<?xml version='1.0' encoding='UTF-8'?>
<nvd xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://nvd.nist.gov/feeds/cve/1.2" nvd_xml_version="1.2" pub_date="2014-05-03" xsi:schemaLocation="http://nvd.nist.gov/feeds/cve/1.2 http://nvd.nist.gov/schema/nvdcve.xsd">
  <entry type="CVE" severity="High" seq="2014-0001" published="2014-01-31" name="CVE-2014-0001" modified="2014-03-05" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">Buffer overflow in client/mysql.cc in Oracle MySQL and MariaDB before 5.5.35 allows remote database servers to cause a denial of service (crash) and possibly execute arbitrary code via a long server version string.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://bazaar.launchpad.net/~maria-captains/maria/5.5/revision/2502.565.64" source="CONFIRM" patch="1">http://bazaar.launchpad.net/~maria-captains/maria/5.5/revision/2502.565.64</ref>
      <ref url="https://mariadb.com/kb/en/mariadb-5535-changelog/" source="CONFIRM">https://mariadb.com/kb/en/mariadb-5535-changelog/</ref>
      <ref url="https://bugzilla.redhat.com/show_bug.cgi?id=1054592" source="CONFIRM">https://bugzilla.redhat.com/show_bug.cgi?id=1054592</ref>
      <ref url="http://www.osvdb.org/102714" source="OSVDB">102714</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0189.html" source="REDHAT">RHSA-2014:0189</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0186.html" source="REDHAT">RHSA-2014:0186</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0173.html" source="REDHAT">RHSA-2014:0173</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0164.html" source="REDHAT">RHSA-2014:0164</ref>
      <ref url="http://osvdb.org/102713" source="OSVDB">102713</ref>
    </refs>
    <vuln_soft>
      <prod vendor="mariadb" name="mariadb">
        <vers prev="1" num="5.5.34"/>
      </prod>
      <prod vendor="oracle" name="mysql">
        <vers num="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0002" published="2014-03-21" name="CVE-2014-0002" modified="2014-04-19" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">The XSLT component in Apache Camel before 2.11.4 and 2.12.x before 2.12.3 allows remote attackers to read arbitrary files and possibly have other unspecified impact via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.securityfocus.com/bid/65901" source="BID">65901</ref>
      <ref url="http://secunia.com/advisories/57719" source="SECUNIA">57719</ref>
      <ref url="http://secunia.com/advisories/57716" source="SECUNIA">57716</ref>
      <ref url="http://secunia.com/advisories/57125" source="SECUNIA" adv="1">57125</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0372.html" source="REDHAT">RHSA-2014:0372</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0371.html" source="REDHAT">RHSA-2014:0371</ref>
      <ref url="http://camel.apache.org/security-advisories.data/CVE-2014-0002.txt.asc" source="CONFIRM" adv="1">http://camel.apache.org/security-advisories.data/CVE-2014-0002.txt.asc</ref>
    </refs>
    <vuln_soft>
      <prod vendor="apache" name="camel">
        <vers num="1.0.0"/>
        <vers num="1.1.0"/>
        <vers num="1.2.0"/>
        <vers num="1.3.0"/>
        <vers num="1.4.0"/>
        <vers num="1.5.0"/>
        <vers num="1.6.0"/>
        <vers num="1.6.1"/>
        <vers num="1.6.2"/>
        <vers num="1.6.3"/>
        <vers num="1.6.4"/>
        <vers num="2.0.0" edition="m1"/>
        <vers num="2.0.0" edition="m2"/>
        <vers num="2.0.0" edition="m3"/>
        <vers num="2.1.0"/>
        <vers num="2.10.0"/>
        <vers num="2.10.1"/>
        <vers num="2.10.2"/>
        <vers num="2.10.3"/>
        <vers num="2.10.4"/>
        <vers num="2.10.5"/>
        <vers num="2.10.6"/>
        <vers num="2.10.7"/>
        <vers num="2.11.0"/>
        <vers num="2.11.1"/>
        <vers num="2.11.2"/>
        <vers prev="1" num="2.11.3"/>
        <vers num="2.12.0"/>
        <vers num="2.12.1"/>
        <vers num="2.12.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0003" published="2014-03-21" name="CVE-2014-0003" modified="2014-04-19" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">The XSLT component in Apache Camel 2.11.x before 2.11.4, 2.12.x before 2.12.3, and possibly earlier versions allows remote attackers to execute arbitrary Java methods via a crafted message.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.securityfocus.com/bid/65902" source="BID">65902</ref>
      <ref url="http://secunia.com/advisories/57719" source="SECUNIA">57719</ref>
      <ref url="http://secunia.com/advisories/57716" source="SECUNIA">57716</ref>
      <ref url="http://secunia.com/advisories/57125" source="SECUNIA" adv="1">57125</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0372.html" source="REDHAT">RHSA-2014:0372</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0371.html" source="REDHAT">RHSA-2014:0371</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0254.html" source="REDHAT">RHSA-2014:0254</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0245.html" source="REDHAT">RHSA-2014:0245</ref>
      <ref url="http://camel.apache.org/security-advisories.data/CVE-2014-0003.txt.asc" source="CONFIRM" adv="1">http://camel.apache.org/security-advisories.data/CVE-2014-0003.txt.asc</ref>
    </refs>
    <vuln_soft>
      <prod vendor="apache" name="camel">
        <vers num="1.0.0"/>
        <vers num="1.1.0"/>
        <vers num="1.2.0"/>
        <vers num="1.3.0"/>
        <vers num="1.4.0"/>
        <vers num="1.5.0"/>
        <vers num="1.6.0"/>
        <vers num="1.6.1"/>
        <vers num="1.6.2"/>
        <vers num="1.6.3"/>
        <vers num="1.6.4"/>
        <vers num="2.0.0" edition="m1"/>
        <vers num="2.0.0" edition="m2"/>
        <vers num="2.0.0" edition="m3"/>
        <vers num="2.1.0"/>
        <vers num="2.10.0"/>
        <vers num="2.10.1"/>
        <vers num="2.10.2"/>
        <vers num="2.10.3"/>
        <vers num="2.10.4"/>
        <vers num="2.10.5"/>
        <vers num="2.10.6"/>
        <vers num="2.10.7"/>
        <vers num="2.11.0"/>
        <vers num="2.11.1"/>
        <vers num="2.11.2"/>
        <vers prev="1" num="2.11.3"/>
        <vers num="2.12.0"/>
        <vers num="2.12.1"/>
        <vers num="2.12.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0004" published="2014-03-11" name="CVE-2014-0004" modified="2014-03-26" CVSS_version="2.0" CVSS_vector="(AV:L/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="6.9" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="3.4" CVSS_base_score="6.9">
    <desc>
      <descript source="cve">Stack-based buffer overflow in udisks before 1.0.5 and 2.x before 2.1.3 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a long mount point.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="http://lists.freedesktop.org/archives/devkit-devel/2014-March/001568.html" source="MLIST" patch="1">[devkit-devel] 20140310 udisks 2.1.3 / 1.0.5 security updates</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2142-1" source="UBUNTU">USN-2142-1</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2872" source="DEBIAN">DSA-2872</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0293.html" source="REDHAT">RHSA-2014:0293</ref>
      <ref url="http://lists.opensuse.org/opensuse-updates/2014-03/msg00053.html" source="SUSE">openSUSE-SU-2014:0390</ref>
      <ref url="http://lists.opensuse.org/opensuse-updates/2014-03/msg00052.html" source="SUSE">openSUSE-SU-2014:0389</ref>
      <ref url="http://lists.opensuse.org/opensuse-updates/2014-03/msg00051.html" source="SUSE">openSUSE-SU-2014:0388</ref>
    </refs>
    <vuln_soft>
      <prod vendor="freedesktop" name="udisks">
        <vers num="1.0"/>
        <vers num="1.0.1"/>
        <vers prev="1" num="1.0.4"/>
        <vers num="2.0.0"/>
        <vers num="2.0.1"/>
        <vers num="2.0.90"/>
        <vers num="2.0.91"/>
        <vers num="2.0.92"/>
        <vers num="2.1.0"/>
        <vers num="2.1.1"/>
        <vers num="2.1.2"/>
      </prod>
      <prod vendor="canonical" name="ubuntu_linux">
        <vers num="12.04" edition="-:lts"/>
        <vers num="12.10"/>
        <vers num="13.10"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0006" published="2014-01-22" name="CVE-2014-0006" modified="2014-03-08" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:N/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">The TempURL middleware in OpenStack Object Storage (Swift) 1.4.6 through 1.8.0, 1.9.0 through 1.10.0, and 1.11.0 allows remote attackers to obtain secret URLs by leveraging an object name and a timing side-channel attack.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.openwall.com/lists/oss-security/2014/01/17/5" source="MLIST" patch="1">[oss-security] 20140117 [OSSA 2014-002] Swift TempURL timing attack (CVE-2014-0006)</ref>
      <ref url="https://bugs.launchpad.net/swift/+bug/1265665" source="CONFIRM" adv="1">https://bugs.launchpad.net/swift/+bug/1265665</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0232.html" source="REDHAT">RHSA-2014:0232</ref>
    </refs>
    <vuln_soft>
      <prod vendor="openstack" name="swift">
        <vers num="1.10.0"/>
        <vers num="1.11.0"/>
        <vers num="1.4.6"/>
        <vers num="1.4.7"/>
        <vers num="1.4.8"/>
        <vers num="1.5.0"/>
        <vers num="1.6.0"/>
        <vers num="1.7.0"/>
        <vers num="1.7.2"/>
        <vers num="1.7.4"/>
        <vers num="1.7.5"/>
        <vers num="1.7.6"/>
        <vers num="1.8.0"/>
        <vers num="1.9.0"/>
        <vers num="1.9.1"/>
        <vers num="1.9.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0008" published="2014-01-20" name="CVE-2014-0008" modified="2014-02-21" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:P/I:N/A:N)" CVSS_score="4.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.0" CVSS_base_score="4.0">
    <desc>
      <descript source="cve">lib/adminlib.php in Moodle through 2.3.11, 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 logs cleartext passwords, which allows remote authenticated administrators to obtain sensitive information by reading the Config Changes Report.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://moodle.org/mod/forum/discuss.php?d=252414" source="CONFIRM" patch="1" adv="1">https://moodle.org/mod/forum/discuss.php?d=252414</ref>
      <ref url="http://git.moodle.org/gw?p=moodle.git&amp;a=search&amp;h=HEAD&amp;st=commit&amp;s=MDL-36721" source="CONFIRM" patch="1">http://git.moodle.org/gw?p=moodle.git&amp;a=search&amp;h=HEAD&amp;st=commit&amp;s=MDL-36721</ref>
      <ref url="http://www.securitytracker.com/id/1029647" source="SECTRACK">1029647</ref>
      <ref url="http://openwall.com/lists/oss-security/2014/01/20/1" source="MLIST">[oss-security] 20140120 Moodle security notifications public</ref>
      <ref url="http://lists.fedoraproject.org/pipermail/package-announce/2014-January/127533.html" source="FEDORA">FEDORA-2014-1396</ref>
      <ref url="http://lists.fedoraproject.org/pipermail/package-announce/2014-January/127510.html" source="FEDORA">FEDORA-2014-1377</ref>
    </refs>
    <vuln_soft>
      <prod vendor="moodle" name="moodle">
        <vers num="2.3"/>
        <vers num="2.3.1"/>
        <vers num="2.3.10"/>
        <vers prev="1" num="2.3.11"/>
        <vers num="2.3.2"/>
        <vers num="2.3.3"/>
        <vers num="2.3.4"/>
        <vers num="2.3.5"/>
        <vers num="2.3.6"/>
        <vers num="2.3.7"/>
        <vers num="2.3.8"/>
        <vers num="2.3.9"/>
        <vers num="2.4"/>
        <vers num="2.4.1"/>
        <vers num="2.4.2"/>
        <vers num="2.4.3"/>
        <vers num="2.4.4"/>
        <vers num="2.4.5"/>
        <vers num="2.4.6"/>
        <vers num="2.4.7"/>
        <vers num="2.5"/>
        <vers num="2.5.1"/>
        <vers num="2.5.2"/>
        <vers num="2.5.3"/>
        <vers num="2.6"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0009" published="2014-01-20" name="CVE-2014-0009" modified="2014-02-21" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:P/I:P/A:N)" CVSS_score="5.5" CVSS_impact_subscore="4.9" CVSS_exploit_subscore="8.0" CVSS_base_score="5.5">
    <desc>
      <descript source="cve">course/loginas.php in Moodle through 2.2.11, 2.3.x before 2.3.11, 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 does not enforce the moodle/site:accessallgroups capability requirement for outside-group users in a SEPARATEGROUPS configuration, which allows remote authenticated users to perform "login as" actions via a direct request.</descript>
    </desc>
    <loss_types>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://moodle.org/mod/forum/discuss.php?d=252415" source="CONFIRM" patch="1" adv="1">https://moodle.org/mod/forum/discuss.php?d=252415</ref>
      <ref url="http://git.moodle.org/gw?p=moodle.git&amp;a=search&amp;h=HEAD&amp;st=commit&amp;s=MDL-42643" source="CONFIRM" patch="1">http://git.moodle.org/gw?p=moodle.git&amp;a=search&amp;h=HEAD&amp;st=commit&amp;s=MDL-42643</ref>
      <ref url="http://www.securitytracker.com/id/1029648" source="SECTRACK">1029648</ref>
      <ref url="http://openwall.com/lists/oss-security/2014/01/20/1" source="MLIST">[oss-security] 20140120 Moodle security notifications public</ref>
      <ref url="http://lists.fedoraproject.org/pipermail/package-announce/2014-January/127533.html" source="FEDORA">FEDORA-2014-1396</ref>
      <ref url="http://lists.fedoraproject.org/pipermail/package-announce/2014-January/127510.html" source="FEDORA">FEDORA-2014-1377</ref>
    </refs>
    <vuln_soft>
      <prod vendor="moodle" name="moodle">
        <vers num="2.0"/>
        <vers num="2.0.1"/>
        <vers num="2.0.2"/>
        <vers num="2.0.3"/>
        <vers num="2.0.4"/>
        <vers num="2.0.5"/>
        <vers num="2.0.6"/>
        <vers num="2.0.7"/>
        <vers num="2.0.8"/>
        <vers num="2.0.9"/>
        <vers num="2.1"/>
        <vers num="2.1.1"/>
        <vers num="2.1.10"/>
        <vers num="2.1.2"/>
        <vers num="2.1.3"/>
        <vers num="2.1.4"/>
        <vers num="2.1.5"/>
        <vers num="2.1.6"/>
        <vers num="2.1.7"/>
        <vers num="2.1.8"/>
        <vers num="2.1.9"/>
        <vers num="2.2"/>
        <vers num="2.2.1"/>
        <vers num="2.2.10"/>
        <vers prev="1" num="2.2.11"/>
        <vers num="2.2.2"/>
        <vers num="2.2.3"/>
        <vers num="2.2.4"/>
        <vers num="2.2.5"/>
        <vers num="2.2.6"/>
        <vers num="2.2.7"/>
        <vers num="2.2.8"/>
        <vers num="2.2.9"/>
        <vers num="2.3"/>
        <vers num="2.3.1"/>
        <vers num="2.3.10"/>
        <vers num="2.3.2"/>
        <vers num="2.3.3"/>
        <vers num="2.3.4"/>
        <vers num="2.3.5"/>
        <vers num="2.3.6"/>
        <vers num="2.3.7"/>
        <vers num="2.3.8"/>
        <vers num="2.3.9"/>
        <vers num="2.4"/>
        <vers num="2.4.1"/>
        <vers num="2.4.2"/>
        <vers num="2.4.3"/>
        <vers num="2.4.4"/>
        <vers num="2.4.5"/>
        <vers num="2.4.6"/>
        <vers num="2.4.7"/>
        <vers num="2.5"/>
        <vers num="2.5.1"/>
        <vers num="2.5.2"/>
        <vers num="2.5.3"/>
        <vers num="2.6"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0010" published="2014-01-20" name="CVE-2014-0010" modified="2014-02-21" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:P)" CVSS_score="6.8" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.6" CVSS_base_score="6.8">
    <desc>
      <descript source="cve">Multiple cross-site request forgery (CSRF) vulnerabilities in user/profile/index.php in Moodle through 2.2.11, 2.3.x before 2.3.11, 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 allow remote attackers to hijack the authentication of administrators for requests that delete (1) categories or (2) fields.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="https://moodle.org/mod/forum/discuss.php?d=252416" source="CONFIRM" patch="1" adv="1">https://moodle.org/mod/forum/discuss.php?d=252416</ref>
      <ref url="http://git.moodle.org/gw?p=moodle.git&amp;a=search&amp;h=HEAD&amp;st=commit&amp;s=MDL-42883" source="CONFIRM" patch="1">http://git.moodle.org/gw?p=moodle.git&amp;a=search&amp;h=HEAD&amp;st=commit&amp;s=MDL-42883</ref>
      <ref url="http://www.securitytracker.com/id/1029649" source="SECTRACK">1029649</ref>
      <ref url="http://openwall.com/lists/oss-security/2014/01/20/1" source="MLIST">[oss-security] 20140120 Moodle security notifications public</ref>
      <ref url="http://lists.fedoraproject.org/pipermail/package-announce/2014-January/127533.html" source="FEDORA">FEDORA-2014-1396</ref>
      <ref url="http://lists.fedoraproject.org/pipermail/package-announce/2014-January/127510.html" source="FEDORA">FEDORA-2014-1377</ref>
    </refs>
    <vuln_soft>
      <prod vendor="moodle" name="moodle">
        <vers num="2.0"/>
        <vers num="2.0.1"/>
        <vers num="2.0.2"/>
        <vers num="2.0.3"/>
        <vers num="2.0.4"/>
        <vers num="2.0.5"/>
        <vers num="2.0.6"/>
        <vers num="2.0.7"/>
        <vers num="2.0.8"/>
        <vers num="2.0.9"/>
        <vers num="2.1"/>
        <vers num="2.1.1"/>
        <vers num="2.1.10"/>
        <vers num="2.1.2"/>
        <vers num="2.1.3"/>
        <vers num="2.1.4"/>
        <vers num="2.1.5"/>
        <vers num="2.1.6"/>
        <vers num="2.1.7"/>
        <vers num="2.1.8"/>
        <vers num="2.1.9"/>
        <vers num="2.2"/>
        <vers num="2.2.1"/>
        <vers num="2.2.10"/>
        <vers prev="1" num="2.2.11"/>
        <vers num="2.2.2"/>
        <vers num="2.2.3"/>
        <vers num="2.2.4"/>
        <vers num="2.2.5"/>
        <vers num="2.2.6"/>
        <vers num="2.2.7"/>
        <vers num="2.2.8"/>
        <vers num="2.2.9"/>
        <vers num="2.3"/>
        <vers num="2.3.1"/>
        <vers num="2.3.10"/>
        <vers num="2.3.2"/>
        <vers num="2.3.3"/>
        <vers num="2.3.4"/>
        <vers num="2.3.5"/>
        <vers num="2.3.6"/>
        <vers num="2.3.7"/>
        <vers num="2.3.8"/>
        <vers num="2.3.9"/>
        <vers num="2.4"/>
        <vers num="2.4.1"/>
        <vers num="2.4.2"/>
        <vers num="2.4.3"/>
        <vers num="2.4.4"/>
        <vers num="2.4.5"/>
        <vers num="2.4.6"/>
        <vers num="2.4.7"/>
        <vers num="2.5"/>
        <vers num="2.5.1"/>
        <vers num="2.5.2"/>
        <vers num="2.5.3"/>
        <vers num="2.6"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0015" published="2014-02-01" name="CVE-2014-0015" modified="2014-03-05" CVSS_version="2.0" CVSS_vector="(AV:N/AC:H/Au:N/C:P/I:P/A:N)" CVSS_score="4.0" CVSS_impact_subscore="4.9" CVSS_exploit_subscore="4.9" CVSS_base_score="4.0">
    <desc>
      <descript source="cve">cURL and libcurl 7.10.6 through 7.34.0, when more than one authentication method is enabled, re-uses NTLM connections, which might allow context-dependent attackers to authenticate as other users via a request.</descript>
    </desc>
    <loss_types>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://curl.haxx.se/docs/adv_20140129.html" source="CONFIRM" patch="1" adv="1">http://curl.haxx.se/docs/adv_20140129.html</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2097-1" source="UBUNTU">USN-2097-1</ref>
      <ref url="http://www.slackware.com/security/viewer.php?l=slackware-security&amp;y=2014&amp;m=slackware-security.502652" source="SLACKWARE">SSA:2014-044-01</ref>
      <ref url="http://www.securitytracker.com/id/1029710" source="SECTRACK">1029710</ref>
      <ref url="http://www.securityfocus.com/bid/65270" source="BID">65270</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2849" source="DEBIAN">DSA-2849</ref>
      <ref url="http://secunia.com/advisories/56734" source="SECUNIA" adv="1">56734</ref>
      <ref url="http://secunia.com/advisories/56731" source="SECUNIA">56731</ref>
      <ref url="http://secunia.com/advisories/56728" source="SECUNIA" adv="1">56728</ref>
      <ref url="http://lists.opensuse.org/opensuse-updates/2014-02/msg00066.html" source="SUSE">openSUSE-SU-2014:0274</ref>
      <ref url="http://lists.fedoraproject.org/pipermail/package-announce/2014-February/128408.html" source="FEDORA">FEDORA-2014-1864</ref>
      <ref url="http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127627.html" source="FEDORA">FEDORA-2014-1876</ref>
    </refs>
    <vuln_soft>
      <prod vendor="haxx" name="curl">
        <vers num="7.10.6"/>
        <vers num="7.10.7"/>
        <vers num="7.10.8"/>
        <vers num="7.11.0"/>
        <vers num="7.11.1"/>
        <vers num="7.11.2"/>
        <vers num="7.12.0"/>
        <vers num="7.12.1"/>
        <vers num="7.12.2"/>
        <vers num="7.12.3"/>
        <vers num="7.13.0"/>
        <vers num="7.13.1"/>
        <vers num="7.13.2"/>
        <vers num="7.14.0"/>
        <vers num="7.14.1"/>
        <vers num="7.15.0"/>
        <vers num="7.15.1"/>
        <vers num="7.15.2"/>
        <vers num="7.15.3"/>
        <vers num="7.15.4"/>
        <vers num="7.15.5"/>
        <vers num="7.16.0"/>
        <vers num="7.16.1"/>
        <vers num="7.16.2"/>
        <vers num="7.16.3"/>
        <vers num="7.16.4"/>
        <vers num="7.17.0"/>
        <vers num="7.17.1"/>
        <vers num="7.18.0"/>
        <vers num="7.18.1"/>
        <vers num="7.18.2"/>
        <vers num="7.19.0"/>
        <vers num="7.19.1"/>
        <vers num="7.19.2"/>
        <vers num="7.19.3"/>
        <vers num="7.19.4"/>
        <vers num="7.19.5"/>
        <vers num="7.19.6"/>
        <vers num="7.19.7"/>
        <vers num="7.20.0"/>
        <vers num="7.20.1"/>
        <vers num="7.21.0"/>
        <vers num="7.21.1"/>
        <vers num="7.21.2"/>
        <vers num="7.21.3"/>
        <vers num="7.21.4"/>
        <vers num="7.21.5"/>
        <vers num="7.21.6"/>
        <vers num="7.21.7"/>
        <vers num="7.22.0"/>
        <vers num="7.23.0"/>
        <vers num="7.23.1"/>
        <vers num="7.24.0"/>
        <vers num="7.25.0"/>
        <vers num="7.26.0"/>
        <vers num="7.27.0"/>
        <vers num="7.28.0"/>
        <vers num="7.28.1"/>
        <vers num="7.29.0"/>
        <vers num="7.30.0"/>
        <vers num="7.31.0"/>
        <vers num="7.32.0"/>
        <vers num="7.33.0"/>
        <vers num="7.34.0"/>
      </prod>
      <prod vendor="haxx" name="libcurl">
        <vers num="7.10.6"/>
        <vers num="7.10.7"/>
        <vers num="7.10.8"/>
        <vers num="7.11.0"/>
        <vers num="7.11.1"/>
        <vers num="7.11.2"/>
        <vers num="7.12.0"/>
        <vers num="7.12.1"/>
        <vers num="7.12.2"/>
        <vers num="7.12.3"/>
        <vers num="7.13.0"/>
        <vers num="7.13.1"/>
        <vers num="7.13.2"/>
        <vers num="7.14.0"/>
        <vers num="7.14.1"/>
        <vers num="7.15.0"/>
        <vers num="7.15.1"/>
        <vers num="7.15.2"/>
        <vers num="7.15.3"/>
        <vers num="7.15.4"/>
        <vers num="7.15.5"/>
        <vers num="7.16.0"/>
        <vers num="7.16.1"/>
        <vers num="7.16.2"/>
        <vers num="7.16.3"/>
        <vers num="7.16.4"/>
        <vers num="7.17.0"/>
        <vers num="7.17.1"/>
        <vers num="7.18.0"/>
        <vers num="7.18.1"/>
        <vers num="7.18.2"/>
        <vers num="7.19.0"/>
        <vers num="7.19.1"/>
        <vers num="7.19.2"/>
        <vers num="7.19.3"/>
        <vers num="7.19.4"/>
        <vers num="7.19.5"/>
        <vers num="7.19.6"/>
        <vers num="7.19.7"/>
        <vers num="7.20.0"/>
        <vers num="7.20.1"/>
        <vers num="7.21.0"/>
        <vers num="7.21.1"/>
        <vers num="7.21.2"/>
        <vers num="7.21.3"/>
        <vers num="7.21.4"/>
        <vers num="7.21.5"/>
        <vers num="7.21.6"/>
        <vers num="7.21.7"/>
        <vers num="7.22.0"/>
        <vers num="7.23.0"/>
        <vers num="7.23.1"/>
        <vers num="7.24.0"/>
        <vers num="7.25.0"/>
        <vers num="7.26.0"/>
        <vers num="7.27.0"/>
        <vers num="7.28.0"/>
        <vers num="7.28.1"/>
        <vers num="7.29.0"/>
        <vers num="7.30.0"/>
        <vers num="7.31.0"/>
        <vers num="7.32.0"/>
        <vers num="7.33.0"/>
        <vers num="7.34.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0016" published="2014-03-24" name="CVE-2014-0016" modified="2014-03-24" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:N/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">stunnel before 5.00, when using fork threading, does not properly update the state of the OpenSSL pseudo-random number generator (PRNG), which causes subsequent children with the same process ID to use the same entropy pool and allows remote attackers to obtain private keys for EC (ECDSA) or DSA certificates.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://www.stunnel.org/sdf_ChangeLog.html" source="CONFIRM" adv="1">https://www.stunnel.org/sdf_ChangeLog.html</ref>
      <ref url="https://bugzilla.redhat.com/show_bug.cgi?id=1072180" source="CONFIRM">https://bugzilla.redhat.com/show_bug.cgi?id=1072180</ref>
      <ref url="https://bugzilla.redhat.com/attachment.cgi?id=870826&amp;action=diff" source="MISC">https://bugzilla.redhat.com/attachment.cgi?id=870826&amp;action=diff</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/03/05/1" source="MLIST">[oss-security] 20140305 libssh and stunnel PRNG flaws</ref>
    </refs>
    <vuln_soft>
      <prod vendor="stunnel" name="stunnel">
        <vers num="0.1"/>
        <vers num="1.0"/>
        <vers num="1.1"/>
        <vers num="1.2"/>
        <vers num="1.3"/>
        <vers num="1.4"/>
        <vers num="1.5"/>
        <vers num="1.6"/>
        <vers num="2.0"/>
        <vers num="2.1"/>
        <vers num="3.0" edition="b1"/>
        <vers num="3.0" edition="b2"/>
        <vers num="3.0" edition="b3"/>
        <vers num="3.0" edition="b4"/>
        <vers num="3.0" edition="b5"/>
        <vers num="3.0" edition="b6"/>
        <vers num="3.0" edition="b7"/>
        <vers num="3.1"/>
        <vers num="3.10"/>
        <vers num="3.11"/>
        <vers num="3.12"/>
        <vers num="3.13"/>
        <vers num="3.14"/>
        <vers num="3.15"/>
        <vers num="3.16"/>
        <vers num="3.17"/>
        <vers num="3.18"/>
        <vers num="3.19"/>
        <vers num="3.2"/>
        <vers num="3.20"/>
        <vers num="3.21"/>
        <vers num="3.21a"/>
        <vers num="3.21b"/>
        <vers num="3.21c"/>
        <vers num="3.22"/>
        <vers num="3.23"/>
        <vers num="3.24"/>
        <vers num="3.25"/>
        <vers num="3.26"/>
        <vers num="3.3"/>
        <vers num="3.4a"/>
        <vers num="3.5"/>
        <vers num="3.6"/>
        <vers num="3.7"/>
        <vers num="3.8" edition="p1"/>
        <vers num="3.8" edition="p2"/>
        <vers num="3.8" edition="p3"/>
        <vers num="3.8" edition="p4"/>
        <vers num="3.8p1"/>
        <vers num="3.8p2"/>
        <vers num="3.8p3"/>
        <vers num="3.8p4"/>
        <vers num="3.9"/>
        <vers num="4.0"/>
        <vers num="4.00"/>
        <vers num="4.01"/>
        <vers num="4.02"/>
        <vers num="4.03"/>
        <vers num="4.04"/>
        <vers num="4.05"/>
        <vers num="4.06"/>
        <vers num="4.07"/>
        <vers num="4.08"/>
        <vers num="4.09"/>
        <vers num="4.10"/>
        <vers num="4.11"/>
        <vers num="4.12"/>
        <vers num="4.13"/>
        <vers num="4.14"/>
        <vers num="4.15"/>
        <vers num="4.16"/>
        <vers num="4.17"/>
        <vers num="4.18"/>
        <vers num="4.19"/>
        <vers num="4.20"/>
        <vers num="4.21"/>
        <vers num="4.22"/>
        <vers num="4.23"/>
        <vers num="4.24"/>
        <vers num="4.25"/>
        <vers num="4.26"/>
        <vers num="4.27"/>
        <vers num="4.28"/>
        <vers num="4.29"/>
        <vers num="4.30"/>
        <vers num="4.31"/>
        <vers num="4.32"/>
        <vers num="4.33"/>
        <vers num="4.34"/>
        <vers num="4.35"/>
        <vers num="4.36"/>
        <vers num="4.37"/>
        <vers num="4.38"/>
        <vers num="4.39"/>
        <vers num="4.40"/>
        <vers num="4.41"/>
        <vers num="4.42"/>
        <vers num="4.43"/>
        <vers num="4.44"/>
        <vers num="4.45"/>
        <vers num="4.46"/>
        <vers num="4.47"/>
        <vers num="4.48"/>
        <vers num="4.49"/>
        <vers num="4.50"/>
        <vers num="4.51"/>
        <vers num="4.52"/>
        <vers num="4.53"/>
        <vers num="4.54"/>
        <vers num="4.55"/>
        <vers prev="1" num="4.56"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-0017" published="2014-03-14" name="CVE-2014-0017" modified="2014-03-26" CVSS_version="2.0" CVSS_vector="(AV:L/AC:M/Au:N/C:P/I:N/A:N)" CVSS_score="1.9" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="3.4" CVSS_base_score="1.9">
    <desc>
      <descript source="cve">The RAND_bytes function in libssh before 0.6.3, when forking is enabled, does not properly reset the state of the OpenSSL pseudo-random number generator (PRNG), which causes the state to be shared between children processes and allows local users to obtain sensitive information by leveraging a pid collision.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="http://www.libssh.org/2014/03/04/libssh-0-6-3-security-release/" source="CONFIRM" patch="1" adv="1">http://www.libssh.org/2014/03/04/libssh-0-6-3-security-release/</ref>
      <ref url="https://bugzilla.redhat.com/show_bug.cgi?id=1072191" source="CONFIRM">https://bugzilla.redhat.com/show_bug.cgi?id=1072191</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2145-1" source="UBUNTU">USN-2145-1</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/03/05/1" source="MLIST">[oss-security] 20140305 libssh and stunnel PRNG flaws</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2879" source="DEBIAN">DSA-2879</ref>
      <ref url="http://secunia.com/advisories/57407" source="SECUNIA" adv="1">57407</ref>
      <ref url="http://lists.opensuse.org/opensuse-updates/2014-03/msg00040.html" source="SUSE">openSUSE-SU-2014:0370</ref>
      <ref url="http://lists.opensuse.org/opensuse-updates/2014-03/msg00036.html" source="SUSE">openSUSE-SU-2014:0366</ref>
    </refs>
    <vuln_soft>
      <prod vendor="libssh" name="libssh">
        <vers num="0.4.7"/>
        <vers num="0.4.8"/>
        <vers num="0.5.0" edition="rc1"/>
        <vers num="0.5.1"/>
        <vers num="0.5.2"/>
        <vers num="0.5.3"/>
        <vers num="0.5.4"/>
        <vers num="0.5.5"/>
        <vers num="0.6.0"/>
        <vers num="0.6.1"/>
        <vers prev="1" num="0.6.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-0018" published="2014-02-14" name="CVE-2014-0018" modified="2014-02-18" CVSS_version="2.0" CVSS_vector="(AV:L/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="1.9" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="3.4" CVSS_base_score="1.9">
    <desc>
      <descript source="cve">Red Hat JBoss Enterprise Application Platform (JBEAP) 6.2.0 and JBoss WildFly Application Server, when run under a security manager, do not properly restrict access to the Modular Service Container (MSC) service registry, which allows local users to modify the server via a crafted deployment.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="https://bugzilla.redhat.com/show_bug.cgi?id=1052783" source="CONFIRM">https://bugzilla.redhat.com/show_bug.cgi?id=1052783</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0172.html" source="REDHAT" adv="1">RHSA-2014:0172</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0171.html" source="REDHAT" adv="1">RHSA-2014:0171</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0170.html" source="REDHAT" adv="1">RHSA-2014:0170</ref>
    </refs>
    <vuln_soft>
      <prod vendor="redhat" name="jboss_enterprise_application_platform">
        <vers num="6.2.0"/>
      </prod>
      <prod vendor="redhat" name="jboss_wildfly_application_server">
        <vers num="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-0019" published="2014-02-04" name="CVE-2014-0019" modified="2014-02-21" CVSS_version="2.0" CVSS_vector="(AV:L/AC:M/Au:N/C:N/I:N/A:P)" CVSS_score="1.9" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="3.4" CVSS_base_score="1.9">
    <desc>
      <descript source="cve">Stack-based buffer overflow in socat 1.3.0.0 through 1.7.2.2 and 2.0.0-b1 through 2.0.0-b6 allows local users to cause a denial of service (segmentation fault) via a long server name in the PROXY-CONNECT address in the command line.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="http://www.dest-unreach.org/socat" source="CONFIRM" patch="1">http://www.dest-unreach.org/socat</ref>
      <ref url="http://seclists.org/oss-sec/2014/q1/159" source="MLIST" patch="1">[oss-security] 20140128 Socat security advisory 5 - PROXY-CONNECT address overflow</ref>
      <ref url="http://www.securityfocus.com/bid/65201" source="BID">65201</ref>
      <ref url="http://www.mandriva.com/security/advisories?name=MDVSA-2014:033" source="MANDRIVA">MDVSA-2014:033</ref>
      <ref url="http://www.dest-unreach.org/socat/contrib/socat-secadv5.txt" source="MISC">http://www.dest-unreach.org/socat/contrib/socat-secadv5.txt</ref>
      <ref url="http://osvdb.org/102612" source="OSVDB">102612</ref>
      <ref url="http://lists.fedoraproject.org/pipermail/package-announce/2014-February/128229.html" source="FEDORA">FEDORA-2014-1795</ref>
      <ref url="http://lists.fedoraproject.org/pipermail/package-announce/2014-February/128190.html" source="FEDORA">FEDORA-2014-1811</ref>
    </refs>
    <vuln_soft>
      <prod vendor="dest-unreach" name="socat">
        <vers num="1.3.0.0"/>
        <vers num="1.3.0.1"/>
        <vers num="1.3.1.0"/>
        <vers num="1.3.2.0"/>
        <vers num="1.3.2.1"/>
        <vers num="1.3.2.2"/>
        <vers num="1.4.0.0"/>
        <vers num="1.4.0.1"/>
        <vers num="1.4.0.2"/>
        <vers num="1.4.0.3"/>
        <vers num="1.4.1.0"/>
        <vers num="1.4.2.0"/>
        <vers num="1.4.3.0"/>
        <vers num="1.4.3.1"/>
        <vers num="1.5.0.0"/>
        <vers num="1.6.0.0"/>
        <vers num="1.6.0.1"/>
        <vers num="1.7.0.0"/>
        <vers num="1.7.0.1"/>
        <vers num="1.7.1.0"/>
        <vers num="1.7.1.1"/>
        <vers num="1.7.1.2"/>
        <vers num="1.7.1.3"/>
        <vers num="1.7.2.0"/>
        <vers num="1.7.2.1"/>
        <vers num="1.7.2.2"/>
        <vers num="2.0.0" edition="b1"/>
        <vers num="2.0.0" edition="b2"/>
        <vers num="2.0.0" edition="b3"/>
        <vers num="2.0.0" edition="b4"/>
        <vers num="2.0.0" edition="b5"/>
        <vers num="2.0.0" edition="b6"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0020" published="2014-02-06" name="CVE-2014-0020" modified="2014-03-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:P)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">The IRC protocol plugin in libpurple in Pidgin before 2.10.8 does not validate argument counts, which allows remote IRC servers to cause a denial of service (application crash) via a crafted message.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://rhn.redhat.com/errata/RHSA-2014-0139.html" source="REDHAT">RHSA-2014:0139</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2100-1" source="UBUNTU">USN-2100-1</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2859" source="DEBIAN">DSA-2859</ref>
      <ref url="http://pidgin.im/news/security/?id=85" source="CONFIRM" adv="1">http://pidgin.im/news/security/?id=85</ref>
      <ref url="http://lists.opensuse.org/opensuse-updates/2014-03/msg00005.html" source="SUSE">openSUSE-SU-2014:0326</ref>
      <ref url="http://lists.opensuse.org/opensuse-updates/2014-02/msg00039.html" source="SUSE">openSUSE-SU-2014:0239</ref>
      <ref url="http://hg.pidgin.im/pidgin/main/rev/a167504359e5" source="CONFIRM">http://hg.pidgin.im/pidgin/main/rev/a167504359e5</ref>
      <ref url="http://hg.pidgin.im/pidgin/main/rev/9f132a6855cd" source="CONFIRM">http://hg.pidgin.im/pidgin/main/rev/9f132a6855cd</ref>
      <ref url="http://hg.pidgin.im/pidgin/main/rev/7d0fb0c6d8d4" source="CONFIRM">http://hg.pidgin.im/pidgin/main/rev/7d0fb0c6d8d4</ref>
      <ref url="http://hg.pidgin.im/pidgin/main/rev/6b0e0566af20" source="CONFIRM">http://hg.pidgin.im/pidgin/main/rev/6b0e0566af20</ref>
      <ref url="http://hg.pidgin.im/pidgin/main/rev/5845d9fa7084" source="CONFIRM">http://hg.pidgin.im/pidgin/main/rev/5845d9fa7084</ref>
      <ref url="http://hg.pidgin.im/pidgin/main/rev/4d9be297d399" source="CONFIRM">http://hg.pidgin.im/pidgin/main/rev/4d9be297d399</ref>
    </refs>
    <vuln_soft>
      <prod vendor="pidgin" name="pidgin">
        <vers num="2.0.0"/>
        <vers num="2.0.1"/>
        <vers num="2.0.2"/>
        <vers num="2.1.0"/>
        <vers num="2.1.1"/>
        <vers num="2.10.0"/>
        <vers num="2.10.1"/>
        <vers num="2.10.2"/>
        <vers num="2.10.3"/>
        <vers num="2.10.4"/>
        <vers num="2.10.5"/>
        <vers num="2.10.6"/>
        <vers prev="1" num="2.10.7"/>
        <vers num="2.2.0"/>
        <vers num="2.2.1"/>
        <vers num="2.2.2"/>
        <vers num="2.3.0"/>
        <vers num="2.3.1"/>
        <vers num="2.4.0"/>
        <vers num="2.4.1"/>
        <vers num="2.4.2"/>
        <vers num="2.4.3"/>
        <vers num="2.5.0"/>
        <vers num="2.5.1"/>
        <vers num="2.5.2"/>
        <vers num="2.5.3"/>
        <vers num="2.5.4"/>
        <vers num="2.5.5"/>
        <vers num="2.5.6"/>
        <vers num="2.5.7"/>
        <vers num="2.5.8"/>
        <vers num="2.5.9"/>
        <vers num="2.6.0"/>
        <vers num="2.6.1"/>
        <vers num="2.6.2"/>
        <vers num="2.6.3"/>
        <vers num="2.6.4"/>
        <vers num="2.6.5"/>
        <vers num="2.6.6"/>
        <vers num="2.7.0"/>
        <vers num="2.7.1"/>
        <vers num="2.7.10"/>
        <vers num="2.7.11"/>
        <vers num="2.7.2"/>
        <vers num="2.7.3"/>
        <vers num="2.7.4"/>
        <vers num="2.7.5"/>
        <vers num="2.7.6"/>
        <vers num="2.7.7"/>
        <vers num="2.7.8"/>
        <vers num="2.7.9"/>
        <vers num="2.8.0"/>
        <vers num="2.9.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0022" published="2014-01-26" name="CVE-2014-0022" modified="2014-01-27" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:P/A:N)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">The installUpdates function in yum-cron/yum-cron.py in yum 3.4.3 and earlier does not properly check the return value of the sigCheckPkg function, which allows remote attackers to bypass the RMP package signing restriction via an unsigned package.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://yum.baseurl.org/gitweb?p=yum.git;a=commitdiff;h=9df69e5794" source="CONFIRM" patch="1">http://yum.baseurl.org/gitweb?p=yum.git;a=commitdiff;h=9df69e5794</ref>
      <ref url="https://bugzilla.redhat.com/show_bug.cgi?id=1057377" source="CONFIRM">https://bugzilla.redhat.com/show_bug.cgi?id=1057377</ref>
      <ref url="https://bugzilla.redhat.com/show_bug.cgi?id=1052440" source="CONFIRM">https://bugzilla.redhat.com/show_bug.cgi?id=1052440</ref>
      <ref url="http://www.securityfocus.com/bid/65119" source="BID">65119</ref>
      <ref url="http://secunia.com/advisories/56637" source="SECUNIA" adv="1">56637</ref>
    </refs>
    <vuln_soft>
      <prod vendor="baseurl" name="yum">
        <vers num="3.4.0"/>
        <vers num="3.4.1"/>
        <vers num="3.4.2"/>
        <vers prev="1" num="3.4.3"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" seq="2014-0025" reject="1" published="2014-01-28" name="CVE-2014-0025" modified="2014-01-28">
    <desc>
      <descript source="cve">** REJECT **  DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2014-1690.  Reason: This candidate is a reservation duplicate of CVE-2014-1690.  Notes: All CVE users should reference CVE-2014-1690 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage.</descript>
    </desc>
    <refs/>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-0027" published="2014-01-25" name="CVE-2014-0027" modified="2014-02-21" CVSS_version="2.0" CVSS_vector="(AV:L/AC:M/Au:N/C:P/I:P/A:N)" CVSS_score="3.3" CVSS_impact_subscore="4.9" CVSS_exploit_subscore="3.4" CVSS_base_score="3.3">
    <desc>
      <descript source="cve">The play_wave_from_socket function in audio/auserver.c in Flite 1.4 allows local users to modify arbitrary files via a symlink attack on /tmp/awb.wav.  NOTE: some of these details are obtained from third party information.</descript>
    </desc>
    <loss_types>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="https://bugzilla.redhat.com/show_bug.cgi?id=1048678" source="CONFIRM">https://bugzilla.redhat.com/show_bug.cgi?id=1048678</ref>
      <ref url="http://www.securityfocus.com/bid/64791" source="BID">64791</ref>
      <ref url="http://www.osvdb.org/101948" source="OSVDB">101948</ref>
      <ref url="http://www.mandriva.com/security/advisories?name=MDVSA-2014:032" source="MANDRIVA">MDVSA-2014:032</ref>
      <ref url="http://seclists.org/oss-sec/2014/q1/59" source="MLIST">[oss-security] 20140110 temporary file issue in flite</ref>
      <ref url="http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127776.html" source="FEDORA">FEDORA-2014-0579</ref>
      <ref url="http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127748.html" source="FEDORA">FEDORA-2014-0574</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cmu" name="flite">
        <vers num="1.4"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0028" published="2014-01-24" name="CVE-2014-0028" modified="2014-03-05" CVSS_version="2.0" CVSS_vector="(AV:A/AC:M/Au:N/C:P/I:N/A:P)" CVSS_score="4.3" CVSS_impact_subscore="4.9" CVSS_exploit_subscore="5.5" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">libvirt 1.1.1 through 1.2.0 allows context-dependent attackers to bypass the domain:getattr and connect:search_domains restrictions in ACLs and obtain sensitive domain object information via a request to the (1) virConnectDomainEventRegister and (2) virConnectDomainEventRegisterAny functions in the event registration API.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
    </loss_types>
    <range>
      <local_network/>
    </range>
    <refs>
      <ref url="https://www.redhat.com/archives/libvir-list/2014-January/msg00684.html" source="MLIST">[libvirt] 20140115 [PATCH 0/4] CVE-2014-0028: domain events vs. ACL filtering</ref>
      <ref url="https://bugzilla.redhat.com/show_bug.cgi?id=1048637" source="CONFIRM" adv="1">https://bugzilla.redhat.com/show_bug.cgi?id=1048637</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2093-1" source="UBUNTU">USN-2093-1</ref>
      <ref url="http://lists.opensuse.org/opensuse-updates/2014-02/msg00060.html" source="SUSE">openSUSE-SU-2014:0268</ref>
      <ref url="http://libvirt.org/news.html" source="CONFIRM">http://libvirt.org/news.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="redhat" name="libvirt">
        <vers num="1.1.1"/>
        <vers num="1.1.2"/>
        <vers num="1.1.3"/>
        <vers num="1.1.4"/>
        <vers num="1.2.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0031" published="2014-01-15" name="CVE-2014-0031" modified="2014-02-25" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:P/I:N/A:N)" CVSS_score="4.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.0" CVSS_base_score="4.0">
    <desc>
      <descript source="cve">The (1) ListNetworkACL and (2) listNetworkACLLists APIs in Apache CloudStack before 4.2.1 allow remote authenticated users to list network ACLS for other users via a crafted request.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://issues.apache.org/jira/browse/CLOUDSTACK-5145" source="CONFIRM">https://issues.apache.org/jira/browse/CLOUDSTACK-5145</ref>
      <ref url="https://blogs.apache.org/cloudstack/entry/cve_2014_0031_cloudstack_listnetworkacl" source="CONFIRM" adv="1">https://blogs.apache.org/cloudstack/entry/cve_2014_0031_cloudstack_listnetworkacl</ref>
      <ref url="http://secunia.com/advisories/55960" source="SECUNIA" adv="1">55960</ref>
    </refs>
    <vuln_soft>
      <prod vendor="apache" name="cloudstack">
        <vers num="2.0" edition="-:community"/>
        <vers num="2.0.1"/>
        <vers num="2.1.0"/>
        <vers num="2.1.1"/>
        <vers num="2.1.10"/>
        <vers num="2.1.2"/>
        <vers num="2.1.3"/>
        <vers num="2.1.4"/>
        <vers num="2.1.5"/>
        <vers num="2.1.6"/>
        <vers num="2.1.7"/>
        <vers num="2.1.8"/>
        <vers num="2.1.9"/>
        <vers num="2.2.0"/>
        <vers num="2.2.1"/>
        <vers num="2.2.11"/>
        <vers num="2.2.12"/>
        <vers num="2.2.13"/>
        <vers num="2.2.14"/>
        <vers num="2.2.2"/>
        <vers num="2.2.3"/>
        <vers num="2.2.5"/>
        <vers num="2.2.6"/>
        <vers num="2.2.7"/>
        <vers num="2.2.8"/>
        <vers num="2.2.9"/>
        <vers num="3.0.0"/>
        <vers num="3.0.1"/>
        <vers num="3.0.2"/>
        <vers num="4.0.0" edition="incubating"/>
        <vers num="4.0.1"/>
        <vers num="4.0.2"/>
        <vers num="4.1.0"/>
        <vers num="4.1.1"/>
        <vers prev="1" num="4.2.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0032" published="2014-02-14" name="CVE-2014-0032" modified="2014-03-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:N/A:P)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">The get_resource function in repos.c in the mod_dav_svn module in Apache Subversion before 1.7.15 and 1.8.x before 1.8.6, when SVNListParentPath is enabled, allows remote attackers to cause a denial of service (crash) via vectors related to the server root and request methods other than GET, as demonstrated by the "svn ls http://svn.example.com" command.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://svn.apache.org/viewvc?view=revision&amp;revision=1557320" source="CONFIRM" patch="1">http://svn.apache.org/viewvc?view=revision&amp;revision=1557320</ref>
      <ref url="http://xforce.iss.net/xforce/xfdb/90986" source="XF">apache-subversion-cve20140032-dos(90986)</ref>
      <ref url="http://www.securityfocus.com/bid/65434" source="BID">65434</ref>
      <ref url="http://www.osvdb.org/102927" source="OSVDB">102927</ref>
      <ref url="http://svn.apache.org/repos/asf/subversion/tags/1.8.6/CHANGES" source="CONFIRM">http://svn.apache.org/repos/asf/subversion/tags/1.8.6/CHANGES</ref>
      <ref url="http://svn.apache.org/repos/asf/subversion/tags/1.7.15/CHANGES" source="CONFIRM">http://svn.apache.org/repos/asf/subversion/tags/1.7.15/CHANGES</ref>
      <ref url="http://secunia.com/advisories/56822" source="SECUNIA" adv="1">56822</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0255.html" source="REDHAT">RHSA-2014:0255</ref>
      <ref url="http://mail-archives.apache.org/mod_mbox/subversion-dev/201401.mbox/%3CCANvU9scLHr2yOLABW8q6_wNzhEf7pWM=NiavGcobqvUuyhKyAA@mail.gmail.com%3E" source="MLIST">[subversion-dev] 20140110 Sin mod_dav_svn with repositories on /</ref>
      <ref url="http://mail-archives.apache.org/mod_mbox/subversion-dev/201401.mbox/%3C871u0gqb0d.fsf@ntlworld.com%3E" source="MLIST">[subversion-dev] 20140110 Re: Segfault in mod_dav_svn with repositories on /</ref>
      <ref url="http://mail-archives.apache.org/mod_mbox/subversion-dev/201401.mbox/%3C52D328AB.8090502@reser.org%3E" source="MLIST">[subversion-dev] 20140110 2 Re: Segfault in mod_dav_svn with repositories on /</ref>
      <ref url="http://lists.opensuse.org/opensuse-updates/2014-03/msg00011.html" source="SUSE">openSUSE-SU-2014:0334</ref>
      <ref url="http://lists.opensuse.org/opensuse-updates/2014-02/msg00086.html" source="SUSE">openSUSE-SU-2014:0307</ref>
    </refs>
    <vuln_soft>
      <prod vendor="apache" name="subversion">
        <vers num="1.7.0"/>
        <vers num="1.7.1"/>
        <vers num="1.7.10"/>
        <vers num="1.7.11"/>
        <vers num="1.7.12"/>
        <vers num="1.7.13"/>
        <vers prev="1" num="1.7.14"/>
        <vers num="1.7.2"/>
        <vers num="1.7.3"/>
        <vers num="1.7.4"/>
        <vers num="1.7.5"/>
        <vers num="1.7.6"/>
        <vers num="1.7.7"/>
        <vers num="1.7.8"/>
        <vers num="1.7.9"/>
        <vers num="1.8.0"/>
        <vers num="1.8.1"/>
        <vers num="1.8.2"/>
        <vers num="1.8.3"/>
        <vers num="1.8.4"/>
        <vers num="1.8.5"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0033" published="2014-02-26" name="CVE-2014-0033" modified="2014-02-26" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:N/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">org/apache/catalina/connector/CoyoteAdapter.java in Apache Tomcat 6.0.33 through 6.0.37 does not consider the disableURLRewriting setting when handling a session ID in a URL, which allows remote attackers to conduct session fixation attacks via a crafted URL.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://bugzilla.redhat.com/show_bug.cgi?id=1069919" source="CONFIRM">https://bugzilla.redhat.com/show_bug.cgi?id=1069919</ref>
      <ref url="http://tomcat.apache.org/security-6.html" source="CONFIRM" adv="1">http://tomcat.apache.org/security-6.html</ref>
      <ref url="http://svn.apache.org/viewvc?view=revision&amp;revision=1558822" source="CONFIRM">http://svn.apache.org/viewvc?view=revision&amp;revision=1558822</ref>
    </refs>
    <vuln_soft>
      <prod vendor="apache" name="tomcat">
        <vers num="6.0.33"/>
        <vers num="6.0.34"/>
        <vers num="6.0.35"/>
        <vers num="6.0.36"/>
        <vers num="6.0.37"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0036" published="2014-04-17" name="CVE-2014-0036" modified="2014-04-18" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:P)" CVSS_score="6.8" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.6" CVSS_base_score="6.8">
    <desc>
      <descript source="cve">The rbovirt gem before 0.0.24 for Ruby uses the rest-client gem with SSL verification disabled, which allows remote attackers to conduct man-in-the-middle attacks via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://bugzilla.redhat.com/show_bug.cgi?id=1058595" source="CONFIRM">https://bugzilla.redhat.com/show_bug.cgi?id=1058595</ref>
      <ref url="http://seclists.org/oss-sec/2014/q1/509" source="MLIST">[oss-security] 20140306 CVE-2014-0036 rubygem-rbovirt: unsafe use of rest-client</ref>
      <ref url="http://lists.fedoraproject.org/pipermail/package-announce/2014-March/130180.html" source="FEDORA">FEDORA-2014-3526</ref>
      <ref url="http://lists.fedoraproject.org/pipermail/package-announce/2014-March/130148.html" source="FEDORA">FEDORA-2014-3573</ref>
    </refs>
    <vuln_soft>
      <prod vendor="amos_benari" name="rbovirt">
        <vers num="0.0.1" edition=":~~~ruby~~"/>
        <vers num="0.0.10" edition=":~~~ruby~~"/>
        <vers num="0.0.11" edition=":~~~ruby~~"/>
        <vers num="0.0.12" edition=":~~~ruby~~"/>
        <vers num="0.0.13" edition=":~~~ruby~~"/>
        <vers num="0.0.14" edition=":~~~ruby~~"/>
        <vers num="0.0.15" edition=":~~~ruby~~"/>
        <vers num="0.0.16" edition=":~~~ruby~~"/>
        <vers num="0.0.17" edition=":~~~ruby~~"/>
        <vers num="0.0.18" edition=":~~~ruby~~"/>
        <vers num="0.0.19" edition=":~~~ruby~~"/>
        <vers num="0.0.2" edition=":~~~ruby~~"/>
        <vers num="0.0.20" edition=":~~~ruby~~"/>
        <vers num="0.0.21" edition=":~~~ruby~~"/>
        <vers num="0.0.22" edition=":~~~ruby~~"/>
        <vers prev="1" num="0.0.23" edition=":~~~ruby~~"/>
        <vers num="0.0.3" edition=":~~~ruby~~"/>
        <vers num="0.0.4" edition=":~~~ruby~~"/>
        <vers num="0.0.5" edition=":~~~ruby~~"/>
        <vers num="0.0.6" edition=":~~~ruby~~"/>
        <vers num="0.0.7" edition=":~~~ruby~~"/>
        <vers num="0.0.8" edition=":~~~ruby~~"/>
