
[http://ics-cert.us-cert.gov/advisories/ICSA-14-035-01]
[65347]
[http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-342587.pdf]
[simatic-wincc-cve20141699-dos(90936)]
Use-after-free vulnerability in modules/speech/SpeechSynthesis.cpp in Blink, as used in Google Chrome before 33.0.1750.149, allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging improper handling of a certain utterance data structure.
[http://googlechromereleases.blogspot.com/2014/03/stable-channel-update_11.html]
[openSUSE-SU-2014:0501]
[GLSA-201408-16]
[DSA-2883]
[1029914]
[https://code.google.com/p/chromium/issues/detail?id=344881]
[https://src.chromium.org/viewvc/blink?revision=168171&view=revision]
The GenerateFunction function in bindings/scripts/code_generator_v8.pm in Blink, as used in Google Chrome before 33.0.1750.149, does not implement a certain cross-origin restriction for the EventTarget::dispatchEvent function, which allows remote attackers to conduct Universal XSS (UXSS) attacks via vectors involving events.
[http://googlechromereleases.blogspot.com/2014/03/stable-channel-update_11.html]
[openSUSE-SU-2014:0501]
[GLSA-201408-16]
[DSA-2883]
[1029914]
[https://code.google.com/p/chromium/issues/detail?id=342618]
[https://src.chromium.org/viewvc/blink?revision=166999&view=revision]
Use-after-free vulnerability in the DatabaseThread::cleanupDatabaseThread function in modules/webdatabase/DatabaseThread.cpp in the web database implementation in Blink, as used in Google Chrome before 33.0.1750.149, allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging improper handling of scheduled tasks during shutdown of a thread.
[http://googlechromereleases.blogspot.com/2014/03/stable-channel-update_11.html]
[openSUSE-SU-2014:0501]
[GLSA-201408-16]
[DSA-2883]
[1029914]
[https://code.google.com/p/chromium/issues/detail?id=333058]
[https://src.chromium.org/viewvc/blink?revision=168059&view=revision]
Use-after-free vulnerability in the WebSocketDispatcherHost::SendOrDrop function in content/browser/renderer_host/websocket_dispatcher_host.cc in the Web Sockets implementation in Google Chrome before 33.0.1750.149 might allow remote attackers to bypass the sandbox protection mechanism by leveraging an incorrect deletion in a certain failure case.
[http://googlechromereleases.blogspot.com/2014/03/stable-channel-update_11.html]
[openSUSE-SU-2014:0501]
[GLSA-201408-16]
[DSA-2883]
[1029914]
[https://code.google.com/p/chromium/issues/detail?id=338354]
[https://src.chromium.org/viewvc/chrome?revision=247627&view=revision]
Multiple unspecified vulnerabilities in Google V8 before 3.23.17.18, as used in Google Chrome before 33.0.1750.149, allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
[http://googlechromereleases.blogspot.com/2014/03/stable-channel-update_11.html]
[openSUSE-SU-2014:0501]
[GLSA-201408-16]
[DSA-2883]
[1029914]
[https://code.google.com/p/chromium/issues/detail?id=328202]
[https://code.google.com/p/chromium/issues/detail?id=345715]
[https://code.google.com/p/chromium/issues/detail?id=349079]
[https://code.google.com/p/v8/source/detail?r=18564]
[https://code.google.com/p/v8/source/detail?r=19614]
[https://code.google.com/p/v8/source/detail?r=19668]
Google V8, as used in Google Chrome before 33.0.1750.152 on OS X and Linux and before 33.0.1750.154 on Windows, allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.
[http://googlechromereleases.blogspot.com/2014/03/stable-channel-update_14.html]
[http://googlechromereleases.blogspot.com/2014/03/stable-channel-update-for-chrome-os_14.html]
[openSUSE-SU-2014:0501]
[GLSA-201408-16]
[DSA-2883]
[https://code.google.com/p/chromium/issues/detail?id=351787]
crosh in Google Chrome OS before 33.0.1750.152 allows attackers to inject commands via unspecified vectors.
[http://googlechromereleases.blogspot.com/2014/03/stable-channel-update-for-chrome-os_14.html]
[https://code.google.com/p/chromium/issues/detail?id=351796]
Directory traversal vulnerability in CrosDisks in Google Chrome OS before 33.0.1750.152 has unspecified impact and attack vectors.
[http://googlechromereleases.blogspot.com/2014/03/stable-channel-update-for-chrome-os_14.html]
[https://code.google.com/p/chromium/issues/detail?id=351811]
The boot implementation in Google Chrome OS before 33.0.1750.152 does not properly consider file persistence, which allows remote attackers to execute arbitrary code via unspecified vectors.
[http://googlechromereleases.blogspot.com/2014/03/stable-channel-update-for-chrome-os_14.html]
[https://code.google.com/p/chromium/issues/detail?id=344051]
The AsyncPixelTransfersCompletedQuery::End function in gpu/command_buffer/service/query_manager.cc in Google Chrome, as used in Google Chrome OS before 33.0.1750.152, does not check whether a certain position is within the bounds of a shared-memory segment, which allows remote attackers to cause a denial of service (GPU command-buffer memory corruption) or possibly have unspecified other impact via unknown vectors.
[http://googlechromereleases.blogspot.com/2014/03/stable-channel-update-for-chrome-os_14.html]
[https://code.google.com/p/chromium/issues/detail?id=351852]
[https://src.chromium.org/viewvc/chrome?revision=256723&view=revision]
[https://src.chromium.org/viewvc/chrome?revision=256918&view=revision]
The GPU driver in the kernel in Google Chrome OS before 33.0.1750.152 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via unknown vectors.
[http://googlechromereleases.blogspot.com/2014/03/stable-channel-update-for-chrome-os_14.html]
[https://code.google.com/p/chromium/issues/detail?id=351855]
Use-after-free vulnerability in the AttributeSetter function in bindings/templates/attributes.cpp in the bindings in Blink, as used in Google Chrome before 33.0.1750.152 on OS X and Linux and before 33.0.1750.154 on Windows, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving the document.location value.
[20140326 VUPEN Security Research - Google Chrome Blink "locationAttributeSetter" Use-after-free (Pwn2Own)]
[APPLE-SA-2014-04-01-1]
[APPLE-SA-2014-04-22-3]
[APPLE-SA-2014-04-22-2]
[http://googlechromereleases.blogspot.com/2014/03/stable-channel-update_14.html]
[http://googlechromereleases.blogspot.com/2014/03/stable-channel-update-for-chrome-os_14.html]
[openSUSE-SU-2014:0501]
[GLSA-201408-16]
[DSA-2883]
[https://code.google.com/p/chromium/issues/detail?id=352374]
[https://src.chromium.org/viewvc/blink?revision=169176&view=revision]
[https://support.apple.com/kb/HT6537]
The ScopedClipboardWriter::WritePickledData function in ui/base/clipboard/scoped_clipboard_writer.cc in Google Chrome before 33.0.1750.152 on OS X and Linux and before 33.0.1750.154 on Windows does not verify a certain format value, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the clipboard.
[20140326 VUPEN Security Research - Google Chrome "Clipboard::WriteData()" Function Sandbox Escape (Pwn2Own)]
[http://googlechromereleases.blogspot.com/2014/03/stable-channel-update_14.html]
[openSUSE-SU-2014:0501]
[GLSA-201408-16]
[https://code.google.com/p/chromium/issues/detail?id=352395]
[https://src.chromium.org/viewvc/chrome?revision=256974&view=revision]
Directory traversal vulnerability in Google Chrome before 33.0.1750.152 on OS X and Linux and before 33.0.1750.154 on Windows has unspecified impact and attack vectors.
[http://googlechromereleases.blogspot.com/2014/03/stable-channel-update_14.html]
[openSUSE-SU-2014:0501]
[GLSA-201408-16]
[DSA-2883]
[66249]
[https://code.google.com/p/chromium/issues/detail?id=352429]
Cross-site scripting (XSS) vulnerability in the Runtime_SetPrototype function in runtime.cc in Google V8, as used in Google Chrome before 34.0.1847.116, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Universal XSS (UXSS)."
[http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html]
[openSUSE-SU-2014:0601]
[GLSA-201408-16]
[DSA-2905]
[https://code.google.com/p/chromium/issues/detail?id=354123]
[https://code.google.com/p/v8/source/detail?r=20138]
Google V8, as used in Google Chrome before 34.0.1847.116, does not properly use numeric casts during handling of typed arrays, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted JavaScript code.
[http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html]
[openSUSE-SU-2014:0601]
[GLSA-201408-16]
[DSA-2905]
[https://code.google.com/p/chromium/issues/detail?id=353004]
[https://code.google.com/p/v8/source/detail?r=20020]
Integer overflow in the SoftwareFrameManager::SwapToNewFrame function in content/browser/renderer_host/software_frame_manager.cc in the software compositor in Google Chrome before 34.0.1847.116 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger an attempted mapping of a large amount of renderer memory.
[http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html]
[openSUSE-SU-2014:0601]
[GLSA-201408-16]
[DSA-2905]
[https://code.google.com/p/chromium/issues/detail?id=348332]
[https://src.chromium.org/viewvc/chrome?revision=257417&view=revision]
[https://src.chromium.org/viewvc/chrome?revision=258418&view=revision]
[https://src.chromium.org/viewvc/chrome?revision=260969&view=revision]
[https://src.chromium.org/viewvc/chrome?revision=261817&view=revision]
Use-after-free vulnerability in the WebSharedWorkerStub::OnTerminateWorkerContext function in content/worker/websharedworker_stub.cc in the Web Workers implementation in Google Chrome before 34.0.1847.116 allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via vectors that trigger a SharedWorker termination during script loading.
[http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html]
[openSUSE-SU-2014:0601]
[GLSA-201408-16]
[DSA-2905]
[https://code.google.com/p/chromium/issues/detail?id=343661]
[https://src.chromium.org/viewvc/chrome?revision=252010&view=revision]
Use-after-free vulnerability in the HTMLBodyElement::insertedInto function in core/html/HTMLBodyElement.cpp in Blink, as used in Google Chrome before 34.0.1847.116, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving attributes.
[http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html]
[openSUSE-SU-2014:0601]
[GLSA-201408-16]
[DSA-2905]
[https://code.google.com/p/chromium/issues/detail?id=356095]
[https://src.chromium.org/viewvc/blink?revision=170216&view=revision]
Google V8, as used in Google Chrome before 34.0.1847.116, does not properly implement lazy deoptimization, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via crafted JavaScript code, as demonstrated by improper handling of a heap allocation of a number outside the Small Integer (aka smi) range.
[http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html]
[openSUSE-SU-2014:0601]
[GLSA-201408-16]
[DSA-2905]
[https://code.google.com/p/chromium/issues/detail?id=350434]
[https://code.google.com/p/v8/source/detail?r=19834]
Use-after-free vulnerability in the RenderBlock::addChildIgnoringAnonymousColumnBlocks function in core/rendering/RenderBlock.cpp in Blink, as used in Google Chrome before 34.0.1847.116, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving addition of a child node.
[http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html]
[openSUSE-SU-2014:0601]
[GLSA-201408-16]
[DSA-2905]
[https://code.google.com/p/chromium/issues/detail?id=330626]
[https://src.chromium.org/viewvc/blink?revision=164405&view=revision]
The UnescapeURLWithOffsetsImpl function in net/base/escape.cc in Google Chrome before 34.0.1847.116 does not properly handle bidirectional Internationalized Resource Identifiers (IRIs), which makes it easier for remote attackers to spoof URLs via crafted use of right-to-left (RTL) Unicode text.
[http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html]
[openSUSE-SU-2014:0601]
[GLSA-201408-16]
[DSA-2905]
[https://code.google.com/p/chromium/issues/detail?id=337746]
[https://src.chromium.org/viewvc/chrome?revision=254091&view=revision]
Use-after-free vulnerability in Free(b)soft Laboratory Speech Dispatcher 0.7.1, as used in Google Chrome before 34.0.1847.116, allows remote attackers to cause a denial of service (application hang) or possibly have unspecified other impact via a text-to-speech request.
[http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html]
[openSUSE-SU-2014:0601]
[GLSA-201408-16]
[DSA-2905]
[https://code.google.com/p/chromium/issues/detail?id=327295]
[https://src.chromium.org/viewvc/chrome?revision=259109&view=revision]
The base64DecodeInternal function in wtf/text/Base64.cpp in Blink, as used in Google Chrome before 34.0.1847.116, does not properly handle string data composed exclusively of whitespace characters, which allows remote attackers to cause a denial of service (out-of-bounds read) via a window.atob method call.
[http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html]
[openSUSE-SU-2014:0601]
[GLSA-201408-16]
[DSA-2905]
[https://code.google.com/p/chromium/issues/detail?id=357332]
[https://src.chromium.org/viewvc/blink?revision=170264&view=revision]
The drag implementation in Google Chrome before 34.0.1847.116 allows user-assisted remote attackers to bypass the Same Origin Policy and forge local pathnames by leveraging renderer access.
[http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html]
[openSUSE-SU-2014:0601]
[GLSA-201408-16]
[DSA-2905]
[https://code.google.com/p/chromium/issues/detail?id=346135]
[https://src.chromium.org/viewvc/chrome?revision=259353&view=revision]
Use-after-free vulnerability in content/renderer/renderer_webcolorchooser_impl.h in Google Chrome before 34.0.1847.116 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to forms.
[http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html]
[openSUSE-SU-2014:0601]
[GLSA-201408-16]
[DSA-2905]
[https://code.google.com/p/chromium/issues/detail?id=342735]
[https://src.chromium.org/viewvc/chrome?revision=255276&view=revision]
Multiple unspecified vulnerabilities in Google Chrome before 34.0.1847.116 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
[http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html]
[openSUSE-SU-2014:0601]
[GLSA-201408-16]
[DSA-2905]
[https://code.google.com/p/chromium/issues/detail?id=345820]
[https://code.google.com/p/chromium/issues/detail?id=347262]
[https://code.google.com/p/chromium/issues/detail?id=348319]
[https://code.google.com/p/chromium/issues/detail?id=350533]
[https://code.google.com/p/chromium/issues/detail?id=350537]
[https://code.google.com/p/chromium/issues/detail?id=350863]
[https://code.google.com/p/chromium/issues/detail?id=351815]
[https://code.google.com/p/chromium/issues/detail?id=352982]
[https://code.google.com/p/chromium/issues/detail?id=353013]
[https://code.google.com/p/chromium/issues/detail?id=354297]
[https://code.google.com/p/chromium/issues/detail?id=355586]
[https://code.google.com/p/chromium/issues/detail?id=356235]
[https://code.google.com/p/chromium/issues/detail?id=356517]
[https://code.google.com/p/chromium/issues/detail?id=358059]
[https://code.google.com/p/chromium/issues/detail?id=360298]
Multiple unspecified vulnerabilities in Google V8 before 3.24.35.22, as used in Google Chrome before 34.0.1847.116, allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
[http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html]
[openSUSE-SU-2014:0601]
[GLSA-201408-16]
[DSA-2905]
[https://code.google.com/p/chromium/issues/detail?id=345820]
[https://code.google.com/p/chromium/issues/detail?id=347262]
[https://code.google.com/p/chromium/issues/detail?id=348319]
[https://code.google.com/p/chromium/issues/detail?id=350863]
[https://code.google.com/p/chromium/issues/detail?id=352982]
[https://code.google.com/p/chromium/issues/detail?id=355586]
[https://code.google.com/p/chromium/issues/detail?id=358059]
[https://code.google.com/p/v8/source/detail?r=19572]
[https://code.google.com/p/v8/source/detail?r=19584]
[https://code.google.com/p/v8/source/detail?r=19923]
[https://code.google.com/p/v8/source/detail?r=20033]
[https://code.google.com/p/v8/source/detail?r=20345]
[https://code.google.com/p/v8/source/detail?r=20409]
Google V8, as used in Google Chrome before 34.0.1847.131 on Windows and OS X and before 34.0.1847.132 on Linux, does not properly store internationalization metadata, which allows remote attackers to bypass intended access restrictions by leveraging "type confusion" and reading property values, related to i18n.js and runtime.cc.
[http://googlechromereleases.blogspot.com/2014/04/stable-channel-update_24.html]
[openSUSE-SU-2014:0668]
[openSUSE-SU-2014:0669]
[60372]
[GLSA-201408-16]
[DSA-2920]
[https://code.google.com/p/chromium/issues/detail?id=354967]
[https://code.google.com/p/v8/source/detail?r=20375]
[https://code.google.com/p/v8/source/detail?r=20377]
[https://code.google.com/p/v8/source/detail?r=20388]
[https://code.google.com/p/v8/source/detail?r=20593]
[https://code.google.com/p/v8/source/detail?r=20595]
core/html/HTMLSelectElement.cpp in the DOM implementation in Blink, as used in Google Chrome before 34.0.1847.131 on Windows and OS X and before 34.0.1847.132 on Linux, does not properly check renderer state upon a focus event, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that leverage "type confusion" for SELECT elements.
[APPLE-SA-2014-05-21-1]
[APPLE-SA-2014-06-30-3]
[APPLE-SA-2014-06-30-4]
[http://googlechromereleases.blogspot.com/2014/04/stable-channel-update_24.html]
[openSUSE-SU-2014:0668]
[openSUSE-SU-2014:0669]
[60372]
[GLSA-201408-16]
[http://support.apple.com/kb/HT6254]
[DSA-2920]
[67572]
[https://code.google.com/p/chromium/issues/detail?id=349903]
[https://src.chromium.org/viewvc/blink?revision=171216&view=revision]
[https://support.apple.com/kb/HT6537]
Use-after-free vulnerability in browser/ui/views/speech_recognition_bubble_views.cc in Google Chrome before 34.0.1847.131 on Windows and OS X and before 34.0.1847.132 on Linux allows remote attackers to cause a denial of service or possibly have unspecified other impact via an INPUT element that triggers the presence of a Speech Recognition Bubble window for an incorrect duration.
[http://googlechromereleases.blogspot.com/2014/04/stable-channel-update_24.html]
[openSUSE-SU-2014:0668]
[openSUSE-SU-2014:0669]
[GLSA-201408-16]
[DSA-2920]
[https://code.google.com/p/chromium/issues/detail?id=352851]
[https://src.chromium.org/viewvc/chrome?revision=261737&view=revision]
The PointerCompare function in codegen.cc in Seccomp-BPF, as used in Google Chrome before 34.0.1847.131 on Windows and OS X and before 34.0.1847.132 on Linux, does not properly merge blocks, which might allow remote attackers to bypass intended sandbox restrictions by leveraging renderer access.
[http://googlechromereleases.blogspot.com/2014/04/stable-channel-update_24.html]
[openSUSE-SU-2014:0668]
[openSUSE-SU-2014:0669]
[GLSA-201408-16]
[DSA-2920]
[https://code.google.com/p/chromium/issues/detail?id=351103]
[https://src.chromium.org/viewvc/chrome?revision=260157&view=revision]
Multiple unspecified vulnerabilities in Google Chrome before 34.0.1847.131 on Windows and OS X and before 34.0.1847.132 on Linux allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
[http://googlechromereleases.blogspot.com/2014/04/stable-channel-update_24.html]
[openSUSE-SU-2014:0668]
[openSUSE-SU-2014:0669]
[GLSA-201408-16]
[DSA-2920]
[https://code.google.com/p/chromium/issues/detail?id=356181]
[https://code.google.com/p/chromium/issues/detail?id=357382]
[https://code.google.com/p/chromium/issues/detail?id=367314]
Multiple unspecified vulnerabilities in Google V8 before 3.24.35.33, as used in Google Chrome before 34.0.1847.131 on Windows and OS X and before 34.0.1847.132 on Linux, allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
[http://googlechromereleases.blogspot.com/2014/04/stable-channel-update_24.html]
[openSUSE-SU-2014:0668]
[openSUSE-SU-2014:0669]
[60372]
[GLSA-201408-16]
[DSA-2920]
[https://code.google.com/p/chromium/issues/detail?id=359130]
[https://code.google.com/p/chromium/issues/detail?id=359525]
[https://code.google.com/p/chromium/issues/detail?id=360429]
[https://code.google.com/p/v8/source/detail?r=20501]
[https://code.google.com/p/v8/source/detail?r=20622]
[https://code.google.com/p/v8/source/detail?r=20624]
[https://src.chromium.org/viewvc/blink?revision=171077&view=revision]
[https://src.chromium.org/viewvc/blink?revision=171127&view=revision]
Integer overflow in api.cc in Google V8, as used in Google Chrome before 34.0.1847.131 on Windows and OS X and before 34.0.1847.132 on Linux, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a large length value.
[http://googlechromereleases.blogspot.com/2014/04/stable-channel-update_24.html]
[DSA-2920]
[https://code.google.com/p/chromium/issues/detail?id=359802]
[https://code.google.com/p/v8/source/detail?r=20519]
[https://code.google.com/p/v8/source/detail?r=20525]
The raw_cmd_copyin function in drivers/block/floppy.c in the Linux kernel through 3.14.3 does not properly handle error conditions during processing of an FDRAWCMD ioctl call, which allows local users to trigger kfree operations and gain privileges by leveraging write access to a /dev/fd device.
[http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=ef87dbe7614341c2e7bfe8d32fcb7028cc97442c]
[http://linux.oracle.com/errata/ELSA-2014-0771.html]
[http://linux.oracle.com/errata/ELSA-2014-3043.html]
[SUSE-SU-2014:0667]
[SUSE-SU-2014:0683]
[RHSA-2014:0800]
[RHSA-2014:0801]
[DSA-2926]
[DSA-2928]
[[oss-security] 20140509 Linux kernel floppy ioctl kernel code execution]
[67300]
[1030474]
[https://bugzilla.redhat.com/show_bug.cgi?id=1094299]
[https://github.com/torvalds/linux/commit/ef87dbe7614341c2e7bfe8d32fcb7028cc97442c]
The raw_cmd_copyout function in drivers/block/floppy.c in the Linux kernel through 3.14.3 does not properly restrict access to certain pointers during processing of an FDRAWCMD ioctl call, which allows local users to obtain sensitive information from kernel heap memory by leveraging write access to a /dev/fd device.
[http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=2145e15e0557a01b9195d1c7199a1b92cb9be81f]
[http://linux.oracle.com/errata/ELSA-2014-0771.html]
[http://linux.oracle.com/errata/ELSA-2014-3043.html]
[SUSE-SU-2014:0667]
[SUSE-SU-2014:0683]
[RHSA-2014:0800]
[RHSA-2014:0801]
[DSA-2926]
[DSA-2928]
[[oss-security] 20140509 Linux kernel floppy ioctl kernel code execution]
[67302]
[1030474]
[https://bugzilla.redhat.com/show_bug.cgi?id=1094299]
[https://github.com/torvalds/linux/commit/2145e15e0557a01b9195d1c7199a1b92cb9be81f]
The media_device_enum_entities function in drivers/media/media-device.c in the Linux kernel before 3.14.6 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel memory by leveraging /dev/media0 read access for a MEDIA_IOC_ENUM_ENTITIES ioctl call.
[http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=e6a623460e5fc960ac3ee9f946d3106233fd28d8]
[SUSE-SU-2014:1316]
[SUSE-SU-2014:1319]
[http://speirofr.appspot.com/cve-2014-1739-kernel-infoleak-vulnerability-in-media_enum_entities.html]
[http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.6]
[[oss-security] 20140615 CVE-2014-1739: Kernel Infoleak vulnerability in,media_enum_entities()]
[68048]
[1038201]
[USN-2259-1]
[USN-2261-1]
[USN-2263-1]
[USN-2264-1]
[https://bugzilla.redhat.com/show_bug.cgi?id=1109774]
[https://github.com/torvalds/linux/commit/e6a623460e5fc960ac3ee9f946d3106233fd28d8]
[https://source.android.com/security/bulletin/2017-04-01]
Multiple use-after-free vulnerabilities in net/websockets/websocket_job.cc in the WebSockets implementation in Google Chrome before 34.0.1847.137 allow remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to WebSocketJob deletion.
[http://googlechromereleases.blogspot.com/2014/05/stable-channel-update.html]
[openSUSE-SU-2014:0783]
[60372]
[GLSA-201408-16]
[DSA-2930]
[67374]
[1030240]
[https://code.google.com/p/chromium/issues/detail?id=358038]
[https://src.chromium.org/viewvc/chrome?revision=261707&view=revision]
Multiple integer overflows in the replace-data functionality in the CharacterData interface implementation in core/dom/CharacterData.cpp in Blink, as used in Google Chrome before 34.0.1847.137, allow remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to ranges.
[http://googlechromereleases.blogspot.com/2014/05/stable-channel-update.html]
[openSUSE-SU-2014:0783]
[60372]
[GLSA-201408-16]
[DSA-2930]
[67376]
[1030240]
[https://code.google.com/p/chromium/issues/detail?id=349898]
[https://src.chromium.org/viewvc/blink?revision=171165&view=revision]
Use-after-free vulnerability in the FrameSelection::updateAppearance function in core/editing/FrameSelection.cpp in Blink, as used in Google Chrome before 34.0.1847.137, allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging improper RenderObject handling.
[http://googlechromereleases.blogspot.com/2014/05/stable-channel-update.html]
[openSUSE-SU-2014:0783]
[60372]
[GLSA-201408-16]
[DSA-2930]
[67375]
[1030240]
[https://code.google.com/p/chromium/issues/detail?id=356690]
[https://src.chromium.org/viewvc/blink?revision=171440&view=revision]
Use-after-free vulnerability in the StyleElement::removedFromDocument function in core/dom/StyleElement.cpp in Blink, as used in Google Chrome before 35.0.1916.114, allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via crafted JavaScript code that triggers tree mutation.
[http://googlechromereleases.blogspot.com/2014/05/stable-channel-update_20.html]
[openSUSE-SU-2014:0783]
[60372]
[GLSA-201408-16]
[DSA-2939]
[1030270]
[https://code.google.com/p/chromium/issues/detail?id=356653]
[https://src.chromium.org/viewvc/blink?revision=170702&view=revision]
Integer overflow in the AudioInputRendererHost::OnCreateStream function in content/browser/renderer_host/media/audio_input_renderer_host.cc in Google Chrome before 35.0.1916.114 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger a large shared-memory allocation.
[http://googlechromereleases.blogspot.com/2014/05/stable-channel-update_20.html]
[openSUSE-SU-2014:0783]
[60372]
[GLSA-201408-16]
[DSA-2939]
[1030270]
[https://code.google.com/p/chromium/issues/detail?id=359454]
[https://src.chromium.org/viewvc/chrome?revision=261549&view=revision]
Use-after-free vulnerability in the SVG implementation in Blink, as used in Google Chrome before 35.0.1916.114, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger removal of an SVGFontFaceElement object, related to core/svg/SVGFontFaceElement.cpp.
[http://googlechromereleases.blogspot.com/2014/05/stable-channel-update_20.html]
[openSUSE-SU-2014:0783]
[GLSA-201408-16]
[DSA-2939]
[1030270]
[https://code.google.com/p/chromium/issues/detail?id=346192]
[https://src.chromium.org/viewvc/blink?revision=167993&view=revision]
The InMemoryUrlProtocol::Read function in media/filters/in_memory_url_protocol.cc in Google Chrome before 35.0.1916.114 relies on an insufficiently large integer data type, which allows remote attackers to cause a denial of service (out-of-bounds read) via vectors that trigger use of a large buffer.
[http://googlechromereleases.blogspot.com/2014/05/stable-channel-update_20.html]
[openSUSE-SU-2014:0783]
[60372]
[GLSA-201408-16]
[DSA-2939]
[1030270]
[https://code.google.com/p/chromium/issues/detail?id=364065]
[https://src.chromium.org/viewvc/chrome?revision=267280&view=revision]
Cross-site scripting (XSS) vulnerability in the DocumentLoader::maybeCreateArchive function in core/loader/DocumentLoader.cpp in Blink, as used in Google Chrome before 35.0.1916.114, allows remote attackers to inject arbitrary web script or HTML via crafted MHTML content, aka "Universal XSS (UXSS)."
[http://googlechromereleases.blogspot.com/2014/05/stable-channel-update_20.html]
[openSUSE-SU-2014:0783]
[GLSA-201408-16]
[DSA-2939]
[1030270]
[https://code.google.com/p/chromium/issues/detail?id=330663]
[https://src.chromium.org/viewvc/blink?revision=169499&view=revision]
The ScrollView::paint function in platform/scroll/ScrollView.cpp in Blink, as used in Google Chrome before 35.0.1916.114, allows remote attackers to spoof the UI by extending scrollbar painting into the parent frame.
[http://googlechromereleases.blogspot.com/2014/05/stable-channel-update_20.html]
[APPLE-SA-2014-12-2-1]
[openSUSE-SU-2014:0783]
[openSUSE-SU-2016:0915]
[60372]
[GLSA-201408-16]
[http://support.apple.com/kb/HT6596]
[DSA-2939]
[1030270]
[USN-2937-1]
[https://code.google.com/p/chromium/issues/detail?id=331168]
[https://src.chromium.org/viewvc/blink?revision=170625&view=revision]
Multiple unspecified vulnerabilities in Google Chrome before 35.0.1916.114 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
[http://googlechromereleases.blogspot.com/2014/05/stable-channel-update_20.html]
[openSUSE-SU-2014:0783]
[GLSA-201408-16]
[DSA-2939]
[1030270]
[https://code.google.com/p/chromium/issues/detail?id=374649]
Open redirect vulnerability in nokia-mapsplaces.php in the Nokia Maps & Places plugin 1.6.6 for WordPress allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the href parameter to page/place.html. NOTE: this was originally reported as a cross-site scripting (XSS) vulnerability, but this may be inaccurate.
<a href="http://cwe.mitre.org/data/definitions/601.html">CWE-601: URL Redirection to Untrusted Site ('Open Redirect')</a>
[[oss-security] 20140129 CVE: Request]
[[oss-security] 20140129 Re: CVE: Request]
[65226]
[https://plugins.trac.wordpress.org/browser/nokia-mapsplaces/trunk/nokia-mapsplaces.php?rev=841883]
[https://plugins.trac.wordpress.org/browser/nokia-mapsplaces/trunk/nokia-mapsplaces.php?rev=842384]
Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0235 and CVE-2014-1755.
