Permissions, Privileges & Access Controls — CVEs by weakness type

Unified Communications Manager MEDIUM 6.0

CVE-2014-0686

Cisco Unified Communications Manager (aka Unified CM) 9.1 (2.10000.28) and earlier allows local users to gain privileges by leveraging incorrect file…

Fix: after 9.1

Fix from $1,600 2014-02-04

Cantata MEDIUM 5.0

CVE-2013-7301

Cantata before 1.2.2 does not restrict access to files in the play queue, which allows remote attackers to obtain sensitive information by reading th…

Fix: after 1.2.1

Fix from $1,600 2014-02-02

Financial Transaction Manager MEDIUM 5.5

CVE-2014-0833

The OAC component in IBM Financial Transaction Manager (FTM) 2.0 before 2.0.0.3 does not properly enforce operator-intervention requirements, which a…

Mitigation only

Fix from $1,600 2014-02-01

Sametime MEDIUM 5.0

CVE-2013-6727

The Connect client in IBM Sametime 8.5.2 through 8.5.2.1 and 9.0 before HF1 does not properly restrict unsigned Java plugins, which allows remote att…

Mitigation only

Fix from $1,600 2014-01-31

Access Risk Management Suite MEDIUM 6.5

CVE-2013-2747

The password reset feature in Courion Access Risk Management Suite Version 8 Update 9 allows remote authenticated users to bypass intended Internet E…

Mitigation only

Fix from $1,600 2014-01-29

Tivoli Application Dependency Discovery Manager HIGH 7.5

CVE-2013-2974

The BIRT viewer in IBM Tivoli Application Dependency Discovery Manager (TADDM) 7.2.1.x before 7.2.1.5 allows remote authenticated users to bypass aut…

Mitigation only

Fix from $1,950 2014-01-29

Proc\ HIGH 7.2

CVE-2013-7135

The Proc::Daemon module 0.14 for Perl uses world-writable permissions for a file that stores a process ID, which allows local users to have an unspec…

Mitigation only

Fix from $1,950 2014-01-28

Xen HIGH 8.3

CVE-2014-1666

The do_physdev_op function in Xen 4.1.5, 4.1.6.1, 4.2.2 through 4.2.3, and 4.3.x does not properly restrict access to the (1) PHYSDEVOP_prepare_msix …

Patch available

Fix from $1,950 2014-01-26

Marc Xml MEDIUM 5.0

CVE-2014-1626

XML External Entity (XXE) vulnerability in MARC::File::XML module before 1.0.2 for Perl, as used in Evergreen, Koha, perl4lib, and possibly other pro…

Fix: after 1.0.1

Fix from $1,600 2014-01-26

Ts 550 Evo Firmware MEDIUM 5.0

CVE-2013-7247

cgi-bin/tsaws.cgi in Franklin Fueling Systems TS-550 evo with firmware 2.0.0.6833 and other versions before 2.4.0 allows remote attackers to discover…

No fix yet

Fix from $1,600 2014-01-26

Secure Access Control System MEDIUM 5.5

CVE-2014-0678

The portal interface in Cisco Secure Access Control System (ACS) does not properly manage sessions, which allows remote authenticated users to hijack…

Mitigation only

Fix from $1,600 2014-01-25

Libvirt MEDIUM 5.2

CVE-2013-6457

The libxlDomainGetNumaParameters function in the libxl driver (libxl/libxl_driver.c) in libvirt before 1.2.1 does not properly initialize the nodemap…

Fix: after 1.2.0

Fix from $1,600 2014-01-24

Spring Framework MEDIUM 6.8

CVE-2013-7315EPSS 5%

The Spring MVC in Spring Framework before 3.2.4 and 4.0.0.M1 through 4.0.0.M2 does not disable external entity resolution for the StAX XMLInputFactor…

Fix: after 3.2.3

Fix from $1,600 2014-01-23

Spring Framework MEDIUM 6.8

CVE-2013-4152EPSS 26%

The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable entity resolution, which allow…

Fix: after 3.2.3

Fix from $1,600 2014-01-23

Jboss Seam 2 Framework MEDIUM 5.0

CVE-2013-6448

The InterfaceGenerator handler in JBoss Seam Remoting in JBoss Seam 2 framework 2.3.1 and earlier, as used in JBoss Web Framework Kit, allows remote …

Fix: after 2.3.1

Fix from $1,600 2014-01-23

Nx Os MEDIUM 6.8

CVE-2014-0676

Cisco NX-OS allows local users to bypass intended TACACS+ command restrictions via a series of multiple commands, aka Bug ID CSCum47367.

Mitigation only

Fix from $1,600 2014-01-22

Asr 5000 Series Software MEDIUM 5.0

CVE-2014-0669

The Wireless Session Protocol (WSP) feature in the Gateway GPRS Support Node (GGSN) component on Cisco ASR 5000 series devices allows remote attacker…

Mitigation only

Fix from $1,600 2014-01-22

Ubuntu Linux MEDIUM 6.8

CVE-2013-0339

libxml2 through 2.9.1 does not properly handle external entities expansion unless an application developer uses the xmlSAX2ResolveEntity or xmlSetExt…

Fix: after 2.9.1