        <vers num="0.0.9" edition=":~~~ruby~~"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0037" published="2014-04-28" name="CVE-2014-0037" modified="2014-04-29" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:P)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">The ValidateUserLogon function in provider/libserver/ECSession.cpp in Zarafa 5.00 before 7.1.8 beta2 allows remote attackers to cause a denial of service (crash) via vectors related to "a NULL pointer of the username."</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://bugzilla.redhat.com/show_bug.cgi?id=1059903" source="CONFIRM">https://bugzilla.redhat.com/show_bug.cgi?id=1059903</ref>
      <ref url="https://bugzilla.redhat.com/show_bug.cgi?id=1056767" source="CONFIRM">https://bugzilla.redhat.com/show_bug.cgi?id=1056767</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/01/31/14" source="MLIST">[oss-security] 20140131 Security Flaw CVE-2014-0037</ref>
      <ref url="http://www.mandriva.com/security/advisories?name=MDVSA-2014:044" source="MANDRIVA">MDVSA-2014:044</ref>
    </refs>
    <vuln_soft>
      <prod vendor="zarafa" name="zarafa">
        <vers num="5.00"/>
        <vers num="5.01"/>
        <vers num="5.02"/>
        <vers num="5.10"/>
        <vers num="5.11"/>
        <vers num="5.20"/>
        <vers num="5.22"/>
        <vers num="6.00"/>
        <vers num="6.01"/>
        <vers num="6.02"/>
        <vers num="6.03"/>
        <vers num="6.10"/>
        <vers num="6.11"/>
        <vers num="6.20"/>
        <vers num="6.20.10"/>
        <vers num="6.20.11"/>
        <vers num="6.20.12"/>
        <vers num="6.20.2"/>
        <vers num="6.20.3"/>
        <vers num="6.20.5"/>
        <vers num="6.20.6"/>
        <vers num="6.20.7"/>
        <vers num="6.30.0"/>
        <vers num="6.30.10"/>
        <vers num="6.30.11"/>
        <vers num="6.30.13"/>
        <vers num="6.30.16"/>
        <vers num="6.30.17"/>
        <vers num="6.30.3"/>
        <vers num="6.30.4"/>
        <vers num="6.30.5"/>
        <vers num="6.30.6"/>
        <vers num="6.30.7"/>
        <vers num="6.30.8"/>
        <vers num="6.30.9"/>
        <vers num="6.40.0"/>
        <vers num="6.40.10"/>
        <vers num="6.40.11"/>
        <vers num="6.40.12"/>
        <vers num="6.40.13"/>
        <vers num="6.40.14"/>
        <vers num="6.40.15"/>
        <vers num="6.40.16"/>
        <vers num="6.40.17"/>
        <vers num="6.40.2"/>
        <vers num="6.40.3"/>
        <vers num="6.40.4"/>
        <vers num="6.40.5"/>
        <vers num="6.40.6"/>
        <vers num="6.40.7"/>
        <vers num="6.40.8"/>
        <vers num="6.40.9"/>
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="7.0.10"/>
        <vers num="7.0.11"/>
        <vers num="7.0.12"/>
        <vers num="7.0.13"/>
        <vers num="7.0.2"/>
        <vers num="7.0.3"/>
        <vers num="7.0.4"/>
        <vers num="7.0.5"/>
        <vers num="7.0.6"/>
        <vers num="7.0.7"/>
        <vers num="7.0.8"/>
        <vers num="7.0.9"/>
        <vers num="7.1.0"/>
        <vers num="7.1.1"/>
        <vers num="7.1.2"/>
        <vers num="7.1.3"/>
        <vers num="7.1.4"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0038" published="2014-02-06" name="CVE-2014-0038" modified="2014-03-05" CVSS_version="2.0" CVSS_vector="(AV:L/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="6.9" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="3.4" CVSS_base_score="6.9">
    <desc>
      <descript source="cve">The compat_sys_recvmmsg function in net/compat.c in the Linux kernel before 3.13.2, when CONFIG_X86_X32 is enabled, allows local users to gain privileges via a recvmmsg system call with a crafted timeout pointer parameter.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="https://github.com/torvalds/linux/commit/2def2ef2ae5f3990aabdbe8a755911902707d268" source="CONFIRM" patch="1">https://github.com/torvalds/linux/commit/2def2ef2ae5f3990aabdbe8a755911902707d268</ref>
      <ref url="http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=2def2ef2ae5f3990aabdbe8a755911902707d268" source="CONFIRM" patch="1">http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=2def2ef2ae5f3990aabdbe8a755911902707d268</ref>
      <ref url="https://github.com/saelo/cve-2014-0038" source="MISC" adv="1">https://github.com/saelo/cve-2014-0038</ref>
      <ref url="https://code.google.com/p/chromium/issues/detail?id=338594" source="MISC">https://code.google.com/p/chromium/issues/detail?id=338594</ref>
      <ref url="https://bugzilla.redhat.com/show_bug.cgi?id=1060023" source="CONFIRM">https://bugzilla.redhat.com/show_bug.cgi?id=1060023</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2096-1" source="UBUNTU">USN-2096-1</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2095-1" source="UBUNTU">USN-2095-1</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2094-1" source="UBUNTU">USN-2094-1</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/01/31/2" source="MLIST">[oss-security] 20140131 Linux 3.4+: arbitrary write with CONFIG_X86_X32 (CVE-2014-0038)</ref>
      <ref url="http://www.mandriva.com/security/advisories?name=MDVSA-2014:038" source="MANDRIVA">MDVSA-2014:038</ref>
      <ref url="http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.13.2" source="CONFIRM">http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.13.2</ref>
      <ref url="http://www.exploit-db.com/exploits/31347" source="EXPLOIT-DB">31347</ref>
      <ref url="http://www.exploit-db.com/exploits/31346" source="EXPLOIT-DB">31346</ref>
      <ref url="http://pastebin.com/raw.php?i=DH3Lbg54" source="MISC">http://pastebin.com/raw.php?i=DH3Lbg54</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00003.html" source="SUSE">openSUSE-SU-2014:0205</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00002.html" source="SUSE">openSUSE-SU-2014:0204</ref>
    </refs>
    <vuln_soft>
      <prod vendor="linux" name="linux_kernel">
        <vers num="3.0" edition="rc1"/>
        <vers num="3.0" edition="rc2"/>
        <vers num="3.0" edition="rc3"/>
        <vers num="3.0" edition="rc4"/>
        <vers num="3.0" edition="rc5"/>
        <vers num="3.0" edition="rc6"/>
        <vers num="3.0" edition="rc7"/>
        <vers num="3.0.1"/>
        <vers num="3.0.10"/>
        <vers num="3.0.11"/>
        <vers num="3.0.12"/>
        <vers num="3.0.13"/>
        <vers num="3.0.14"/>
        <vers num="3.0.15"/>
        <vers num="3.0.16"/>
        <vers num="3.0.17"/>
        <vers num="3.0.18"/>
        <vers num="3.0.19"/>
        <vers num="3.0.2"/>
        <vers num="3.0.20"/>
        <vers num="3.0.21"/>
        <vers num="3.0.22"/>
        <vers num="3.0.23"/>
        <vers num="3.0.24"/>
        <vers num="3.0.25"/>
        <vers num="3.0.26"/>
        <vers num="3.0.27"/>
        <vers num="3.0.28"/>
        <vers num="3.0.29"/>
        <vers num="3.0.3"/>
        <vers num="3.0.30"/>
        <vers num="3.0.31"/>
        <vers num="3.0.32"/>
        <vers num="3.0.33"/>
        <vers num="3.0.34"/>
        <vers num="3.0.35"/>
        <vers num="3.0.36"/>
        <vers num="3.0.37"/>
        <vers num="3.0.38"/>
        <vers num="3.0.39"/>
        <vers num="3.0.4"/>
        <vers num="3.0.40"/>
        <vers num="3.0.41"/>
        <vers num="3.0.42"/>
        <vers num="3.0.43"/>
        <vers num="3.0.44"/>
        <vers num="3.0.45"/>
        <vers num="3.0.46"/>
        <vers num="3.0.47"/>
        <vers num="3.0.48"/>
        <vers num="3.0.49"/>
        <vers num="3.0.5"/>
        <vers num="3.0.50"/>
        <vers num="3.0.51"/>
        <vers num="3.0.52"/>
        <vers num="3.0.53"/>
        <vers num="3.0.54"/>
        <vers num="3.0.55"/>
        <vers num="3.0.56"/>
        <vers num="3.0.57"/>
        <vers num="3.0.58"/>
        <vers num="3.0.59"/>
        <vers num="3.0.6"/>
        <vers num="3.0.60"/>
        <vers num="3.0.61"/>
        <vers num="3.0.62"/>
        <vers num="3.0.63"/>
        <vers num="3.0.64"/>
        <vers num="3.0.65"/>
        <vers num="3.0.66"/>
        <vers num="3.0.67"/>
        <vers num="3.0.68"/>
        <vers num="3.0.7"/>
        <vers num="3.0.8"/>
        <vers num="3.0.9"/>
        <vers num="3.1" edition="rc1"/>
        <vers num="3.1" edition="rc2"/>
        <vers num="3.1" edition="rc3"/>
        <vers num="3.1" edition="rc4"/>
        <vers num="3.1.1"/>
        <vers num="3.1.10"/>
        <vers num="3.1.2"/>
        <vers num="3.1.3"/>
        <vers num="3.1.4"/>
        <vers num="3.1.5"/>
        <vers num="3.1.6"/>
        <vers num="3.1.7"/>
        <vers num="3.1.8"/>
        <vers num="3.1.9"/>
        <vers num="3.10"/>
        <vers num="3.10.1"/>
        <vers num="3.10.10"/>
        <vers num="3.10.11"/>
        <vers num="3.10.12"/>
        <vers num="3.10.13"/>
        <vers num="3.10.14"/>
        <vers num="3.10.15"/>
        <vers num="3.10.16"/>
        <vers num="3.10.17"/>
        <vers num="3.10.18"/>
        <vers num="3.10.19"/>
        <vers num="3.10.2"/>
        <vers num="3.10.20"/>
        <vers num="3.10.21"/>
        <vers num="3.10.22"/>
        <vers num="3.10.23"/>
        <vers num="3.10.24"/>
        <vers num="3.10.25"/>
        <vers num="3.10.26"/>
        <vers num="3.10.27"/>
        <vers num="3.10.28"/>
        <vers num="3.10.29"/>
        <vers num="3.10.3"/>
        <vers num="3.10.4"/>
        <vers num="3.10.5"/>
        <vers num="3.10.6"/>
        <vers num="3.10.7"/>
        <vers num="3.10.8"/>
        <vers num="3.10.9"/>
        <vers num="3.11"/>
        <vers num="3.11.1"/>
        <vers num="3.11.10"/>
        <vers num="3.11.2"/>
        <vers num="3.11.3"/>
        <vers num="3.11.4"/>
        <vers num="3.11.5"/>
        <vers num="3.11.6"/>
        <vers num="3.11.7"/>
        <vers num="3.11.8"/>
        <vers num="3.11.9"/>
        <vers num="3.12"/>
        <vers num="3.12.1"/>
        <vers num="3.12.10"/>
        <vers num="3.12.2"/>
        <vers num="3.12.3"/>
        <vers num="3.12.4"/>
        <vers num="3.12.5"/>
        <vers num="3.12.6"/>
        <vers num="3.12.7"/>
        <vers num="3.12.8"/>
        <vers num="3.12.9"/>
        <vers num="3.13"/>
        <vers prev="1" num="3.13.1"/>
        <vers num="3.2" edition="rc2"/>
        <vers num="3.2" edition="rc3"/>
        <vers num="3.2" edition="rc4"/>
        <vers num="3.2" edition="rc5"/>
        <vers num="3.2" edition="rc6"/>
        <vers num="3.2" edition="rc7"/>
        <vers num="3.2.1"/>
        <vers num="3.2.10"/>
        <vers num="3.2.11"/>
        <vers num="3.2.12"/>
        <vers num="3.2.13"/>
        <vers num="3.2.14"/>
        <vers num="3.2.15"/>
        <vers num="3.2.16"/>
        <vers num="3.2.17"/>
        <vers num="3.2.18"/>
        <vers num="3.2.19"/>
        <vers num="3.2.2"/>
        <vers num="3.2.20"/>
        <vers num="3.2.21"/>
        <vers num="3.2.22"/>
        <vers num="3.2.23"/>
        <vers num="3.2.24"/>
        <vers num="3.2.25"/>
        <vers num="3.2.26"/>
        <vers num="3.2.27"/>
        <vers num="3.2.28"/>
        <vers num="3.2.29"/>
        <vers num="3.2.3"/>
        <vers num="3.2.30"/>
        <vers num="3.2.4"/>
        <vers num="3.2.5"/>
        <vers num="3.2.6"/>
        <vers num="3.2.7"/>
        <vers num="3.2.8"/>
        <vers num="3.2.9"/>
        <vers num="3.3" edition="rc1"/>
        <vers num="3.3" edition="rc2"/>
        <vers num="3.3" edition="rc3"/>
        <vers num="3.3" edition="rc4"/>
        <vers num="3.3" edition="rc5"/>
        <vers num="3.3" edition="rc6"/>
        <vers num="3.3" edition="rc7"/>
        <vers num="3.3.1"/>
        <vers num="3.3.2"/>
        <vers num="3.3.3"/>
        <vers num="3.3.4"/>
        <vers num="3.3.5"/>
        <vers num="3.3.6"/>
        <vers num="3.3.7"/>
        <vers num="3.3.8"/>
        <vers num="3.4" edition="rc1"/>
        <vers num="3.4" edition="rc2"/>
        <vers num="3.4" edition="rc3"/>
        <vers num="3.4" edition="rc4"/>
        <vers num="3.4" edition="rc5"/>
        <vers num="3.4" edition="rc6"/>
        <vers num="3.4" edition="rc7"/>
        <vers num="3.4.1"/>
        <vers num="3.4.10"/>
        <vers num="3.4.11"/>
        <vers num="3.4.12"/>
        <vers num="3.4.13"/>
        <vers num="3.4.14"/>
        <vers num="3.4.15"/>
        <vers num="3.4.16"/>
        <vers num="3.4.17"/>
        <vers num="3.4.18"/>
        <vers num="3.4.19"/>
        <vers num="3.4.2"/>
        <vers num="3.4.20"/>
        <vers num="3.4.21"/>
        <vers num="3.4.22"/>
        <vers num="3.4.23"/>
        <vers num="3.4.24"/>
        <vers num="3.4.25"/>
        <vers num="3.4.26"/>
        <vers num="3.4.27"/>
        <vers num="3.4.28"/>
        <vers num="3.4.29"/>
        <vers num="3.4.3"/>
        <vers num="3.4.30"/>
        <vers num="3.4.31"/>
        <vers num="3.4.32"/>
        <vers num="3.4.4"/>
        <vers num="3.4.5"/>
        <vers num="3.4.6"/>
        <vers num="3.4.7"/>
        <vers num="3.4.8"/>
        <vers num="3.4.9"/>
        <vers num="3.5.1"/>
        <vers num="3.5.2"/>
        <vers num="3.5.3"/>
        <vers num="3.5.4"/>
        <vers num="3.5.5"/>
        <vers num="3.5.6"/>
        <vers num="3.5.7"/>
        <vers num="3.6"/>
        <vers num="3.6.1"/>
        <vers num="3.6.10"/>
        <vers num="3.6.11"/>
        <vers num="3.6.2"/>
        <vers num="3.6.3"/>
        <vers num="3.6.4"/>
        <vers num="3.6.5"/>
        <vers num="3.6.6"/>
        <vers num="3.6.7"/>
        <vers num="3.6.8"/>
        <vers num="3.6.9"/>
        <vers num="3.7"/>
        <vers num="3.7.1"/>
        <vers num="3.7.10"/>
        <vers num="3.7.2"/>
        <vers num="3.7.3"/>
        <vers num="3.7.4"/>
        <vers num="3.7.5"/>
        <vers num="3.7.6"/>
        <vers num="3.7.7"/>
        <vers num="3.7.8"/>
        <vers num="3.7.9"/>
        <vers num="3.8.0"/>
        <vers num="3.8.1"/>
        <vers num="3.8.10"/>
        <vers num="3.8.11"/>
        <vers num="3.8.12"/>
        <vers num="3.8.13"/>
        <vers num="3.8.2"/>
        <vers num="3.8.3"/>
        <vers num="3.8.4"/>
        <vers num="3.8.5"/>
        <vers num="3.8.6"/>
        <vers num="3.8.7"/>
        <vers num="3.8.8"/>
        <vers num="3.8.9"/>
        <vers num="3.9" edition="rc1"/>
        <vers num="3.9" edition="rc2"/>
        <vers num="3.9" edition="rc3"/>
        <vers num="3.9" edition="rc4"/>
        <vers num="3.9" edition="rc5"/>
        <vers num="3.9" edition="rc6"/>
        <vers num="3.9" edition="rc7"/>
        <vers num="3.9.0"/>
        <vers num="3.9.1"/>
        <vers num="3.9.10"/>
        <vers num="3.9.11"/>
        <vers num="3.9.2"/>
        <vers num="3.9.3"/>
        <vers num="3.9.4"/>
        <vers num="3.9.5"/>
        <vers num="3.9.6"/>
        <vers num="3.9.7"/>
        <vers num="3.9.8"/>
        <vers num="3.9.9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0039" published="2014-02-07" name="CVE-2014-0039" modified="2014-02-21" CVSS_version="2.0" CVSS_vector="(AV:L/AC:M/Au:N/C:P/I:P/A:P)" CVSS_score="4.4" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="3.4" CVSS_base_score="4.4">
    <desc>
      <descript source="cve">Untrusted search path vulnerability in fwsnort before 1.6.4, when not running as root, allows local users to execute arbitrary code via a Trojan horse fwsnort.conf in the current working directory.</descript>
      <descript source="nvd">Per: http://cwe.mitre.org/data/definitions/426.html

"CWE-426: Untrusted Search Path"</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="https://github.com/mrash/fwsnort/commit/fa977453120cc48e1654f373311f9cac468d3348" source="CONFIRM" patch="1">https://github.com/mrash/fwsnort/commit/fa977453120cc48e1654f373311f9cac468d3348</ref>
      <ref url="https://github.com/mrash/fwsnort/blob/master/ChangeLog" source="CONFIRM">https://github.com/mrash/fwsnort/blob/master/ChangeLog</ref>
      <ref url="http://www.securityfocus.com/bid/65341" source="BID">65341</ref>
      <ref url="http://seclists.org/oss-sec/2014/q1/221" source="MLIST">[oss-security] 20140203 CVE-2014-0039: fwsnort loaded configuration file from cwd when run as a non-root user</ref>
      <ref url="http://osvdb.org/102822" source="OSVDB">102822</ref>
      <ref url="http://lists.fedoraproject.org/pipermail/package-announce/2014-February/128205.html" source="FEDORA">FEDORA-2014-1972</ref>
      <ref url="http://lists.fedoraproject.org/pipermail/package-announce/2014-February/128188.html" source="FEDORA">FEDORA-2014-1975</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cipherdyne" name="fwsnort">
        <vers num="0.5"/>
        <vers num="0.6"/>
        <vers num="0.6.1"/>
        <vers num="0.6.2"/>
        <vers num="0.6.3"/>
        <vers num="0.6.4"/>
        <vers num="0.6.5"/>
        <vers num="0.7.0"/>
        <vers num="0.8.0"/>
        <vers num="0.8.1"/>
        <vers num="0.8.2"/>
        <vers num="0.9.0"/>
        <vers num="1.0"/>
        <vers num="1.0.1"/>
        <vers num="1.0.2"/>
        <vers num="1.0.3"/>
        <vers num="1.0.4"/>
        <vers num="1.0.5"/>
        <vers num="1.0.6"/>
        <vers num="1.5"/>
        <vers num="1.6"/>
        <vers num="1.6.1"/>
        <vers num="1.6.2"/>
        <vers num="1.6.3"/>
        <vers prev="1" num="1.6.4"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0044" published="2014-02-07" name="CVE-2014-0044" modified="2014-03-05" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:P)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">The opus_packet_get_samples_per_frame function in client in Mumble 1.2.4 and the 1.2.3 pre-release snapshots allows remote attackers to cause a denial of service (crash) via a crafted length prefix value, which triggers a NULL pointer dereference or a heap-based buffer over-read (aka "out-of-bounds array access").</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.debian.org/security/2014/dsa-2854" source="DEBIAN">DSA-2854</ref>
      <ref url="http://osvdb.org/102904" source="OSVDB">102904</ref>
      <ref url="http://mumble.info/security/Mumble-SA-2014-001.txt" source="CONFIRM" adv="1">http://mumble.info/security/Mumble-SA-2014-001.txt</ref>
      <ref url="http://lists.opensuse.org/opensuse-updates/2014-02/msg00063.html" source="SUSE">openSUSE-SU-2014:0271</ref>
    </refs>
    <vuln_soft>
      <prod vendor="light_speed_gaming" name="mumble">
        <vers num="1.2.3" edition="rc1"/>
        <vers num="1.2.3" edition="rc2"/>
        <vers num="1.2.3" edition="rc3"/>
        <vers num="1.2.4"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0045" published="2014-02-07" name="CVE-2014-0045" modified="2014-03-05" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">The needSamples method in AudioOutputSpeech.cpp in the client in Mumble 1.2.4 and the 1.2.3 pre-release snapshots, Mumble for iOS 1.1 through 1.2.2, and MumbleKit before commit fd190328a9b24d37382b269a5674b0c0c7a7e36d does not check the return value of the opus_decode_float function, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted Opus voice packet, which triggers an error in opus_decode_float, a conversion of a negative integer to an unsigned integer, and a heap-based buffer over-read and over-write.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.debian.org/security/2014/dsa-2854" source="DEBIAN">DSA-2854</ref>
      <ref url="http://osvdb.org/102958" source="OSVDB">102958</ref>
      <ref url="http://osvdb.org/102905" source="OSVDB">102905</ref>
      <ref url="http://mumble.info/security/Mumble-SA-2014-004.txt" source="CONFIRM" adv="1">http://mumble.info/security/Mumble-SA-2014-004.txt</ref>
      <ref url="http://mumble.info/security/Mumble-SA-2014-002.txt" source="CONFIRM">http://mumble.info/security/Mumble-SA-2014-002.txt</ref>
      <ref url="http://lists.opensuse.org/opensuse-updates/2014-02/msg00063.html" source="SUSE">openSUSE-SU-2014:0271</ref>
    </refs>
    <vuln_soft>
      <prod vendor="light_speed_gaming" name="mumble">
        <vers num="1.1" edition=":~~~iphone_os~~"/>
        <vers num="1.1" edition="rc1:~~~iphone_os~~"/>
        <vers num="1.1.1" edition=":~~~iphone_os~~"/>
        <vers num="1.2" edition=":~~~iphone_os~~"/>
        <vers num="1.2.1" edition=":~~~iphone_os~~"/>
        <vers num="1.2.2" edition=":~~~iphone_os~~"/>
        <vers num="1.2.3" edition="rc1"/>
        <vers num="1.2.3" edition="rc2"/>
        <vers num="1.2.3" edition="rc3"/>
        <vers num="1.2.4"/>
      </prod>
      <prod vendor="light_speed_gaming" name="mumblekit">
        <vers num="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-0046" published="2014-02-27" name="CVE-2014-0046" modified="2014-03-05" CVSS_version="2.0" CVSS_vector="(AV:N/AC:H/Au:N/C:N/I:P/A:N)" CVSS_score="2.6" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="4.9" CVSS_base_score="2.6">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in the link-to helper in Ember.js 1.2.x before 1.2.2, 1.3.x before 1.3.2, and 1.4.x before 1.4.0-beta.6, when used in non-block form, allows remote attackers to inject arbitrary web script or HTML via the title attribute.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="https://groups.google.com/forum/#%21topic/ember-security/1h6FRgr8lXQ" source="CONFIRM">https://groups.google.com/forum/#!topic/ember-security/1h6FRgr8lXQ</ref>
      <ref url="http://xforce.iss.net/xforce/xfdb/91242" source="XF">emberjs-linkto-xss(91242)</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/02/14/6" source="MLIST">[oss-security] 20140214 [CVE-2014-0046] XSS Vulnerability With {{link-to}} Helper in Non-block Form</ref>
      <ref url="http://secunia.com/advisories/56965" source="SECUNIA" adv="1">56965</ref>
      <ref url="http://emberjs.com/blog/2014/02/07/ember-security-releases.html" source="CONFIRM" adv="1">http://emberjs.com/blog/2014/02/07/ember-security-releases.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="emberjs" name="ember.js">
        <vers num="1.2.0"/>
        <vers num="1.2.1"/>
        <vers num="1.3.0"/>
        <vers num="1.3.1"/>
        <vers num="1.4.0" edition="beta"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0049" published="2014-03-11" name="CVE-2014-0049" modified="2014-03-11" CVSS_version="2.0" CVSS_vector="(AV:A/AC:M/Au:S/C:C/I:C/A:C)" CVSS_score="7.4" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="4.4" CVSS_base_score="7.4">
    <desc>
      <descript source="cve">Buffer overflow in the complete_emulated_mmio function in arch/x86/kvm/x86.c in the Linux kernel before 3.13.6 allows guest OS users to execute arbitrary code on the host OS by leveraging a loop that triggers an invalid memory copy affecting certain cancel_work_item data.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <local_network/>
    </range>
    <refs>
      <ref url="http://www.openwall.com/lists/oss-security/2014/03/03/1" source="MLIST" patch="1">[oss-security] 20140303 CVE-2014-0049 -- Linux kernel: kvm: mmio_fragments out-of-the-bounds access</ref>
      <ref url="https://github.com/torvalds/linux/commit/a08d3b3b99efd509133946056531cdf8f3a0c09b" source="CONFIRM">https://github.com/torvalds/linux/commit/a08d3b3b99efd509133946056531cdf8f3a0c09b</ref>
      <ref url="https://bugzilla.redhat.com/show_bug.cgi?id=1062368" source="CONFIRM">https://bugzilla.redhat.com/show_bug.cgi?id=1062368</ref>
      <ref url="http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.13.6" source="CONFIRM" adv="1">http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.13.6</ref>
      <ref url="http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=a08d3b3b99efd509133946056531cdf8f3a0c09b" source="CONFIRM">http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=a08d3b3b99efd509133946056531cdf8f3a0c09b</ref>
    </refs>
    <vuln_soft>
      <prod vendor="linux" name="linux_kernel">
        <vers num="3.0" edition="rc1"/>
        <vers num="3.0" edition="rc2"/>
        <vers num="3.0" edition="rc3"/>
        <vers num="3.0" edition="rc4"/>
        <vers num="3.0" edition="rc5"/>
        <vers num="3.0" edition="rc6"/>
        <vers num="3.0" edition="rc7"/>
        <vers num="3.0.1"/>
        <vers num="3.0.10"/>
        <vers num="3.0.11"/>
        <vers num="3.0.12"/>
        <vers num="3.0.13"/>
        <vers num="3.0.14"/>
        <vers num="3.0.15"/>
        <vers num="3.0.16"/>
        <vers num="3.0.17"/>
        <vers num="3.0.18"/>
        <vers num="3.0.19"/>
        <vers num="3.0.2"/>
        <vers num="3.0.20"/>
        <vers num="3.0.21"/>
        <vers num="3.0.22"/>
        <vers num="3.0.23"/>
        <vers num="3.0.24"/>
        <vers num="3.0.25"/>
        <vers num="3.0.26"/>
        <vers num="3.0.27"/>
        <vers num="3.0.28"/>
        <vers num="3.0.29"/>
        <vers num="3.0.3"/>
        <vers num="3.0.30"/>
        <vers num="3.0.31"/>
        <vers num="3.0.32"/>
        <vers num="3.0.33"/>
        <vers num="3.0.34"/>
        <vers num="3.0.35"/>
        <vers num="3.0.36"/>
        <vers num="3.0.37"/>
        <vers num="3.0.38"/>
        <vers num="3.0.39"/>
        <vers num="3.0.4"/>
        <vers num="3.0.40"/>
        <vers num="3.0.41"/>
        <vers num="3.0.42"/>
        <vers num="3.0.43"/>
        <vers num="3.0.44"/>
        <vers num="3.0.45"/>
        <vers num="3.0.46"/>
        <vers num="3.0.47"/>
        <vers num="3.0.48"/>
        <vers num="3.0.49"/>
        <vers num="3.0.5"/>
        <vers num="3.0.50"/>
        <vers num="3.0.51"/>
        <vers num="3.0.52"/>
        <vers num="3.0.53"/>
        <vers num="3.0.54"/>
        <vers num="3.0.55"/>
        <vers num="3.0.56"/>
        <vers num="3.0.57"/>
        <vers num="3.0.58"/>
        <vers num="3.0.59"/>
        <vers num="3.0.6"/>
        <vers num="3.0.60"/>
        <vers num="3.0.61"/>
        <vers num="3.0.62"/>
        <vers num="3.0.63"/>
        <vers num="3.0.64"/>
        <vers num="3.0.65"/>
        <vers num="3.0.66"/>
        <vers num="3.0.67"/>
        <vers num="3.0.68"/>
        <vers num="3.0.7"/>
        <vers num="3.0.8"/>
        <vers num="3.0.9"/>
        <vers num="3.1" edition="rc1"/>
        <vers num="3.1" edition="rc2"/>
        <vers num="3.1" edition="rc3"/>
        <vers num="3.1" edition="rc4"/>
        <vers num="3.1.1"/>
        <vers num="3.1.10"/>
        <vers num="3.1.2"/>
        <vers num="3.1.3"/>
        <vers num="3.1.4"/>
        <vers num="3.1.5"/>
        <vers num="3.1.6"/>
        <vers num="3.1.7"/>
        <vers num="3.1.8"/>
        <vers num="3.1.9"/>
        <vers num="3.10"/>
        <vers num="3.10.1"/>
        <vers num="3.10.10"/>
        <vers num="3.10.11"/>
        <vers num="3.10.12"/>
        <vers num="3.10.13"/>
        <vers num="3.10.14"/>
        <vers num="3.10.15"/>
        <vers num="3.10.16"/>
        <vers num="3.10.17"/>
        <vers num="3.10.18"/>
        <vers num="3.10.19"/>
        <vers num="3.10.2"/>
        <vers num="3.10.20"/>
        <vers num="3.10.21"/>
        <vers num="3.10.22"/>
        <vers num="3.10.23"/>
        <vers num="3.10.24"/>
        <vers num="3.10.25"/>
        <vers num="3.10.26"/>
        <vers num="3.10.27"/>
        <vers num="3.10.28"/>
        <vers num="3.10.29"/>
        <vers num="3.10.3"/>
        <vers num="3.10.4"/>
        <vers num="3.10.5"/>
        <vers num="3.10.6"/>
        <vers num="3.10.7"/>
        <vers num="3.10.8"/>
        <vers num="3.10.9"/>
        <vers num="3.11"/>
        <vers num="3.11.1"/>
        <vers num="3.11.10"/>
        <vers num="3.11.2"/>
        <vers num="3.11.3"/>
        <vers num="3.11.4"/>
        <vers num="3.11.5"/>
        <vers num="3.11.6"/>
        <vers num="3.11.7"/>
        <vers num="3.11.8"/>
        <vers num="3.11.9"/>
        <vers num="3.12"/>
        <vers num="3.12.1"/>
        <vers num="3.12.10"/>
        <vers num="3.12.11"/>
        <vers num="3.12.12"/>
        <vers num="3.12.13"/>
        <vers num="3.12.2"/>
        <vers num="3.12.3"/>
        <vers num="3.12.4"/>
        <vers num="3.12.5"/>
        <vers num="3.12.6"/>
        <vers num="3.12.7"/>
        <vers num="3.12.8"/>
        <vers num="3.12.9"/>
        <vers num="3.13"/>
        <vers num="3.13.1"/>
        <vers num="3.13.2"/>
        <vers num="3.13.3"/>
        <vers num="3.13.4"/>
        <vers prev="1" num="3.13.5"/>
        <vers num="3.2" edition="rc2"/>
        <vers num="3.2" edition="rc3"/>
        <vers num="3.2" edition="rc4"/>
        <vers num="3.2" edition="rc5"/>
        <vers num="3.2" edition="rc6"/>
        <vers num="3.2" edition="rc7"/>
        <vers num="3.2.1"/>
        <vers num="3.2.10"/>
        <vers num="3.2.11"/>
        <vers num="3.2.12"/>
        <vers num="3.2.13"/>
        <vers num="3.2.14"/>
        <vers num="3.2.15"/>
        <vers num="3.2.16"/>
        <vers num="3.2.17"/>
        <vers num="3.2.18"/>
        <vers num="3.2.19"/>
        <vers num="3.2.2"/>
        <vers num="3.2.20"/>
        <vers num="3.2.21"/>
        <vers num="3.2.22"/>
        <vers num="3.2.23"/>
        <vers num="3.2.24"/>
        <vers num="3.2.25"/>
        <vers num="3.2.26"/>
        <vers num="3.2.27"/>
        <vers num="3.2.28"/>
        <vers num="3.2.29"/>
        <vers num="3.2.3"/>
        <vers num="3.2.30"/>
        <vers num="3.2.4"/>
        <vers num="3.2.5"/>
        <vers num="3.2.6"/>
        <vers num="3.2.7"/>
        <vers num="3.2.8"/>
        <vers num="3.2.9"/>
        <vers num="3.3" edition="rc1"/>
        <vers num="3.3" edition="rc2"/>
        <vers num="3.3" edition="rc3"/>
        <vers num="3.3" edition="rc4"/>
        <vers num="3.3" edition="rc5"/>
        <vers num="3.3" edition="rc6"/>
        <vers num="3.3" edition="rc7"/>
        <vers num="3.3.1"/>
        <vers num="3.3.2"/>
        <vers num="3.3.3"/>
        <vers num="3.3.4"/>
        <vers num="3.3.5"/>
        <vers num="3.3.6"/>
        <vers num="3.3.7"/>
        <vers num="3.3.8"/>
        <vers num="3.4" edition="rc1"/>
        <vers num="3.4" edition="rc2"/>
        <vers num="3.4" edition="rc3"/>
        <vers num="3.4" edition="rc4"/>
        <vers num="3.4" edition="rc5"/>
        <vers num="3.4" edition="rc6"/>
        <vers num="3.4" edition="rc7"/>
        <vers num="3.4.1"/>
        <vers num="3.4.10"/>
        <vers num="3.4.11"/>
        <vers num="3.4.12"/>
        <vers num="3.4.13"/>
        <vers num="3.4.14"/>
        <vers num="3.4.15"/>
        <vers num="3.4.16"/>
        <vers num="3.4.17"/>
        <vers num="3.4.18"/>
        <vers num="3.4.19"/>
        <vers num="3.4.2"/>
        <vers num="3.4.20"/>
        <vers num="3.4.21"/>
        <vers num="3.4.22"/>
        <vers num="3.4.23"/>
        <vers num="3.4.24"/>
        <vers num="3.4.25"/>
        <vers num="3.4.26"/>
        <vers num="3.4.27"/>
        <vers num="3.4.28"/>
        <vers num="3.4.29"/>
        <vers num="3.4.3"/>
        <vers num="3.4.30"/>
        <vers num="3.4.31"/>
        <vers num="3.4.32"/>
        <vers num="3.4.33"/>
        <vers num="3.4.34"/>
        <vers num="3.4.35"/>
        <vers num="3.4.36"/>
        <vers num="3.4.37"/>
        <vers num="3.4.38"/>
        <vers num="3.4.39"/>
        <vers num="3.4.4"/>
        <vers num="3.4.40"/>
        <vers num="3.4.41"/>
        <vers num="3.4.42"/>
        <vers num="3.4.43"/>
        <vers num="3.4.44"/>
        <vers num="3.4.45"/>
        <vers num="3.4.46"/>
        <vers num="3.4.47"/>
        <vers num="3.4.48"/>
        <vers num="3.4.49"/>
        <vers num="3.4.5"/>
        <vers num="3.4.50"/>
        <vers num="3.4.51"/>
        <vers num="3.4.52"/>
        <vers num="3.4.53"/>
        <vers num="3.4.54"/>
        <vers num="3.4.55"/>
        <vers num="3.4.56"/>
        <vers num="3.4.57"/>
        <vers num="3.4.58"/>
        <vers num="3.4.59"/>
        <vers num="3.4.6"/>
        <vers num="3.4.60"/>
        <vers num="3.4.61"/>
        <vers num="3.4.62"/>
        <vers num="3.4.63"/>
        <vers num="3.4.64"/>
        <vers num="3.4.65"/>
        <vers num="3.4.66"/>
        <vers num="3.4.67"/>
        <vers num="3.4.68"/>
        <vers num="3.4.69"/>
        <vers num="3.4.7"/>
        <vers num="3.4.70"/>
        <vers num="3.4.71"/>
        <vers num="3.4.72"/>
        <vers num="3.4.73"/>
        <vers num="3.4.74"/>
        <vers num="3.4.75"/>
        <vers num="3.4.76"/>
        <vers num="3.4.77"/>
        <vers num="3.4.78"/>
        <vers num="3.4.79"/>
        <vers num="3.4.8"/>
        <vers num="3.4.9"/>
        <vers num="3.5.1"/>
        <vers num="3.5.2"/>
        <vers num="3.5.3"/>
        <vers num="3.5.4"/>
        <vers num="3.5.5"/>
        <vers num="3.5.6"/>
        <vers num="3.5.7"/>
        <vers num="3.6"/>
        <vers num="3.6.1"/>
        <vers num="3.6.10"/>
        <vers num="3.6.11"/>
        <vers num="3.6.2"/>
        <vers num="3.6.3"/>
        <vers num="3.6.4"/>
        <vers num="3.6.5"/>
        <vers num="3.6.6"/>
        <vers num="3.6.7"/>
        <vers num="3.6.8"/>
        <vers num="3.6.9"/>
        <vers num="3.7"/>
        <vers num="3.7.1"/>
        <vers num="3.7.10"/>
        <vers num="3.7.2"/>
        <vers num="3.7.3"/>
        <vers num="3.7.4"/>
        <vers num="3.7.5"/>
        <vers num="3.7.6"/>
        <vers num="3.7.7"/>
        <vers num="3.7.8"/>
        <vers num="3.7.9"/>
        <vers num="3.8.0"/>
        <vers num="3.8.1"/>
        <vers num="3.8.10"/>
        <vers num="3.8.11"/>
        <vers num="3.8.12"/>
        <vers num="3.8.13"/>
        <vers num="3.8.2"/>
        <vers num="3.8.3"/>
        <vers num="3.8.4"/>
        <vers num="3.8.5"/>
        <vers num="3.8.6"/>
        <vers num="3.8.7"/>
        <vers num="3.8.8"/>
        <vers num="3.8.9"/>
        <vers num="3.9" edition="rc1"/>
        <vers num="3.9" edition="rc2"/>
        <vers num="3.9" edition="rc3"/>
        <vers num="3.9" edition="rc4"/>
        <vers num="3.9" edition="rc5"/>
        <vers num="3.9" edition="rc6"/>
        <vers num="3.9" edition="rc7"/>
        <vers num="3.9.0"/>
        <vers num="3.9.1"/>
        <vers num="3.9.10"/>
        <vers num="3.9.11"/>
        <vers num="3.9.2"/>
        <vers num="3.9.3"/>
        <vers num="3.9.4"/>
        <vers num="3.9.5"/>
        <vers num="3.9.6"/>
        <vers num="3.9.7"/>
        <vers num="3.9.8"/>
        <vers num="3.9.9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0050" published="2014-04-01" name="CVE-2014-0050" modified="2014-04-24" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:P)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a loop's intended exit conditions.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://tomcat.apache.org/security-8.html" source="CONFIRM" patch="1" adv="1">http://tomcat.apache.org/security-8.html</ref>
      <ref url="http://tomcat.apache.org/security-7.html" source="CONFIRM" patch="1" adv="1">http://tomcat.apache.org/security-7.html</ref>
      <ref url="http://svn.apache.org/r1565143" source="CONFIRM" patch="1">http://svn.apache.org/r1565143</ref>
      <ref url="https://bugzilla.redhat.com/show_bug.cgi?id=1062337" source="CONFIRM">https://bugzilla.redhat.com/show_bug.cgi?id=1062337</ref>
      <ref url="http://secunia.com/advisories/57915" source="SECUNIA">57915</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0400.html" source="REDHAT">RHSA-2014:0400</ref>
      <ref url="http://mail-archives.apache.org/mod_mbox/commons-dev/201402.mbox/%3C52F373FC.9030907@apache.org%3E" source="MLIST">[commons-dev] 20140206 [SECURITY] CVE-2014-0050 Apache Commons FileUpload and Apache Tomcat DoS</ref>
      <ref url="http://jvndb.jvn.jp/jvndb/JVNDB-2014-000017" source="JVNDB">JVNDB-2014-000017</ref>
      <ref url="http://jvn.jp/en/jp/JVN14876762/index.html" source="JVN">JVN#14876762</ref>
      <ref url="http://blog.spiderlabs.com/2014/02/cve-2014-0050-exploit-with-boundaries-loops-without-boundaries.html" source="MISC">http://blog.spiderlabs.com/2014/02/cve-2014-0050-exploit-with-boundaries-loops-without-boundaries.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="apache" name="commons_fileupload">
        <vers num="1.0"/>
        <vers num="1.1"/>
        <vers num="1.1.1"/>
        <vers num="1.2"/>
        <vers num="1.2.1"/>
        <vers num="1.2.2"/>
        <vers num="1.3"/>
        <vers prev="1" num="1.3.1"/>
      </prod>
      <prod vendor="apache" name="tomcat">
        <vers num="7.0.0" edition="beta"/>
        <vers num="7.0.1"/>
        <vers num="7.0.10"/>
        <vers num="7.0.11"/>
        <vers num="7.0.12"/>
        <vers num="7.0.13"/>
        <vers num="7.0.14"/>
        <vers num="7.0.15"/>
        <vers num="7.0.16"/>
        <vers num="7.0.17"/>
        <vers num="7.0.18"/>
        <vers num="7.0.19"/>
        <vers num="7.0.2" edition="beta"/>
        <vers num="7.0.20"/>
        <vers num="7.0.21"/>
        <vers num="7.0.22"/>
        <vers num="7.0.23"/>
        <vers num="7.0.24"/>
        <vers num="7.0.25"/>
        <vers num="7.0.26"/>
        <vers num="7.0.27"/>
        <vers num="7.0.28"/>
        <vers num="7.0.29"/>
        <vers num="7.0.3"/>
        <vers num="7.0.30"/>
        <vers num="7.0.31"/>
        <vers num="7.0.32"/>
        <vers num="7.0.33"/>
        <vers num="7.0.34"/>
        <vers num="7.0.35"/>
        <vers num="7.0.36"/>
        <vers num="7.0.37"/>
        <vers num="7.0.38"/>
        <vers num="7.0.39"/>
        <vers num="7.0.4" edition="beta"/>
        <vers num="7.0.40"/>
        <vers num="7.0.41"/>
        <vers num="7.0.42"/>
        <vers num="7.0.43"/>
        <vers num="7.0.44"/>
        <vers num="7.0.45"/>
        <vers num="7.0.46"/>
        <vers num="7.0.47"/>
        <vers num="7.0.48"/>
        <vers num="7.0.49"/>
        <vers num="7.0.5"/>
        <vers num="7.0.50"/>
        <vers num="7.0.6"/>
        <vers num="7.0.7"/>
        <vers num="7.0.8"/>
        <vers num="7.0.9"/>
        <vers num="8.0.0" edition="rc1"/>
        <vers num="8.0.0" edition="rc10"/>
        <vers num="8.0.0" edition="rc2"/>
        <vers num="8.0.0" edition="rc5"/>
        <vers num="8.0.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0053" published="2014-04-15" name="CVE-2014-0053" modified="2014-04-22" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:N/A:N)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">The default configuration of the Resources plugin 1.0.0 before 1.2.6 for Pivotal Grails 2.0.0 before 2.3.6 does not properly restrict access to files in the WEB-INF directory, which allows remote attackers to obtain sensitive information via a direct request.  NOTE: this identifier has been SPLIT due to different researchers and different vulnerability types. See CVE-2014-2857 for the META-INF variant and CVE-2014-2858 for the directory traversal.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://twitter.com/Ramsharan065/status/434975409134792704" source="MISC">https://twitter.com/Ramsharan065/status/434975409134792704</ref>
      <ref url="http://xforce.iss.net/xforce/xfdb/91270" source="XF">grails-cve20140053-info-disc(91270)</ref>
      <ref url="http://www.securityfocus.com/bid/65678" source="BID">65678</ref>
      <ref url="http://www.securityfocus.com/archive/1/archive/1/531281/100/0/threaded" source="BUGTRAQ">20140227 Update: CVE-2014-0053 Information Disclosure when using Grails</ref>
      <ref url="http://www.gopivotal.com/security/cve-2014-0053" source="CONFIRM">http://www.gopivotal.com/security/cve-2014-0053</ref>
      <ref url="http://secunia.com/advisories/56841" source="SECUNIA" adv="1">56841</ref>
      <ref url="http://archives.neohapsis.com/archives/fulldisclosure/2014-02/0267.html" source="FULLDISC">20140227 Update: CVE-2014-0053 Information Disclosure when using Grails</ref>
      <ref url="http://archives.neohapsis.com/archives/fulldisclosure/2014-02/0194.html" source="FULLDISC">20140219 CVE-2014-0053 Information Disclosure when using Grails</ref>
    </refs>
    <vuln_soft>
      <prod vendor="gopivotal" name="grails">
        <vers num="2.0.0"/>
        <vers num="2.0.1"/>
        <vers num="2.0.2"/>
        <vers num="2.0.3"/>
        <vers num="2.0.4"/>
        <vers num="2.1.0"/>
        <vers num="2.1.1"/>
        <vers num="2.1.2"/>
        <vers num="2.1.3"/>
        <vers num="2.1.4"/>
        <vers num="2.1.5"/>
        <vers num="2.2.0"/>
        <vers num="2.2.1"/>
        <vers num="2.2.2"/>
        <vers num="2.2.3"/>
        <vers num="2.2.4"/>
        <vers num="2.2.5"/>
        <vers num="2.3.0"/>
        <vers num="2.3.1"/>
        <vers num="2.3.2"/>
        <vers num="2.3.3"/>
        <vers num="2.3.4"/>
        <vers num="2.3.5"/>
      </prod>
      <prod vendor="gopivotal" name="grails-resources">
        <vers num="1.0.0"/>
        <vers num="1.0.2"/>
        <vers num="1.1.0"/>
        <vers num="1.1.1"/>
        <vers num="1.1.2"/>
        <vers num="1.1.4"/>
        <vers num="1.1.5"/>
        <vers num="1.1.6"/>
        <vers num="1.2.0"/>
        <vers num="1.2.1"/>
        <vers num="1.2.2"/>
        <vers num="1.2.3"/>
        <vers num="1.2.4"/>
        <vers num="1.2.5"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0054" published="2014-04-17" name="CVE-2014-0054" modified="2014-04-18" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:P)" CVSS_score="6.8" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.6" CVSS_base_score="6.8">
    <desc>
      <descript source="cve">The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4152, CVE-2013-7315, and CVE-2013-6429.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="https://jira.spring.io/browse/SPR-11376" source="CONFIRM">https://jira.spring.io/browse/SPR-11376</ref>
      <ref url="http://secunia.com/advisories/57915" source="SECUNIA" adv="1">57915</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0400.html" source="REDHAT">RHSA-2014:0400</ref>
    </refs>
    <vuln_soft>
      <prod vendor="springsource" name="spring_framework">
        <vers num="3.0.0" edition="m1"/>
        <vers num="3.0.0" edition="m2"/>
        <vers num="3.0.0" edition="m3"/>
        <vers num="3.0.0" edition="m4"/>
        <vers num="3.0.0" edition="rc1"/>
        <vers num="3.0.0" edition="rc2"/>
        <vers num="3.0.0" edition="rc3"/>
        <vers num="3.0.0.m1"/>
        <vers num="3.0.0.m2"/>
        <vers num="3.0.1"/>
        <vers num="3.0.2"/>
        <vers num="3.0.3"/>
        <vers num="3.0.4"/>
        <vers num="3.0.5"/>
        <vers num="3.0.6"/>
        <vers num="3.0.7"/>
        <vers num="3.1.0"/>
        <vers num="3.1.1"/>
        <vers num="3.1.2"/>
        <vers num="3.1.3"/>
        <vers num="3.1.4"/>
        <vers num="3.2.0"/>
        <vers num="3.2.1"/>
        <vers num="3.2.2"/>
        <vers num="3.2.3"/>
        <vers num="3.2.4"/>
        <vers num="3.2.5"/>
        <vers num="3.2.6"/>
        <vers prev="1" num="3.2.7"/>
        <vers num="4.0.0" edition="m1"/>
        <vers num="4.0.0" edition="m2"/>
        <vers num="4.0.0" edition="rc1"/>
        <vers num="4.0.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0055" published="2014-03-26" name="CVE-2014-0055" modified="2014-04-19" CVSS_version="2.0" CVSS_vector="(AV:A/AC:L/Au:S/C:N/I:N/A:C)" CVSS_score="5.5" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="5.1" CVSS_base_score="5.5">
    <desc>
      <descript source="cve">The get_rx_bufs function in drivers/vhost/net.c in the vhost-net subsystem in the Linux kernel package before 2.6.32-431.11.2 on Red Hat Enterprise Linux (RHEL) 6 does not properly handle vhost_get_vq_desc errors, which allows guest OS users to cause a denial of service (host OS crash) via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <local_network/>
    </range>
    <refs>
      <ref url="https://bugzilla.redhat.com/show_bug.cgi?id=1062577" source="CONFIRM">https://bugzilla.redhat.com/show_bug.cgi?id=1062577</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0339.html" source="REDHAT">RHSA-2014:0339</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0328.html" source="REDHAT">RHSA-2014:0328</ref>
    </refs>
    <vuln_soft>
      <prod vendor="redhat" name="enterprise_linux">
        <vers num="6"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0057" published="2014-03-18" name="CVE-2014-0057" modified="2014-03-19" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">The x_button method in the ServiceController (vmdb/app/controllers/service_controller.rb) in Red Hat CloudForms 3.0 Management Engine 5.2 allows remote attackers to execute arbitrary methods via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://bugzilla.redhat.com/show_bug.cgi?id=1064140" source="CONFIRM">https://bugzilla.redhat.com/show_bug.cgi?id=1064140</ref>
      <ref url="http://secunia.com/advisories/57376" source="SECUNIA" adv="1">57376</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0215.html" source="REDHAT" adv="1">RHSA-2014:0215</ref>
    </refs>
    <vuln_soft>
      <prod vendor="redhat" name="cloudforms">
        <vers num="3.0"/>
      </prod>
      <prod vendor="redhat" name="cloudforms_3.0_management_engine">
        <vers num="5.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-0058" published="2014-02-26" name="CVE-2014-0058" modified="2014-02-27" CVSS_version="2.0" CVSS_vector="(AV:L/AC:M/Au:N/C:P/I:N/A:N)" CVSS_score="1.9" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="3.4" CVSS_base_score="1.9">
    <desc>
      <descript source="cve">The security audit functionality in Red Hat JBoss Enterprise Application Platform (EAP) 6.x before 6.2.1 logs request parameters in plaintext, which might allow local users to obtain passwords by reading the log files.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0205.html" source="REDHAT" adv="1">RHSA-2014:0205</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0204.html" source="REDHAT" adv="1">RHSA-2014:0204</ref>
    </refs>
    <vuln_soft>
      <prod vendor="redhat" name="jboss_enterprise_application_platform">
        <vers num="6.0.0"/>
        <vers num="6.0.1"/>
        <vers num="6.1.0"/>
        <vers num="6.2.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0060" published="2014-03-31" name="CVE-2014-0060" modified="2014-03-31" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:N/I:P/A:N)" CVSS_score="4.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.0" CVSS_base_score="4.0">
    <desc>
      <descript source="cve">PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 does not properly enforce the ADMIN OPTION restriction, which allows remote authenticated members of a role to add or remove arbitrary users to that role by calling the SET ROLE command before the associated GRANT command.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.postgresql.org/about/news/1506/" source="CONFIRM" adv="1">http://www.postgresql.org/about/news/1506/</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2865" source="DEBIAN">DSA-2865</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2864" source="DEBIAN">DSA-2864</ref>
      <ref url="http://wiki.postgresql.org/wiki/20140220securityrelease" source="CONFIRM" adv="1">http://wiki.postgresql.org/wiki/20140220securityrelease</ref>
    </refs>
    <vuln_soft>
      <prod vendor="postgresql" name="postgresql">
        <vers num="8.4.1"/>
        <vers num="8.4.10"/>
        <vers num="8.4.11"/>
        <vers num="8.4.12"/>
        <vers num="8.4.13"/>
        <vers num="8.4.14"/>
        <vers num="8.4.15"/>
        <vers num="8.4.16"/>
        <vers num="8.4.17"/>
        <vers num="8.4.18"/>
        <vers prev="1" num="8.4.19"/>
        <vers num="8.4.2"/>
        <vers num="8.4.3"/>
        <vers num="8.4.4"/>
        <vers num="8.4.5"/>
        <vers num="8.4.6"/>
        <vers num="8.4.7"/>
        <vers num="8.4.8"/>
        <vers num="8.4.9"/>
        <vers num="9.0"/>
        <vers num="9.0.1"/>
        <vers num="9.0.10"/>
        <vers num="9.0.11"/>
        <vers num="9.0.12"/>
        <vers num="9.0.13"/>
        <vers num="9.0.14"/>
        <vers num="9.0.15"/>
        <vers num="9.0.2"/>
        <vers num="9.0.3"/>
        <vers num="9.0.4"/>
        <vers num="9.0.5"/>
        <vers num="9.0.6"/>
        <vers num="9.0.7"/>
        <vers num="9.0.8"/>
        <vers num="9.0.9"/>
        <vers num="9.1"/>
        <vers num="9.1.1"/>
        <vers num="9.1.10"/>
        <vers num="9.1.11"/>
        <vers num="9.1.2"/>
        <vers num="9.1.3"/>
        <vers num="9.1.4"/>
        <vers num="9.1.5"/>
        <vers num="9.1.6"/>
        <vers num="9.1.7"/>
        <vers num="9.1.8"/>
        <vers num="9.1.9"/>
        <vers num="9.2"/>
        <vers num="9.2.1"/>
        <vers num="9.2.2"/>
        <vers num="9.2.3"/>
        <vers num="9.2.4"/>
        <vers num="9.2.5"/>
        <vers num="9.2.6"/>
        <vers num="9.3"/>
        <vers num="9.3.1"/>
        <vers num="9.3.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0061" published="2014-03-31" name="CVE-2014-0061" modified="2014-03-31" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:P/I:P/A:P)" CVSS_score="6.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.0" CVSS_base_score="6.5">
    <desc>
      <descript source="cve">The validator functions for the procedural languages (PLs) in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allow remote authenticated users to gain privileges via a function that is (1) defined in another language or (2) not allowed to be directly called by the user due to permissions.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.postgresql.org/about/news/1506/" source="CONFIRM" adv="1">http://www.postgresql.org/about/news/1506/</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2865" source="DEBIAN">DSA-2865</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2864" source="DEBIAN">DSA-2864</ref>
      <ref url="http://wiki.postgresql.org/wiki/20140220securityrelease" source="CONFIRM" adv="1">http://wiki.postgresql.org/wiki/20140220securityrelease</ref>
    </refs>
    <vuln_soft>
      <prod vendor="postgresql" name="postgresql">
        <vers num="8.4.1"/>
        <vers num="8.4.10"/>
        <vers num="8.4.11"/>
        <vers num="8.4.12"/>
        <vers num="8.4.13"/>
        <vers num="8.4.14"/>
        <vers num="8.4.15"/>
        <vers num="8.4.16"/>
        <vers num="8.4.17"/>
        <vers num="8.4.18"/>
        <vers prev="1" num="8.4.19"/>
        <vers num="8.4.2"/>
        <vers num="8.4.3"/>
        <vers num="8.4.4"/>
        <vers num="8.4.5"/>
        <vers num="8.4.6"/>
        <vers num="8.4.7"/>
        <vers num="8.4.8"/>
        <vers num="8.4.9"/>
        <vers num="9.0"/>
        <vers num="9.0.1"/>
        <vers num="9.0.10"/>
        <vers num="9.0.11"/>
        <vers num="9.0.12"/>
        <vers num="9.0.13"/>
        <vers num="9.0.14"/>
        <vers num="9.0.15"/>
        <vers num="9.0.2"/>
        <vers num="9.0.3"/>
        <vers num="9.0.4"/>
        <vers num="9.0.5"/>
        <vers num="9.0.6"/>
        <vers num="9.0.7"/>
        <vers num="9.0.8"/>
        <vers num="9.0.9"/>
        <vers num="9.1"/>
        <vers num="9.1.1"/>
        <vers num="9.1.10"/>
        <vers num="9.1.11"/>
        <vers num="9.1.2"/>
        <vers num="9.1.3"/>
        <vers num="9.1.4"/>
        <vers num="9.1.5"/>
        <vers num="9.1.6"/>
        <vers num="9.1.7"/>
        <vers num="9.1.8"/>
        <vers num="9.1.9"/>
        <vers num="9.2"/>
        <vers num="9.2.1"/>
        <vers num="9.2.2"/>
        <vers num="9.2.3"/>
        <vers num="9.2.4"/>
        <vers num="9.2.5"/>
        <vers num="9.2.6"/>
        <vers num="9.3"/>
        <vers num="9.3.1"/>
        <vers num="9.3.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0062" published="2014-03-31" name="CVE-2014-0062" modified="2014-03-31" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:S/C:P/I:P/A:N)" CVSS_score="4.9" CVSS_impact_subscore="4.9" CVSS_exploit_subscore="6.8" CVSS_base_score="4.9">
    <desc>
      <descript source="cve">Race condition in the (1) CREATE INDEX and (2) unspecified ALTER TABLE commands in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allows remote authenticated users to create an unauthorized index or read portions of unauthorized tables by creating or deleting a table with the same name during the timing window.</descript>