[MS14-018]
Microsoft Internet Explorer 6 and 7 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
[MS14-018]
Microsoft Internet Explorer 6 through 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
[MS14-018]
Cross-site scripting (XSS) vulnerability in Microsoft SharePoint Server 2013 Gold and SP1, SharePoint Foundation 2013 Gold and SP1, Office Web Apps Server 2013 Gold and SP1, and SharePoint Server 2013 Client Components SDK allows remote attackers to inject arbitrary web script or HTML via a crafted request, aka "SharePoint XSS Vulnerability."
[67288]
[1030227]
[MS14-022]
Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0235 and CVE-2014-1751.
[MS14-018]
Untrusted search path vulnerability in Microsoft Office 2007 SP3, 2010 SP1 and SP2, and 2013 Gold, SP1, RT, and RT SP1, when the Simplified Chinese Proofing Tool is enabled, allows local users to gain privileges via a Trojan horse DLL in the current working directory, as demonstrated by a directory that contains a .docx file, aka "Microsoft Office Chinese Grammar Checking Vulnerability."
Per: http://cwe.mitre.org/data/definitions/426.html "CWE-426: Untrusted Search Path"
[MS14-023]
Microsoft Word 2007 SP3 and 2010 SP1 and SP2, and Office Compatibility Pack SP3, allocates memory incorrectly for file conversions from a binary (aka .doc) format to a newer format, which allows remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office File Format Converter Vulnerability."
[VU#882841]
[MS14-017]
Stack-based buffer overflow in Microsoft Word 2003 SP3 allows remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Word Stack Overflow Vulnerability."
[MS14-017]
pubconv.dll in Microsoft Publisher 2003 SP3 and 2007 SP3 allows remote attackers to execute arbitrary code or cause a denial of service (incorrect pointer dereference and application crash) via a crafted .pub file, aka "Arbitrary Pointer Dereference Vulnerability."
[MS14-020]
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
[MS14-018]
Microsoft Word 2003 SP3, 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Word Viewer; Office Compatibility Pack SP3; Office for Mac 2011; Word Automation Services on SharePoint Server 2010 SP1 and SP2 and 2013; Office Web Apps 2010 SP1 and SP2; and Office Web Apps Server 2013 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted RTF data, as exploited in the wild in March 2014.
[http://technet.microsoft.com/security/advisory/2953095]
[MS14-017]
Unspecified vulnerability in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code with medium-integrity privileges and bypass a sandbox protection mechanism via unknown vectors, as demonstrated by ZDI during a Pwn4Fun competition at CanSecWest 2014.
[http://twitter.com/thezdi/statuses/443810610958958592]
[http://www.pwn2own.com/2014/03/pwn2own-results-for-wednesday-day-one/]
[67511]
[1030370]
[MS14-035]
Use-after-free vulnerability in Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code and bypass a sandbox protection mechanism via unspecified vectors, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2014.
[http://twitter.com/thezdi/statuses/443855973673754624]
[http://www.pwn2own.com/2014/03/pwn2own-results-for-wednesday-day-one/]
[20140716 VUPEN Security Research - Microsoft Internet Explorer CSS @import Memory Corruption (Pwn2Own 2014)]
[1030532]
[MS14-037]
Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code and bypass a sandbox protection mechanism by leveraging "object confusion" in a broker process, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2014.
[http://twitter.com/thezdi/statuses/443855973673754624]
[http://www.pwn2own.com/2014/03/pwn2own-results-for-wednesday-day-one/]
[20140716 VUPEN Security Research - Microsoft Internet Explorer "Request" Object Confusion Sandbox Bypass (Pwn2Own 2014)]
[67295]
[1030370]
[MS14-035]
Multiple use-after-free vulnerabilities in Microsoft Internet Explorer 6 through 11 allow remote attackers to execute arbitrary code via unspecified vectors, as demonstrated by Sebastian Apelt and Andreas Schmidt during a Pwn2Own competition at CanSecWest 2014.
[http://twitter.com/thezdi/statuses/444216845734666240]
[http://www.pwn2own.com/2014/03/pwn2own-results-thursday-day-two/]
[1030532]
[MS14-037]
Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, as demonstrated by Sebastian Apelt and Andreas Schmidt during a Pwn2Own competition at CanSecWest 2014. NOTE: the original disclosure referred to triggering a kernel bug with the Internet Explorer exploit payload, but this ID is not for a kernel vulnerability.
[http://twitter.com/thezdi/statuses/444216845734666240]
[http://www.pwn2own.com/2014/03/pwn2own-results-thursday-day-two/]
[67518]
[1030370]
[MS14-035]
Double free vulnerability in the Ancillary Function Driver (AFD) in afd.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a crafted application, aka "Ancillary Function Driver Elevation of Privilege Vulnerability."
<a href="http://cwe.mitre.org/data/definitions/415.html" target="_blank">CWE-415: Double Free</a>
[68394]
[http://www.zerodayinitiative.com/advisories/ZDI-14-220/]
[MS14-040]
[39446]
[39525]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2014. Notes: none.
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1782, CVE-2014-1785, CVE-2014-2753, CVE-2014-2755, CVE-2014-2760, CVE-2014-2761, CVE-2014-2772, and CVE-2014-2776.
[67863]
[1030370]
[MS14-035]
Use-after-free vulnerability in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code via crafted JavaScript code that interacts improperly with a CollectGarbage function call on a CMarkup object allocated by the CMarkup::CreateInitialMarkup function.
[VU#239151]
[67544]
[1030266]
[http://zerodayinitiative.com/advisories/ZDI-14-140/]
[MS14-035]
[https://www.corelan.be/index.php/2014/05/22/on-cve-2014-1770-zdi-14-140-internet-explorer-8-0day/]
SChannel in Microsoft Internet Explorer 6 through 11 does not ensure that a server's X.509 certificate is the same during renegotiation as it was before renegotiation, which allows man-in-the-middle attackers to obtain sensitive information or modify TLS session data via a "triple handshake attack," aka "TLS Server Certificate Renegotiation Vulnerability."
[67861]
[1030370]
[MS14-035]
[https://secure-resumption.com/]
Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1780, CVE-2014-1794, CVE-2014-1797, CVE-2014-1802, CVE-2014-2756, CVE-2014-2763, CVE-2014-2764, CVE-2014-2769, and CVE-2014-2771.
[67864]
[1030370]
[MS14-035]
Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1783, CVE-2014-1784, CVE-2014-1786, CVE-2014-1795, CVE-2014-1805, CVE-2014-2758, CVE-2014-2759, CVE-2014-2765, CVE-2014-2766, and CVE-2014-2775.
[67866]
[1030370]
[MS14-035]
Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1788 and CVE-2014-2754.
[67867]
[1030370]
[MS14-035]
Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0282, CVE-2014-1779, CVE-2014-1799, CVE-2014-1803, and CVE-2014-2757.
[67871]
[1030370]
[MS14-035]
Use-after-free vulnerability in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via vectors related to the CMarkup::IsConnectedToPrimaryMarkup function, as exploited in the wild in April 2014. NOTE: this issue originally emphasized VGX.DLL, but Microsoft clarified that "VGX.DLL does not contain the vulnerable code leveraged in this exploit. Disabling VGX.DLL is an exploit-specific workaround that provides an immediate, effective workaround to help block known attacks."
[http://blogs.technet.com/b/srd/archive/2014/04/30/protection-strategies-for-the-security-advisory-2963983-ie-0day.aspx]
[1030154]
[http://www.fireeye.com/blog/uncategorized/2014/04/new-zero-day-exploit-targeting-internet-explorer-versions-9-through-11-identified-in-targeted-attacks.html]
[VU#222929]
[67075]
[http://www.signalsec.com/cve-2014-1776-ie-0day-analysis/]
[MS14-021]
[https://technet.microsoft.com/library/security/2963983]
Microsoft Internet Explorer 10 and 11 allows remote attackers to read local files on the client via a crafted web site, aka "Internet Explorer Information Disclosure Vulnerability."
[67869]
[1030370]
[MS14-035]
Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary web script with increased privileges via unspecified vectors, aka "Internet Explorer Elevation of Privilege Vulnerability," a different vulnerability than CVE-2014-2777.
[67882]
[1030370]
[MS14-035]
Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0282, CVE-2014-1775, CVE-2014-1799, CVE-2014-1803, and CVE-2014-2757.
[67872]
[1030370]
[MS14-035]
Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1772, CVE-2014-1794, CVE-2014-1797, CVE-2014-1802, CVE-2014-2756, CVE-2014-2763, CVE-2014-2764, CVE-2014-2769, and CVE-2014-2771.
[67873]
[1030370]
[MS14-035]
Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1792, CVE-2014-1804, and CVE-2014-2770.
[67874]
[1030370]
[MS14-035]
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1769, CVE-2014-1785, CVE-2014-2753, CVE-2014-2755, CVE-2014-2760, CVE-2014-2761, CVE-2014-2772, and CVE-2014-2776.
[67875]
[1030370]
[MS14-035]
Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1773, CVE-2014-1784, CVE-2014-1786, CVE-2014-1795, CVE-2014-1805, CVE-2014-2758, CVE-2014-2759, CVE-2014-2765, CVE-2014-2766, and CVE-2014-2775.
[67876]
[1030370]
[MS14-035]
Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1773, CVE-2014-1783, CVE-2014-1786, CVE-2014-1795, CVE-2014-1805, CVE-2014-2758, CVE-2014-2759, CVE-2014-2765, CVE-2014-2766, and CVE-2014-2775.
[67877]
[1030370]
[MS14-035]
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1769, CVE-2014-1782, CVE-2014-2753, CVE-2014-2755, CVE-2014-2760, CVE-2014-2761, CVE-2014-2772, and CVE-2014-2776.
[http://blog.skylined.nl/20161220001.html]
[http://packetstormsecurity.com/files/140233/Microsoft-Internet-Explorer-11-MSHTML-CSpliceTreeEngine-RemoveSplice-Use-After-Free.html]
[67878]
[1030370]
[MS14-035]
[40946]
Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1773, CVE-2014-1783, CVE-2014-1784, CVE-2014-1795, CVE-2014-1805, CVE-2014-2758, CVE-2014-2759, CVE-2014-2765, CVE-2014-2766, and CVE-2014-2775.
[67879]
[1030370]
[MS14-035]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2014. Notes: none.
Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1774 and CVE-2014-2754.
[67880]
[1030370]
[MS14-035]
Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1790.
[67881]
[1030370]
[MS14-035]
Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1789.
[67883]
[1030370]
[MS14-035]
Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
[67884]
[1030370]
[MS14-035]
Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1781, CVE-2014-1804, and CVE-2014-2770.
[67885]
[1030370]
[MS14-035]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2014. Notes: none.
Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1772, CVE-2014-1780, CVE-2014-1797, CVE-2014-1802, CVE-2014-2756, CVE-2014-2763, CVE-2014-2764, CVE-2014-2769, and CVE-2014-2771.
[67886]
[1030370]
[MS14-035]
Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1773, CVE-2014-1783, CVE-2014-1784, CVE-2014-1786, CVE-2014-1805, CVE-2014-2758, CVE-2014-2759, CVE-2014-2765, CVE-2014-2766, and CVE-2014-2775.
[67887]
[1030370]
[MS14-035]
Microsoft Internet Explorer 6 and 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
[67889]
[1030370]
[MS14-035]
Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1772, CVE-2014-1780, CVE-2014-1794, CVE-2014-1802, CVE-2014-2756, CVE-2014-2763, CVE-2014-2764, CVE-2014-2769, and CVE-2014-2771.
[67890]
[1030370]
[MS14-035]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2014. Notes: none.
Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0282, CVE-2014-1775, CVE-2014-1779, CVE-2014-1803, and CVE-2014-2757.
[67891]
[1030370]
[MS14-035]
[20150108 Microsoft Internet Explorer 11 CTreeNode Use-after-Free Vulnerability]
Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
[67831]
[1030370]
[MS14-035]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2014. Notes: none.
Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1772, CVE-2014-1780, CVE-2014-1794, CVE-2014-1797, CVE-2014-2756, CVE-2014-2763, CVE-2014-2764, CVE-2014-2769, and CVE-2014-2771.
[67833]
[1030370]
[MS14-035]
Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0282, CVE-2014-1775, CVE-2014-1779, CVE-2014-1799, and CVE-2014-2757.
[67834]
[1030370]
[MS14-035]
Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1781, CVE-2014-1792, and CVE-2014-2770.
[67835]
[1030370]
[MS14-035]
Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1773, CVE-2014-1783, CVE-2014-1784, CVE-2014-1786, CVE-2014-1795, CVE-2014-2758, CVE-2014-2759, CVE-2014-2765, CVE-2014-2766, and CVE-2014-2775.
[67836]
[1030370]
[MS14-035]
The .NET Remoting implementation in Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, 4.5, and 4.5.1 does not properly restrict memory access, which allows remote attackers to execute arbitrary code via vectors involving malformed objects, aka "TypeFilterLevel Vulnerability."
[67286]
[MS14-026]
The ShellExecute API in Windows Shell in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly implement file associations, which allows local users to gain privileges via a crafted application, as exploited in the wild in May 2014, aka "Windows Shell File Association Vulnerability."
[67276]
[MS14-027]
Microsoft Office 2013 Gold, SP1, RT, and RT SP1 allows remote attackers to obtain sensitive token information via a web site that sends a crafted response during opening of an Office document, aka "Token Reuse Vulnerability."
[MS14-023]
The MSCOMCTL library in Microsoft Office 2007 SP3, 2010 SP1 and SP2, and 2013 Gold, SP1, RT, and RT SP1 makes it easier for remote attackers to bypass the ASLR protection mechanism via a crafted web site, as exploited in the wild in May 2014, aka "MSCOMCTL ASLR Vulnerability."
[MS14-024]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2014. Notes: none.
The TCP implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to cause a denial of service (non-paged pool memory consumption and system hang) via malformed data in the Options field of a TCP header, aka "TCP Denial of Service Vulnerability."
[http://blogs.technet.com/b/srd/archive/2014/06/10/assessing-risk-for-the-june-2014-security-updates.aspx]
[67888]
[MS14-031]
The Group Policy implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 does not properly handle distribution of passwords, which allows remote authenticated users to obtain sensitive credential information and consequently gain privileges by leveraging access to the SYSVOL share, as exploited in the wild in May 2014, aka "Group Policy Preferences Password Elevation of Privilege Vulnerability."
[http://blogs.technet.com/b/srd/archive/2014/05/13/ms14-025-an-update-for-group-policy-preferences.aspx]
[MS14-025]
Microsoft Web Applications 2010 SP1 and SP2 allows remote authenticated users to execute arbitrary code via crafted page content, aka "Web Applications Page Content Vulnerability."
[1030227]
[MS14-022]
The Windows Installer in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a crafted application that invokes the repair feature for a different application, aka "Windows Installer Repair Vulnerability."
[60674]
[69112]
[1030719]
[MS14-049]
Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, as exploited in the wild in May 2014, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0310.
[MS14-029]
Microsoft XML Core Services (aka MSXML) 3.0 and 6.0 does not properly restrict the information transmitted by Internet Explorer during a download action, which allows remote attackers to discover (1) full pathnames on the client system and (2) local usernames embedded in these pathnames via a crafted web site, aka "MSXML Entity URI Vulnerability."
[http://blogs.technet.com/b/srd/archive/2014/06/10/assessing-risk-for-the-june-2014-security-updates.aspx]
[67895]
[MS14-033]
usp10.dll in Uniscribe (aka the Unicode Script Processor) in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, Office 2007 SP3 and 2010 SP1 and SP2, Live Meeting 2007 Console, Lync 2010 and 2013, Lync 2010 Attendee, and Lync Basic 2013 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted EMF+ record in a font file, aka "Unicode Scripts Processor Vulnerability."
[http://blogs.technet.com/b/srd/archive/2014/06/10/assessing-risk-for-the-june-2014-security-updates.aspx]
[67897]
[1030376]
[1030377]
[1030378]
[MS14-036]
GDI+ in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, Office 2007 SP3 and 2010 SP1 and SP2, Live Meeting 2007 Console, Lync 2010 and 2013, Lync 2010 Attendee, and Lync Basic 2013 allows remote attackers to execute arbitrary code via a crafted EMF+ record in an image file, aka "GDI+ Image Parsing Vulnerability."
[http://blogs.technet.com/b/srd/archive/2014/06/10/assessing-risk-for-the-june-2014-security-updates.aspx]
[67904]
[1030376]
[1030377]
[1030378]
[MS14-036]
win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly control access to objects associated with font files, which allows local users to gain privileges via a crafted file, aka "Font Double-Fetch Vulnerability."
[60673]
[69143]
[MS14-045]
Cross-site scripting (XSS) vulnerability in Master Data Services (MDS) in Microsoft SQL Server 2012 SP1 and 2014 on 64-bit platforms allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "SQL Master Data Services XSS Vulnerability."
[60676]
[69071]
[1030716]
[MS14-044]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2014. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2014. Notes: none.
Cross-site scripting (XSS) vulnerability in the Web Components Server in Microsoft Lync Server 2010 and 2013 allows remote attackers to inject arbitrary web script or HTML via a crafted URL containing a valid meeting ID, aka "Lync Server Content Sanitization Vulnerability."
[http://blogs.technet.com/b/srd/archive/2014/06/10/assessing-risk-for-the-june-2014-security-updates.aspx]
[67893]
[1030381]
[MS14-032]
Windows Journal in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code via a crafted Journal (aka .JNT) file, aka "Windows Journal Remote Code Execution Vulnerability."
[68396]
[MS14-038]
[297185]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2014. Notes: none.
Cross-site scripting (XSS) vulnerability in the iThoughtsHD app 4.19 for iOS on iPad devices, when the WiFi Transfer feature is used, allows remote attackers to inject arbitrary web script or HTML via a crafted map name.
[http://www.madirish.net/559]
The iThoughtsHD app 4.19 for iOS on iPad devices, when the WiFi Transfer feature is used, allows remote attackers to upload arbitrary files by placing a %00 sequence after a dangerous extension, as demonstrated by a .html%00.txt file.
[http://www.madirish.net/559]
The iThoughts web server in the iThoughtsHD app 4.19 for iOS on iPad devices allows remote attackers to cause a denial of service (disk consumption) by uploading a large file.
[http://www.madirish.net/559]
Requests (aka python-requests) before 2.3.0 allows remote servers to obtain a netrc password by reading the Authorization header in a redirected request.
[http://advisories.mageia.org/MGASA-2014-0409.html]
[DSA-3146]
[MDVSA-2015:133]
[USN-2382-1]
[https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=733108]
[https://github.com/kennethreitz/requests/issues/1885]
Requests (aka python-requests) before 2.3.0 allows remote servers to obtain sensitive information by reading the Proxy-Authorization header in a redirected request.
[http://advisories.mageia.org/MGASA-2014-0409.html]
[openSUSE-SU-2016:0246]
[DSA-3146]
[MDVSA-2015:133]
[https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=733108]
[https://github.com/kennethreitz/requests/issues/1885]
Phusion Passenger before 4.0.37 allows local users to write to certain files and directories via a symlink attack on (1) control_process.pid or a (2) generation-* file.
<a href="http://cwe.mitre.org/data/definitions/61.html">CWE-61: UNIX Symbolic Link (Symlink) Following</a>
[FEDORA-2015-1151]
[[oss-security] 20140128 CVE request: temporary file issue in Passenger rubygem]
[[oss-security] 20140130 Re: CVE request: temporary file issue in Passenger rubygem]
[https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=736958]
[https://bugzilla.redhat.com/show_bug.cgi?id=1058992]
[https://github.com/phusion/passenger/commit/34b1087870c2]
Phusion Passenger 4.0.37 allows local users to write to certain files and directories via a symlink attack on (1) control_process.pid or a (2) generation-* file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-1831.
<a href="http://cwe.mitre.org/data/definitions/61.html">CWE-61: UNIX Symbolic Link (Symlink) Following</a>
[FEDORA-2015-1151]
[[oss-security] 20140129 Re: CVE request: temporary file issue in Passenger rubygem]
[[oss-security] 20150130 Re: CVE request: temporary file issue in Passenger rubygem]
[https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=736958]
[https://bugzilla.redhat.com/show_bug.cgi?id=1058992]
[https://github.com/phusion/passenger/commit/94428057c602da3d6d34ef75c78091066ecac5c0]
Directory traversal vulnerability in uupdate in devscripts 2.14.1 allows remote attackers to modify arbitrary files via a crafted .orig.tar file, related to a symlink.
[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737160]
[[oss-security] 20140131 Re: CVE request: uupdate (devscripts) directory traversal]
[[oss-security] 20140131 CVE request: uupdate (devscripts) directory traversal]
[65260]
[USN-2649-1]
[https://bugzilla.redhat.com/show_bug.cgi?id=1059947]
[devscripts-cve20141833-dir-trav(90842)]
The perform_request function in /lib/echor/backplane.rb in echor 0.1.6 Ruby Gem allows local users to inject arbitrary code by adding a semi-colon in their username or password.
[[oss-security] 20140131 Re: echor 0.1.6 Ruby Gem exposes login credentials]
The perform_request function in /lib/echor/backplane.rb in echor 0.1.6 Ruby Gem allows local users to steal the login credentials by watching the process table.
[[oss-security] 20140131 Re: echor 0.1.6 Ruby Gem exposes login credentials]
[echor-ruby-system-process-info-disc(90858)]
Absolute path traversal vulnerability in htdocs/libraries/image-editor/image-edit.php in ImpressCMS before 1.3.6 allows remote attackers to delete arbitrary files via a full pathname in the image_path parameter in a cancel action.
[http://community.impresscms.org/modules/smartsection/item.php?itemid=675]
[20140203 [CVE-2014-1836] Arbitrary file deletion in ImpressCMS < 1.3.6 and two XSS issues]
[65279]
[https://github.com/pedrib/PoC/blob/master/generic/impresscms-1.3.5.txt]
Cross-site scripting (XSS) vulnerability in the StackIdeas Komento (com_komento) component before 1.7.4 for Joomla! allows remote attackers to inject arbitrary web script or HTML via vectors related to "checking new comments."
[http://stackideas.com/downloads/changelog/komento]
[65173]
[komento-joomla-cve20141837-xss(90974)]
The (1) extract_keys_from_pdf and (2) fill_pdf functions in pdf_ext.py in logilab-commons before 0.61.0 allows local users to overwrite arbitrary files and possibly have other unspecified impact via a symlink attack on /tmp/toto.fdf.
[[oss-security] 20140131 CVE request: temp file issues in python's logilab-common module]
[openSUSE-SU-2014:0306]
[http://www.logilab.org/ticket/207561]
[https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737051]
The Execute class in shellutils in logilab-commons before 0.61.0 uses tempfile.mktemp, which allows local users to have an unspecified impact by pre-creating the temporary file.
[[oss-security] 20140131 CVE request: temp file issues in python's logilab-common module]
[openSUSE-SU-2014:0306]
[http://www.logilab.org/ticket/207562]
[https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737051]
Cross-site scripting (XSS) vulnerability in Upload/search.php in MyBB 1.6.12 and earlier allows remote attackers to inject arbitrary web script or HTML via the keywords parameter in a do_search action, which is not properly handled in a forced SQL error message.
[http://osandamalith.wordpress.com/2014/02/02/mybb-1-6-12-post-xss-0day/]
[http://packetstormsecurity.com/files/125038/MyBB-1.6.12-POST-Cross-Site-Scripting.html]
Directory traversal vulnerability in the web interface in Titan FTP Server before 10.40 build 1829 allows remote attackers to copy an arbitrary user's home folder via a Move action with a .. (dot dot) in the src parameter.
[20140210 Titan FTP Server Directory Traversal Vulnerabilities - [CVE-2014-1841 / CVE-2014-1842 / CVE-2014-1843]]
[31579]
[65462]
Directory traversal vulnerability in the web interface in Titan FTP Server before 10.40 build 1829 allows remote attackers to list all usernames via a Go action with a .. (dot dot) in the search-bar value.
[20140210 Titan FTP Server Directory Traversal Vulnerabilities - [CVE-2014-1841 / CVE-2014-1842 / CVE-2014-1843]]
[31579]
Directory traversal vulnerability in the web interface in Titan FTP Server before 10.40 build 1829 allows remote attackers to obtain the property information of an arbitrary home folder via a Properties action with a .. (dot dot) in the src parameter.
[20140210 Titan FTP Server Directory Traversal Vulnerabilities - [CVE-2014-1841 / CVE-2014-1842 / CVE-2014-1843]]
[31579]
[65469]
An unspecified setuid root helper in Enlightenment before 0.17.6 allows local users to gain privileges by leveraging failure to properly sanitize the environment.
[[oss-security] 20140203 Re: CVE request: enlightenment sysactions]
[https://bugzilla.redhat.com/show_bug.cgi?id=1059410]
[enlightenment-helper-priv-esc(91216)]
[https://git.enlightenment.org/core/enlightenment.git/commit/?id=666df815cd86a50343859bce36c5cf968c5f38b0]
[https://git.enlightenment.org/core/enlightenment.git/commit/?id=bb4a21e98656fe2c7d98ba2163e6defe9a630e2b]
Enlightenment before 0.17.6 might allow local users to gain privileges via vectors involving the gdb method.
[[oss-security] 20140203 Re: CVE request: enlightenment sysactions]
[https://bugzilla.redhat.com/show_bug.cgi?id=1059410]
[enlightenment-configuration-priv-esc(91215)]
[https://git.enlightenment.org/core/enlightenment.git/commit/?id=bb4a21e98656fe2c7d98ba2163e6defe9a630e2b]
Foscam IP camera 11.37.2.49 and other versions, when using the Foscam DynDNS option, generates credentials based on predictable camera subdomain names, which allows remote attackers to spoof or hijack arbitrary cameras and conduct other attacks by modifying arbitrary camera records in the Foscam DNS server.
[http://blog.shekyan.com/2014/05/cve-2014-1849-foscam-dynamic-dns-predictable-credentials-vulnerability.html]
[20140508 CVE-2014-1849 Foscam Dynamic DNS predictable credentials vulnerability]
[https://github.com/artemharutyunyan/getmecamtool/blob/master/src/dnsmod.c]
SQL injection vulnerability in library/clicktracker.php in the AdRotate Pro plugin 3.9 through 3.9.5 and AdRotate Free plugin 3.9 through 3.9.4 for WordPress allows remote attackers to execute arbitrary SQL commands via the track parameter.
[http://www.adrotateplugin.com/2014/01/adrotate-pro-3-9-6-and-adrotate-free-3-9-5]
[31834]
[20140220 SQL Injection in AdRotate]
[65709]
[adrotate-track-sql-injection(91253)]
[https://www.htbridge.com/advisory/HTB23201]
Multiple cross-site scripting (XSS) vulnerabilities in Seo Panel before 3.5.0 allow remote attackers to inject arbitrary web script or HTML via the (1) capcheck parameter to directories.php or (2) keyword parameter to proxy.php.
[http://forum.seopanel.in/viewtopic.php?f=7&t=10978]
[http://packetstormsecurity.com/files/126706/Seo-Panel-3.4.0-Cross-Site-Scripting.html]
[20140516 Two Cross-Site Scripting (XSS) Vulnerabilities in Seo Panel]
[https://www.htbridge.com/advisory/HTB23200]
__init__.py in f2py in NumPy before 1.8.1 allows local users to write to arbitrary files via a symlink attack on a temporary file.
[FEDORA-2014-2289]
[FEDORA-2014-2387]
[[oss-security] 20140207 Re: CVE request: f2py insecure temporary file use]
[65441]
[https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737778]
[https://bugzilla.redhat.com/show_bug.cgi?id=1062009]
[numpy-cve20141858-symlink(91318)]
[https://github.com/numpy/numpy/blob/maintenance/1.8.x/doc/release/1.8.1-notes.rst]
[https://github.com/numpy/numpy/commit/0bb46c1448b0d3f5453d5182a17ea7ac5854ee15]
[https://github.com/numpy/numpy/pull/4262]
(1) core/tests/test_memmap.py, (2) core/tests/test_multiarray.py, (3) f2py/f2py2e.py, and (4) lib/tests/test_io.py in NumPy before 1.8.1 allow local users to write to arbitrary files via a symlink attack on a temporary file.
[FEDORA-2014-2289]
[FEDORA-2014-2387]
[[oss-security] 20140207 Re: CVE request: f2py insecure temporary file use]
[65440]
[https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737778]
[https://bugzilla.redhat.com/show_bug.cgi?id=1062009]
[numpy-cve20141859-symlink(91317)]
[https://github.com/numpy/numpy/blob/maintenance/1.8.x/doc/release/1.8.1-notes.rst]
[https://github.com/numpy/numpy/commit/0bb46c1448b0d3f5453d5182a17ea7ac5854ee15]
[https://github.com/numpy/numpy/pull/4262]
The client in Jetro COCKPIT Secure Browsing (JCSB) 4.3.1 and 4.3.3 does not validate the FileName element in an RDP_FILE_TRANSFER document, which allows remote JCSB servers to execute arbitrary programs by providing a .EXE extension.
[20140217 Jetro Cockpit Secure Browsing vulnerability - Client missing input validation allowing RCE]
[http://blog.quaji.com/2014/02/remote-code-execution-on-all-enterprise.html]
Restlet Framework 2.1.x before 2.1.7 and 2.x.x before 2.2 RC1, when using XMLRepresentation or XML serializers, allows attackers to cause a denial of service via an XML Entity Expansion (XEE) attack.
<a href="http://cwe.mitre.org/data/definitions/611.html" target="_blank">CWE-611: Improper Restriction of XML External Entity Reference ('XXE')</a>
[restlet-framework-cve20141868-dos(91181)]
[https://github.com/restlet/restlet-framework-java/wiki/XEE-security-enhancements]
Multiple cross-site scripting (XSS) vulnerabilities in ZeroClipboard.swf in ZeroClipboard before 1.3.2, as maintained by Jon Rohan and James M. Greene, allow remote attackers to inject arbitrary web script or HTML via vectors related to certain SWF query parameters (aka loaderInfo.parameters).
[65484]
[RHSA-2016:0070]
[zeroclipboard-cve20141869-xss(91085)]
[https://github.com/zeroclipboard/zeroclipboard/commit/2f9eb9750a433965572d047e24b0fc78fd1415ca]
[https://github.com/zeroclipboard/zeroclipboard/pull/335]
[https://github.com/zeroclipboard/zeroclipboard/releases/tag/v1.3.2]
[https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-10-01]
Opera before 19 on Mac OS X allows user-assisted remote attackers to spoof the address bar via vectors involving a drag-and-drop operation.
[http://blogs.opera.com/security/2014/01/security-changes-features-opera-19/]
The security_context_to_sid_core function in security/selinux/ss/services.c in the Linux kernel before 3.13.4 allows local users to cause a denial of service (system crash) by leveraging the CAP_MAC_ADMIN capability to set a zero-length security context.
[http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=2172fa709ab32ca60e86179dc67d0857be8e2c98]
[http://linux.oracle.com/errata/ELSA-2014-0771.html]
[http://linux.oracle.com/errata/ELSA-2014-3043.html]
[SUSE-SU-2015:0812]
[http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.13.4]
[[oss-security] 20140206 Re: CVE Request: Linux kernel: SELinux local DoS]
[65459]
[USN-2128-1]
[USN-2129-1]
[USN-2133-1]
[USN-2134-1]
[USN-2135-1]
[USN-2136-1]
[USN-2137-1]
[USN-2138-1]
[USN-2139-1]
[USN-2140-1]
[USN-2141-1]
[https://bugzilla.redhat.com/show_bug.cgi?id=1062356]
[https://github.com/torvalds/linux/commit/2172fa709ab32ca60e86179dc67d0857be8e2c98]
The Capture::Tiny module before 0.24 for Perl allows local users to write to arbitrary files via a symlink attack on a temporary file.
[http://cpansearch.perl.org/src/DAGOLDEN/Capture-Tiny-0.24/Changes]
[FEDORA-2014-2261]
[FEDORA-2014-2321]
[[oss-security] 20140206 CVE Request: Capture::Tiny: insecure use of /tmp]
[[oss-security] 20140206 Re: CVE Request: Capture::Tiny: insecure use of /tmp]
[65475]
[https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737835]
[https://bugzilla.redhat.com/show_bug.cgi?id=1062424]
[capturetiny-perl-symlink(91464)]
[https://github.com/dagolden/Capture-Tiny/commit/635c9eabd52ab8042b0c841823bd6e692de87924]
[https://github.com/dagolden/Capture-Tiny/issues/16]
The unpacker::redirect_stdio function in unpack.cpp in unpack200 in OpenJDK 6, 7, and 8; Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JRockit R27.8.1 and R28.3.1; and Java SE Embedded 7u51 does not securely create temporary files when a log file cannot be opened, which allows local users to overwrite arbitrary files via a symlink attack on /tmp/unpack.log.
[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737562]
[SSRT101667]
[SSRT101668]
[RHSA-2014:0675]
[RHSA-2014:0685]
[[oss-security] 20140203 CVE request and heads-up on insecure temp file handling in unpack200 (OpenJDK, Oracle Java)]
[[oss-security] 20140207 Re: CVE request and heads-up on insecure temp file handling in unpack200 (OpenJDK, Oracle Java)]
[GLSA-201406-32]
[DSA-2912]
[http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html]
[65568]
[USN-2187-1]
[USN-2191-1]
[http://www-01.ibm.com/support/docview.wss?uid=swg21672080]
[http://www-01.ibm.com/support/docview.wss?uid=swg21676746]
[http://www-01.ibm.com/support/docview.wss?uid=swg21679713]
[RHSA-2014:0413]
[RHSA-2014:0414]
[https://bugzilla.redhat.com/show_bug.cgi?id=1060907]
Multiple cross-site scripting (XSS) vulnerabilities in Dokeos 2.1.1 allow remote attackers to inject arbitrary web script or HTML via the (1) Phone, (2) Street, (3) Address line, (4) Zip code, or (5) City field to main/auth/profile.php; (6) Subject field to main/social/groups.php; or (7) Message body field to main/messages/view_message.php.
[[oss-security] 20140206 Dokeos 2.1.1 Multiple Stored XSS Vulnerabilities]
[[oss-security] 20140207 Re: Dokeos 2.1.1 Multiple Stored XSS Vulnerabilities]
[65416]
[http://www.xchg.info/?p=381]
[dokeos-cve20141877-xss(91295)]
Stack-based buffer overflow in the cmd_submitf function in cgi/cmd.c in Nagios Core, possibly 4.0.3rc1 and earlier, and Icinga before 1.8.6, 1.9 before 1.9.5, and 1.10 before 1.10.3 allows remote attackers to cause a denial of service (segmentation fault) via a long message to cmd.cgi.
[openSUSE-SU-2014:0516]
[65605]
[https://bugzilla.redhat.com/show_bug.cgi?id=1066578]
[https://dev.icinga.org/issues/5434]
[[debian-lts-announce] 20181224 [SECURITY] [DLA 1615-1] nagios3 security update]
[https://www.icinga.org/2014/02/11/bugfix-releases-1-10-3-1-9-5-1-8-6]
Cross-site scripting (XSS) vulnerability in import.php in phpMyAdmin before 4.1.7 allows remote authenticated users to inject arbitrary web script or HTML via a crafted filename in an import action.
[openSUSE-SU-2014:0344]
[http://www.phpmyadmin.net/home_page/security/PMASA-2014-1.php]
[65717]
[https://github.com/phpmyadmin/phpmyadmin/commit/968d5d5f486820bfa30af046f063b9f23304e14a]
Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier allow remote attackers to bypass intended device-resource restrictions of an event-based bridge via a crafted library clone that leverages IFRAME script execution and waits a certain amount of time for an OnJsPrompt handler return value as an alternative to correct synchronization.
[[oss-security] 20140207 Re: CVE request: multiple issues in Apache Cordova/PhoneGap]
[http://packetstormsecurity.com/files/124954/apachecordovaphonegap-bypass.txt]
[20140124 Security Vulnerabilities in Apache Cordova / PhoneGap]
[http://www.cs.utexas.edu/~shmat/shmat_ndss14nofrak.pdf]
[http://www.internetsociety.org/ndss2014/programme#session3]
Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier allow remote attackers to bypass intended device-resource restrictions of an event-based bridge via a crafted library clone that leverages IFRAME script execution and directly accesses bridge JavaScript objects, as demonstrated by certain cordova.require calls.
[[oss-security] 20140207 Re: CVE request: multiple issues in Apache Cordova/PhoneGap]
[http://packetstormsecurity.com/files/124954/apachecordovaphonegap-bypass.txt]
[20140124 Security Vulnerabilities in Apache Cordova / PhoneGap]
[http://www.cs.utexas.edu/~shmat/shmat_ndss14nofrak.pdf]
[http://www.internetsociety.org/ndss2014/programme#session3]
Adobe PhoneGap before 2.6.0 on Android uses the shouldOverrideUrlLoading callback instead of the proper shouldInterceptRequest callback, which allows remote attackers to bypass intended device-resource restrictions via content that is accessed (1) in an IFRAME element or (2) with the XMLHttpRequest method by a crafted application.
[[oss-security] 20140207 Re: CVE request: multiple issues in Apache Cordova/PhoneGap]
[http://packetstormsecurity.com/files/124954/apachecordovaphonegap-bypass.txt]
[20140124 Security Vulnerabilities in Apache Cordova / PhoneGap]
[http://www.cs.utexas.edu/~shmat/shmat_ndss14nofrak.pdf]
[http://www.internetsociety.org/ndss2014/programme#session3]
[https://github.com/phonegap/phonegap/blob/2.6.0/changelog]
Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier on Windows Phone 7 and 8 do not properly restrict navigation events, which allows remote attackers to bypass intended device-resource restrictions via content that is accessed (1) in an IFRAME element or (2) with the XMLHttpRequest method by a crafted application.
[[oss-security] 20140207 Re: CVE request: multiple issues in Apache Cordova/PhoneGap]
[http://packetstormsecurity.com/files/124954/apachecordovaphonegap-bypass.txt]
[20140124 Security Vulnerabilities in Apache Cordova / PhoneGap]
[http://www.cs.utexas.edu/~shmat/shmat_ndss14nofrak.pdf]
[http://www.internetsociety.org/ndss2014/programme#session3]
The ForzeArmate application for Android, when Adobe PhoneGap 2.9.0 or earlier is used, allows remote attackers to execute arbitrary JavaScript code, and consequently obtain write access to external-storage resources, by leveraging control over any Google syndication advertising domain.
[[oss-security] 20140207 Re: CVE request: multiple issues in Apache Cordova/PhoneGap]
[http://www.cs.utexas.edu/~shmat/shmat_ndss14nofrak.pdf]
[http://www.internetsociety.org/ndss2014/programme#session3]
The Edinburgh by Bus application for Android, when Adobe PhoneGap 2.9.0 or earlier is used, allows remote attackers to execute arbitrary JavaScript code, and consequently access external-storage resources, by leveraging control over one of a number of "obscure Eastern European dating sites."
[[oss-security] 20140207 Re: CVE request: multiple issues in Apache Cordova/PhoneGap]
[http://www.cs.utexas.edu/~shmat/shmat_ndss14nofrak.pdf]
[http://www.internetsociety.org/ndss2014/programme#session3]
The DrinkedIn BarFinder application for Android, when Adobe PhoneGap 2.9.0 or earlier is used, allows remote attackers to execute arbitrary JavaScript code, and consequently obtain sensitive fine-geolocation information, by leveraging control over one of a number of adult sites, as demonstrated by (1) freelifetimecheating.com and (2) www.babesroulette.com.
[[oss-security] 20140207 Re: CVE request: multiple issues in Apache Cordova/PhoneGap]
[http://www.cs.utexas.edu/~shmat/shmat_ndss14nofrak.pdf]
[http://www.internetsociety.org/ndss2014/programme#session3]
Cross-site scripting (XSS) vulnerability in the BuddyPress plugin before 1.9.2 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the name field to groups/create/step/group-details. NOTE: this can be exploited without authentication by leveraging CVE-2014-1889.
[http://buddypress.org/2014/02/buddypress-1-9-2]
[http://packetstormsecurity.com/files/125212/WordPress-Buddypress-1.9.1-Cross-Site-Scripting.html]
[20140213 Wordpress plugin Buddypress <= 1.9.1 stored xss vulnerability]
[65555]
[buddypress-cve20141888-xss(91175)]
The Group creation process in the Buddypress plugin before 1.9.2 for WordPress allows remote authenticated users to gain control of arbitrary groups by leveraging a missing permissions check.
[20140213 Wordpress plugin Buddypress <= 1.9.1 privilege escalation vulnerability]
[65554]
[https://buddypress.org/2014/02/buddypress-1-9-2/]
[buddypress-cve20141889-sec-bypass(91261)]
Multiple integer overflows in the (1) FLASK_GETBOOL, (2) FLASK_SETBOOL, (3) FLASK_USER, and (4) FLASK_CONTEXT_TO_SID suboperations in the flask hypercall in Xen 4.3.x, 4.2.x, 4.1.x, 3.2.x, and earlier, when XSM is enabled, allow local users to cause a denial of service (processor fault) via unspecified vectors, a different vulnerability than CVE-2014-1892, CVE-2014-1893, and CVE-2014-1894.
[SUSE-SU-2014:0372]
[SUSE-SU-2014:0373]
[SUSE-SU-2014:0446]
[GLSA-201407-03]
[[oss-security] 20140207 Re: Xen Security Advisory 84 - integer overflow in several XSM/Flask hypercalls]
[[oss-security] 20140207 Re: Xen Security Advisory 84 - integer overflow in several XSM/Flask hypercalls]
[[oss-security] 20140210 Xen Security Advisory 84 (CVE-2014-1891,CVE-2014-1892,CVE-2014-1893,CVE-2014-1894) - integer overflow in several XSM/Flask hypercalls]
[http://xenbits.xen.org/xsa/advisory-84.html]
Xen 3.3 through 4.1, when XSM is enabled, allows local users to cause a denial of service via vectors related to a "large memory allocation," a different vulnerability than CVE-2014-1891, CVE-2014-1893, and CVE-2014-1894.
[SUSE-SU-2014:0372]
[SUSE-SU-2014:0373]
[SUSE-SU-2014:0446]
[GLSA-201407-03]
[[oss-security] 20140207 Re: Xen Security Advisory 84 - integer overflow in several XSM/Flask hypercalls]
[[oss-security] 20140207 Re: Xen Security Advisory 84 - integer overflow in several XSM/Flask hypercalls]
[[oss-security] 20140210 Xen Security Advisory 84 (CVE-2014-1891,CVE-2014-1892,CVE-2014-1893,CVE-2014-1894) - integer overflow in several XSM/Flask hypercalls]
[http://xenbits.xen.org/xsa/advisory-84.html]
Multiple integer overflows in the (1) FLASK_GETBOOL and (2) FLASK_SETBOOL suboperations in the flask hypercall in Xen 4.1.x, 3.3.x, 3.2.x, and earlier, when XSM is enabled, allow local users to cause a denial of service (processor fault) via unspecified vectors, a different vulnerability than CVE-2014-1891, CVE-2014-1892, and CVE-2014-1894.
[SUSE-SU-2014:0372]
[SUSE-SU-2014:0373]
[SUSE-SU-2014:0446]
[GLSA-201407-03]
[[oss-security] 20140207 Re: Xen Security Advisory 84 - integer overflow in several XSM/Flask hypercalls]
[[oss-security] 20140207 Re: Xen Security Advisory 84 - integer overflow in several XSM/Flask hypercalls]
[[oss-security] 20140210 Xen Security Advisory 84 (CVE-2014-1891,CVE-2014-1892,CVE-2014-1893,CVE-2014-1894) - integer overflow in several XSM/Flask hypercalls]
[http://xenbits.xen.org/xsa/advisory-84.html]
Multiple integer overflows in unspecified suboperations in the flask hypercall in Xen 3.2.x and earlier, when XSM is enabled, allow local users to cause a denial of service (processor fault) via unspecified vectors, a different vulnerability than CVE-2014-1891, CVE-2014-1892, and CVE-2014-1893.
[SUSE-SU-2014:0372]
[SUSE-SU-2014:0373]
[SUSE-SU-2014:0446]
[GLSA-201407-03]
[[oss-security] 20140207 Re: Xen Security Advisory 84 - integer overflow in several XSM/Flask hypercalls]
[[oss-security] 20140207 Re: Xen Security Advisory 84 - integer overflow in several XSM/Flask hypercalls]
[[oss-security] 20140210 Xen Security Advisory 84 (CVE-2014-1891,CVE-2014-1892,CVE-2014-1893,CVE-2014-1894) - integer overflow in several XSM/Flask hypercalls]
[http://xenbits.xen.org/xsa/advisory-84.html]
Off-by-one error in the flask_security_avc_cachestats function in xsm/flask/flask_op.c in Xen 4.2.x and 4.3.x, when the maximum number of physical CPUs are in use, allows local users to cause a denial of service (host crash) or obtain sensitive information from hypervisor memory by leveraging a FLASK_AVC_CACHESTAT hypercall, which triggers a buffer over-read.
[SUSE-SU-2014:0373]
[GLSA-201407-03]
[[oss-security] 20140207 Re: Xen Security Advisory 84 - integer overflow in several XSM/Flask hypercalls]
[[oss-security] 20140210 Xen Security Advisory 85 (CVE-2014-1895) - Off-by-one error in FLASK_AVC_CACHESTAT hypercall]
[http://xenbits.xen.org/xsa/advisory-85.html]
The (1) do_send and (2) do_recv functions in io.c in libvchan in Xen 4.2.x, 4.3.x, and 4.4-RC series allows local guests to cause a denial of service or possibly gain privileges via crafted xenstore ring indexes, which triggers a "read or write past the end of the ring."
[SUSE-SU-2014:0373]
[GLSA-201407-03]
[[oss-security] 20140207 Re: Xen Security Advisory 84 - integer overflow in several XSM/Flask hypercalls]
[[oss-security] 20140210 Xen Security Advisory 86 (CVE-2014-1896) - libvchan failure handling malicious ring indexes]
[http://xenbits.xen.org/xsa/advisory-86.html]
[http://xenbits.xen.org/xsa/xsa86.patch]
Cross-site scripting (XSS) vulnerability in Citrix NetScaler Gateway (formerly Citrix Access Gateway Enterprise Edition) 9.x before 9.3.66.5 and 10.x before 10.1.123.9 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
[67177]
[1030186]
[https://support.citrix.com/article/CTX140291]
Y-Cam camera models SD range YCB003, YCK003, and YCW003; S range YCB004, YCK004, YCW004; EyeBall YCEB03; Bullet VGA YCBL03 and YCBLB3; Bullet HD 720 YCBLHD5; Y-cam Classic Range YCB002, YCK002, and YCW003; and Y-cam Original Range YCB001, YCW001, running firmware 4.30 and earlier, allow remote attackers to bypass authentication and obtain sensitive information via a leading "/./" in a request to en/account/accedit.asp.
[http://www.y-cam.com/y-cam-security-fix/]
[https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2014-007/?fid=3850]
Y-Cam camera models SD range YCB003, YCK003, and YCW003; S range YCB004, YCK004, YCW004; EyeBall YCEB03; Bullet VGA YCBL03 and YCBLB3; Bullet HD 720 YCBLHD5; Y-cam Classic Range YCB002, YCK002, and YCW003; and Y-cam Original Range YCB001, YCW001, running firmware 4.30 and earlier, allow remote authenticated users to cause a denial of service (reboot) via a malformed (1) path parameter to en/store_main.asp, (2) item parameter to en/account/accedit.asp, or (3) emailid parameter to en/smtpclient.asp. NOTE: this issue can be exploited without authentication by leveraging CVE-2014-1900.
[http://www.y-cam.com/y-cam-security-fix/]
[https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2014-007/?fid=3850]
Multiple cross-site scripting (XSS) vulnerabilities in Y-Cam camera models SD range YCB003, YCK003, and YCW003; S range YCB004, YCK004, YCW004; EyeBall YCEB03; Bullet VGA YCBL03 and YCBLB3; Bullet HD 720 YCBLHD5; Y-cam Classic Range YCB002, YCK002, and YCW003; and Y-cam Original Range YCB001, YCW001, running firmware 4.30 and earlier, allow remote authenticated users to inject arbitrary web script or HTML via the (1) SYSCONTACT parameter to form/identityApply, as triggered using en/identity.asp; (2) PASSWD parameter to form/accAdd, as triggered using en/account/accedit.asp; (3) NTPSERVER parameter to form/clockApply, as triggered using en/clock.asp; (4) SERVER parameter to form/smtpclientApply, as triggered using en/smtpclient.asp; (5) SERVER parameter to form/ftpApply, as triggered using en/ftp.asp; or (6) SERVER parameter to form/httpEventApply, as triggered using en/httpevent.asp.
[http://www.y-cam.com/y-cam-security-fix/]
[https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2014-007/?fid=3850]
admin/libraries/view.functions.php in FreePBX 2.9 before 2.9.0.14, 2.10 before 2.10.1.15, 2.11 before 2.11.0.23, and 12 before 12.0.1alpha22 does not restrict the set of functions accessible to the API handler, which allows remote attackers to execute arbitrary PHP code via the function and args parameters to admin/config.php.
[20140211 Freepbx , php code execution exploit]
[20140211 Re: Freepbx , php code execution exploit]
[http://code.freepbx.org/changelog/FreePBX_Framework?cs=a29382efeb293ef4f42aa9b841dfc8eabb2d1e03]
[http://code.freepbx.org/changelog/FreePBX_SVN?cs=16429]
[http://issues.freepbx.org/browse/FREEPBX-7117]
[http://issues.freepbx.org/browse/FREEPBX-7123]
[http://packetstormsecurity.com/files/125166/FreePBX-2.x-Code-Execution.html]
[http://packetstormsecurity.com/files/125215/FreePBX-2.9-Remote-Code-Execution.html]
[http://www.freepbx.org/news/2014-02-06/security-vulnerability-notice]
[20140211 [CVE-2014-1903] FreePBX 2.9 through 12 RCE]
[https://github.com/0x00string/oldays/blob/master/CVE-2014-1903.pl]
Cross-site scripting (XSS) vulnerability in web/servlet/tags/form/FormTag.java in Spring MVC in Spring Framework 3.0.0 before 3.2.8 and 4.0.0 before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via the requested URI in a default action.
[http://docs.spring.io/spring/docs/3.2.8.RELEASE/changelog.txt]
[RHSA-2014:0400]
[20140312 CVE-2014-1904 XSS when using Spring MVC]
[http://www.gopivotal.com/security/cve-2014-1904]
[20140311 CVE-2014-1904 XSS when using Spring MVC]
[66137]
[https://github.com/spring-projects/spring-framework/commit/741b4b229ae032bd17175b46f98673ce0bd2d485]
[https://jira.springsource.org/browse/SPR-11426]
Unrestricted file upload vulnerability in ls/vw_snapshots.php in the VideoWhisper Live Streaming Integration plugin before 4.29.5 for WordPress allows remote attackers to execute arbitrary PHP code by uploading a file with a double extension, and then accessing the file via a direct request to a wp-content/plugins/videowhisper-live-streaming-integration/ls/snapshots/ pathname, as demonstrated by a .php.jpg filename.
[https://www.htbridge.com/advisory/HTB23199]
Multiple cross-site scripting (XSS) vulnerabilities in the VideoWhisper Live Streaming Integration plugin before 4.29.5 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) m parameter to lb_status.php; (2) msg parameter to vc_chatlog.php; n parameter to (3) channel.php, (4) htmlchat.php, (5) video.php, or (6) videotext.php; (7) message parameter to lb_logout.php; or ct parameter to (8) lb_status.php or (9) v_status.php in ls/.
[http://packetstormsecurity.com/files/125454]
[videowhisper-cve20141906-xss(91477)]
[https://www.htbridge.com/advisory/HTB23199]
Multiple directory traversal vulnerabilities in the VideoWhisper Live Streaming Integration plugin before 4.29.5 for WordPress allow remote attackers to (1) read arbitrary files via a .. (dot dot) in the s parameter to ls/rtmp_login.php or (2) delete arbitrary files via a .. (dot dot) in the s parameter to ls/rtmp_logout.php.
[http://packetstormsecurity.com/files/125454]
[videowhisper-cve20141907-dir-trav(91478)]
[https://www.htbridge.com/advisory/HTB23199]
The error-handling feature in (1) bp.php, (2) videowhisper_streaming.php, and (3) ls/rtmp.inc.php in the VideoWhisper Live Streaming Integration plugin before 4.29.5 for WordPress allows remote attackers to obtain sensitive information via a direct request, which reveals the full path in an error message.
[https://www.htbridge.com/advisory/HTB23199]
Integer signedness error in system/core/adb/adb_client.c in Android Debug Bridge (ADB) for Android 4.4 in the Android SDK Platform Tools 18.0.1 allows ADB servers to execute arbitrary code via a negative length value, which bypasses a signed comparison and triggers a stack-based buffer overflow.
[openSUSE-SU-2014:0636]
[openSUSE-SU-2014:0637]
[[oss-security] 20140208 Re: CVE Request: Multiple security issues in Android Debug Bridge (Android SDK Tools)]
[65403]
[androidsdk-cve20141909-bo(91291)]
Citrix ShareFile Mobile and ShareFile Mobile for Tablets before 2.4.4 for Android do not verify X.509 certificates from SSL servers, which allow man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
[http://support.citrix.com/article/CTX140303]
[1029791]
The Foscam FI8910W camera with firmware before 11.37.2.55 allows remote attackers to obtain sensitive video and image data via a blank username and password.
[http://foscam.us/forum/mjpeg-54-firmware-bug-user-logon-bypass-t8442.html]
[VU#525132]
Buffer overflow in the socket.recvfrom_into function in Modules/socketmodule.c in Python 2.5 before 2.7.7, 3.x before 3.3.4, and 3.4.x before 3.4rc1 allows remote attackers to execute arbitrary code via a crafted string.
[http://bugs.python.org/issue20246]
[http://hg.python.org/cpython/rev/87673659d8f7]
[APPLE-SA-2015-08-13-2]
[openSUSE-SU-2014:0518]
[openSUSE-SU-2014:0597]
[http://pastebin.com/raw.php?i=GHXSmNEg]
[RHSA-2015:1064]
[RHSA-2015:1330]
[DSA-2880]
[31875]
[[oss-security] 20140212 Re: CVE request? buffer overflow in socket.recvfrom_into]
[http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html]
[http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html]
[65379]
[1029831]
[USN-2125-1]
[GLSA-201503-10]
[https://support.apple.com/kb/HT205031]
[https://www.trustedsec.com/february-2014/python-remote-code-execution-socket-recvfrom_into/]
Multiple cross-site scripting (XSS) vulnerabilities in Command School Student Management System 1.06.01 allow remote attackers to inject arbitrary web script or HTML via the (1) topic parameter to sw/add_topic.php or (2) nick parameter to sw/chat/message.php.
[http://packetstormsecurity.com/files/124708/Command-School-Student-Management-System-1.06.01-SQL-Injection-CSRF-XSS.html]
[64707]
[commandschool-addtopic-xss(90178)]
[commandschool-message-xss(90179)]
Multiple cross-site request forgery (CSRF) vulnerabilities in Command School Student Management System 1.06.01 allow remote attackers to hijack the authentication of (1) administrators for requests that change the administrator password via an update action to sw/admin_change_password.php or (2) unspecified victims for requests that add a topic or blog entry to sw/add_topic.php. NOTE: vector 2 can be leveraged to bypass the authentication requirements for exploiting vector 1 in CVE-2014-1914.
[http://packetstormsecurity.com/files/124708/Command-School-Student-Management-System-1.06.01-SQL-Injection-CSRF-XSS.html]
[64707]
The (1) opus_packet_get_nb_frames and (2) opus_packet_get_samples_per_frame functions in the client in MumbleKit before commit fd190328a9b24d37382b269a5674b0c0c7a7e36d and Mumble for iOS 1.1 through 1.2.2 do not properly check the return value of the copyDataBlock method, which allow remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted length prefix value in an Opus voice packet.
[http://mumble.info/security/Mumble-SA-2014-003.txt]
parcimonie before 0.8.1, when using a large keyring, sleeps for the same amount of time between fetches, which allows attackers to correlate key fetches via unspecified vectors.
[[oss-security] 20140210 CVE request: parcimonie (0.6 to 0.8, included) possible correlation between key fetches]
[[oss-security] 20140210 Re: CVE request: parcimonie (0.6 to 0.8, included) possible correlation between key fetches]
[DSA-2860]
[65505]
[https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=738134]
[parcimonie-cve20141921-info-disc(91118)]
[https://gaffer.ptitcanardnoir.org/intrigeri/files/parcimonie/App-Parcimonie-0.8.1.tar.gz]
The shell_quote function in python-gnupg 0.3.5 does not properly quote strings, which allows context-dependent attackers to execute arbitrary code via shell metacharacters in unspecified vectors, as demonstrated using "$(" command-substitution sequences, a different vulnerability than CVE-2014-1928. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7323.
[[oss-security] 20140204 Re: CVE request: python-gnupg before 0.3.5 shell injection]
[[oss-security] 20140209 Re: CVE request: python-gnupg before 0.3.5 shell injection]
[DSA-2946]
[https://code.google.com/p/python-gnupg/]
[https://code.google.com/p/python-gnupg/issues/detail?id=98]
The shell_quote function in python-gnupg 0.3.5 does not properly escape characters, which allows context-dependent attackers to execute arbitrary code via shell metacharacters in unspecified vectors, as demonstrated using "\" (backslash) characters to form multi-command sequences, a different vulnerability than CVE-2014-1927. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7323.
[[oss-security] 20140204 Re: CVE request: python-gnupg before 0.3.5 shell injection]
[[oss-security] 20140209 Re: CVE request: python-gnupg before 0.3.5 shell injection]
[DSA-2946]
[https://code.google.com/p/python-gnupg/]
[https://code.google.com/p/python-gnupg/issues/detail?id=98]
python-gnupg 0.3.5 and 0.3.6 allows context-dependent attackers to have an unspecified impact via vectors related to "option injection through positional arguments." NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7323.
[[oss-security] 20140204 Re: CVE request: python-gnupg before 0.3.5 shell injection]
[[oss-security] 20140212 Re: CVE request: python-gnupg before 0.3.5 shell injection]
[DSA-2946]
Visibility Software Cyber Recruiter before 8.1.00 does not use the appropriate combination of HTTPS transport and response headers to prevent access to (1) AppSelfService.aspx and (2) AgencyPortal.aspx in the browser history, which allows remote attackers to obtain sensitive information by leveraging an unattended workstation.
[http://jvn.jp/vu/JVNVU97441356/index.html]
[VU#566894]
[65305]
[http://www.vspublic.com/help/Cyber%20Recruiter/default.aspx?pageid=release_details]
The user login page in Visibility Software Cyber Recruiter before 8.1.00 generates different responses for invalid password-retrieval attempts depending on which data elements are incorrect, which might allow remote attackers to obtain account-related information via a series of requests.
[65564]
[http://www.vspublic.com/help/Cyber%20Recruiter/default.aspx?pageid=release_details]
The (1) load_djpeg function in JpegImagePlugin.py, (2) Ghostscript function in EpsImagePlugin.py, (3) load function in IptcImagePlugin.py, and (4) _copy function in Image.py in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 do not properly create temporary files, which allow local users to overwrite arbitrary files and obtain sensitive information via a symlink attack on the temporary file.