    </desc>
    <loss_types>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.postgresql.org/about/news/1506/" source="CONFIRM" adv="1">http://www.postgresql.org/about/news/1506/</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2865" source="DEBIAN">DSA-2865</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2864" source="DEBIAN">DSA-2864</ref>
      <ref url="http://wiki.postgresql.org/wiki/20140220securityrelease" source="CONFIRM" adv="1">http://wiki.postgresql.org/wiki/20140220securityrelease</ref>
    </refs>
    <vuln_soft>
      <prod vendor="postgresql" name="postgresql">
        <vers num="8.4.1"/>
        <vers num="8.4.10"/>
        <vers num="8.4.11"/>
        <vers num="8.4.12"/>
        <vers num="8.4.13"/>
        <vers num="8.4.14"/>
        <vers num="8.4.15"/>
        <vers num="8.4.16"/>
        <vers num="8.4.17"/>
        <vers num="8.4.18"/>
        <vers prev="1" num="8.4.19"/>
        <vers num="8.4.2"/>
        <vers num="8.4.3"/>
        <vers num="8.4.4"/>
        <vers num="8.4.5"/>
        <vers num="8.4.6"/>
        <vers num="8.4.7"/>
        <vers num="8.4.8"/>
        <vers num="8.4.9"/>
        <vers num="9.0"/>
        <vers num="9.0.1"/>
        <vers num="9.0.10"/>
        <vers num="9.0.11"/>
        <vers num="9.0.12"/>
        <vers num="9.0.13"/>
        <vers num="9.0.14"/>
        <vers num="9.0.15"/>
        <vers num="9.0.2"/>
        <vers num="9.0.3"/>
        <vers num="9.0.4"/>
        <vers num="9.0.5"/>
        <vers num="9.0.6"/>
        <vers num="9.0.7"/>
        <vers num="9.0.8"/>
        <vers num="9.0.9"/>
        <vers num="9.1"/>
        <vers num="9.1.1"/>
        <vers num="9.1.10"/>
        <vers num="9.1.11"/>
        <vers num="9.1.2"/>
        <vers num="9.1.3"/>
        <vers num="9.1.4"/>
        <vers num="9.1.5"/>
        <vers num="9.1.6"/>
        <vers num="9.1.7"/>
        <vers num="9.1.8"/>
        <vers num="9.1.9"/>
        <vers num="9.2"/>
        <vers num="9.2.1"/>
        <vers num="9.2.2"/>
        <vers num="9.2.3"/>
        <vers num="9.2.4"/>
        <vers num="9.2.5"/>
        <vers num="9.2.6"/>
        <vers num="9.3"/>
        <vers num="9.3.1"/>
        <vers num="9.3.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0063" published="2014-03-31" name="CVE-2014-0063" modified="2014-03-31" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:P/I:P/A:P)" CVSS_score="6.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.0" CVSS_base_score="6.5">
    <desc>
      <descript source="cve">Multiple stack-based buffer overflows in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allow remote authenticated users to cause a denial of service (crash) or possibly execute arbitrary code via vectors related to an incorrect MAXDATELEN constant and datetime values involving (1) intervals, (2) timestamps, or (3) timezones, a different vulnerability than CVE-2014-0065.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://github.com/postgres/postgres/commit/4318daecc959886d001a6e79c6ea853e8b1dfb4b" source="CONFIRM">https://github.com/postgres/postgres/commit/4318daecc959886d001a6e79c6ea853e8b1dfb4b</ref>
      <ref url="https://bugzilla.redhat.com/show_bug.cgi?id=1065226" source="CONFIRM">https://bugzilla.redhat.com/show_bug.cgi?id=1065226</ref>
      <ref url="http://www.postgresql.org/support/security/" source="CONFIRM">http://www.postgresql.org/support/security/</ref>
      <ref url="http://www.postgresql.org/about/news/1506/" source="CONFIRM" adv="1">http://www.postgresql.org/about/news/1506/</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2865" source="DEBIAN">DSA-2865</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2864" source="DEBIAN">DSA-2864</ref>
      <ref url="http://wiki.postgresql.org/wiki/20140220securityrelease" source="CONFIRM" adv="1">http://wiki.postgresql.org/wiki/20140220securityrelease</ref>
    </refs>
    <vuln_soft>
      <prod vendor="postgresql" name="postgresql">
        <vers num="8.4.1"/>
        <vers num="8.4.10"/>
        <vers num="8.4.11"/>
        <vers num="8.4.12"/>
        <vers num="8.4.13"/>
        <vers num="8.4.14"/>
        <vers num="8.4.15"/>
        <vers num="8.4.16"/>
        <vers num="8.4.17"/>
        <vers num="8.4.18"/>
        <vers prev="1" num="8.4.19"/>
        <vers num="8.4.2"/>
        <vers num="8.4.3"/>
        <vers num="8.4.4"/>
        <vers num="8.4.5"/>
        <vers num="8.4.6"/>
        <vers num="8.4.7"/>
        <vers num="8.4.8"/>
        <vers num="8.4.9"/>
        <vers num="9.0"/>
        <vers num="9.0.1"/>
        <vers num="9.0.10"/>
        <vers num="9.0.11"/>
        <vers num="9.0.12"/>
        <vers num="9.0.13"/>
        <vers num="9.0.14"/>
        <vers num="9.0.15"/>
        <vers num="9.0.2"/>
        <vers num="9.0.3"/>
        <vers num="9.0.4"/>
        <vers num="9.0.5"/>
        <vers num="9.0.6"/>
        <vers num="9.0.7"/>
        <vers num="9.0.8"/>
        <vers num="9.0.9"/>
        <vers num="9.1"/>
        <vers num="9.1.1"/>
        <vers num="9.1.10"/>
        <vers num="9.1.11"/>
        <vers num="9.1.2"/>
        <vers num="9.1.3"/>
        <vers num="9.1.4"/>
        <vers num="9.1.5"/>
        <vers num="9.1.6"/>
        <vers num="9.1.7"/>
        <vers num="9.1.8"/>
        <vers num="9.1.9"/>
        <vers num="9.2"/>
        <vers num="9.2.1"/>
        <vers num="9.2.2"/>
        <vers num="9.2.3"/>
        <vers num="9.2.4"/>
        <vers num="9.2.5"/>
        <vers num="9.2.6"/>
        <vers num="9.3"/>
        <vers num="9.3.1"/>
        <vers num="9.3.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0064" published="2014-03-31" name="CVE-2014-0064" modified="2014-03-31" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:P/I:P/A:P)" CVSS_score="6.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.0" CVSS_base_score="6.5">
    <desc>
      <descript source="cve">Multiple integer overflows in the path_in and other unspecified functions in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allow remote authenticated users to have unspecified impact and attack vectors, which trigger a buffer overflow.  NOTE: this identifier has been SPLIT due to different affected versions; use CVE-2014-2669 for the hstore vector.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://github.com/postgres/postgres/commit/31400a673325147e1205326008e32135a78b4d8a" source="CONFIRM">https://github.com/postgres/postgres/commit/31400a673325147e1205326008e32135a78b4d8a</ref>
      <ref url="https://bugzilla.redhat.com/show_bug.cgi?id=1065230" source="CONFIRM">https://bugzilla.redhat.com/show_bug.cgi?id=1065230</ref>
      <ref url="http://www.postgresql.org/support/security/" source="CONFIRM" adv="1">http://www.postgresql.org/support/security/</ref>
      <ref url="http://www.postgresql.org/about/news/1506/" source="CONFIRM" adv="1">http://www.postgresql.org/about/news/1506/</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2865" source="DEBIAN">DSA-2865</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2864" source="DEBIAN">DSA-2864</ref>
      <ref url="http://wiki.postgresql.org/wiki/20140220securityrelease" source="CONFIRM">http://wiki.postgresql.org/wiki/20140220securityrelease</ref>
    </refs>
    <vuln_soft>
      <prod vendor="postgresql" name="postgresql">
        <vers num="8.4.1"/>
        <vers num="8.4.10"/>
        <vers num="8.4.11"/>
        <vers num="8.4.12"/>
        <vers num="8.4.13"/>
        <vers num="8.4.14"/>
        <vers num="8.4.15"/>
        <vers num="8.4.16"/>
        <vers num="8.4.17"/>
        <vers num="8.4.18"/>
        <vers prev="1" num="8.4.19"/>
        <vers num="8.4.2"/>
        <vers num="8.4.3"/>
        <vers num="8.4.4"/>
        <vers num="8.4.5"/>
        <vers num="8.4.6"/>
        <vers num="8.4.7"/>
        <vers num="8.4.8"/>
        <vers num="8.4.9"/>
        <vers num="9.0"/>
        <vers num="9.0.1"/>
        <vers num="9.0.10"/>
        <vers num="9.0.11"/>
        <vers num="9.0.12"/>
        <vers num="9.0.13"/>
        <vers num="9.0.14"/>
        <vers num="9.0.15"/>
        <vers num="9.0.2"/>
        <vers num="9.0.3"/>
        <vers num="9.0.4"/>
        <vers num="9.0.5"/>
        <vers num="9.0.6"/>
        <vers num="9.0.7"/>
        <vers num="9.0.8"/>
        <vers num="9.0.9"/>
        <vers num="9.1"/>
        <vers num="9.1.1"/>
        <vers num="9.1.10"/>
        <vers num="9.1.11"/>
        <vers num="9.1.2"/>
        <vers num="9.1.3"/>
        <vers num="9.1.4"/>
        <vers num="9.1.5"/>
        <vers num="9.1.6"/>
        <vers num="9.1.7"/>
        <vers num="9.1.8"/>
        <vers num="9.1.9"/>
        <vers num="9.2"/>
        <vers num="9.2.1"/>
        <vers num="9.2.2"/>
        <vers num="9.2.3"/>
        <vers num="9.2.4"/>
        <vers num="9.2.5"/>
        <vers num="9.2.6"/>
        <vers num="9.3"/>
        <vers num="9.3.1"/>
        <vers num="9.3.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0065" published="2014-03-31" name="CVE-2014-0065" modified="2014-04-03" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:P/I:P/A:P)" CVSS_score="6.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.0" CVSS_base_score="6.5">
    <desc>
      <descript source="cve">Multiple buffer overflows in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allow remote authenticated users to have unspecified impact and attack vectors, a different vulnerability than CVE-2014-0063.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.postgresql.org/about/news/1506/" source="CONFIRM" adv="1">http://www.postgresql.org/about/news/1506/</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2865" source="DEBIAN">DSA-2865</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2864" source="DEBIAN">DSA-2864</ref>
      <ref url="http://wiki.postgresql.org/wiki/20140220securityrelease" source="CONFIRM" adv="1">http://wiki.postgresql.org/wiki/20140220securityrelease</ref>
    </refs>
    <vuln_soft>
      <prod vendor="postgresql" name="postgresql">
        <vers num="8.4.1"/>
        <vers num="8.4.10"/>
        <vers num="8.4.11"/>
        <vers num="8.4.12"/>
        <vers num="8.4.13"/>
        <vers num="8.4.14"/>
        <vers num="8.4.15"/>
        <vers num="8.4.16"/>
        <vers num="8.4.17"/>
        <vers num="8.4.18"/>
        <vers prev="1" num="8.4.19"/>
        <vers num="8.4.2"/>
        <vers num="8.4.3"/>
        <vers num="8.4.4"/>
        <vers num="8.4.5"/>
        <vers num="8.4.6"/>
        <vers num="8.4.7"/>
        <vers num="8.4.8"/>
        <vers num="8.4.9"/>
        <vers num="9.0"/>
        <vers num="9.0.1"/>
        <vers num="9.0.10"/>
        <vers num="9.0.11"/>
        <vers num="9.0.12"/>
        <vers num="9.0.13"/>
        <vers num="9.0.14"/>
        <vers num="9.0.15"/>
        <vers num="9.0.2"/>
        <vers num="9.0.3"/>
        <vers num="9.0.4"/>
        <vers num="9.0.5"/>
        <vers num="9.0.6"/>
        <vers num="9.0.7"/>
        <vers num="9.0.8"/>
        <vers num="9.0.9"/>
        <vers num="9.1"/>
        <vers num="9.1.1"/>
        <vers num="9.1.10"/>
        <vers num="9.1.11"/>
        <vers num="9.1.2"/>
        <vers num="9.1.3"/>
        <vers num="9.1.4"/>
        <vers num="9.1.5"/>
        <vers num="9.1.6"/>
        <vers num="9.1.7"/>
        <vers num="9.1.8"/>
        <vers num="9.1.9"/>
        <vers num="9.2"/>
        <vers num="9.2.1"/>
        <vers num="9.2.2"/>
        <vers num="9.2.3"/>
        <vers num="9.2.4"/>
        <vers num="9.2.5"/>
        <vers num="9.2.6"/>
        <vers num="9.3"/>
        <vers num="9.3.1"/>
        <vers num="9.3.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0066" published="2014-03-31" name="CVE-2014-0066" modified="2014-04-03" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:N/I:N/A:P)" CVSS_score="4.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.0" CVSS_base_score="4.0">
    <desc>
      <descript source="cve">The chkpass extension in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 does not properly check the return value of the crypt library function, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and crash) via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.postgresql.org/about/news/1506/" source="CONFIRM" adv="1">http://www.postgresql.org/about/news/1506/</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2865" source="DEBIAN">DSA-2865</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2864" source="DEBIAN">DSA-2864</ref>
      <ref url="http://wiki.postgresql.org/wiki/20140220securityrelease" source="CONFIRM" adv="1">http://wiki.postgresql.org/wiki/20140220securityrelease</ref>
    </refs>
    <vuln_soft>
      <prod vendor="postgresql" name="postgresql">
        <vers num="8.4.1"/>
        <vers num="8.4.10"/>
        <vers num="8.4.11"/>
        <vers num="8.4.12"/>
        <vers num="8.4.13"/>
        <vers num="8.4.14"/>
        <vers num="8.4.15"/>
        <vers num="8.4.16"/>
        <vers num="8.4.17"/>
        <vers num="8.4.18"/>
        <vers prev="1" num="8.4.19"/>
        <vers num="8.4.2"/>
        <vers num="8.4.3"/>
        <vers num="8.4.4"/>
        <vers num="8.4.5"/>
        <vers num="8.4.6"/>
        <vers num="8.4.7"/>
        <vers num="8.4.8"/>
        <vers num="8.4.9"/>
        <vers num="9.0"/>
        <vers num="9.0.1"/>
        <vers num="9.0.10"/>
        <vers num="9.0.11"/>
        <vers num="9.0.12"/>
        <vers num="9.0.13"/>
        <vers num="9.0.14"/>
        <vers num="9.0.15"/>
        <vers num="9.0.2"/>
        <vers num="9.0.3"/>
        <vers num="9.0.4"/>
        <vers num="9.0.5"/>
        <vers num="9.0.6"/>
        <vers num="9.0.7"/>
        <vers num="9.0.8"/>
        <vers num="9.0.9"/>
        <vers num="9.1"/>
        <vers num="9.1.1"/>
        <vers num="9.1.10"/>
        <vers num="9.1.11"/>
        <vers num="9.1.2"/>
        <vers num="9.1.3"/>
        <vers num="9.1.4"/>
        <vers num="9.1.5"/>
        <vers num="9.1.6"/>
        <vers num="9.1.7"/>
        <vers num="9.1.8"/>
        <vers num="9.1.9"/>
        <vers num="9.2"/>
        <vers num="9.2.1"/>
        <vers num="9.2.2"/>
        <vers num="9.2.3"/>
        <vers num="9.2.4"/>
        <vers num="9.2.5"/>
        <vers num="9.2.6"/>
        <vers num="9.3"/>
        <vers num="9.3.1"/>
        <vers num="9.3.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0067" published="2014-03-31" name="CVE-2014-0067" modified="2014-03-31" CVSS_version="2.0" CVSS_vector="(AV:L/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="4.6" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="3.9" CVSS_base_score="4.6">
    <desc>
      <descript source="cve">The "make check" command for the test suites in PostgreSQL 9.3.3 and earlier does not properly invoke initdb to specify the authentication requirements for a database cluster to be used for the tests, which allows local users to gain privileges by leveraging access to this cluster.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="http://www.postgresql.org/about/news/1506/" source="CONFIRM">http://www.postgresql.org/about/news/1506/</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2865" source="DEBIAN">DSA-2865</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2864" source="DEBIAN">DSA-2864</ref>
      <ref url="http://wiki.postgresql.org/wiki/20140220securityrelease" source="CONFIRM" adv="1">http://wiki.postgresql.org/wiki/20140220securityrelease</ref>
    </refs>
    <vuln_soft>
      <prod vendor="postgresql" name="postgresql">
        <vers num="8.4.1"/>
        <vers num="8.4.10"/>
        <vers num="8.4.11"/>
        <vers num="8.4.12"/>
        <vers num="8.4.13"/>
        <vers num="8.4.14"/>
        <vers num="8.4.15"/>
        <vers num="8.4.16"/>
        <vers num="8.4.17"/>
        <vers num="8.4.18"/>
        <vers prev="1" num="8.4.19"/>
        <vers num="8.4.2"/>
        <vers num="8.4.3"/>
        <vers num="8.4.4"/>
        <vers num="8.4.5"/>
        <vers num="8.4.6"/>
        <vers num="8.4.7"/>
        <vers num="8.4.8"/>
        <vers num="8.4.9"/>
        <vers num="9.0"/>
        <vers num="9.0.1"/>
        <vers num="9.0.10"/>
        <vers num="9.0.11"/>
        <vers num="9.0.12"/>
        <vers num="9.0.13"/>
        <vers num="9.0.14"/>
        <vers num="9.0.15"/>
        <vers num="9.0.2"/>
        <vers num="9.0.3"/>
        <vers num="9.0.4"/>
        <vers num="9.0.5"/>
        <vers num="9.0.6"/>
        <vers num="9.0.7"/>
        <vers num="9.0.8"/>
        <vers num="9.0.9"/>
        <vers num="9.1"/>
        <vers num="9.1.1"/>
        <vers num="9.1.10"/>
        <vers num="9.1.11"/>
        <vers num="9.1.2"/>
        <vers num="9.1.3"/>
        <vers num="9.1.4"/>
        <vers num="9.1.5"/>
        <vers num="9.1.6"/>
        <vers num="9.1.7"/>
        <vers num="9.1.8"/>
        <vers num="9.1.9"/>
        <vers num="9.2"/>
        <vers num="9.2.1"/>
        <vers num="9.2.2"/>
        <vers num="9.2.3"/>
        <vers num="9.2.4"/>
        <vers num="9.2.5"/>
        <vers num="9.2.6"/>
        <vers num="9.3"/>
        <vers num="9.3.1"/>
        <vers num="9.3.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0069" published="2014-02-28" name="CVE-2014-0069" modified="2014-04-01" CVSS_version="2.0" CVSS_vector="(AV:L/AC:H/Au:N/C:C/I:C/A:C)" CVSS_score="6.2" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="1.9" CVSS_base_score="6.2">
    <desc>
      <descript source="cve">The cifs_iovec_write function in fs/cifs/file.c in the Linux kernel through 3.13.5 does not properly handle uncached write operations that copy fewer than the requested number of bytes, which allows local users to obtain sensitive information from kernel memory, cause a denial of service (memory corruption and system crash), or possibly gain privileges via a writev system call with a crafted pointer.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="https://github.com/torvalds/linux/commit/5d81de8e8667da7135d3a32a964087c0faf5483f" source="CONFIRM" patch="1">https://github.com/torvalds/linux/commit/5d81de8e8667da7135d3a32a964087c0faf5483f</ref>
      <ref url="http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=5d81de8e8667da7135d3a32a964087c0faf5483f" source="CONFIRM" patch="1">http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=5d81de8e8667da7135d3a32a964087c0faf5483f</ref>
      <ref url="https://bugzilla.redhat.com/show_bug.cgi?id=1064253" source="CONFIRM">https://bugzilla.redhat.com/show_bug.cgi?id=1064253</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/02/17/4" source="MLIST">[oss-security] 20140217 CVE-2014-0069 -- kernel: cifs: incorrect handling of bogus user pointers during uncached writes</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0328.html" source="REDHAT">RHSA-2014:0328</ref>
      <ref url="http://article.gmane.org/gmane.linux.kernel.cifs/9401" source="MLIST">[linux-cifs] 20140214 [PATCH] cifs: ensure that uncached writes handle unmapped areas correctly</ref>
    </refs>
    <vuln_soft>
      <prod vendor="linux" name="linux_kernel">
        <vers num="3.0" edition="rc1"/>
        <vers num="3.0" edition="rc2"/>
        <vers num="3.0" edition="rc3"/>
        <vers num="3.0" edition="rc4"/>
        <vers num="3.0" edition="rc5"/>
        <vers num="3.0" edition="rc6"/>
        <vers num="3.0" edition="rc7"/>
        <vers num="3.0.1"/>
        <vers num="3.0.10"/>
        <vers num="3.0.11"/>
        <vers num="3.0.12"/>
        <vers num="3.0.13"/>
        <vers num="3.0.14"/>
        <vers num="3.0.15"/>
        <vers num="3.0.16"/>
        <vers num="3.0.17"/>
        <vers num="3.0.18"/>
        <vers num="3.0.19"/>
        <vers num="3.0.2"/>
        <vers num="3.0.20"/>
        <vers num="3.0.21"/>
        <vers num="3.0.22"/>
        <vers num="3.0.23"/>
        <vers num="3.0.24"/>
        <vers num="3.0.25"/>
        <vers num="3.0.26"/>
        <vers num="3.0.27"/>
        <vers num="3.0.28"/>
        <vers num="3.0.29"/>
        <vers num="3.0.3"/>
        <vers num="3.0.30"/>
        <vers num="3.0.31"/>
        <vers num="3.0.32"/>
        <vers num="3.0.33"/>
        <vers num="3.0.34"/>
        <vers num="3.0.35"/>
        <vers num="3.0.36"/>
        <vers num="3.0.37"/>
        <vers num="3.0.38"/>
        <vers num="3.0.39"/>
        <vers num="3.0.4"/>
        <vers num="3.0.40"/>
        <vers num="3.0.41"/>
        <vers num="3.0.42"/>
        <vers num="3.0.43"/>
        <vers num="3.0.44"/>
        <vers num="3.0.45"/>
        <vers num="3.0.46"/>
        <vers num="3.0.47"/>
        <vers num="3.0.48"/>
        <vers num="3.0.49"/>
        <vers num="3.0.5"/>
        <vers num="3.0.50"/>
        <vers num="3.0.51"/>
        <vers num="3.0.52"/>
        <vers num="3.0.53"/>
        <vers num="3.0.54"/>
        <vers num="3.0.55"/>
        <vers num="3.0.56"/>
        <vers num="3.0.57"/>
        <vers num="3.0.58"/>
        <vers num="3.0.59"/>
        <vers num="3.0.6"/>
        <vers num="3.0.60"/>
        <vers num="3.0.61"/>
        <vers num="3.0.62"/>
        <vers num="3.0.63"/>
        <vers num="3.0.64"/>
        <vers num="3.0.65"/>
        <vers num="3.0.66"/>
        <vers num="3.0.67"/>
        <vers num="3.0.68"/>
        <vers num="3.0.7"/>
        <vers num="3.0.8"/>
        <vers num="3.0.9"/>
        <vers num="3.1" edition="rc1"/>
        <vers num="3.1" edition="rc2"/>
        <vers num="3.1" edition="rc3"/>
        <vers num="3.1" edition="rc4"/>
        <vers num="3.1.1"/>
        <vers num="3.1.10"/>
        <vers num="3.1.2"/>
        <vers num="3.1.3"/>
        <vers num="3.1.4"/>
        <vers num="3.1.5"/>
        <vers num="3.1.6"/>
        <vers num="3.1.7"/>
        <vers num="3.1.8"/>
        <vers num="3.1.9"/>
        <vers num="3.10"/>
        <vers num="3.10.1"/>
        <vers num="3.10.10"/>
        <vers num="3.10.11"/>
        <vers num="3.10.12"/>
        <vers num="3.10.13"/>
        <vers num="3.10.14"/>
        <vers num="3.10.15"/>
        <vers num="3.10.16"/>
        <vers num="3.10.17"/>
        <vers num="3.10.18"/>
        <vers num="3.10.19"/>
        <vers num="3.10.2"/>
        <vers num="3.10.20"/>
        <vers num="3.10.21"/>
        <vers num="3.10.22"/>
        <vers num="3.10.23"/>
        <vers num="3.10.24"/>
        <vers num="3.10.25"/>
        <vers num="3.10.26"/>
        <vers num="3.10.27"/>
        <vers num="3.10.28"/>
        <vers num="3.10.29"/>
        <vers num="3.10.3"/>
        <vers num="3.10.4"/>
        <vers num="3.10.5"/>
        <vers num="3.10.6"/>
        <vers num="3.10.7"/>
        <vers num="3.10.8"/>
        <vers num="3.10.9"/>
        <vers num="3.11"/>
        <vers num="3.11.1"/>
        <vers num="3.11.10"/>
        <vers num="3.11.2"/>
        <vers num="3.11.3"/>
        <vers num="3.11.4"/>
        <vers num="3.11.5"/>
        <vers num="3.11.6"/>
        <vers num="3.11.7"/>
        <vers num="3.11.8"/>
        <vers num="3.11.9"/>
        <vers num="3.12"/>
        <vers num="3.12.1"/>
        <vers num="3.12.10"/>
        <vers num="3.12.11"/>
        <vers num="3.12.12"/>
        <vers num="3.12.13"/>
        <vers num="3.12.2"/>
        <vers num="3.12.3"/>
        <vers num="3.12.4"/>
        <vers num="3.12.5"/>
        <vers num="3.12.6"/>
        <vers num="3.12.7"/>
        <vers num="3.12.8"/>
        <vers num="3.12.9"/>
        <vers num="3.13"/>
        <vers num="3.13.1"/>
        <vers num="3.13.2"/>
        <vers num="3.13.3"/>
        <vers num="3.13.4"/>
        <vers prev="1" num="3.13.5"/>
        <vers num="3.2" edition="rc2"/>
        <vers num="3.2" edition="rc3"/>
        <vers num="3.2" edition="rc4"/>
        <vers num="3.2" edition="rc5"/>
        <vers num="3.2" edition="rc6"/>
        <vers num="3.2" edition="rc7"/>
        <vers num="3.2.1"/>
        <vers num="3.2.10"/>
        <vers num="3.2.11"/>
        <vers num="3.2.12"/>
        <vers num="3.2.13"/>
        <vers num="3.2.14"/>
        <vers num="3.2.15"/>
        <vers num="3.2.16"/>
        <vers num="3.2.17"/>
        <vers num="3.2.18"/>
        <vers num="3.2.19"/>
        <vers num="3.2.2"/>
        <vers num="3.2.20"/>
        <vers num="3.2.21"/>
        <vers num="3.2.22"/>
        <vers num="3.2.23"/>
        <vers num="3.2.24"/>
        <vers num="3.2.25"/>
        <vers num="3.2.26"/>
        <vers num="3.2.27"/>
        <vers num="3.2.28"/>
        <vers num="3.2.29"/>
        <vers num="3.2.3"/>
        <vers num="3.2.30"/>
        <vers num="3.2.4"/>
        <vers num="3.2.5"/>
        <vers num="3.2.6"/>
        <vers num="3.2.7"/>
        <vers num="3.2.8"/>
        <vers num="3.2.9"/>
        <vers num="3.3" edition="rc1"/>
        <vers num="3.3" edition="rc2"/>
        <vers num="3.3" edition="rc3"/>
        <vers num="3.3" edition="rc4"/>
        <vers num="3.3" edition="rc5"/>
        <vers num="3.3" edition="rc6"/>
        <vers num="3.3" edition="rc7"/>
        <vers num="3.3.1"/>
        <vers num="3.3.2"/>
        <vers num="3.3.3"/>
        <vers num="3.3.4"/>
        <vers num="3.3.5"/>
        <vers num="3.3.6"/>
        <vers num="3.3.7"/>
        <vers num="3.3.8"/>
        <vers num="3.4" edition="rc1"/>
        <vers num="3.4" edition="rc2"/>
        <vers num="3.4" edition="rc3"/>
        <vers num="3.4" edition="rc4"/>
        <vers num="3.4" edition="rc5"/>
        <vers num="3.4" edition="rc6"/>
        <vers num="3.4" edition="rc7"/>
        <vers num="3.4.1"/>
        <vers num="3.4.10"/>
        <vers num="3.4.11"/>
        <vers num="3.4.12"/>
        <vers num="3.4.13"/>
        <vers num="3.4.14"/>
        <vers num="3.4.15"/>
        <vers num="3.4.16"/>
        <vers num="3.4.17"/>
        <vers num="3.4.18"/>
        <vers num="3.4.19"/>
        <vers num="3.4.2"/>
        <vers num="3.4.20"/>
        <vers num="3.4.21"/>
        <vers num="3.4.22"/>
        <vers num="3.4.23"/>
        <vers num="3.4.24"/>
        <vers num="3.4.25"/>
        <vers num="3.4.26"/>
        <vers num="3.4.27"/>
        <vers num="3.4.28"/>
        <vers num="3.4.29"/>
        <vers num="3.4.3"/>
        <vers num="3.4.30"/>
        <vers num="3.4.31"/>
        <vers num="3.4.32"/>
        <vers num="3.4.33"/>
        <vers num="3.4.34"/>
        <vers num="3.4.35"/>
        <vers num="3.4.36"/>
        <vers num="3.4.37"/>
        <vers num="3.4.38"/>
        <vers num="3.4.39"/>
        <vers num="3.4.4"/>
        <vers num="3.4.40"/>
        <vers num="3.4.41"/>
        <vers num="3.4.42"/>
        <vers num="3.4.43"/>
        <vers num="3.4.44"/>
        <vers num="3.4.45"/>
        <vers num="3.4.46"/>
        <vers num="3.4.47"/>
        <vers num="3.4.48"/>
        <vers num="3.4.49"/>
        <vers num="3.4.5"/>
        <vers num="3.4.50"/>
        <vers num="3.4.51"/>
        <vers num="3.4.52"/>
        <vers num="3.4.53"/>
        <vers num="3.4.54"/>
        <vers num="3.4.55"/>
        <vers num="3.4.56"/>
        <vers num="3.4.57"/>
        <vers num="3.4.58"/>
        <vers num="3.4.59"/>
        <vers num="3.4.6"/>
        <vers num="3.4.60"/>
        <vers num="3.4.61"/>
        <vers num="3.4.62"/>
        <vers num="3.4.63"/>
        <vers num="3.4.64"/>
        <vers num="3.4.65"/>
        <vers num="3.4.66"/>
        <vers num="3.4.67"/>
        <vers num="3.4.68"/>
        <vers num="3.4.69"/>
        <vers num="3.4.7"/>
        <vers num="3.4.70"/>
        <vers num="3.4.71"/>
        <vers num="3.4.72"/>
        <vers num="3.4.73"/>
        <vers num="3.4.74"/>
        <vers num="3.4.75"/>
        <vers num="3.4.76"/>
        <vers num="3.4.77"/>
        <vers num="3.4.78"/>
        <vers num="3.4.79"/>
        <vers num="3.4.8"/>
        <vers num="3.4.9"/>
        <vers num="3.5.1"/>
        <vers num="3.5.2"/>
        <vers num="3.5.3"/>
        <vers num="3.5.4"/>
        <vers num="3.5.5"/>
        <vers num="3.5.6"/>
        <vers num="3.5.7"/>
        <vers num="3.6"/>
        <vers num="3.6.1"/>
        <vers num="3.6.10"/>
        <vers num="3.6.11"/>
        <vers num="3.6.2"/>
        <vers num="3.6.3"/>
        <vers num="3.6.4"/>
        <vers num="3.6.5"/>
        <vers num="3.6.6"/>
        <vers num="3.6.7"/>
        <vers num="3.6.8"/>
        <vers num="3.6.9"/>
        <vers num="3.7"/>
        <vers num="3.7.1"/>
        <vers num="3.7.10"/>
        <vers num="3.7.2"/>
        <vers num="3.7.3"/>
        <vers num="3.7.4"/>
        <vers num="3.7.5"/>
        <vers num="3.7.6"/>
        <vers num="3.7.7"/>
        <vers num="3.7.8"/>
        <vers num="3.7.9"/>
        <vers num="3.8.0"/>
        <vers num="3.8.1"/>
        <vers num="3.8.10"/>
        <vers num="3.8.11"/>
        <vers num="3.8.12"/>
        <vers num="3.8.13"/>
        <vers num="3.8.2"/>
        <vers num="3.8.3"/>
        <vers num="3.8.4"/>
        <vers num="3.8.5"/>
        <vers num="3.8.6"/>
        <vers num="3.8.7"/>
        <vers num="3.8.8"/>
        <vers num="3.8.9"/>
        <vers num="3.9" edition="rc1"/>
        <vers num="3.9" edition="rc2"/>
        <vers num="3.9" edition="rc3"/>
        <vers num="3.9" edition="rc4"/>
        <vers num="3.9" edition="rc5"/>
        <vers num="3.9" edition="rc6"/>
        <vers num="3.9" edition="rc7"/>
        <vers num="3.9.0"/>
        <vers num="3.9.1"/>
        <vers num="3.9.10"/>
        <vers num="3.9.11"/>
        <vers num="3.9.2"/>
        <vers num="3.9.3"/>
        <vers num="3.9.4"/>
        <vers num="3.9.5"/>
        <vers num="3.9.6"/>
        <vers num="3.9.7"/>
        <vers num="3.9.8"/>
        <vers num="3.9.9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" seq="2014-0070" reject="1" published="2014-02-26" name="CVE-2014-0070" modified="2014-02-26">
    <desc>
      <descript source="cve">** REJECT **  DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not a security issue.  Notes: none.</descript>
    </desc>
    <refs/>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0071" published="2014-04-17" name="CVE-2014-0071" modified="2014-04-17" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:N)" CVSS_score="6.4" CVSS_impact_subscore="4.9" CVSS_exploit_subscore="10.0" CVSS_base_score="6.4">
    <desc>
      <descript source="cve">PackStack in Red Hat OpenStack 4.0 does not enforce the default security groups when deployed to Neutron, which allows remote attackers to bypass intended access restrictions and make unauthorized connections.</descript>
    </desc>
    <loss_types>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://bugzilla.redhat.com/show_bug.cgi?id=1064163" source="CONFIRM">https://bugzilla.redhat.com/show_bug.cgi?id=1064163</ref>
      <ref url="http://www.securityfocus.com/bid/66001" source="BID">66001</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0233.html" source="REDHAT" adv="1">RHSA-2014:0233</ref>
    </refs>
    <vuln_soft>
      <prod vendor="redhat" name="openstack">
        <vers num="4.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0076" published="2014-03-25" name="CVE-2014-0076" modified="2014-03-26" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:N/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">The Montgomery ladder implementation in OpenSSL through 1.0.0l does not ensure that certain swap operations have a constant-time behavior, which makes it easier for local users to obtain ECDSA nonces via a FLUSH+RELOAD cache side-channel attack.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://bugzilla.novell.com/show_bug.cgi?id=869945" source="CONFIRM">https://bugzilla.novell.com/show_bug.cgi?id=869945</ref>
      <ref url="https://bugs.gentoo.org/show_bug.cgi?id=505278" source="CONFIRM">https://bugs.gentoo.org/show_bug.cgi?id=505278</ref>
      <ref url="http://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=2198be3483259de374f91e57d247d0fc667aef29" source="CONFIRM">http://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=2198be3483259de374f91e57d247d0fc667aef29</ref>
      <ref url="http://eprint.iacr.org/2014/140" source="MISC">http://eprint.iacr.org/2014/140</ref>
    </refs>
    <vuln_soft>
      <prod vendor="openssl" name="openssl">
        <vers num="0.9.1c"/>
        <vers num="0.9.2b"/>
        <vers num="0.9.3"/>
        <vers num="0.9.3a"/>
        <vers num="0.9.4"/>
        <vers num="0.9.5" edition="beta1"/>
        <vers num="0.9.5" edition="beta2"/>
        <vers num="0.9.5a" edition="beta1"/>
        <vers num="0.9.5a" edition="beta2"/>
        <vers num="0.9.6" edition="beta1"/>
        <vers num="0.9.6" edition="beta2"/>
        <vers num="0.9.6" edition="beta3"/>
        <vers num="0.9.6a" edition="beta1"/>
        <vers num="0.9.6a" edition="beta2"/>
        <vers num="0.9.6a" edition="beta3"/>
        <vers num="0.9.6b"/>
        <vers num="0.9.6c"/>
        <vers num="0.9.6d"/>
        <vers num="0.9.6e"/>
        <vers num="0.9.6f"/>
        <vers num="0.9.6g"/>
        <vers num="0.9.6h"/>
        <vers num="0.9.6i"/>
        <vers num="0.9.6j"/>
        <vers num="0.9.6k"/>
        <vers num="0.9.6l"/>
        <vers num="0.9.6m"/>
        <vers num="0.9.7" edition="beta1"/>
        <vers num="0.9.7" edition="beta2"/>
        <vers num="0.9.7" edition="beta3"/>
        <vers num="0.9.7" edition="beta4"/>
        <vers num="0.9.7" edition="beta5"/>
        <vers num="0.9.7" edition="beta6"/>
        <vers num="0.9.7a"/>
        <vers num="0.9.7b"/>
        <vers num="0.9.7c"/>
        <vers num="0.9.7d"/>
        <vers num="0.9.7e"/>
        <vers num="0.9.7f"/>
        <vers num="0.9.7g"/>
        <vers num="0.9.7h"/>
        <vers num="0.9.7i"/>
        <vers num="0.9.7j"/>
        <vers num="0.9.7k"/>
        <vers num="0.9.7l"/>
        <vers num="0.9.7m"/>
        <vers num="0.9.8"/>
        <vers num="0.9.8a"/>
        <vers num="0.9.8b"/>
        <vers num="0.9.8c"/>
        <vers num="0.9.8d"/>
        <vers num="0.9.8e"/>
        <vers num="0.9.8f"/>
        <vers num="0.9.8g"/>
        <vers num="0.9.8h"/>
        <vers num="0.9.8i"/>
        <vers num="0.9.8j"/>
        <vers num="0.9.8k"/>
        <vers num="0.9.8l"/>
        <vers num="0.9.8m" edition="beta1"/>
        <vers num="0.9.8n"/>
        <vers num="0.9.8o"/>
        <vers num="0.9.8p"/>
        <vers num="0.9.8q"/>
        <vers num="0.9.8r"/>
        <vers num="0.9.8s"/>
        <vers num="0.9.8t"/>
        <vers num="0.9.8u"/>
        <vers num="0.9.8v"/>
        <vers num="0.9.8w"/>
        <vers num="0.9.8x"/>
        <vers num="0.9.8y"/>
        <vers num="1.0.0" edition="beta1"/>
        <vers num="1.0.0" edition="beta2"/>
        <vers num="1.0.0" edition="beta3"/>
        <vers num="1.0.0" edition="beta4"/>
        <vers num="1.0.0" edition="beta5"/>
        <vers num="1.0.0a"/>
        <vers num="1.0.0b"/>
        <vers num="1.0.0c"/>
        <vers num="1.0.0d"/>
        <vers num="1.0.0e"/>
        <vers num="1.0.0f"/>
        <vers num="1.0.0g"/>
        <vers num="1.0.0h"/>
        <vers num="1.0.0i"/>
        <vers num="1.0.0j"/>
        <vers num="1.0.0k"/>
        <vers prev="1" num="1.0.0l"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0077" published="2014-04-14" name="CVE-2014-0077" modified="2014-04-15" CVSS_version="2.0" CVSS_vector="(AV:A/AC:H/Au:S/C:P/I:P/A:C)" CVSS_score="5.5" CVSS_impact_subscore="8.5" CVSS_exploit_subscore="2.5" CVSS_base_score="5.5">
    <desc>
      <descript source="cve">drivers/vhost/net.c in the Linux kernel before 3.13.10, when mergeable buffers are disabled, does not properly validate packet lengths, which allows guest OS users to cause a denial of service (memory corruption and host OS crash) or possibly gain privileges on the host OS via crafted packets, related to the handle_rx and get_rx_bufs functions.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <local_network/>
    </range>
    <refs>
      <ref url="http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.13.10" source="CONFIRM" patch="1">http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.13.10</ref>
      <ref url="http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=d8316f3991d207fe32881a9ac20241be8fa2bad0" source="CONFIRM" patch="1">http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=d8316f3991d207fe32881a9ac20241be8fa2bad0</ref>
      <ref url="https://github.com/torvalds/linux/commit/d8316f3991d207fe32881a9ac20241be8fa2bad0" source="CONFIRM">https://github.com/torvalds/linux/commit/d8316f3991d207fe32881a9ac20241be8fa2bad0</ref>
      <ref url="https://bugzilla.redhat.com/show_bug.cgi?id=1064440" source="CONFIRM">https://bugzilla.redhat.com/show_bug.cgi?id=1064440</ref>
    </refs>
    <vuln_soft>
      <prod vendor="linux" name="linux_kernel">
        <vers num="3.0" edition="rc1"/>
        <vers num="3.0" edition="rc2"/>
        <vers num="3.0" edition="rc3"/>
        <vers num="3.0" edition="rc4"/>
        <vers num="3.0" edition="rc5"/>
        <vers num="3.0" edition="rc6"/>
        <vers num="3.0" edition="rc7"/>
        <vers num="3.0.1"/>
        <vers num="3.0.10"/>
        <vers num="3.0.11"/>
        <vers num="3.0.12"/>
        <vers num="3.0.13"/>
        <vers num="3.0.14"/>
        <vers num="3.0.15"/>
        <vers num="3.0.16"/>
        <vers num="3.0.17"/>
        <vers num="3.0.18"/>
        <vers num="3.0.19"/>
        <vers num="3.0.2"/>
        <vers num="3.0.20"/>
        <vers num="3.0.21"/>
        <vers num="3.0.22"/>
        <vers num="3.0.23"/>
        <vers num="3.0.24"/>
        <vers num="3.0.25"/>
        <vers num="3.0.26"/>
        <vers num="3.0.27"/>
        <vers num="3.0.28"/>
        <vers num="3.0.29"/>
        <vers num="3.0.3"/>
        <vers num="3.0.30"/>
        <vers num="3.0.31"/>
        <vers num="3.0.32"/>
        <vers num="3.0.33"/>
        <vers num="3.0.34"/>
        <vers num="3.0.35"/>
        <vers num="3.0.36"/>
        <vers num="3.0.37"/>
        <vers num="3.0.38"/>
        <vers num="3.0.39"/>
        <vers num="3.0.4"/>
        <vers num="3.0.40"/>
        <vers num="3.0.41"/>
        <vers num="3.0.42"/>
        <vers num="3.0.43"/>
        <vers num="3.0.44"/>
        <vers num="3.0.45"/>
        <vers num="3.0.46"/>
        <vers num="3.0.47"/>
        <vers num="3.0.48"/>
        <vers num="3.0.49"/>
        <vers num="3.0.5"/>
        <vers num="3.0.50"/>
        <vers num="3.0.51"/>
        <vers num="3.0.52"/>
        <vers num="3.0.53"/>
        <vers num="3.0.54"/>
        <vers num="3.0.55"/>
        <vers num="3.0.56"/>
        <vers num="3.0.57"/>
        <vers num="3.0.58"/>
        <vers num="3.0.59"/>
        <vers num="3.0.6"/>
        <vers num="3.0.60"/>
        <vers num="3.0.61"/>
        <vers num="3.0.62"/>
        <vers num="3.0.63"/>
        <vers num="3.0.64"/>
        <vers num="3.0.65"/>
        <vers num="3.0.66"/>
        <vers num="3.0.67"/>
        <vers num="3.0.68"/>
        <vers num="3.0.7"/>
        <vers num="3.0.8"/>
        <vers num="3.0.9"/>
        <vers num="3.1" edition="rc1"/>
        <vers num="3.1" edition="rc2"/>
        <vers num="3.1" edition="rc3"/>
        <vers num="3.1" edition="rc4"/>
        <vers num="3.1.1"/>
        <vers num="3.1.10"/>
        <vers num="3.1.2"/>
        <vers num="3.1.3"/>
        <vers num="3.1.4"/>
        <vers num="3.1.5"/>
        <vers num="3.1.6"/>
        <vers num="3.1.7"/>
        <vers num="3.1.8"/>
        <vers num="3.1.9"/>
        <vers num="3.10"/>
        <vers num="3.10.1"/>
        <vers num="3.10.10"/>
        <vers num="3.10.11"/>
        <vers num="3.10.12"/>
        <vers num="3.10.13"/>
        <vers num="3.10.14"/>
        <vers num="3.10.15"/>
        <vers num="3.10.16"/>
        <vers num="3.10.17"/>
        <vers num="3.10.18"/>
        <vers num="3.10.19"/>
        <vers num="3.10.2"/>
        <vers num="3.10.20"/>
        <vers num="3.10.21"/>
        <vers num="3.10.22"/>
        <vers num="3.10.23"/>
        <vers num="3.10.24"/>
        <vers num="3.10.25"/>
        <vers num="3.10.26"/>
        <vers num="3.10.27"/>
        <vers num="3.10.28"/>
        <vers num="3.10.29"/>
        <vers num="3.10.3"/>
        <vers num="3.10.4"/>
        <vers num="3.10.5"/>
        <vers num="3.10.6"/>
        <vers num="3.10.7"/>
        <vers num="3.10.8"/>
        <vers num="3.10.9"/>
        <vers num="3.11"/>
        <vers num="3.11.1"/>
        <vers num="3.11.10"/>
        <vers num="3.11.2"/>
        <vers num="3.11.3"/>
        <vers num="3.11.4"/>
        <vers num="3.11.5"/>
        <vers num="3.11.6"/>
        <vers num="3.11.7"/>
        <vers num="3.11.8"/>
        <vers num="3.11.9"/>
        <vers num="3.12"/>
        <vers num="3.12.1"/>
        <vers num="3.12.10"/>
        <vers num="3.12.11"/>
        <vers num="3.12.12"/>
        <vers num="3.12.13"/>
        <vers num="3.12.14"/>
        <vers num="3.12.15"/>
        <vers num="3.12.16"/>
        <vers num="3.12.17"/>
        <vers num="3.12.2"/>
        <vers num="3.12.3"/>
        <vers num="3.12.4"/>
        <vers num="3.12.5"/>
        <vers num="3.12.6"/>
        <vers num="3.12.7"/>
        <vers num="3.12.8"/>
        <vers num="3.12.9"/>
        <vers num="3.13"/>
        <vers num="3.13.1"/>
        <vers num="3.13.2"/>
        <vers num="3.13.3"/>
        <vers num="3.13.4"/>
        <vers num="3.13.5"/>
        <vers num="3.13.6"/>
        <vers num="3.13.7"/>
        <vers num="3.13.8"/>
        <vers prev="1" num="3.13.9"/>
        <vers num="3.2" edition="rc2"/>
        <vers num="3.2" edition="rc3"/>
        <vers num="3.2" edition="rc4"/>
        <vers num="3.2" edition="rc5"/>
        <vers num="3.2" edition="rc6"/>
        <vers num="3.2" edition="rc7"/>
        <vers num="3.2.1"/>
        <vers num="3.2.10"/>
        <vers num="3.2.11"/>
        <vers num="3.2.12"/>
        <vers num="3.2.13"/>
        <vers num="3.2.14"/>
        <vers num="3.2.15"/>
        <vers num="3.2.16"/>
        <vers num="3.2.17"/>
        <vers num="3.2.18"/>
        <vers num="3.2.19"/>
        <vers num="3.2.2"/>
        <vers num="3.2.20"/>
        <vers num="3.2.21"/>
        <vers num="3.2.22"/>
        <vers num="3.2.23"/>
        <vers num="3.2.24"/>
        <vers num="3.2.25"/>
        <vers num="3.2.26"/>
        <vers num="3.2.27"/>
        <vers num="3.2.28"/>
        <vers num="3.2.29"/>
        <vers num="3.2.3"/>
        <vers num="3.2.30"/>
        <vers num="3.2.4"/>
        <vers num="3.2.5"/>
        <vers num="3.2.6"/>
        <vers num="3.2.7"/>
        <vers num="3.2.8"/>
        <vers num="3.2.9"/>
        <vers num="3.3" edition="rc1"/>
        <vers num="3.3" edition="rc2"/>
        <vers num="3.3" edition="rc3"/>
        <vers num="3.3" edition="rc4"/>
        <vers num="3.3" edition="rc5"/>
        <vers num="3.3" edition="rc6"/>
        <vers num="3.3" edition="rc7"/>
        <vers num="3.3.1"/>
        <vers num="3.3.2"/>
        <vers num="3.3.3"/>
        <vers num="3.3.4"/>
        <vers num="3.3.5"/>
        <vers num="3.3.6"/>
        <vers num="3.3.7"/>
        <vers num="3.3.8"/>
        <vers num="3.4" edition="rc1"/>
        <vers num="3.4" edition="rc2"/>
        <vers num="3.4" edition="rc3"/>
        <vers num="3.4" edition="rc4"/>
        <vers num="3.4" edition="rc5"/>
        <vers num="3.4" edition="rc6"/>
        <vers num="3.4" edition="rc7"/>
        <vers num="3.4.1"/>
        <vers num="3.4.10"/>
        <vers num="3.4.11"/>
        <vers num="3.4.12"/>
        <vers num="3.4.13"/>
        <vers num="3.4.14"/>
        <vers num="3.4.15"/>
        <vers num="3.4.16"/>
        <vers num="3.4.17"/>
        <vers num="3.4.18"/>
        <vers num="3.4.19"/>
        <vers num="3.4.2"/>
        <vers num="3.4.20"/>
        <vers num="3.4.21"/>
        <vers num="3.4.22"/>
        <vers num="3.4.23"/>
        <vers num="3.4.24"/>
        <vers num="3.4.25"/>
        <vers num="3.4.26"/>
        <vers num="3.4.27"/>
        <vers num="3.4.28"/>
        <vers num="3.4.29"/>
        <vers num="3.4.3"/>
        <vers num="3.4.30"/>
        <vers num="3.4.31"/>
        <vers num="3.4.32"/>
        <vers num="3.4.33"/>
        <vers num="3.4.34"/>
        <vers num="3.4.35"/>
        <vers num="3.4.36"/>
        <vers num="3.4.37"/>
        <vers num="3.4.38"/>
        <vers num="3.4.39"/>
        <vers num="3.4.4"/>
        <vers num="3.4.40"/>
        <vers num="3.4.41"/>
        <vers num="3.4.42"/>
        <vers num="3.4.43"/>
        <vers num="3.4.44"/>
        <vers num="3.4.45"/>
        <vers num="3.4.46"/>
        <vers num="3.4.47"/>
        <vers num="3.4.48"/>
        <vers num="3.4.49"/>
        <vers num="3.4.5"/>
        <vers num="3.4.50"/>
        <vers num="3.4.51"/>
        <vers num="3.4.52"/>
        <vers num="3.4.53"/>
        <vers num="3.4.54"/>
        <vers num="3.4.55"/>
        <vers num="3.4.56"/>
        <vers num="3.4.57"/>
        <vers num="3.4.58"/>
        <vers num="3.4.59"/>
        <vers num="3.4.6"/>
        <vers num="3.4.60"/>
        <vers num="3.4.61"/>
        <vers num="3.4.62"/>
        <vers num="3.4.63"/>
        <vers num="3.4.64"/>
        <vers num="3.4.65"/>
        <vers num="3.4.66"/>
        <vers num="3.4.67"/>
        <vers num="3.4.68"/>
        <vers num="3.4.69"/>
        <vers num="3.4.7"/>
        <vers num="3.4.70"/>
        <vers num="3.4.71"/>
        <vers num="3.4.72"/>
        <vers num="3.4.73"/>
        <vers num="3.4.74"/>
        <vers num="3.4.75"/>
        <vers num="3.4.76"/>
        <vers num="3.4.77"/>
        <vers num="3.4.78"/>
        <vers num="3.4.79"/>
        <vers num="3.4.8"/>
        <vers num="3.4.9"/>
        <vers num="3.5.1"/>
        <vers num="3.5.2"/>
        <vers num="3.5.3"/>
        <vers num="3.5.4"/>
        <vers num="3.5.5"/>
        <vers num="3.5.6"/>
        <vers num="3.5.7"/>
        <vers num="3.6"/>
        <vers num="3.6.1"/>
        <vers num="3.6.10"/>
        <vers num="3.6.11"/>
        <vers num="3.6.2"/>
        <vers num="3.6.3"/>
        <vers num="3.6.4"/>
        <vers num="3.6.5"/>
        <vers num="3.6.6"/>
        <vers num="3.6.7"/>
        <vers num="3.6.8"/>
        <vers num="3.6.9"/>
        <vers num="3.7"/>
        <vers num="3.7.1"/>
        <vers num="3.7.10"/>
        <vers num="3.7.2"/>
        <vers num="3.7.3"/>
        <vers num="3.7.4"/>
        <vers num="3.7.5"/>
        <vers num="3.7.6"/>
        <vers num="3.7.7"/>
        <vers num="3.7.8"/>
        <vers num="3.7.9"/>
        <vers num="3.8.0"/>
        <vers num="3.8.1"/>
        <vers num="3.8.10"/>
        <vers num="3.8.11"/>
        <vers num="3.8.12"/>
        <vers num="3.8.13"/>
        <vers num="3.8.2"/>
        <vers num="3.8.3"/>
        <vers num="3.8.4"/>
        <vers num="3.8.5"/>
        <vers num="3.8.6"/>
        <vers num="3.8.7"/>
        <vers num="3.8.8"/>
        <vers num="3.8.9"/>
        <vers num="3.9" edition="rc1"/>
        <vers num="3.9" edition="rc2"/>
        <vers num="3.9" edition="rc3"/>
        <vers num="3.9" edition="rc4"/>
        <vers num="3.9" edition="rc5"/>
        <vers num="3.9" edition="rc6"/>
        <vers num="3.9" edition="rc7"/>
        <vers num="3.9.0"/>
        <vers num="3.9.1"/>
        <vers num="3.9.10"/>
        <vers num="3.9.11"/>
        <vers num="3.9.2"/>
        <vers num="3.9.3"/>
        <vers num="3.9.4"/>
        <vers num="3.9.5"/>
        <vers num="3.9.6"/>
        <vers num="3.9.7"/>
        <vers num="3.9.8"/>
        <vers num="3.9.9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0079" published="2014-04-28" name="CVE-2014-0079" modified="2014-04-29" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:P)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">The ValidateUserLogon function in provider/libserver/ECSession.cpp in Zarafa 7.1.8, 6.20.0, and earlier, when using certain build conditions, allows remote attackers to cause a denial of service (crash) via vectors related to "a NULL pointer of the password."</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://bugzilla.redhat.com/show_bug.cgi?id=1059903" source="CONFIRM">https://bugzilla.redhat.com/show_bug.cgi?id=1059903</ref>
      <ref url="http://www.mandriva.com/security/advisories?name=MDVSA-2014:044" source="MANDRIVA">MDVSA-2014:044</ref>
    </refs>
    <vuln_soft>
      <prod vendor="zarafa" name="zarafa">
        <vers num="5.00"/>
        <vers num="5.01"/>
        <vers num="5.02"/>
        <vers num="5.10"/>
        <vers num="5.11"/>
        <vers num="5.20"/>
        <vers num="5.22"/>
        <vers num="6.00"/>
        <vers num="6.01"/>
        <vers num="6.02"/>
        <vers num="6.03"/>
        <vers num="6.10"/>
        <vers num="6.11"/>
        <vers prev="1" num="6.20"/>
        <vers num="7.1.8"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0080" published="2014-02-20" name="CVE-2014-0080" modified="2014-02-20" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:P)" CVSS_score="6.8" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.6" CVSS_base_score="6.8">
    <desc>
      <descript source="cve">SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql/cast.rb in Active Record in Ruby on Rails 4.0.x before 4.0.3, and 4.1.0.beta1, when PostgreSQL is used, allows remote attackers to execute "add data" SQL commands via vectors involving \ (backslash) characters that are not properly handled in operations on array columns.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://groups.google.com/forum/message/raw?msg=rubyonrails-security/Wu96YkTUR6s/pPLBMZrlwvYJ" source="MLIST">[rubyonrails-security] 20140218 Data Injection Vulnerability in Active Record (CVE-2014-0080)</ref>
      <ref url="http://openwall.com/lists/oss-security/2014/02/18/9" source="MLIST">[oss-security] 20140218 Data Injection Vulnerability in Active Record (CVE-2014-0080)</ref>
    </refs>
    <vuln_soft>
      <prod vendor="rubyonrails" name="ruby_on_rails">
        <vers num="4.0.0" edition="-"/>
        <vers num="4.0.0" edition="beta"/>
        <vers num="4.0.0" edition="rc1"/>
        <vers num="4.0.0" edition="rc2"/>
        <vers num="4.0.1" edition="-"/>
        <vers num="4.0.1" edition="rc1"/>
        <vers num="4.0.1" edition="rc2"/>
        <vers num="4.0.1" edition="rc3"/>
        <vers num="4.0.1" edition="rc4"/>
        <vers num="4.0.2" edition="-"/>
        <vers num="4.1.0" edition="beta1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0081" published="2014-02-20" name="CVE-2014-0081" modified="2014-03-26" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Multiple cross-site scripting (XSS) vulnerabilities in actionview/lib/action_view/helpers/number_helper.rb in Ruby on Rails before 3.2.17, 4.0.x before 4.0.3, and 4.1.x before 4.1.0.beta2 allow remote attackers to inject arbitrary web script or HTML via the (1) format, (2) negative_format, or (3) units parameter to the (a) number_to_currency, (b) number_to_percentage, or (c) number_to_human helper.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="https://groups.google.com/forum/message/raw?msg=rubyonrails-security/tfp6gZCtzr4/j8LUHmu7fIEJ" source="MLIST">[rubyonrails-security] 20140218 XSS Vulnerability in number_to_currency, number_to_percentage and number_to_human (CVE-2014-0081)</ref>
      <ref url="http://secunia.com/advisories/57376" source="SECUNIA">57376</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0306.html" source="REDHAT">RHSA-2014:0306</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0215.html" source="REDHAT">RHSA-2014:0215</ref>
      <ref url="http://openwall.com/lists/oss-security/2014/02/18/8" source="MLIST">[oss-security] 20140218 XSS Vulnerability in number_to_currency, number_to_percentage and number_to_human (CVE-2014-0081)</ref>
      <ref url="http://lists.opensuse.org/opensuse-updates/2014-02/msg00081.html" source="SUSE">openSUSE-SU-2014:0295</ref>
    </refs>
    <vuln_soft>
      <prod vendor="rubyonrails" name="ruby_on_rails">
        <vers num="0.10.0"/>