[openSUSE-SU-2014:0591]
[[oss-security] 20140210 Re: CVE requests: Pacemaker, Python Imaging Library, eyeD3, 9base, rc, Gamera, RPLY - insecure use of /tmp]
[65511]
[USN-2168-1]
[https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737059]
[https://github.com/python-imaging/Pillow/commit/4e9f367dfd3f04c8f5d23f7f759ec12782e10ee7]
[GLSA-201612-52]
The (1) JpegImagePlugin.py and (2) EpsImagePlugin.py scripts in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 uses the names of temporary files on the command line, which makes it easier for local users to conduct symlink attacks by listing the processes.
[openSUSE-SU-2014:0591]
[[oss-security] 20140210 CVE requests: Pacemaker, Python Imaging Library, eyeD3, 9base, rc, Gamera, RPLY - insecure use of /tmp]
[[oss-security] 20140210 Re: CVE requests: Pacemaker, Python Imaging Library, eyeD3, 9base, rc, Gamera, RPLY - insecure use of /tmp]
[65513]
[USN-2168-1]
[https://github.com/python-imaging/Pillow/commit/4e9f367dfd3f04c8f5d23f7f759ec12782e10ee7]
[GLSA-201612-52]
tag.py in eyeD3 (aka python-eyed3) 7.0.3, 0.6.18, and earlier for Python allows local users to modify arbitrary files via a symlink attack on a temporary file.
[openSUSE-SU-2014:0619]
[openSUSE-SU-2014:0620]
[https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737062]
[https://bugzilla.redhat.com/show_bug.cgi?id=1063671]
java/android/webkit/BrowserFrame.java in Android before 4.4 uses the addJavascriptInterface API in conjunction with creating an object of the SearchBoxImpl class, which allows attackers to execute arbitrary Java code by leveraging access to the searchBoxJavaBridge_ interface at certain Android API levels.
[http://blog.chromium.org/2013/11/introducing-chromium-powered-android.html]
[[oss-security] 20140210 CVE-2014-1939 searchBoxJavaBridge_ in Android Jelly Bean]
[https://support.lenovo.com/us/en/product_security/len_6421]
Cross-site scripting (XSS) vulnerability in aal/loginverification.aspx in Pearson eSIS Enterprise Student Information System allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
[VU#163188]
Fine Free file before 5.17 allows context-dependent attackers to cause a denial of service (infinite recursion, CPU consumption, and crash) via a crafted indirect offset value in the magic of a file.
[openSUSE-SU-2014:0364]
[openSUSE-SU-2014:0367]
[[file] 20142010 segfault in magic_buffer]
[[file] 20140211 segfault in magic_buffer]
[[file] 20140211 segfault in magic_buffer]
[[file] 20140213 segfault in magic_buffer]
[RHSA-2014:1765]
[http://support.apple.com/kb/HT6443]
[DSA-2861]
[DSA-2868]
[http://www.php.net/ChangeLog-5.php]
[USN-2123-1]
[USN-2126-1]
[https://github.com/glensc/file/blob/FILE5_17/ChangeLog]
Cross-site scripting (XSS) vulnerability in Ilch CMS 2.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the text parameter to index.php/guestbook/index/newentry.
[32076]
[20140305 Cross-Site Scripting (XSS) in Ilch CMS]
[ilchcms-cve20141944-xss(91538)]
[https://github.com/IlchCMS/Ilch-2.0/commit/381e15f39d07d3cdf6aaaa25c0f2321f817935f7]
[https://www.htbridge.com/advisory/HTB23203]
SQL injection vulnerability in ajax_udf.php in OpenDocMan before 1.2.7.2 allows remote attackers to execute arbitrary SQL commands via the add_value parameter.
[http://www.opendocman.com/opendocman-v1-2-7-1-release]
[http://www.opendocman.com/opendocman-v1-2-7-2-released]
[65775]
[https://www.htbridge.com/advisory/HTB23202]
OpenDocMan 1.2.7 and earlier does not properly validate allowed actions, which allows remote authenticated users to bypass an intended access restrictions and assign administrative privileges to themselves via a crafted request to signup.php.
[20140305 Multiple Vulnerabilities in OpenDocMan]
[opendocman-cve20141946-sec-bypass(91577)]
[https://www.htbridge.com/advisory/HTB23202]
OpenStack Image Registry and Delivery Service (Glance) 2013.2 through 2013.2.1 and Icehouse before icehouse-2 logs a URL containing the Swift store backend password when authentication fails and WARNING level logging is enabled, which allows local users to obtain sensitive information by reading the log.
[RHSA-2014:0229]
[[oss-security] 20140212 [OSSA 2014-004] Glance Swift store backend password leak (CVE-2014-1948)]
[65507]
[https://bugs.launchpad.net/glance/+bug/1275062]
GTK+ 3.10.9 and earlier, as used in cinnamon-screensaver, gnome-screensaver, and other applications, allows physically proximate attackers to bypass the lock screen by pressing the menu button.
[http://advisories.mageia.org/MGASA-2014-0374.html]
[[oss-security] 20140212 cinnamon-screensaver lock bypass (tested on Fedora 20)]
[[oss-security] 20140212 Re: cinnamon-screensaver lock bypass (tested on Fedora 20)]
[MDVSA-2015:162]
[USN-2475-1]
[https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=759145]
[https://bugzilla.redhat.com/show_bug.cgi?id=1064695]
[https://github.com/linuxmint/cinnamon-screensaver/issues/44]
Use-after-free vulnerability in the xc_cpupool_getinfo function in Xen 4.1.x through 4.3.x, when using a multithreaded toolstack, does not properly handle a failure by the xc_cpumap_alloc function, which allows local users with access to management functions to cause a denial of service (heap corruption) and possibly gain privileges via unspecified vectors.
[SUSE-SU-2014:0372]
[SUSE-SU-2014:0373]
[DSA-3006]
[[oss-security] 20140212 Xen Security Advisory 88 (CVE-2014-1950) - use-after-free in xc_cpupool_getinfo() under memory pressure]
[http://xenbits.xen.org/xsa/advisory-88.html]
Cross-site scripting (XSS) vulnerability in FortiGuard FortiWeb before 5.0.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
[http://www.fortiguard.com/advisory/FG-IR-13-009/]
CRLF injection vulnerability in FortiGuard FortiWeb before 5.0.3 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.
CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') "http://cwe.mitre.org/data/definitions/113.html"
[http://www.fortiguard.com/advisory/FG-IR-13-009/]
FortiGuard FortiWeb before 5.0.3 allows remote authenticated users to gain privileges via unspecified vectors.
[http://www.fortiguard.com/advisory/FG-IR-13-009/]
lib/x509/verify.c in GnuTLS before 3.1.21 and 3.2.x before 3.2.11 treats version 1 X.509 certificates as intermediate CAs, which allows remote attackers to bypass intended restrictions by leveraging a X.509 V1 certificate from a trusted CA to issue new certificates.
[[oss-security] 20140213 CVE Request - GnuTLS corrects flaw in certificate verification (3.1.x/3.2.x)]
[[oss-security] 20140213 Re: CVE Request - GnuTLS corrects flaw in certificate verification (3.1.x/3.2.x)]
[DSA-2866]
[http://www.gnutls.org/security.html]
[65559]
[USN-2121-1]
[https://www.gitorious.org/gnutls/gnutls/commit/b1abfe3d182d68539900092eb42fc62cf1bb7e7c]
The Solution Manager in SAP NetWeaver does not properly restrict access, which allows remote attackers to obtain sensitive information via unspecified vectors.
[http://scn.sap.com/docs/DOC-8218]
[https://erpscan.io/advisories/erpscan-14-004-sap-netweaver-solution-manager-missing-authorization-check-information-disclosure/]
[netweaver-solution-info-disc(91093)]
[https://service.sap.com/sap/support/notes/1828885]
Unspecified vulnerability in the Portal WebDynPro in SAP NetWeaver allows remote attackers to obtain sensitive path information via unknown attack vectors.
[http://scn.sap.com/docs/DOC-8218]
[https://erpscan.io/advisories/erpscan-14-002-sap-portal-webdynpro-path-disclosure/]
[netweaver-webdyn-path-disclosure(91096)]
[https://service.sap.com/sap/support/notes/1852146]
Gwsync in SAP CRM 7.02 EHP 2 allows remote attackers to obtain sensitive information via unspecified vectors, related to an XML External Entity (XXE) issue.
[http://scn.sap.com/docs/DOC-8218]
[https://erpscan.io/advisories/erpscan-14-003-sap-crm-gwsync-xxe/]
[sap-crm-info-disc(91098)]
[https://service.sap.com/sap/support/notes/1917054]
Unspecified vulnerability in Message Server in SAP NetWeaver 7.20 allows remote attackers to cause a denial of service via unknown attack vectors.
[http://scn.sap.com/docs/DOC-8218]
[https://erpscan.io/advisories/erpscan-14-001-sap-netweaver-message-server-dos/]
[netweaver-message-server-dos(91097)]
[https://service.sap.com/sap/support/notes/1773912]
Cross-site scripting (XSS) vulnerability in the Integration Repository in the SAP Exchange Infrastructure (BC-XI) component in SAP NetWeaver allows remote attackers to inject arbitrary web script or HTML via vectors related to the ESR application and a DIR error.
[http://scn.sap.com/docs/DOC-8218]
[https://erpscan.io/advisories/erpscan-14-005-sap-netweaver-dir-error-xss/]
[netweaver-dir-xss(91095)]
[https://service.sap.com/sap/support/notes/1788080]
Cross-site scripting (XSS) vulnerability in ISpeakAdapter in the Integration Repository in the SAP Exchange Infrastructure (BC-XI) component 3.0, 7.00 through 7.02, and 7.10 through 7.11 for SAP NetWeaver allows remote attackers to inject arbitrary web script or HTML via vectors related to PIP.
[http://www.stechno.net/sap-notes.html?view=sapnote&id=1442517]
[https://erpscan.io/advisories/erpscan-14-006-sap-netweaver-pip-xss/]
[netweaver-ispeakadapter-xss(91094)]
[https://service.sap.com/sap/support/notes/1442517]
The SNMP implementation in Siemens RuggedCom ROS before 3.11, ROS 3.11 for RS950G, ROS 3.12 before 3.12.4, and ROS 4.0 for RSG2488 allows remote attackers to cause a denial of service (device outage) via crafted packets.
[http://ics-cert.us-cert.gov/advisories/ICSA-14-051-03]
[http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-892342.pdf]
The Denny's application before 2.0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
[JVN#48810179]
[JVNDB-2014-000022]
[https://play.google.com/store/apps/details?id=jp.denimoba]
Cross-site scripting (XSS) vulnerability in the XooNIps module 3.47 and earlier for XOOPS allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
[JVN#87797318]
[JVNDB-2014-000025]
[65807]
[http://xoonips.sourceforge.jp]
Directory traversal vulnerability in the apps4u@android SD Card Manager application before 20140224 for Android allows attackers to overwrite or create arbitrary files via a crafted filename.
[JVN#47386847]
[JVNDB-2014-000035]
Directory traversal vulnerability in the ES File Explorer File Manager application before 3.0.4 for Android allows remote attackers to overwrite or create arbitrary files via unspecified vectors.
[JVN#70029459]
[JVNDB-2014-000033]
Cross-site scripting (XSS) vulnerability in Silex before 2.0.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
[JVN#14282890]
[JVNDB-2014-000032]
[66329]
[https://github.com/silexlabs/Silex/blob/master/docs/change-log.md]
Apache Tapestry before 5.3.6 relies on client-side object storage without checking whether a client has modified an object, which allows remote attackers to cause a denial of service (resource consumption) or execute arbitrary code via crafted serialized data.
[JVN#17611367]
[JVNDB-2015-000118]
[20190825 CVE-2019-10071: Timing Attack in HMAC Verification in Apache Tapestry]
[[oss-security] 20190823 CVE-2019-10071: Timing Attack in HMAC Verification in Apache Tapestry]
[https://issues.apache.org/jira/browse/TAP5-2008]
[[tapestry-users] 20190913 Re: CVE-2019-10071: Apache Tapestry vulnerability disclosure]
[[tapestry-users] 20191007 Re: CVE-2019-10071: Apache Tapestry vulnerability disclosure]
[https://tapestry.apache.org/release-notes-536.html]
Directory traversal vulnerability in the NextApp File Explorer application before 2.1.0.3 for Android allows remote attackers to overwrite or create arbitrary files via a crafted filename.
[JVN#84335912]
[JVNDB-2014-000081]
[68726]
Directory traversal vulnerability in the LYSESOFT AndExplorer application before 20140403 and AndExplorerPro application before 20140405 for Android allows attackers to overwrite or create arbitrary files via unspecified vectors.
[JVN#22670349]
[JVNDB-2014-000037]
[https://play.google.com/store/apps/details?id=lysesoft.andexplorer]
[https://play.google.com/store/apps/details?id=lysesoft.andexplorerpro]
Directory traversal vulnerability in the R-Company Unzipper application 1.0.1 and earlier for Android allows remote attackers to overwrite or create arbitrary files via a crafted filename.
[http://jvn.jp/en/jp/JVN38227002/995495/index.html]
[JVN#38227002]
[JVNDB-2014-000031]
[66250]
[https://play.google.com/store/apps/details?id=org.rhorita777.unzipper]
The Demaecan application 2.1.0 and earlier for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
[JVN#16263849]
[JVNDB-2014-000030]
[https://play.google.com/store/apps/details?id=com.demaecan.androidapp]
The NTT DOCOMO sp mode mail application 6300 and earlier for Android 4.0.x and 6700 and earlier for Android 4.1 through 4.4 uses weak permissions for attachments during processing of incoming e-mail messages, which allows attackers to obtain sensitive information via a crafted application.
[JVN#81739241]
[JVNDB-2014-000027]
The application link interface in the NTT DOCOMO sp mode mail application 6100 through 6300 for Android 4.0.x and 6130 through 6700 for Android 4.1 through 4.4 writes message content to the SD card during e-mail composition, which allows attackers to obtain sensitive information via a crafted application.
[JVN#05951929]
[JVNDB-2014-000028]
The NTT DOCOMO sp mode mail application 5900 through 6300 for Android 4.0.x and 6000 through 6620 for Android 4.1 through 4.4 allows remote attackers to execute arbitrary Java methods via Deco-mail emoticon POP data in an e-mail message.
[JVN#89260331]
[JVNDB-2014-000029]
Cross-site scripting (XSS) vulnerability in include/functions_metadata.inc.php in Piwigo before 2.4.6 allows remote attackers to inject arbitrary web script or HTML via the Make field in IPTC Exif metadata within an image uploaded to the Community plugin.
[JVN#80310172]
[JVNDB-2014-000092]
[http://piwigo.org/bugs/view.php?id=2805]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2014. Notes: none.
The administrative interface in Allied Telesis AT-RG634A ADSL Broadband router 3.3+, iMG624A firmware 3.5, iMG616LH firmware 2.4, and iMG646BD firmware 3.5 allows remote attackers to gain privileges and execute arbitrary commands via a direct request to cli.html.
[20140326 [GTA-2014-01] - Allied Telesis AT-RG634A ADSL Broadband router hidden administrative unauthenticated webshell.]
[32545]
Unspecified vulnerability in Cybozu Remote Service Manager through 2.3.0 and 3.x before 3.1.1 allows remote attackers to cause a denial of service (CPU consumption) via unknown vectors.
[http://cs.cybozu.co.jp/information/20130317notice01.php]
[JVN#10319260]
[JVNDB-2014-000039]
Session fixation vulnerability in the management screen in Cybozu Remote Service Manager through 2.3.0 and 3.x before 3.1.1 allows remote attackers to hijack web sessions via unspecified vectors.
[http://cs.cybozu.co.jp/information/20130317notice02.php]
[JVN#00058727]
[JVNDB-2014-000040]
Open redirect vulnerability in the redirect_back_or_default function in app/controllers/application_controller.rb in Redmine before 2.4.5 and 2.5.x before 2.5.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the back url (back_url parameter).
[JVN#93004610]
[JVNDB-2014-000041]
[[oss-security] 20140410 Re: CVE request: redmine open redirector]
[http://www.redmine.org/projects/redmine/wiki/Changelog]
[http://www.redmine.org/projects/redmine/wiki/Changelog_2_4]
[http://www.redmine.org/projects/redmine/wiki/Security_Advisories]
[66674]
[https://github.com/redmine/redmine/commit/7567c3d8b21fe67e5f04e6839c1fce061600f2f3]
The Content Provider in the KOKUYO CamiApp application 1.21.1 and earlier for Android allows attackers to bypass intended access restrictions and read database information via a crafted application.
[JVN#55438786]
[JVNDB-2014-000036]
[https://play.google.com/store/apps/details?id=jp.co.kokuyost.CamiApp]
The CGI component in Cybozu Garoon 3.1.0 through 3.7 SP3 allows remote attackers to execute arbitrary commands via unspecified vectors.
[http://cs.cybozu.co.jp/information/gr20140421news01.php]
[JVN#42024228]
[JVNDB-2014-000073]
The Phone Messages feature in Cybozu Garoon 2.0.0 through 3.7 SP2 allows remote authenticated users to cause a denial of service (resource consumption) via unspecified vectors.
[JVN#90519014]
[JVNDB-2014-000042]
[https://support.cybozu.com/ja-jp/article/8105]
Cybozu Garoon 3.0 through 3.7 SP3 allows remote authenticated users to bypass intended access restrictions and delete schedule information via unspecified API calls.
[JVN#31230946]
[JVNDB-2014-000043]
[https://support.cybozu.com/ja/article/5264]
Cross-site request forgery (CSRF) vulnerability in TopAccess (aka the web-based management utility) on TOSHIBA TEC e-Studio 232, 233, 282, and 283 devices allows remote attackers to hijack the authentication of administrators for requests that change passwords.
[JVN#13313061]
[JVNDB-2014-000038]
[http://www.toshibatec.co.jp/page.jsp?id=4224]
Open redirect vulnerability in WebPlatform / AppFramework 6.0 through 7.2 in NTT DATA INTRAMART intra-mart allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
[http://jvn.jp/en/jp/JVN68340046/278948/index.html]
[JVN#68340046]
[JVNDB-2014-000044]
Cross-site scripting (XSS) vulnerability in the Messages functionality in Cybozu Garoon 3.1.x, 3.5.x, and 3.7.x before 3.7 SP4 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
[http://cs.cybozu.co.jp/information/gr20140714up05.php]
[JVN#94838679]
[JVNDB-2014-000078]
The Portlets subsystem in Cybozu Garoon 2.x and 3.x before 3.7 SP4 allows remote authenticated users to bypass intended access restrictions via unspecified vectors.
[http://cs.cybozu.co.jp/information/gr20140714up04.php]
[JVN#75990997]
[JVNDB-2014-000077]
Cross-site scripting (XSS) vulnerability in the Notices portlet in Cybozu Garoon 2.x and 3.x before 3.7 SP4 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
[http://cs.cybozu.co.jp/information/gr20140714up04.php]
[JVN#80583739]
[JVNDB-2014-000076]
Cross-site scripting (XSS) vulnerability in the Map search functionality in Cybozu Garoon 2.x and 3.x before 3.7 SP4 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
[http://cs.cybozu.co.jp/information/gr20140714up02.php]
[JVN#97558950]
[JVNDB-2014-000075]
Cybozu Garoon 3.7 before SP4 allows remote authenticated users to bypass intended access restrictions, and execute arbitrary code or cause a denial of service, via an API call.
[http://cs.cybozu.co.jp/information/gr20140714up01.php]
[JVN#31082531]
[JVNDB-2014-000074]
The ATEN CN8000 remote-access unit with firmware 1.6.154 and earlier allows remote attackers to cause a denial of service via unspecified vectors.
[JVN#78136804]
[JVNDB-2014-000046]
[67816]
Cross-site scripting (XSS) vulnerability in Nippon Institute of Agroinformatics SOY CMS 1.4.0c and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
[JVN#54650130]
[JVNDB-2014-000047]
The auto-format feature in the Request_Curl class in FuelPHP 1.1 through 1.7.1 allows remote attackers to execute arbitrary code via a crafted response.
[http://fuelphp.com/security-advisories]
[JVN#94791545]
[JVNDB-2014-000082]
The NTT 050 plus application before 4.2.1 for Android allows attackers to obtain sensitive information by leveraging the ability to read system log files.
[http://jvn.jp/en/jp/JVN07677464/995558/index.html]
[JVN#07677464]
[JVNDB-2014-000049]
The East Japan Railway Company JR East Japan application before 1.2.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to obtain sensitive information via a crafted certificate.
[JVN#10603428]
[JVNDB-2014-000050]
[https://play.google.com/store/apps/details?id=jp.co.jreast]
Cross-site scripting (XSS) vulnerability in C-BOARD Moyuku 1.01b6 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
[JVN#58029817]
[JVNDB-2014-000051]
JustSystems JUST Online Update, as used in Ichitaro through 2014 and other products, does not properly validate signatures of update modules, which allows remote attackers to spoof modules and execute arbitrary code via a crafted signature.
[JVN#50129191]
[JVNDB-2014-000053]
[http://www.ipa.go.jp/security/ciadr/vul/20140611-jvn.html]
[http://www.justsystems.com/jp/info/js14002.html]
The PPP Access Concentrator (PPPAC) on SEIL SEIL/x86 routers 1.00 through 3.10, SEIL/X1 routers 1.00 through 4.50, SEIL/X2 routers 1.00 through 4.50, SEIL/B1 routers 1.00 through 4.50, SEIL/Turbo routers 1.80 through 2.17, and SEIL/neu 2FE Plus routers 1.80 through 2.17 allows remote attackers to cause a denial of service (session termination or concentrator outage) via a crafted TCP packet.
[JVN#10724763]
[JVNDB-2014-000055]
[http://www.seil.jp/support/security/a01443.html]
Sophos Disk Encryption (SDE) 5.x in Sophos Enterprise Console (SEC) 5.x before 5.2.2 does not enforce intended authentication requirements for a resume action from sleep mode, which allows physically proximate attackers to obtain desktop access by leveraging the absence of a login screen.
[JVN#63940326]
[JVNDB-2014-000061]
[68169]
[http://www.sophos.com/en-us/support/knowledgebase/121066.aspx]
Cross-site scripting (XSS) vulnerability in Intercom Web Kyukincho 3.x before 3.0.030 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
[http://jvn.jp/en/jp/JVN80006084/995199/index.html]
[JVN#80006084]
[JVNDB-2014-000063]
SQL injection vulnerability in confirm.php in the mPAY24 payment module before 1.6 for PrestaShop allows remote attackers to execute arbitrary SQL commands via the TID parameter.
[http://packetstormsecurity.com/files/128136/Mpay24-Payment-Module-1.5-Information-Disclosure-SQL-Injection.html]
[20140903 Mpay24 prestashop payment module multiple vulnerabilities]
[34586]
[69560]
[mpay24-cve20142008-sql-injection(95720)]
The mPAY24 payment module before 1.6 for PrestaShop allows remote attackers to obtain credentials, the installation path, and other sensitive information via a direct request to api/curllog.log.
[http://packetstormsecurity.com/files/128136/Mpay24-Payment-Module-1.5-Information-Disclosure-SQL-Injection.html]
[20140903 Mpay24 prestashop payment module multiple vulnerabilities]
[34586]
[69560]
[mpay24-cve20142009-info-disc(95721)]
Stack-based buffer overflow in the xps_parse_color function in xps/xps-common.c in MuPDF 1.3 and earlier allows remote attackers to execute arbitrary code via a large number of entries in the ContextColor value of the Fill attribute in a Path element.
[http://bugs.ghostscript.com/show_bug.cgi?id=694957]
[http://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=60dabde18d7fe12b19da8b509bdfee9cc886aafc]
[openSUSE-SU-2014:0309]
[20140120 0day - MuPDF Stack-based Buffer Overflow in xps_parse_color()]
[[oss-security] 20140218 Re: CVE request: MuPDF Stack-based Buffer Overflow in xps_parse_color()]
[DSA-2951]
[31090]
[http://www.hdwsec.fr/blog/mupdf.html]
[65036]
imapsync before 1.584, when running with the --tls option, attempts a cleartext login when a certificate verification failure occurs, which allows remote attackers to obtain credentials by sniffing the network.
[[oss-security] 20140217 CVE request: "imapsync ignores the --tls switch and sends my authentication plaintext."]
[[oss-security] 20140218 Re: CVE request: "imapsync ignores the --tls switch and sends my authentication plaintext."]
[[imapsync_list] 20140120 Re: [imapsync] STARTTLS support (#15)]
[[imapsync_list] 20140122 Re: [imapsync] Upon certificate issues STARTTLS is ignored and the password sent in plaintext (#15)]
[MDVSA-2014:060]
[https://bugs.mageia.org/show_bug.cgi?id=12770]
[https://github.com/imapsync/imapsync/issues/15]
[FEDORA-2014-2505]
Stack-based buffer overflow in the normify function in the rlm_pap module (modules/rlm_pap/rlm_pap.c) in FreeRADIUS 2.x, possibly 2.2.3 and earlier, and 3.x, possibly 3.0.1 and earlier, might allow attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long password hash, as demonstrated by an SSHA hash.
[[freebsd-bugbusters] 20140212 freeradius denial of service in authentication flow]
[[freebsd-bugbusters] 20140213 freeradius denial of service in authentication flow]
[[freebsd-bugbusters] 20140214 freeradius denial of service in authentication flow]
[RHSA-2015:1287]
[USN-2122-1]
[[oss-security] 20140216 Re: CVE request: freeradius denial of service in rlm_pap hash processing]
[65581]
[https://bugzilla.redhat.com/show_bug.cgi?id=1066761]
Multiple cross-site scripting (XSS) vulnerabilities in OXID eShop Professional and Community Edition 4.6.8 and earlier, 4.7.x before 4.7.11, and 4.8.x before 4.8.4, and Enterprise Edition 4.6.8 and earlier, 5.0.x before 5.0.11 and 5.1.x before 5.1.4 allow remote attackers to inject arbitrary web script or HTML via the searchtag parameter to the getTag function in (1) application/controllers/details.php or (2) application/controllers/tag.php.
[http://wiki.oxidforge.org/Security_bulletins/2014-001]
CRLF injection vulnerability in OXID eShop Professional Edition before 4.7.11 and 4.8.x before 4.8.4, Enterprise Edition before 5.0.11 and 5.1.x before 5.1.4, and Community Edition before 4.7.11 and 4.8.x before 4.8.4 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.
[https://bugs.oxid-esales.com/view.php?id=5635]
[https://oxidforge.org/en/security-bulletin-2014-002.html]
Cross-site scripting (XSS) vulnerability in Mozilla Thunderbird 17.x through 17.0.8, Thunderbird ESR 17.x through 17.0.10, and SeaMonkey before 2.20 allows user-assisted remote attackers to inject arbitrary web script or HTML via an e-mail message containing a data: URL in a (1) OBJECT or (2) EMBED element, a related issue to CVE-2013-6674.
[VU#863369]
[http://www.mozilla.org/security/announce/2014/mfsa2014-14.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[1029773]
[1029774]
[http://www.vulnerability-lab.com/get_content.php?id=953]
[https://bugzilla.mozilla.org/show_bug.cgi?id=875818]
The iCloud subsystem in Apple iOS before 7.1 allows physically proximate attackers to bypass an intended password requirement, and turn off the Find My iPhone service or complete a Delete Account action and then associate this service with a different Apple ID account, by entering an arbitrary iCloud Account Password value and a blank iCloud Account Description value.
[http://news.softpedia.com/news/Major-iOS-7-Security-Flaw-Discovered-Video-425011.shtml]
[http://support.apple.com/kb/HT6162]
[http://www.youtube.com/watch?v=QnPk4RRWjic]
ext/gd/gd.c in PHP 5.5.x before 5.5.9 does not check data types, which might allow remote attackers to obtain sensitive information by using a (1) string or (2) array data type in place of a numeric data type, as demonstrated by an imagecrop function call with a string for the x dimension value, a different vulnerability than CVE-2013-7226.
[USN-2126-1]
[https://bugs.php.net/bug.php?id=66356]
[https://github.com/php/php-src/commit/2938329ce19cb8c4197dec146c3ec887c6f61d01]
Cross-site scripting (XSS) vulnerability in admincp/apilog.php in vBulletin 4.2.2 and earlier, and 5.0.x through 5.0.5 allows remote authenticated users to inject arbitrary web script or HTML via a crafted XMLRPC API request, as demonstrated using the client name.
[http://packetstormsecurity.com/files/128691/vBulletin-5.x-4.x-Persistent-Cross-Site-Scripting.html]
[20141013 CVE-2013-2021 - vBulletin 5.x/4.x - persistent XSS in AdminCP/ApiLog via xmlrpc API (post-auth)]
[20141014 Re: CVE-2013-2021 - vBulletin 5.x/4.x - persistent XSS in AdminCP/ApiLog via xmlrpc API (post-auth)]
[70577]
[1031000]
[vbulletin-cve20142021-xss(97026)]
[https://github.com/tintinweb/pub/tree/master/pocs/cve-2014-2021]
SQL injection vulnerability in includes/api/4/breadcrumbs_create.php in vBulletin 4.2.2, 4.2.1, 4.2.0 PL2, and earlier allows remote authenticated users to execute arbitrary SQL commands via the conceptid argument in an xmlrpc API request.
[http://packetstormsecurity.com/files/128696/vBulletin-4.x-SQL-Injection.html]
[20141013 CVE-2014-2022 - vbulletin 4.x - SQLi in breadcrumbs via xmlrpc API (post-auth)]
[70417]
[1031001]
[https://github.com/tintinweb/pub/tree/master/pocs/cve-2014-2022]
Multiple SQL injection vulnerabilities in the Tapatalk plugin 4.9.0 and earlier and 5.x through 5.2.1 for vBulletin allow remote attackers to execute arbitrary SQL commands via a crafted xmlrpc API request to (1) unsubscribe_forum.php or (2) unsubscribe_topic.php in mobiquo/functions/.