        <vers num="0.10.1"/>
        <vers num="0.11.0"/>
        <vers num="0.11.1"/>
        <vers num="0.12.0"/>
        <vers num="0.12.1"/>
        <vers num="0.13.0"/>
        <vers num="0.13.1"/>
        <vers num="0.14.1"/>
        <vers num="0.14.2"/>
        <vers num="0.14.3"/>
        <vers num="0.14.4"/>
        <vers num="0.5.0"/>
        <vers num="0.5.5"/>
        <vers num="0.5.6"/>
        <vers num="0.5.7"/>
        <vers num="0.6.0"/>
        <vers num="0.6.5"/>
        <vers num="0.7.0"/>
        <vers num="0.8.0"/>
        <vers num="0.8.5"/>
        <vers num="0.9.0"/>
        <vers num="0.9.1"/>
        <vers num="0.9.2"/>
        <vers num="0.9.3"/>
        <vers num="0.9.4"/>
        <vers num="0.9.4.1"/>
        <vers num="1.0.0"/>
        <vers num="1.1.0"/>
        <vers num="1.1.1"/>
        <vers num="1.1.2"/>
        <vers num="1.1.3"/>
        <vers num="1.1.4"/>
        <vers num="1.1.5"/>
        <vers num="1.1.6"/>
        <vers num="1.2.0"/>
        <vers num="1.2.1"/>
        <vers num="1.2.2"/>
        <vers num="1.2.3"/>
        <vers num="1.2.4"/>
        <vers num="1.2.5"/>
        <vers num="1.2.6"/>
        <vers num="1.9.5"/>
        <vers num="2.0.0" edition="rc1"/>
        <vers num="2.0.0" edition="rc2"/>
        <vers num="2.0.1"/>
        <vers num="2.0.2"/>
        <vers num="2.0.4"/>
        <vers num="2.1"/>
        <vers num="2.1.0"/>
        <vers num="2.1.1"/>
        <vers num="2.1.2"/>
        <vers num="2.2.0"/>
        <vers num="2.2.1"/>
        <vers num="2.2.2"/>
        <vers num="2.3.0"/>
        <vers num="2.3.1"/>
        <vers num="2.3.10"/>
        <vers num="2.3.11"/>
        <vers num="2.3.12"/>
        <vers num="2.3.13"/>
        <vers num="2.3.14"/>
        <vers num="2.3.15"/>
        <vers num="2.3.16"/>
        <vers num="2.3.2"/>
        <vers num="2.3.3"/>
        <vers num="2.3.4"/>
        <vers num="2.3.9"/>
        <vers num="3.0.0" edition="beta"/>
        <vers num="3.0.0" edition="beta2"/>
        <vers num="3.0.0" edition="beta3"/>
        <vers num="3.0.0" edition="beta4"/>
        <vers num="3.0.0" edition="rc"/>
        <vers num="3.0.0" edition="rc2"/>
        <vers num="3.0.1" edition="pre"/>
        <vers num="3.0.10" edition="rc1"/>
        <vers num="3.0.11"/>
        <vers num="3.0.12" edition="rc1"/>
        <vers num="3.0.13" edition="rc1"/>
        <vers num="3.0.14"/>
        <vers num="3.0.16"/>
        <vers num="3.0.17"/>
        <vers num="3.0.18"/>
        <vers num="3.0.19"/>
        <vers num="3.0.2" edition="pre"/>
        <vers num="3.0.20"/>
        <vers num="3.0.3"/>
        <vers num="3.0.4" edition="rc"/>
        <vers num="3.0.4" edition="rc1"/>
        <vers num="3.0.5" edition="rc1"/>
        <vers num="3.0.6" edition="rc1"/>
        <vers num="3.0.6" edition="rc2"/>
        <vers num="3.0.7" edition="rc1"/>
        <vers num="3.0.7" edition="rc2"/>
        <vers num="3.0.8" edition="rc1"/>
        <vers num="3.0.8" edition="rc2"/>
        <vers num="3.0.8" edition="rc3"/>
        <vers num="3.0.8" edition="rc4"/>
        <vers num="3.0.9" edition="rc1"/>
        <vers num="3.0.9" edition="rc2"/>
        <vers num="3.0.9" edition="rc3"/>
        <vers num="3.0.9" edition="rc4"/>
        <vers num="3.0.9" edition="rc5"/>
        <vers num="3.1.0" edition="beta1"/>
        <vers num="3.1.0" edition="rc1"/>
        <vers num="3.1.0" edition="rc2"/>
        <vers num="3.1.0" edition="rc3"/>
        <vers num="3.1.0" edition="rc4"/>
        <vers num="3.1.0" edition="rc5"/>
        <vers num="3.1.0" edition="rc6"/>
        <vers num="3.1.0" edition="rc7"/>
        <vers num="3.1.0" edition="rc8"/>
        <vers num="3.1.1" edition="rc1"/>
        <vers num="3.1.1" edition="rc2"/>
        <vers num="3.1.1" edition="rc3"/>
        <vers num="3.1.10"/>
        <vers num="3.1.2" edition="rc1"/>
        <vers num="3.1.2" edition="rc2"/>
        <vers num="3.1.3"/>
        <vers num="3.1.4" edition="rc1"/>
        <vers num="3.1.5" edition="rc1"/>
        <vers num="3.1.6"/>
        <vers num="3.1.7"/>
        <vers num="3.1.8"/>
        <vers num="3.1.9"/>
        <vers num="3.2.0" edition="rc1"/>
        <vers num="3.2.0" edition="rc2"/>
        <vers num="3.2.1"/>
        <vers num="3.2.10"/>
        <vers num="3.2.11"/>
        <vers num="3.2.12"/>
        <vers num="3.2.13" edition="rc1"/>
        <vers num="3.2.13" edition="rc2"/>
        <vers num="3.2.14" edition="rc1"/>
        <vers num="3.2.14" edition="rc2"/>
        <vers num="3.2.15" edition="rc1"/>
        <vers num="3.2.15" edition="rc2"/>
        <vers num="3.2.15" edition="rc3"/>
        <vers prev="1" num="3.2.16"/>
        <vers num="3.2.2" edition="rc1"/>
        <vers num="3.2.3" edition="rc1"/>
        <vers num="3.2.3" edition="rc2"/>
        <vers num="3.2.4" edition="rc1"/>
        <vers num="3.2.5"/>
        <vers num="3.2.6"/>
        <vers num="3.2.7"/>
        <vers num="3.2.8"/>
        <vers num="3.2.9"/>
        <vers num="4.0.0" edition="-"/>
        <vers num="4.0.0" edition="beta"/>
        <vers num="4.0.0" edition="rc1"/>
        <vers num="4.0.0" edition="rc2"/>
        <vers num="4.0.1" edition="-"/>
        <vers num="4.0.1" edition="rc1"/>
        <vers num="4.0.1" edition="rc2"/>
        <vers num="4.0.1" edition="rc3"/>
        <vers num="4.0.1" edition="rc4"/>
        <vers num="4.0.2" edition="-"/>
        <vers num="4.1.0" edition="beta1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0082" published="2014-02-20" name="CVE-2014-0082" modified="2014-04-24" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:P)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">actionpack/lib/action_view/template/text.rb in Action View in Ruby on Rails 3.x before 3.2.17 converts MIME type strings to symbols during use of the :text option to the render method, which allows remote attackers to cause a denial of service (memory consumption) by including these strings in headers.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://groups.google.com/forum/message/raw?msg=rubyonrails-security/LMxO_3_eCuc/ozGBEhKaJbIJ" source="MLIST">[rubyonrails-security] 20140218 Denial of Service Vulnerability in Action View when using render :text (CVE-2014-0082)</ref>
      <ref url="http://www.getchef.com/blog/2014/04/09/enterprise-chef-11-1-3-release/" source="CONFIRM">http://www.getchef.com/blog/2014/04/09/enterprise-chef-11-1-3-release/</ref>
      <ref url="http://secunia.com/advisories/57836" source="SECUNIA">57836</ref>
      <ref url="http://secunia.com/advisories/57376" source="SECUNIA">57376</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0306.html" source="REDHAT">RHSA-2014:0306</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0215.html" source="REDHAT">RHSA-2014:0215</ref>
      <ref url="http://openwall.com/lists/oss-security/2014/02/18/10" source="MLIST">[oss-security] 20140218 Denial of Service Vulnerability in Action View when using render :text (CVE-2014-0082)</ref>
      <ref url="http://lists.opensuse.org/opensuse-updates/2014-02/msg00081.html" source="SUSE">openSUSE-SU-2014:0295</ref>
    </refs>
    <vuln_soft>
      <prod vendor="rubyonrails" name="ruby_on_rails">
        <vers num="3.0.0" edition="beta"/>
        <vers num="3.0.0" edition="beta2"/>
        <vers num="3.0.0" edition="beta3"/>
        <vers num="3.0.0" edition="beta4"/>
        <vers num="3.0.0" edition="rc"/>
        <vers num="3.0.0" edition="rc2"/>
        <vers num="3.0.1" edition="pre"/>
        <vers num="3.0.10" edition="rc1"/>
        <vers num="3.0.11"/>
        <vers num="3.0.12" edition="rc1"/>
        <vers num="3.0.13" edition="rc1"/>
        <vers num="3.0.14"/>
        <vers num="3.0.16"/>
        <vers num="3.0.17"/>
        <vers num="3.0.18"/>
        <vers num="3.0.19"/>
        <vers num="3.0.2" edition="pre"/>
        <vers num="3.0.20"/>
        <vers num="3.0.3"/>
        <vers num="3.0.4" edition="rc"/>
        <vers num="3.0.4" edition="rc1"/>
        <vers num="3.0.5" edition="rc1"/>
        <vers num="3.0.6" edition="rc1"/>
        <vers num="3.0.6" edition="rc2"/>
        <vers num="3.0.7" edition="rc1"/>
        <vers num="3.0.7" edition="rc2"/>
        <vers num="3.0.8" edition="rc1"/>
        <vers num="3.0.8" edition="rc2"/>
        <vers num="3.0.8" edition="rc3"/>
        <vers num="3.0.8" edition="rc4"/>
        <vers num="3.0.9" edition="rc1"/>
        <vers num="3.0.9" edition="rc2"/>
        <vers num="3.0.9" edition="rc3"/>
        <vers num="3.0.9" edition="rc4"/>
        <vers num="3.0.9" edition="rc5"/>
        <vers num="3.1.0" edition="beta1"/>
        <vers num="3.1.0" edition="rc1"/>
        <vers num="3.1.0" edition="rc2"/>
        <vers num="3.1.0" edition="rc3"/>
        <vers num="3.1.0" edition="rc4"/>
        <vers num="3.1.0" edition="rc5"/>
        <vers num="3.1.0" edition="rc6"/>
        <vers num="3.1.0" edition="rc7"/>
        <vers num="3.1.0" edition="rc8"/>
        <vers num="3.1.1" edition="rc1"/>
        <vers num="3.1.1" edition="rc2"/>
        <vers num="3.1.1" edition="rc3"/>
        <vers num="3.1.10"/>
        <vers num="3.1.2" edition="rc1"/>
        <vers num="3.1.2" edition="rc2"/>
        <vers num="3.1.3"/>
        <vers num="3.1.4" edition="rc1"/>
        <vers num="3.1.5" edition="rc1"/>
        <vers num="3.1.6"/>
        <vers num="3.1.7"/>
        <vers num="3.1.8"/>
        <vers num="3.1.9"/>
        <vers num="3.2.0" edition="rc1"/>
        <vers num="3.2.0" edition="rc2"/>
        <vers num="3.2.1"/>
        <vers num="3.2.10"/>
        <vers num="3.2.11"/>
        <vers num="3.2.12"/>
        <vers num="3.2.13" edition="rc1"/>
        <vers num="3.2.13" edition="rc2"/>
        <vers num="3.2.14" edition="rc1"/>
        <vers num="3.2.14" edition="rc2"/>
        <vers num="3.2.15" edition="rc1"/>
        <vers num="3.2.15" edition="rc2"/>
        <vers num="3.2.15" edition="rc3"/>
        <vers prev="1" num="3.2.16"/>
        <vers num="3.2.2" edition="rc1"/>
        <vers num="3.2.3" edition="rc1"/>
        <vers num="3.2.3" edition="rc2"/>
        <vers num="3.2.4" edition="rc1"/>
        <vers num="3.2.5"/>
        <vers num="3.2.6"/>
        <vers num="3.2.7"/>
        <vers num="3.2.8"/>
        <vers num="3.2.9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-0085" published="2014-04-17" name="CVE-2014-0085" modified="2014-04-17" CVSS_version="2.0" CVSS_vector="(AV:L/AC:L/Au:N/C:P/I:N/A:N)" CVSS_score="2.1" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="3.9" CVSS_base_score="2.1">
    <desc>
      <descript source="cve">Apache Zookeeper logs cleartext admin passwords, which allows local users to obtain sensitive information by reading the log.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="https://bugzilla.redhat.com/show_bug.cgi?id=1067265" source="CONFIRM">https://bugzilla.redhat.com/show_bug.cgi?id=1067265</ref>
      <ref url="http://secunia.com/advisories/57915" source="SECUNIA" adv="1">57915</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0400.html" source="REDHAT">RHSA-2014:0400</ref>
    </refs>
    <vuln_soft>
      <prod vendor="apache" name="zookeeper">
        <vers num="-"/>
      </prod>
      <prod vendor="redhat" name="jboss_fuse">
        <vers num="6.0.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0086" published="2014-03-31" name="CVE-2014-0086" modified="2014-03-31" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:N/A:P)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">The doFilter function in webapp/PushHandlerFilter.java in JBoss RichFaces 4.3.4, 4.3.5, and 5.x allows remote attackers to cause a denial of service (memory consumption and out-of-memory error) via a large number of malformed atmosphere push requests.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://issues.jboss.org/browse/RF-13250" source="CONFIRM" patch="1">https://issues.jboss.org/browse/RF-13250</ref>
      <ref url="https://github.com/pslegr/core-1/commit/8131f15003f5bec73d475d2b724472e4b87d0757" source="CONFIRM" patch="1">https://github.com/pslegr/core-1/commit/8131f15003f5bec73d475d2b724472e4b87d0757</ref>
      <ref url="https://bugzilla.redhat.com/show_bug.cgi?id=1067268" source="CONFIRM">https://bugzilla.redhat.com/show_bug.cgi?id=1067268</ref>
      <ref url="http://secunia.com/advisories/57053" source="SECUNIA" adv="1">57053</ref>
    </refs>
    <vuln_soft>
      <prod vendor="redhat" name="jboss_web_framework_kit">
        <vers num="2.5.0"/>
      </prod>
      <prod vendor="redhat" name="richfaces">
        <vers num="4.3.4"/>
        <vers num="4.3.5"/>
        <vers num="5.0.0" edition="alpha1"/>
        <vers num="5.0.0" edition="alpha2"/>
        <vers num="5.0.0" edition="alpha3"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0088" published="2014-04-29" name="CVE-2014-0088" modified="2014-04-30" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">The SPDY implementation in the ngx_http_spdy_module module in nginx 1.5.10 before 1.5.11, when running on a 32-bit platform, allows remote attackers to execute arbitrary code via a crafted request.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://mailman.nginx.org/pipermail/nginx-announce/2014/000132.html" source="MLIST" patch="1">[nginx-announce] 20140304 nginx security advisory (CVE-2014-0088)</ref>
      <ref url="http://www.securitytracker.com/id/1030150" source="SECTRACK">1030150</ref>
    </refs>
    <vuln_soft>
      <prod vendor="igor_sysoev" name="nginx">
        <vers num="1.5.10"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0089" published="2014-03-27" name="CVE-2014-0089" modified="2014-03-27" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in app/views/common/500.html.erb in Foreman 1.4.x before 1.4.2 allows remote authenticated users to inject arbitrary web script or HTML via the bookmark name when adding a bookmark.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://projects.theforeman.org/issues/4456" source="CONFIRM" patch="1">http://projects.theforeman.org/issues/4456</ref>
      <ref url="https://bugzilla.redhat.com/show_bug.cgi?id=1071741" source="MISC">https://bugzilla.redhat.com/show_bug.cgi?id=1071741</ref>
      <ref url="http://theforeman.org/security.html" source="CONFIRM" adv="1">http://theforeman.org/security.html</ref>
      <ref url="http://secunia.com/advisories/57575" source="SECUNIA" adv="1">57575</ref>
    </refs>
    <vuln_soft>
      <prod vendor="theforeman" name="foreman">
        <vers num="1.4.0"/>
        <vers num="1.4.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0092" published="2014-03-06" name="CVE-2014-0092" modified="2014-04-19" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:N)" CVSS_score="5.8" CVSS_impact_subscore="4.9" CVSS_exploit_subscore="8.6" CVSS_base_score="5.8">
    <desc>
      <descript source="cve">lib/x509/verify.c in GnuTLS before 3.1.22 and 3.2.x before 3.2.12 does not properly handle unspecified errors when verifying X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers via a crafted certificate.</descript>
    </desc>
    <loss_types>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://bugzilla.redhat.com/show_bug.cgi?id=1069865" source="CONFIRM">https://bugzilla.redhat.com/show_bug.cgi?id=1069865</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2127-1" source="UBUNTU">USN-2127-1</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2869" source="DEBIAN">DSA-2869</ref>
      <ref url="http://secunia.com/advisories/57321" source="SECUNIA">57321</ref>
      <ref url="http://secunia.com/advisories/57274" source="SECUNIA">57274</ref>
      <ref url="http://secunia.com/advisories/57260" source="SECUNIA">57260</ref>
      <ref url="http://secunia.com/advisories/57254" source="SECUNIA">57254</ref>
      <ref url="http://secunia.com/advisories/57204" source="SECUNIA" adv="1">57204</ref>
      <ref url="http://secunia.com/advisories/57103" source="SECUNIA">57103</ref>
      <ref url="http://secunia.com/advisories/56933" source="SECUNIA" adv="1">56933</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0339.html" source="REDHAT">RHSA-2014:0339</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0288.html" source="REDHAT">RHSA-2014:0288</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0247.html" source="REDHAT">RHSA-2014:0247</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0246.html" source="REDHAT">RHSA-2014:0246</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00020.html" source="SUSE">SUSE-SU-2014:0445</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00009.html" source="SUSE">openSUSE-SU-2014:0346</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00007.html" source="SUSE">openSUSE-SU-2014:0328</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00006.html" source="SUSE">openSUSE-SU-2014:0325</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00005.html" source="SUSE">SUSE-SU-2014:0324</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00004.html" source="SUSE">SUSE-SU-2014:0323</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00003.html" source="SUSE">SUSE-SU-2014:0322</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00002.html" source="SUSE">SUSE-SU-2014:0321</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00001.html" source="SUSE">SUSE-SU-2014:0320</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00000.html" source="SUSE">SUSE-SU-2014:0319</ref>
      <ref url="http://gnutls.org/security.html#GNUTLS-SA-2014-2" source="CONFIRM">http://gnutls.org/security.html#GNUTLS-SA-2014-2</ref>
    </refs>
    <vuln_soft>
      <prod vendor="gnu" name="gnutls">
        <vers num="3.1.0"/>
        <vers num="3.1.1"/>
        <vers num="3.1.10"/>
        <vers num="3.1.11"/>
        <vers num="3.1.12"/>
        <vers num="3.1.13"/>
        <vers num="3.1.14"/>
        <vers num="3.1.15"/>
        <vers num="3.1.16"/>
        <vers num="3.1.17"/>
        <vers num="3.1.18"/>
        <vers num="3.1.19"/>
        <vers num="3.1.2"/>
        <vers num="3.1.20"/>
        <vers prev="1" num="3.1.21"/>
        <vers num="3.1.3"/>
        <vers num="3.1.4"/>
        <vers num="3.1.5"/>
        <vers num="3.1.6"/>
        <vers num="3.1.7"/>
        <vers num="3.1.8"/>
        <vers num="3.1.9"/>
        <vers num="3.2.0"/>
        <vers num="3.2.1"/>
        <vers num="3.2.10"/>
        <vers prev="1" num="3.2.11"/>
        <vers num="3.2.2"/>
        <vers num="3.2.3"/>
        <vers num="3.2.4"/>
        <vers num="3.2.5"/>
        <vers num="3.2.6"/>
        <vers num="3.2.7"/>
        <vers num="3.2.8"/>
        <vers num="3.2.8.1"/>
        <vers num="3.2.9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0093" published="2014-04-03" name="CVE-2014-0093" modified="2014-04-03" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:N)" CVSS_score="5.8" CVSS_impact_subscore="4.9" CVSS_exploit_subscore="8.6" CVSS_base_score="5.8">
    <desc>
      <descript source="cve">Red Hat JBoss Enterprise Application Platform (JBEAP) 6.2.2, when using a Java Security Manager (JSM), does not properly apply permissions defined by a policy file, which causes applications to be granted the java.security.AllPermission permission and allows remote attackers to bypass intended access restrictions.</descript>
    </desc>
    <loss_types>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://secunia.com/advisories/57675" source="SECUNIA" adv="1">57675</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0345.html" source="REDHAT" adv="1">RHSA-2014:0345</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0344.html" source="REDHAT" adv="1">RHSA-2014:0344</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0343.html" source="REDHAT" adv="1">RHSA-2014:0343</ref>
    </refs>
    <vuln_soft>
      <prod vendor="redhat" name="jboss_enterprise_application_platform">
        <vers num="6.2.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0094" published="2014-03-11" name="CVE-2014-0094" modified="2014-03-11" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:P/A:N)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">The ParametersInterceptor in Apache Struts before 2.3.16.1 allows remote attackers to "manipulate" the ClassLoader via the class parameter, which is passed to the getClass method.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.securitytracker.com/id/1029876" source="SECTRACK">1029876</ref>
      <ref url="http://www.securityfocus.com/bid/65999" source="BID">65999</ref>
      <ref url="http://www.securityfocus.com/archive/1/archive/1/531362/100/0/threaded" source="BUGTRAQ">20140306 [ANN] Struts 2.3.16.1 GA release available - security fix</ref>
      <ref url="http://struts.apache.org/release/2.3.x/docs/s2-020.html" source="CONFIRM" adv="1">http://struts.apache.org/release/2.3.x/docs/s2-020.html</ref>
      <ref url="http://secunia.com/advisories/56440" source="SECUNIA" adv="1">56440</ref>
    </refs>
    <vuln_soft>
      <prod vendor="apache" name="struts">
        <vers num="2.0.0"/>
        <vers num="2.0.1"/>
        <vers num="2.0.10"/>
        <vers num="2.0.11"/>
        <vers num="2.0.11.1"/>
        <vers num="2.0.11.2"/>
        <vers num="2.0.12"/>
        <vers num="2.0.13"/>
        <vers num="2.0.14"/>
        <vers num="2.0.2"/>
        <vers num="2.0.3"/>
        <vers num="2.0.4"/>
        <vers num="2.0.5"/>
        <vers num="2.0.6"/>
        <vers num="2.0.7"/>
        <vers num="2.0.8"/>
        <vers num="2.0.9"/>
        <vers num="2.1.0"/>
        <vers num="2.1.1"/>
        <vers num="2.1.2"/>
        <vers num="2.1.3"/>
        <vers num="2.1.4"/>
        <vers num="2.1.5"/>
        <vers num="2.1.6"/>
        <vers num="2.1.8"/>
        <vers num="2.1.8.1"/>
        <vers num="2.2.1"/>
        <vers num="2.2.1.1"/>
        <vers num="2.2.3"/>
        <vers num="2.2.3.1"/>
        <vers num="2.3.1"/>
        <vers num="2.3.1.1"/>
        <vers num="2.3.1.2"/>
        <vers num="2.3.12"/>
        <vers num="2.3.14"/>
        <vers num="2.3.14.1"/>
        <vers num="2.3.14.2"/>
        <vers num="2.3.14.3"/>
        <vers num="2.3.15"/>
        <vers num="2.3.15.1"/>
        <vers num="2.3.15.2"/>
        <vers num="2.3.15.3"/>
        <vers prev="1" num="2.3.16"/>
        <vers num="2.3.3"/>
        <vers num="2.3.4"/>
        <vers num="2.3.4.1"/>
        <vers num="2.3.7"/>
        <vers num="2.3.8"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0098" published="2014-03-18" name="CVE-2014-0098" modified="2014-04-01" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:P)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">The log_cookie function in mod_log_config.c in the mod_log_config module in the Apache HTTP Server before 2.4.8 allows remote attackers to cause a denial of service (segmentation fault and daemon crash) via a crafted cookie that is not properly handled during truncation.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/loggers/mod_log_config.c?r1=1575394&amp;r2=1575400&amp;diff_format=h" source="CONFIRM" patch="1">http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/loggers/mod_log_config.c?r1=1575394&amp;r2=1575400&amp;diff_format=h</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2152-1" source="UBUNTU">USN-2152-1</ref>
      <ref url="http://www.apache.org/dist/httpd/CHANGES_2.4.9" source="CONFIRM">http://www.apache.org/dist/httpd/CHANGES_2.4.9</ref>
      <ref url="http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/loggers/mod_log_config.c" source="CONFIRM">http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/loggers/mod_log_config.c</ref>
    </refs>
    <vuln_soft>
      <prod vendor="apache" name="http_server">
        <vers num="2.0"/>
        <vers num="2.0.28" edition="beta"/>
        <vers num="2.0.32" edition="beta"/>
        <vers num="2.0.34" edition="beta"/>
        <vers num="2.0.35"/>
        <vers num="2.0.36"/>
        <vers num="2.0.37"/>
        <vers num="2.0.38"/>
        <vers num="2.0.39"/>
        <vers num="2.0.40"/>
        <vers num="2.0.41"/>
        <vers num="2.0.42"/>
        <vers num="2.0.43"/>
        <vers num="2.0.44"/>
        <vers num="2.0.45"/>
        <vers num="2.0.46"/>
        <vers num="2.0.47"/>
        <vers num="2.0.48"/>
        <vers num="2.0.49"/>
        <vers num="2.0.50"/>
        <vers num="2.0.51"/>
        <vers num="2.0.52"/>
        <vers num="2.0.53"/>
        <vers num="2.0.54"/>
        <vers num="2.0.55"/>
        <vers num="2.0.56"/>
        <vers num="2.0.57"/>
        <vers num="2.0.58"/>
        <vers num="2.0.59"/>
        <vers num="2.0.60"/>
        <vers num="2.0.61"/>
        <vers num="2.0.63"/>
        <vers num="2.0.64"/>
        <vers num="2.0.9"/>
        <vers num="2.1"/>
        <vers num="2.1.1"/>
        <vers num="2.1.2"/>
        <vers num="2.1.3"/>
        <vers num="2.1.4"/>
        <vers num="2.1.5"/>
        <vers num="2.1.6"/>
        <vers num="2.1.7"/>
        <vers num="2.1.8"/>
        <vers num="2.1.9"/>
        <vers num="2.2"/>
        <vers num="2.2.0"/>
        <vers num="2.2.1"/>
        <vers num="2.2.10"/>
        <vers num="2.2.11"/>
        <vers num="2.2.12"/>
        <vers num="2.2.13"/>
        <vers num="2.2.14"/>
        <vers num="2.2.15"/>
        <vers num="2.2.16"/>
        <vers num="2.2.17"/>
        <vers num="2.2.18"/>
        <vers num="2.2.19"/>
        <vers num="2.2.2"/>
        <vers num="2.2.20"/>
        <vers num="2.2.21"/>
        <vers num="2.2.22"/>
        <vers num="2.2.23"/>
        <vers num="2.2.24"/>
        <vers num="2.2.25"/>
        <vers num="2.2.3"/>
        <vers num="2.2.4"/>
        <vers num="2.2.6"/>
        <vers num="2.2.8"/>
        <vers num="2.2.9"/>
        <vers num="2.3.0"/>
        <vers num="2.3.1"/>
        <vers num="2.3.10"/>
        <vers num="2.3.11"/>
        <vers num="2.3.12"/>
        <vers num="2.3.13"/>
        <vers num="2.3.14"/>
        <vers num="2.3.15"/>
        <vers num="2.3.16"/>
        <vers num="2.3.2"/>
        <vers num="2.3.3"/>
        <vers num="2.3.4"/>
        <vers num="2.3.5"/>
        <vers num="2.3.6"/>
        <vers num="2.3.7"/>
        <vers num="2.3.8"/>
        <vers num="2.3.9"/>
        <vers num="2.4.0"/>
        <vers num="2.4.1"/>
        <vers num="2.4.2"/>
        <vers num="2.4.3"/>
        <vers num="2.4.4"/>
        <vers num="2.4.6"/>
        <vers prev="1" num="2.4.7"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0100" published="2014-03-11" name="CVE-2014-0100" modified="2014-03-11" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">Race condition in the inet_frag_intern function in net/ipv4/inet_fragment.c in the Linux kernel through 3.13.6 allows remote attackers to cause a denial of service (use-after-free error) or possibly have unspecified other impact via a large series of fragmented ICMP Echo Request packets to a system with a heavy CPU load.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.openwall.com/lists/oss-security/2014/03/04/4" source="MLIST" patch="1">[oss-security] 20140304 CVE-2014-0100 -- Linux kernel: net: inet frag code race condition leading to user-after-free</ref>
      <ref url="https://bugzilla.redhat.com/show_bug.cgi?id=1070618" source="CONFIRM">https://bugzilla.redhat.com/show_bug.cgi?id=1070618</ref>
      <ref url="http://patchwork.ozlabs.org/patch/325844/" source="MISC">http://patchwork.ozlabs.org/patch/325844/</ref>
    </refs>
    <vuln_soft>
      <prod vendor="linux" name="linux_kernel">
        <vers num="3.0" edition="rc1"/>
        <vers num="3.0" edition="rc2"/>
        <vers num="3.0" edition="rc3"/>
        <vers num="3.0" edition="rc4"/>
        <vers num="3.0" edition="rc5"/>
        <vers num="3.0" edition="rc6"/>
        <vers num="3.0" edition="rc7"/>
        <vers num="3.0.1"/>
        <vers num="3.0.10"/>
        <vers num="3.0.11"/>
        <vers num="3.0.12"/>
        <vers num="3.0.13"/>
        <vers num="3.0.14"/>
        <vers num="3.0.15"/>
        <vers num="3.0.16"/>
        <vers num="3.0.17"/>
        <vers num="3.0.18"/>
        <vers num="3.0.19"/>
        <vers num="3.0.2"/>
        <vers num="3.0.20"/>
        <vers num="3.0.21"/>
        <vers num="3.0.22"/>
        <vers num="3.0.23"/>
        <vers num="3.0.24"/>
        <vers num="3.0.25"/>
        <vers num="3.0.26"/>
        <vers num="3.0.27"/>
        <vers num="3.0.28"/>
        <vers num="3.0.29"/>
        <vers num="3.0.3"/>
        <vers num="3.0.30"/>
        <vers num="3.0.31"/>
        <vers num="3.0.32"/>
        <vers num="3.0.33"/>
        <vers num="3.0.34"/>
        <vers num="3.0.35"/>
        <vers num="3.0.36"/>
        <vers num="3.0.37"/>
        <vers num="3.0.38"/>
        <vers num="3.0.39"/>
        <vers num="3.0.4"/>
        <vers num="3.0.40"/>
        <vers num="3.0.41"/>
        <vers num="3.0.42"/>
        <vers num="3.0.43"/>
        <vers num="3.0.44"/>
        <vers num="3.0.45"/>
        <vers num="3.0.46"/>
        <vers num="3.0.47"/>
        <vers num="3.0.48"/>
        <vers num="3.0.49"/>
        <vers num="3.0.5"/>
        <vers num="3.0.50"/>
        <vers num="3.0.51"/>
        <vers num="3.0.52"/>
        <vers num="3.0.53"/>
        <vers num="3.0.54"/>
        <vers num="3.0.55"/>
        <vers num="3.0.56"/>
        <vers num="3.0.57"/>
        <vers num="3.0.58"/>
        <vers num="3.0.59"/>
        <vers num="3.0.6"/>
        <vers num="3.0.60"/>
        <vers num="3.0.61"/>
        <vers num="3.0.62"/>
        <vers num="3.0.63"/>
        <vers num="3.0.64"/>
        <vers num="3.0.65"/>
        <vers num="3.0.66"/>
        <vers num="3.0.67"/>
        <vers num="3.0.68"/>
        <vers num="3.0.7"/>
        <vers num="3.0.8"/>
        <vers num="3.0.9"/>
        <vers num="3.1" edition="rc1"/>
        <vers num="3.1" edition="rc2"/>
        <vers num="3.1" edition="rc3"/>
        <vers num="3.1" edition="rc4"/>
        <vers num="3.1.1"/>
        <vers num="3.1.10"/>
        <vers num="3.1.2"/>
        <vers num="3.1.3"/>
        <vers num="3.1.4"/>
        <vers num="3.1.5"/>
        <vers num="3.1.6"/>
        <vers num="3.1.7"/>
        <vers num="3.1.8"/>
        <vers num="3.1.9"/>
        <vers num="3.10"/>
        <vers num="3.10.1"/>
        <vers num="3.10.10"/>
        <vers num="3.10.11"/>
        <vers num="3.10.12"/>
        <vers num="3.10.13"/>
        <vers num="3.10.14"/>
        <vers num="3.10.15"/>
        <vers num="3.10.16"/>
        <vers num="3.10.17"/>
        <vers num="3.10.18"/>
        <vers num="3.10.19"/>
        <vers num="3.10.2"/>
        <vers num="3.10.20"/>
        <vers num="3.10.21"/>
        <vers num="3.10.22"/>
        <vers num="3.10.23"/>
        <vers num="3.10.24"/>
        <vers num="3.10.25"/>
        <vers num="3.10.26"/>
        <vers num="3.10.27"/>
        <vers num="3.10.28"/>
        <vers num="3.10.29"/>
        <vers num="3.10.3"/>
        <vers num="3.10.4"/>
        <vers num="3.10.5"/>
        <vers num="3.10.6"/>
        <vers num="3.10.7"/>
        <vers num="3.10.8"/>
        <vers num="3.10.9"/>
        <vers num="3.11"/>
        <vers num="3.11.1"/>
        <vers num="3.11.10"/>
        <vers num="3.11.2"/>
        <vers num="3.11.3"/>
        <vers num="3.11.4"/>
        <vers num="3.11.5"/>
        <vers num="3.11.6"/>
        <vers num="3.11.7"/>
        <vers num="3.11.8"/>
        <vers num="3.11.9"/>
        <vers num="3.12"/>
        <vers num="3.12.1"/>
        <vers num="3.12.10"/>
        <vers num="3.12.11"/>
        <vers num="3.12.12"/>
        <vers num="3.12.13"/>
        <vers num="3.12.2"/>
        <vers num="3.12.3"/>
        <vers num="3.12.4"/>
        <vers num="3.12.5"/>
        <vers num="3.12.6"/>
        <vers num="3.12.7"/>
        <vers num="3.12.8"/>
        <vers num="3.12.9"/>
        <vers num="3.13"/>
        <vers num="3.13.1"/>
        <vers num="3.13.2"/>
        <vers num="3.13.3"/>
        <vers num="3.13.4"/>
        <vers num="3.13.5"/>
        <vers num="3.13.6"/>
        <vers num="3.2" edition="rc2"/>
        <vers num="3.2" edition="rc3"/>
        <vers num="3.2" edition="rc4"/>
        <vers num="3.2" edition="rc5"/>
        <vers num="3.2" edition="rc6"/>
        <vers num="3.2" edition="rc7"/>
        <vers num="3.2.1"/>
        <vers num="3.2.10"/>
        <vers num="3.2.11"/>
        <vers num="3.2.12"/>
        <vers num="3.2.13"/>
        <vers num="3.2.14"/>
        <vers num="3.2.15"/>
        <vers num="3.2.16"/>
        <vers num="3.2.17"/>
        <vers num="3.2.18"/>
        <vers num="3.2.19"/>
        <vers num="3.2.2"/>
        <vers num="3.2.20"/>
        <vers num="3.2.21"/>
        <vers num="3.2.22"/>
        <vers num="3.2.23"/>
        <vers num="3.2.24"/>
        <vers num="3.2.25"/>
        <vers num="3.2.26"/>
        <vers num="3.2.27"/>
        <vers num="3.2.28"/>
        <vers num="3.2.29"/>
        <vers num="3.2.3"/>
        <vers num="3.2.30"/>
        <vers num="3.2.4"/>
        <vers num="3.2.5"/>
        <vers num="3.2.6"/>
        <vers num="3.2.7"/>
        <vers num="3.2.8"/>
        <vers num="3.2.9"/>
        <vers num="3.3" edition="rc1"/>
        <vers num="3.3" edition="rc2"/>
        <vers num="3.3" edition="rc3"/>
        <vers num="3.3" edition="rc4"/>
        <vers num="3.3" edition="rc5"/>
        <vers num="3.3" edition="rc6"/>
        <vers num="3.3" edition="rc7"/>
        <vers num="3.3.1"/>
        <vers num="3.3.2"/>
        <vers num="3.3.3"/>
        <vers num="3.3.4"/>
        <vers num="3.3.5"/>
        <vers num="3.3.6"/>
        <vers num="3.3.7"/>
        <vers num="3.3.8"/>
        <vers num="3.4" edition="rc1"/>
        <vers num="3.4" edition="rc2"/>
        <vers num="3.4" edition="rc3"/>
        <vers num="3.4" edition="rc4"/>
        <vers num="3.4" edition="rc5"/>
        <vers num="3.4" edition="rc6"/>
        <vers num="3.4" edition="rc7"/>
        <vers num="3.4.1"/>
        <vers num="3.4.10"/>
        <vers num="3.4.11"/>
        <vers num="3.4.12"/>
        <vers num="3.4.13"/>
        <vers num="3.4.14"/>
        <vers num="3.4.15"/>
        <vers num="3.4.16"/>
        <vers num="3.4.17"/>
        <vers num="3.4.18"/>
        <vers num="3.4.19"/>
        <vers num="3.4.2"/>
        <vers num="3.4.20"/>
        <vers num="3.4.21"/>
        <vers num="3.4.22"/>
        <vers num="3.4.23"/>
        <vers num="3.4.24"/>
        <vers num="3.4.25"/>
        <vers num="3.4.26"/>
        <vers num="3.4.27"/>
        <vers num="3.4.28"/>
        <vers num="3.4.29"/>
        <vers num="3.4.3"/>
        <vers num="3.4.30"/>
        <vers num="3.4.31"/>
        <vers num="3.4.32"/>
        <vers num="3.4.33"/>
        <vers num="3.4.34"/>
        <vers num="3.4.35"/>
        <vers num="3.4.36"/>
        <vers num="3.4.37"/>
        <vers num="3.4.38"/>
        <vers num="3.4.39"/>
        <vers num="3.4.4"/>
        <vers num="3.4.40"/>
        <vers num="3.4.41"/>
        <vers num="3.4.42"/>
        <vers num="3.4.43"/>
        <vers num="3.4.44"/>
        <vers num="3.4.45"/>
        <vers num="3.4.46"/>
        <vers num="3.4.47"/>
        <vers num="3.4.48"/>
        <vers num="3.4.49"/>
        <vers num="3.4.5"/>
        <vers num="3.4.50"/>
        <vers num="3.4.51"/>
        <vers num="3.4.52"/>
        <vers num="3.4.53"/>
        <vers num="3.4.54"/>
        <vers num="3.4.55"/>
        <vers num="3.4.56"/>
        <vers num="3.4.57"/>
        <vers num="3.4.58"/>
        <vers num="3.4.59"/>
        <vers num="3.4.6"/>
        <vers num="3.4.60"/>
        <vers num="3.4.61"/>
        <vers num="3.4.62"/>
        <vers num="3.4.63"/>
        <vers num="3.4.64"/>
        <vers num="3.4.65"/>
        <vers num="3.4.66"/>
        <vers num="3.4.67"/>
        <vers num="3.4.68"/>
        <vers num="3.4.69"/>
        <vers num="3.4.7"/>
        <vers num="3.4.70"/>
        <vers num="3.4.71"/>
        <vers num="3.4.72"/>
        <vers num="3.4.73"/>
        <vers num="3.4.74"/>
        <vers num="3.4.75"/>
        <vers num="3.4.76"/>
        <vers num="3.4.77"/>
        <vers num="3.4.78"/>
        <vers num="3.4.79"/>
        <vers num="3.4.8"/>
        <vers num="3.4.9"/>
        <vers num="3.5.1"/>
        <vers num="3.5.2"/>
        <vers num="3.5.3"/>
        <vers num="3.5.4"/>
        <vers num="3.5.5"/>
        <vers num="3.5.6"/>
        <vers num="3.5.7"/>
        <vers num="3.6"/>
        <vers num="3.6.1"/>
        <vers num="3.6.10"/>
        <vers num="3.6.11"/>
        <vers num="3.6.2"/>
        <vers num="3.6.3"/>
        <vers num="3.6.4"/>
        <vers num="3.6.5"/>
        <vers num="3.6.6"/>
        <vers num="3.6.7"/>
        <vers num="3.6.8"/>
        <vers num="3.6.9"/>
        <vers num="3.7"/>
        <vers num="3.7.1"/>
        <vers num="3.7.10"/>
        <vers num="3.7.2"/>
        <vers num="3.7.3"/>
        <vers num="3.7.4"/>
        <vers num="3.7.5"/>
        <vers num="3.7.6"/>
        <vers num="3.7.7"/>
        <vers num="3.7.8"/>
        <vers num="3.7.9"/>
        <vers num="3.8.0"/>
        <vers num="3.8.1"/>
        <vers num="3.8.10"/>
        <vers num="3.8.11"/>
        <vers num="3.8.12"/>
        <vers num="3.8.13"/>
        <vers num="3.8.2"/>
        <vers num="3.8.3"/>
        <vers num="3.8.4"/>
        <vers num="3.8.5"/>
        <vers num="3.8.6"/>
        <vers num="3.8.7"/>
        <vers num="3.8.8"/>
        <vers num="3.8.9"/>
        <vers num="3.9" edition="rc1"/>
        <vers num="3.9" edition="rc2"/>
        <vers num="3.9" edition="rc3"/>
        <vers num="3.9" edition="rc4"/>
        <vers num="3.9" edition="rc5"/>
        <vers num="3.9" edition="rc6"/>
        <vers num="3.9" edition="rc7"/>
        <vers num="3.9.0"/>
        <vers num="3.9.1"/>
        <vers num="3.9.10"/>
        <vers num="3.9.11"/>
        <vers num="3.9.2"/>
        <vers num="3.9.3"/>
        <vers num="3.9.4"/>
        <vers num="3.9.5"/>
        <vers num="3.9.6"/>
        <vers num="3.9.7"/>
        <vers num="3.9.8"/>
        <vers num="3.9.9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0101" published="2014-03-11" name="CVE-2014-0101" modified="2014-04-01" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:N/A:C)" CVSS_score="7.1" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="8.6" CVSS_base_score="7.1">
    <desc>
      <descript source="cve">The sctp_sf_do_5_1D_ce function in net/sctp/sm_statefuns.c in the Linux kernel through 3.13.6 does not validate certain auth_enable and auth_capable fields before making an sctp_sf_authenticate call, which allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) via an SCTP handshake with a modified INIT chunk and a crafted AUTH chunk before a COOKIE_ECHO chunk.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.openwall.com/lists/oss-security/2014/03/04/6" source="MLIST" patch="1">[oss-security] 20140304 CVE-2014-0101 -- Linux kernel: net: sctp: null pointer dereference when processing authenticated cookie_echo chunk</ref>
      <ref url="https://github.com/torvalds/linux/commit/ec0223ec48a90cb605244b45f7c62de856403729" source="CONFIRM">https://github.com/torvalds/linux/commit/ec0223ec48a90cb605244b45f7c62de856403729</ref>
      <ref url="https://bugzilla.redhat.com/show_bug.cgi?id=1070705" source="CONFIRM">https://bugzilla.redhat.com/show_bug.cgi?id=1070705</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0328.html" source="REDHAT">RHSA-2014:0328</ref>
      <ref url="http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=ec0223ec48a90cb605244b45f7c62de856403729" source="CONFIRM">http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=ec0223ec48a90cb605244b45f7c62de856403729</ref>
    </refs>
    <vuln_soft>
      <prod vendor="linux" name="linux_kernel">
        <vers num="3.0" edition="rc1"/>
        <vers num="3.0" edition="rc2"/>
        <vers num="3.0" edition="rc3"/>
        <vers num="3.0" edition="rc4"/>
        <vers num="3.0" edition="rc5"/>
        <vers num="3.0" edition="rc6"/>
        <vers num="3.0" edition="rc7"/>
        <vers num="3.0.1"/>
        <vers num="3.0.10"/>
        <vers num="3.0.11"/>
        <vers num="3.0.12"/>
        <vers num="3.0.13"/>
        <vers num="3.0.14"/>
        <vers num="3.0.15"/>
        <vers num="3.0.16"/>
        <vers num="3.0.17"/>
        <vers num="3.0.18"/>
        <vers num="3.0.19"/>
        <vers num="3.0.2"/>
        <vers num="3.0.20"/>
        <vers num="3.0.21"/>
        <vers num="3.0.22"/>
        <vers num="3.0.23"/>
        <vers num="3.0.24"/>
        <vers num="3.0.25"/>
        <vers num="3.0.26"/>
        <vers num="3.0.27"/>
        <vers num="3.0.28"/>
        <vers num="3.0.29"/>
        <vers num="3.0.3"/>
        <vers num="3.0.30"/>
        <vers num="3.0.31"/>
        <vers num="3.0.32"/>
        <vers num="3.0.33"/>
        <vers num="3.0.34"/>
        <vers num="3.0.35"/>
        <vers num="3.0.36"/>
        <vers num="3.0.37"/>
        <vers num="3.0.38"/>
        <vers num="3.0.39"/>
        <vers num="3.0.4"/>
        <vers num="3.0.40"/>
        <vers num="3.0.41"/>
        <vers num="3.0.42"/>
        <vers num="3.0.43"/>
        <vers num="3.0.44"/>
        <vers num="3.0.45"/>
        <vers num="3.0.46"/>
        <vers num="3.0.47"/>
        <vers num="3.0.48"/>
        <vers num="3.0.49"/>
        <vers num="3.0.5"/>
        <vers num="3.0.50"/>
        <vers num="3.0.51"/>
        <vers num="3.0.52"/>
        <vers num="3.0.53"/>
        <vers num="3.0.54"/>
        <vers num="3.0.55"/>
        <vers num="3.0.56"/>
        <vers num="3.0.57"/>
        <vers num="3.0.58"/>
        <vers num="3.0.59"/>
        <vers num="3.0.6"/>
        <vers num="3.0.60"/>
        <vers num="3.0.61"/>
        <vers num="3.0.62"/>
        <vers num="3.0.63"/>
        <vers num="3.0.64"/>
        <vers num="3.0.65"/>
        <vers num="3.0.66"/>
        <vers num="3.0.67"/>
        <vers num="3.0.68"/>
        <vers num="3.0.7"/>
        <vers num="3.0.8"/>
        <vers num="3.0.9"/>
        <vers num="3.1" edition="rc1"/>
        <vers num="3.1" edition="rc2"/>
        <vers num="3.1" edition="rc3"/>
        <vers num="3.1" edition="rc4"/>
        <vers num="3.1.1"/>
        <vers num="3.1.10"/>
        <vers num="3.1.2"/>
        <vers num="3.1.3"/>
        <vers num="3.1.4"/>
        <vers num="3.1.5"/>
        <vers num="3.1.6"/>
        <vers num="3.1.7"/>
        <vers num="3.1.8"/>
        <vers num="3.1.9"/>
        <vers num="3.10"/>
        <vers num="3.10.1"/>
        <vers num="3.10.10"/>
        <vers num="3.10.11"/>
        <vers num="3.10.12"/>
        <vers num="3.10.13"/>
        <vers num="3.10.14"/>
        <vers num="3.10.15"/>
        <vers num="3.10.16"/>
        <vers num="3.10.17"/>
        <vers num="3.10.18"/>
        <vers num="3.10.19"/>
        <vers num="3.10.2"/>
        <vers num="3.10.20"/>
        <vers num="3.10.21"/>
        <vers num="3.10.22"/>
        <vers num="3.10.23"/>
        <vers num="3.10.24"/>
        <vers num="3.10.25"/>
        <vers num="3.10.26"/>
        <vers num="3.10.27"/>
        <vers num="3.10.28"/>
        <vers num="3.10.29"/>
        <vers num="3.10.3"/>
        <vers num="3.10.4"/>
        <vers num="3.10.5"/>
        <vers num="3.10.6"/>
        <vers num="3.10.7"/>
        <vers num="3.10.8"/>
        <vers num="3.10.9"/>
        <vers num="3.11"/>
        <vers num="3.11.1"/>
        <vers num="3.11.10"/>
        <vers num="3.11.2"/>
        <vers num="3.11.3"/>
        <vers num="3.11.4"/>
        <vers num="3.11.5"/>
        <vers num="3.11.6"/>
        <vers num="3.11.7"/>
        <vers num="3.11.8"/>
        <vers num="3.11.9"/>
        <vers num="3.12"/>
        <vers num="3.12.1"/>
        <vers num="3.12.10"/>
        <vers num="3.12.11"/>
        <vers num="3.12.12"/>
        <vers num="3.12.13"/>
        <vers num="3.12.2"/>
        <vers num="3.12.3"/>
        <vers num="3.12.4"/>
        <vers num="3.12.5"/>
        <vers num="3.12.6"/>
        <vers num="3.12.7"/>
        <vers num="3.12.8"/>
        <vers num="3.12.9"/>
        <vers num="3.13"/>
        <vers num="3.13.1"/>
        <vers num="3.13.2"/>
        <vers num="3.13.3"/>
        <vers num="3.13.4"/>
        <vers num="3.13.5"/>
        <vers num="3.13.6"/>
        <vers num="3.2" edition="rc2"/>
        <vers num="3.2" edition="rc3"/>
        <vers num="3.2" edition="rc4"/>
        <vers num="3.2" edition="rc5"/>
        <vers num="3.2" edition="rc6"/>
        <vers num="3.2" edition="rc7"/>
        <vers num="3.2.1"/>
        <vers num="3.2.10"/>
        <vers num="3.2.11"/>
        <vers num="3.2.12"/>
        <vers num="3.2.13"/>
        <vers num="3.2.14"/>
        <vers num="3.2.15"/>
        <vers num="3.2.16"/>
        <vers num="3.2.17"/>
        <vers num="3.2.18"/>
        <vers num="3.2.19"/>
        <vers num="3.2.2"/>
        <vers num="3.2.20"/>
        <vers num="3.2.21"/>
        <vers num="3.2.22"/>
        <vers num="3.2.23"/>
        <vers num="3.2.24"/>
        <vers num="3.2.25"/>
        <vers num="3.2.26"/>
        <vers num="3.2.27"/>
        <vers num="3.2.28"/>
        <vers num="3.2.29"/>
        <vers num="3.2.3"/>
        <vers num="3.2.30"/>
        <vers num="3.2.4"/>
        <vers num="3.2.5"/>
        <vers num="3.2.6"/>
        <vers num="3.2.7"/>
        <vers num="3.2.8"/>
        <vers num="3.2.9"/>
        <vers num="3.3" edition="rc1"/>
        <vers num="3.3" edition="rc2"/>
        <vers num="3.3" edition="rc3"/>
        <vers num="3.3" edition="rc4"/>
        <vers num="3.3" edition="rc5"/>
        <vers num="3.3" edition="rc6"/>
        <vers num="3.3" edition="rc7"/>
        <vers num="3.3.1"/>
        <vers num="3.3.2"/>
        <vers num="3.3.3"/>
        <vers num="3.3.4"/>
        <vers num="3.3.5"/>
        <vers num="3.3.6"/>
        <vers num="3.3.7"/>
        <vers num="3.3.8"/>
        <vers num="3.4" edition="rc1"/>
        <vers num="3.4" edition="rc2"/>
        <vers num="3.4" edition="rc3"/>
        <vers num="3.4" edition="rc4"/>
        <vers num="3.4" edition="rc5"/>
        <vers num="3.4" edition="rc6"/>
        <vers num="3.4" edition="rc7"/>
        <vers num="3.4.1"/>
        <vers num="3.4.10"/>
        <vers num="3.4.11"/>
        <vers num="3.4.12"/>
        <vers num="3.4.13"/>
        <vers num="3.4.14"/>
        <vers num="3.4.15"/>
        <vers num="3.4.16"/>
        <vers num="3.4.17"/>
        <vers num="3.4.18"/>
        <vers num="3.4.19"/>
        <vers num="3.4.2"/>
        <vers num="3.4.20"/>
        <vers num="3.4.21"/>
        <vers num="3.4.22"/>
        <vers num="3.4.23"/>
        <vers num="3.4.24"/>
        <vers num="3.4.25"/>
        <vers num="3.4.26"/>
        <vers num="3.4.27"/>
        <vers num="3.4.28"/>
        <vers num="3.4.29"/>
        <vers num="3.4.3"/>
        <vers num="3.4.30"/>
        <vers num="3.4.31"/>
        <vers num="3.4.32"/>
        <vers num="3.4.33"/>
        <vers num="3.4.34"/>
        <vers num="3.4.35"/>
        <vers num="3.4.36"/>
        <vers num="3.4.37"/>
        <vers num="3.4.38"/>
        <vers num="3.4.39"/>
        <vers num="3.4.4"/>
        <vers num="3.4.40"/>
        <vers num="3.4.41"/>
        <vers num="3.4.42"/>
        <vers num="3.4.43"/>
        <vers num="3.4.44"/>
        <vers num="3.4.45"/>
        <vers num="3.4.46"/>
        <vers num="3.4.47"/>
        <vers num="3.4.48"/>
        <vers num="3.4.49"/>
        <vers num="3.4.5"/>
        <vers num="3.4.50"/>
        <vers num="3.4.51"/>
        <vers num="3.4.52"/>
        <vers num="3.4.53"/>
        <vers num="3.4.54"/>
        <vers num="3.4.55"/>
        <vers num="3.4.56"/>
        <vers num="3.4.57"/>
        <vers num="3.4.58"/>
        <vers num="3.4.59"/>
        <vers num="3.4.6"/>
        <vers num="3.4.60"/>
        <vers num="3.4.61"/>
        <vers num="3.4.62"/>
        <vers num="3.4.63"/>
        <vers num="3.4.64"/>
        <vers num="3.4.65"/>
        <vers num="3.4.66"/>
        <vers num="3.4.67"/>
        <vers num="3.4.68"/>
        <vers num="3.4.69"/>
        <vers num="3.4.7"/>
        <vers num="3.4.70"/>
        <vers num="3.4.71"/>
        <vers num="3.4.72"/>
        <vers num="3.4.73"/>
        <vers num="3.4.74"/>
        <vers num="3.4.75"/>
        <vers num="3.4.76"/>
        <vers num="3.4.77"/>
        <vers num="3.4.78"/>
        <vers num="3.4.79"/>
        <vers num="3.4.8"/>
        <vers num="3.4.9"/>
        <vers num="3.5.1"/>
        <vers num="3.5.2"/>
        <vers num="3.5.3"/>
        <vers num="3.5.4"/>
        <vers num="3.5.5"/>
        <vers num="3.5.6"/>
        <vers num="3.5.7"/>
        <vers num="3.6"/>
        <vers num="3.6.1"/>
        <vers num="3.6.10"/>
        <vers num="3.6.11"/>
        <vers num="3.6.2"/>
        <vers num="3.6.3"/>
        <vers num="3.6.4"/>
        <vers num="3.6.5"/>
        <vers num="3.6.6"/>
        <vers num="3.6.7"/>
        <vers num="3.6.8"/>
        <vers num="3.6.9"/>
        <vers num="3.7"/>
        <vers num="3.7.1"/>
        <vers num="3.7.10"/>
        <vers num="3.7.2"/>
        <vers num="3.7.3"/>
        <vers num="3.7.4"/>
        <vers num="3.7.5"/>
        <vers num="3.7.6"/>
        <vers num="3.7.7"/>
        <vers num="3.7.8"/>
        <vers num="3.7.9"/>
        <vers num="3.8.0"/>
        <vers num="3.8.1"/>
        <vers num="3.8.10"/>
        <vers num="3.8.11"/>
        <vers num="3.8.12"/>
        <vers num="3.8.13"/>
        <vers num="3.8.2"/>
        <vers num="3.8.3"/>
        <vers num="3.8.4"/>
        <vers num="3.8.5"/>
        <vers num="3.8.6"/>
        <vers num="3.8.7"/>
        <vers num="3.8.8"/>
        <vers num="3.8.9"/>
        <vers num="3.9" edition="rc1"/>
        <vers num="3.9" edition="rc2"/>
        <vers num="3.9" edition="rc3"/>
        <vers num="3.9" edition="rc4"/>
        <vers num="3.9" edition="rc5"/>
        <vers num="3.9" edition="rc6"/>
        <vers num="3.9" edition="rc7"/>
        <vers num="3.9.0"/>
        <vers num="3.9.1"/>
        <vers num="3.9.10"/>
        <vers num="3.9.11"/>
        <vers num="3.9.2"/>
        <vers num="3.9.3"/>
        <vers num="3.9.4"/>
        <vers num="3.9.5"/>
        <vers num="3.9.6"/>
        <vers num="3.9.7"/>
        <vers num="3.9.8"/>
        <vers num="3.9.9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0102" published="2014-03-11" name="CVE-2014-0102" modified="2014-03-11" CVSS_version="2.0" CVSS_vector="(AV:A/AC:M/Au:S/C:N/I:N/A:C)" CVSS_score="5.2" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="4.4" CVSS_base_score="5.2">
    <desc>
      <descript source="cve">The keyring_detect_cycle_iterator function in security/keys/keyring.c in the Linux kernel through 3.13.6 does not properly determine whether keyrings are identical, which allows local users to cause a denial of service (OOPS) via crafted keyctl commands.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <local_network/>
    </range>
    <refs>
      <ref url="http://www.openwall.com/lists/oss-security/2014/03/04/21" source="MLIST" patch="1">[oss-security] 20140304 CVE-2014-0102 -- Linux kernel: security: keyring cycle detector DoS</ref>
      <ref url="https://bugzilla.redhat.com/show_bug.cgi?id=1072419" source="CONFIRM">https://bugzilla.redhat.com/show_bug.cgi?id=1072419</ref>
      <ref url="http://www.kernelhub.org/?msg=425013&amp;p=2" source="MISC">http://www.kernelhub.org/?msg=425013&amp;p=2</ref>
      <ref url="http://lkml.org/lkml/2014/2/27/507" source="MLIST">[linux-kernel] 20140227 kernel BUG at security/keys/keyring.c:1003!</ref>
    </refs>
    <vuln_soft>
      <prod vendor="linux" name="linux_kernel">
        <vers num="3.0" edition="rc1"/>
        <vers num="3.0" edition="rc2"/>
        <vers num="3.0" edition="rc3"/>
        <vers num="3.0" edition="rc4"/>
        <vers num="3.0" edition="rc5"/>
        <vers num="3.0" edition="rc6"/>
        <vers num="3.0" edition="rc7"/>
        <vers num="3.0.1"/>
        <vers num="3.0.10"/>
        <vers num="3.0.11"/>
        <vers num="3.0.12"/>
        <vers num="3.0.13"/>
        <vers num="3.0.14"/>