[http://packetstormsecurity.com/files/128854/vBulletin-4.x-Tapatalk-Blind-SQL-Injection.html]
[20141013 CVE-2014-2023 - Tapatalk for vBulletin 4.x - multiple blind sql injection (pre-auth)]
[35102]
[70418]
[https://github.com/tintinweb/pub/tree/master/pocs/cve-2014-2023]
Cross-site scripting (XSS) vulnerability in classes/controller/error.php in Open Classifieds 2 before 2.1.3 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to shared-apartments-rooms/.
[20140312 Cross-Site Scripting (XSS) in Open Classifieds]
[https://github.com/open-classifieds/openclassifieds2/commit/45ee8fb601a91b8a4238229580a32a4fd8d96ef9]
[https://github.com/open-classifieds/openclassifieds2/issues/556]
[https://www.htbridge.com/advisory/HTB23204]
Cross-site scripting (XSS) vulnerability in the search functionality in United Planet Intrexx Professional before 5.2 Online Update 0905 and 6.x before 6.0 Online Update 10 allows remote attackers to inject arbitrary web script or HTML via the request parameter.
[http://packetstormsecurity.com/files/129590/Intrexx-Professional-6.0-5.2-Cross-Site-Scripting.html]
[http://www.christian-schneider.net/advisories/CVE-2014-2026.txt]
[20141214 CVE-2014-2026 Reflected Cross-Site Scripting (XSS) in "Intrexx Professional"]
[71673]
[https://help.unitedplanet.com/?rq_AppGuid=C203A277EDDF9AD2492B776B996B20D4A7C58395&rq_TargetPageGuid=2EBBF802B1970FE31EFC8A34108DF3F47E7A8EEC&rq_RecId=32&rq_SourceAppGuid=C203A277EDDF9AD2492B776B996B20D4A7C58395&rq_SourcePageGuid=7A91F4B76FFC41A18F4EA4ACE26F31E033C5B018&rq_SourceRecId=32]
eGroupware before 1.8.006.20140217 allows remote attackers to conduct PHP object injection attacks, delete arbitrary files, and possibly execute arbitrary code via the (1) addr_fields or (2) trans parameter to addressbook/csv_import.php, (3) cal_fields or (4) trans parameter to calendar/csv_import.php, (5) info_fields or (6) trans parameter to csv_import.php in (a) projectmanager/ or (b) infolog/, or (7) processed parameter to preferences/inc/class.uiaclprefs.inc.php.
[http://advisories.mageia.org/MGASA-2014-0116.html]
[[oss-security] 20140219 Re: CVE request: remote code execution in egroupware <= 1.8.005]
[[oss-security] 20140219 Re: CVE request: remote code execution in egroupware <= 1.8.005]
[http://sourceforge.net/projects/egroupware/files/eGroupware-1.8/README/download]
[MDVSA-2015:087]
[GLSA-201711-12]
The automatic version check functionality in the tools in Percona Toolkit 2.1 allows man-in-the-middle attackers to obtain sensitive information or execute arbitrary code by leveraging use of HTTP to download configuration information from v.percona.com.
[[oss-security] 20140219 Re: CVE Request: Percona Toolkit automatic version check - remote code execution / information leak]
[https://bugs.launchpad.net/percona-toolkit/+bug/1279502]
[https://bugzilla.novell.com/show_bug.cgi?id=864194]
Deadwood before 2.3.09, 3.x before 3.2.05, and as used in MaraDNS before 1.4.14 and 2.x before 2.0.09, allow remote attackers to cause a denial of service (out-of-bounds read and crash) by leveraging permission to perform recursive queries against Deadwood, related to a logic error.
[http://samiam.org/blog/2014-02-12.html]
[[oss-security] 20140219 Re: CVE request: MaraDNS DoS due to incorrect bounds checking on certain strings]
[1029771]
[https://bugzilla.redhat.com/show_bug.cgi?id=1066609]
[maradns-cve20142031-dos(91203)]
Deadwood before 2.3.09, 3.x before 3.2.05, and as used in MaraDNS before 1.4.14 and 2.x before 2.0.09, allow remote attackers to cause a denial of service (out-of-bounds read and crash) by leveraging permission to perform recursive queries against Deadwood, related to missing input validation.
[http://samiam.org/blog/2014-02-12.html]
[[oss-security] 20140219 Re: CVE request: MaraDNS DoS due to incorrect bounds checking on certain strings]
[65595]
[1029771]
[https://bugzilla.redhat.com/show_bug.cgi?id=1066609]
[maradns-cve20142032-dos(91204)]
The caching feature in SGOS in Blue Coat ProxySG 5.5 through 5.5.11.3, 6.1 through 6.1.6.3, 6.2 through 6.2.15.3, 6.4 through 6.4.6.1, and 6.3 and 6.5 before 6.5.4 allows remote authenticated users to bypass intended access restrictions during a time window after account deletion or modification by leveraging knowledge of previously valid credentials.
[VU#221620]
[https://kb.bluecoat.com/index?page=content&id=SA77]
Unspecified vulnerability in Sonatype Nexus OSS and Pro 2.4.0 through 2.7.1 allows attackers to create arbitrary user accounts via unknown vectors related to "an unauthenticated execution path."
[65956]
[http://www.sonatype.org/advisories/archive/2014-03-03-Nexus]
[https://support.sonatype.com/entries/42374566-CVE-2014-2034-Nexus-Security-Advisory-REST-API]
Cross-site scripting (XSS) vulnerability in xhr.php in InterWorx Web Control Panel (aka InterWorx Hosting Control Panel and InterWorx-CP) before 5.0.13 build 574 allows remote attackers to inject arbitrary web script or HTML via the i parameter.
[http://www.interworx.com/developers/changelog/version-5-0-13-build-574-2014-02-19]
[20140220 [CVE-2014-2035] XSS in InterWorx Web Control Panel <= 5.0.12]
[65734]
Openswan 2.6.40 allows remote attackers to cause a denial of service (NULL pointer dereference and IKE daemon restart) via IKEv2 packets that lack expected payloads. NOTE: this vulnerability exists because of an incomplete fix for CVE 2013-6466.
[[oss-security] 20140217 Re: CVE request for unfixed CVE-2013-6466 in openswan-2.6.40]
[[oss-security] 20140220 Re: CVE request for unfixed CVE-2013-6466 in openswan-2.6.40]
[65629]
[[Openswan Users] 20140221 Openswan 2.6.41 released]
The nfs_can_extend_write function in fs/nfs/write.c in the Linux kernel before 3.13.3 relies on a write delegation to extend a write operation without a certain up-to-date verification, which allows local users to obtain sensitive information from kernel memory in opportunistic circumstances by writing to a file in an NFS filesystem and then reading the same file.
[http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=263b4509ec4d47e0da3e753f85a39ea12d1eff24]
[http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.13.3]
[[oss-security] 20140221 Re: Re: CVE request: Linux kernel: nfs: information leakage]
[USN-2137-1]
[USN-2140-1]
[https://bugzilla.redhat.com/show_bug.cgi?id=1066939]
[https://github.com/torvalds/linux/commit/263b4509ec4d47e0da3e753f85a39ea12d1eff24]
arch/s390/kernel/head64.S in the Linux kernel before 3.13.5 on the s390 platform does not properly handle attempted use of the linkage stack, which allows local users to cause a denial of service (system crash) by executing a crafted instruction.
[http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=8d7f6690cedb83456edd41c9bd583783f0703bf0]
[http://linux.oracle.com/errata/ELSA-2014-0771.html]
[http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.13.5]
[[oss-security] 20140220 Re: CVE Request: Linux kernel: s390: crash due to linkage stack instruction]
[65700]
[https://bugzilla.redhat.com/show_bug.cgi?id=1067558]
[https://github.com/torvalds/linux/commit/8d7f6690cedb83456edd41c9bd583783f0703bf0]
Multiple cross-site scripting (XSS) vulnerabilities in the (1) callback_multicheck, (2) callback_radio, and (3) callback_wysiwygin functions in mfrh_class.settings-api.php in the Media File Renamer plugin 1.7.0 for WordPress allow remote authenticated users with permissions to add media or edit media to inject arbitrary web script or HTML via unspecified parameters, as demonstrated by the title of an uploaded file.
[20140226 Persistent XSS in Media File Renamer V1.7.0 wordpress plugin]
[65715]
[http://www.vapid.dhs.org/advisories/wordpress/plugins/MediaFileRenamer-1.7.0/index.html]
Unrestricted file upload vulnerability in the Manage Project functionality in Livetecs Timelive before 6.5.1 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in a predictable directory in Uploads/.
Per: http://cwe.mitre.org/data/definitions/434.html
"CWE-434: Unrestricted Upload of File with Dangerous Type"
[20140423 CVE-2014-2042 - Unrestricted file upload in Livetecs Timelive]
[20140423 CVE-2014-2042 - Unrestricted file upload in Livetecs Timelive]
SQL injection vulnerability in Resources/System/Templates/Data.aspx in Procentia IntelliPen before 1.1.18.1658 allows remote authenticated users to execute arbitrary SQL commands via the value parameter.
[20140312 CVE-2014-2043 - SQL Injection in Procentia IntelliPen]
[32212]
[20140312 CVE-2014-2043 - SQL Injection in Procentia IntelliPen]
[https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-2043]
Incomplete blacklist vulnerability in ajax/upload.php in ownCloud before 5.0, when running on Windows, allows remote authenticated users to bypass intended access restrictions, upload files with arbitrary names, and execute arbitrary code via an Alternate Data Stream (ADS) syntax in the filename parameter, as demonstrated using .htaccess::$DATA to upload a PHP program.
[http://packetstormsecurity.com/files/125585/ownCloud-4.0.x-4.5.x-Remote-Code-Execution.html]
[20140306 CVE-2014-2044 - Remote Code Execution in ownCloud]
[32162]
[20140306 CVE-2014-2044 - Remote Code Execution in ownCloud]
[66000]
[owncloud-upload-file-upload(91757)]
[https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-2044/]
Multiple cross-site scripting (XSS) vulnerabilities in the old and new interfaces in Viprinet Multichannel VPN Router 300 allow remote attackers to inject arbitrary web script or HTML via the username when (1) logging in or (2) creating an account in the old interface, (3) username when creating an account in the new interface, (4) hostname in the old interface, (5) inspect parameter in the config module, (6) commands parameter in the atcommands tool, or (7) host parameter in the ping tool.
[http://packetstormsecurity.com/files/135613/Viprinet-Multichannel-VPN-Router-300-Cross-Site-Scripting.html]
[20160203 Security Advisories]
[20160203 Security Advisories]
[39407]
[https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-2045/]
cgi-bin/rpcBridge in the web interface 1.1 on Broadcom Ltd PIPA C211 rev2 does not properly restrict access, which allows remote attackers to (1) obtain credentials and other sensitive information via a certain request to the config.getValuesHashExcludePaths method or (2) modify the firmware via unspecified vectors.
[20140513 CVE-2014-2046 - Unauthenticated Credential And Configuration Retrieval In Broadcom Ltd PIPA C211]
[https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-2046/]
Session fixation vulnerability in ownCloud before 6.0.2, when PHP is configured to accept session parameters through a GET request, allows remote attackers to hijack web sessions via unspecified vectors.
[http://owncloud.org/about/security/advisories/oC-SA-2014-001/]
The user_openid app in ownCloud Server before 5.0.15 allows remote attackers to obtain access by leveraging an insecure OpenID implementation.
[owncloud-cve20142048-sec-bypass(91973)]
[https://owncloud.org/security/advisories/insecure-openid-implementation/]
The default Flash Cross Domain policies in ownCloud before 5.0.15 and 6.x before 6.0.2 allows remote attackers to access user files via unspecified vectors.
[http://owncloud.org/about/security/advisories/oC-SA-2014-003/]
ownCloud Server before 5.0.15 and 6.0.x before 6.0.2 allows remote attackers to conduct an LDAP injection attack via unspecified vectors, as demonstrated using a "login query."
[http://owncloud.org/about/security/advisories/oC-SA-2014-005/]
getID3() before 1.9.8, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity (XXE) attack.
Per: http://cwe.mitre.org/data/definitions/611.html
"CWE-611: Improper Restriction of XML External Entity Reference ('XXE')"
[http://getid3.sourceforge.net/source/changelog.txt]
[http://owncloud.org/about/security/advisories/oC-SA-2014-006/]
[58002]
[DSA-3001]
[https://wordpress.org/news/2014/08/wordpress-3-9-2/]
PHPExcel before 1.8.0, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, does not disable external entity loading in libxml, which allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity (XXE) attack.
Per: http://cwe.mitre.org/data/definitions/611.html
"CWE-611: Improper Restriction of XML External Entity Reference ('XXE')"
[http://owncloud.org/about/security/advisories/oC-SA-2014-006/]
[https://github.com/PHPOffice/PHPExcel/blob/develop/changelog.txt]
SabreDAV before 1.7.11, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity (XXE) attack.
Per: http://cwe.mitre.org/data/definitions/611.html
"CWE-611: Improper Restriction of XML External Entity Reference ('XXE')"
[http://owncloud.org/about/security/advisories/oC-SA-2014-006/]
[https://github.com/fruux/sabre-dav/releases/tag/1.7.11]
PHPDocX, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity (XXE) attack.
Per: http://cwe.mitre.org/data/definitions/611.html
"CWE-611: Improper Restriction of XML External Entity Reference ('XXE')"
[http://owncloud.org/about/security/advisories/oC-SA-2014-006/]
Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 6.0.2 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
[http://owncloud.org/about/security/advisories/oC-SA-2014-007/]
BuildTrigger in Jenkins before 1.551 and LTS before 1.532.2 allows remote authenticated users to bypass access restrictions and execute arbitrary jobs by configuring a job to trigger another job. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7330.
[[oss-security] 20140220 Re: Possible CVE Requests: several issues fixed in Jenkins (Advisory 2014-02-14)]
[https://github.com/jenkinsci/jenkins/commit/b6b2a367a7976be80a799c6a49fa6c58d778b50e]
[https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-02-14]
Directory traversal vulnerability in the CLI job creation (hudson/cli/CreateJobCommand.java) in Jenkins before 1.551 and LTS before 1.532.2 allows remote authenticated users to overwrite arbitrary files via the job name.
[[oss-security] 20140220 Re: Possible CVE Requests: several issues fixed in Jenkins (Advisory 2014-02-14)]
[jenkins-cve20142059-dir-trav(91346)]
[https://github.com/jenkinsci/jenkins/commit/ad38d8480f20ce3cbf8fec3e2003bc83efda4f7d]
[https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-02-14]
The Winstone servlet container in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to hijack sessions via unspecified vectors.
[[oss-security] 20140220 Re: Possible CVE Requests: several issues fixed in Jenkins (Advisory 2014-02-14)]
[https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-02-14]
The input control in PasswordParameterDefinition in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to obtain passwords by reading the HTML source code, related to the default value.
[[oss-security] 20140220 Re: Possible CVE Requests: several issues fixed in Jenkins (Advisory 2014-02-14)]
[https://github.com/jenkinsci/jenkins/commit/bf539198564a1108b7b71a973bf7de963a6213ef]
[https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-02-14]
Jenkins before 1.551 and LTS before 1.532.2 does not invalidate the API token when a user is deleted, which allows remote authenticated users to retain access via the token.
[[oss-security] 20140220 Re: Possible CVE Requests: several issues fixed in Jenkins (Advisory 2014-02-14)]
[https://github.com/jenkinsci/jenkins/commit/5548b5220cfd496831b5721124189ff18fbb12a3]
[https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-02-14]
Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to conduct clickjacking attacks via unspecified vectors.
[[oss-security] 20140220 Re: Possible CVE Requests: several issues fixed in Jenkins (Advisory 2014-02-14)]
[https://github.com/jenkinsci/jenkins/commit/16931bd7bf7560e26ef98328b8e95e803d0e90f6]
[https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-02-14]
The loadUserByUsername function in hudson/security/HudsonPrivateSecurityRealm.java in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to determine whether a user exists via vectors related to failed login attempts.
[[oss-security] 20140220 Re: Possible CVE Requests: several issues fixed in Jenkins (Advisory 2014-02-14)]
[https://github.com/jenkinsci/jenkins/commit/fbf96734470caba9364f04e0b77b0bae7293a1ec]
[https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-02-14]
Cross-site scripting (XSS) vulnerability in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to inject arbitrary web script or HTML via the iconSize cookie.
[[oss-security] 20140220 Re: Possible CVE Requests: several issues fixed in Jenkins (Advisory 2014-02-14)]
[https://github.com/jenkinsci/jenkins/commit/a0b00508eeb74d7033dc4100eb382df4e8fa72e7]
[https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-02-14]
Session fixation vulnerability in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to hijack web sessions via vectors involving the "override" of Jenkins cookies.
[[oss-security] 20140220 Re: Possible CVE Requests: several issues fixed in Jenkins (Advisory 2014-02-14)]
[https://github.com/jenkinsci/jenkins/commit/8ac74c350779921598f9d5edfed39dd35de8842a]
[https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-02-14]
Cross-site scripting (XSS) vulnerability in java/hudson/model/Cause.java in Jenkins before 1.551 and LTS before 1.532.2 allows remote authenticated users to inject arbitrary web script or HTML via a "remote cause note."
[[oss-security] 20140220 Re: Possible CVE Requests: several issues fixed in Jenkins (Advisory 2014-02-14)]
[jenkins-cve20142067-xss(91354)]
[https://github.com/jenkinsci/jenkins/commit/5d57c855f3147bfc5e7fda9252317b428a700014]
[https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-02-14]
The doIndex function in hudson/util/RemotingDiagnostics.java in CloudBees Jenkins before 1.551 and LTS before 1.532.2 allows remote authenticated users with the ADMINISTER permission to obtain sensitive information via vectors related to heapDump.
[[oss-security] 20140220 Re: Possible CVE Requests: several issues fixed in Jenkins (Advisory 2014-02-14)]
[https://github.com/jenkinsci/jenkins/commit/0530a6645aac10fec005614211660e98db44b5eb]
[https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-02-14]
Absolute path traversal vulnerability in Eshtery CMS allows remote attackers to read arbitrary files via a full pathname in the file parameter to FileManager.aspx.
[20140222 [CVE-2014-2069] 'eshtery CMS' allows remote attackers to read arbitrary files]
[65740]
[eshtery-filemanager-file-disclosure(91463)]
Aruba Networks ClearPass Policy Manager 6.1.x, 6.2.x before 6.2.5.61640 and 6.3.x before 6.3.0.61712, when configured to use tunneled and non-tunneled EAP methods in a single policy construct, allows remote authenticated users to gain privileges by advertising independent inner and outer identities within a tunneled EAP method.
[http://www.arubanetworks.com/assets/alert/aid-050214.asc]
Stack-based buffer overflow in Dassault Systemes CATIA V5-6R2013 allows remote attackers to execute arbitrary code via a crafted packet, related to "CATV5_Backbone_Bus."
[http://packetstormsecurity.com/files/125325/Catia-V5-6R2013-Stack-Buffer-Overflow.html]
TIBCO Enterprise Administrator 1.0.0 and Enterprise Administrator SDK 1.0.0 do not properly enforce administrative authentication requirements, which allows remote attackers to execute arbitrary commands via unspecified vectors.
[http://www.tibco.com/mk/advisory.jsp]
[http://www.tibco.com/multimedia/enterprise_administator_advisory_20140226_tcm8-20533.txt]
Cross-site scripting (XSS) vulnerability in the frontend in Open-Xchange (OX) AppSuite 7.4.1 before 7.4.1-rev10 and 7.4.2 before 7.4.2-rev8 allows remote attackers to inject arbitrary web script or HTML via the subject of an email, involving 'the aria "tags" for screenreaders at the top bar'.
[20140317 Open-Xchange Security Advisory 2014-03-17]
The backend in Open-Xchange (OX) AppSuite 7.4.2 before 7.4.2-rev9 allows remote attackers to obtain sensitive information about user email addresses in opportunistic circumstances by leveraging a failure in e-mail auto configuration for external accounts.
[20140317 Open-Xchange Security Advisory 2014-03-17]
[appsuite-cve20142078-info-disc(92017)]
X File Explorer (aka xfe) might allow local users to bypass intended access restrictions and gain access to arbitrary files by leveraging failure to use directory masks when creating files on Samba and NFS shares.
[[oss-security] 20140224 Re: xfe: directory masks ignored when creating new files on Samba and NFS]
[65748]
[https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=739536]
[https://bugzilla.redhat.com/show_bug.cgi?id=1069066]
[xfile-explorer-cve20142079-sec-bypass(91519)]
Cross-site scripting (XSS) vulnerability in manager/templates/default/header.tpl in ModX Revolution before 2.2.11 allows remote attackers to inject arbitrary web script or HTML via the "a" parameter.
[http://modx.com/blog/2014/01/21/revolution-2.2.11%E2%80%94security-fixes-and-prevent-change-loss]
[[oss-security] 20140224 Re: CVE request: XSS in MODX Revolution before 2.2.11]
[65755]
[https://github.com/modxcms/revolution/commit/77463eb6a8090f474b04fdc1b72225cb93c558ea]
Multiple SQL injection vulnerabilities in the login in web_reports/cgi-bin/InfoStation.cgi in Innovative vtls-Virtua before 2013.2.4 and 2014.x before 2014.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) password parameter.
[http://packetstormsecurity.com/files/127997/VTLS-Virtua-SQL-Injection.html]
[20140825 CVE-2014-2081 - VTLS Virtua InfoStation.cgi SQLi.]
Skybox View Appliances with ISO 6.3.33-2.14, 6.3.31-2.14, 6.4.42-2.54, 6.4.45-2.56, and 6.4.46-2.57 does not properly restrict access to the Admin interface, which allows remote attackers to obtain sensitive information via a request to (1) scripts/commands/getSystemInformation or (2) scripts/commands/getNetworkConfigurationInfo, cause a denial of service (reboot) via a request to scripts/commands/reboot, or cause a denial of service (shutdown) via a request to scripts/commands/shutdown.
[33327]
[33328]
[67352]
[https://www.skyboxsecurity.com/sites/default/files/file_resources/Skybox_Security_Appliance_Vulnerability.pdf]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-2084. Reason: This issue was MERGED into CVE-2014-2084 in accordance with CVE content decisions, because it is the same type of vulnerability and affects the same versions. Notes: All CVE users should reference CVE-2014-2084 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
Stack-based buffer overflow in the CDownloads_Deleted::UpdateDownload function in Downloads_Deleted.cpp in Free Download Manager 3.9.3 build 1360, 3.8 build 1173, 3.0 build 852, and earlier allows user-assisted remote attackers to execute arbitrary code via a long file name, which is then deleted from the download queue by the user.
[20140313 [CVE-2014-2087] Free Download Manager CDownloads_Deleted::UpdateDownload() Buffer Overflow Remote Code Execution]
[20140313 [CVE-2014-2087] Free Download Manager CDownloads_Deleted::UpdateDownload() Buffer Overflow Remote Code Execution]
[66211]
[https://www.rcesecurity.com/2014/03/cve-2014-2087-free-download-manager-cdownloads_deleted-updatedownload-remote-code-execution]
Unrestricted file upload vulnerability in ilias.php in ILIAS 4.4.1 allows remote authenticated users to execute arbitrary PHP code by using a .php filename in an upload_files action to the uploadFiles command, and then accessing the .php file via a direct request to a certain client_id pathname.
Per: http://cwe.mitre.org/data/definitions/434.html
"CWE-434: Unrestricted Upload of File with Dangerous Type"
[http://packetstormsecurity.com/files/125350/ILIAS-4.4.1-Cross-Site-Scripting-Shell-Upload.html]
ILIAS 4.4.1 allows remote attackers to execute arbitrary PHP code via an e-mail attachment that leads to creation of a .php file with a certain client_id pathname.
[http://packetstormsecurity.com/files/125350/ILIAS-4.4.1-Cross-Site-Scripting-Shell-Upload.html]
Multiple cross-site scripting (XSS) vulnerabilities in ilias.php in ILIAS 4.4.1 allow remote authenticated users to inject arbitrary web script or HTML via the (1) tar, (2) tar_val, or (3) title parameter.
[http://packetstormsecurity.com/files/125350/ILIAS-4.4.1-Cross-Site-Scripting-Shell-Upload.html]
Cross-site scripting (XSS) vulnerability in mods/_standard/forums/admin/forum_add.php in ATutor 2.1.1 allows remote authenticated administrators to inject arbitrary web script or HTML via the title parameter in an add_forum action. NOTE: the original disclosure also reported issues that may not cross privilege boundaries.
[http://packetstormsecurity.com/files/125348/ATutor-2.1.1-Cross-Site-Scripting.html]
[65744]
Cross-site scripting (XSS) vulnerability in lib/filemanager/ImageManager/editorFrame.php in CMS Made Simple 1.11.10 allows remote attackers to inject arbitrary web script or HTML via the action parameter, a different issue than CVE-2014-0334. NOTE: the original disclosure also reported issues that may not cross privilege boundaries.
[http://packetstormsecurity.com/files/125353/CMSMadeSimple-1.11.10-Cross-Site-Scripting.html]
[65746]
Untrusted search path vulnerability in Catfish through 0.4.0.3 allows local users to gain privileges via a Trojan horse catfish.py in the current working directory.
Per: http://cwe.mitre.org/data/definitions/426.html
"CWE-426: Untrusted Search Path"
[[oss-security] 20140225 Re: CVE request for catfish program]
[[oss-security] 20140225 Re: CVE request for catfish program]
[https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=739958]
[https://bugzilla.redhat.com/show_bug.cgi?id=1069396]
Untrusted search path vulnerability in Catfish through 0.4.0.3, when a Fedora package such as 0.4.0.2-2 is not used, allows local users to gain privileges via a Trojan horse catfish.pyc in the current working directory.
[[oss-security] 20140225 Re: CVE request for catfish program]
[[oss-security] 20140225 Re: CVE request for catfish program]
[https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=739958]
[https://bugzilla.redhat.com/show_bug.cgi?id=1069396]
Untrusted search path vulnerability in Catfish 0.6.0 through 1.0.0, when a Fedora package such as 0.8.2-1 is not used, allows local users to gain privileges via a Trojan horse bin/catfish.pyc under the current working directory.
Per: http://cwe.mitre.org/data/definitions/426.html
"CWE-426: Untrusted Search Path"
[[oss-security] 20140225 Re: CVE request for catfish program]
[[oss-security] 20140225 Re: CVE request for catfish program]
[https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=739958]
[https://bugzilla.redhat.com/show_bug.cgi?id=1069396]
Untrusted search path vulnerability in Catfish 0.6.0 through 1.0.0 allows local users to gain privileges via a Trojan horse bin/catfish.py under the current working directory.
Per: http://cwe.mitre.org/data/definitions/426.html
"CWE-426: Untrusted Search Path"
[[oss-security] 20140225 Re: CVE request for catfish program]
[[oss-security] 20140225 Re: CVE request for catfish program]
[https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=739958]
[https://bugzilla.redhat.com/show_bug.cgi?id=1069396]
The tak_decode_frame function in libavcodec/takdec.c in FFmpeg before 2.1.4 does not properly validate a certain bits-per-sample value, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted TAK (aka Tom's lossless Audio Kompressor) data.
[http://git.videolan.org/?p=ffmpeg.git;a=commit;h=f58eab151214d2d35ff0973f2b3e51c5eb372da4]
[GLSA-201603-06]
libavcodec/wmalosslessdec.c in FFmpeg before 2.1.4 uses an incorrect data-structure size for certain coefficients, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via crafted WMA data.
[http://git.videolan.org/?p=ffmpeg.git;a=commit;h=ec9578d54d09b64bf112c2bf7a34b1ef3b93dbd3]
[GLSA-201603-06]
The msrle_decode_frame function in libavcodec/msrle.c in FFmpeg before 2.1.4 does not properly calculate line sizes, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted Microsoft RLE video data.
[http://git.videolan.org/?p=ffmpeg.git;a=commit;h=c919e1ca2ecfc47d796382973ba0e48b8f6f92a2]
Cisco Unified Contact Center Express (Unified CCX) does not properly restrict the content of the CCMConfig page, which allows remote authenticated users to obtain sensitive information by examining this content, aka Bug ID CSCum95575.
[20140225 Cisco Unified Contact Center Express CCMConfig Sensitive Information Disclosure Vulnerability]
[1029842]
Cisco Intrusion Prevention System (IPS) Software allows remote attackers to cause a denial of service (MainApp process outage) via malformed SNMP packets, aka Bug IDs CSCum52355 and CSCul49309.
[20140227 Cisco IPS MainApp SNMP Denial of Service Vulnerability]
Multiple cross-site scripting (XSS) vulnerabilities in the Business Voice Services Manager (BVSM) page in Cisco Unified Communications Domain Manager 9.0(.1) allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug IDs CSCum78536, CSCum78526, CSCum69809, and CSCum63113.
[20140227 Cisco Unified Communications Domain Manager Cross-Site Scripting Vulnerability]
[http://tools.cisco.com/security/center/viewAlert.x?alertId=33111]
[65869]
Cisco IOS 15.3M before 15.3(3)M2 and IOS XE 3.10.xS before 3.10.2S allow remote attackers to cause a denial of service (device reload) via crafted SIP messages, aka Bug ID CSCug45898.
Per: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140326-sip
"The following Cisco IOS Software and Cisco IOS XE Software releases are affected by this vulnerability:
Cisco IOS Software release 15.3(3)M and 15.3(3)M1
Cisco IOS XE Software release 3.10.0S and 3.10.1S1"
[20140326 Cisco IOS Software Session Initiation Protocol Denial of Service Vulnerability]
Cisco IOS 12.2 and 15.0 through 15.3, when used with the Kailash FPGA before 2.6 on RSP720-3C-10GE and RSP720-3CXL-10GE devices, allows remote attackers to cause a denial of service (route switch processor outage) via crafted IP packets, aka Bug ID CSCug84789.
[20140326 Cisco 7600 Series Route Switch Processor 720 with 10 Gigabit Ethernet Uplinks Denial of Service Vulnerability]
Cisco IOS 12.2 and 15.0 through 15.3 and IOS XE 3.2 through 3.7 before 3.7.5S and 3.8 through 3.10 before 3.10.1S allow remote attackers to cause a denial of service (device reload) via a malformed IKEv2 packet, aka Bug ID CSCui88426.