        <vers num="3.0.15"/>
        <vers num="3.0.16"/>
        <vers num="3.0.17"/>
        <vers num="3.0.18"/>
        <vers num="3.0.19"/>
        <vers num="3.0.2"/>
        <vers num="3.0.20"/>
        <vers num="3.0.21"/>
        <vers num="3.0.22"/>
        <vers num="3.0.23"/>
        <vers num="3.0.24"/>
        <vers num="3.0.25"/>
        <vers num="3.0.26"/>
        <vers num="3.0.27"/>
        <vers num="3.0.28"/>
        <vers num="3.0.29"/>
        <vers num="3.0.3"/>
        <vers num="3.0.30"/>
        <vers num="3.0.31"/>
        <vers num="3.0.32"/>
        <vers num="3.0.33"/>
        <vers num="3.0.34"/>
        <vers num="3.0.35"/>
        <vers num="3.0.36"/>
        <vers num="3.0.37"/>
        <vers num="3.0.38"/>
        <vers num="3.0.39"/>
        <vers num="3.0.4"/>
        <vers num="3.0.40"/>
        <vers num="3.0.41"/>
        <vers num="3.0.42"/>
        <vers num="3.0.43"/>
        <vers num="3.0.44"/>
        <vers num="3.0.45"/>
        <vers num="3.0.46"/>
        <vers num="3.0.47"/>
        <vers num="3.0.48"/>
        <vers num="3.0.49"/>
        <vers num="3.0.5"/>
        <vers num="3.0.50"/>
        <vers num="3.0.51"/>
        <vers num="3.0.52"/>
        <vers num="3.0.53"/>
        <vers num="3.0.54"/>
        <vers num="3.0.55"/>
        <vers num="3.0.56"/>
        <vers num="3.0.57"/>
        <vers num="3.0.58"/>
        <vers num="3.0.59"/>
        <vers num="3.0.6"/>
        <vers num="3.0.60"/>
        <vers num="3.0.61"/>
        <vers num="3.0.62"/>
        <vers num="3.0.63"/>
        <vers num="3.0.64"/>
        <vers num="3.0.65"/>
        <vers num="3.0.66"/>
        <vers num="3.0.67"/>
        <vers num="3.0.68"/>
        <vers num="3.0.7"/>
        <vers num="3.0.8"/>
        <vers num="3.0.9"/>
        <vers num="3.1" edition="rc1"/>
        <vers num="3.1" edition="rc2"/>
        <vers num="3.1" edition="rc3"/>
        <vers num="3.1" edition="rc4"/>
        <vers num="3.1.1"/>
        <vers num="3.1.10"/>
        <vers num="3.1.2"/>
        <vers num="3.1.3"/>
        <vers num="3.1.4"/>
        <vers num="3.1.5"/>
        <vers num="3.1.6"/>
        <vers num="3.1.7"/>
        <vers num="3.1.8"/>
        <vers num="3.1.9"/>
        <vers num="3.10"/>
        <vers num="3.10.1"/>
        <vers num="3.10.10"/>
        <vers num="3.10.11"/>
        <vers num="3.10.12"/>
        <vers num="3.10.13"/>
        <vers num="3.10.14"/>
        <vers num="3.10.15"/>
        <vers num="3.10.16"/>
        <vers num="3.10.17"/>
        <vers num="3.10.18"/>
        <vers num="3.10.19"/>
        <vers num="3.10.2"/>
        <vers num="3.10.20"/>
        <vers num="3.10.21"/>
        <vers num="3.10.22"/>
        <vers num="3.10.23"/>
        <vers num="3.10.24"/>
        <vers num="3.10.25"/>
        <vers num="3.10.26"/>
        <vers num="3.10.27"/>
        <vers num="3.10.28"/>
        <vers num="3.10.29"/>
        <vers num="3.10.3"/>
        <vers num="3.10.4"/>
        <vers num="3.10.5"/>
        <vers num="3.10.6"/>
        <vers num="3.10.7"/>
        <vers num="3.10.8"/>
        <vers num="3.10.9"/>
        <vers num="3.11"/>
        <vers num="3.11.1"/>
        <vers num="3.11.10"/>
        <vers num="3.11.2"/>
        <vers num="3.11.3"/>
        <vers num="3.11.4"/>
        <vers num="3.11.5"/>
        <vers num="3.11.6"/>
        <vers num="3.11.7"/>
        <vers num="3.11.8"/>
        <vers num="3.11.9"/>
        <vers num="3.12"/>
        <vers num="3.12.1"/>
        <vers num="3.12.10"/>
        <vers num="3.12.11"/>
        <vers num="3.12.12"/>
        <vers num="3.12.13"/>
        <vers num="3.12.2"/>
        <vers num="3.12.3"/>
        <vers num="3.12.4"/>
        <vers num="3.12.5"/>
        <vers num="3.12.6"/>
        <vers num="3.12.7"/>
        <vers num="3.12.8"/>
        <vers num="3.12.9"/>
        <vers num="3.13"/>
        <vers num="3.13.1"/>
        <vers num="3.13.2"/>
        <vers num="3.13.3"/>
        <vers num="3.13.4"/>
        <vers num="3.13.5"/>
        <vers num="3.13.6"/>
        <vers num="3.2" edition="rc2"/>
        <vers num="3.2" edition="rc3"/>
        <vers num="3.2" edition="rc4"/>
        <vers num="3.2" edition="rc5"/>
        <vers num="3.2" edition="rc6"/>
        <vers num="3.2" edition="rc7"/>
        <vers num="3.2.1"/>
        <vers num="3.2.10"/>
        <vers num="3.2.11"/>
        <vers num="3.2.12"/>
        <vers num="3.2.13"/>
        <vers num="3.2.14"/>
        <vers num="3.2.15"/>
        <vers num="3.2.16"/>
        <vers num="3.2.17"/>
        <vers num="3.2.18"/>
        <vers num="3.2.19"/>
        <vers num="3.2.2"/>
        <vers num="3.2.20"/>
        <vers num="3.2.21"/>
        <vers num="3.2.22"/>
        <vers num="3.2.23"/>
        <vers num="3.2.24"/>
        <vers num="3.2.25"/>
        <vers num="3.2.26"/>
        <vers num="3.2.27"/>
        <vers num="3.2.28"/>
        <vers num="3.2.29"/>
        <vers num="3.2.3"/>
        <vers num="3.2.30"/>
        <vers num="3.2.4"/>
        <vers num="3.2.5"/>
        <vers num="3.2.6"/>
        <vers num="3.2.7"/>
        <vers num="3.2.8"/>
        <vers num="3.2.9"/>
        <vers num="3.3" edition="rc1"/>
        <vers num="3.3" edition="rc2"/>
        <vers num="3.3" edition="rc3"/>
        <vers num="3.3" edition="rc4"/>
        <vers num="3.3" edition="rc5"/>
        <vers num="3.3" edition="rc6"/>
        <vers num="3.3" edition="rc7"/>
        <vers num="3.3.1"/>
        <vers num="3.3.2"/>
        <vers num="3.3.3"/>
        <vers num="3.3.4"/>
        <vers num="3.3.5"/>
        <vers num="3.3.6"/>
        <vers num="3.3.7"/>
        <vers num="3.3.8"/>
        <vers num="3.4" edition="rc1"/>
        <vers num="3.4" edition="rc2"/>
        <vers num="3.4" edition="rc3"/>
        <vers num="3.4" edition="rc4"/>
        <vers num="3.4" edition="rc5"/>
        <vers num="3.4" edition="rc6"/>
        <vers num="3.4" edition="rc7"/>
        <vers num="3.4.1"/>
        <vers num="3.4.10"/>
        <vers num="3.4.11"/>
        <vers num="3.4.12"/>
        <vers num="3.4.13"/>
        <vers num="3.4.14"/>
        <vers num="3.4.15"/>
        <vers num="3.4.16"/>
        <vers num="3.4.17"/>
        <vers num="3.4.18"/>
        <vers num="3.4.19"/>
        <vers num="3.4.2"/>
        <vers num="3.4.20"/>
        <vers num="3.4.21"/>
        <vers num="3.4.22"/>
        <vers num="3.4.23"/>
        <vers num="3.4.24"/>
        <vers num="3.4.25"/>
        <vers num="3.4.26"/>
        <vers num="3.4.27"/>
        <vers num="3.4.28"/>
        <vers num="3.4.29"/>
        <vers num="3.4.3"/>
        <vers num="3.4.30"/>
        <vers num="3.4.31"/>
        <vers num="3.4.32"/>
        <vers num="3.4.33"/>
        <vers num="3.4.34"/>
        <vers num="3.4.35"/>
        <vers num="3.4.36"/>
        <vers num="3.4.37"/>
        <vers num="3.4.38"/>
        <vers num="3.4.39"/>
        <vers num="3.4.4"/>
        <vers num="3.4.40"/>
        <vers num="3.4.41"/>
        <vers num="3.4.42"/>
        <vers num="3.4.43"/>
        <vers num="3.4.44"/>
        <vers num="3.4.45"/>
        <vers num="3.4.46"/>
        <vers num="3.4.47"/>
        <vers num="3.4.48"/>
        <vers num="3.4.49"/>
        <vers num="3.4.5"/>
        <vers num="3.4.50"/>
        <vers num="3.4.51"/>
        <vers num="3.4.52"/>
        <vers num="3.4.53"/>
        <vers num="3.4.54"/>
        <vers num="3.4.55"/>
        <vers num="3.4.56"/>
        <vers num="3.4.57"/>
        <vers num="3.4.58"/>
        <vers num="3.4.59"/>
        <vers num="3.4.6"/>
        <vers num="3.4.60"/>
        <vers num="3.4.61"/>
        <vers num="3.4.62"/>
        <vers num="3.4.63"/>
        <vers num="3.4.64"/>
        <vers num="3.4.65"/>
        <vers num="3.4.66"/>
        <vers num="3.4.67"/>
        <vers num="3.4.68"/>
        <vers num="3.4.69"/>
        <vers num="3.4.7"/>
        <vers num="3.4.70"/>
        <vers num="3.4.71"/>
        <vers num="3.4.72"/>
        <vers num="3.4.73"/>
        <vers num="3.4.74"/>
        <vers num="3.4.75"/>
        <vers num="3.4.76"/>
        <vers num="3.4.77"/>
        <vers num="3.4.78"/>
        <vers num="3.4.79"/>
        <vers num="3.4.8"/>
        <vers num="3.4.9"/>
        <vers num="3.5.1"/>
        <vers num="3.5.2"/>
        <vers num="3.5.3"/>
        <vers num="3.5.4"/>
        <vers num="3.5.5"/>
        <vers num="3.5.6"/>
        <vers num="3.5.7"/>
        <vers num="3.6"/>
        <vers num="3.6.1"/>
        <vers num="3.6.10"/>
        <vers num="3.6.11"/>
        <vers num="3.6.2"/>
        <vers num="3.6.3"/>
        <vers num="3.6.4"/>
        <vers num="3.6.5"/>
        <vers num="3.6.6"/>
        <vers num="3.6.7"/>
        <vers num="3.6.8"/>
        <vers num="3.6.9"/>
        <vers num="3.7"/>
        <vers num="3.7.1"/>
        <vers num="3.7.10"/>
        <vers num="3.7.2"/>
        <vers num="3.7.3"/>
        <vers num="3.7.4"/>
        <vers num="3.7.5"/>
        <vers num="3.7.6"/>
        <vers num="3.7.7"/>
        <vers num="3.7.8"/>
        <vers num="3.7.9"/>
        <vers num="3.8.0"/>
        <vers num="3.8.1"/>
        <vers num="3.8.10"/>
        <vers num="3.8.11"/>
        <vers num="3.8.12"/>
        <vers num="3.8.13"/>
        <vers num="3.8.2"/>
        <vers num="3.8.3"/>
        <vers num="3.8.4"/>
        <vers num="3.8.5"/>
        <vers num="3.8.6"/>
        <vers num="3.8.7"/>
        <vers num="3.8.8"/>
        <vers num="3.8.9"/>
        <vers num="3.9" edition="rc1"/>
        <vers num="3.9" edition="rc2"/>
        <vers num="3.9" edition="rc3"/>
        <vers num="3.9" edition="rc4"/>
        <vers num="3.9" edition="rc5"/>
        <vers num="3.9" edition="rc6"/>
        <vers num="3.9" edition="rc7"/>
        <vers num="3.9.0"/>
        <vers num="3.9.1"/>
        <vers num="3.9.10"/>
        <vers num="3.9.11"/>
        <vers num="3.9.2"/>
        <vers num="3.9.3"/>
        <vers num="3.9.4"/>
        <vers num="3.9.5"/>
        <vers num="3.9.6"/>
        <vers num="3.9.7"/>
        <vers num="3.9.8"/>
        <vers num="3.9.9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0105" published="2014-04-15" name="CVE-2014-0105" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:S/C:P/I:P/A:P)" CVSS_score="6.0" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="6.8" CVSS_base_score="6.0">
    <desc>
      <descript source="cve">The auth_token middleware in the OpenStack Python client library for Keystone (aka python-keystoneclient) before 0.7.0 does not properly retrieve user tokens from memcache, which allows remote authenticated users to gain privileges in opportunistic circumstances via a large number of requests, related to an "interaction between eventlet and python-memcached."</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.openwall.com/lists/oss-security/2014/03/27/4" source="MLIST" patch="1">[oss-security] 20140327 [OSSA 2014-007] Potential context confusion in Keystone middleware  (CVE-2014-0105)</ref>
      <ref url="https://bugs.launchpad.net/python-keystoneclient/+bug/1282865" source="CONFIRM" adv="1">https://bugs.launchpad.net/python-keystoneclient/+bug/1282865</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0382.html" source="REDHAT">RHSA-2014:0382</ref>
    </refs>
    <vuln_soft>
      <prod vendor="openstack" name="python-keystoneclient">
        <vers num="0.2.2"/>
        <vers num="0.2.3"/>
        <vers num="0.2.4"/>
        <vers num="0.3.0"/>
        <vers num="0.3.1"/>
        <vers num="0.3.2"/>
        <vers prev="1" num="0.4.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0106" published="2014-03-11" name="CVE-2014-0106" modified="2014-03-26" CVSS_version="2.0" CVSS_vector="(AV:L/AC:M/Au:S/C:C/I:C/A:C)" CVSS_score="6.6" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="2.7" CVSS_base_score="6.6">
    <desc>
      <descript source="cve">Sudo 1.6.9 before 1.8.5, when env_reset is disabled, does not properly check environment variables for the env_delete restriction, which allows local users with sudo permissions to bypass intended command restrictions via a crafted environment variable.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="http://www.sudo.ws/sudo/alerts/env_add.html" source="CONFIRM" patch="1" adv="1">http://www.sudo.ws/sudo/alerts/env_add.html</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2146-1" source="UBUNTU">USN-2146-1</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/03/06/2" source="MLIST">[oss-security] 20140305 sudo: security policy bypass when env_reset is disabled</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0266.html" source="REDHAT">RHSA-2014:0266</ref>
    </refs>
    <vuln_soft>
      <prod vendor="todd_miller" name="sudo">
        <vers num="1.6.9"/>
        <vers num="1.6.9p20"/>
        <vers num="1.6.9p21"/>
        <vers num="1.6.9p22"/>
        <vers num="1.6.9p23"/>
        <vers num="1.7.0"/>
        <vers num="1.7.1"/>
        <vers num="1.7.10"/>
        <vers num="1.7.10p1"/>
        <vers num="1.7.10p10"/>
        <vers num="1.7.10p2"/>
        <vers num="1.7.10p3"/>
        <vers num="1.7.10p4"/>
        <vers num="1.7.10p5"/>
        <vers num="1.7.10p6"/>
        <vers num="1.7.10p7"/>
        <vers num="1.7.10p8"/>
        <vers num="1.7.10p9"/>
        <vers num="1.7.2"/>
        <vers num="1.7.2p1"/>
        <vers num="1.7.2p2"/>
        <vers num="1.7.2p3"/>
        <vers num="1.7.2p4"/>
        <vers num="1.7.2p5"/>
        <vers num="1.7.2p6"/>
        <vers num="1.7.2p7"/>
        <vers num="1.7.3b1"/>
        <vers num="1.7.4"/>
        <vers num="1.7.4p1"/>
        <vers num="1.7.4p2"/>
        <vers num="1.7.4p3"/>
        <vers num="1.7.4p4"/>
        <vers num="1.7.4p5"/>
        <vers num="1.7.4p6"/>
        <vers num="1.7.5"/>
        <vers num="1.7.6"/>
        <vers num="1.7.6p1"/>
        <vers num="1.7.6p2"/>
        <vers num="1.7.7"/>
        <vers num="1.7.8"/>
        <vers num="1.7.8p1"/>
        <vers num="1.7.8p2"/>
        <vers num="1.7.9"/>
        <vers num="1.7.9p1"/>
        <vers num="1.8.0"/>
        <vers num="1.8.1"/>
        <vers num="1.8.1p1"/>
        <vers num="1.8.1p2"/>
        <vers num="1.8.2"/>
        <vers num="1.8.3"/>
        <vers num="1.8.3p1"/>
        <vers num="1.8.3p2"/>
        <vers num="1.8.4"/>
        <vers num="1.8.4p1"/>
        <vers num="1.8.4p2"/>
        <vers num="1.8.4p3"/>
        <vers num="1.8.4p4"/>
        <vers num="1.8.4p5"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0107" published="2014-04-15" name="CVE-2014-0107" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">The TransformerFactory in Apache Xalan-Java before 2.7.2 does not properly restrict access to certain properties when FEATURE_SECURE_PROCESSING is enabled, which allows remote attackers to bypass expected restrictions and load arbitrary classes or access external resources via a crafted (1) xalan:content-header, (2) xalan:entities, (3) xslt:content-header, or (4) xslt:entities property, or a Java property that is bound to the XSLT 1.0 system-property function.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.ocert.org/advisories/ocert-2014-002.html" source="MISC">http://www.ocert.org/advisories/ocert-2014-002.html</ref>
      <ref url="http://svn.apache.org/viewvc?view=revision&amp;revision=1581058" source="CONFIRM" patch="1">http://svn.apache.org/viewvc?view=revision&amp;revision=1581058</ref>
      <ref url="https://issues.apache.org/jira/browse/XALANJ-2435" source="CONFIRM">https://issues.apache.org/jira/browse/XALANJ-2435</ref>
      <ref url="http://xforce.iss.net/xforce/xfdb/92023" source="XF">apache-xalanjava-cve20140107-sec-bypass(92023)</ref>
      <ref url="http://www.securityfocus.com/bid/66397" source="BID">66397</ref>
      <ref url="http://secunia.com/advisories/57563" source="SECUNIA">57563</ref>
    </refs>
    <vuln_soft>
      <prod vendor="apache" name="xalan-java">
        <vers num="1.0.0"/>
        <vers num="2.0.0"/>
        <vers num="2.0.1"/>
        <vers num="2.1.0"/>
        <vers num="2.2.0"/>
        <vers num="2.4.0"/>
        <vers num="2.4.1"/>
        <vers num="2.5.0"/>
        <vers num="2.5.1"/>
        <vers num="2.5.2"/>
        <vers num="2.6.0"/>
        <vers num="2.7.0"/>
        <vers prev="1" num="2.7.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0111" published="2014-04-17" name="CVE-2014-0111" modified="2014-04-18" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:P/I:P/A:P)" CVSS_score="6.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.0" CVSS_base_score="6.5">
    <desc>
      <descript source="cve">Apache Syncope 1.0.0 before 1.0.9 and 1.1.0 before 1.1.7 allows remote administrators to execute arbitrary Java code via vectors related to Apache Commons JEXL expressions, "derived schema definition," "user / role templates," and "account links of resource mappings."</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.securityfocus.com/archive/1/archive/1/531841/100/0/threaded" source="BUGTRAQ">20140415 [SECURITY] CVE-2014-0111 Apache Syncope</ref>
      <ref url="http://syncope.apache.org/security.html" source="CONFIRM" adv="1">http://syncope.apache.org/security.html</ref>
      <ref url="http://mail-archives.us.apache.org/mod_mbox/www-announce/201404.mbox/%3C534CE273.9020601@apache.org%3E" source="MLIST">[www-announce] 20140415 [SECURITY] CVE-2014-0111 Apache Syncope</ref>
    </refs>
    <vuln_soft>
      <prod vendor="apache" name="syncope">
        <vers num="1.0.0"/>
        <vers num="1.0.1"/>
        <vers num="1.0.2"/>
        <vers num="1.0.3"/>
        <vers num="1.0.4"/>
        <vers num="1.0.5"/>
        <vers num="1.0.6"/>
        <vers num="1.0.7"/>
        <vers num="1.0.8"/>
        <vers num="1.1.0"/>
        <vers num="1.1.1"/>
        <vers num="1.1.2"/>
        <vers num="1.1.3"/>
        <vers num="1.1.4"/>
        <vers num="1.1.5"/>
        <vers num="1.1.6"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0112" published="2014-04-29" name="CVE-2014-0112" modified="2014-04-29" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">ParametersInterceptor in Apache Struts before 2.3.16.2 does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via a crafted request.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0094.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://cwiki.apache.org/confluence/display/WW/S2-021" source="CONFIRM" patch="1" adv="1">https://cwiki.apache.org/confluence/display/WW/S2-021</ref>
      <ref url="https://bugzilla.redhat.com/show_bug.cgi?id=1091939" source="CONFIRM">https://bugzilla.redhat.com/show_bug.cgi?id=1091939</ref>
      <ref url="http://jvndb.jvn.jp/jvndb/JVNDB-2014-000045" source="JVNDB">JVNDB-2014-000045</ref>
      <ref url="http://jvn.jp/en/jp/JVN19294237/index.html" source="JVN">JVN#19294237</ref>
    </refs>
    <vuln_soft>
      <prod vendor="apache" name="struts">
        <vers num="2.0.0"/>
        <vers num="2.0.1"/>
        <vers num="2.0.10"/>
        <vers num="2.0.11"/>
        <vers num="2.0.11.1"/>
        <vers num="2.0.11.2"/>
        <vers num="2.0.12"/>
        <vers num="2.0.13"/>
        <vers num="2.0.14"/>
        <vers num="2.0.2"/>
        <vers num="2.0.3"/>
        <vers num="2.0.4"/>
        <vers num="2.0.5"/>
        <vers num="2.0.6"/>
        <vers num="2.0.7"/>
        <vers num="2.0.8"/>
        <vers num="2.0.9"/>
        <vers num="2.1.0"/>
        <vers num="2.1.1"/>
        <vers num="2.1.2"/>
        <vers num="2.1.3"/>
        <vers num="2.1.4"/>
        <vers num="2.1.5"/>
        <vers num="2.1.6"/>
        <vers num="2.1.8"/>
        <vers num="2.1.8.1"/>
        <vers num="2.2.1"/>
        <vers num="2.2.1.1"/>
        <vers num="2.2.3"/>
        <vers num="2.2.3.1"/>
        <vers num="2.3.1"/>
        <vers num="2.3.1.1"/>
        <vers num="2.3.1.2"/>
        <vers num="2.3.12"/>
        <vers num="2.3.14"/>
        <vers num="2.3.14.1"/>
        <vers num="2.3.14.2"/>
        <vers num="2.3.14.3"/>
        <vers num="2.3.15"/>
        <vers num="2.3.15.1"/>
        <vers num="2.3.15.2"/>
        <vers num="2.3.15.3"/>
        <vers num="2.3.16"/>
        <vers prev="1" num="2.3.16.1"/>
        <vers num="2.3.3"/>
        <vers num="2.3.4"/>
        <vers num="2.3.4.1"/>
        <vers num="2.3.7"/>
        <vers num="2.3.8"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0113" published="2014-04-29" name="CVE-2014-0113" modified="2014-04-29" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">CookieInterceptor in Apache Struts before 2.3.16.2, when a wildcard cookiesName value is used, does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via a crafted request.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0094.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://cwiki.apache.org/confluence/display/WW/S2-021" source="CONFIRM" patch="1" adv="1">https://cwiki.apache.org/confluence/display/WW/S2-021</ref>
    </refs>
    <vuln_soft>
      <prod vendor="apache" name="struts">
        <vers num="2.0.0"/>
        <vers num="2.0.1"/>
        <vers num="2.0.10"/>
        <vers num="2.0.11"/>
        <vers num="2.0.11.1"/>
        <vers num="2.0.11.2"/>
        <vers num="2.0.12"/>
        <vers num="2.0.13"/>
        <vers num="2.0.14"/>
        <vers num="2.0.2"/>
        <vers num="2.0.3"/>
        <vers num="2.0.4"/>
        <vers num="2.0.5"/>
        <vers num="2.0.6"/>
        <vers num="2.0.7"/>
        <vers num="2.0.8"/>
        <vers num="2.0.9"/>
        <vers num="2.1.0"/>
        <vers num="2.1.1"/>
        <vers num="2.1.2"/>
        <vers num="2.1.3"/>
        <vers num="2.1.4"/>
        <vers num="2.1.5"/>
        <vers num="2.1.6"/>
        <vers num="2.1.8"/>
        <vers num="2.1.8.1"/>
        <vers num="2.2.1"/>
        <vers num="2.2.1.1"/>
        <vers num="2.2.3"/>
        <vers num="2.2.3.1"/>
        <vers num="2.3.1"/>
        <vers num="2.3.1.1"/>
        <vers num="2.3.1.2"/>
        <vers num="2.3.12"/>
        <vers num="2.3.14"/>
        <vers num="2.3.14.1"/>
        <vers num="2.3.14.2"/>
        <vers num="2.3.14.3"/>
        <vers num="2.3.15"/>
        <vers num="2.3.15.1"/>
        <vers num="2.3.15.2"/>
        <vers num="2.3.15.3"/>
        <vers num="2.3.16"/>
        <vers prev="1" num="2.3.16.1"/>
        <vers num="2.3.3"/>
        <vers num="2.3.4"/>
        <vers num="2.3.4.1"/>
        <vers num="2.3.7"/>
        <vers num="2.3.8"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0114" published="2014-04-30" name="CVE-2014-0114" modified="2014-04-30" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">The ActionForm object in Apache Struts 1.x through 1.3.10 allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via the class parameter, which is passed to the getClass method.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://bugzilla.redhat.com/show_bug.cgi?id=1091938" source="CONFIRM">https://bugzilla.redhat.com/show_bug.cgi?id=1091938</ref>
    </refs>
    <vuln_soft>
      <prod vendor="apache" name="struts">
        <vers num="1.0"/>
        <vers num="1.0.2"/>
        <vers num="1.1" edition="b1"/>
        <vers num="1.1" edition="b2"/>
        <vers num="1.1" edition="b3"/>
        <vers num="1.1" edition="rc1"/>
        <vers num="1.1" edition="rc2"/>
        <vers num="1.2.2"/>
        <vers num="1.2.4"/>
        <vers num="1.2.6"/>
        <vers num="1.2.7"/>
        <vers num="1.2.8"/>
        <vers num="1.2.9"/>
        <vers num="1.3.10"/>
        <vers num="1.3.5"/>
        <vers num="1.3.8"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0122" published="2014-03-24" name="CVE-2014-0122" modified="2014-03-24" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:S/C:P/I:P/A:N)" CVSS_score="4.9" CVSS_impact_subscore="4.9" CVSS_exploit_subscore="6.8" CVSS_base_score="4.9">
    <desc>
      <descript source="cve">mod/chat/chat_ajax.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 does not properly check for the mod/chat:chat capability during chat sessions, which allows remote authenticated users to bypass intended access restrictions in opportunistic circumstances by remaining in a chat session after an intra-session capability removal by an administrator.</descript>
    </desc>
    <loss_types>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://moodle.org/mod/forum/discuss.php?d=256418" source="CONFIRM" adv="1">https://moodle.org/mod/forum/discuss.php?d=256418</ref>
      <ref url="http://openwall.com/lists/oss-security/2014/03/17/1" source="MLIST">[oss-security] 20140317 Moodle security notifications public</ref>
      <ref url="http://git.moodle.org/gw?p=moodle.git&amp;a=search&amp;h=HEAD&amp;st=commit&amp;s=MDL-44082" source="CONFIRM">http://git.moodle.org/gw?p=moodle.git&amp;a=search&amp;h=HEAD&amp;st=commit&amp;s=MDL-44082</ref>
    </refs>
    <vuln_soft>
      <prod vendor="moodle" name="moodle">
        <vers num="2.0"/>
        <vers num="2.0.1"/>
        <vers num="2.0.2"/>
        <vers num="2.0.3"/>
        <vers num="2.0.4"/>
        <vers num="2.0.5"/>
        <vers num="2.0.6"/>
        <vers num="2.0.7"/>
        <vers num="2.0.8"/>
        <vers num="2.0.9"/>
        <vers num="2.1"/>
        <vers num="2.1.1"/>
        <vers num="2.1.10"/>
        <vers num="2.1.2"/>
        <vers num="2.1.3"/>
        <vers num="2.1.4"/>
        <vers num="2.1.5"/>
        <vers num="2.1.6"/>
        <vers num="2.1.7"/>
        <vers num="2.1.8"/>
        <vers num="2.1.9"/>
        <vers num="2.2"/>
        <vers num="2.2.1"/>
        <vers num="2.2.10"/>
        <vers num="2.2.11"/>
        <vers num="2.2.2"/>
        <vers num="2.2.3"/>
        <vers num="2.2.4"/>
        <vers num="2.2.5"/>
        <vers num="2.2.6"/>
        <vers num="2.2.7"/>
        <vers num="2.2.8"/>
        <vers num="2.2.9"/>
        <vers num="2.3"/>
        <vers num="2.3.1"/>
        <vers num="2.3.10"/>
        <vers prev="1" num="2.3.11"/>
        <vers num="2.3.2"/>
        <vers num="2.3.3"/>
        <vers num="2.3.4"/>
        <vers num="2.3.5"/>
        <vers num="2.3.6"/>
        <vers num="2.3.7"/>
        <vers num="2.3.8"/>
        <vers num="2.3.9"/>
        <vers num="2.4"/>
        <vers num="2.4.1"/>
        <vers num="2.4.2"/>
        <vers num="2.4.3"/>
        <vers num="2.4.4"/>
        <vers num="2.4.5"/>
        <vers num="2.4.6"/>
        <vers num="2.4.7"/>
        <vers num="2.4.8"/>
        <vers num="2.5"/>
        <vers num="2.5.1"/>
        <vers num="2.5.2"/>
        <vers num="2.5.3"/>
        <vers num="2.5.4"/>
        <vers num="2.6"/>
        <vers num="2.6.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0123" published="2014-03-24" name="CVE-2014-0123" modified="2014-03-24" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:S/C:P/I:P/A:N)" CVSS_score="4.9" CVSS_impact_subscore="4.9" CVSS_exploit_subscore="6.8" CVSS_base_score="4.9">
    <desc>
      <descript source="cve">The wiki subsystem in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 does not properly restrict (1) view and (2) edit access, which allows remote authenticated users to perform wiki operations by leveraging the student role and using the Recent Activity block to reach the individual wiki of an arbitrary student.</descript>
    </desc>
    <loss_types>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://moodle.org/mod/forum/discuss.php?d=256419" source="CONFIRM" adv="1">https://moodle.org/mod/forum/discuss.php?d=256419</ref>
      <ref url="http://openwall.com/lists/oss-security/2014/03/17/1" source="MLIST">[oss-security] 20140317 Moodle security notifications public</ref>
      <ref url="http://git.moodle.org/gw?p=moodle.git&amp;a=search&amp;h=HEAD&amp;st=commit&amp;s=MDL-39990" source="CONFIRM">http://git.moodle.org/gw?p=moodle.git&amp;a=search&amp;h=HEAD&amp;st=commit&amp;s=MDL-39990</ref>
    </refs>
    <vuln_soft>
      <prod vendor="moodle" name="moodle">
        <vers num="2.0"/>
        <vers num="2.0.1"/>
        <vers num="2.0.2"/>
        <vers num="2.0.3"/>
        <vers num="2.0.4"/>
        <vers num="2.0.5"/>
        <vers num="2.0.6"/>
        <vers num="2.0.7"/>
        <vers num="2.0.8"/>
        <vers num="2.0.9"/>
        <vers num="2.1"/>
        <vers num="2.1.1"/>
        <vers num="2.1.10"/>
        <vers num="2.1.2"/>
        <vers num="2.1.3"/>
        <vers num="2.1.4"/>
        <vers num="2.1.5"/>
        <vers num="2.1.6"/>
        <vers num="2.1.7"/>
        <vers num="2.1.8"/>
        <vers num="2.1.9"/>
        <vers num="2.2"/>
        <vers num="2.2.1"/>
        <vers num="2.2.10"/>
        <vers num="2.2.11"/>
        <vers num="2.2.2"/>
        <vers num="2.2.3"/>
        <vers num="2.2.4"/>
        <vers num="2.2.5"/>
        <vers num="2.2.6"/>
        <vers num="2.2.7"/>
        <vers num="2.2.8"/>
        <vers num="2.2.9"/>
        <vers num="2.3"/>
        <vers num="2.3.1"/>
        <vers num="2.3.10"/>
        <vers prev="1" num="2.3.11"/>
        <vers num="2.3.2"/>
        <vers num="2.3.3"/>
        <vers num="2.3.4"/>
        <vers num="2.3.5"/>
        <vers num="2.3.6"/>
        <vers num="2.3.7"/>
        <vers num="2.3.8"/>
        <vers num="2.3.9"/>
        <vers num="2.4"/>
        <vers num="2.4.1"/>
        <vers num="2.4.2"/>
        <vers num="2.4.3"/>
        <vers num="2.4.4"/>
        <vers num="2.4.5"/>
        <vers num="2.4.6"/>
        <vers num="2.4.7"/>
        <vers num="2.4.8"/>
        <vers num="2.5"/>
        <vers num="2.5.1"/>
        <vers num="2.5.2"/>
        <vers num="2.5.3"/>
        <vers num="2.5.4"/>
        <vers num="2.6"/>
        <vers num="2.6.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0124" published="2014-03-24" name="CVE-2014-0124" modified="2014-03-24" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:P/I:N/A:N)" CVSS_score="4.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.0" CVSS_base_score="4.0">
    <desc>
      <descript source="cve">The identity-reporting implementations in mod/forum/renderer.php and mod/quiz/override_form.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 do not properly restrict the display of e-mail addresses, which allows remote authenticated users to obtain sensitive information by using the (1) Forum or (2) Quiz module.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://moodle.org/mod/forum/discuss.php?d=256421" source="CONFIRM" adv="1">https://moodle.org/mod/forum/discuss.php?d=256421</ref>
      <ref url="http://openwall.com/lists/oss-security/2014/03/17/1" source="MLIST">[oss-security] 20140317 Moodle security notifications public</ref>
      <ref url="http://git.moodle.org/gw?p=moodle.git&amp;a=search&amp;h=HEAD&amp;st=commit&amp;s=MDL-43916" source="CONFIRM">http://git.moodle.org/gw?p=moodle.git&amp;a=search&amp;h=HEAD&amp;st=commit&amp;s=MDL-43916</ref>
    </refs>
    <vuln_soft>
      <prod vendor="moodle" name="moodle">
        <vers num="2.0"/>
        <vers num="2.0.1"/>
        <vers num="2.0.2"/>
        <vers num="2.0.3"/>
        <vers num="2.0.4"/>
        <vers num="2.0.5"/>
        <vers num="2.0.6"/>
        <vers num="2.0.7"/>
        <vers num="2.0.8"/>
        <vers num="2.0.9"/>
        <vers num="2.1"/>
        <vers num="2.1.1"/>
        <vers num="2.1.10"/>
        <vers num="2.1.2"/>
        <vers num="2.1.3"/>
        <vers num="2.1.4"/>
        <vers num="2.1.5"/>
        <vers num="2.1.6"/>
        <vers num="2.1.7"/>
        <vers num="2.1.8"/>
        <vers num="2.1.9"/>
        <vers num="2.2"/>
        <vers num="2.2.1"/>
        <vers num="2.2.10"/>
        <vers num="2.2.11"/>
        <vers num="2.2.2"/>
        <vers num="2.2.3"/>
        <vers num="2.2.4"/>
        <vers num="2.2.5"/>
        <vers num="2.2.6"/>
        <vers num="2.2.7"/>
        <vers num="2.2.8"/>
        <vers num="2.2.9"/>
        <vers num="2.3"/>
        <vers num="2.3.1"/>
        <vers num="2.3.10"/>
        <vers prev="1" num="2.3.11"/>
        <vers num="2.3.2"/>
        <vers num="2.3.3"/>
        <vers num="2.3.4"/>
        <vers num="2.3.5"/>
        <vers num="2.3.6"/>
        <vers num="2.3.7"/>
        <vers num="2.3.8"/>
        <vers num="2.3.9"/>
        <vers num="2.4"/>
        <vers num="2.4.1"/>
        <vers num="2.4.2"/>
        <vers num="2.4.3"/>
        <vers num="2.4.4"/>
        <vers num="2.4.5"/>
        <vers num="2.4.6"/>
        <vers num="2.4.7"/>
        <vers num="2.4.8"/>
        <vers num="2.5"/>
        <vers num="2.5.1"/>
        <vers num="2.5.2"/>
        <vers num="2.5.3"/>
        <vers num="2.5.4"/>
        <vers num="2.6"/>
        <vers num="2.6.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0125" published="2014-03-24" name="CVE-2014-0125" modified="2014-03-24" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:N)" CVSS_score="5.8" CVSS_impact_subscore="4.9" CVSS_exploit_subscore="8.6" CVSS_base_score="5.8">
    <desc>
      <descript source="cve">repository/alfresco/lib.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 places a session key in a URL, which allows remote attackers to bypass intended Alfresco Repository file restrictions by impersonating a file's owner.</descript>
    </desc>
    <loss_types>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://moodle.org/mod/forum/discuss.php?d=256422" source="CONFIRM" adv="1">https://moodle.org/mod/forum/discuss.php?d=256422</ref>
      <ref url="http://openwall.com/lists/oss-security/2014/03/17/1" source="MLIST">[oss-security] 20140317 Moodle security notifications public</ref>
      <ref url="http://git.moodle.org/gw?p=moodle.git&amp;a=search&amp;h=HEAD&amp;st=commit&amp;s=MDL-29409" source="CONFIRM">http://git.moodle.org/gw?p=moodle.git&amp;a=search&amp;h=HEAD&amp;st=commit&amp;s=MDL-29409</ref>
    </refs>
    <vuln_soft>
      <prod vendor="moodle" name="moodle">
        <vers num="2.0"/>
        <vers num="2.0.1"/>
        <vers num="2.0.2"/>
        <vers num="2.0.3"/>
        <vers num="2.0.4"/>
        <vers num="2.0.5"/>
        <vers num="2.0.6"/>
        <vers num="2.0.7"/>
        <vers num="2.0.8"/>
        <vers num="2.0.9"/>
        <vers num="2.1"/>
        <vers num="2.1.1"/>
        <vers num="2.1.10"/>
        <vers num="2.1.2"/>
        <vers num="2.1.3"/>
        <vers num="2.1.4"/>
        <vers num="2.1.5"/>
        <vers num="2.1.6"/>
        <vers num="2.1.7"/>
        <vers num="2.1.8"/>
        <vers num="2.1.9"/>
        <vers num="2.2"/>
        <vers num="2.2.1"/>
        <vers num="2.2.10"/>
        <vers num="2.2.11"/>
        <vers num="2.2.2"/>
        <vers num="2.2.3"/>
        <vers num="2.2.4"/>
        <vers num="2.2.5"/>
        <vers num="2.2.6"/>
        <vers num="2.2.7"/>
        <vers num="2.2.8"/>
        <vers num="2.2.9"/>
        <vers num="2.3"/>
        <vers num="2.3.1"/>
        <vers num="2.3.10"/>
        <vers prev="1" num="2.3.11"/>
        <vers num="2.3.2"/>
        <vers num="2.3.3"/>
        <vers num="2.3.4"/>
        <vers num="2.3.5"/>
        <vers num="2.3.6"/>
        <vers num="2.3.7"/>
        <vers num="2.3.8"/>
        <vers num="2.3.9"/>
        <vers num="2.4"/>
        <vers num="2.4.1"/>
        <vers num="2.4.2"/>
        <vers num="2.4.3"/>
        <vers num="2.4.4"/>
        <vers num="2.4.5"/>
        <vers num="2.4.6"/>
        <vers num="2.4.7"/>
        <vers num="2.4.8"/>
        <vers num="2.5"/>
        <vers num="2.5.1"/>
        <vers num="2.5.2"/>
        <vers num="2.5.3"/>
        <vers num="2.5.4"/>
        <vers num="2.6"/>
        <vers num="2.6.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0126" published="2014-03-24" name="CVE-2014-0126" modified="2014-03-24" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:P)" CVSS_score="6.8" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.6" CVSS_base_score="6.8">
    <desc>
      <descript source="cve">Cross-site request forgery (CSRF) vulnerability in enrol/imsenterprise/importnow.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 allows remote attackers to hijack the authentication of administrators for requests that import an IMS Enterprise file.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="https://moodle.org/mod/forum/discuss.php?d=256423" source="CONFIRM" adv="1">https://moodle.org/mod/forum/discuss.php?d=256423</ref>
      <ref url="http://openwall.com/lists/oss-security/2014/03/17/1" source="MLIST">[oss-security] 20140317 Moodle security notifications public</ref>
      <ref url="http://git.moodle.org/gw?p=moodle.git&amp;a=search&amp;h=HEAD&amp;st=commit&amp;s=MDL-43146" source="CONFIRM">http://git.moodle.org/gw?p=moodle.git&amp;a=search&amp;h=HEAD&amp;st=commit&amp;s=MDL-43146</ref>
    </refs>
    <vuln_soft>
      <prod vendor="moodle" name="moodle">
        <vers num="2.0"/>
        <vers num="2.0.1"/>
        <vers num="2.0.2"/>
        <vers num="2.0.3"/>
        <vers num="2.0.4"/>
        <vers num="2.0.5"/>
        <vers num="2.0.6"/>
        <vers num="2.0.7"/>
        <vers num="2.0.8"/>
        <vers num="2.0.9"/>
        <vers num="2.1"/>
        <vers num="2.1.1"/>
        <vers num="2.1.10"/>
        <vers num="2.1.2"/>
        <vers num="2.1.3"/>
        <vers num="2.1.4"/>
        <vers num="2.1.5"/>
        <vers num="2.1.6"/>
        <vers num="2.1.7"/>
        <vers num="2.1.8"/>
        <vers num="2.1.9"/>
        <vers num="2.2"/>
        <vers num="2.2.1"/>
        <vers num="2.2.10"/>
        <vers num="2.2.11"/>
        <vers num="2.2.2"/>
        <vers num="2.2.3"/>
        <vers num="2.2.4"/>
        <vers num="2.2.5"/>
        <vers num="2.2.6"/>
        <vers num="2.2.7"/>
        <vers num="2.2.8"/>
        <vers num="2.2.9"/>
        <vers num="2.3"/>
        <vers num="2.3.1"/>
        <vers num="2.3.10"/>
        <vers prev="1" num="2.3.11"/>
        <vers num="2.3.2"/>
        <vers num="2.3.3"/>
        <vers num="2.3.4"/>
        <vers num="2.3.5"/>
        <vers num="2.3.6"/>
        <vers num="2.3.7"/>
        <vers num="2.3.8"/>
        <vers num="2.3.9"/>
        <vers num="2.4"/>
        <vers num="2.4.1"/>
        <vers num="2.4.2"/>
        <vers num="2.4.3"/>
        <vers num="2.4.4"/>
        <vers num="2.4.5"/>
        <vers num="2.4.6"/>
        <vers num="2.4.7"/>
        <vers num="2.4.8"/>
        <vers num="2.5"/>
        <vers num="2.5.1"/>
        <vers num="2.5.2"/>
        <vers num="2.5.3"/>
        <vers num="2.5.4"/>
        <vers num="2.6"/>
        <vers num="2.6.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0127" published="2014-03-24" name="CVE-2014-0127" modified="2014-03-24" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:S/C:P/I:P/A:N)" CVSS_score="4.9" CVSS_impact_subscore="4.9" CVSS_exploit_subscore="6.8" CVSS_base_score="4.9">
    <desc>
      <descript source="cve">The time-validation implementation in (1) mod/feedback/complete.php and (2) mod/feedback/complete_guest.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 allows remote authenticated users to bypass intended restrictions on starting a Feedback activity by choosing an unavailable time.</descript>
    </desc>
    <loss_types>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://moodle.org/mod/forum/discuss.php?d=256417" source="CONFIRM" adv="1">https://moodle.org/mod/forum/discuss.php?d=256417</ref>
      <ref url="http://openwall.com/lists/oss-security/2014/03/17/1" source="MLIST">[oss-security] 20140317 Moodle security notifications public</ref>
      <ref url="http://git.moodle.org/gw?p=moodle.git&amp;a=search&amp;h=HEAD&amp;st=commit&amp;s=MDL-43656" source="CONFIRM">http://git.moodle.org/gw?p=moodle.git&amp;a=search&amp;h=HEAD&amp;st=commit&amp;s=MDL-43656</ref>
    </refs>
    <vuln_soft>
      <prod vendor="moodle" name="moodle">
        <vers num="2.0"/>
        <vers num="2.0.1"/>
        <vers num="2.0.2"/>
        <vers num="2.0.3"/>
        <vers num="2.0.4"/>
        <vers num="2.0.5"/>
        <vers num="2.0.6"/>
        <vers num="2.0.7"/>
        <vers num="2.0.8"/>
        <vers num="2.0.9"/>
        <vers num="2.1"/>
        <vers num="2.1.1"/>
        <vers num="2.1.10"/>
        <vers num="2.1.2"/>
        <vers num="2.1.3"/>
        <vers num="2.1.4"/>
        <vers num="2.1.5"/>
        <vers num="2.1.6"/>
        <vers num="2.1.7"/>
        <vers num="2.1.8"/>
        <vers num="2.1.9"/>
        <vers num="2.2"/>
        <vers num="2.2.1"/>
        <vers num="2.2.10"/>
        <vers num="2.2.11"/>
        <vers num="2.2.2"/>
        <vers num="2.2.3"/>
        <vers num="2.2.4"/>
        <vers num="2.2.5"/>
        <vers num="2.2.6"/>
        <vers num="2.2.7"/>
        <vers num="2.2.8"/>
        <vers num="2.2.9"/>
        <vers num="2.3"/>
        <vers num="2.3.1"/>
        <vers num="2.3.10"/>
        <vers prev="1" num="2.3.11"/>
        <vers num="2.3.2"/>
        <vers num="2.3.3"/>
        <vers num="2.3.4"/>
        <vers num="2.3.5"/>
        <vers num="2.3.6"/>
        <vers num="2.3.7"/>
        <vers num="2.3.8"/>
        <vers num="2.3.9"/>
        <vers num="2.4"/>
        <vers num="2.4.1"/>
        <vers num="2.4.2"/>
        <vers num="2.4.3"/>
        <vers num="2.4.4"/>
        <vers num="2.4.5"/>
        <vers num="2.4.6"/>
        <vers num="2.4.7"/>
        <vers num="2.4.8"/>
        <vers num="2.5"/>
        <vers num="2.5.1"/>
        <vers num="2.5.2"/>
        <vers num="2.5.3"/>
        <vers num="2.5.4"/>
        <vers num="2.6"/>
        <vers num="2.6.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0128" published="2014-04-14" name="CVE-2014-0128" modified="2014-04-15" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:P)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">Squid 3.1 before 3.3.12 and 3.4 before 3.4.4, when SSL-Bump is enabled, allows remote attackers to cause a denial of service (assertion failure) via a crafted range request, related to state management.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://secunia.com/advisories/57288" source="SECUNIA" adv="1">57288</ref>
      <ref url="http://www.squid-cache.org/Advisories/SQUID-2014_1.txt" source="CONFIRM" adv="1">http://www.squid-cache.org/Advisories/SQUID-2014_1.txt</ref>
      <ref url="http://secunia.com/advisories/57889" source="SECUNIA" adv="1">57889</ref>
      <ref url="http://lists.opensuse.org/opensuse-updates/2014-04/msg00030.html" source="SUSE" adv="1">openSUSE-SU-2014:0513</ref>
    </refs>
    <vuln_soft>
      <prod vendor="squid-cache" name="squid">
        <vers num="3.1"/>
        <vers num="3.1.0.1"/>
        <vers num="3.1.0.10"/>
        <vers num="3.1.0.11"/>
        <vers num="3.1.0.12"/>
        <vers num="3.1.0.13"/>
        <vers num="3.1.0.14"/>
        <vers num="3.1.0.15"/>
        <vers num="3.1.0.16"/>
        <vers num="3.1.0.17"/>
        <vers num="3.1.0.18"/>
        <vers num="3.1.0.2"/>
        <vers num="3.1.0.3"/>
        <vers num="3.1.0.4"/>
        <vers num="3.1.0.5"/>
        <vers num="3.1.0.6"/>
        <vers num="3.1.0.7"/>
        <vers num="3.1.0.8"/>
        <vers num="3.1.0.9"/>
        <vers num="3.1.1"/>
        <vers num="3.1.10"/>
        <vers num="3.1.11"/>
        <vers num="3.1.12"/>
        <vers num="3.1.13"/>
        <vers num="3.1.14"/>
        <vers num="3.1.15"/>
        <vers num="3.1.2"/>
        <vers num="3.1.3"/>
        <vers num="3.1.4"/>
        <vers num="3.1.5"/>
        <vers num="3.1.5.1"/>
        <vers num="3.1.6"/>
        <vers num="3.1.7"/>
        <vers num="3.1.8"/>
        <vers num="3.1.9"/>
        <vers num="3.2.0.1"/>
        <vers num="3.2.0.10"/>
        <vers num="3.2.0.11"/>
        <vers num="3.2.0.12"/>
        <vers num="3.2.0.13"/>
        <vers num="3.2.0.14"/>
        <vers num="3.2.0.15"/>
        <vers num="3.2.0.16"/>
        <vers num="3.2.0.17"/>
        <vers num="3.2.0.18"/>
        <vers num="3.2.0.19"/>
        <vers num="3.2.0.2"/>
        <vers num="3.2.0.3"/>
        <vers num="3.2.0.4"/>
        <vers num="3.2.0.5"/>
        <vers num="3.2.0.6"/>
        <vers num="3.2.0.7"/>
        <vers num="3.2.0.8"/>
        <vers num="3.2.0.9"/>
        <vers num="3.2.1"/>
        <vers num="3.2.10"/>
        <vers num="3.2.11"/>
        <vers num="3.2.12"/>
        <vers num="3.2.2"/>
        <vers num="3.2.3"/>
        <vers num="3.2.4"/>
        <vers num="3.2.5"/>
        <vers num="3.2.6"/>
        <vers num="3.2.7"/>
        <vers num="3.2.8"/>
        <vers num="3.2.9"/>
        <vers num="3.3.0"/>
        <vers num="3.3.0.2"/>
        <vers num="3.3.0.3"/>
        <vers num="3.3.1"/>
        <vers num="3.3.10"/>
        <vers num="3.3.11"/>
        <vers num="3.3.2"/>
        <vers num="3.3.3"/>
        <vers num="3.3.4"/>
        <vers num="3.3.5"/>
        <vers num="3.3.6"/>
        <vers num="3.3.7"/>
        <vers num="3.3.8"/>
        <vers num="3.3.9"/>
        <vers num="3.4.0.1"/>
        <vers num="3.4.0.2"/>
        <vers num="3.4.0.3"/>
        <vers num="3.4.1"/>
        <vers num="3.4.2"/>
        <vers num="3.4.3"/>
      </prod>
      <prod vendor="novell" name="opensuse">
        <vers num="11.4"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0129" published="2014-03-24" name="CVE-2014-0129" modified="2014-03-24" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:N/I:P/A:N)" CVSS_score="4.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.0" CVSS_base_score="4.0">
    <desc>
      <descript source="cve">badges/mybadges.php in Moodle 2.5.x before 2.5.5 and 2.6.x before 2.6.2 does not properly track the user to whom a badge was issued, which allows remote authenticated users to modify the visibility of an arbitrary badge via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://moodle.org/mod/forum/discuss.php?d=256424" source="CONFIRM" adv="1">https://moodle.org/mod/forum/discuss.php?d=256424</ref>
      <ref url="http://openwall.com/lists/oss-security/2014/03/17/1" source="MLIST">[oss-security] 20140317 Moodle security notifications public</ref>
      <ref url="http://git.moodle.org/gw?p=moodle.git&amp;a=search&amp;h=HEAD&amp;st=commit&amp;s=MDL-44140" source="CONFIRM">http://git.moodle.org/gw?p=moodle.git&amp;a=search&amp;h=HEAD&amp;st=commit&amp;s=MDL-44140</ref>
    </refs>
    <vuln_soft>
      <prod vendor="moodle" name="moodle">
        <vers num="2.0"/>
        <vers num="2.0.1"/>
        <vers num="2.0.2"/>
        <vers num="2.0.3"/>
        <vers num="2.0.4"/>
        <vers num="2.0.5"/>
        <vers num="2.0.6"/>
        <vers num="2.0.7"/>
        <vers num="2.0.8"/>
        <vers num="2.0.9"/>
        <vers num="2.1"/>
        <vers num="2.1.1"/>
        <vers num="2.1.10"/>
        <vers num="2.1.2"/>
        <vers num="2.1.3"/>
        <vers num="2.1.4"/>
        <vers num="2.1.5"/>
        <vers num="2.1.6"/>
        <vers num="2.1.7"/>
        <vers num="2.1.8"/>
        <vers num="2.1.9"/>
        <vers num="2.2"/>
        <vers num="2.2.1"/>
        <vers num="2.2.10"/>
        <vers num="2.2.11"/>
        <vers num="2.2.2"/>
        <vers num="2.2.3"/>
        <vers num="2.2.4"/>
        <vers num="2.2.5"/>
        <vers num="2.2.6"/>
        <vers num="2.2.7"/>
        <vers num="2.2.8"/>
        <vers num="2.2.9"/>
        <vers num="2.3"/>
        <vers num="2.3.1"/>
        <vers num="2.3.10"/>
        <vers prev="1" num="2.3.11"/>
        <vers num="2.3.2"/>
        <vers num="2.3.3"/>
        <vers num="2.3.4"/>
        <vers num="2.3.5"/>
        <vers num="2.3.6"/>
        <vers num="2.3.7"/>
        <vers num="2.3.8"/>
        <vers num="2.3.9"/>
        <vers num="2.4"/>
        <vers num="2.4.1"/>
        <vers num="2.4.2"/>
        <vers num="2.4.3"/>
        <vers num="2.4.4"/>
        <vers num="2.4.5"/>
        <vers num="2.4.6"/>
        <vers num="2.4.7"/>
        <vers num="2.4.8"/>
        <vers num="2.5"/>
        <vers num="2.5.1"/>
        <vers num="2.5.2"/>
        <vers num="2.5.3"/>
        <vers num="2.5.4"/>
        <vers num="2.6"/>
        <vers num="2.6.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-0131" published="2014-03-24" name="CVE-2014-0131" modified="2014-03-25" CVSS_version="2.0" CVSS_vector="(AV:A/AC:M/Au:N/C:P/I:N/A:N)" CVSS_score="2.9" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="5.5" CVSS_base_score="2.9">
    <desc>
      <descript source="cve">Use-after-free vulnerability in the skb_segment function in net/core/skbuff.c in the Linux kernel through 3.13.6 allows attackers to obtain sensitive information from kernel memory by leveraging the absence of a certain orphaning operation.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <local_network/>
    </range>
    <refs>
      <ref url="https://github.com/torvalds/linux/commit/1fd819ecb90cc9b822cd84d3056ddba315d3340f" source="CONFIRM" patch="1">https://github.com/torvalds/linux/commit/1fd819ecb90cc9b822cd84d3056ddba315d3340f</ref>
      <ref url="http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=1fd819ecb90cc9b822cd84d3056ddba315d3340f" source="CONFIRM" patch="1">http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=1fd819ecb90cc9b822cd84d3056ddba315d3340f</ref>
      <ref url="https://bugzilla.redhat.com/show_bug.cgi?id=1074589" source="CONFIRM">https://bugzilla.redhat.com/show_bug.cgi?id=1074589</ref>
      <ref url="http://www.spinics.net/lists/netdev/msg274316.html" source="MLIST">[netdev] 20140310 [PATCH 5/5] skbuff: skb_segment: orphan frags before copying</ref>
      <ref url="http://www.spinics.net/lists/netdev/msg274250.html" source="MLIST">[netdev] 20140310 [PATCH 0/5] skbuff: fix skb_segment with zero copy skbs</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/03/10/4" source="MLIST">[oss-security] 20140310 CVE-2014-0131 -- kernel: net: use-after-free during segmentation with zerocopy</ref>
    </refs>
    <vuln_soft>
      <prod vendor="linux" name="linux_kernel">
        <vers num="3.0" edition="rc1"/>
        <vers num="3.0" edition="rc2"/>
        <vers num="3.0" edition="rc3"/>
        <vers num="3.0" edition="rc4"/>
        <vers num="3.0" edition="rc5"/>
        <vers num="3.0" edition="rc6"/>
        <vers num="3.0" edition="rc7"/>
        <vers num="3.0.1"/>
        <vers num="3.0.10"/>
        <vers num="3.0.11"/>
        <vers num="3.0.12"/>
        <vers num="3.0.13"/>
        <vers num="3.0.14"/>
        <vers num="3.0.15"/>
        <vers num="3.0.16"/>
        <vers num="3.0.17"/>
        <vers num="3.0.18"/>
        <vers num="3.0.19"/>
        <vers num="3.0.2"/>
        <vers num="3.0.20"/>
        <vers num="3.0.21"/>
        <vers num="3.0.22"/>
        <vers num="3.0.23"/>
        <vers num="3.0.24"/>
        <vers num="3.0.25"/>
        <vers num="3.0.26"/>
        <vers num="3.0.27"/>
        <vers num="3.0.28"/>
        <vers num="3.0.29"/>
        <vers num="3.0.3"/>
        <vers num="3.0.30"/>
        <vers num="3.0.31"/>
        <vers num="3.0.32"/>
        <vers num="3.0.33"/>
        <vers num="3.0.34"/>
        <vers num="3.0.35"/>
        <vers num="3.0.36"/>
        <vers num="3.0.37"/>
        <vers num="3.0.38"/>
        <vers num="3.0.39"/>
        <vers num="3.0.4"/>
        <vers num="3.0.40"/>
        <vers num="3.0.41"/>
        <vers num="3.0.42"/>
        <vers num="3.0.43"/>
        <vers num="3.0.44"/>
        <vers num="3.0.45"/>
        <vers num="3.0.46"/>
        <vers num="3.0.47"/>
        <vers num="3.0.48"/>
        <vers num="3.0.49"/>
        <vers num="3.0.5"/>
        <vers num="3.0.50"/>
        <vers num="3.0.51"/>
        <vers num="3.0.52"/>
        <vers num="3.0.53"/>
        <vers num="3.0.54"/>
        <vers num="3.0.55"/>
        <vers num="3.0.56"/>
        <vers num="3.0.57"/>
        <vers num="3.0.58"/>
        <vers num="3.0.59"/>
        <vers num="3.0.6"/>
        <vers num="3.0.60"/>
        <vers num="3.0.61"/>
        <vers num="3.0.62"/>
        <vers num="3.0.63"/>
        <vers num="3.0.64"/>
        <vers num="3.0.65"/>
        <vers num="3.0.66"/>
        <vers num="3.0.67"/>
        <vers num="3.0.68"/>
        <vers num="3.0.7"/>
        <vers num="3.0.8"/>
        <vers num="3.0.9"/>
        <vers num="3.1" edition="rc1"/>
        <vers num="3.1" edition="rc2"/>
        <vers num="3.1" edition="rc3"/>
        <vers num="3.1" edition="rc4"/>
        <vers num="3.1.1"/>
        <vers num="3.1.10"/>
        <vers num="3.1.2"/>
        <vers num="3.1.3"/>
        <vers num="3.1.4"/>
        <vers num="3.1.5"/>
        <vers num="3.1.6"/>
        <vers num="3.1.7"/>
        <vers num="3.1.8"/>
        <vers num="3.1.9"/>
        <vers num="3.10"/>
        <vers num="3.10.1"/>
        <vers num="3.10.10"/>
        <vers num="3.10.11"/>
        <vers num="3.10.12"/>
        <vers num="3.10.13"/>
        <vers num="3.10.14"/>
        <vers num="3.10.15"/>
        <vers num="3.10.16"/>
        <vers num="3.10.17"/>
        <vers num="3.10.18"/>
        <vers num="3.10.19"/>
        <vers num="3.10.2"/>
        <vers num="3.10.20"/>
        <vers num="3.10.21"/>
        <vers num="3.10.22"/>
        <vers num="3.10.23"/>
        <vers num="3.10.24"/>
        <vers num="3.10.25"/>
        <vers num="3.10.26"/>
        <vers num="3.10.27"/>
        <vers num="3.10.28"/>
        <vers num="3.10.29"/>
        <vers num="3.10.3"/>
        <vers num="3.10.4"/>
        <vers num="3.10.5"/>
        <vers num="3.10.6"/>
        <vers num="3.10.7"/>
        <vers num="3.10.8"/>
        <vers num="3.10.9"/>
        <vers num="3.11"/>
        <vers num="3.11.1"/>
        <vers num="3.11.10"/>
        <vers num="3.11.2"/>
        <vers num="3.11.3"/>
        <vers num="3.11.4"/>
        <vers num="3.11.5"/>
        <vers num="3.11.6"/>
        <vers num="3.11.7"/>
        <vers num="3.11.8"/>
        <vers num="3.11.9"/>
        <vers num="3.12"/>
        <vers num="3.12.1"/>
        <vers num="3.12.10"/>
        <vers num="3.12.11"/>
        <vers num="3.12.12"/>
        <vers num="3.12.13"/>
        <vers num="3.12.2"/>
        <vers num="3.12.3"/>
        <vers num="3.12.4"/>
        <vers num="3.12.5"/>
        <vers num="3.12.6"/>
        <vers num="3.12.7"/>
        <vers num="3.12.8"/>
        <vers num="3.12.9"/>
        <vers num="3.13"/>
        <vers num="3.13.1"/>
        <vers num="3.13.2"/>
        <vers num="3.13.3"/>
        <vers num="3.13.4"/>
        <vers num="3.13.5"/>
        <vers prev="1" num="3.13.6"/>
        <vers num="3.2" edition="rc2"/>
        <vers num="3.2" edition="rc3"/>
        <vers num="3.2" edition="rc4"/>
        <vers num="3.2" edition="rc5"/>
        <vers num="3.2" edition="rc6"/>
        <vers num="3.2" edition="rc7"/>
        <vers num="3.2.1"/>
        <vers num="3.2.10"/>
        <vers num="3.2.11"/>
        <vers num="3.2.12"/>
        <vers num="3.2.13"/>
        <vers num="3.2.14"/>
        <vers num="3.2.15"/>
        <vers num="3.2.16"/>
        <vers num="3.2.17"/>
        <vers num="3.2.18"/>
        <vers num="3.2.19"/>
        <vers num="3.2.2"/>
        <vers num="3.2.20"/>
        <vers num="3.2.21"/>
        <vers num="3.2.22"/>
        <vers num="3.2.23"/>
        <vers num="3.2.24"/>
        <vers num="3.2.25"/>
        <vers num="3.2.26"/>
        <vers num="3.2.27"/>
        <vers num="3.2.28"/>
        <vers num="3.2.29"/>
        <vers num="3.2.3"/>
        <vers num="3.2.30"/>
        <vers num="3.2.4"/>
        <vers num="3.2.5"/>
        <vers num="3.2.6"/>
        <vers num="3.2.7"/>
        <vers num="3.2.8"/>
        <vers num="3.2.9"/>
        <vers num="3.3" edition="rc1"/>
        <vers num="3.3" edition="rc2"/>
        <vers num="3.3" edition="rc3"/>
        <vers num="3.3" edition="rc4"/>
        <vers num="3.3" edition="rc5"/>
        <vers num="3.3" edition="rc6"/>
        <vers num="3.3" edition="rc7"/>
        <vers num="3.3.1"/>
        <vers num="3.3.2"/>
        <vers num="3.3.3"/>
        <vers num="3.3.4"/>
        <vers num="3.3.5"/>
        <vers num="3.3.6"/>
        <vers num="3.3.7"/>
        <vers num="3.3.8"/>
        <vers num="3.4" edition="rc1"/>
        <vers num="3.4" edition="rc2"/>
        <vers num="3.4" edition="rc3"/>
        <vers num="3.4" edition="rc4"/>
        <vers num="3.4" edition="rc5"/>
        <vers num="3.4" edition="rc6"/>
        <vers num="3.4" edition="rc7"/>
        <vers num="3.4.1"/>
        <vers num="3.4.10"/>
        <vers num="3.4.11"/>
        <vers num="3.4.12"/>
        <vers num="3.4.13"/>
        <vers num="3.4.14"/>
        <vers num="3.4.15"/>
        <vers num="3.4.16"/>
        <vers num="3.4.17"/>
        <vers num="3.4.18"/>
        <vers num="3.4.19"/>
        <vers num="3.4.2"/>
        <vers num="3.4.20"/>
        <vers num="3.4.21"/>
        <vers num="3.4.22"/>
        <vers num="3.4.23"/>
        <vers num="3.4.24"/>
        <vers num="3.4.25"/>
        <vers num="3.4.26"/>
        <vers num="3.4.27"/>
        <vers num="3.4.28"/>
        <vers num="3.4.29"/>
        <vers num="3.4.3"/>
        <vers num="3.4.30"/>
        <vers num="3.4.31"/>
        <vers num="3.4.32"/>
        <vers num="3.4.33"/>
        <vers num="3.4.34"/>
        <vers num="3.4.35"/>
        <vers num="3.4.36"/>
        <vers num="3.4.37"/>
        <vers num="3.4.38"/>
        <vers num="3.4.39"/>
        <vers num="3.4.4"/>
        <vers num="3.4.40"/>
        <vers num="3.4.41"/>
        <vers num="3.4.42"/>
        <vers num="3.4.43"/>
        <vers num="3.4.44"/>
        <vers num="3.4.45"/>
        <vers num="3.4.46"/>
        <vers num="3.4.47"/>
        <vers num="3.4.48"/>
        <vers num="3.4.49"/>
        <vers num="3.4.5"/>
        <vers num="3.4.50"/>
        <vers num="3.4.51"/>
        <vers num="3.4.52"/>
        <vers num="3.4.53"/>
        <vers num="3.4.54"/>
        <vers num="3.4.55"/>
        <vers num="3.4.56"/>
        <vers num="3.4.57"/>
        <vers num="3.4.58"/>
        <vers num="3.4.59"/>
        <vers num="3.4.6"/>
        <vers num="3.4.60"/>
        <vers num="3.4.61"/>
        <vers num="3.4.62"/>
        <vers num="3.4.63"/>
        <vers num="3.4.64"/>
        <vers num="3.4.65"/>
        <vers num="3.4.66"/>
        <vers num="3.4.67"/>
        <vers num="3.4.68"/>
        <vers num="3.4.69"/>
        <vers num="3.4.7"/>
        <vers num="3.4.70"/>
        <vers num="3.4.71"/>
        <vers num="3.4.72"/>
        <vers num="3.4.73"/>
        <vers num="3.4.74"/>
        <vers num="3.4.75"/>
        <vers num="3.4.76"/>
        <vers num="3.4.77"/>
        <vers num="3.4.78"/>
        <vers num="3.4.79"/>
        <vers num="3.4.8"/>
        <vers num="3.4.9"/>
        <vers num="3.5.1"/>
        <vers num="3.5.2"/>
        <vers num="3.5.3"/>
        <vers num="3.5.4"/>
        <vers num="3.5.5"/>
        <vers num="3.5.6"/>
        <vers num="3.5.7"/>
        <vers num="3.6"/>
        <vers num="3.6.1"/>
        <vers num="3.6.10"/>
        <vers num="3.6.11"/>
        <vers num="3.6.2"/>
        <vers num="3.6.3"/>
        <vers num="3.6.4"/>
        <vers num="3.6.5"/>
        <vers num="3.6.6"/>
        <vers num="3.6.7"/>
        <vers num="3.6.8"/>
        <vers num="3.6.9"/>
        <vers num="3.7"/>
        <vers num="3.7.1"/>
        <vers num="3.7.10"/>
        <vers num="3.7.2"/>
        <vers num="3.7.3"/>
        <vers num="3.7.4"/>
        <vers num="3.7.5"/>
        <vers num="3.7.6"/>
        <vers num="3.7.7"/>
        <vers num="3.7.8"/>
        <vers num="3.7.9"/>
        <vers num="3.8.0"/>
        <vers num="3.8.1"/>
        <vers num="3.8.10"/>
        <vers num="3.8.11"/>
        <vers num="3.8.12"/>
        <vers num="3.8.13"/>
        <vers num="3.8.2"/>
        <vers num="3.8.3"/>
        <vers num="3.8.4"/>
        <vers num="3.8.5"/>
        <vers num="3.8.6"/>
        <vers num="3.8.7"/>
        <vers num="3.8.8"/>
        <vers num="3.8.9"/>
        <vers num="3.9" edition="rc1"/>
        <vers num="3.9" edition="rc2"/>
        <vers num="3.9" edition="rc3"/>
        <vers num="3.9" edition="rc4"/>
        <vers num="3.9" edition="rc5"/>
        <vers num="3.9" edition="rc6"/>
        <vers num="3.9" edition="rc7"/>
        <vers num="3.9.0"/>
        <vers num="3.9.1"/>
        <vers num="3.9.10"/>
        <vers num="3.9.11"/>
        <vers num="3.9.2"/>
        <vers num="3.9.3"/>
        <vers num="3.9.4"/>
        <vers num="3.9.5"/>
        <vers num="3.9.6"/>
        <vers num="3.9.7"/>
        <vers num="3.9.8"/>
        <vers num="3.9.9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0132" published="2014-03-18" name="CVE-2014-0132" modified="2014-03-19" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:P/I:P/A:P)" CVSS_score="6.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.0" CVSS_base_score="6.5">
    <desc>
      <descript source="cve">The SASL authentication functionality in 389 Directory Server before 1.2.11.26 allows remote authenticated users to connect as an arbitrary user and gain privileges via the authzid parameter in a SASL/GSSAPI bind.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://fedorahosted.org/389/ticket/47739" source="CONFIRM" patch="1">https://fedorahosted.org/389/ticket/47739</ref>
      <ref url="https://fedorahosted.org/389/changeset/76acff12a86110d4165f94e2cba13ef5c7ebc38a/" source="CONFIRM">https://fedorahosted.org/389/changeset/76acff12a86110d4165f94e2cba13ef5c7ebc38a/</ref>
      <ref url="http://secunia.com/advisories/57427" source="SECUNIA" adv="1">57427</ref>
      <ref url="http://secunia.com/advisories/57412" source="SECUNIA" adv="1">57412</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0292.html" source="REDHAT">RHSA-2014:0292</ref>
    </refs>
    <vuln_soft>
      <prod vendor="fedoraproject" name="389_directory_server">
        <vers num="1.2.11.1"/>
        <vers num="1.2.11.10"/>
        <vers num="1.2.11.11"/>
        <vers num="1.2.11.12"/>
        <vers num="1.2.11.13"/>
        <vers num="1.2.11.14"/>
        <vers num="1.2.11.15"/>
        <vers num="1.2.11.17"/>
        <vers num="1.2.11.19"/>
        <vers num="1.2.11.20"/>
        <vers num="1.2.11.21"/>
        <vers num="1.2.11.22"/>
        <vers num="1.2.11.23"/>
        <vers prev="1" num="1.2.11.25"/>
        <vers num="1.2.11.5"/>
        <vers num="1.2.11.6"/>
        <vers num="1.2.11.8"/>
        <vers num="1.2.11.9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0133" published="2014-03-28" name="CVE-2014-0133" modified="2014-03-31" CVSS_version="2.0" CVSS_vector="(AV:N/AC:H/Au:N/C:P/I:P/A:P)" CVSS_score="5.1" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="4.9" CVSS_base_score="5.1">
    <desc>
      <descript source="cve">Heap-based buffer overflow in the SPDY implementation in nginx 1.3.15 before 1.4.7 and 1.5.x before 1.5.12 allows remote attackers to execute arbitrary code via a crafted request.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://mailman.nginx.org/pipermail/nginx-announce/2014/000135.html" source="MLIST">[nginx-announce] 20140318 nginx security advisory (CVE-2014-0133)</ref>
      <ref url="http://lists.opensuse.org/opensuse-updates/2014-03/msg00095.html" source="SUSE">openSUSE-SU-2014:0450</ref>
    </refs>
    <vuln_soft>
      <prod vendor="igor_sysoev" name="nginx">
        <vers num="1.3.15"/>
        <vers num="1.3.16"/>
        <vers num="1.4.0"/>
        <vers num="1.4.1"/>
        <vers num="1.4.2"/>
        <vers num="1.4.3"/>
        <vers num="1.5.0"/>
        <vers num="1.5.1"/>
        <vers num="1.5.10"/>
        <vers num="1.5.11"/>
        <vers num="1.5.2"/>
        <vers num="1.5.3"/>
        <vers num="1.5.4"/>
        <vers num="1.5.5"/>
        <vers num="1.5.6"/>
        <vers num="1.5.7"/>
        <vers num="1.5.8"/>
        <vers num="1.5.9"/>
      </prod>
      <prod vendor="novell" name="opensuse">
        <vers num="13.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0138" published="2014-04-15" name="CVE-2014-0138" modified="2014-04-24" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:N)" CVSS_score="6.4" CVSS_impact_subscore="4.9" CVSS_exploit_subscore="10.0" CVSS_base_score="6.4">
    <desc>
      <descript source="cve">The default configuration in cURL and libcurl 7.10.6 before 7.36.0 re-uses (1) SCP, (2) SFTP, (3) POP3, (4) POP3S, (5) IMAP, (6) IMAPS, (7) SMTP, (8) SMTPS, (9) LDAP, and (10) LDAPS connections, which might allow context-dependent attackers to connect as other users via a request, a similar issue to CVE-2014-0015.</descript>
    </desc>
    <loss_types>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.getchef.com/blog/2014/04/09/enterprise-chef-11-1-3-release/" source="CONFIRM">http://www.getchef.com/blog/2014/04/09/enterprise-chef-11-1-3-release/</ref>
      <ref url="http://www.getchef.com/blog/2014/04/09/enterprise-chef-1-4-9-release/" source="CONFIRM">http://www.getchef.com/blog/2014/04/09/enterprise-chef-1-4-9-release/</ref>
      <ref url="http://www.getchef.com/blog/2014/04/09/chef-server-11-0-12-release/" source="CONFIRM">http://www.getchef.com/blog/2014/04/09/chef-server-11-0-12-release/</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2902" source="DEBIAN">DSA-2902</ref>
      <ref url="http://secunia.com/advisories/57968" source="SECUNIA">57968</ref>
      <ref url="http://secunia.com/advisories/57966" source="SECUNIA">57966</ref>
      <ref url="http://secunia.com/advisories/57836" source="SECUNIA">57836</ref>
      <ref url="http://curl.haxx.se/docs/adv_20140326A.html" source="CONFIRM" adv="1">http://curl.haxx.se/docs/adv_20140326A.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="haxx" name="curl">
        <vers num="7.10.6"/>
        <vers num="7.10.7"/>
        <vers num="7.10.8"/>
        <vers num="7.11.0"/>
        <vers num="7.11.1"/>
        <vers num="7.11.2"/>
        <vers num="7.12.0"/>
        <vers num="7.12.1"/>
        <vers num="7.12.2"/>
        <vers num="7.12.3"/>
        <vers num="7.13.0"/>
        <vers num="7.13.1"/>
        <vers num="7.13.2"/>
        <vers num="7.14.0"/>
        <vers num="7.14.1"/>
        <vers num="7.15.0"/>
        <vers num="7.15.1"/>
        <vers num="7.15.2"/>
        <vers num="7.15.3"/>
        <vers num="7.15.4"/>
        <vers num="7.15.5"/>
        <vers num="7.16.0"/>
        <vers num="7.16.1"/>
        <vers num="7.16.2"/>
        <vers num="7.16.3"/>
        <vers num="7.16.4"/>
        <vers num="7.17.0"/>
        <vers num="7.17.1"/>
        <vers num="7.18.0"/>
        <vers num="7.18.1"/>
        <vers num="7.18.2"/>
        <vers num="7.19.0"/>
        <vers num="7.19.1"/>
        <vers num="7.19.2"/>
        <vers num="7.19.3"/>
        <vers num="7.19.4"/>
        <vers num="7.19.5"/>
        <vers num="7.19.6"/>
        <vers num="7.19.7"/>
        <vers num="7.20.0"/>
        <vers num="7.20.1"/>
        <vers num="7.21.0"/>
        <vers num="7.21.1"/>
        <vers num="7.21.2"/>
        <vers num="7.21.3"/>
        <vers num="7.21.4"/>
        <vers num="7.21.5"/>
        <vers num="7.21.6"/>
        <vers num="7.21.7"/>
        <vers num="7.22.0"/>
        <vers num="7.23.0"/>
        <vers num="7.23.1"/>
        <vers num="7.24.0"/>
        <vers num="7.25.0"/>
        <vers num="7.26.0"/>
        <vers num="7.27.0"/>
        <vers num="7.28.0"/>
        <vers num="7.28.1"/>
        <vers num="7.29.0"/>
        <vers num="7.30.0"/>
        <vers num="7.31.0"/>
        <vers num="7.32.0"/>
        <vers num="7.33.0"/>
        <vers num="7.34.0"/>
        <vers num="7.35.0"/>
      </prod>
      <prod vendor="haxx" name="libcurl">
        <vers num="7.10.6"/>
        <vers num="7.10.7"/>
        <vers num="7.10.8"/>
        <vers num="7.11.0"/>
        <vers num="7.11.1"/>
        <vers num="7.11.2"/>
        <vers num="7.12.0"/>
        <vers num="7.12.1"/>
        <vers num="7.12.2"/>
        <vers num="7.12.3"/>
        <vers num="7.13.0"/>
        <vers num="7.13.1"/>
        <vers num="7.13.2"/>
        <vers num="7.14.0"/>
        <vers num="7.14.1"/>
        <vers num="7.15.0"/>
        <vers num="7.15.1"/>
        <vers num="7.15.2"/>
        <vers num="7.15.3"/>
        <vers num="7.15.4"/>
        <vers num="7.15.5"/>
        <vers num="7.16.0"/>
        <vers num="7.16.1"/>
        <vers num="7.16.2"/>
        <vers num="7.16.3"/>
        <vers num="7.16.4"/>
        <vers num="7.17.0"/>
        <vers num="7.17.1"/>
        <vers num="7.18.0"/>
        <vers num="7.18.1"/>
        <vers num="7.18.2"/>
        <vers num="7.19.0"/>
        <vers num="7.19.1"/>
        <vers num="7.19.2"/>
        <vers num="7.19.3"/>
        <vers num="7.19.4"/>
        <vers num="7.19.5"/>
        <vers num="7.19.6"/>
        <vers num="7.19.7"/>
        <vers num="7.20.0"/>
        <vers num="7.20.1"/>
        <vers num="7.21.0"/>
        <vers num="7.21.1"/>
        <vers num="7.21.2"/>
        <vers num="7.21.3"/>
        <vers num="7.21.4"/>
        <vers num="7.21.5"/>
        <vers num="7.21.6"/>
        <vers num="7.21.7"/>
        <vers num="7.22.0"/>
        <vers num="7.23.0"/>
        <vers num="7.23.1"/>
        <vers num="7.24.0"/>
        <vers num="7.25.0"/>
        <vers num="7.26.0"/>
        <vers num="7.27.0"/>
        <vers num="7.28.0"/>
        <vers num="7.28.1"/>
        <vers num="7.29.0"/>
        <vers num="7.30.0"/>
        <vers num="7.31.0"/>
        <vers num="7.32.0"/>
        <vers num="7.33.0"/>
        <vers num="7.34.0"/>
        <vers num="7.35.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0139" published="2014-04-15" name="CVE-2014-0139" modified="2014-04-24" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:N)" CVSS_score="5.8" CVSS_impact_subscore="4.9" CVSS_exploit_subscore="8.6" CVSS_base_score="5.8">
    <desc>
      <descript source="cve">cURL and libcurl 7.1 before 7.36.0, when using the OpenSSL, axtls, qsossl or gskit libraries for TLS, recognize a wildcard IP address in the subject's Common Name (CN) field of an X.509 certificate, which might allow man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority.</descript>
    </desc>
    <loss_types>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.getchef.com/blog/2014/04/09/enterprise-chef-11-1-3-release/" source="CONFIRM">http://www.getchef.com/blog/2014/04/09/enterprise-chef-11-1-3-release/</ref>
      <ref url="http://www.getchef.com/blog/2014/04/09/enterprise-chef-1-4-9-release/" source="CONFIRM">http://www.getchef.com/blog/2014/04/09/enterprise-chef-1-4-9-release/</ref>
      <ref url="http://www.getchef.com/blog/2014/04/09/chef-server-11-0-12-release/" source="CONFIRM">http://www.getchef.com/blog/2014/04/09/chef-server-11-0-12-release/</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2902" source="DEBIAN">DSA-2902</ref>
      <ref url="http://secunia.com/advisories/57968" source="SECUNIA">57968</ref>
      <ref url="http://secunia.com/advisories/57966" source="SECUNIA">57966</ref>
      <ref url="http://secunia.com/advisories/57836" source="SECUNIA">57836</ref>
      <ref url="http://curl.haxx.se/docs/adv_20140326B.html" source="CONFIRM" adv="1">http://curl.haxx.se/docs/adv_20140326B.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="haxx" name="curl">
        <vers num="7.10.6"/>
        <vers num="7.10.7"/>
        <vers num="7.10.8"/>
        <vers num="7.11.0"/>
        <vers num="7.11.1"/>
        <vers num="7.11.2"/>
        <vers num="7.12.0"/>
        <vers num="7.12.1"/>
        <vers num="7.12.2"/>
        <vers num="7.12.3"/>
        <vers num="7.13.0"/>
        <vers num="7.13.1"/>
        <vers num="7.13.2"/>
        <vers num="7.14.0"/>
        <vers num="7.14.1"/>
        <vers num="7.15.0"/>
        <vers num="7.15.1"/>
        <vers num="7.15.2"/>
        <vers num="7.15.3"/>
        <vers num="7.15.4"/>
        <vers num="7.15.5"/>
        <vers num="7.16.0"/>
        <vers num="7.16.1"/>
        <vers num="7.16.2"/>
        <vers num="7.16.3"/>
        <vers num="7.16.4"/>
        <vers num="7.17.0"/>
        <vers num="7.17.1"/>
        <vers num="7.18.0"/>
        <vers num="7.18.1"/>
        <vers num="7.18.2"/>
        <vers num="7.19.0"/>
        <vers num="7.19.1"/>
        <vers num="7.19.2"/>
        <vers num="7.19.3"/>
        <vers num="7.19.4"/>
        <vers num="7.19.5"/>
        <vers num="7.19.6"/>
        <vers num="7.19.7"/>
        <vers num="7.20.0"/>
        <vers num="7.20.1"/>
        <vers num="7.21.0"/>
        <vers num="7.21.1"/>
        <vers num="7.21.2"/>
        <vers num="7.21.3"/>
        <vers num="7.21.4"/>
        <vers num="7.21.5"/>
        <vers num="7.21.6"/>
        <vers num="7.21.7"/>
        <vers num="7.22.0"/>
        <vers num="7.23.0"/>
        <vers num="7.23.1"/>
        <vers num="7.24.0"/>
        <vers num="7.25.0"/>
        <vers num="7.26.0"/>
        <vers num="7.27.0"/>
        <vers num="7.28.0"/>
        <vers num="7.28.1"/>
        <vers num="7.29.0"/>
        <vers num="7.30.0"/>
        <vers num="7.31.0"/>
        <vers num="7.32.0"/>
        <vers num="7.33.0"/>
        <vers num="7.34.0"/>
        <vers num="7.35.0"/>
      </prod>
      <prod vendor="haxx" name="libcurl">
        <vers num="7.10.6"/>
        <vers num="7.10.7"/>
        <vers num="7.10.8"/>
        <vers num="7.11.0"/>
        <vers num="7.11.1"/>
        <vers num="7.11.2"/>
        <vers num="7.12.0"/>
        <vers num="7.12.1"/>
        <vers num="7.12.2"/>
        <vers num="7.12.3"/>
        <vers num="7.13.0"/>
        <vers num="7.13.1"/>
        <vers num="7.13.2"/>
        <vers num="7.14.0"/>
        <vers num="7.14.1"/>
        <vers num="7.15.0"/>
        <vers num="7.15.1"/>
        <vers num="7.15.2"/>
        <vers num="7.15.3"/>
        <vers num="7.15.4"/>
        <vers num="7.15.5"/>
        <vers num="7.16.0"/>
        <vers num="7.16.1"/>
        <vers num="7.16.2"/>
        <vers num="7.16.3"/>
        <vers num="7.16.4"/>
        <vers num="7.17.0"/>
        <vers num="7.17.1"/>
        <vers num="7.18.0"/>
        <vers num="7.18.1"/>
        <vers num="7.18.2"/>
        <vers num="7.19.0"/>
        <vers num="7.19.1"/>
        <vers num="7.19.2"/>
        <vers num="7.19.3"/>
        <vers num="7.19.4"/>
        <vers num="7.19.5"/>
        <vers num="7.19.6"/>
        <vers num="7.19.7"/>
        <vers num="7.20.0"/>
        <vers num="7.20.1"/>
        <vers num="7.21.0"/>
        <vers num="7.21.1"/>
        <vers num="7.21.2"/>
        <vers num="7.21.3"/>
        <vers num="7.21.4"/>
        <vers num="7.21.5"/>
        <vers num="7.21.6"/>
        <vers num="7.21.7"/>
        <vers num="7.22.0"/>
        <vers num="7.23.0"/>
        <vers num="7.23.1"/>
        <vers num="7.24.0"/>
        <vers num="7.25.0"/>
        <vers num="7.26.0"/>
        <vers num="7.27.0"/>
        <vers num="7.28.0"/>
        <vers num="7.28.1"/>
        <vers num="7.29.0"/>
        <vers num="7.30.0"/>
        <vers num="7.31.0"/>
        <vers num="7.32.0"/>
        <vers num="7.33.0"/>
        <vers num="7.34.0"/>
        <vers num="7.35.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0150" published="2014-04-18" name="CVE-2014-0150" modified="2014-04-21" CVSS_version="2.0" CVSS_vector="(AV:A/AC:M/Au:S/C:P/I:P/A:P)" CVSS_score="4.9" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="4.4" CVSS_base_score="4.9">
    <desc>
      <descript source="cve">Integer overflow in the virtio_net_handle_mac function in hw/net/virtio-net.c in QEMU 2.0 and earlier allows local guest users to execute arbitrary code via a MAC addresses table update request, which triggers a heap-based buffer overflow.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <local_network/>
    </range>
    <refs>
      <ref url="http://thread.gmane.org/gmane.comp.emulators.qemu/266713" source="MLIST" patch="1">[Qemu-devel] 20140411 [PATCH for-2.0] virtio-net: fix guest-triggerable buffer overrun</ref>
      <ref url="https://bugzilla.redhat.com/show_bug.cgi?id=1078846" source="CONFIRM">https://bugzilla.redhat.com/show_bug.cgi?id=1078846</ref>
      <ref url="http://secunia.com/advisories/57878" source="SECUNIA" adv="1">57878</ref>
      <ref url="http://article.gmane.org/gmane.comp.emulators.qemu/266768" source="MLIST">[Qemu-devel] 20140411 Re: [PATCH for-2.0] virtio-net: fix guest-triggerable buffer overrun</ref>
    </refs>
    <vuln_soft>
      <prod vendor="qemu" name="qemu">
        <vers num="0.1"/>
        <vers num="0.1.1"/>
        <vers num="0.1.2"/>
        <vers num="0.1.3"/>
        <vers num="0.1.4"/>
        <vers num="0.1.5"/>
        <vers num="0.1.6"/>
        <vers num="0.10.0"/>
        <vers num="0.10.1"/>
        <vers num="0.10.2"/>
        <vers num="0.10.3"/>
        <vers num="0.10.4"/>
        <vers num="0.10.5"/>
        <vers num="0.10.6"/>
        <vers num="0.11.0" edition="rc0"/>
        <vers num="0.11.0" edition="rc1"/>
        <vers num="0.11.0" edition="rc2"/>
        <vers num="0.11.0-rc0"/>
        <vers num="0.11.0-rc1"/>
        <vers num="0.11.0-rc2"/>
        <vers num="0.11.1"/>
        <vers num="0.12.0" edition="rc1"/>
        <vers num="0.12.0" edition="rc2"/>
        <vers num="0.12.1"/>
        <vers num="0.12.2"/>
        <vers num="0.12.3"/>
        <vers num="0.12.4"/>
        <vers num="0.12.5"/>
        <vers num="0.13.0" edition="rc0"/>
        <vers num="0.13.0" edition="rc1"/>
        <vers num="0.14.0" edition="rc0"/>
        <vers num="0.14.0" edition="rc1"/>
        <vers num="0.14.0" edition="rc2"/>
        <vers num="0.14.1"/>
        <vers num="0.15.0" edition="rc1"/>
        <vers num="0.15.0" edition="rc2"/>
        <vers num="0.15.1"/>
        <vers num="0.15.2"/>
        <vers num="0.2"/>
        <vers num="0.3"/>
        <vers num="0.4"/>
        <vers num="0.4.1"/>
        <vers num="0.4.2"/>
        <vers num="0.4.3"/>
        <vers num="0.5.0"/>
        <vers num="0.5.1"/>
        <vers num="0.5.2"/>
        <vers num="0.5.3"/>
        <vers num="0.5.4"/>
        <vers num="0.5.5"/>
        <vers num="0.6.0"/>
        <vers num="0.6.1"/>
        <vers num="0.7.0"/>
        <vers num="0.7.1"/>
        <vers num="0.7.2"/>
        <vers num="0.8.0"/>
        <vers num="0.8.1"/>
        <vers num="0.8.2"/>
        <vers num="0.9.0"/>
        <vers num="0.9.1"/>
        <vers num="0.9.1-5"/>
        <vers num="1.0" edition="rc1"/>
        <vers num="1.0" edition="rc2"/>
        <vers num="1.0" edition="rc3"/>
        <vers num="1.0" edition="rc4"/>
        <vers num="1.0.1"/>
        <vers num="1.1" edition="rc1"/>
        <vers num="1.1" edition="rc2"/>
        <vers num="1.1" edition="rc3"/>
        <vers num="1.1" edition="rc4"/>
        <vers num="1.4.1"/>
        <vers num="1.4.2"/>
        <vers num="1.5.0" edition="rc1"/>
        <vers num="1.5.0" edition="rc2"/>
        <vers num="1.5.0" edition="rc3"/>
        <vers num="1.5.1"/>
        <vers num="1.5.2"/>
        <vers num="1.5.3"/>
        <vers num="1.6.0" edition="rc1"/>
        <vers num="1.6.0" edition="rc2"/>
        <vers num="1.6.0" edition="rc3"/>
        <vers num="1.6.1"/>
        <vers num="1.6.2"/>
        <vers num="1.7.1"/>
        <vers prev="1" num="2.0"/>
        <vers prev="1" num="2.0.0" edition="-"/>
        <vers prev="1" num="2.0.0" edition="rc0"/>
        <vers prev="1" num="2.0.0" edition="rc1"/>
        <vers prev="1" num="2.0.0" edition="rc2"/>
        <vers prev="1" num="2.0.0" edition="rc3"/>
      </prod>
      <prod vendor="redhat" name="enterprise_linux">
        <vers num="6"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0155" published="2014-04-14" name="CVE-2014-0155" modified="2014-04-15" CVSS_version="2.0" CVSS_vector="(AV:A/AC:L/Au:S/C:N/I:N/A:C)" CVSS_score="5.5" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="5.1" CVSS_base_score="5.5">
    <desc>
      <descript source="cve">The ioapic_deliver function in virt/kvm/ioapic.c in the Linux kernel through 3.14.1 does not properly validate the kvm_irq_delivery_to_apic return value, which allows guest OS users to cause a denial of service (host OS crash) via a crafted entry in the redirection table of an I/O APIC.  NOTE: the affected code was moved to the ioapic_service function before the vulnerability was announced.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <local_network/>
    </range>
    <refs>
      <ref url="http://git.kernel.org/cgit/virt/kvm/kvm.git/commit/?id=5678de3f15010b9022ee45673f33bcfc71d47b60" source="CONFIRM" patch="1">http://git.kernel.org/cgit/virt/kvm/kvm.git/commit/?id=5678de3f15010b9022ee45673f33bcfc71d47b60</ref>
      <ref url="https://bugzilla.redhat.com/show_bug.cgi?id=1081589" source="CONFIRM">https://bugzilla.redhat.com/show_bug.cgi?id=1081589</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/04/07/2" source="MLIST">[oss-security] 20140407 CVE-2014-0155 -- kernel: kvm: BUG caused by invalid entry in guest ioapic redirection table</ref>
    </refs>
    <vuln_soft>
      <prod vendor="linux" name="linux_kernel">
        <vers num="3.0" edition="rc1"/>
        <vers num="3.0" edition="rc2"/>
        <vers num="3.0" edition="rc3"/>
        <vers num="3.0" edition="rc4"/>
        <vers num="3.0" edition="rc5"/>
        <vers num="3.0" edition="rc6"/>
        <vers num="3.0" edition="rc7"/>
        <vers num="3.0.1"/>
        <vers num="3.0.10"/>
        <vers num="3.0.11"/>
        <vers num="3.0.12"/>
        <vers num="3.0.13"/>
        <vers num="3.0.14"/>
        <vers num="3.0.15"/>
        <vers num="3.0.16"/>
        <vers num="3.0.17"/>
        <vers num="3.0.18"/>
        <vers num="3.0.19"/>
        <vers num="3.0.2"/>
        <vers num="3.0.20"/>
        <vers num="3.0.21"/>
        <vers num="3.0.22"/>
        <vers num="3.0.23"/>
        <vers num="3.0.24"/>
        <vers num="3.0.25"/>
        <vers num="3.0.26"/>
        <vers num="3.0.27"/>
        <vers num="3.0.28"/>
        <vers num="3.0.29"/>
        <vers num="3.0.3"/>
        <vers num="3.0.30"/>
        <vers num="3.0.31"/>
        <vers num="3.0.32"/>
        <vers num="3.0.33"/>
        <vers num="3.0.34"/>
        <vers num="3.0.35"/>
        <vers num="3.0.36"/>
        <vers num="3.0.37"/>
        <vers num="3.0.38"/>
        <vers num="3.0.39"/>
        <vers num="3.0.4"/>
        <vers num="3.0.40"/>
        <vers num="3.0.41"/>
        <vers num="3.0.42"/>
        <vers num="3.0.43"/>
        <vers num="3.0.44"/>
        <vers num="3.0.45"/>
        <vers num="3.0.46"/>
        <vers num="3.0.47"/>
        <vers num="3.0.48"/>
        <vers num="3.0.49"/>
        <vers num="3.0.5"/>
        <vers num="3.0.50"/>
        <vers num="3.0.51"/>
        <vers num="3.0.52"/>
        <vers num="3.0.53"/>
        <vers num="3.0.54"/>
        <vers num="3.0.55"/>
        <vers num="3.0.56"/>
        <vers num="3.0.57"/>
        <vers num="3.0.58"/>
        <vers num="3.0.59"/>
        <vers num="3.0.6"/>
        <vers num="3.0.60"/>
        <vers num="3.0.61"/>
        <vers num="3.0.62"/>
        <vers num="3.0.63"/>
        <vers num="3.0.64"/>
        <vers num="3.0.65"/>
        <vers num="3.0.66"/>
        <vers num="3.0.67"/>
        <vers num="3.0.68"/>
        <vers num="3.0.7"/>
        <vers num="3.0.8"/>
        <vers num="3.0.9"/>
        <vers num="3.1" edition="rc1"/>
        <vers num="3.1" edition="rc2"/>
        <vers num="3.1" edition="rc3"/>
        <vers num="3.1" edition="rc4"/>
        <vers num="3.1.1"/>
        <vers num="3.1.10"/>
        <vers num="3.1.2"/>
        <vers num="3.1.3"/>
        <vers num="3.1.4"/>
        <vers num="3.1.5"/>
        <vers num="3.1.6"/>
        <vers num="3.1.7"/>
        <vers num="3.1.8"/>
        <vers num="3.1.9"/>
        <vers num="3.10"/>
        <vers num="3.10.1"/>
        <vers num="3.10.10"/>
        <vers num="3.10.11"/>
        <vers num="3.10.12"/>
        <vers num="3.10.13"/>
        <vers num="3.10.14"/>
        <vers num="3.10.15"/>
        <vers num="3.10.16"/>
        <vers num="3.10.17"/>
        <vers num="3.10.18"/>
        <vers num="3.10.19"/>
        <vers num="3.10.2"/>
        <vers num="3.10.20"/>
        <vers num="3.10.21"/>
        <vers num="3.10.22"/>
        <vers num="3.10.23"/>
        <vers num="3.10.24"/>
        <vers num="3.10.25"/>
        <vers num="3.10.26"/>
        <vers num="3.10.27"/>
        <vers num="3.10.28"/>
        <vers num="3.10.29"/>
        <vers num="3.10.3"/>
        <vers num="3.10.4"/>
        <vers num="3.10.5"/>
        <vers num="3.10.6"/>
        <vers num="3.10.7"/>
        <vers num="3.10.8"/>
        <vers num="3.10.9"/>
        <vers num="3.11"/>
        <vers num="3.11.1"/>
        <vers num="3.11.10"/>
        <vers num="3.11.2"/>
        <vers num="3.11.3"/>
        <vers num="3.11.4"/>
        <vers num="3.11.5"/>
        <vers num="3.11.6"/>
        <vers num="3.11.7"/>
        <vers num="3.11.8"/>
        <vers num="3.11.9"/>
        <vers num="3.12"/>
        <vers num="3.12.1"/>
        <vers num="3.12.10"/>
        <vers num="3.12.11"/>
        <vers num="3.12.12"/>
        <vers num="3.12.13"/>
        <vers num="3.12.14"/>
        <vers num="3.12.15"/>
        <vers num="3.12.16"/>
        <vers num="3.12.17"/>
        <vers num="3.12.2"/>
        <vers num="3.12.3"/>
        <vers num="3.12.4"/>
        <vers num="3.12.5"/>
        <vers num="3.12.6"/>
        <vers num="3.12.7"/>
        <vers num="3.12.8"/>
        <vers num="3.12.9"/>
        <vers num="3.13"/>
        <vers num="3.13.1"/>
        <vers num="3.13.2"/>
        <vers num="3.13.3"/>
        <vers num="3.13.4"/>
        <vers num="3.13.5"/>
        <vers num="3.13.6"/>
        <vers num="3.13.7"/>
        <vers num="3.13.8"/>
        <vers num="3.13.9"/>
        <vers prev="1" num="3.14.1"/>
        <vers num="3.2" edition="rc2"/>
        <vers num="3.2" edition="rc3"/>
        <vers num="3.2" edition="rc4"/>
        <vers num="3.2" edition="rc5"/>
        <vers num="3.2" edition="rc6"/>
        <vers num="3.2" edition="rc7"/>
        <vers num="3.2.1"/>
        <vers num="3.2.10"/>
        <vers num="3.2.11"/>
        <vers num="3.2.12"/>
        <vers num="3.2.13"/>
        <vers num="3.2.14"/>
        <vers num="3.2.15"/>
        <vers num="3.2.16"/>
        <vers num="3.2.17"/>
        <vers num="3.2.18"/>
        <vers num="3.2.19"/>
        <vers num="3.2.2"/>
        <vers num="3.2.20"/>
        <vers num="3.2.21"/>
        <vers num="3.2.22"/>
        <vers num="3.2.23"/>
        <vers num="3.2.24"/>
        <vers num="3.2.25"/>
        <vers num="3.2.26"/>
        <vers num="3.2.27"/>
        <vers num="3.2.28"/>
        <vers num="3.2.29"/>
        <vers num="3.2.3"/>
        <vers num="3.2.30"/>
        <vers num="3.2.4"/>
        <vers num="3.2.5"/>
        <vers num="3.2.6"/>
        <vers num="3.2.7"/>
        <vers num="3.2.8"/>
        <vers num="3.2.9"/>
        <vers num="3.3" edition="rc1"/>
        <vers num="3.3" edition="rc2"/>
        <vers num="3.3" edition="rc3"/>
        <vers num="3.3" edition="rc4"/>
        <vers num="3.3" edition="rc5"/>
        <vers num="3.3" edition="rc6"/>
        <vers num="3.3" edition="rc7"/>
        <vers num="3.3.1"/>
        <vers num="3.3.2"/>
        <vers num="3.3.3"/>
        <vers num="3.3.4"/>
        <vers num="3.3.5"/>
        <vers num="3.3.6"/>
        <vers num="3.3.7"/>
        <vers num="3.3.8"/>
        <vers num="3.4" edition="rc1"/>
        <vers num="3.4" edition="rc2"/>
        <vers num="3.4" edition="rc3"/>
        <vers num="3.4" edition="rc4"/>
        <vers num="3.4" edition="rc5"/>
        <vers num="3.4" edition="rc6"/>
        <vers num="3.4" edition="rc7"/>
        <vers num="3.4.1"/>
        <vers num="3.4.10"/>
        <vers num="3.4.11"/>
        <vers num="3.4.12"/>
        <vers num="3.4.13"/>
        <vers num="3.4.14"/>
        <vers num="3.4.15"/>
        <vers num="3.4.16"/>
        <vers num="3.4.17"/>
        <vers num="3.4.18"/>
        <vers num="3.4.19"/>
        <vers num="3.4.2"/>
        <vers num="3.4.20"/>
        <vers num="3.4.21"/>
        <vers num="3.4.22"/>
        <vers num="3.4.23"/>
        <vers num="3.4.24"/>
        <vers num="3.4.25"/>
        <vers num="3.4.26"/>
        <vers num="3.4.27"/>
        <vers num="3.4.28"/>
        <vers num="3.4.29"/>
        <vers num="3.4.3"/>
        <vers num="3.4.30"/>
        <vers num="3.4.31"/>
        <vers num="3.4.32"/>
        <vers num="3.4.33"/>
        <vers num="3.4.34"/>
        <vers num="3.4.35"/>
        <vers num="3.4.36"/>
        <vers num="3.4.37"/>
        <vers num="3.4.38"/>
        <vers num="3.4.39"/>
        <vers num="3.4.4"/>
        <vers num="3.4.40"/>
        <vers num="3.4.41"/>
        <vers num="3.4.42"/>
        <vers num="3.4.43"/>
        <vers num="3.4.44"/>
        <vers num="3.4.45"/>
        <vers num="3.4.46"/>
        <vers num="3.4.47"/>
        <vers num="3.4.48"/>
        <vers num="3.4.49"/>
        <vers num="3.4.5"/>
        <vers num="3.4.50"/>
        <vers num="3.4.51"/>
        <vers num="3.4.52"/>
        <vers num="3.4.53"/>
        <vers num="3.4.54"/>
        <vers num="3.4.55"/>
        <vers num="3.4.56"/>
        <vers num="3.4.57"/>
        <vers num="3.4.58"/>
        <vers num="3.4.59"/>
        <vers num="3.4.6"/>
        <vers num="3.4.60"/>
        <vers num="3.4.61"/>
        <vers num="3.4.62"/>
        <vers num="3.4.63"/>
        <vers num="3.4.64"/>
        <vers num="3.4.65"/>
        <vers num="3.4.66"/>
        <vers num="3.4.67"/>
        <vers num="3.4.68"/>
        <vers num="3.4.69"/>
        <vers num="3.4.7"/>
        <vers num="3.4.70"/>
        <vers num="3.4.71"/>
        <vers num="3.4.72"/>
        <vers num="3.4.73"/>
        <vers num="3.4.74"/>
        <vers num="3.4.75"/>
        <vers num="3.4.76"/>
        <vers num="3.4.77"/>
        <vers num="3.4.78"/>
        <vers num="3.4.79"/>
        <vers num="3.4.8"/>
        <vers num="3.4.9"/>
        <vers num="3.5.1"/>
        <vers num="3.5.2"/>
        <vers num="3.5.3"/>
        <vers num="3.5.4"/>
        <vers num="3.5.5"/>
        <vers num="3.5.6"/>
        <vers num="3.5.7"/>
        <vers num="3.6"/>
        <vers num="3.6.1"/>
        <vers num="3.6.10"/>
        <vers num="3.6.11"/>
        <vers num="3.6.2"/>
        <vers num="3.6.3"/>
        <vers num="3.6.4"/>
        <vers num="3.6.5"/>
        <vers num="3.6.6"/>
        <vers num="3.6.7"/>
        <vers num="3.6.8"/>
        <vers num="3.6.9"/>
        <vers num="3.7"/>
        <vers num="3.7.1"/>
        <vers num="3.7.10"/>
        <vers num="3.7.2"/>
        <vers num="3.7.3"/>
        <vers num="3.7.4"/>
        <vers num="3.7.5"/>
        <vers num="3.7.6"/>
        <vers num="3.7.7"/>
        <vers num="3.7.8"/>
        <vers num="3.7.9"/>
        <vers num="3.8.0"/>
        <vers num="3.8.1"/>
        <vers num="3.8.10"/>
        <vers num="3.8.11"/>
        <vers num="3.8.12"/>
        <vers num="3.8.13"/>
        <vers num="3.8.2"/>
        <vers num="3.8.3"/>
        <vers num="3.8.4"/>
        <vers num="3.8.5"/>
        <vers num="3.8.6"/>
        <vers num="3.8.7"/>
        <vers num="3.8.8"/>
        <vers num="3.8.9"/>
        <vers num="3.9" edition="rc1"/>
        <vers num="3.9" edition="rc2"/>
        <vers num="3.9" edition="rc3"/>
        <vers num="3.9" edition="rc4"/>
        <vers num="3.9" edition="rc5"/>
        <vers num="3.9" edition="rc6"/>
        <vers num="3.9" edition="rc7"/>
        <vers num="3.9.0"/>
        <vers num="3.9.1"/>
        <vers num="3.9.10"/>
        <vers num="3.9.11"/>
        <vers num="3.9.2"/>
        <vers num="3.9.3"/>
        <vers num="3.9.4"/>
        <vers num="3.9.5"/>
        <vers num="3.9.6"/>
        <vers num="3.9.7"/>
        <vers num="3.9.8"/>
        <vers num="3.9.9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0157" published="2014-04-15" name="CVE-2014-0157" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in the Horizon Orchestration dashboard in OpenStack Dashboard (aka Horizon) 2013.2 before 2013.2.4 and icehouse before icehouse-rc2 allows remote attackers to inject arbitrary web script or HTML via the description field of a Heat template.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://www.openwall.com/lists/oss-security/2014/04/08/8" source="MLIST" patch="1">[oss-security] 20140408 [OSSA 2014-010] XSS in Horizon orchestration dashboard (CVE-2014-0157)</ref>
      <ref url="https://launchpad.net/bugs/1289033" source="CONFIRM" adv="1">https://launchpad.net/bugs/1289033</ref>
    </refs>
    <vuln_soft>
      <prod vendor="openstack" name="horizon">
        <vers num="2013.2"/>
        <vers num="2013.2.1"/>
        <vers num="2013.2.2"/>
        <vers num="2013.2.3"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0159" published="2014-04-14" name="CVE-2014-0159" modified="2014-04-15" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:P)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">Buffer overflow in the GetStatistics64 remote procedure call (RPC) in OpenAFS 1.4.8 before 1.6.7 allows remote attackers to cause a denial of service (crash) via a crafted statsVersion argument.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.openafs.org/frameset/dl/openafs/1.6.7/ChangeLog" source="CONFIRM">http://www.openafs.org/frameset/dl/openafs/1.6.7/ChangeLog</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2899" source="DEBIAN">DSA-2899</ref>
      <ref url="http://secunia.com/advisories/57832" source="SECUNIA" adv="1">57832</ref>
      <ref url="http://secunia.com/advisories/57779" source="SECUNIA" adv="1">57779</ref>
      <ref url="http://openafs.org/pages/security/OPENAFS-SA-2014-001.txt" source="CONFIRM" adv="1">http://openafs.org/pages/security/OPENAFS-SA-2014-001.txt</ref>
    </refs>
    <vuln_soft>
      <prod vendor="openafs" name="openafs">
        <vers num="1.4.10"/>
        <vers num="1.4.11"/>
        <vers num="1.4.12"/>
        <vers num="1.4.14"/>
        <vers num="1.4.14.1"/>
        <vers num="1.4.15"/>
        <vers num="1.4.8"/>
        <vers num="1.4.9"/>
        <vers num="1.6.0"/>
        <vers num="1.6.1"/>
        <vers num="1.6.2"/>
        <vers num="1.6.2.1"/>
        <vers num="1.6.3"/>
        <vers num="1.6.4"/>
        <vers num="1.6.5"/>
        <vers num="1.6.5.1"/>
        <vers num="1.6.5.2"/>
        <vers num="1.6.6"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0160" published="2014-04-07" name="CVE-2014-0160" modified="2014-04-24" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:N/A:N)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c, aka the Heartbleed bug.</descript>
    </desc>
    <impacts>
      <impact source="nvd">CVSS V2 scoring evaluates the impact of the vulnerability on the host where the vulnerability is located. When evaluating the impact of this vulnerability to your organization, take into account the nature of the data that is being protected and act according to your organization’s risk acceptance. While CVE-2014-0160 does not allow unrestricted access to memory on the targeted host, a successful exploit does leak information from memory locations which have the potential to contain particularly sensitive information, e.g., cryptographic keys and passwords.  Theft of this information could enable other attacks on the information system, the impact of which would depend on the sensitivity of the data and functions of that system.</impact>
    </impacts>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.us-cert.gov/ncas/alerts/TA14-098A" source="CERT">TA14-098A</ref>
      <ref url="http://www.kb.cert.org/vuls/id/720951" source="CERT-VN">VU#720951</ref>
      <ref url="https://www.cert.fi/en/reports/2014/vulnerability788210.html" source="MISC">https://www.cert.fi/en/reports/2014/vulnerability788210.html</ref>
      <ref url="https://lists.balabit.hu/pipermail/syslog-ng-announce/2014-April/000184.html" source="MLIST">[syslog-ng-announce] 20140411 syslog-ng Premium Edition 5 LTS (5.0.4a) has been released</ref>
      <ref url="https://gist.github.com/chapmajs/10473815" source="MISC">https://gist.github.com/chapmajs/10473815</ref>
      <ref url="https://code.google.com/p/mod-spdy/issues/detail?id=85" source="CONFIRM">https://code.google.com/p/mod-spdy/issues/detail?id=85</ref>
      <ref url="https://bugzilla.redhat.com/show_bug.cgi?id=1084875" source="CONFIRM">https://bugzilla.redhat.com/show_bug.cgi?id=1084875</ref>
      <ref url="https://blog.torproject.org/blog/openssl-bug-cve-2014-0160" source="MISC">https://blog.torproject.org/blog/openssl-bug-cve-2014-0160</ref>
      <ref url="http://www.splunk.com/view/SP-CAAAMB3" source="CONFIRM">http://www.splunk.com/view/SP-CAAAMB3</ref>
      <ref url="http://www.securitytracker.com/id/1030082" source="SECTRACK">1030082</ref>
      <ref url="http://www.securitytracker.com/id/1030081" source="SECTRACK">1030081</ref>
      <ref url="http://www.securitytracker.com/id/1030080" source="SECTRACK">1030080</ref>
      <ref url="http://www.securitytracker.com/id/1030079" source="SECTRACK">1030079</ref>
      <ref url="http://www.securitytracker.com/id/1030078" source="SECTRACK">1030078</ref>
      <ref url="http://www.securitytracker.com/id/1030077" source="SECTRACK">1030077</ref>
      <ref url="http://www.securitytracker.com/id/1030074" source="SECTRACK">1030074</ref>
      <ref url="http://www.securitytracker.com/id/1030026" source="SECTRACK">1030026</ref>
      <ref url="http://www.securityfocus.com/bid/66690" source="BID">66690</ref>
      <ref url="http://www.oracle.com/technetwork/topics/security/opensslheartbleedcve-2014-0160-2188454.html" source="CONFIRM">http://www.oracle.com/technetwork/topics/security/opensslheartbleedcve-2014-0160-2188454.html</ref>
      <ref url="http://www.openssl.org/news/secadv_20140407.txt" source="CONFIRM" adv="1">http://www.openssl.org/news/secadv_20140407.txt</ref>
      <ref url="http://www.getchef.com/blog/2014/04/09/enterprise-chef-11-1-3-release/" source="CONFIRM">http://www.getchef.com/blog/2014/04/09/enterprise-chef-11-1-3-release/</ref>
      <ref url="http://www.getchef.com/blog/2014/04/09/enterprise-chef-1-4-9-release/" source="CONFIRM">http://www.getchef.com/blog/2014/04/09/enterprise-chef-1-4-9-release/</ref>
      <ref url="http://www.getchef.com/blog/2014/04/09/chef-server-heartbleed-cve-2014-0160-releases/" source="CONFIRM">http://www.getchef.com/blog/2014/04/09/chef-server-heartbleed-cve-2014-0160-releases/</ref>
      <ref url="http://www.getchef.com/blog/2014/04/09/chef-server-11-0-12-release/" source="CONFIRM">http://www.getchef.com/blog/2014/04/09/chef-server-11-0-12-release/</ref>
      <ref url="http://www.f-secure.com/en/web/labs_global/fsc-2014-1" source="CONFIRM">http://www.f-secure.com/en/web/labs_global/fsc-2014-1</ref>
      <ref url="http://www.exploit-db.com/exploits/32764" source="EXPLOIT-DB">32764</ref>
      <ref url="http://www.exploit-db.com/exploits/32745" source="EXPLOIT-DB">32745</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2896" source="DEBIAN">DSA-2896</ref>
      <ref url="http://www.blackberry.com/btsc/KB35882" source="CONFIRM">http://www.blackberry.com/btsc/KB35882</ref>
      <ref url="http://www-01.ibm.com/support/docview.wss?uid=swg21670161" source="CONFIRM">http://www-01.ibm.com/support/docview.wss?uid=swg21670161</ref>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140409-heartbleed" source="CISCO">20140409 OpenSSL Heartbeat Extension Vulnerability in Multiple Cisco Products</ref>
      <ref url="http://secunia.com/advisories/57968" source="SECUNIA" adv="1">57968</ref>
      <ref url="http://secunia.com/advisories/57966" source="SECUNIA" adv="1">57966</ref>
      <ref url="http://secunia.com/advisories/57836" source="SECUNIA" adv="1">57836</ref>
      <ref url="http://secunia.com/advisories/57721" source="SECUNIA" adv="1">57721</ref>
      <ref url="http://secunia.com/advisories/57483" source="SECUNIA" adv="1">57483</ref>
      <ref url="http://secunia.com/advisories/57347" source="SECUNIA" adv="1">57347</ref>
      <ref url="http://seclists.org/fulldisclosure/2014/Apr/91" source="FULLDISC">20140408 Re: heartbleed OpenSSL bug CVE-2014-0160</ref>
      <ref url="http://seclists.org/fulldisclosure/2014/Apr/90" source="FULLDISC">20140408 heartbleed OpenSSL bug CVE-2014-0160</ref>
      <ref url="http://seclists.org/fulldisclosure/2014/Apr/190" source="FULLDISC">20140412 Re: heartbleed OpenSSL bug CVE-2014-0160</ref>
      <ref url="http://seclists.org/fulldisclosure/2014/Apr/173" source="FULLDISC">20140411 MRI Rubies may contain statically linked, vulnerable OpenSSL</ref>
      <ref url="http://seclists.org/fulldisclosure/2014/Apr/109" source="FULLDISC">20140409 Re: heartbleed OpenSSL bug CVE-2014-0160</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0396.html" source="REDHAT">RHSA-2014:0396</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0378.html" source="REDHAT">RHSA-2014:0378</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0377.html" source="REDHAT">RHSA-2014:0377</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0376.html" source="REDHAT">RHSA-2014:0376</ref>
      <ref url="http://marc.info/?l=bugtraq&amp;m=139722163017074&amp;w=2" source="HP">HPSBMU02995</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00005.html" source="SUSE">SUSE-SA:2014:002</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00004.html" source="SUSE">openSUSE-SU-2014:0492</ref>
      <ref url="http://lists.fedoraproject.org/pipermail/package-announce/2014-April/131291.html" source="FEDORA">FEDORA-2014-4910</ref>
      <ref url="http://lists.fedoraproject.org/pipermail/package-announce/2014-April/131221.html" source="FEDORA">FEDORA-2014-4879</ref>
      <ref url="http://heartbleed.com/" source="MISC">http://heartbleed.com/</ref>
      <ref url="http://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=96db9023b881d7cd9f379b0c154650d6c108e9a3" source="CONFIRM" adv="1">http://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=96db9023b881d7cd9f379b0c154650d6c108e9a3</ref>
      <ref url="http://blog.fox-it.com/2014/04/08/openssl-heartbleed-bug-live-blog/" source="MISC">http://blog.fox-it.com/2014/04/08/openssl-heartbleed-bug-live-blog/</ref>
    </refs>
    <vuln_soft>
      <prod vendor="openssl" name="openssl">
        <vers num="1.0.1" edition="beta1"/>
        <vers num="1.0.1" edition="beta2"/>
        <vers num="1.0.1" edition="beta3"/>
        <vers num="1.0.1a"/>
        <vers num="1.0.1b"/>
        <vers num="1.0.1c"/>
        <vers num="1.0.1d"/>
        <vers num="1.0.1e"/>
        <vers num="1.0.1f"/>
        <vers num="1.0.2" edition="beta1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0162" published="2014-04-27" name="CVE-2014-0162" modified="2014-04-28" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:S/C:P/I:P/A:P)" CVSS_score="6.0" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="6.8" CVSS_base_score="6.0">
    <desc>
      <descript source="cve">The Sheepdog backend in OpenStack Image Registry and Delivery Service (Glance) 2013.2 before 2013.2.4 and icehouse before icehouse-rc2 allows remote authenticated users with permission to insert or modify an image to execute arbitrary commands via a crafted location.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://launchpad.net/bugs/1298698" source="CONFIRM">https://launchpad.net/bugs/1298698</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/04/10/13" source="MLIST">[oss-security] 20140410 [OSSA 2014-012] Remote code execution in Glance Sheepdog backend (CVE-2014-0162)</ref>
    </refs>
    <vuln_soft>
      <prod vendor="openstack" name="icehouse">
        <vers num="rc-1"/>
      </prod>
      <prod vendor="openstack" name="image_registry_and_delivery_service_(glance)">
        <vers num="2013.2"/>
        <vers num="2013.2.1"/>
        <vers num="2013.2.2"/>
        <vers num="2013.2.3"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0165" published="2014-04-09" name="CVE-2014-0165" modified="2014-04-10" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:N/I:P/A:N)" CVSS_score="4.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.0" CVSS_base_score="4.0">
    <desc>
      <descript source="cve">WordPress before 3.7.2 and 3.8.x before 3.8.2 allows remote authenticated users to publish posts by leveraging the Contributor role, related to wp-admin/includes/post.php and wp-admin/includes/class-wp-posts-list-table.php.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://bugzilla.redhat.com/show_bug.cgi?id=1085866" source="CONFIRM">https://bugzilla.redhat.com/show_bug.cgi?id=1085866</ref>