[20140326 Cisco IOS Software Internet Key Exchange Version 2 Denial of Service Vulnerability]
The TCP Input module in Cisco IOS 12.2 through 12.4 and 15.0 through 15.4, when NAT is used, allows remote attackers to cause a denial of service (memory consumption or device reload) via crafted TCP packets, aka Bug IDs CSCuh33843 and CSCuj41494.
[20140326 Cisco IOS Software Network Address Translation Vulnerabilities]
[66470]
The Application Layer Gateway (ALG) module in Cisco IOS 12.2 through 12.4 and 15.0 through 15.4, when NAT is used, allows remote attackers to cause a denial of service (device reload) via crafted DNS packets, aka Bug ID CSCue00996.
[20140326 Cisco IOS Software Network Address Translation Vulnerabilities]
[66470]
The SSL VPN (aka WebVPN) feature in Cisco IOS 15.1 through 15.4 allows remote attackers to cause a denial of service (memory consumption) via crafted HTTP requests, aka Bug ID CSCuf51357.
[20140326 Cisco IOS Software SSL VPN Denial of Service Vulnerability]
[66462]
Cisco IOS 15.1 through 15.3 and IOS XE 3.3 and 3.5 before 3.5.2E; 3.7 before 3.7.5S; and 3.8, 3.9, and 3.10 before 3.10.2S allow remote attackers to cause a denial of service (I/O memory consumption and device reload) via a malformed IPv6 packet, aka Bug ID CSCui59540.
[20140326 Cisco IOS Software Crafted IPv6 Packet Denial of Service Vulnerability]
[66467]
Cross-site scripting (XSS) vulnerability in UserServlet in Cisco Emergency Responder (ER) 8.6 and earlier allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCun24384.
[20140403 Cisco Emergency Responder Cross-Site Scripting Vulnerability]
[http://tools.cisco.com/security/center/viewAlert.x?alertId=33644]
[66635]
[1030019]
Multiple cross-site request forgery (CSRF) vulnerabilities in CERUserServlet pages in Cisco Emergency Responder (ER) 8.6 and earlier allow remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCun24250.
[20140403 Cisco Emergency Responder Cross-Site Request Forgery Vulnerability]
[http://tools.cisco.com/security/center/viewAlert.x?alertId=33643]
[66631]
[1030019]
Cisco Emergency Responder (ER) 8.6 and earlier allows remote attackers to inject web pages and modify dynamic content via unspecified parameters, aka Bug ID CSCun37882.
[20140403 Cisco Emergency Responder Dynamic Content Modification Vulnerability]
[http://tools.cisco.com/security/center/viewAlert.x?alertId=33641]
[66632]
[1030019]
Multiple open redirect vulnerabilities in Cisco Emergency Responder (ER) 8.6 and earlier allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified parameters, aka Bug ID CSCun37909.
[20140403 Cisco Emergency Responder Open Redirect Vulnerability]
[http://tools.cisco.com/security/center/viewAlert.x?alertId=33642]
[66634]
[1030019]
Multiple cross-site scripting (XSS) vulnerabilities in dashboard-related HTML documents in Cisco Prime Security Manager (aka PRSM) 9.2(.1-2) and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug ID CSCun50687.
[20140327 Cisco Prime Security Manager Cross-Site Scripting Vulnerability]
[http://tools.cisco.com/security/center/viewAlert.x?alertId=33542]
[66488]
[1029968]
The End User Safelist/Blocklist (aka SLBL) service in Cisco AsyncOS Software for Email Security Appliance (ESA) before 7.6.3-023 and 8.x before 8.0.1-023 and Cisco Content Security Management Appliance (SMA) before 7.9.1-110 and 8.x before 8.1.1-013 allows remote authenticated users to execute arbitrary code with root privileges via an FTP session that uploads a modified SLBL database file, aka Bug IDs CSCug79377 and CSCug80118.
[20140319 Cisco AsyncOS Software Code Execution Vulnerability]
Cross-site scripting (XSS) vulnerability in the WebVPN login page in Cisco Adaptive Security Appliance (ASA) Software allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCun19025.
[20140318 Cisco Adaptive Security Appliance WebVPN Login Page Cross-Site Scripting Vulnerability]
[66290]
[1029935]
The Java-based software in Cisco Hosted Collaboration Solution (HCS) allows remote attackers to cause a denial of service (closing of TCP ports) via unspecified vectors, aka Bug IDs CSCug77633, CSCug77667, CSCug78266, CSCug82795, and CSCuh58643.
[20140318 Cisco Hosted Collaboration Solution Denial of Service Vulnerability]
[66283]
[1029933]
Memory leak in the GUI in the Impact server in Cisco Hosted Collaboration Solution (HCS) allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors, aka Bug ID CSCub58999.
[20140318 Cisco Hosted Collaboration Solution Memory Leak Vulnerability]
[66293]
[1029936]
[cisco-hosted-cve20142122-dos(91907)]
Cisco IOS 15.1(2)SY3 and earlier, when used with Supervisor Engine 2T (aka Sup2T) on Catalyst 6500 devices, allows remote attackers to cause a denial of service (device crash) via crafted multicast packets, aka Bug ID CSCuf60783.
[20140319 Cisco IOS Software Sup2T Denial of Service Vulnerability]
[http://tools.cisco.com/security/center/viewAlert.x?alertId=33413]
[66301]
[1029942]
[ciscoios-cve20142124-dos(91904)]
Cross-site scripting (XSS) vulnerability in the Web Inbox in Cisco Unity Connection 8.6(2a)SU3 and earlier allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCui33028.
[20140401 Cisco Unity Connection Cross-Site Scripting Vulnerability]
[http://tools.cisco.com/security/center/viewAlert.x?alertId=33603]
[1029988]
Cisco Adaptive Security Appliance (ASA) Software 8.2 before 8.2(5.47), 8.4 before 8.4(7.5), 8.7 before 8.7(1.11), 9.0 before 9.0(3.10), and 9.1 before 9.1(3.4) allows remote authenticated users to gain privileges by leveraging level-0 ASDM access, aka Bug ID CSCuj33496.
[20140409 Multiple Vulnerabilities in Cisco ASA Software]
Cisco Adaptive Security Appliance (ASA) Software 8.x before 8.2(5.48), 8.3 before 8.3(2.40), 8.4 before 8.4(7.9), 8.6 before 8.6(1.13), 9.0 before 9.0(4.1), and 9.1 before 9.1(4.3) does not properly process management-session information during privilege validation for SSL VPN portal connections, which allows remote authenticated users to gain privileges by establishing a Clientless SSL VPN session and entering crafted URLs, aka Bug ID CSCul70099.
[20140409 Multiple Vulnerabilities in Cisco ASA Software]
The SSL VPN implementation in Cisco Adaptive Security Appliance (ASA) Software 8.2 before 8.2(5.47, 8.3 before 8.3(2.40), 8.4 before 8.4(7.3), 8.6 before 8.6(1.13), 9.0 before 9.0(3.8), and 9.1 before 9.1(3.2) allows remote attackers to bypass authentication via (1) a crafted cookie value within modified HTTP POST data or (2) a crafted URL, aka Bug ID CSCua85555.
[20140409 Multiple Vulnerabilities in Cisco ASA Software]
The SIP inspection engine in Cisco Adaptive Security Appliance (ASA) Software 8.2 before 8.2(5.48), 8.4 before 8.4(6.5), 9.0 before 9.0(3.1), and 9.1 before 9.1(2.5) allows remote attackers to cause a denial of service (memory consumption or device reload) via crafted SIP packets, aka Bug ID CSCuh44052.
[20140409 Multiple Vulnerabilities in Cisco ASA Software]
Cisco Secure Access Control Server (ACS) provides an unintentional administration web interface based on Apache Tomcat, which allows remote authenticated users to modify application files and configuration files, and consequently execute arbitrary code, by leveraging administrative privileges, aka Bug ID CSCuj83189.
[20150304 Cisco Secure Access Control Server Default Tomcat Administration Interface Vulnerability]
[1031844]
The packet driver in Cisco IOS allows remote attackers to cause a denial of service (device reload) via a series of (1) Virtual Switching Systems (VSS) or (2) Bidirectional Forwarding Detection (BFD) packets, aka Bug IDs CSCug41049 and CSCue61890.
[20140328 Cisco IOS Software High Priority Queue Denial of Service Vulnerability]
Cisco WebEx Recording Format (WRF) player and Advanced Recording Format (ARF) player T27 LD before SP32 EP16, T28 before T28.12, and T29 before T29.2 allow remote attackers to cause a denial of service (application crash) via a crafted (1) .wrf or (2) .arf file that triggers a buffer over-read, aka Bug ID CSCuh52768.
[20140507 Multiple Vulnerabilities in the Cisco WebEx Recording Format and Advanced Recording Format Players]
Buffer overflow in Cisco Advanced Recording Format (ARF) player T27 LD before SP32 EP16, T28 before T28.12, and T29 before T29.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted .arf file that triggers improper LZW decompression, aka Bug ID CSCuj87565.
[20140507 Multiple Vulnerabilities in the Cisco WebEx Recording Format and Advanced Recording Format Players]
Heap-based buffer overflow in Cisco WebEx Recording Format (WRF) player T27 LD before SP32 EP16, T28 before T28.12, and T29 before T29.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted audio channel in a .wrf file, aka Bug ID CSCuc39458.
[20140507 Multiple Vulnerabilities in the Cisco WebEx Recording Format and Advanced Recording Format Players]
Buffer overflow in Cisco Advanced Recording Format (ARF) player T27 LD before SP32 EP16, T28 before T28.12, and T29 before T29.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted .arf file, aka Bug IDs CSCul87216 and CSCuj07603.
[20140507 Multiple Vulnerabilities in the Cisco WebEx Recording Format and Advanced Recording Format Players]
Buffer overflow in Cisco Advanced Recording Format (ARF) player T27 LD before SP32 EP16, T28 before T28.12, and T29 before T29.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted .arf file, aka Bug IDs CSCui72223, CSCul01163, and CSCul01166.
[20140507 Multiple Vulnerabilities in the Cisco WebEx Recording Format and Advanced Recording Format Players]
CRLF injection vulnerability in the web framework in Cisco Web Security Appliance (WSA) 7.7 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct redirection attacks via a crafted URL, aka Bug ID CSCuj61002.
[20140401 Cisco WSA HTTP Header Injection Vulnerability]
[http://tools.cisco.com/security/center/viewAlert.x?alertId=33608]
CRLF injection vulnerability in the web framework in Cisco Security Manager 4.2 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct redirection attacks via a crafted URL, aka Bug ID CSCun82349.
[20140401 Cisco Security Manager HTTP Header Redirection Vulnerability]
[http://tools.cisco.com/security/center/viewAlert.x?alertId=33607]
Cisco ONS 15454 controller cards with software 9.6 and earlier allow remote attackers to cause a denial of service (flash write outage) via a TCP FIN attack that triggers file-descriptor exhaustion, aka Bug ID CSCug97315.
[20140407 Cisco ONS 15454 Controller Card Denial of Service Vulnerability]
[http://tools.cisco.com/security/center/viewAlert.x?alertId=33681]
Cisco ONS 15454 controller cards with software 9.6 and earlier allow remote attackers to cause a denial of service (card reset) via a TCP FIN attack that triggers file-descriptor exhaustion and a failure to open a CAL pipe, aka Bug ID CSCug97348.
[20140407 Cisco ONS 15454 Controller Card Denial of Service Vulnerability]
[http://tools.cisco.com/security/center/viewAlert.x?alertId=33680]
The session-termination functionality on Cisco ONS 15454 controller cards with software 9.6 and earlier does not initialize an unspecified pointer, which allows remote authenticated users to cause a denial of service (card reset) via crafted session-close actions, aka Bug ID CSCug97416.
[20140407 Cisco ONS 15454 Controller Card Denial of Service Vulnerability]
[http://tools.cisco.com/security/center/viewAlert.x?alertId=33682]
Cisco ONS 15454 controller cards with software 10.0 and earlier allow remote attackers to cause a denial of service (card reload) via a crafted HTTP URI, aka Bug ID CSCun06870.
[20140407 Cisco ONS 15454 Controller Card Denial of Service Vulnerability]
[http://tools.cisco.com/security/center/viewAlert.x?alertId=33679]
The IKE implementation in Cisco IOS 15.4(1)T and earlier and IOS XE allows remote attackers to cause a denial of service (security-association drop) via crafted Main Mode packets, aka Bug ID CSCun31021.
[20140403 Cisco IOS Software IKE Main Mode Vulnerability]
[http://tools.cisco.com/security/center/viewAlert.x?alertId=33639]
Cisco IOS XR does not properly throttle ICMPv6 redirect packets, which allows remote attackers to cause a denial of service (IPv4 and IPv6 transit outage) via crafted redirect messages, aka Bug ID CSCum14266.
[20140404 Cisco IOS XR Software ICMPv6 Redirect Vulnerability]
Directory traversal vulnerability in the messaging API in Cisco Unity Connection allows remote authenticated users to read arbitrary files via vectors related to unenforced access constraints for .wav files and the audio/x-wav MIME type, aka Bug ID CSCun91071.
[20140404 Cisco Unity Connection Directory Traversal Vulnerability]
[66676]
The Zone-Based Firewall (ZBFW) functionality in Cisco IOS, possibly 15.4 and earlier, and IOS XE, possibly 3.13 and earlier, mishandles zone checking for existing sessions, which allows remote attackers to bypass intended resource-access restrictions via spoofed traffic that matches one of these sessions, aka Bug IDs CSCun94946 and CSCun96847.
[93126]
[20150529 Multiple Cisco Products Zone-Based Firewall Security Bypass Vulnerability]
The web interface in Cisco Prime Infrastructure 2.1 and earlier does not properly restrict use of IFRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks and unspecified other attacks via a crafted web site, related to a "cross-frame scripting (XFS)" issue, aka Bug ID CSCuj42444.
[20150209 Cisco Prime Infrastructure Cross-Frame Scripting Vulnerability]
[http://tools.cisco.com/security/center/viewAlert.x?alertId=37419]
[72551]
[1031715]
[cisco-prime-cve20142147-xfs(100755)]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2014. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2014. Notes: none.
The WebVPN portal in Cisco Adaptive Security Appliance (ASA) Software 8.4(.7.15) and earlier allows remote authenticated users to obtain sensitive information via a crafted JavaScript file, aka Bug ID CSCui04520.
[20140616 Cisco ASA WebVPN Information Disclosure Vulnerability]
[http://tools.cisco.com/security/center/viewAlert.x?alertId=34627]
[68063]
[1030445]
Cross-site request forgery (CSRF) vulnerability in the INSERT page in Cisco Prime Infrastructure (PI) allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCun21868.
[20150209 Cisco Prime Infrastructure Cross-Site Request Forgery Vulnerability]
[72558]
[1031715]
[cisco-prime-cve20142152-csrf(100747)]
Multiple cross-site scripting (XSS) vulnerabilities in INSERT pages in Cisco Prime Infrastructure allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug ID CSCun21869.
[20150209 Cisco Prime Infrastructure Cross-Site Scripting Vulnerability]
[72555]
[1031715]
[cisco-prime-cve20142153-xss(100746)]
Memory leak in the SIP inspection engine in Cisco Adaptive Security Appliance (ASA) Software allows remote attackers to cause a denial of service (memory consumption and instability) via crafted SIP packets, aka Bug ID CSCuf67469.
[20140422 Cisco ASA SIP Inspection Memory Leak Vulnerability]
The DHCPv6 server module in Cisco CNS Network Registrar 7.1 allows remote attackers to cause a denial of service (daemon reload) via a malformed DHCPv6 packet, aka Bug ID CSCuo07437.
[20140417 Cisco Network Registrar DHCPv6 Denial of Service Vulnerability]
[http://tools.cisco.com/security/center/viewAlert.x?alertId=33850]
Cisco TelePresence System MXP Series Software before F9.3.1 allows remote attackers to cause a denial of service (device reload) via crafted SIP packets, aka Bug ID CSCty45739.
Per: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140430-mxp
" Vulnerable Products
The following products running a version of Cisco TelePresence System MXP Series Software prior to F9.3.1 are affected by the vulnerabilities described in this advisory:
Cisco TelePresence System 1700 MXP
Cisco TelePresence System 1000 MXP
Cisco TelePresence System Edge 75 MXP
Cisco TelePresence System Edge 85 MXP
Cisco TelePresence System Edge 95 MXP
Cisco TelePresence System Codec 3000 MXP
Cisco TelePresence System Codec 6000 MXP
Tandberg 550 MXP
Tandberg 770 MXP
Tandberg 880 MXP
Tandberg 990 MXP
Tandberg 2000 MXP"
[20140430 Multiple Vulnerabilities in Cisco TelePresence System MXP Series]
Cisco TelePresence System MXP Series Software before F9.3.1 allows remote attackers to cause a denial of service (device reload) via crafted SIP packets, aka Bug ID CSCty45733.
Per: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140430-mxp
" Vulnerable Products
The following products running a version of Cisco TelePresence System MXP Series Software prior to F9.3.1 are affected by the vulnerabilities described in this advisory:
Cisco TelePresence System 1700 MXP
Cisco TelePresence System 1000 MXP
Cisco TelePresence System Edge 75 MXP
Cisco TelePresence System Edge 85 MXP
Cisco TelePresence System Edge 95 MXP
Cisco TelePresence System Codec 3000 MXP
Cisco TelePresence System Codec 6000 MXP
Tandberg 550 MXP
Tandberg 770 MXP
Tandberg 880 MXP
Tandberg 990 MXP
Tandberg 2000 MXP"
[20140430 Multiple Vulnerabilities in Cisco TelePresence System MXP Series]
Cisco TelePresence System MXP Series Software before F9.3.1 allows remote attackers to cause a denial of service (device reload) via crafted SIP packets, aka Bug ID CSCty45720.
[20140430 Multiple Vulnerabilities in Cisco TelePresence System MXP Series]
The H.225 subsystem in Cisco TelePresence System MXP Series Software before F9.3.1 allows remote attackers to cause a denial of service (device reload) via crafted packets, aka Bug ID CSCtq78722.
[20140430 Multiple Vulnerabilities in Cisco TelePresence System MXP Series]
The H.225 subsystem in Cisco TelePresence System MXP Series Software before F9.3.1 allows remote attackers to cause a denial of service (device reload) via crafted packets, aka Bug ID CSCty45745.
[20140430 Multiple Vulnerabilities in Cisco TelePresence System MXP Series]
The H.225 subsystem in Cisco TelePresence System MXP Series Software before F9.3.1 allows remote attackers to cause a denial of service (device reload) via crafted packets, aka Bug ID CSCty45731.
[20140430 Multiple Vulnerabilities in Cisco TelePresence System MXP Series]
The SIP implementation in Cisco TelePresence TC Software 4.x and 5.x and TE Software 4.x and 6.0 allows remote attackers to cause a denial of service (device reload) via crafted SIP packets, aka Bug ID CSCud29566.
[20140430 Multiple Vulnerabilities in Cisco TelePresence TC and TE Software]
The SIP implementation in Cisco TelePresence TC Software 4.x and 5.x and TE Software 4.x allows remote attackers to cause a denial of service (device reload) via crafted SIP packets, aka Bug ID CSCua64961.
[20140430 Multiple Vulnerabilities in Cisco TelePresence TC and TE Software]
The SIP implementation in Cisco TelePresence TC Software 4.x and 5.x and TE Software 4.x and 6.0 allows remote attackers to cause a denial of service (device reload) via crafted SIP packets, aka Bug ID CSCuj94651.
[20140430 Multiple Vulnerabilities in Cisco TelePresence TC and TE Software]
The SIP implementation in Cisco TelePresence TC Software 4.x and 5.x and TE Software 4.x and 6.0 allows remote attackers to cause a denial of service (device reload) via crafted SIP packets, aka Bug ID CSCtq72699.
[20140430 Multiple Vulnerabilities in Cisco TelePresence TC and TE Software]
The SIP implementation in Cisco TelePresence TC Software 4.x and TE Software 4.x allows remote attackers to cause a denial of service (device reload) via crafted SIP packets, aka Bug ID CSCto70562.
[20140430 Multiple Vulnerabilities in Cisco TelePresence TC and TE Software]
The SIP implementation in Cisco TelePresence TC Software 4.x and 5.x and TE Software 4.x and 6.0 allows remote attackers to cause a denial of service (device reload) via crafted SIP packets, aka Bug ID CSCua86589.
[20140430 Multiple Vulnerabilities in Cisco TelePresence TC and TE Software]
Buffer overflow in Cisco TelePresence TC Software 4.x and 5.x and TE Software 4.x and 6.0 allows remote attackers to execute arbitrary code via crafted DNS response packets, aka Bug ID CSCty44804.
[20140430 Multiple Vulnerabilities in Cisco TelePresence TC and TE Software]
Cisco TelePresence TC Software 4.x through 6.x before 6.2.0 and TE Software 4.x and 6.0 allow remote authenticated users to execute arbitrary commands by using the commands as arguments to internal system scripts, aka Bug ID CSCue60211.
[20140430 Multiple Vulnerabilities in Cisco TelePresence TC and TE Software]
Cisco TelePresence TC Software 4.x and 5.x before 5.1.7 and 6.x before 6.0.1 and TE Software 4.x and 6.0 allow remote authenticated users to execute arbitrary commands by using the commands as arguments to tshell (aka tcsh) scripts, aka Bug ID CSCue60202.
[20140430 Multiple Vulnerabilities in Cisco TelePresence TC and TE Software]
Heap-based buffer overflow in Cisco TelePresence TC Software 4.x through 6.x before 6.0.1 and TE Software 4.x and 6.0.x before 6.0.2 allows remote attackers to execute arbitrary code via crafted SIP packets, aka Bug ID CSCud81796.
[20140430 Multiple Vulnerabilities in Cisco TelePresence TC and TE Software]
Buffer overflow in Cisco TelePresence TC Software 4.x and 5.x and TE Software 4.x and 6.0 allows local users to gain privileges by leveraging improper handling of the u-boot compiler flag for internal executable files, aka Bug ID CSCub67693.
[20140430 Multiple Vulnerabilities in Cisco TelePresence TC and TE Software]
Cisco TelePresence TC Software 4.x and 5.x and TE Software 4.x and 6.0 do not properly restrict access to the serial port, which allows local users to gain privileges via unspecified commands, aka Bug ID CSCub67692.
[20140430 Multiple Vulnerabilities in Cisco TelePresence TC and TE Software]
Cisco TelePresence T, TelePresence TE, and TelePresence TC before 7.1 do not properly implement access control, which allows remote attackers to obtain root privileges by sending packets on the local network and allows physically proximate attackers to obtain root privileges via unspecified vectors, aka Bug ID CSCub67651.
[20150513 Multiple Vulnerabilities in Cisco TelePresence TC and TE Software]
Cisco TelePresence TC Software 4.x and 5.x and TE Software 4.x and 6.0 allow remote attackers to cause a denial of service (memory consumption) via crafted H.225 packets, aka Bug ID CSCtq78849.
[20140430 Multiple Vulnerabilities in Cisco TelePresence TC and TE Software]
Cisco IOS XR 4.1.2 through 5.1.1 on ASR 9000 devices, when a Trident-based line card is used, allows remote attackers to cause a denial of service (NP chip and line card reload) via malformed IPv6 packets, aka Bug ID CSCun71928.
[20140611 Cisco IOS XR Software IPv6 Malformed Packet Denial of Service Vulnerability]
[68005]
[1030400]
The network-diagnostics administration interface in the Cisco RV router firmware on RV220W devices, before 1.0.5.9 on RV120W devices, and before 1.0.4.14 on RV180 and RV180W devices allows remote authenticated users to execute arbitrary commands via a crafted HTTP request, aka Bug ID CSCuh87126.
[http://packetstormsecurity.com/files/128992/Cisco-RV-Overwrite-CSRF-Command-Execution.html]
[20141106 Cisco RV Series multiple vulnerabilities]
[20141105 Multiple Vulnerabilities in Cisco Small Business RV Series Routers]
[20141106 Cisco RV Series multiple vulnerabilities]
[1031171]
[cisco-cve20142177-command-exec(98497)]
Cross-site request forgery (CSRF) vulnerability in the administrative web interface in the Cisco RV router firmware on RV220W devices, before 1.0.5.9 on RV120W devices, and before 1.0.4.14 on RV180 and RV180W devices allows remote attackers to hijack the authentication of administrators, aka Bug ID CSCuh87145.
[http://packetstormsecurity.com/files/128992/Cisco-RV-Overwrite-CSRF-Command-Execution.html]
[20141106 Cisco RV Series multiple vulnerabilities]
[20141105 Multiple Vulnerabilities in Cisco Small Business RV Series Routers]
[20141106 Cisco RV Series multiple vulnerabilities]
[1031171]
[cisco-cve20142178-csrf(98498)]
The Cisco RV router firmware on RV220W devices, before 1.0.5.9 on RV120W devices, and before 1.0.4.14 on RV180 and RV180W devices allows remote attackers to upload files to arbitrary locations via a crafted HTTP request, aka Bug ID CSCuh86998.
[http://packetstormsecurity.com/files/128992/Cisco-RV-Overwrite-CSRF-Command-Execution.html]
[20141106 Cisco RV Series multiple vulnerabilities]
[20141105 Multiple Vulnerabilities in Cisco Small Business RV Series Routers]
[20141106 Cisco RV Series multiple vulnerabilities]
[1031171]
[cisco-cve20142179-file-upload(98499)]
The Document Management component in Cisco Unified Contact Center Express does not properly validate a parameter, which allows remote authenticated users to upload files to arbitrary pathnames via a crafted HTTP request, aka Bug ID CSCun74133.
[20140428 Cisco Unified Contact Center Express Arbitrary File Upload Vulnerability]
Cisco Adaptive Security Appliance (ASA) Software allows remote authenticated users to read files by sending a crafted URL to the HTTP server, as demonstrated by reading the running configuration, aka Bug ID CSCun78551.
[20140506 Cisco ASA Information Disclosure Vulnerability]
Cisco Adaptive Security Appliance (ASA) Software, when DHCPv6 replay is configured, allows remote attackers to cause a denial of service (device reload) via a crafted DHCPv6 packet, aka Bug ID CSCun45520.
[20140428 Cisco ASA DHCPv6 Denial of Service Vulnerability]
The L2TP module in Cisco IOS XE 3.10S(.2) and earlier on ASR 1000 routers allows remote authenticated users to cause a denial of service (ESP card reload) via a malformed L2TP packet, aka Bug ID CSCun09973.
[20140428 Cisco IOS XE Software Malformed L2TP Packet Vulnerability]
[http://tools.cisco.com/security/center/viewAlert.x?alertId=33971]
The IP Manager Assistant (IPMA) component in Cisco Unified Communications Manager (Unified CM) allows remote attackers to obtain sensitive information via a crafted URL, aka Bug ID CSCun74352.
[20140428 Cisco Unified Communications Manager Sensitive Information Disclosure Vulnerability]
The Call Detail Records (CDR) Management component in Cisco Unified Communications Manager (Unified CM) allows remote authenticated users to obtain sensitive information by reading extraneous fields in an HTML document, aka Bug ID CSCun74374.
[20140428 Cisco Unified Communications Manager CDR Management Vulnerability]
Cross-site request forgery (CSRF) vulnerability in the web framework in Cisco WebEx Meetings Server allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuj81777.
[20140429 Cisco WebEx Meetings Server Cross-Site Request Forgery Vulnerability]
[1030173]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2015-0607. Reason: This candidate is a duplicate of CVE-2015-0607. The wrong ID was used. Notes: All CVE users should reference CVE-2015-0607 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2014. Notes: none.
Cross-site request forgery (CSRF) vulnerability in the web framework in Cisco Broadcast Access Center for Telco and Wireless (aka BAC-TW) allows remote attackers to hijack the authentication of arbitrary users for requests that make BAC-TW changes, aka Bug IDs CSCuo23804 and CSCuo26389.
[20140506 Cisco Broadcast Access Center for Telco and Wireless Cross-Site Request Forgery Vulnerability]
[1030199]
Cross-site scripting (XSS) vulnerability in the web framework in Cisco Broadcast Access Center for Telco and Wireless (aka BAC-TW) allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCun91113.
[20140506 Cisco Broadcast Access Center for Telco and Wireless Cross-Site Scripting Vulnerability]
[1030198]
Cross-site scripting (XSS) vulnerability in Cisco Unified Web and E-mail Interaction Manager 9.0(2) allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCuj43033.
[20140516 Cisco Unified Web and E-mail Interaction Manager Cross-Site Scripting Vulnerability]
[http://tools.cisco.com/security/center/viewAlert.x?alertId=34269]
[67464]
Cisco Unified Web and E-Mail Interaction Manager places session identifiers in GET requests, which allows remote attackers to inject conversation text by obtaining a valid identifier, aka Bug ID CSCuj43084.
[20140519 Cisco Unified Web and E-Mail Interaction Manager Broken Authentication Vulnerability]
system/egain/chat/entrypoint in Cisco Unified Web and E-mail Interaction Manager 9.0(2) allows remote attackers to have an unspecified impact by injecting a spoofed XML external entity.
[20140516 Cisco Unified Web and E-mail Interaction Manager XML External Entities Vulnerability]
[http://tools.cisco.com/security/center/viewAlert.x?alertId=34270]
Cisco AsyncOS on Email Security Appliance (ESA) and Content Security Management Appliance (SMA) devices, when Active Directory is enabled, does not properly handle group names, which allows remote attackers to gain role privileges by leveraging group-name similarity, aka Bug ID CSCum86085.
[20140519 Cisco AsyncOS Software Administration Role Authorization Vulnerability]
[1030258]
Cisco Wide Area Application Services (WAAS) 5.1.1 before 5.1.1e, when SharePoint prefetch optimization is enabled, allows remote SharePoint servers to execute arbitrary code via a malformed response, aka Bug ID CSCue18479.
[20140521 Cisco Wide Area Application Services Remote Code Execution Vulnerability]
[1030265]
The Administration GUI in the web framework in Cisco Unified Communications Domain Manager (CDM) in Unified CDM Application Software before 8.1.4 does not properly implement access control, which allows remote authenticated users to modify administrative credentials via a crafted URL, aka Bug ID CSCun49862.
[59573]
[20140702 Multiple Vulnerabilities in Cisco Unified Communications Domain Manager]
[20140702 Identifying and Mitigating Exploitation of the Multiple Vulnerabilities in Cisco Unified Communications Domain Manager]
[68333]
[1030515]
Cisco Unified Communications Domain Manager (CDM) in Unified CDM Platform Software before 4.4.2 has a hardcoded SSH private key, which makes it easier for remote attackers to obtain access to the support and root accounts by extracting this key from a binary file found in a different installation of the product, aka Bug ID CSCud41130.
[59544]
[20140702 Multiple Vulnerabilities in Cisco Unified Communications Domain Manager]
[20140702 Identifying and Mitigating Exploitation of the Multiple Vulnerabilities in Cisco Unified Communications Domain Manager]
[68334]
[1030515]
meetinginfo.do in Cisco WebEx Event Center, WebEx Meeting Center, WebEx Sales Center, WebEx Training Center, WebEx Meetings Server 1.5(.1.131) and earlier, and WebEx Business Suite (WBS) 27 before 27.32.31.16, 28 before 28.12.13.18, and 29 before 29.5.1.12 allows remote attackers to obtain sensitive meeting information by leveraging knowledge of a meeting identifier, aka Bug IDs CSCuo68624 and CSCue46738.
[20140515 WebEx Meeting Information Disclosure Vulnerability in meetinginfo.do]
[http://tools.cisco.com/security/center/viewAlert.x?alertId=34252]
[1030251]
Cisco NX-OS 5.0 before 5.0(5) on Nexus 7000 devices, when local authentication and multiple VDCs are enabled, allows remote authenticated users to gain privileges within an unintended VDC via an SSH session to a management interface, aka Bug ID CSCti11629.
[20140521 Multiple Vulnerabilities in Cisco NX-OS-Based Products]
The Message Transfer Service (MTS) in Cisco NX-OS before 6.2(7) on MDS 9000 devices and 6.0 before 6.0(2) on Nexus 7000 devices allows remote attackers to cause a denial of service (NULL pointer dereference and kernel panic) via a large volume of crafted traffic, aka Bug ID CSCtw98915.
Per: http://cwe.mitre.org/data/definitions/476.html
"CWE-476: NULL Pointer Dereference"
[20140521 Multiple Vulnerabilities in Cisco NX-OS-Based Products]
The Import and Export Framework in McAfee ePolicy Orchestrator (ePO) before 4.6.7 Hotfix 940148 allows remote authenticated users with permissions to add dashboards to read arbitrary files by importing a crafted XML file, related to an XML External Entity (XXE) issue.
[20140225 [RT-SA-2014-001] McAfee ePolicy Orchestrator: XML External Entity Expansion in Dashboard]
[65771]
[https://kc.mcafee.com/corporate/index?page=content&id=SB10065]
[https://www.redteam-pentesting.de/advisories/rt-sa-2014-001.txt]
Stack-based buffer overflow in GetGo Download Manager 4.9.0.1982, 4.8.2.1346, 4.4.5.502, and earlier allows remote attackers to cause a denial of service (crash) and execute arbitrary code via a long HTTP Response Header.
[http://www.rcesecurity.com/2014/03/cve-2014-2206-getgo-download-manager-http-response-header-buffer-overflow-remote-code-execution]
[20140302 [CVE-2014-2206] GetGo Download Manager HTTP Response Header Buffer Overflow Remote Code Execution]
[65913]
CRLF injection vulnerability in the LightProcess protocol implementation in hphp/util/light-process.cpp in Facebook HipHop Virtual Machine (HHVM) before 2.4.2 allows remote attackers to execute arbitrary commands by entering a \n (newline) character before the end of a string.
[https://github.com/facebook/hhvm/commit/506a44194a9016406c752ad8e010c01aeffc18cc]
Facebook HipHop Virtual Machine (HHVM) before 3.1.0 does not drop supplemental group memberships within hphp/util/capability.cpp and hphp/util/light-process.cpp, which allows remote attackers to bypass intended access restrictions by leveraging group permissions for a file or directory.
[https://github.com/facebook/hhvm/commit/851fff90a9b7461df2393af32239ba217bc25946]
Multiple directory traversal vulnerabilities in CA ERwin Web Portal 9.5 allow remote attackers to obtain sensitive information, bypass intended access restrictions, cause a denial of service, or possibly execute arbitrary code via unspecified vectors.
[66644]
[1030017]
[https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=%7B7F968A14-7407-4BCF-9EB1-EFE9F0E6D663%7D]
SQL injection vulnerability in portal/addtoapplication.php in POSH (aka Posh portal or Portaneo) 3.0 before 3.3.0 allows remote attackers to execute arbitrary SQL commands via the rssurl parameter.
[[oss-security] 20140227 [CVE assignment notification] Multiple vulnerabilities in POSH]
[http://sourceforge.net/p/posh/svn/3540/]
[65817]
[http://www.sysdream.com/CVE-2014-2211_2214]
[http://www.sysdream.com/system/files/POSH-3.2.1-advisory_0.pdf]
The remember me feature in portal/scr_authentif.php in POSH (aka Posh portal or Portaneo) 3.0, 3.2.1, 3.3.0, and earlier stores the username and MD5 digest of the password in cleartext in a cookie, which allows attackers to obtain sensitive information by reading this cookie.
[[oss-security] 20140227 [CVE assignment notification] Multiple vulnerabilities in POSH]
[http://www.sysdream.com/CVE-2014-2211_2214]
[http://www.sysdream.com/system/files/POSH-3.2.1-advisory_0.pdf]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2014. Notes: none.
The FortiManager protocol service in Fortinet FortiOS before 4.3.16 and 5.0.0 before 5.0.8 on FortiGate devices allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted request.
[http://www.fortiguard.com/advisory/FG-IR-14-006/]
[VU#730964]
[69338]
[1030753]
[fortigate-cve20142216-dos(95442)]
Absolute path traversal vulnerability in the RadAsyncUpload control in the RadControls in Telerik UI for ASP.NET AJAX before Q3 2012 SP2 allows remote attackers to write to arbitrary files, and consequently execute arbitrary code, via a full pathname in the UploadID metadata value.
[http://itq.nl/arbitrary-file-write-in-telerik-ui-for-asp-net-ajax/]
Cross-site scripting (XSS) vulnerability in whizzywig/wb.php in CMSimple Classic 3.54 and earlier, possibly as downloaded before February 26, 2014, allows remote attackers to inject arbitrary web script or HTML via the d parameter.
[20140319 Cross-Site Scripting (XSS) in CMSimple]
[66312]
[https://www.htbridge.com/advisory/HTB23205]
Unrestricted file upload vulnerability in plog-admin/plog-upload.php in Plogger 1.0 RC1 and earlier allows remote authenticated users to execute arbitrary code by uploading a ZIP file that contains a PHP file and a non-zero length PNG file, then accessing the PHP file via a direct request to it in plog-content/uploads/archive/.
[http://packetstormsecurity.com/files/128029/Plogger-Authenticated-Arbitrary-File-Upload.html]
[[oss-security] 20140227 CVE request: PLOGGER 1.0RC1 multiple vulnerabilities]
[[oss-security] 20140227 Re: CVE request: PLOGGER 1.0RC1 multiple vulnerabilities]
[34447]
[https://www.sysdream.com/CVE-2014-2223_CVE-2014-2224]
[https://www.sysdream.com/system/files/PLOGGER-1.0RC1-advisory.pdf]
Plogger 1.0 RC1 and earlier, when the Lucid theme is used, does not assign new values for certain codes, which makes it easier for remote attackers to bypass the CAPTCHA protection mechanism via a series of form submissions.
[https://www.sysdream.com/CVE-2014-2223_CVE-2014-2224]
Ubiquiti UniFi Controller before 3.2.1 logs the administrative password hash in syslog messages, which allows man-in-the-middle attackers to obtain sensitive information via unspecified vectors.
[http://packetstormsecurity.com/files/127616/Ubiquiti-UbiFi-Controller-2.4.5-Password-Hash-Disclosure.html]
[20140724 CVE-2014-2226: Ubiquiti Networks - UniFi Controller - Admin/root password hash sent via syslog]
[http://sethsec.blogspot.com/2014/07/cve-2014-2226.html]
[68869]
The default Flash cross-domain policy (crossdomain.xml) in Ubiquiti Networks UniFi Video (formerly AirVision aka AirVision Controller) before 3.0.1 does not restrict access to the application, which allows remote attackers to bypass the Same Origin Policy via a crafted SWF file.
[20140724 CVE-2014-2227: Ubiquiti Networks - AirVision v2.1.3 - Overly Permissive default crossdomain.xml]
[http://sethsec.blogspot.com/2014/07/cve-2014-2227.html]
[68866]
Open redirect vulnerability in the header function in adclick.php in OpenX 2.8.10 and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the (1) dest parameter to adclick.php or (2) _maxdest parameter to ck.php.
<a href = "http://cwe.mitre.org/data/definitions/601.html"> CWE-601: URL Redirection to Untrusted Site ('Open Redirect') </a>
[http://packetstormsecurity.com/files/128718/OpenX-2.8.10-Open-Redirect.html]
[20141016 CVE-2014-2230 - OpenX Open Redirect Vulnerability]
[http://www.tetraph.com/blog/cves/cve-2014-2230-openx-open-redirect-vulnerability-2]
[openx-cve20142230-open-redirect(97621)]
Cross-site scripting (XSS) vulnerability in the API in synetics i-doit pro before 1.2.5 allows remote attackers to inject arbitrary web script or HTML via a property title.
[http://www.i-doit.com/en/company/news/single-news/?tx_ttnews%5Btt_news%5D=141]
Absolute path traversal vulnerability in the MapAPI in Infoware MapSuite before 1.0.36 and 1.1.x before 1.1.49 allows remote attackers to read arbitrary files via unspecified vectors.
[http://iw.mapandroute.de/MapAPI-1.0/releaseHistory.jsp]
[http://iw.mapandroute.de/MapAPI-1.1/releaseHistory.jsp]
[http://www.christian-schneider.net/advisories/CVE-2014-2232.txt]
Server-side request forgery (SSRF) vulnerability in the MapAPI in Infoware MapSuite before 1.0.36 and 1.1.x before 1.1.49 allows remote attackers to trigger requests to intranet servers via unspecified vectors.
<a href="http://cwe.mitre.org/data/definitions/918.html">CWE-918: Server-Side Request Forgery (SSRF)</a>
[http://iw.mapandroute.de/MapAPI-1.0/releaseHistory.jsp]
[http://iw.mapandroute.de/MapAPI-1.1/releaseHistory.jsp]
[http://www.christian-schneider.net/advisories/CVE-2014-2233.txt]
A certain Apple patch for OpenSSL in Apple OS X 10.9.2 and earlier uses a Trust Evaluation Agent (TEA) feature without terminating certain TLS/SSL handshakes as specified in the SSL_CTX_set_verify callback function's documentation, which allows remote attackers to bypass extra verification within a custom application via a crafted certificate chain that is acceptable to TEA but not acceptable to that application.
[https://hynek.me/articles/apple-openssl-verification-surprises/]
Cross-site scripting (XSS) vulnerability in Askbot before 0.7.49 allows remote attackers to inject arbitrary web script or HTML via vectors related to the question search form.
[[oss-security] 20140228 Re: CVE request: askbot xss]
[65885]
[https://bugzilla.redhat.com/show_bug.cgi?id=1070852]
[https://github.com/ASKBOT/askbot-devel/commit/876e3662ff6b78cc6241338c15e3a0cb49edf4e2]
Multiple cross-site scripting (XSS) vulnerabilities in Askbot before 0.7.49 allow remote attackers to inject arbitrary web script or HTML via vectors related to the (1) tag or (2) user search forms.
[[oss-security] 20140228 Re: CVE request: askbot xss]
[65885]
[https://bugzilla.redhat.com/show_bug.cgi?id=1070852]
[https://github.com/ASKBOT/askbot-devel/commit/876e3662ff6b78cc6241338c15e3a0cb49edf4e2#diff-b693b4c02739be4b3231bece15b0eb87]
[https://github.com/ASKBOT/askbot-devel/commit/a676a86b6b7a5737d4da4f59f71e037406f88d29]
The memcache token backend in OpenStack Identity (Keystone) 2013.1 through 2.013.1.4, 2013.2 through 2013.2.2, and icehouse before icehouse-3, when issuing a trust token with impersonation enabled, does not include this token in the trustee's token-index-list, which prevents the token from being invalidated by bulk token revocation and allows the trustee to bypass intended access restrictions.
[RHSA-2014:0580]
[[oss-security] 20140304 [OSSA 2014-006] Trustee token revocation does not work with memcache backend (CVE-2014-2237)]
[65895]
[https://bugs.launchpad.net/keystone/+bug/1260080]
SQL injection vulnerability in the manage configuration page (adm_config_report.php) in MantisBT 1.2.13 through 1.2.16 allows remote authenticated administrators to execute arbitrary SQL commands via the filter_config_id parameter.
[http://mantisbt.domainunion.de/bugs/view.php?id=17055]
[[oss-security] 20140228 CVE request: MantisBT 1.2.13 SQL injection vulnerability]
[[oss-security] 20140304 Re: CVE request: MantisBT 1.2.13 SQL injection vulnerability]
[http://www.mantisbt.org/blog/?p=288]
[65903]
[mantisbt-admconfigreport-sql-injection(91563)]
Stack-based buffer overflow in the cf2_hintmap_build function in cff/cf2hints.c in FreeType before 2.5.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large number of stem hints in a font file.
[http://savannah.nongnu.org/bugs/?41697]
[http://sourceforge.net/projects/freetype/files/freetype2/2.5.3]
[http://www.freetype.org/index.html]
[66074]
[1029895]
[USN-2148-1]
The (1) cf2_initLocalRegionBuffer and (2) cf2_initGlobalRegionBuffer functions in cff/cf2ft.c in FreeType before 2.5.3 do not properly check if a subroutine exists, which allows remote attackers to cause a denial of service (assertion failure), as demonstrated by a crafted ttf file.
[http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=135c3faebb96f8f550bd4f318716f2e1e095a969]
[http://savannah.nongnu.org/bugs/?41697]
[[oss-security] 20140312 Re: Two stack-based issues in freetype [NOT a request]]
[USN-2148-1]
includes/upload/UploadBase.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 does not prevent use of invalid namespaces in SVG files, which allows remote attackers to conduct cross-site scripting (XSS) attacks via an SVG upload, as demonstrated by use of a W3C XHTML namespace in conjunction with an IFRAME element.
[[mediawiki-announce] 20140228 MediaWiki Security and Maintenance Releases: 1.22.3, 1.21.6 and 1.19.12]
[[oss-security] 20140228 CVE requests: MediaWiki 1.22.3, 1.21.6 and 1.19.12 release]
[[oss-security] 20140301 Re: CVE requests: MediaWiki 1.22.3, 1.21.6 and 1.19.12 release]
[65910]
[https://bugzilla.redhat.com/show_bug.cgi?id=1071135]
[https://bugzilla.wikimedia.org/show_bug.cgi?id=60771]
[https://gerrit.wikimedia.org/r/#/q/7d923a6b53f7fbcb0cbc3a19797d741bf6f440eb,n,z]
includes/User.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 terminates validation of a user token upon encountering the first incorrect character, which makes it easier for remote attackers to obtain access via a brute-force attack that relies on timing differences in responses to incorrect token guesses.
[[mediawiki-announce] 20140228 MediaWiki Security and Maintenance Releases: 1.22.3, 1.21.6 and 1.19.12]
[[oss-security] 20140228 CVE requests: MediaWiki 1.22.3, 1.21.6 and 1.19.12 release]
[[oss-security] 20140301 Re: CVE requests: MediaWiki 1.22.3, 1.21.6 and 1.19.12 release]
[https://bugzilla.redhat.com/show_bug.cgi?id=1071136]
[https://bugzilla.wikimedia.org/show_bug.cgi?id=61346]
[https://gerrit.wikimedia.org/r/#/q/I2a9e89120f7092015495e638c6fa9f67adc9b84f,n,z]
Cross-site scripting (XSS) vulnerability in the formatHTML function in includes/api/ApiFormatBase.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 allows remote attackers to inject arbitrary web script or HTML via a crafted string located after http:// in the text parameter to api.php.
[[mediawiki-announce] 20140228 MediaWiki Security and Maintenance Releases: 1.22.3, 1.21.6 and 1.19.12]
[[oss-security] 20140228 CVE requests: MediaWiki 1.22.3, 1.21.6 and 1.19.12 release]
[[oss-security] 20140301 Re: CVE requests: MediaWiki 1.22.3, 1.21.6 and 1.19.12 release]
[65906]
[https://bugzilla.redhat.com/show_bug.cgi?id=1071139]
[https://bugzilla.wikimedia.org/show_bug.cgi?id=61362]
[https://gerrit.wikimedia.org/r/#/q/Idf985e4e69c2f11778a8a90503914678441cb3fb,n,z]
SQL injection vulnerability in the News module in CMS Made Simple (CMSMS) before 1.11.10 allows remote authenticated users with the "Modify News" permission to execute arbitrary SQL commands via the sortby parameter to admin/moduleinterface.php. NOTE: some of these details are obtained from third party information.
[http://dev.cmsmadesimple.org/project/changelog/4602]
[[oss-security] 20140301 Re: CVE request: CMS Made Simple SQL injection fixed in 1.11.10]
[65953]
Cross-site scripting (XSS) vulnerability in the integrated web server on Siemens SIMATIC S7-1500 CPU PLC devices with firmware before 1.5.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
[http://ics-cert.us-cert.gov/advisories/ICSA-14-073-01]
[66201]
[http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-456423.pdf]
The integrated web server on Siemens SIMATIC S7-1500 CPU PLC devices with firmware before 1.5.0 allows remote attackers to inject headers via unspecified vectors.
CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
[http://ics-cert.us-cert.gov/advisories/ICSA-14-073-01]
[http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-456423.pdf]
Open redirect vulnerability in the integrated web server on Siemens SIMATIC S7-1500 CPU PLC devices with firmware before 1.5.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
CWE-601: URL Redirection to Untrusted Site (“Open Redirect”)
[http://ics-cert.us-cert.gov/advisories/ICSA-14-073-01]
[66190]
[http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-456423.pdf]
Cross-site request forgery (CSRF) vulnerability on Siemens SIMATIC S7-1500 CPU PLC devices with firmware before 1.5.0 and SIMATIC S7-1200 CPU PLC devices with firmware before 4.0 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
[http://ics-cert.us-cert.gov/advisories/ICSA-14-073-01]
[http://ics-cert.us-cert.gov/advisories/ICSA-14-079-02]
[http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-456423.pdf]
[http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-654382.pdf]
The random-number generator on Siemens SIMATIC S7-1200 CPU PLC devices with firmware before 4.0 does not have sufficient entropy, which makes it easier for remote attackers to defeat cryptographic protection mechanisms and hijack sessions via unspecified vectors, a different vulnerability than CVE-2014-2251.
[http://ics-cert.us-cert.gov/advisories/ICSA-14-079-02]
[http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-654382.pdf]
The random-number generator on Siemens SIMATIC S7-1500 CPU PLC devices with firmware before 1.5.0 does not have sufficient entropy, which makes it easier for remote attackers to defeat cryptographic protection mechanisms and hijack sessions via unspecified vectors.
CWE-331: Insufficient Entropy
[http://ics-cert.us-cert.gov/advisories/ICSA-14-073-01]
[http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-456423.pdf]
Siemens SIMATIC S7-1200 CPU PLC devices with firmware before 4.0 allow remote attackers to cause a denial of service (defect-mode transition) via crafted PROFINET packets, a different vulnerability than CVE-2014-2253.
[http://ics-cert.us-cert.gov/advisories/ICSA-14-079-02]
[http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-654382.pdf]
Siemens SIMATIC S7-1500 CPU PLC devices with firmware before 1.5.0 allow remote attackers to cause a denial of service (defect-mode transition) via crafted Profinet packets.
CWE-404: Improper Resource Shutdown or Release
[http://ics-cert.us-cert.gov/advisories/ICSA-14-073-01]
[http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-456423.pdf]
Siemens SIMATIC S7-1200 CPU PLC devices with firmware before 4.0 allow remote attackers to cause a denial of service (defect-mode transition) via crafted HTTP packets, a different vulnerability than CVE-2014-2255.
[http://ics-cert.us-cert.gov/advisories/ICSA-14-079-02]
[http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-654382.pdf]
Siemens SIMATIC S7-1500 CPU PLC devices with firmware before 1.5.0 allow remote attackers to cause a denial of service (defect-mode transition) via crafted HTTP packets.
CWE-404: Improper Resource Shutdown or Release
[http://ics-cert.us-cert.gov/advisories/ICSA-14-073-01]
[http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-456423.pdf]
Siemens SIMATIC S7-1200 CPU PLC devices with firmware before 4.0 allow remote attackers to cause a denial of service (defect-mode transition) via crafted ISO-TSAP packets, a different vulnerability than CVE-2014-2257.
[http://ics-cert.us-cert.gov/advisories/ICSA-14-079-02]
[http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-654382.pdf]
Siemens SIMATIC S7-1500 CPU PLC devices with firmware before 1.5.0 allow remote attackers to cause a denial of service (defect-mode transition) via crafted ISO-TSAP packets.
CWE-404: Improper Resource Shutdown or Release
[http://ics-cert.us-cert.gov/advisories/ICSA-14-073-01]
[http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-456423.pdf]
Siemens SIMATIC S7-1200 CPU PLC devices with firmware before 4.0 allow remote attackers to cause a denial of service (defect-mode transition) via crafted HTTPS packets, a different vulnerability than CVE-2014-2259.
[http://ics-cert.us-cert.gov/advisories/ICSA-14-079-02]
[http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-654382.pdf]
Siemens SIMATIC S7-1500 CPU PLC devices with firmware before 1.5.0 allow remote attackers to cause a denial of service (defect-mode transition) via crafted HTTPS packets.
CWE-404: Improper Resource Shutdown or Release
[http://ics-cert.us-cert.gov/advisories/ICSA-14-073-01]
[http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-456423.pdf]
Cross-site scripting (XSS) vulnerability in plugins/main/content/js/ajenti.coffee in Eugene Pankov Ajenti 1.2.13 allows remote authenticated users to inject arbitrary web script or HTML via the command field in the Cron functionality.
[http://packetstormsecurity.com/files/124804/Ajenti-1.2.13-Cross-Site-Scripting.html]
[64982]
[https://github.com/Eugeny/ajenti/commit/3270fd1d78391bb847b4c9ce37cf921f485b1310]
[https://github.com/Eugeny/ajenti/issues/233]
Buffer overflow in the client application in Base SAS 9.2 TS2M3, SAS 9.3 TS1M1 and TS1M2, and SAS 9.4 TS1M0 allows user-assisted remote attackers to execute arbitrary code via a crafted SAS program.
[http://support.sas.com/kb/51/701.html]
[20140227 SEC Consult SA-20140227-0 :: Local Buffer Overflow vulnerability in SAS for Windows (Statistical Analysis System)]
[65853]
[https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140227-0_SAS_Buffer_overflow_v10.txt]
The mpegts_write_pmt function in the MPEG2 transport stream (aka DVB) muxer (libavformat/mpegtsenc.c) in FFmpeg, possibly 2.1 and earlier, allows remote attackers to have unspecified impact and vectors, which trigger an out-of-bounds write.
[http://git.videolan.org/?p=ffmpeg.git;a=commit;h=842b6c14bc]
[65560]
[1029850]
[ffmpeg-mpegtswritepmt-bo(91174)]
[GLSA-201603-06]
The OpenVPN module in Synology DiskStation Manager (DSM) 4.3-3810 update 1 has a hardcoded root password of synopass, which makes it easier for remote attackers to obtain access via a VPN session.
[http://forum.synology.com/enu/viewtopic.php?f=173&t=77644]
[VU#534284]
Rock Lobster Contact Form 7 before 3.7.2 allows remote attackers to bypass the CAPTCHA protection mechanism and submit arbitrary form data by omitting the _wpcf7_captcha_challenge_captcha-719 parameter.
[http://contactform7.com/2014/02/26/contact-form-7-372/]
[http://wordpress.org/plugins/contact-form-7/changelog]
[http://www.hedgehogsecurity.co.uk/2014/02/26/contactform7-vulnerability/]
views/Index.php in the Install module in vTiger 6.0 before Security Patch 2 does not properly restrict access, which allows remote attackers to re-install the application via a request that sets the X-Requested-With HTTP header, as demonstrated by executing arbitrary PHP code via the db_name parameter.
[[Vtigercrm-developers] 20140316 IMP: forgot password and re-installation security fix]
[32794]
[66757]
[https://www.navixia.com/blog/entry/navixia-find-critical-vulnerabilities-in-vtiger-crm-cve-2014-2268-cve-2014-2269.html]
modules/Users/ForgotPassword.php in vTiger 6.0 before Security Patch 2 allows remote attackers to reset the password for arbitrary users via a request containing the username, password, and confirmPassword parameters.
[[Vtigercrm-developers] 20140316 IMP: forgot password and re-installation security fix]
[66758]
softmagic.c in file before 5.17 and libmagic allows context-dependent attackers to cause a denial of service (out-of-bounds memory access and crash) via crafted offsets in the softmagic of a PE executable.
[http://bugs.gw.com/view.php?id=313]
[openSUSE-SU-2014:0364]
[openSUSE-SU-2014:0367]
[openSUSE-SU-2014:0435]
[RHSA-2014:1765]
[[oss-security] 20140303 CVE Request: file: crashes when checking softmagic for some corrupt PE executables]
[[oss-security] 20140305 Re: CVE Request: file: crashes when checking softmagic for some corrupt PE executables]
[[oss-security] 20140305 Re: CVE Request: file: crashes when checking softmagic for some corrupt PE executables]
[http://support.apple.com/kb/HT6443]
[DSA-2873]
[http://www.php.net/ChangeLog-5.php]
[USN-2162-1]
[USN-2163-1]
[https://github.com/file/file/commit/447558595a3650db2886cd2f416ad0beba965801]
[GLSA-201503-08]
The hx170dec device driver in Huawei P2-6011 before V100R001C00B043 allows local users to read and write to arbitrary memory locations via unspecified vectors.
[http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-401529.htm]
[71374]
[huawei-cve20142273-priv-esc(99088)]
[https://labs.mwrinfosecurity.com/system/assets/762/original/mwri_advisory_huawei_driver-root-exploit.pdf]
Cross-site request forgery (CSRF) vulnerability in the Subscribe To Comments Reloaded plugin before 140219 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via a request to the subscribe-to-comments-reloaded/options/index.php page to wp-admin/admin.php.
[https://security.dxw.com/advisories/stored-xss-and-csrf-vulnerabilities-in-subscribe-to-comments-reloaded-140129/]
[https://wordpress.org/plugins/subscribe-to-comments-reloaded/#developers]
The FileUploadController servlet in EMC Connectrix Manager Converged Network Edition (CMCNE) before 12.1.5 does not properly restrict additions to the Connectrix Manager repository, which allows remote attackers to obtain sensitive information by importing a crafted firmware file.
[20140318 ESA-2014-018: EMC Connectrix Manager Converged Network Edition Information Disclosure Vulnerability]
[66308]
[1029939]
[connectrix-cve20142276-info-disc(91987)]
The make_temporary_filename function in perltidy 20120701-1 and earlier allows local users to obtain sensitive information or write to arbitrary files via a symlink attack, related to use of the tmpnam function.
[FEDORA-2014-3891]
[FEDORA-2014-3874]
[[oss-security] 20140308 Re: possible CVE requests: perltidy insecure temporary file usage]
[66139]
[https://bugzilla.redhat.com/show_bug.cgi?id=1074720]
[perltidy-cve20142277-symlink(92104)]
Unrestricted file upload vulnerability in op/op.AddFile2.php in SeedDMS (formerly LetoDMS and MyDMS) before 4.3.4 allows remote attackers to execute arbitrary code by uploading a file with an executable extension specified by the partitionIndex parameter and leveraging CVE-2014-2279.2 to access it via the directory specified by the fileId parameter.
[20140314 Multiple Vulnerabilities in SeedDMS < = 4.3.3]
[http://packetstormsecurity.com/files/125726]
[http://sourceforge.net/p/seeddms/code/ci/master/tree/CHANGELOG]
Multiple directory traversal vulnerabilities in SeedDMS (formerly LetoDMS and MyDMS) before 4.3.4 allow (1) remote authenticated users with access to the LogManagement functionality to read arbitrary files via a .. (dot dot) in the logname parameter to out/out.LogManagement.php or (2) remote attackers to write to arbitrary files via a .. (dot dot) in the fileId parameter to op/op.AddFile2.php. NOTE: vector 2 can be leveraged to execute arbitrary code by using CVE-2014-2278.
[20140314 Multiple Vulnerabilities in SeedDMS < = 4.3.3]
[http://packetstormsecurity.com/files/125726]
[http://sourceforge.net/p/seeddms/code/ci/master/tree/CHANGELOG]
[66256]
[seeddms-cve20142279-dir-trav(91831)]
Cross-site scripting (XSS) vulnerability in the search feature in SeedDMS (formerly LetoDMS and MyDMS) before 4.3.4 allows remote attackers to inject arbitrary web script or HTML via the query parameter.
[20140314 Multiple Vulnerabilities in SeedDMS < = 4.3.3]
[http://packetstormsecurity.com/files/125726]
[http://sourceforge.net/p/seeddms/code/ci/master/tree/CHANGELOG]
[seeddms-cve20142280-xss(91830)]
The nfs_name_snoop_add_name function in epan/dissectors/packet-nfs.c in the NFS dissector in Wireshark 1.8.x before 1.8.13 and 1.10.x before 1.10.6 does not validate a certain length value, which allows remote attackers to cause a denial of service (memory corruption and application crash) via a crafted NFS packet.