      <ref url="http://core.trac.wordpress.org/changeset/27976" source="CONFIRM">http://core.trac.wordpress.org/changeset/27976</ref>
      <ref url="http://codex.wordpress.org/Version_3.8.2" source="CONFIRM" adv="1">http://codex.wordpress.org/Version_3.8.2</ref>
      <ref url="http://codex.wordpress.org/Version_3.7.2" source="CONFIRM" adv="1">http://codex.wordpress.org/Version_3.7.2</ref>
    </refs>
    <vuln_soft>
      <prod vendor="wordpress" name="wordpress">
        <vers num="0.71"/>
        <vers num="1.0"/>
        <vers num="1.0.1"/>
        <vers num="1.0.2"/>
        <vers num="1.1.1"/>
        <vers num="1.2"/>
        <vers num="1.2.1"/>
        <vers num="1.2.2"/>
        <vers num="1.2.3"/>
        <vers num="1.2.4"/>
        <vers num="1.2.5" edition="a"/>
        <vers num="1.3"/>
        <vers num="1.3.2"/>
        <vers num="1.3.3"/>
        <vers num="1.5"/>
        <vers num="1.5.1"/>
        <vers num="1.5.1.1"/>
        <vers num="1.5.1.2"/>
        <vers num="1.5.1.3"/>
        <vers num="1.5.2"/>
        <vers num="1.6.2"/>
        <vers num="2.0"/>
        <vers num="2.0.1"/>
        <vers num="2.0.10"/>
        <vers num="2.0.11"/>
        <vers num="2.0.2"/>
        <vers num="2.0.4"/>
        <vers num="2.0.5"/>
        <vers num="2.0.6"/>
        <vers num="2.0.7"/>
        <vers num="2.0.8"/>
        <vers num="2.0.9"/>
        <vers num="2.1"/>
        <vers num="2.1.1"/>
        <vers num="2.1.2"/>
        <vers num="2.1.3"/>
        <vers num="2.2"/>
        <vers num="2.2.1"/>
        <vers num="2.2.2"/>
        <vers num="2.2.3"/>
        <vers num="2.3"/>
        <vers num="2.3.1"/>
        <vers num="2.3.2"/>
        <vers num="2.3.3"/>
        <vers num="2.5"/>
        <vers num="2.5.1"/>
        <vers num="2.6"/>
        <vers num="2.6.1"/>
        <vers num="2.6.2"/>
        <vers num="2.6.3"/>
        <vers num="2.6.5"/>
        <vers num="2.7"/>
        <vers num="2.7.1"/>
        <vers num="2.8"/>
        <vers num="2.8.1"/>
        <vers num="2.8.2"/>
        <vers num="2.8.3"/>
        <vers num="2.8.4" edition="a"/>
        <vers num="2.8.5"/>
        <vers num="2.8.5.1"/>
        <vers num="2.8.5.2"/>
        <vers num="2.8.6"/>
        <vers num="2.9"/>
        <vers num="2.9.1"/>
        <vers num="2.9.1.1"/>
        <vers num="2.9.2"/>
        <vers num="3.0"/>
        <vers num="3.0.1"/>
        <vers num="3.0.2"/>
        <vers num="3.0.3"/>
        <vers num="3.0.4"/>
        <vers num="3.0.5"/>
        <vers num="3.0.6"/>
        <vers num="3.1"/>
        <vers num="3.1.1"/>
        <vers num="3.1.2"/>
        <vers num="3.1.3"/>
        <vers num="3.1.4"/>
        <vers num="3.2" edition="beta1"/>
        <vers num="3.2.1"/>
        <vers num="3.3"/>
        <vers num="3.3.1"/>
        <vers num="3.3.2"/>
        <vers num="3.3.3"/>
        <vers num="3.4.0"/>
        <vers num="3.4.1"/>
        <vers num="3.4.2"/>
        <vers num="3.5.0"/>
        <vers num="3.5.1"/>
        <vers num="3.6"/>
        <vers num="3.6.1"/>
        <vers num="3.7"/>
        <vers prev="1" num="3.7.1"/>
        <vers num="3.8"/>
        <vers num="3.8.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0166" published="2014-04-09" name="CVE-2014-0166" modified="2014-04-10" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:N)" CVSS_score="6.4" CVSS_impact_subscore="4.9" CVSS_exploit_subscore="10.0" CVSS_base_score="6.4">
    <desc>
      <descript source="cve">The wp_validate_auth_cookie function in wp-includes/pluggable.php in WordPress before 3.7.2 and 3.8.x before 3.8.2 does not properly determine the validity of authentication cookies, which makes it easier for remote attackers to obtain access via a forged cookie.</descript>
    </desc>
    <loss_types>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://bugzilla.redhat.com/show_bug.cgi?id=1085858" source="CONFIRM">https://bugzilla.redhat.com/show_bug.cgi?id=1085858</ref>
      <ref url="http://core.trac.wordpress.org/changeset/28054" source="CONFIRM">http://core.trac.wordpress.org/changeset/28054</ref>
      <ref url="http://codex.wordpress.org/Version_3.8.2" source="CONFIRM" adv="1">http://codex.wordpress.org/Version_3.8.2</ref>
      <ref url="http://codex.wordpress.org/Version_3.7.2" source="CONFIRM" adv="1">http://codex.wordpress.org/Version_3.7.2</ref>
    </refs>
    <vuln_soft>
      <prod vendor="wordpress" name="wordpress">
        <vers num="0.71"/>
        <vers num="1.0"/>
        <vers num="1.0.1"/>
        <vers num="1.0.2"/>
        <vers num="1.1.1"/>
        <vers num="1.2"/>
        <vers num="1.2.1"/>
        <vers num="1.2.2"/>
        <vers num="1.2.3"/>
        <vers num="1.2.4"/>
        <vers num="1.2.5" edition="a"/>
        <vers num="1.3"/>
        <vers num="1.3.2"/>
        <vers num="1.3.3"/>
        <vers num="1.5"/>
        <vers num="1.5.1"/>
        <vers num="1.5.1.1"/>
        <vers num="1.5.1.2"/>
        <vers num="1.5.1.3"/>
        <vers num="1.5.2"/>
        <vers num="1.6.2"/>
        <vers num="2.0"/>
        <vers num="2.0.1"/>
        <vers num="2.0.10"/>
        <vers num="2.0.11"/>
        <vers num="2.0.2"/>
        <vers num="2.0.4"/>
        <vers num="2.0.5"/>
        <vers num="2.0.6"/>
        <vers num="2.0.7"/>
        <vers num="2.0.8"/>
        <vers num="2.0.9"/>
        <vers num="2.1"/>
        <vers num="2.1.1"/>
        <vers num="2.1.2"/>
        <vers num="2.1.3"/>
        <vers num="2.2"/>
        <vers num="2.2.1"/>
        <vers num="2.2.2"/>
        <vers num="2.2.3"/>
        <vers num="2.3"/>
        <vers num="2.3.1"/>
        <vers num="2.3.2"/>
        <vers num="2.3.3"/>
        <vers num="2.5"/>
        <vers num="2.5.1"/>
        <vers num="2.6"/>
        <vers num="2.6.1"/>
        <vers num="2.6.2"/>
        <vers num="2.6.3"/>
        <vers num="2.6.5"/>
        <vers num="2.7"/>
        <vers num="2.7.1"/>
        <vers num="2.8"/>
        <vers num="2.8.1"/>
        <vers num="2.8.2"/>
        <vers num="2.8.3"/>
        <vers num="2.8.4" edition="a"/>
        <vers num="2.8.5"/>
        <vers num="2.8.5.1"/>
        <vers num="2.8.5.2"/>
        <vers num="2.8.6"/>
        <vers num="2.9"/>
        <vers num="2.9.1"/>
        <vers num="2.9.1.1"/>
        <vers num="2.9.2"/>
        <vers num="3.0"/>
        <vers num="3.0.1"/>
        <vers num="3.0.2"/>
        <vers num="3.0.3"/>
        <vers num="3.0.4"/>
        <vers num="3.0.5"/>
        <vers num="3.0.6"/>
        <vers num="3.1"/>
        <vers num="3.1.1"/>
        <vers num="3.1.2"/>
        <vers num="3.1.3"/>
        <vers num="3.1.4"/>
        <vers num="3.2" edition="beta1"/>
        <vers num="3.2.1"/>
        <vers num="3.3"/>
        <vers num="3.3.1"/>
        <vers num="3.3.2"/>
        <vers num="3.3.3"/>
        <vers num="3.4.0"/>
        <vers num="3.4.1"/>
        <vers num="3.4.2"/>
        <vers num="3.5.0"/>
        <vers num="3.5.1"/>
        <vers num="3.6"/>
        <vers num="3.6.1"/>
        <vers num="3.7"/>
        <vers prev="1" num="3.7.1"/>
        <vers num="3.8"/>
        <vers num="3.8.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0167" published="2014-04-15" name="CVE-2014-0167" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:S/C:P/I:P/A:P)" CVSS_score="6.0" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="6.8" CVSS_base_score="6.0">
    <desc>
      <descript source="cve">The Nova EC2 API security group implementation in OpenStack Compute (Nova) 2013.1 before 2013.2.4 and icehouse before icehouse-rc2 does not enforce RBAC policies for (1) add_rules, (2) remove_rules, (3) destroy, and other unspecified methods in compute/api.py when using non-default policies, which allows remote authenticated users to gain privileges via these API requests.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.openwall.com/lists/oss-security/2014/04/09/26" source="MLIST" patch="1">[oss-security] 20140409 [OSSA 2014-011] RBAC policy not properly enforced in Nova EC2 API  (CVE-2014-0167)</ref>
      <ref url="https://launchpad.net/bugs/1290537" source="CONFIRM" adv="1">https://launchpad.net/bugs/1290537</ref>
    </refs>
    <vuln_soft>
      <prod vendor="openstack" name="compute">
        <vers num="2013.1"/>
        <vers num="2013.1.1"/>
        <vers num="2013.1.2"/>
        <vers num="2013.1.3"/>
        <vers num="2013.2"/>
        <vers num="2013.2.1"/>
        <vers num="2013.2.2"/>
        <vers num="2013.2.3"/>
      </prod>
      <prod vendor="openstack" name="icehouse">
        <vers num="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0172" published="2014-04-11" name="CVE-2014-0172" modified="2014-04-14" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:P)" CVSS_score="6.8" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.6" CVSS_base_score="6.8">
    <desc>
      <descript source="cve">Integer overflow in the check_section function in dwarf_begin_elf.c in the libdw library, as used in elfutils 0.153 and possibly through 0.158 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a malformed compressed debug section in an ELF file, which triggers a heap-based buffer overflow.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://lists.fedorahosted.org/pipermail/elfutils-devel/2014-April/003921.html" source="MLIST" patch="1">[elfutils-devel] 20140409 [PATCH] CVE-2014-0172 Check for overflow before calling malloc to uncompress data.</ref>
      <ref url="https://bugzilla.redhat.com/show_bug.cgi?id=1085663" source="CONFIRM">https://bugzilla.redhat.com/show_bug.cgi?id=1085663</ref>
      <ref url="http://www.securityfocus.com/bid/66714" source="BID">66714</ref>
      <ref url="http://seclists.org/oss-sec/2014/q2/54" source="MLIST">[oss-security] 20140409 Heap-based buffer overflow in libdw/elfutils (CVE-2014-0172)</ref>
    </refs>
    <vuln_soft>
      <prod vendor="elfutils_project" name="elfutils">
        <vers num="0.153"/>
        <vers num="0.154"/>
        <vers num="0.155"/>
        <vers num="0.156"/>
        <vers num="0.157"/>
        <vers num="0.158"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0173" published="2014-04-22" name="CVE-2014-0173" modified="2014-04-22" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:N)" CVSS_score="5.8" CVSS_impact_subscore="4.9" CVSS_exploit_subscore="8.6" CVSS_base_score="5.8">
    <desc>
      <descript source="cve">The Jetpack plugin before 1.9 before 1.9.4, 2.0.x before 2.0.9, 2.1.x before 2.1.4, 2.2.x before 2.2.7, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.2, 2.6.x before 2.6.3, 2.7.x before 2.7.2, 2.8.x before 2.8.2, and 2.9.x before 2.9.3 for WordPress does not properly restrict access to the XML-RPC service, which allows remote attackers to bypass intended restrictions and publish posts via unspecified vectors.  NOTE: some of these details are obtained from third party information.</descript>
    </desc>
    <loss_types>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/92560" source="XF">jetpack-wordpress-cve20140173-sec-bypass(92560)</ref>
      <ref url="http://www.securityfocus.com/bid/66789" source="BID">66789</ref>
      <ref url="http://secunia.com/advisories/57729" source="SECUNIA" adv="1">57729</ref>
      <ref url="http://jetpack.me/2014/04/10/jetpack-security-update/" source="CONFIRM" adv="1">http://jetpack.me/2014/04/10/jetpack-security-update/</ref>
    </refs>
    <vuln_soft>
      <prod vendor="automattic" name="jetpack">
        <vers num="1.9" edition=":~~~wordpress~~"/>
        <vers num="1.9.1" edition=":~~~wordpress~~"/>
        <vers num="1.9.2" edition=":~~~wordpress~~"/>
        <vers num="2.0" edition=":~~~wordpress~~"/>
        <vers num="2.0.1" edition=":~~~wordpress~~"/>
        <vers num="2.0.2" edition=":~~~wordpress~~"/>
        <vers num="2.0.3" edition=":~~~wordpress~~"/>
        <vers num="2.0.4" edition=":~~~wordpress~~"/>
        <vers num="2.1" edition=":~~~wordpress~~"/>
        <vers num="2.1.1" edition=":~~~wordpress~~"/>
        <vers num="2.1.2" edition=":~~~wordpress~~"/>
        <vers num="2.2" edition=":~~~wordpress~~"/>
        <vers num="2.2.1" edition=":~~~wordpress~~"/>
        <vers num="2.2.2" edition=":~~~wordpress~~"/>
        <vers num="2.2.3" edition=":~~~wordpress~~"/>
        <vers num="2.2.4" edition=":~~~wordpress~~"/>
        <vers num="2.2.5" edition=":~~~wordpress~~"/>
        <vers num="2.3" edition=":~~~wordpress~~"/>
        <vers num="2.3.1" edition=":~~~wordpress~~"/>
        <vers num="2.3.2" edition=":~~~wordpress~~"/>
        <vers num="2.3.3" edition=":~~~wordpress~~"/>
        <vers num="2.3.4" edition=":~~~wordpress~~"/>
        <vers num="2.3.5" edition=":~~~wordpress~~"/>
        <vers num="2.4" edition=":~~~wordpress~~"/>
        <vers num="2.4.1" edition=":~~~wordpress~~"/>
        <vers num="2.4.2" edition=":~~~wordpress~~"/>
        <vers num="2.5" edition=":~~~wordpress~~"/>
        <vers num="2.6" edition=":~~~wordpress~~"/>
        <vers num="2.6.1" edition=":~~~wordpress~~"/>
        <vers num="2.7" edition=":~~~wordpress~~"/>
        <vers num="2.8" edition=":~~~wordpress~~"/>
        <vers num="2.9" edition=":~~~wordpress~~"/>
        <vers num="2.9.1" edition=":~~~wordpress~~"/>
        <vers num="2.9.2" edition=":~~~wordpress~~"/>
        <vers num="2.9.3" edition=":~~~wordpress~~"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-0181" published="2014-04-26" name="CVE-2014-0181" modified="2014-04-28" CVSS_version="2.0" CVSS_vector="(AV:L/AC:L/Au:N/C:N/I:P/A:N)" CVSS_score="2.1" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="3.9" CVSS_base_score="2.1">
    <desc>
      <descript source="cve">The Netlink implementation in the Linux kernel through 3.14.1 does not provide a mechanism for authorizing socket operations based on the opener of a socket, which allows local users to bypass intended access restrictions and modify network configurations by using a Netlink socket for the (1) stdout or (2) stderr of a setuid program.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="https://git.kernel.org/cgit/linux/kernel/git/davem/net.git/commit/?id=90f62cf30a78721641e08737bda787552428061e" source="CONFIRM">https://git.kernel.org/cgit/linux/kernel/git/davem/net.git/commit/?id=90f62cf30a78721641e08737bda787552428061e</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/04/23/6" source="MLIST">[oss-security] 20140423 Re: CVE-2014-0181: Linux network reconfiguration due to incorrect netlink checks</ref>
      <ref url="http://marc.info/?l=linux-netdev&amp;m=139828832919748&amp;w=2" source="MLIST">[netdev] 20140423 [PATCH 0/5]: Preventing abuse when passing file descriptors</ref>
    </refs>
    <vuln_soft>
      <prod vendor="linux" name="linux_kernel">
        <vers num="3.0" edition="rc1"/>
        <vers num="3.0" edition="rc2"/>
        <vers num="3.0" edition="rc3"/>
        <vers num="3.0" edition="rc4"/>
        <vers num="3.0" edition="rc5"/>
        <vers num="3.0" edition="rc6"/>
        <vers num="3.0" edition="rc7"/>
        <vers num="3.0.1"/>
        <vers num="3.0.10"/>
        <vers num="3.0.11"/>
        <vers num="3.0.12"/>
        <vers num="3.0.13"/>
        <vers num="3.0.14"/>
        <vers num="3.0.15"/>
        <vers num="3.0.16"/>
        <vers num="3.0.17"/>
        <vers num="3.0.18"/>
        <vers num="3.0.19"/>
        <vers num="3.0.2"/>
        <vers num="3.0.20"/>
        <vers num="3.0.21"/>
        <vers num="3.0.22"/>
        <vers num="3.0.23"/>
        <vers num="3.0.24"/>
        <vers num="3.0.25"/>
        <vers num="3.0.26"/>
        <vers num="3.0.27"/>
        <vers num="3.0.28"/>
        <vers num="3.0.29"/>
        <vers num="3.0.3"/>
        <vers num="3.0.30"/>
        <vers num="3.0.31"/>
        <vers num="3.0.32"/>
        <vers num="3.0.33"/>
        <vers num="3.0.34"/>
        <vers num="3.0.35"/>
        <vers num="3.0.36"/>
        <vers num="3.0.37"/>
        <vers num="3.0.38"/>
        <vers num="3.0.39"/>
        <vers num="3.0.4"/>
        <vers num="3.0.40"/>
        <vers num="3.0.41"/>
        <vers num="3.0.42"/>
        <vers num="3.0.43"/>
        <vers num="3.0.44"/>
        <vers num="3.0.45"/>
        <vers num="3.0.46"/>
        <vers num="3.0.47"/>
        <vers num="3.0.48"/>
        <vers num="3.0.49"/>
        <vers num="3.0.5"/>
        <vers num="3.0.50"/>
        <vers num="3.0.51"/>
        <vers num="3.0.52"/>
        <vers num="3.0.53"/>
        <vers num="3.0.54"/>
        <vers num="3.0.55"/>
        <vers num="3.0.56"/>
        <vers num="3.0.57"/>
        <vers num="3.0.58"/>
        <vers num="3.0.59"/>
        <vers num="3.0.6"/>
        <vers num="3.0.60"/>
        <vers num="3.0.61"/>
        <vers num="3.0.62"/>
        <vers num="3.0.63"/>
        <vers num="3.0.64"/>
        <vers num="3.0.65"/>
        <vers num="3.0.66"/>
        <vers num="3.0.67"/>
        <vers num="3.0.68"/>
        <vers num="3.0.7"/>
        <vers num="3.0.8"/>
        <vers num="3.0.9"/>
        <vers num="3.1" edition="rc1"/>
        <vers num="3.1" edition="rc2"/>
        <vers num="3.1" edition="rc3"/>
        <vers num="3.1" edition="rc4"/>
        <vers num="3.1.1"/>
        <vers num="3.1.10"/>
        <vers num="3.1.2"/>
        <vers num="3.1.3"/>
        <vers num="3.1.4"/>
        <vers num="3.1.5"/>
        <vers num="3.1.6"/>
        <vers num="3.1.7"/>
        <vers num="3.1.8"/>
        <vers num="3.1.9"/>
        <vers num="3.10"/>
        <vers num="3.10.1"/>
        <vers num="3.10.10"/>
        <vers num="3.10.11"/>
        <vers num="3.10.12"/>
        <vers num="3.10.13"/>
        <vers num="3.10.14"/>
        <vers num="3.10.15"/>
        <vers num="3.10.16"/>
        <vers num="3.10.17"/>
        <vers num="3.10.18"/>
        <vers num="3.10.19"/>
        <vers num="3.10.2"/>
        <vers num="3.10.20"/>
        <vers num="3.10.21"/>
        <vers num="3.10.22"/>
        <vers num="3.10.23"/>
        <vers num="3.10.24"/>
        <vers num="3.10.25"/>
        <vers num="3.10.26"/>
        <vers num="3.10.27"/>
        <vers num="3.10.28"/>
        <vers num="3.10.29"/>
        <vers num="3.10.3"/>
        <vers num="3.10.4"/>
        <vers num="3.10.5"/>
        <vers num="3.10.6"/>
        <vers num="3.10.7"/>
        <vers num="3.10.8"/>
        <vers num="3.10.9"/>
        <vers num="3.11"/>
        <vers num="3.11.1"/>
        <vers num="3.11.10"/>
        <vers num="3.11.2"/>
        <vers num="3.11.3"/>
        <vers num="3.11.4"/>
        <vers num="3.11.5"/>
        <vers num="3.11.6"/>
        <vers num="3.11.7"/>
        <vers num="3.11.8"/>
        <vers num="3.11.9"/>
        <vers num="3.12"/>
        <vers num="3.12.1"/>
        <vers num="3.12.10"/>
        <vers num="3.12.11"/>
        <vers num="3.12.12"/>
        <vers num="3.12.13"/>
        <vers num="3.12.14"/>
        <vers num="3.12.15"/>
        <vers num="3.12.16"/>
        <vers num="3.12.17"/>
        <vers num="3.12.2"/>
        <vers num="3.12.3"/>
        <vers num="3.12.4"/>
        <vers num="3.12.5"/>
        <vers num="3.12.6"/>
        <vers num="3.12.7"/>
        <vers num="3.12.8"/>
        <vers num="3.12.9"/>
        <vers num="3.13"/>
        <vers num="3.13.1"/>
        <vers num="3.13.2"/>
        <vers num="3.13.3"/>
        <vers num="3.13.4"/>
        <vers num="3.13.5"/>
        <vers num="3.13.6"/>
        <vers num="3.13.7"/>
        <vers num="3.13.8"/>
        <vers num="3.13.9"/>
        <vers prev="1" num="3.14.1"/>
        <vers num="3.2" edition="rc2"/>
        <vers num="3.2" edition="rc3"/>
        <vers num="3.2" edition="rc4"/>
        <vers num="3.2" edition="rc5"/>
        <vers num="3.2" edition="rc6"/>
        <vers num="3.2" edition="rc7"/>
        <vers num="3.2.1"/>
        <vers num="3.2.10"/>
        <vers num="3.2.11"/>
        <vers num="3.2.12"/>
        <vers num="3.2.13"/>
        <vers num="3.2.14"/>
        <vers num="3.2.15"/>
        <vers num="3.2.16"/>
        <vers num="3.2.17"/>
        <vers num="3.2.18"/>
        <vers num="3.2.19"/>
        <vers num="3.2.2"/>
        <vers num="3.2.20"/>
        <vers num="3.2.21"/>
        <vers num="3.2.22"/>
        <vers num="3.2.23"/>
        <vers num="3.2.24"/>
        <vers num="3.2.25"/>
        <vers num="3.2.26"/>
        <vers num="3.2.27"/>
        <vers num="3.2.28"/>
        <vers num="3.2.29"/>
        <vers num="3.2.3"/>
        <vers num="3.2.30"/>
        <vers num="3.2.4"/>
        <vers num="3.2.5"/>
        <vers num="3.2.6"/>
        <vers num="3.2.7"/>
        <vers num="3.2.8"/>
        <vers num="3.2.9"/>
        <vers num="3.3" edition="rc1"/>
        <vers num="3.3" edition="rc2"/>
        <vers num="3.3" edition="rc3"/>
        <vers num="3.3" edition="rc4"/>
        <vers num="3.3" edition="rc5"/>
        <vers num="3.3" edition="rc6"/>
        <vers num="3.3" edition="rc7"/>
        <vers num="3.3.1"/>
        <vers num="3.3.2"/>
        <vers num="3.3.3"/>
        <vers num="3.3.4"/>
        <vers num="3.3.5"/>
        <vers num="3.3.6"/>
        <vers num="3.3.7"/>
        <vers num="3.3.8"/>
        <vers num="3.4" edition="rc1"/>
        <vers num="3.4" edition="rc2"/>
        <vers num="3.4" edition="rc3"/>
        <vers num="3.4" edition="rc4"/>
        <vers num="3.4" edition="rc5"/>
        <vers num="3.4" edition="rc6"/>
        <vers num="3.4" edition="rc7"/>
        <vers num="3.4.1"/>
        <vers num="3.4.10"/>
        <vers num="3.4.11"/>
        <vers num="3.4.12"/>
        <vers num="3.4.13"/>
        <vers num="3.4.14"/>
        <vers num="3.4.15"/>
        <vers num="3.4.16"/>
        <vers num="3.4.17"/>
        <vers num="3.4.18"/>
        <vers num="3.4.19"/>
        <vers num="3.4.2"/>
        <vers num="3.4.20"/>
        <vers num="3.4.21"/>
        <vers num="3.4.22"/>
        <vers num="3.4.23"/>
        <vers num="3.4.24"/>
        <vers num="3.4.25"/>
        <vers num="3.4.26"/>
        <vers num="3.4.27"/>
        <vers num="3.4.28"/>
        <vers num="3.4.29"/>
        <vers num="3.4.3"/>
        <vers num="3.4.30"/>
        <vers num="3.4.31"/>
        <vers num="3.4.32"/>
        <vers num="3.4.33"/>
        <vers num="3.4.34"/>
        <vers num="3.4.35"/>
        <vers num="3.4.36"/>
        <vers num="3.4.37"/>
        <vers num="3.4.38"/>
        <vers num="3.4.39"/>
        <vers num="3.4.4"/>
        <vers num="3.4.40"/>
        <vers num="3.4.41"/>
        <vers num="3.4.42"/>
        <vers num="3.4.43"/>
        <vers num="3.4.44"/>
        <vers num="3.4.45"/>
        <vers num="3.4.46"/>
        <vers num="3.4.47"/>
        <vers num="3.4.48"/>
        <vers num="3.4.49"/>
        <vers num="3.4.5"/>
        <vers num="3.4.50"/>
        <vers num="3.4.51"/>
        <vers num="3.4.52"/>
        <vers num="3.4.53"/>
        <vers num="3.4.54"/>
        <vers num="3.4.55"/>
        <vers num="3.4.56"/>
        <vers num="3.4.57"/>
        <vers num="3.4.58"/>
        <vers num="3.4.59"/>
        <vers num="3.4.6"/>
        <vers num="3.4.60"/>
        <vers num="3.4.61"/>
        <vers num="3.4.62"/>
        <vers num="3.4.63"/>
        <vers num="3.4.64"/>
        <vers num="3.4.65"/>
        <vers num="3.4.66"/>
        <vers num="3.4.67"/>
        <vers num="3.4.68"/>
        <vers num="3.4.69"/>
        <vers num="3.4.7"/>
        <vers num="3.4.70"/>
        <vers num="3.4.71"/>
        <vers num="3.4.72"/>
        <vers num="3.4.73"/>
        <vers num="3.4.74"/>
        <vers num="3.4.75"/>
        <vers num="3.4.76"/>
        <vers num="3.4.77"/>
        <vers num="3.4.78"/>
        <vers num="3.4.79"/>
        <vers num="3.4.8"/>
        <vers num="3.4.9"/>
        <vers num="3.5.1"/>
        <vers num="3.5.2"/>
        <vers num="3.5.3"/>
        <vers num="3.5.4"/>
        <vers num="3.5.5"/>
        <vers num="3.5.6"/>
        <vers num="3.5.7"/>
        <vers num="3.6"/>
        <vers num="3.6.1"/>
        <vers num="3.6.10"/>
        <vers num="3.6.11"/>
        <vers num="3.6.2"/>
        <vers num="3.6.3"/>
        <vers num="3.6.4"/>
        <vers num="3.6.5"/>
        <vers num="3.6.6"/>
        <vers num="3.6.7"/>
        <vers num="3.6.8"/>
        <vers num="3.6.9"/>
        <vers num="3.7"/>
        <vers num="3.7.1"/>
        <vers num="3.7.10"/>
        <vers num="3.7.2"/>
        <vers num="3.7.3"/>
        <vers num="3.7.4"/>
        <vers num="3.7.5"/>
        <vers num="3.7.6"/>
        <vers num="3.7.7"/>
        <vers num="3.7.8"/>
        <vers num="3.7.9"/>
        <vers num="3.8.0"/>
        <vers num="3.8.1"/>
        <vers num="3.8.10"/>
        <vers num="3.8.11"/>
        <vers num="3.8.12"/>
        <vers num="3.8.13"/>
        <vers num="3.8.2"/>
        <vers num="3.8.3"/>
        <vers num="3.8.4"/>
        <vers num="3.8.5"/>
        <vers num="3.8.6"/>
        <vers num="3.8.7"/>
        <vers num="3.8.8"/>
        <vers num="3.8.9"/>
        <vers num="3.9" edition="rc1"/>
        <vers num="3.9" edition="rc2"/>
        <vers num="3.9" edition="rc3"/>
        <vers num="3.9" edition="rc4"/>
        <vers num="3.9" edition="rc5"/>
        <vers num="3.9" edition="rc6"/>
        <vers num="3.9" edition="rc7"/>
        <vers num="3.9.0"/>
        <vers num="3.9.1"/>
        <vers num="3.9.10"/>
        <vers num="3.9.11"/>
        <vers num="3.9.2"/>
        <vers num="3.9.3"/>
        <vers num="3.9.4"/>
        <vers num="3.9.5"/>
        <vers num="3.9.6"/>
        <vers num="3.9.7"/>
        <vers num="3.9.8"/>
        <vers num="3.9.9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0187" published="2014-04-28" name="CVE-2014-0187" modified="2014-04-29" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:C/I:C/A:C)" CVSS_score="9.0" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.0" CVSS_base_score="9.0">
    <desc>
      <descript source="cve">The openvswitch-agent process in OpenStack Neutron 2013.1 before 2013.2.4 and 2014.1 before 2014.1.1 allows remote authenticated users to bypass security group restrictions via an invalid CIDR in a security group rule, which prevents further rules from being applied.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://bugs.launchpad.net/neutron/+bug/1300785" source="CONFIRM" adv="1">https://bugs.launchpad.net/neutron/+bug/1300785</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/04/22/8" source="MLIST">[oss-security] 20140422 [OSSA 2014-014] Neutron security groups bypass through invalid CIDR (CVE-2014-0187)</ref>
    </refs>
    <vuln_soft>
      <prod vendor="openstack" name="neutron">
        <vers num="2013.1"/>
        <vers num="2013.1.1"/>
        <vers num="2013.1.2"/>
        <vers num="2013.1.3"/>
        <vers num="2013.1.4"/>
        <vers num="2013.1.5"/>
        <vers num="2013.2"/>
        <vers num="2013.2.1"/>
        <vers num="2013.2.2"/>
        <vers num="2013.2.3"/>
        <vers num="2014.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0188" published="2014-04-24" name="CVE-2014-0188" modified="2014-04-24" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">The openshift-origin-broker in Red Hat OpenShift Enterprise 2.0.5, 1.2.7, and earlier does not properly handle authentication requests from the remote-user auth plugin, which allows remote attackers to bypass authentication and impersonate arbitrary users via the X-Remote-User header in a request to a passthrough trigger.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://bugzilla.redhat.com/show_bug.cgi?id=1090120" source="CONFIRM">https://bugzilla.redhat.com/show_bug.cgi?id=1090120</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0423.html" source="REDHAT" adv="1">RHSA-2014:0423</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0422.html" source="REDHAT" adv="1">RHSA-2014:0422</ref>
    </refs>
    <vuln_soft>
      <prod vendor="redhat" name="openshift">
        <vers num="1.0" edition="-:enterprise"/>
        <vers num="1.1" edition="-:enterprise"/>
        <vers num="1.2" edition=":enterprise"/>
        <vers num="1.2.1" edition=":enterprise"/>
        <vers num="1.2.2" edition="-:enterprise"/>
        <vers num="1.2.3" edition=":enterprise"/>
        <vers num="1.2.4" edition=":enterprise"/>
        <vers num="1.2.5" edition=":enterprise"/>
        <vers num="1.2.6" edition=":enterprise"/>
        <vers prev="1" num="1.2.7" edition=":enterprise"/>
        <vers num="2.0" edition=":enterprise"/>
        <vers num="2.0.1" edition=":enterprise"/>
        <vers num="2.0.2" edition=":enterprise"/>
        <vers num="2.0.3" edition=":enterprise"/>
        <vers num="2.0.4" edition=":enterprise"/>
        <vers prev="1" num="2.0.5" edition=":enterprise"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" seq="2014-0189" published="2014-05-02" name="CVE-2014-0189" modified="2014-05-02">
    <desc>
      <descript source="cve">virt-who uses world-readable permissions for /etc/sysconfig/virt-who, which allows local users to obtain password for hypervisors by reading the file.</descript>
    </desc>
    <refs>
      <ref url="https://bugzilla.redhat.com/show_bug.cgi?id=1088732" source="CONFIRM">https://bugzilla.redhat.com/show_bug.cgi?id=1088732</ref>
      <ref url="https://bugzilla.redhat.com/show_bug.cgi?id=1081286" source="CONFIRM">https://bugzilla.redhat.com/show_bug.cgi?id=1081286</ref>
      <ref url="http://www.securityfocus.com/bid/67089" source="BID">67089</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/04/28/2" source="MLIST">[oss-security] 20140428 CVE-2014-0189: /etc/sysconfig/virt-who is world-readable (contains unencrypted passwords)</ref>
    </refs>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0235" published="2014-04-08" name="CVE-2014-0235" modified="2014-04-09" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1751 and CVE-2014-1755.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://technet.microsoft.com/security/bulletin/MS14-018" source="MS" adv="1">MS14-018</ref>
    </refs>
    <vuln_soft>
      <prod vendor="microsoft" name="internet_explorer">
        <vers num="9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0253" published="2014-02-11" name="CVE-2014-0253" modified="2014-02-12" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:P)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, 4.5, and 4.5.1 does not properly determine TCP connection states, which allows remote attackers to cause a denial of service (ASP.NET daemon hang) via crafted HTTP requests that trigger persistent resource consumption for a (1) stale or (2) closed connection, as exploited in the wild in February 2014, aka "POST Request DoS Vulnerability."</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://technet.microsoft.com/security/bulletin/MS14-009" source="MS" patch="1" adv="1">MS14-009</ref>
    </refs>
    <vuln_soft>
      <prod vendor="microsoft" name=".net_framework">
        <vers num="1.1" edition="sp1"/>
        <vers num="2.0" edition="sp2"/>
        <vers num="3.5"/>
        <vers num="3.5.1"/>
        <vers num="4.0"/>
        <vers num="4.5"/>
        <vers num="4.5.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0254" published="2014-02-11" name="CVE-2014-0254" modified="2014-02-12" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:C)" CVSS_score="7.8" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="10.0" CVSS_base_score="7.8">
    <desc>
      <descript source="cve">The IPv6 implementation in Microsoft Windows 8, Windows Server 2012, and Windows RT does not properly validate packets, which allows remote attackers to cause a denial of service (system hang) via crafted ICMPv6 Router Advertisement packets, aka "TCP/IP Version 6 (IPv6) Denial of Service Vulnerability."</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://technet.microsoft.com/security/bulletin/MS14-006" source="MS" patch="1" adv="1">MS14-006</ref>
    </refs>
    <vuln_soft>
      <prod vendor="microsoft" name="windows_8">
        <vers num="-" edition="-:x86"/>
        <vers num="-" edition="-:x64"/>
      </prod>
      <prod vendor="microsoft" name="windows_rt">
        <vers num="-"/>
      </prod>
      <prod vendor="microsoft" name="windows_server_2012">
        <vers num="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0257" published="2014-02-11" name="CVE-2014-0257" modified="2014-02-12" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, 4.5, and 4.5.1 does not properly determine whether it is safe to execute a method, which allows remote attackers to execute arbitrary code via (1) a crafted web site or (2) a crafted .NET Framework application that exposes a COM server endpoint, aka "Type Traversal Vulnerability."</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://technet.microsoft.com/security/bulletin/MS14-009" source="MS" patch="1" adv="1">MS14-009</ref>
    </refs>
    <vuln_soft>
      <prod vendor="microsoft" name=".net_framework">
        <vers num="1.0" edition="sp3"/>
        <vers num="1.1" edition="sp1"/>
        <vers num="2.0" edition="sp2"/>
        <vers num="3.5"/>
        <vers num="3.5.1"/>
        <vers num="4.0"/>
        <vers num="4.5"/>
        <vers num="4.5.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0258" published="2014-01-15" name="CVE-2014-0258" modified="2014-02-06" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">Microsoft Word 2003 SP3 and 2007 SP3, Office Compatibility Pack SP3, and Word Viewer allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Word Memory Corruption Vulnerability."</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://technet.microsoft.com/security/bulletin/MS14-001" source="MS" patch="1" adv="1">MS14-001</ref>
      <ref url="http://www.securitytracker.com/id/1029599" source="SECTRACK">1029599</ref>
      <ref url="http://www.securitytracker.com/id/1029598" source="SECTRACK">1029598</ref>
    </refs>
    <vuln_soft>
      <prod vendor="microsoft" name="office_compatibility_pack">
        <vers num="" edition="sp3"/>
      </prod>
      <prod vendor="microsoft" name="word">
        <vers num="2003" edition="sp3"/>
        <vers num="2007" edition="sp3"/>
      </prod>
      <prod vendor="microsoft" name="word_viewer">
        <vers num=""/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0259" published="2014-01-15" name="CVE-2014-0259" modified="2014-02-06" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">Microsoft Word 2007 SP3 and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Word Memory Corruption Vulnerability."</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://technet.microsoft.com/security/bulletin/MS14-001" source="MS" patch="1" adv="1">MS14-001</ref>
      <ref url="http://www.securitytracker.com/id/1029599" source="SECTRACK">1029599</ref>
      <ref url="http://www.securitytracker.com/id/1029598" source="SECTRACK">1029598</ref>
    </refs>
    <vuln_soft>
      <prod vendor="microsoft" name="office_compatibility_pack">
        <vers num="" edition="sp3"/>
      </prod>
      <prod vendor="microsoft" name="word">
        <vers num="2007" edition="sp3"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0260" published="2014-01-15" name="CVE-2014-0260" modified="2014-02-06" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">Microsoft Word 2003 SP3, 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Office Compatibility Pack SP3; Word Viewer; SharePoint Server 2010 SP1 and SP2 and 2013; Office Web Apps 2010 SP1 and SP2; and Office Web Apps Server 2013 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Word Memory Corruption Vulnerability."</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://technet.microsoft.com/security/bulletin/MS14-001" source="MS" patch="1" adv="1">MS14-001</ref>
      <ref url="http://www.securitytracker.com/id/1029599" source="SECTRACK">1029599</ref>
      <ref url="http://www.securitytracker.com/id/1029598" source="SECTRACK">1029598</ref>
    </refs>
    <vuln_soft>
      <prod vendor="microsoft" name="office_compatibility_pack">
        <vers num="" edition="sp3"/>
      </prod>
      <prod vendor="microsoft" name="office_web_apps">
        <vers num="2010" edition="sp1"/>
        <vers num="2010" edition="sp2"/>
      </prod>
      <prod vendor="microsoft" name="office_web_apps_server">
        <vers num="2013"/>
      </prod>
      <prod vendor="microsoft" name="sharepoint_server">
        <vers num="2010" edition="sp1"/>
        <vers num="2010" edition="sp2"/>
        <vers num="2013"/>
      </prod>
      <prod vendor="microsoft" name="word">
        <vers num="2003" edition="sp3"/>
        <vers num="2007" edition="sp3"/>
        <vers num="2010" edition="sp1"/>
        <vers num="2010" edition="sp2"/>
        <vers num="2013" edition="-:~-~-~rt~~"/>
      </prod>
      <prod vendor="microsoft" name="word_viewer">
        <vers num=""/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0261" published="2014-01-15" name="CVE-2014-0261" modified="2014-02-06" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:N/I:N/A:P)" CVSS_score="4.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.0" CVSS_base_score="4.0">
    <desc>
      <descript source="cve">Microsoft Dynamics AX 4.0 SP2, 2009 SP1, 2012, and 2012 R2 allows remote authenticated users to cause a denial of service (instance outage) via crafted data to an Application Object Server (AOS) instance, aka "Query Filter DoS Vulnerability."</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://technet.microsoft.com/security/bulletin/MS14-004" source="MS" patch="1" adv="1">MS14-004</ref>
      <ref url="http://www.securitytracker.com/id/1029601" source="SECTRACK">1029601</ref>
    </refs>
    <vuln_soft>
      <prod vendor="microsoft" name="dynamics_ax">
        <vers num="2009" edition="sp1"/>
        <vers num="2012" edition="r2"/>
        <vers num="4.0" edition="sp2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0262" published="2014-01-15" name="CVE-2014-0262" modified="2014-02-21" CVSS_version="2.0" CVSS_vector="(AV:L/AC:L/Au:N/C:C/I:C/A:C)" CVSS_score="7.2" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="3.9" CVSS_base_score="7.2">
    <desc>
      <descript source="cve">win32k.sys in the kernel-mode drivers in Microsoft Windows 7 SP1 and Server 2008 R2 SP1 does not properly consider thread-owned objects during the processing of window handles, which allows local users to gain privileges via a crafted application, aka "Win32k Window Handle Vulnerability."</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="http://technet.microsoft.com/security/bulletin/MS14-003" source="MS" patch="1" adv="1">MS14-003</ref>
      <ref url="http://www.securitytracker.com/id/1029600" source="SECTRACK">1029600</ref>
      <ref url="http://www.securityfocus.com/bid/64725" source="BID">64725</ref>
    </refs>
    <vuln_soft>
      <prod vendor="microsoft" name="windows_7">
        <vers num="" edition="sp1:x64"/>
        <vers num="" edition="sp1:x86"/>
      </prod>
      <prod vendor="microsoft" name="windows_server_2008">
        <vers num="r2" edition="sp1:itanium"/>
        <vers num="r2" edition="sp1:x64"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0263" published="2014-02-11" name="CVE-2014-0263" modified="2014-02-12" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">The Direct2D implementation in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code via a large 2D geometric figure that is encountered with Internet Explorer, aka "Microsoft Graphics Component Memory Corruption Vulnerability."</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://technet.microsoft.com/security/bulletin/MS14-007" source="MS" patch="1" adv="1">MS14-007</ref>
    </refs>
    <vuln_soft>
      <prod vendor="microsoft" name="windows_7">
        <vers num="" edition="sp1:x64"/>
        <vers num="" edition="sp1:x86"/>
      </prod>
      <prod vendor="microsoft" name="windows_8">
        <vers num="-" edition="-:x86"/>
        <vers num="-" edition="-:x64"/>
      </prod>
      <prod vendor="microsoft" name="windows_8.1">
        <vers num="-" edition="-:~-~-~-~x64~"/>
        <vers num="-" edition="-:~-~-~-~x86~"/>
      </prod>
      <prod vendor="microsoft" name="windows_rt">
        <vers num="-"/>
      </prod>
      <prod vendor="microsoft" name="windows_rt_8.1">
        <vers num="-"/>
      </prod>
      <prod vendor="microsoft" name="windows_server_2008">
        <vers num="r2" edition="sp1:x64"/>
      </prod>
      <prod vendor="microsoft" name="windows_server_2012">
        <vers num="-"/>
        <vers num="r2" edition="-:~-~essentials~~~"/>
        <vers num="r2" edition="-:~-~standard~~~"/>
        <vers num="r2" edition="-:~-~datacenter~~~"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0266" published="2014-02-11" name="CVE-2014-0266" modified="2014-02-12" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:N/A:N)" CVSS_score="7.1" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="8.6" CVSS_base_score="7.1">
    <desc>
      <descript source="cve">The XMLHTTP ActiveX controls in XML Core Services 3.0 in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote attackers to bypass the Same Origin Policy via a web page that is visited in Internet Explorer, aka "MSXML Information Disclosure Vulnerability."</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://technet.microsoft.com/security/bulletin/MS14-005" source="MS" patch="1" adv="1">MS14-005</ref>
    </refs>
    <vuln_soft>
      <prod vendor="microsoft" name="xml_core_services">
        <vers num="3.0"/>
      </prod>
      <prod vendor="microsoft" name="windows_7">
        <vers num="" edition="sp1:x64"/>
        <vers num="" edition="sp1:x86"/>
      </prod>
      <prod vendor="microsoft" name="windows_8">
        <vers num="-" edition="-:x86"/>
        <vers num="-" edition="-:x64"/>
      </prod>
      <prod vendor="microsoft" name="windows_8.1">
        <vers num="-" edition="-:~-~-~-~x64~"/>
        <vers num="-" edition="-:~-~-~-~x86~"/>
      </prod>
      <prod vendor="microsoft" name="windows_rt">
        <vers num="-"/>
      </prod>
      <prod vendor="microsoft" name="windows_rt_8.1">
        <vers num="-"/>
      </prod>
      <prod vendor="microsoft" name="windows_server_2003">
        <vers num="" edition="sp2:x64"/>
        <vers num="" edition="sp2:itanium"/>
      </prod>
      <prod vendor="microsoft" name="windows_server_2008">
        <vers num="" edition="sp2:x64"/>
        <vers num="" edition="sp2:x86"/>
        <vers num="" edition="sp2:itanium"/>
        <vers num="r2" edition="sp1:x64"/>
        <vers num="r2" edition="sp1:itanium"/>
      </prod>
      <prod vendor="microsoft" name="windows_server_2012">
        <vers num="-"/>
        <vers num="r2" edition="-:~-~essentials~~~"/>
        <vers num="r2" edition="-:~-~standard~~~"/>
        <vers num="r2" edition="-:~-~datacenter~~~"/>
      </prod>
      <prod vendor="microsoft" name="windows_vista">
        <vers num="" edition="sp2:x64"/>
      </prod>
      <prod vendor="microsoft" name="windows_xp">
        <vers num="" edition="sp3"/>
        <vers num="-" edition="sp2:x64"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0267" published="2014-02-11" name="CVE-2014-0267" modified="2014-02-12" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0289 and CVE-2014-0290.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://technet.microsoft.com/security/bulletin/MS14-010" source="MS" patch="1" adv="1">MS14-010</ref>
    </refs>
    <vuln_soft>
      <prod vendor="microsoft" name="internet_explorer">
        <vers num="11" edition="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0268" published="2014-02-11" name="CVE-2014-0268" modified="2014-02-12" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Microsoft Internet Explorer 8 through 11 does not properly restrict file installation and registry-key creation, which allows remote attackers to bypass the Mandatory Integrity Control protection mechanism via a crafted web site, aka "Internet Explorer Elevation of Privilege Vulnerability."</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://technet.microsoft.com/security/bulletin/MS14-010" source="MS" patch="1" adv="1">MS14-010</ref>
    </refs>
    <vuln_soft>
      <prod vendor="microsoft" name="internet_explorer">
        <vers num="10"/>
        <vers num="11" edition="-"/>
        <vers num="8"/>
        <vers num="9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0269" published="2014-02-11" name="CVE-2014-0269" modified="2014-02-12" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://technet.microsoft.com/security/bulletin/MS14-010" source="MS" patch="1" adv="1">MS14-010</ref>
    </refs>
    <vuln_soft>
      <prod vendor="microsoft" name="internet_explorer">
        <vers num="10"/>
        <vers num="6"/>
        <vers num="7"/>
        <vers num="8"/>
        <vers num="9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0270" published="2014-02-11" name="CVE-2014-0270" modified="2014-02-12" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0273, CVE-2014-0274, and CVE-2014-0288.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://technet.microsoft.com/security/bulletin/MS14-010" source="MS" patch="1" adv="1">MS14-010</ref>
    </refs>
    <vuln_soft>
      <prod vendor="microsoft" name="internet_explorer">
        <vers num="10"/>
        <vers num="11" edition="-"/>
        <vers num="9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0271" published="2014-02-11" name="CVE-2014-0271" modified="2014-02-12" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">The VBScript engine in Microsoft Internet Explorer 6 through 11, and VBScript 5.6 through 5.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "VBScript Memory Corruption Vulnerability."</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://technet.microsoft.com/security/bulletin/MS14-011" source="MS" patch="1" adv="1">MS14-011</ref>
      <ref url="http://technet.microsoft.com/security/bulletin/MS14-010" source="MS" patch="1" adv="1">MS14-010</ref>
    </refs>
    <vuln_soft>
      <prod vendor="microsoft" name="internet_explorer">
        <vers num="10"/>
        <vers num="11" edition="-"/>
        <vers num="6"/>
        <vers num="7"/>
        <vers num="8"/>
        <vers num="9"/>
      </prod>
      <prod vendor="microsoft" name="vbscript">
        <vers num="5.6"/>
        <vers num="5.7"/>
        <vers num="5.8"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0272" published="2014-02-11" name="CVE-2014-0272" modified="2014-02-12" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">Microsoft Internet Explorer 8 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://technet.microsoft.com/security/bulletin/MS14-010" source="MS" patch="1" adv="1">MS14-010</ref>
    </refs>
    <vuln_soft>
      <prod vendor="microsoft" name="internet_explorer">
        <vers num="10"/>
        <vers num="8"/>
        <vers num="9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0273" published="2014-02-11" name="CVE-2014-0273" modified="2014-02-12" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0270, CVE-2014-0274, and CVE-2014-0288.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://technet.microsoft.com/security/bulletin/MS14-010" source="MS" patch="1" adv="1">MS14-010</ref>
    </refs>
    <vuln_soft>
      <prod vendor="microsoft" name="internet_explorer">
        <vers num="10"/>
        <vers num="11" edition="-"/>
        <vers num="9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0274" published="2014-02-11" name="CVE-2014-0274" modified="2014-02-13" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0270, CVE-2014-0273, and CVE-2014-0288.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://technet.microsoft.com/security/bulletin/MS14-010" source="MS" patch="1" adv="1">MS14-010</ref>
    </refs>
    <vuln_soft>
      <prod vendor="microsoft" name="internet_explorer">
        <vers num="10"/>
        <vers num="11" edition="-"/>
        <vers num="9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0275" published="2014-02-11" name="CVE-2014-0275" modified="2014-02-12" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0285 and CVE-2014-0286.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://technet.microsoft.com/security/bulletin/MS14-010" source="MS" patch="1" adv="1">MS14-010</ref>
    </refs>
    <vuln_soft>
      <prod vendor="microsoft" name="internet_explorer">
        <vers num="10"/>
        <vers num="11" edition="-"/>
        <vers num="6"/>
        <vers num="7"/>
        <vers num="8"/>
        <vers num="9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0276" published="2014-02-11" name="CVE-2014-0276" modified="2014-02-12" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://technet.microsoft.com/security/bulletin/MS14-010" source="MS" patch="1" adv="1">MS14-010</ref>
    </refs>
    <vuln_soft>
      <prod vendor="microsoft" name="internet_explorer">
        <vers num="8"/>
        <vers num="9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0277" published="2014-02-11" name="CVE-2014-0277" modified="2014-02-13" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0278 and CVE-2014-0279.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://technet.microsoft.com/security/bulletin/MS14-010" source="MS" patch="1" adv="1">MS14-010</ref>
    </refs>
    <vuln_soft>
      <prod vendor="microsoft" name="internet_explorer">
        <vers num="8"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0278" published="2014-02-11" name="CVE-2014-0278" modified="2014-02-13" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0277 and CVE-2014-0279.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://technet.microsoft.com/security/bulletin/MS14-010" source="MS" patch="1" adv="1">MS14-010</ref>
    </refs>
    <vuln_soft>
      <prod vendor="microsoft" name="internet_explorer">
        <vers num="8"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0279" published="2014-02-11" name="CVE-2014-0279" modified="2014-02-13" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0277 and CVE-2014-0278.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://technet.microsoft.com/security/bulletin/MS14-010" source="MS" patch="1" adv="1">MS14-010</ref>
    </refs>
    <vuln_soft>
      <prod vendor="microsoft" name="internet_explorer">
        <vers num="8"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0280" published="2014-02-11" name="CVE-2014-0280" modified="2014-02-12" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://technet.microsoft.com/security/bulletin/MS14-010" source="MS" patch="1" adv="1">MS14-010</ref>
    </refs>
    <vuln_soft>
      <prod vendor="microsoft" name="internet_explorer">
        <vers num="6"/>
        <vers num="7"/>
        <vers num="8"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0281" published="2014-02-11" name="CVE-2014-0281" modified="2014-02-13" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0287.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://technet.microsoft.com/security/bulletin/MS14-010" source="MS" patch="1" adv="1">MS14-010</ref>
    </refs>
    <vuln_soft>
      <prod vendor="microsoft" name="internet_explorer">
        <vers num="10"/>
        <vers num="11" edition="-"/>
        <vers num="8"/>
        <vers num="9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0283" published="2014-02-11" name="CVE-2014-0283" modified="2014-02-13" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://technet.microsoft.com/security/bulletin/MS14-010" source="MS" patch="1" adv="1">MS14-010</ref>
    </refs>
    <vuln_soft>
      <prod vendor="microsoft" name="internet_explorer">
        <vers num="9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0284" published="2014-02-11" name="CVE-2014-0284" modified="2014-02-12" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://technet.microsoft.com/security/bulletin/MS14-010" source="MS" patch="1" adv="1">MS14-010</ref>