[http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-nfs.c?r1=54875&r2=54874&pathrev=54875]
[http://anonsvn.wireshark.org/viewvc?view=revision&revision=54875]
[openSUSE-SU-2014:0382]
[openSUSE-SU-2014:0383]
[RHSA-2014:0341]
[RHSA-2014:0342]
[DSA-2871]
[1029907]
[http://www.wireshark.org/security/wnpa-sec-2014-01.html]
[https://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_wireshark10]
[https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9672]
The dissect_protocol_data_parameter function in epan/dissectors/packet-m3ua.c in the M3UA dissector in Wireshark 1.10.x before 1.10.6 does not properly allocate memory, which allows remote attackers to cause a denial of service (application crash) via a crafted SS7 MTP3 packet.
[http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-m3ua.c?r1=51608&r2=51607&pathrev=51608]
[http://anonsvn.wireshark.org/viewvc?view=revision&revision=51608]
[openSUSE-SU-2014:0382]
[1029907]
[http://www.wireshark.org/security/wnpa-sec-2014-02.html]
[https://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_wireshark10]
[https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9699]
epan/dissectors/packet-rlc in the RLC dissector in Wireshark 1.8.x before 1.8.13 and 1.10.x before 1.10.6 uses inconsistent memory-management approaches, which allows remote attackers to cause a denial of service (use-after-free error and application crash) via a crafted UMTS Radio Link Control packet.
<a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a>
[openSUSE-SU-2014:0382]
[openSUSE-SU-2014:0383]
[RHSA-2014:0342]
[DSA-2871]
[1029907]
[http://www.wireshark.org/security/wnpa-sec-2014-03.html]
[https://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_wireshark10]
[https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9730]
[https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9802]
[https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=217293ba4a0353bf5d657e74fe8623dd3c86fe08]
The Linux implementation of the ICMP-MIB in Net-SNMP 5.5 before 5.5.2.1, 5.6.x before 5.6.2.1, and 5.7.x before 5.7.2.1 does not properly validate input, which allows remote attackers to cause a denial of service via unspecified vectors.
[[oss-security] 20140305 CVE request for two net-snmp remote DoS flaws]
[openSUSE-SU-2014:0398]
[openSUSE-SU-2014:0399]
[RHSA-2014:0321]
[[net-snmp-announce] 20140225 Multiple Security-fix Net-SNMP Releases: 5.5.2.1, 5.6.2.1, and 5.7.2.1]
[GLSA-201409-02]
[USN-2166-1]
The perl_trapd_handler function in perl/TrapReceiver/TrapReceiver.xs in Net-SNMP 5.7.3.pre3 and earlier, when using certain Perl versions, allows remote attackers to cause a denial of service (snmptrapd crash) via an empty community string in an SNMP trap, which triggers a NULL pointer dereference within the newSVpv function in Perl.
[[oss-security] 20140305 CVE request for two net-snmp remote DoS flaws]
[http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705]
[openSUSE-SU-2014:0398]
[openSUSE-SU-2014:0399]
[http://sourceforge.net/p/net-snmp/patches/1275/]
[GLSA-201409-02]
[http://www.nntp.perl.org/group/perl.perl5.porters/2006/09/msg116250.html]
[https://bugzilla.redhat.com/show_bug.cgi?id=1072044]
[https://bugzilla.redhat.com/show_bug.cgi?id=1072778]
[RHSA-2014:0322]
main/http.c in Asterisk Open Source 1.8.x before 1.8.26.1, 11.8.x before 11.8.1, and 12.1.x before 12.1.1, and Certified Asterisk 1.8.x before 1.8.15-cert5 and 11.6 before 11.6-cert2, allows remote attackers to cause a denial of service (stack consumption) and possibly execute arbitrary code via an HTTP request with a large number of Cookie headers.
[http://downloads.asterisk.org/pub/security/AST-2014-001.html]
[http://downloads.asterisk.org/pub/security/AST-2014-001-1.8.diff]
[FEDORA-2014-3779]
[FEDORA-2014-3762]
[MDVSA-2014:078]
[66093]
[https://issues.asterisk.org/jira/browse/ASTERISK-23340]
channels/chan_sip.c in Asterisk Open Source 1.8.x before 1.8.26.1, 11.8.x before 11.8.1, and 12.1.x before 12.1.1, and Certified Asterisk 1.8.15 before 1.8.15-cert5 and 11.6 before 11.6-cert2, when chan_sip has a certain configuration, allows remote authenticated users to cause a denial of service (channel and file descriptor consumption) via an INVITE request with a (1) Session-Expires or (2) Min-SE header with a malformed or invalid value.
[http://downloads.asterisk.org/pub/security/AST-2014-002.html]
[http://downloads.asterisk.org/pub/security/AST-2014-002-1.8.diff]
[FEDORA-2014-3779]
[FEDORA-2014-3762]
[MDVSA-2014:078]
[66094]
[https://issues.asterisk.org/jira/browse/ASTERISK-23373]
The PJSIP channel driver in Asterisk Open Source 12.x before 12.1.1, when qualify_frequency "is enabled on an AOR and the remote SIP server challenges for authentication of the resulting OPTIONS request," allows remote attackers to cause a denial of service (crash) via a PJSIP endpoint that does not have an associated outgoing request.
[http://downloads.asterisk.org/pub/security/AST-2014-003.html]
[http://downloads.asterisk.org/pub/security/AST-2014-003-12.diff]
[FEDORA-2014-3779]
[FEDORA-2014-3762]
[https://issues.asterisk.org/jira/browse/ASTERISK-23210]
res/res_pjsip_exten_state.c in the PJSIP channel driver in Asterisk Open Source 12.x before 12.1.0 allows remote authenticated users to cause a denial of service (crash) via a SUBSCRIBE request without any Accept headers, which triggers an invalid pointer dereference.
[http://downloads.asterisk.org/pub/security/AST-2014-004.html]
[http://downloads.asterisk.org/pub/security/AST-2014-004-12.diff]
[FEDORA-2014-3779]
[FEDORA-2014-3762]
[https://issues.asterisk.org/jira/browse/ASTERISK-23139]
Cross-site scripting (XSS) vulnerability in the Pulse Collaboration (Secure Meeting) user pages in Juniper Junos Pulse Secure Access Service (aka SSL VPN) with IVE OS before 7.1r18, 7.3 before 7.3r10, 7.4 before 7.4r8, and 8.0 before 8.0r1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
[juniper-junos-cve20142291-xss(91770)]
[https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10617]
Unspecified vulnerability in the Linux Network Connect client in Juniper Junos Pulse Secure Access Service (aka SSL VPN) with IVE OS before 7.1r18, 7.3 before 7.3r10, 7.4 before 7.4r8, and 8.0 before 8.0r1 allows local users to gain privileges via unspecified vectors.
[https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10616]
Zikula Application Framework before 1.3.7 build 11 allows remote attackers to conduct PHP object injection attacks and delete arbitrary files or execute arbitrary PHP code via crafted serialized data in the (1) authentication_method_ser or (2) authentication_info_ser parameter to index.php, or (3) zikulaMobileTheme parameter to index.php.
[http://karmainsecurity.com/KIS-2014-02]
[zikula-cve20142293-code-exec(91786)]
[zikula-securityutil-code-exec(91787)]
[https://secuniaresearch.flexerasoftware.com/secunia_research/2014-2/]
Open Web Analytics (OWA) before 1.5.7 allows remote attackers to conduct PHP object injection attacks via a crafted serialized object in the owa_event parameter to queue.php.
[http://karmainsecurity.com/KIS-2014-03]
[http://www.openwebanalytics.com/?p=388]
[https://secuniaresearch.flexerasoftware.com/advisories/56999]
[https://secuniaresearch.flexerasoftware.com/secunia_research/2014-3/]
[66076]
XML external entity (XXE) vulnerability in java/org/jasig/cas/util/SamlUtils.java in Jasig CAS server before 3.4.12.1 and 3.5.x before 3.5.2.1, when Google Accounts Integration is enabled, allows remote unauthenticated users to bypass authentication via crafted XML data.
[[cas-dev] 20140401 CAS 3.5.2.1 and 3.4.12.1 Security Releases]
[https://vigilance.fr/vulnerability/Jasig-CAS-Server-bypassing-authentication-via-Google-Accounts-Integration-14512]
Multiple cross-site scripting (XSS) vulnerabilities in the VideoWhisper Live Streaming Integration plugin 4.29.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) n parameter to ls/htmlchat.php or (2) bgcolor parameter to ls/index.php. NOTE: vector 1 may overlap CVE-2014-1906.4.
[20140408 Re: CVE-2014-2297(WordPress-videowhisper-live-streaming-integration 4.29.6-Xss)]
Buffer overflow in the mpeg_read function in wiretap/mpeg.c in the MPEG parser in Wireshark 1.8.x before 1.8.13 and 1.10.x before 1.10.6 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a large record in MPEG data.
[openSUSE-SU-2014:0382]
[openSUSE-SU-2014:0383]
[http://packetstormsecurity.com/files/126337/Wireshark-1.8.12-1.10.5-wiretap-mpeg.c-Stack-Buffer-Overflow.html]
[RHSA-2014:0341]
[RHSA-2014:0342]
[DSA-2871]
[33069]
[66066]
[1029907]
[http://www.wireshark.org/security/wnpa-sec-2014-04.html]
[https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9843]
[https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=f567435ac7140c96a5de56dbce3d5e7659af4d09]
OrbiTeam BSCW before 5.0.8 allows remote attackers to obtain sensitive metadata via the inf operations (op=inf) to an object in pub/bscw.cgi/.
[http://www.bscw.de/english/news.html]
[20140508 [RT-SA-2014-003] Metadata Information Disclosure in OrbiTeam BSCW]
[https://www.redteam-pentesting.de/en/advisories/rt-sa-2014-003/-metadata-information-disclosure-in-orbiteam-bscw]
The installer script in webEdition CMS before 6.2.7-s1 and 6.3.x before 6.3.8-s1 allows remote attackers to conduct PHP Object Injection attacks by intercepting a request to update.webedition.org.
[http://packetstormsecurity.com/files/126861/webEdition-CMS-2.8.0.0-Remote-Command-Execution.html]
[20140528 [RT-SA-2014-004] Remote Command Execution in webEdition CMS Installer Script]
[20140528 [RT-SA-2014-004] Remote Command Execution in webEdition CMS Installer Script]
[67692]
[https://www.redteam-pentesting.de/advisories/rt-sa-2014-004]
Multiple SQL injection vulnerabilities in the file browser component (we_fs.php) in webEdition CMS before 6.2.7-s1.2 and 6.3.x through 6.3.8 before -s1 allow remote attackers to execute arbitrary SQL commands via the (1) table or (2) order parameter.
[http://packetstormsecurity.com/files/126862/webEdition-CMS-6.3.8.0-svn6985-SQL-Injection.html]
[20140528 [RT-SA-2014-005] SQL Injection in webEdition CMS File Browser Installer Script]
[20140528 [RT-SA-2014-005] SQL Injection in webEdition CMS File Browser Installer Script]
[67689]
[http://www.webedition.org/de/aktuelles/allgemein/Wichtiges-Sicherheitsupdate-fuer-CMS-webEdition-veroeffentlicht]
[https://www.redteam-pentesting.de/en/advisories/rt-sa-2014-005/-sql-injection-in-webedition-cms-file-browser]
The ip6_route_add function in net/ipv6/route.c in the Linux kernel through 3.13.6 does not properly count the addition of routes, which allows remote attackers to cause a denial of service (memory consumption) via a flood of ICMPv6 Router Advertisement packets.
[http://git.kernel.org/cgit/linux/kernel/git/davem/net.git/commit/?id=c88507fbad8055297c1d1e21e599f46960cbee39]
[SUSE-SU-2015:0481]
[openSUSE-SU-2015:0566]
[[oss-security] 20140307 Re: CVE Request: Linux kernel: IPv6: crash due to router advertisement flooding]
[66095]
[1029894]
The AgentX subagent in Net-SNMP before 5.4.4 allows remote attackers to cause a denial of service (hang) by sending a multi-object request with an Object ID (OID) containing more subids than previous requests, a different vulnerability than CVE-2012-6151.
[[oss-security] 20140306 CVE request: net-snmp agentx incorrect handling of multi-object requests DoS]
[[oss-security] 20140307 Re: CVE request: net-snmp agentx incorrect handling of multi-object requests DoS]
[http://sourceforge.net/p/net-snmp/code/ci/eb816330a1887798d844d2fd5dc6482002123cbd/]
[http://sourceforge.net/p/net-snmp/patches/1113/]
[USN-2166-1]
[https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=684388]
SQL injection vulnerability in modx.class.php in MODX Revolution 2.0.0 before 2.2.13 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
[http://forums.modx.com/thread/89486/modx-revolution-2-x-sql-injection]
[http://modx.com/blog/2014/03/07/revolution-2.2.13/]
[[oss-security] 20140308 Re: CVE request: SQL injection in MODX Revolution before 2.2.13]
The main function in android_main.cpp in thermald allows local users to write to arbitrary files via a symlink attack on /tmp/thermald.pid.
[[oss-security] 20140308 CVE Request: thermald]
[[oss-security] 20140308 Re: CVE Request: thermald]
Directory traversal vulnerability in the Importers plugin in Atlassian JIRA before 6.0.5 allows remote attackers to create arbitrary files via unspecified vectors.
Per: https://confluence.atlassian.com/display/JIRA/JIRA+Security+Advisory+2014-02-26
"Issue 2: Path traversal in JIRA Importers plugin (Windows only)"
[https://confluence.atlassian.com/display/JIRA/JIRA+Security+Advisory+2014-02-26]
Directory traversal vulnerability in the Issue Collector plugin in Atlassian JIRA before 6.0.4 allows remote attackers to create arbitrary files via unspecified vectors.
Per: https://confluence.atlassian.com/display/JIRA/JIRA+Security+Advisory+2014-02-26
"Issue 1: Path traversal in JIRA Issue Collector plugin (Windows only)"
[http://blog.h3xstream.com/2014/02/jira-path-traversal-explained.html]
[32725]
[https://confluence.atlassian.com/display/JIRA/JIRA+Security+Advisory+2014-02-26]
Multiple cross-site scripting (XSS) vulnerabilities in the Thank You Counter Button plugin 1.8.7 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) thanks_caption, (2) thanks_caption_style, or (3) thanks_style parameter to wp-admin/options.php.
[http://packetstormsecurity.com/files/125397]
[65805]
[thanks-you-wordpress-xss(91474)]
SQL injection vulnerability in se_search_default in the Search Everything plugin before 7.0.3 for WordPress allows remote attackers to execute arbitrary SQL commands via the s parameter to index.php. NOTE: some of these details are obtained from third party information.
[http://wordpress.org/plugins/search-everything/changelog/]
[65765]
SQL injection vulnerability in ajax_udf.php in OpenDocMan before 1.2.7.2 allows remote attackers to execute arbitrary SQL commands via the table parameter. NOTE: some of these details are obtained from third party information.
[http://www.opendocman.com/opendocman-v1-2-7-2-released]
[65775]
SQL injection vulnerability in ATCOM Netvolution 3 allows remote attackers to execute arbitrary SQL commands via the m parameter.
[http://packetstormsecurity.com/files/125507]
[65942]
[netvolution-m-sql-injection(91543)]
The Encrypt Files feature in ConeXware PowerArchiver before 14.02.05 uses legacy ZIP encryption even if the AES 256-bit selection is chosen, which makes it easier for context-dependent attackers to obtain sensitive information via a known-plaintext attack.
[http://int21.de/cve/CVE-2014-2319-powerarchiver.html]
[http://www.powerarchiver.com/2014/03/12/powerarchiver-2013-14-02-05-released/]
web_shell_cmd.gch on ZTE F460 and F660 cable modems allows remote attackers to obtain administrative access via sendcmd requests, as demonstrated by using "set TelnetCfg" commands to enable a TELNET service with specified credentials.
Per: http://www.kb.cert.org/vuls/id/600724
" It has been reported that the web_shell_cmd.gch script is sometimes accessible from the WAN interface making exploitation of this backdoor from the Internet possible in certain cases. "
[VU#600724]
[http://www.myxzy.com/post-411.html]
[https://community.rapid7.com/community/infosec/blog/2014/03/03/disclosure-r7-2013-18-zte-f460-and-zte-f660-webshellcmdgch-backdoor]
lib/string_utf_support.rb in the Arabic Prawn 0.0.1 gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) downloaded_file or (2) url variable.
Per: https://cwe.mitre.org/data/definitions/77.html
"CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')"
[[oss-security] 20140310 Remote Command Injection in Arabic Prawn 0.0.1 Ruby Gem]
[[oss-security] 20140312 Re: Remote Command Injection in Arabic Prawn 0.0.1 Ruby Gem]
[http://www.vapid.dhs.org/advisories/arabic-ruby-gem.html]
SQL injection vulnerability in mod_mysql_vhost.c in lighttpd before 1.4.35 allows remote attackers to execute arbitrary SQL commands via the host name, related to request_check_hostname.
[http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2014_01.txt]
[openSUSE-SU-2014:0449]
[SUSE-SU-2014:0474]
[openSUSE-SU-2014:0496]
[HPSBGN03191]
[[oss-security] 20140312 lighttpd 1.4.34 SQL injection and path traversal CVE request]
[[oss-security] 20140312 Re: lighttpd 1.4.34 SQL injection and path traversal CVE request]
[DSA-2877]
[http://www.lighttpd.net/2014/3/12/1.4.35/]
Multiple directory traversal vulnerabilities in (1) mod_evhost and (2) mod_simple_vhost in lighttpd before 1.4.35 allow remote attackers to read arbitrary files via a .. (dot dot) in the host name, related to request_check_hostname.
[http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2014_01.txt]
[openSUSE-SU-2014:0449]
[SUSE-SU-2014:0474]
[openSUSE-SU-2014:0496]
[HPSBGN03191]
[[oss-security] 20140312 lighttpd 1.4.34 SQL injection and path traversal CVE request]
[[oss-security] 20140312 Re: lighttpd 1.4.34 SQL injection and path traversal CVE request]
[DSA-2877]
[http://www.lighttpd.net/2014/3/12/1.4.35/]
[66157]
Multiple cross-site scripting (XSS) vulnerabilities in Proxmox Mail Gateway before 3.1-5829 allow remote attackers to inject arbitrary web script or HTML via the (1) state parameter to objects/who/index.htm or (2) User email address to quarantine/spam/manage.htm.
[http://proxmox.com/news/archive/view/listid-1-proxmox-newsletter/mailid-48-proxmox-newsletter-march-2014-proxmox-ve-3-2-released/tmpl-component]
[20140312 Multiplus XSS in Proxmox Mail Gateway 3.1 (CVE-2014-2325)]
[66169]
Cross-site scripting (XSS) vulnerability in cdef.php in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
[http://bugs.cacti.net/view.php?id=2431]
[FEDORA-2014-4928]
[FEDORA-2014-4892]
[openSUSE-SU-2015:0479]
[http://packetstormsecurity.com/files/125849/Deutsche-Telekom-CERT-Advisory-DTC-A-20140324-001.html]
[http://svn.cacti.net/viewvc?view=rev&revision=7443]
[DSA-2970]
[20140324 Deutsche Telekom CERT Advisory [DTC-A-20140324-001] vulnerabilities in cacti]
[66390]
[https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=742768]
[GLSA-201509-03]
Cross-site request forgery (CSRF) vulnerability in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to hijack the authentication of users for unspecified commands, as demonstrated by requests that (1) modify binary files, (2) modify configurations, or (3) add arbitrary users.
[JVN#55076671]
[JVNDB-2014-002239]
[openSUSE-SU-2015:0479]
[DSA-2970]
[20140324 Deutsche Telekom CERT Advisory [DTC-A-20140324-001] vulnerabilities in cacti]
[66392]
[https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=742768]
[GLSA-201509-03]
lib/graph_export.php in Cacti 0.8.7g, 0.8.8b, and earlier allows remote authenticated users to execute arbitrary commands via shell metacharacters in unspecified vectors.
Per: https://cwe.mitre.org/data/definitions/77.html
"CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')"
[http://bugs.cacti.net/view.php?id=2433]
[FEDORA-2014-4928]
[FEDORA-2014-4892]
[openSUSE-SU-2015:0479]
[http://svn.cacti.net/viewvc?view=rev&revision=7442]
[DSA-2970]
[20140324 Deutsche Telekom CERT Advisory [DTC-A-20140324-001] vulnerabilities in cacti]
[66387]
[https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=742768]
[GLSA-201509-03]
Multiple cross-site scripting (XSS) vulnerabilities in Check_MK before 1.2.2p3 and 1.2.3x before 1.2.3i5 allow remote authenticated users to inject arbitrary web script or HTML via the (1) agent string for a check_mk agent, a (2) crafted request to a monitored host, which is not properly handled by the logwatch module, or other unspecified vectors.
[20140324 Deutsche Telekom CERT Advisory [DTC-A-20140324-002] vulnerabilities in check_mk]
[20140328 Deutsche Telekom CERT Advisory [DTC-A-20140324-002] update140328]
Multiple cross-site request forgery (CSRF) vulnerabilities in the Multisite GUI in Check_MK before 1.2.5i2 allow remote attackers to hijack the authentication of users for requests that (1) upload arbitrary snapshots, (2) delete arbitrary files, or possibly have other unspecified impact via unknown vectors.
[http://mathias-kettner.de/check_mk_werks.php?werk_id=0766]
[20140324 Deutsche Telekom CERT Advisory [DTC-A-20140324-002] vulnerabilities in check_mk]
[66389]
Check_MK 1.2.2p2, 1.2.2p3, and 1.2.3i5 allows remote authenticated users to execute arbitrary Python code via a crafted rules.mk file in a snapshot. NOTE: this can be exploited by remote attackers by leveraging CVE-2014-2330.
[20140324 Deutsche Telekom CERT Advisory [DTC-A-20140324-002] vulnerabilities in check_mk]
[20140328 Deutsche Telekom CERT Advisory [DTC-A-20140324-002] update140328]
Check_MK before 1.2.2p3 and 1.2.3x before 1.2.3i5 allows remote authenticated users to delete arbitrary files via a request to an unspecified link, related to "Insecure Direct Object References." NOTE: this can be exploited by remote attackers by leveraging CVE-2014-2330.
[20140324 Deutsche Telekom CERT Advisory [DTC-A-20140324-002] vulnerabilities in check_mk]
[20140328 Deutsche Telekom CERT Advisory [DTC-A-20140324-002] update140328]
Cross-site scripting (XSS) vulnerability in the Lazyest Gallery plugin before 1.1.21 for WordPress allows remote attackers to inject arbitrary web script or HTML via an EXIF tag. NOTE: some of these details are obtained from third party information.
[http://wordpress.org/plugins/lazyest-gallery/changelog]
[66756]
[lazyest-wordpress-xss(92598)]
Multiple cross-site scripting (XSS) vulnerabilities in the Web User Interface in Fortinet FortiAnalyzer before 5.0.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2014-2336.
[http://www.fortiguard.com/advisory/FG-IR-14-033/]
[70887]
[fortimanageranalyzer-cve20142334-xss(98477)]
Multiple cross-site scripting (XSS) vulnerabilities in the Web User Interface in Fortinet FortiManager before 5.0.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2014-2336.
[http://www.fortiguard.com/advisory/FG-IR-14-033/]
[fortimanageranalyzer-cve20142335-xss(98478)]
Multiple cross-site scripting (XSS) vulnerabilities in the Web User Interface in Fortinet FortiManager before 5.0.7 and FortiAnalyzer before 5.0.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2014-2334 and CVE-2014-2335.
[http://www.fortiguard.com/advisory/FG-IR-14-033/]
[70889]
[fortimanageranalyzer-cve20142336-xss(98479)]
IKEv2 in strongSwan 4.0.7 before 5.1.3 allows remote attackers to bypass authentication by rekeying an IKE_SA during (1) initiation or (2) re-authentication, which triggers the IKE_SA state to be set to established.
[SUSE-SU-2014:0529]
[openSUSE-SU-2014:0697]
[openSUSE-SU-2014:0700]
[DSA-2903]
[66815]
[http://www.strongswan.org/blog/2014/04/14/strongswan-authentication-bypass-vulnerability-%28cve-2014-2338%29.html]
Multiple SQL injection vulnerabilities in bbs/ajax.autosave.php in GNUboard 5.x and possibly earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) subject or (2) content parameter.
[20140317 [CVE-2014-2339] GNUboard SQL Injection Vulnerability]
[66228]
[gnuboard-cve20142339-sql-injection(91814)]
Cross-site request forgery (CSRF) vulnerability in the XCloner plugin before 3.1.1 for WordPress allows remote attackers to hijack the authentication of administrators for requests that create website backups via a request to wp-admin/plugins.php.
[http://wordpress.org/plugins/xcloner-backup-and-restore/changelog/]
[32701]
[20140402 Сross-Site Request Forgery (CSRF) in XCloner Wordpress Plugin]
[66280]
[https://www.htbridge.com/advisory/HTB23206]
Session fixation vulnerability in CubeCart before 5.2.9 allows remote attackers to hijack web sessions via the PHPSESSID parameter.
[http://forums.cubecart.com/topic/48427-cubecart-529-relased/]
[32830]
[66805]
[1030086]
[cubecart-cve20142341-session-hijacking(92526)]
Triangle MicroWorks SCADA Data Gateway before 3.00.0635 allows remote attackers to cause a denial of service (excessive data processing) via a crafted DNP3 packet.
[http://ics-cert.us-cert.gov/advisories/ICSA-14-149-01]
[http://www.trianglemicroworks.com/products/scada-data-gateway/what%27s-new]
Triangle MicroWorks SCADA Data Gateway before 3.00.0635 allows physically proximate attackers to cause a denial of service (excessive data processing) via a crafted DNP request over a serial line.
[http://ics-cert.us-cert.gov/advisories/ICSA-14-149-01]
[http://www.trianglemicroworks.com/products/scada-data-gateway/what%27s-new]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2014. Notes: none.
COPA-DATA zenon DNP3 NG driver (DNP3 master) 7.10 and 7.11 through 7.11 SP0 build 10238 and zenon DNP3 Process Gateway (DNP3 outstation) 7.11 SP0 build 10238 and earlier allow remote attackers to cause a denial of service (infinite loop and process crash) by sending a crafted DNP3 packet over TCP.
Per: http://ics-cert.us-cert.gov/advisories/ICSA-14-154-01
"AFFECTED PRODUCTS
The following COPA-DATA products are affected:
zenon DNP3 NG driver (DNP3 master), Versions 7.10 SP0 up to and including 7.11 SP0 build 10238
zenon DNP3 Process Gateway (DNP3 outstation), Versions 7.11 SP0 build 10238 and prior."
[http://ics-cert.us-cert.gov/advisories/ICSA-14-154-01]
[http://www.copadata.com/no_cache/en/support/knowledge-base-faq.html?tx_hrfaq_pi1%5Bknowledgebase%5D=813&tx_hrfaq_pi1%5Baction%5D=show&tx_hrfaq_pi1%5Bcontroller%5D=knowledgebase]
[http://www.copadata.com/no_cache/en/support/knowledge-base-faq.html?tx_hrfaq_pi1%5Bknowledgebase%5D=814&tx_hrfaq_pi1%5Baction%5D=show&tx_hrfaq_pi1%5Bcontroller%5D=knowledgebase]
COPA-DATA zenon DNP3 NG driver (DNP3 master) 7.10 and 7.11 through 7.11 SP0 build 10238 and zenon DNP3 Process Gateway (DNP3 outstation) 7.11 SP0 build 10238 and earlier allow physically proximate attackers to cause a denial of service (infinite loop and process crash) via crafted input over a serial line.
[http://ics-cert.us-cert.gov/advisories/ICSA-14-154-01]
[http://www.copadata.com/no_cache/en/support/knowledge-base-faq.html?tx_hrfaq_pi1%5Bknowledgebase%5D=813&tx_hrfaq_pi1%5Baction%5D=show&tx_hrfaq_pi1%5Bcontroller%5D=knowledgebase]
[http://www.copadata.com/no_cache/en/support/knowledge-base-faq.html?tx_hrfaq_pi1%5Bknowledgebase%5D=814&tx_hrfaq_pi1%5Baction%5D=show&tx_hrfaq_pi1%5Bcontroller%5D=knowledgebase]
Amtelco miSecureMessages (aka MSM) 6.2 does not properly manage sessions, which allows remote authenticated users to obtain sensitive information via a modified message request.
[http://ics-cert.us-cert.gov/advisories/ICSA-14-121-01]
[https://service.amtelco.com/INFINITY/MSM/MSM6.2SecurityBriefing.pdf]
Emerson DeltaV 10.3.1, 11.3, 11.3.1, and 12.3 allows local users to modify or read configuration files by leveraging engineering-level privileges.
[http://ics-cert.us-cert.gov/advisories/ICSA-14-133-02]
Emerson DeltaV 10.3.1, 11.3, 11.3.1, and 12.3 uses hardcoded credentials for diagnostic services, which allows remote attackers to bypass intended access restrictions via a TCP session, as demonstrated by a session that uses the telnet program.
[http://ics-cert.us-cert.gov/advisories/ICSA-14-133-02]
SQL injection vulnerability in the LiveData service in CSWorks before 2.5.5233.0 allows remote attackers to execute arbitrary SQL commands via vectors related to pathnames contained in web API requests.
[http://ics-cert.us-cert.gov/advisories/ICSA-14-135-01]
[http://www.controlsystemworks.com/blogengine/post/2014/05/08/Important-CSWorks-security-release-2552330]
[67427]
Directory traversal vulnerability in Cogent DataHub before 7.3.5 allows remote attackers to read arbitrary files of unspecified types, or cause a web-server denial of service, via a crafted pathname.
[http://ics-cert.us-cert.gov/advisories/ICSA-14-149-02]