    </refs>
    <vuln_soft>
      <prod vendor="microsoft" name="internet_explorer">
        <vers num="10"/>
        <vers num="9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0285" published="2014-02-11" name="CVE-2014-0285" modified="2014-02-12" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0275 and CVE-2014-0286.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://technet.microsoft.com/security/bulletin/MS14-010" source="MS" patch="1" adv="1">MS14-010</ref>
    </refs>
    <vuln_soft>
      <prod vendor="microsoft" name="internet_explorer">
        <vers num="10"/>
        <vers num="11" edition="-"/>
        <vers num="6"/>
        <vers num="7"/>
        <vers num="8"/>
        <vers num="9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0286" published="2014-02-11" name="CVE-2014-0286" modified="2014-02-12" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0275 and CVE-2014-0285.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://technet.microsoft.com/security/bulletin/MS14-010" source="MS" patch="1" adv="1">MS14-010</ref>
    </refs>
    <vuln_soft>
      <prod vendor="microsoft" name="internet_explorer">
        <vers num="10"/>
        <vers num="11" edition="-"/>
        <vers num="6"/>
        <vers num="7"/>
        <vers num="8"/>
        <vers num="9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0287" published="2014-02-11" name="CVE-2014-0287" modified="2014-02-12" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0281.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://technet.microsoft.com/security/bulletin/MS14-010" source="MS" patch="1" adv="1">MS14-010</ref>
    </refs>
    <vuln_soft>
      <prod vendor="microsoft" name="internet_explorer">
        <vers num="10"/>
        <vers num="11" edition="-"/>
        <vers num="8"/>
        <vers num="9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0288" published="2014-02-11" name="CVE-2014-0288" modified="2014-02-12" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0270, CVE-2014-0273, and CVE-2014-0274.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://technet.microsoft.com/security/bulletin/MS14-010" source="MS" patch="1" adv="1">MS14-010</ref>
    </refs>
    <vuln_soft>
      <prod vendor="microsoft" name="internet_explorer">
        <vers num="10"/>
        <vers num="11" edition="-"/>
        <vers num="9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0289" published="2014-02-11" name="CVE-2014-0289" modified="2014-02-12" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0267 and CVE-2014-0290.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://technet.microsoft.com/security/bulletin/MS14-010" source="MS" patch="1" adv="1">MS14-010</ref>
    </refs>
    <vuln_soft>
      <prod vendor="microsoft" name="internet_explorer">
        <vers num="11" edition="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0290" published="2014-02-11" name="CVE-2014-0290" modified="2014-02-12" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0267 and CVE-2014-0289.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://technet.microsoft.com/security/bulletin/MS14-010" source="MS" patch="1" adv="1">MS14-010</ref>
    </refs>
    <vuln_soft>
      <prod vendor="microsoft" name="internet_explorer">
        <vers num="11" edition="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0293" published="2014-02-11" name="CVE-2014-0293" modified="2014-02-12" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:N/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Microsoft Internet Explorer 9 through 11 allows remote attackers to read content from a different (1) domain or (2) zone via a crafted web site, aka "Internet Explorer Cross-domain Information Disclosure Vulnerability."</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://technet.microsoft.com/security/bulletin/MS14-010" source="MS" patch="1" adv="1">MS14-010</ref>
    </refs>
    <vuln_soft>
      <prod vendor="microsoft" name="internet_explorer">
        <vers num="10"/>
        <vers num="11" edition="-"/>
        <vers num="9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0294" published="2014-02-11" name="CVE-2014-0294" modified="2014-02-12" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:C/I:C/A:C)" CVSS_score="10.0" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="10.0" CVSS_base_score="10.0">
    <desc>
      <descript source="cve">Microsoft Forefront Protection 2010 for Exchange Server does not properly parse e-mail content, which might allow remote attackers to execute arbitrary code via a crafted message, aka "RCE Vulnerability."</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://technet.microsoft.com/security/bulletin/MS14-008" source="MS" patch="1" adv="1">MS14-008</ref>
    </refs>
    <vuln_soft>
      <prod vendor="microsoft" name="microsoft_forefront_protection_2010">
        <vers num="-" edition=":~~~exchange_server~~"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0295" published="2014-02-11" name="CVE-2014-0295" modified="2014-02-12" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">VsaVb7rt.dll in Microsoft .NET Framework 2.0 SP2 and 3.5.1 does not implement the ASLR protection mechanism, which makes it easier for remote attackers to execute arbitrary code via a crafted web site, as exploited in the wild in February 2014, aka "VSAVB7RT ASLR Vulnerability."</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://technet.microsoft.com/security/bulletin/MS14-009" source="MS" patch="1" adv="1">MS14-009</ref>
      <ref url="http://www.greyhathacker.net/?p=585" source="MISC">http://www.greyhathacker.net/?p=585</ref>
    </refs>
    <vuln_soft>
      <prod vendor="microsoft" name=".net_framework">
        <vers num="2.0" edition="sp2"/>
        <vers num="3.5.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0297" published="2014-03-12" name="CVE-2014-0297" modified="2014-03-12" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0308, CVE-2014-0312, and CVE-2014-0324.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://technet.microsoft.com/security/bulletin/MS14-012" source="MS" patch="1" adv="1">MS14-012</ref>
    </refs>
    <vuln_soft>
      <prod vendor="microsoft" name="internet_explorer">
        <vers num="10"/>
        <vers num="11" edition="-"/>
        <vers num="8"/>
        <vers num="9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0298" published="2014-03-12" name="CVE-2014-0298" modified="2014-03-12" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://technet.microsoft.com/security/bulletin/MS14-012" source="MS" patch="1" adv="1">MS14-012</ref>
    </refs>
    <vuln_soft>
      <prod vendor="microsoft" name="internet_explorer">
        <vers num="10"/>
        <vers num="11" edition="-"/>
        <vers num="9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0299" published="2014-03-12" name="CVE-2014-0299" modified="2014-03-12" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0305 and CVE-2014-0311.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://technet.microsoft.com/security/bulletin/MS14-012" source="MS" patch="1" adv="1">MS14-012</ref>
    </refs>
    <vuln_soft>
      <prod vendor="microsoft" name="internet_explorer">
        <vers num="10"/>
        <vers num="11" edition="-"/>
        <vers num="6"/>
        <vers num="7"/>
        <vers num="8"/>
        <vers num="9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0300" published="2014-03-12" name="CVE-2014-0300" modified="2014-03-12" CVSS_version="2.0" CVSS_vector="(AV:L/AC:L/Au:N/C:C/I:C/A:C)" CVSS_score="7.2" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="3.9" CVSS_base_score="7.2">
    <desc>
      <descript source="cve">win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability."</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="http://technet.microsoft.com/security/bulletin/MS14-015" source="MS" patch="1" adv="1">MS14-015</ref>
    </refs>
    <vuln_soft>
      <prod vendor="microsoft" name="windows_7">
        <vers num="" edition="sp1:x64"/>
        <vers num="" edition="sp1:x86"/>
      </prod>
      <prod vendor="microsoft" name="windows_8">
        <vers num="-" edition="-:x86"/>
        <vers num="-" edition="-:x64"/>
      </prod>
      <prod vendor="microsoft" name="windows_8.1">
        <vers num="-" edition="-:~-~-~-~x64~"/>
        <vers num="-" edition="-:~-~-~-~x86~"/>
      </prod>
      <prod vendor="microsoft" name="windows_rt">
        <vers num="-"/>
      </prod>
      <prod vendor="microsoft" name="windows_rt_8.1">
        <vers num="-"/>
      </prod>
      <prod vendor="microsoft" name="windows_server_2003">
        <vers num="" edition="sp2:itanium"/>
        <vers num="" edition="sp2:x64"/>
      </prod>
      <prod vendor="microsoft" name="windows_server_2008">
        <vers num="" edition="sp2:x64"/>
        <vers num="" edition="sp2:x86"/>
        <vers num="" edition="sp2:itanium"/>
        <vers num="r2" edition="sp1:x64"/>
        <vers num="r2" edition="sp1:itanium"/>
      </prod>
      <prod vendor="microsoft" name="windows_server_2012">
        <vers num="-"/>
        <vers num="r2" edition="-:~-~essentials~~~"/>
        <vers num="r2" edition="-:~-~standard~~~"/>
        <vers num="r2" edition="-:~-~datacenter~~~"/>
      </prod>
      <prod vendor="microsoft" name="windows_vista">
        <vers num="" edition="sp2:x64"/>
      </prod>
      <prod vendor="microsoft" name="windows_xp">
        <vers num="" edition="sp3"/>
        <vers num="-" edition="sp2:x64"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0301" published="2014-03-12" name="CVE-2014-0301" modified="2014-03-12" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">Double free vulnerability in qedit.dll in DirectShow in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via a crafted JPEG image, aka "DirectShow Memory Corruption Vulnerability."</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://technet.microsoft.com/security/bulletin/MS14-013" source="MS" patch="1" adv="1">MS14-013</ref>
    </refs>
    <vuln_soft>
      <prod vendor="microsoft" name="windows_7">
        <vers num="" edition="sp1:x64"/>
        <vers num="" edition="sp1:x86"/>
      </prod>
      <prod vendor="microsoft" name="windows_8">
        <vers num="-" edition="-:x86"/>
        <vers num="-" edition="-:x64"/>
      </prod>
      <prod vendor="microsoft" name="windows_8.1">
        <vers num="-" edition="-:~-~-~-~x64~"/>
        <vers num="-" edition="-:~-~-~-~x86~"/>
      </prod>
      <prod vendor="microsoft" name="windows_server_2003">
        <vers num="" edition="sp2:itanium"/>
        <vers num="" edition="sp2:x64"/>
      </prod>
      <prod vendor="microsoft" name="windows_server_2008">
        <vers num="" edition="sp2:x64"/>
        <vers num="" edition="sp2:x86"/>
        <vers num="" edition="sp2:itanium"/>
        <vers num="r2" edition="sp1:x64"/>
      </prod>
      <prod vendor="microsoft" name="windows_server_2012">
        <vers num="-"/>
        <vers num="r2" edition="-:~-~essentials~~~"/>
        <vers num="r2" edition="-:~-~standard~~~"/>
        <vers num="r2" edition="-:~-~datacenter~~~"/>
      </prod>
      <prod vendor="microsoft" name="windows_vista">
        <vers num="" edition="sp2:x64"/>
      </prod>
      <prod vendor="microsoft" name="windows_xp">
        <vers num="" edition="sp3"/>
        <vers num="-" edition="sp2:x64"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0302" published="2014-03-12" name="CVE-2014-0302" modified="2014-03-12" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0303.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://technet.microsoft.com/security/bulletin/MS14-012" source="MS" patch="1" adv="1">MS14-012</ref>
    </refs>
    <vuln_soft>
      <prod vendor="microsoft" name="internet_explorer">
        <vers num="6"/>
        <vers num="7"/>
        <vers num="8"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0303" published="2014-03-12" name="CVE-2014-0303" modified="2014-03-12" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0302.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://technet.microsoft.com/security/bulletin/MS14-012" source="MS" patch="1" adv="1">MS14-012</ref>
    </refs>
    <vuln_soft>
      <prod vendor="microsoft" name="internet_explorer">
        <vers num="6"/>
        <vers num="7"/>
        <vers num="8"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0304" published="2014-03-12" name="CVE-2014-0304" modified="2014-03-12" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://technet.microsoft.com/security/bulletin/MS14-012" source="MS" patch="1" adv="1">MS14-012</ref>
    </refs>
    <vuln_soft>
      <prod vendor="microsoft" name="internet_explorer">
        <vers num="11" edition="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0305" published="2014-03-12" name="CVE-2014-0305" modified="2014-03-12" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0299 and CVE-2014-0311.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://technet.microsoft.com/security/bulletin/MS14-012" source="MS" patch="1" adv="1">MS14-012</ref>
    </refs>
    <vuln_soft>
      <prod vendor="microsoft" name="internet_explorer">
        <vers num="10"/>
        <vers num="11" edition="-"/>
        <vers num="6"/>
        <vers num="7"/>
        <vers num="8"/>
        <vers num="9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0306" published="2014-03-12" name="CVE-2014-0306" modified="2014-03-12" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://technet.microsoft.com/security/bulletin/MS14-012" source="MS" patch="1" adv="1">MS14-012</ref>
    </refs>
    <vuln_soft>
      <prod vendor="microsoft" name="internet_explorer">
        <vers num="8"/>
        <vers num="9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0307" published="2014-03-12" name="CVE-2014-0307" modified="2014-03-26" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">Use-after-free vulnerability in Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a certain sequence of manipulations of a TextRange element, aka "Internet Explorer Memory Corruption Vulnerability."</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://technet.microsoft.com/security/bulletin/MS14-012" source="MS" patch="1" adv="1">MS14-012</ref>
      <ref url="http://www.exploit-db.com/exploits/32438" source="EXPLOIT-DB">32438</ref>
    </refs>
    <vuln_soft>
      <prod vendor="microsoft" name="internet_explorer">
        <vers num="9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0308" published="2014-03-12" name="CVE-2014-0308" modified="2014-03-12" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0297, CVE-2014-0312, and CVE-2014-0324.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://technet.microsoft.com/security/bulletin/MS14-012" source="MS" patch="1" adv="1">MS14-012</ref>
    </refs>
    <vuln_soft>
      <prod vendor="microsoft" name="internet_explorer">
        <vers num="10"/>
        <vers num="11" edition="-"/>
        <vers num="8"/>
        <vers num="9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0309" published="2014-03-12" name="CVE-2014-0309" modified="2014-03-12" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">Microsoft Internet Explorer 8 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://technet.microsoft.com/security/bulletin/MS14-012" source="MS" patch="1" adv="1">MS14-012</ref>
    </refs>
    <vuln_soft>
      <prod vendor="microsoft" name="internet_explorer">
        <vers num="10"/>
        <vers num="8"/>
        <vers num="9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0311" published="2014-03-12" name="CVE-2014-0311" modified="2014-03-12" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0299 and CVE-2014-0305.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://technet.microsoft.com/security/bulletin/MS14-012" source="MS" patch="1" adv="1">MS14-012</ref>
    </refs>
    <vuln_soft>
      <prod vendor="microsoft" name="internet_explorer">
        <vers num="10"/>
        <vers num="11" edition="-"/>
        <vers num="6"/>
        <vers num="7"/>
        <vers num="8"/>
        <vers num="9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0312" published="2014-03-12" name="CVE-2014-0312" modified="2014-03-12" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0297, CVE-2014-0308, and CVE-2014-0324.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://technet.microsoft.com/security/bulletin/MS14-012" source="MS" patch="1" adv="1">MS14-012</ref>
    </refs>
    <vuln_soft>
      <prod vendor="microsoft" name="internet_explorer">
        <vers num="10"/>
        <vers num="11" edition="-"/>
        <vers num="8"/>
        <vers num="9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0313" published="2014-03-12" name="CVE-2014-0313" modified="2014-03-12" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0321.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://technet.microsoft.com/security/bulletin/MS14-012" source="MS" patch="1" adv="1">MS14-012</ref>
    </refs>
    <vuln_soft>
      <prod vendor="microsoft" name="internet_explorer">
        <vers num="10"/>
        <vers num="11" edition="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0314" published="2014-03-12" name="CVE-2014-0314" modified="2014-03-12" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://technet.microsoft.com/security/bulletin/MS14-012" source="MS" patch="1" adv="1">MS14-012</ref>
    </refs>
    <vuln_soft>
      <prod vendor="microsoft" name="internet_explorer">
        <vers num="10"/>
        <vers num="9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0315" published="2014-04-08" name="CVE-2014-0315" modified="2014-04-09" CVSS_version="2.0" CVSS_vector="(AV:L/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="6.9" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="3.4" CVSS_base_score="6.9">
    <desc>
      <descript source="cve">Untrusted search path vulnerability in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a Trojan horse cmd.exe file in the current working directory, as demonstrated by a directory that contains a .bat or .cmd file, aka "Windows File Handling Vulnerability."</descript>
      <descript source="nvd">Per: http://cwe.mitre.org/data/definitions/426.html "CWE-426: Untrusted Search Path"</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="http://technet.microsoft.com/security/bulletin/MS14-019" source="MS" adv="1">MS14-019</ref>
      <ref url="http://blogs.technet.com/b/srd/archive/2014/04/08/ms14-019-fixing-a-binary-hijacking-via-cmd-or-bat-file.aspx" source="CONFIRM">http://blogs.technet.com/b/srd/archive/2014/04/08/ms14-019-fixing-a-binary-hijacking-via-cmd-or-bat-file.aspx</ref>
    </refs>
    <vuln_soft>
      <prod vendor="microsoft" name="windows_7">
        <vers num="" edition="sp1:x64"/>
        <vers num="" edition="sp1:x86"/>
      </prod>
      <prod vendor="microsoft" name="windows_8">
        <vers num="-" edition="-:x86"/>
        <vers num="-" edition="-:x64"/>
      </prod>
      <prod vendor="microsoft" name="windows_8.1">
        <vers num="-" edition="-:~-~-~-~x64~"/>
        <vers num="-" edition="-:~-~-~-~x86~"/>
      </prod>
      <prod vendor="microsoft" name="windows_rt">
        <vers num="-"/>
      </prod>
      <prod vendor="microsoft" name="windows_rt_8.1">
        <vers num="-"/>
      </prod>
      <prod vendor="microsoft" name="windows_server_2003">
        <vers num="" edition="sp2:itanium"/>
        <vers num="" edition="sp2:x64"/>
      </prod>
      <prod vendor="microsoft" name="windows_server_2008">
        <vers num="" edition="sp2:x64"/>
        <vers num="" edition="sp2:x86"/>
        <vers num="" edition="sp2:itanium"/>
        <vers num="r2" edition="sp1:x64"/>
        <vers num="r2" edition="sp1:itanium"/>
      </prod>
      <prod vendor="microsoft" name="windows_server_2012">
        <vers num="-"/>
        <vers num="r2" edition="-:~-~essentials~~~"/>
        <vers num="r2" edition="-:~-~standard~~~"/>
        <vers num="r2" edition="-:~-~datacenter~~~"/>
      </prod>
      <prod vendor="microsoft" name="windows_vista">
        <vers num="" edition="sp2:x64"/>
      </prod>
      <prod vendor="microsoft" name="windows_xp">
        <vers num="" edition="sp3"/>
        <vers num="-" edition="sp2:x64"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0317" published="2014-03-12" name="CVE-2014-0317" modified="2014-03-12" CVSS_version="2.0" CVSS_vector="(AV:N/AC:H/Au:N/C:N/I:C/A:N)" CVSS_score="5.4" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="4.9" CVSS_base_score="5.4">
    <desc>
      <descript source="cve">The Security Account Manager Remote (SAMR) protocol implementation in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows Server 2012 Gold and R2 does not properly determine the user-lockout state, which makes it easier for remote attackers to bypass the account lockout policy and obtain access via a brute-force attack, aka "SAMR Security Feature Bypass Vulnerability."</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://technet.microsoft.com/security/bulletin/MS14-016" source="MS" patch="1" adv="1">MS14-016</ref>
    </refs>
    <vuln_soft>
      <prod vendor="microsoft" name="windows_server_2003">
        <vers num="" edition="sp2:itanium"/>
        <vers num="" edition="sp2:x64"/>
      </prod>
      <prod vendor="microsoft" name="windows_server_2008">
        <vers num="" edition="sp2:x64"/>
        <vers num="" edition="sp2:x86"/>
        <vers num="r2" edition="sp1:x64"/>
      </prod>
      <prod vendor="microsoft" name="windows_server_2012">
        <vers num="-"/>
        <vers num="r2" edition="-:~-~essentials~~~"/>
        <vers num="r2" edition="-:~-~standard~~~"/>
        <vers num="r2" edition="-:~-~datacenter~~~"/>
      </prod>
      <prod vendor="microsoft" name="windows_vista">
        <vers num="" edition="sp2:x64"/>
      </prod>
      <prod vendor="microsoft" name="windows_xp">
        <vers num="" edition="sp3"/>
        <vers num="-" edition="sp2:x64"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0319" published="2014-03-12" name="CVE-2014-0319" modified="2014-03-12" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:C/A:N)" CVSS_score="7.1" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="8.6" CVSS_base_score="7.1">
    <desc>
      <descript source="cve">Microsoft Silverlight 5 before 5.1.30214.0 and Silverlight 5 Developer Runtime before 5.1.30214.0 allow attackers to bypass the DEP and ASLR protection mechanisms via unspecified vectors, aka "Silverlight DEP/ASLR Bypass Vulnerability."</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://technet.microsoft.com/security/bulletin/MS14-014" source="MS" patch="1" adv="1">MS14-014</ref>
    </refs>
    <vuln_soft>
      <prod vendor="microsoft" name="silverlight">
        <vers num="5.0.60401.0"/>
        <vers num="5.0.60818.0" edition="rc"/>
        <vers num="5.0.61118.0"/>
        <vers num="5.1.10411.0"/>
        <vers num="5.1.20125.0"/>
        <vers num="5.1.20513.0"/>
        <vers num="5.1.20913.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0321" published="2014-03-12" name="CVE-2014-0321" modified="2014-03-12" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0313.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://technet.microsoft.com/security/bulletin/MS14-012" source="MS" patch="1" adv="1">MS14-012</ref>
    </refs>
    <vuln_soft>
      <prod vendor="microsoft" name="internet_explorer">
        <vers num="10"/>
        <vers num="11" edition="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0322" published="2014-02-14" name="CVE-2014-0322" modified="2014-03-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">Use-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code via vectors involving crafted JavaScript code, as exploited in the wild in January and February 2014.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://www.kb.cert.org/vuls/id/732479" source="CERT-VN">VU#732479</ref>
      <ref url="https://www.dropbox.com/s/pyxjgycmudirbqe/CVE-2014-0322.zip" source="MISC">https://www.dropbox.com/s/pyxjgycmudirbqe/CVE-2014-0322.zip</ref>
      <ref url="http://www.fireeye.com/blog/uncategorized/2014/02/operation-snowman-deputydog-actor-compromises-us-veterans-of-foreign-wars-website.html" source="MISC">http://www.fireeye.com/blog/uncategorized/2014/02/operation-snowman-deputydog-actor-compromises-us-veterans-of-foreign-wars-website.html</ref>
      <ref url="http://www.fireeye.com/blog/technical/cyber-exploits/2014/02/new-ie-zero-day-found-in-watering-hole-attack-2.html" source="MISC">http://www.fireeye.com/blog/technical/cyber-exploits/2014/02/new-ie-zero-day-found-in-watering-hole-attack-2.html</ref>
      <ref url="http://twitter.com/nanoc0re/statuses/434251658344673281" source="MISC">http://twitter.com/nanoc0re/statuses/434251658344673281</ref>
      <ref url="http://technet.microsoft.com/security/bulletin/MS14-012" source="MS">MS14-012</ref>
      <ref url="http://technet.microsoft.com/security/advisory/2934088" source="CONFIRM">http://technet.microsoft.com/security/advisory/2934088</ref>
      <ref url="http://community.websense.com/blogs/securitylabs/archive/2014/02/13/msie-0-day-exploit-cve-2014-0322-possibly-targeting-french-aerospace-organization.aspx" source="MISC">http://community.websense.com/blogs/securitylabs/archive/2014/02/13/msie-0-day-exploit-cve-2014-0322-possibly-targeting-french-aerospace-organization.aspx</ref>
    </refs>
    <vuln_soft>
      <prod vendor="microsoft" name="internet_explorer">
        <vers num="10"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0323" published="2014-03-12" name="CVE-2014-0323" modified="2014-03-12" CVSS_version="2.0" CVSS_vector="(AV:L/AC:L/Au:N/C:C/I:N/A:C)" CVSS_score="6.6" CVSS_impact_subscore="9.2" CVSS_exploit_subscore="3.9" CVSS_base_score="6.6">
    <desc>
      <descript source="cve">win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to obtain sensitive information from kernel memory or cause a denial of service (system hang) via a crafted application, aka "Win32k Information Disclosure Vulnerability."</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="http://technet.microsoft.com/security/bulletin/MS14-015" source="MS" patch="1" adv="1">MS14-015</ref>
    </refs>
    <vuln_soft>
      <prod vendor="microsoft" name="windows_7">
        <vers num="" edition="sp1:x64"/>
        <vers num="" edition="sp1:x86"/>
      </prod>
      <prod vendor="microsoft" name="windows_8">
        <vers num="-" edition="-:x86"/>
        <vers num="-" edition="-:x64"/>
      </prod>
      <prod vendor="microsoft" name="windows_8.1">
        <vers num="-" edition="-:~-~-~-~x64~"/>
        <vers num="-" edition="-:~-~-~-~x86~"/>
      </prod>
      <prod vendor="microsoft" name="windows_rt">
        <vers num="-"/>
      </prod>
      <prod vendor="microsoft" name="windows_rt_8.1">
        <vers num="-"/>
      </prod>
      <prod vendor="microsoft" name="windows_server_2003">
        <vers num="" edition="sp2:itanium"/>
        <vers num="" edition="sp2:x64"/>
      </prod>
      <prod vendor="microsoft" name="windows_server_2008">
        <vers num="" edition="sp2:x64"/>
        <vers num="" edition="sp2:x86"/>
        <vers num="" edition="sp2:itanium"/>
        <vers num="r2" edition="sp1:x64"/>
        <vers num="r2" edition="sp1:itanium"/>
      </prod>
      <prod vendor="microsoft" name="windows_server_2012">
        <vers num="-"/>
        <vers num="r2" edition="-:~-~essentials~~~"/>
        <vers num="r2" edition="-:~-~standard~~~"/>
        <vers num="r2" edition="-:~-~datacenter~~~"/>
      </prod>
      <prod vendor="microsoft" name="windows_vista">
        <vers num="" edition="sp2:x64"/>
      </prod>
      <prod vendor="microsoft" name="windows_xp">
        <vers num="" edition="sp3"/>
        <vers num="-" edition="sp2:x64"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0324" published="2014-03-12" name="CVE-2014-0324" modified="2014-03-12" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0297, CVE-2014-0308, and CVE-2014-0312.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://technet.microsoft.com/security/bulletin/MS14-012" source="MS" patch="1" adv="1">MS14-012</ref>
    </refs>
    <vuln_soft>
      <prod vendor="microsoft" name="internet_explorer">
        <vers num="10"/>
        <vers num="11" edition="-"/>
        <vers num="8"/>
        <vers num="9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0329" published="2014-02-04" name="CVE-2014-0329" modified="2014-03-13" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">The TELNET service on the ZTE ZXV10 W300 router 2.1.0 has a hardcoded password ending with airocon for the admin account, which allows remote attackers to obtain administrative access by leveraging knowledge of the MAC address characters present at the beginning of the password.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.kb.cert.org/vuls/id/228886" source="CERT-VN">VU#228886</ref>
      <ref url="http://xforce.iss.net/xforce/xfdb/90958" source="XF">zxv10-w300-cve20140329-sec-bypass(90958)</ref>
      <ref url="http://www.securityfocus.com/bid/65310" source="BID">65310</ref>
      <ref url="http://packetstormsecurity.com/files/125142/ZTE-ZXV10-W300-Hardcoded-Credentials.html" source="MISC">http://packetstormsecurity.com/files/125142/ZTE-ZXV10-W300-Hardcoded-Credentials.html</ref>
      <ref url="http://osvdb.org/102816" source="OSVDB">102816</ref>
      <ref url="http://blog.alguien.at/2014/02/hackeando-el-router-zte-zxv10-w300-v21.html" source="MISC">http://blog.alguien.at/2014/02/hackeando-el-router-zte-zxv10-w300-v21.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="zte" name="zxv10_w300">
        <vers num="2.1.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0330" published="2014-02-06" name="CVE-2014-0330" modified="2014-02-07" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in adminui/user_list.php on the Dell KACE K1000 management appliance 5.5.90545 allows remote attackers to inject arbitrary web script or HTML via the LABEL_ID parameter.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://www.kb.cert.org/vuls/id/813382" source="CERT-VN">VU#813382</ref>
    </refs>
    <vuln_soft>
      <prod vendor="dell" name="kace_k1000_systems_management_appliance_software">
        <vers num="5.5.90545"/>
      </prod>
      <prod vendor="dell" name="kace_k1000_systems_management_appliance">
        <vers num="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0331" published="2014-04-10" name="CVE-2014-0331" modified="2014-04-11" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in the web administration interface in FortiADC with firmware before 3.2.1 allows remote attackers to inject arbitrary web script or HTML via the locale parameter to gui_partA/.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://www.fortiguard.com/advisory/FG-IR-14-004" source="CONFIRM" adv="1">http://www.fortiguard.com/advisory/FG-IR-14-004</ref>
      <ref url="http://seclists.org/fulldisclosure/2014/Apr/53" source="FULLDISC">20140403 XSS Reflected vulnerabilities in OS of FortiADC v3.2 (CVE-2014-0331)</ref>
    </refs>
    <vuln_soft>
      <prod vendor="fortinet" name="fortiadc-1000e">
        <vers num="-"/>
      </prod>
      <prod vendor="fortinet" name="fortiadc-1500d">
        <vers num="-"/>
      </prod>
      <prod vendor="fortinet" name="fortiadc-2000d">
        <vers num="-"/>
      </prod>
      <prod vendor="fortinet" name="fortiadc-200d">
        <vers num="-"/>
      </prod>
      <prod vendor="fortinet" name="fortiadc-300e">
        <vers num="-"/>
      </prod>
      <prod vendor="fortinet" name="fortiadc-4000d">
        <vers num="-"/>
      </prod>
      <prod vendor="fortinet" name="fortiadc-400e">
        <vers num="-"/>
      </prod>
      <prod vendor="fortinet" name="fortiadc-600e">
        <vers num="-"/>
      </prod>
      <prod vendor="fortinet" name="fortiadc_firmware">
        <vers prev="1" num="3.2.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0332" published="2014-02-14" name="CVE-2014-0332" modified="2014-03-05" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in mainPage in Dell SonicWALL GMS before 7.1 SP2, SonicWALL Analyzer before 7.1 SP2, and SonicWALL UMA E5000 before 7.1 SP2 might allow remote attackers to inject arbitrary web script or HTML via the node_id parameter in a ScreenDisplayManager genNetwork action.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://www.kb.cert.org/vuls/id/727318" source="CERT-VN">VU#727318</ref>
      <ref url="http://xforce.iss.net/xforce/xfdb/91062" source="XF">sonicwall-cve20140332-nodeid-xss(91062)</ref>
      <ref url="http://www.sonicwall.com/us/shared/download/Support_Bulletin_GMS_Vulnerability_XSS_Resolved_in_7.1_SP2_and_7.2.pdf" source="CONFIRM">http://www.sonicwall.com/us/shared/download/Support_Bulletin_GMS_Vulnerability_XSS_Resolved_in_7.1_SP2_and_7.2.pdf</ref>
    </refs>
    <vuln_soft>
      <prod vendor="dell" name="sonicwall_analyzer">
        <vers num="7.0"/>
        <vers prev="1" num="7.1" edition="sp1"/>
      </prod>
      <prod vendor="dell" name="sonicwall_global_management_system">
        <vers num="7.0"/>
        <vers prev="1" num="7.1" edition="sp1"/>
      </prod>
      <prod vendor="dell" name="sonicwall_universal_management_appliance_e5000">
        <vers prev="1" num="7.0" edition="sp1"/>
        <vers num="7.1" edition="sp1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0333" published="2014-02-27" name="CVE-2014-0333" modified="2014-03-26" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:P)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">The png_push_read_chunk function in pngpread.c in the progressive decoder in libpng 1.6.x through 1.6.9 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via an IDAT chunk with a length of zero.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.kb.cert.org/vuls/id/684412" source="CERT-VN" patch="1">VU#684412</ref>
      <ref url="ftp://ftp.simplesystems.org/pub/png/src/libpng16/patch-libpng16-vu684412.diff" source="CONFIRM" patch="1">ftp://ftp.simplesystems.org/pub/png/src/libpng16/patch-libpng16-vu684412.diff</ref>
      <ref url="https://sourceforge.net/projects/libpng/files/libpng16/patch-libpng16-vu684412.diff" source="CONFIRM">https://sourceforge.net/projects/libpng/files/libpng16/patch-libpng16-vu684412.diff</ref>
      <ref url="http://lists.opensuse.org/opensuse-updates/2014-03/msg00029.html" source="SUSE">openSUSE-SU-2014:0358</ref>
    </refs>
    <vuln_soft>
      <prod vendor="libpng" name="libpng">
        <vers num="1.6.0" edition="beta"/>
        <vers num="1.6.1" edition="beta"/>
        <vers num="1.6.2" edition="beta"/>
        <vers num="1.6.3" edition="beta"/>
        <vers num="1.6.4" edition="beta"/>
        <vers num="1.6.5"/>
        <vers num="1.6.6"/>
        <vers num="1.6.7" edition="beta"/>
        <vers num="1.6.8" edition="beta"/>
        <vers num="1.6.9" edition="beta"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-0334" published="2014-03-02" name="CVE-2014-0334" modified="2014-03-03" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:S/C:N/I:P/A:N)" CVSS_score="3.5" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="6.8" CVSS_base_score="3.5">
    <desc>
      <descript source="cve">Multiple cross-site scripting (XSS) vulnerabilities in CMS Made Simple allow remote authenticated users to inject arbitrary web script or HTML via (1) the group parameter to admin/addgroup.php, (2) the htmlblob parameter to admin/addhtmlblob.php, the (3) title or (4) url parameter to admin/addbookmark.php, (5) the stylesheet_name parameter to admin/copystylesheet.php, (6) the template_name parameter to admin/copytemplate.php, the (7) title or (8) url parameter to admin/editbookmark.php, (9) the template parameter to admin/listtemplates.php, or (10) the css_name parameter to admin/listcss.php, a different issue than CVE-2014-2092.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://www.kb.cert.org/vuls/id/526062" source="CERT-VN">VU#526062</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cmsmadesimple" name="cms_made_simple">
        <vers num=""/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0335" published="2014-03-06" name="CVE-2014-0335" modified="2014-03-07" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Multiple cross-site scripting (XSS) vulnerabilities in the web client in Serena Dimensions CM 12.2 build 7.199.0 allow remote attackers to inject arbitrary web script or HTML via the (1) DB_CONN, (2) DB_NAME, (3) DM_HOST, (4) MAN_DB_NAME, (5) framecmd, (6) identifier, (7) merant.adm.adapters.AdmDialogPropertyMgr, (8) nav_frame, (9) nav_jsp, (10) target_frame, (11) id, or (12) type parameter to the dimensions/ URI.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://www.kb.cert.org/vuls/id/823452" source="CERT-VN">VU#823452</ref>
    </refs>
    <vuln_soft>
      <prod vendor="serena" name="dimensions_cm">
        <vers num="12.2" edition="build7.199.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0336" published="2014-03-06" name="CVE-2014-0336" modified="2014-03-07" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:P)" CVSS_score="6.8" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.6" CVSS_base_score="6.8">
    <desc>
      <descript source="cve">Cross-site request forgery (CSRF) vulnerability in the web client in Serena Dimensions CM 12.2 build 7.199.0 allows remote attackers to hijack the authentication of administrators for requests that use the user_new_master parameter to the adminconsole/ URI.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://www.kb.cert.org/vuls/id/823452" source="CERT-VN">VU#823452</ref>
    </refs>
    <vuln_soft>
      <prod vendor="serena" name="dimensions_cm">
        <vers num="12.2" edition="build7.199.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0337" published="2014-04-05" name="CVE-2014-0337" modified="2014-04-07" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in the web interface on Huawei Echo Life HG8247 routers with software before V100R006C00SPC127 allows remote attackers to inject arbitrary web script or HTML via an invalid TELNET connection attempt with a crafted username that is not properly handled during construction of the "failed log-in attempts over telnet" log view.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://www.kb.cert.org/vuls/id/917700" source="CERT-VN">VU#917700</ref>
    </refs>
    <vuln_soft>
      <prod vendor="huawei" name="echo_life">
        <vers num="hg8247"/>
      </prod>
      <prod vendor="huawei" name="echo_life_hg8247_firmware">
        <vers num="v1r006c00s120"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0338" published="2014-03-16" name="CVE-2014-0338" modified="2014-03-17" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Multiple cross-site scripting (XSS) vulnerabilities in the firewall policy management pages in WatchGuard Fireware XTM before 11.8.3 allow remote attackers to inject arbitrary web script or HTML via the pol_name parameter.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://www.kb.cert.org/vuls/id/807134" source="CERT-VN">VU#807134</ref>
      <ref url="http://watchguardsecuritycenter.com/2014/03/13/fireware-xtm-11-8-3-update-corrects-xss-flaw/" source="CONFIRM" adv="1">http://watchguardsecuritycenter.com/2014/03/13/fireware-xtm-11-8-3-update-corrects-xss-flaw/</ref>
    </refs>
    <vuln_soft>
      <prod vendor="watchguard" name="fireware">
        <vers num="11.6"/>
        <vers num="11.6.1"/>
        <vers num="11.6.3"/>
        <vers num="11.6.5"/>
        <vers num="11.6.6"/>
        <vers num="11.7"/>
        <vers num="11.7.2"/>
        <vers num="11.7.3"/>
        <vers num="11.7.4"/>
        <vers num="11.8"/>
        <vers prev="1" num="11.8.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0339" published="2014-03-16" name="CVE-2014-0339" modified="2014-03-17" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in view.cgi in Webmin before 1.680 allows remote attackers to inject arbitrary web script or HTML via the search parameter.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://www.kb.cert.org/vuls/id/381692" source="CERT-VN">VU#381692</ref>
      <ref url="http://www.webmin.com/changes.html" source="CONFIRM">http://www.webmin.com/changes.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="webmin" name="webmin">
        <vers num="1.600"/>
        <vers num="1.610"/>
        <vers num="1.620"/>
        <vers num="1.630"/>
        <vers num="1.640"/>
        <vers num="1.650"/>
        <vers num="1.660"/>
        <vers prev="1" num="1.670"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-0341" published="2014-04-15" name="CVE-2014-0341" modified="2014-04-15" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:S/C:N/I:P/A:N)" CVSS_score="3.5" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="6.8" CVSS_base_score="3.5">
    <desc>
      <descript source="cve">Multiple cross-site scripting (XSS) vulnerabilities in PivotX before 2.3.9 allow remote authenticated users to inject arbitrary web script or HTML via the title field to (1) templates_internal/pages.tpl, (2) templates_internal/home.tpl, or (3) templates_internal/entries.tpl; (4) an event field to objects.php; or the (5) email or (6) nickname field to pages.php, related to templates_internal/users.tpl.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://www.kb.cert.org/vuls/id/901156" source="CERT-VN">VU#901156</ref>
      <ref url="http://sourceforge.net/p/pivot-weblog/code/4349/" source="CONFIRM" patch="1">http://sourceforge.net/p/pivot-weblog/code/4349/</ref>
      <ref url="http://sourceforge.net/p/pivot-weblog/code/4345/" source="CONFIRM" patch="1">http://sourceforge.net/p/pivot-weblog/code/4345/</ref>
      <ref url="http://pivotx.net/page/security" source="CONFIRM" adv="1">http://pivotx.net/page/security</ref>
      <ref url="http://blog.pivotx.net/archive/2014/03/03/pivotx-239-released" source="CONFIRM">http://blog.pivotx.net/archive/2014/03/03/pivotx-239-released</ref>
    </refs>
    <vuln_soft>
      <prod vendor="pivotx" name="pivotx">
        <vers num="2.1.0"/>
        <vers num="2.1.1"/>
        <vers num="2.1.2"/>
        <vers num="2.2.0" edition="b1"/>
        <vers num="2.2.0" edition="b2"/>
        <vers num="2.2.0" edition="rc"/>
        <vers num="2.2.1"/>
        <vers num="2.2.2"/>
        <vers num="2.2.3"/>
        <vers num="2.2.5"/>
        <vers num="2.3.0"/>
        <vers num="2.3.2"/>
        <vers num="2.3.3"/>
        <vers num="2.3.5"/>
        <vers num="2.3.6"/>
        <vers num="2.3.7"/>
        <vers prev="1" num="2.3.8"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0342" published="2014-04-15" name="CVE-2014-0342" modified="2014-04-15" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">Multiple unrestricted file upload vulnerabilities in fileupload.php in PivotX before 2.3.9 allow remote authenticated users to execute arbitrary PHP code by uploading a file with a (1) .php or (2) .php# extension, and then accessing it via unspecified vectors.</descript>
      <descript source="nvd">Per: http://cwe.mitre.org/data/definitions/434.html

"CWE-434: Unrestricted Upload of File with Dangerous Type"</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.kb.cert.org/vuls/id/901156" source="CERT-VN">VU#901156</ref>
      <ref url="http://sourceforge.net/p/pivot-weblog/code/4347/" source="CONFIRM">http://sourceforge.net/p/pivot-weblog/code/4347/</ref>
      <ref url="http://pivotx.net/page/security" source="CONFIRM">http://pivotx.net/page/security</ref>
      <ref url="http://blog.pivotx.net/archive/2014/03/03/pivotx-239-released" source="CONFIRM">http://blog.pivotx.net/archive/2014/03/03/pivotx-239-released</ref>
    </refs>
    <vuln_soft>
      <prod vendor="pivotx" name="pivotx">
        <vers num="2.1.0"/>
        <vers num="2.1.1"/>
        <vers num="2.1.2"/>
        <vers num="2.2.0" edition="b1"/>
        <vers num="2.2.0" edition="b2"/>
        <vers num="2.2.0" edition="rc"/>
        <vers num="2.2.1"/>
        <vers num="2.2.2"/>
        <vers num="2.2.3"/>
        <vers num="2.2.5"/>
        <vers num="2.3.0"/>
        <vers num="2.3.2"/>
        <vers num="2.3.3"/>
        <vers num="2.3.5"/>
        <vers num="2.3.6"/>
        <vers num="2.3.7"/>
        <vers prev="1" num="2.3.8"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0343" published="2014-03-25" name="CVE-2014-0343" modified="2014-03-26" CVSS_version="2.0" CVSS_vector="(AV:A/AC:M/Au:S/C:P/I:P/A:P)" CVSS_score="4.9" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="4.4" CVSS_base_score="4.9">
    <desc>
      <descript source="cve">The web interface on Virtual Access GW6110A routers with software 9.00 before 9.09.27, 9.50 before 9.50.21, and 10.00 before 10.00.21 allows remote authenticated users to gain privileges via a modified JavaScript variable.</descript>
    </desc>
    <impacts>
      <impact source="nvd">Per: http://cwe.mitre.org/data/definitions/472.html

"CWE-472: External Control of Assumed-Immutable Web Parameter"</impact>
    </impacts>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <local_network/>
    </range>
    <refs>
      <ref url="http://www.kb.cert.org/vuls/id/213046" source="CERT-VN">VU#213046</ref>
    </refs>
    <vuln_soft>
      <prod vendor="virtualaccess" name="gw6110a">
        <vers num="-"/>
      </prod>
      <prod vendor="virtualaccess" name="gw6110a_firmware">
        <vers num="10.00"/>
        <vers num="9.00"/>
        <vers num="9.50"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0344" published="2014-03-29" name="CVE-2014-0344" modified="2014-03-31" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:P/I:P/A:P)" CVSS_score="6.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.0" CVSS_base_score="6.5">
    <desc>
      <descript source="cve">Properties.do in ZOHO ManageEngine OpStor before build 8500 does not properly check privilege levels, which allows remote authenticated users to obtain Admin access by using the name parameter in conjunction with a true value of the edit parameter.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.kb.cert.org/vuls/id/140886" source="CERT-VN">VU#140886</ref>
    </refs>
    <vuln_soft>
      <prod vendor="zohocorp" name="manageengine_opstor">
        <vers prev="1" num="8.3"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" seq="2014-0346" reject="1" published="2014-04-07" name="CVE-2014-0346" modified="2014-04-07">
    <desc>
      <descript source="cve">** REJECT **  DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2014-0160.  Reason: This candidate is a reservation duplicate of CVE-2014-0160.  Notes: All CVE users should reference CVE-2014-0160 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage.</descript>
    </desc>
    <refs/>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-0347" published="2014-04-12" name="CVE-2014-0347" modified="2014-04-14" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:S/C:P/I:N/A:N)" CVSS_score="3.5" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="6.8" CVSS_base_score="3.5">
    <desc>
      <descript source="cve">The Settings module in Websense Triton Unified Security Center 7.7.3 before Hotfix 31, Web Filter 7.7.3 before Hotfix 31, Web Security 7.7.3 before Hotfix 31, Web Security Gateway 7.7.3 before Hotfix 31, and Web Security Gateway Anywhere 7.7.3 before Hotfix 31 allows remote authenticated users to read cleartext passwords by replacing type="password" with type="text" in an INPUT element in the (1) Log Database or (2) User Directories component.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.kb.cert.org/vuls/id/568252" source="CERT-VN">VU#568252</ref>
      <ref url="https://www.websense.com/content/mywebsense-hotfixes.aspx?patchid=894&amp;prodidx=20&amp;osidx=0&amp;intidx=0&amp;versionidx=0" source="CONFIRM">https://www.websense.com/content/mywebsense-hotfixes.aspx?patchid=894&amp;prodidx=20&amp;osidx=0&amp;intidx=0&amp;versionidx=0</ref>
    </refs>
    <vuln_soft>
      <prod vendor="websense" name="triton_unified_security_center">
        <vers num="7.7.3"/>
      </prod>
      <prod vendor="websense" name="triton_web_filter">
        <vers num="7.7.3"/>
      </prod>
      <prod vendor="websense" name="triton_web_security">
        <vers num="7.7.3"/>
      </prod>
      <prod vendor="websense" name="triton_web_security_gateway">
        <vers num="7.7.3"/>
      </prod>
      <prod vendor="websense" name="triton_web_security_gateway_anywhere">
        <vers num="7.7.3"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-0348" published="2014-04-15" name="CVE-2014-0348" modified="2014-04-15" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:S/C:P/I:N/A:N)" CVSS_score="3.5" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="6.8" CVSS_base_score="3.5">
    <desc>
      <descript source="cve">The Artiva Agency Single Sign-On (SSO) implementation in Artiva Workstation 1.3.x before 1.3.9, Artiva Rm 3.1 MR7, Artiva Healthcare 5.2 MR5, and Artiva Architect 3.2 MR5, when the domain-name option is enabled, allows remote attackers to login to arbitrary domain accounts by using the corresponding username on a Windows client machine.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.kb.cert.org/vuls/id/215284" source="CERT-VN">VU#215284</ref>
    </refs>
    <vuln_soft>
      <prod vendor="ontariosystems" name="artiva_architect">
        <vers num="3.2" edition="mr5"/>
      </prod>
      <prod vendor="ontariosystems" name="artiva_healthcare">
        <vers num="5.2" edition="mr5"/>
      </prod>
      <prod vendor="ontariosystems" name="artiva_rm">
        <vers num="3.1" edition="mr7"/>
      </prod>
      <prod vendor="ontariosystems" name="artiva_workstation">
        <vers num="1.3.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0349" published="2014-04-12" name="CVE-2014-0349" modified="2014-04-14" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:C/I:C/A:C)" CVSS_score="10.0" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="10.0" CVSS_base_score="10.0">
    <desc>
      <descript source="cve">Multiple unspecified vulnerabilities in J2k-Codec allow remote attackers to execute arbitrary code via a crafted JPEG 2000 file.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.kb.cert.org/vuls/id/345337" source="CERT-VN">VU#345337</ref>
    </refs>
    <vuln_soft>
      <prod vendor="j2k-codec" name="j2k-codec">
        <vers num="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0350" published="2014-04-25" name="CVE-2014-0350" modified="2014-04-28" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:N)" CVSS_score="6.4" CVSS_impact_subscore="4.9" CVSS_exploit_subscore="10.0" CVSS_base_score="6.4">
    <desc>
      <descript source="cve">The Poco::Net::X509Certificate::verify method in the NetSSL library in POCO C++ Libraries before 1.4.6p4 allows man-in-the-middle attackers to spoof SSL servers via crafted DNS PTR records that are requested during comparison of a server name to a wildcard domain name in an X.509 certificate.</descript>
    </desc>
    <loss_types>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.kb.cert.org/vuls/id/118748" source="CERT-VN">VU#118748</ref>
      <ref url="https://raw.githubusercontent.com/pocoproject/poco/poco-1.4.6p4-release/CHANGELOG" source="CONFIRM">https://raw.githubusercontent.com/pocoproject/poco/poco-1.4.6p4-release/CHANGELOG</ref>
    </refs>
    <vuln_soft>
      <prod vendor="pocoproject" name="poco_c++_libraries">
        <vers num="1.4.5"/>
        <vers prev="1" num="1.4.6" edition="-"/>
        <vers prev="1" num="1.4.6" edition="p1"/>
        <vers prev="1" num="1.4.6" edition="p2"/>
        <vers prev="1" num="1.4.6" edition="p3"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0353" published="2014-04-15" name="CVE-2014-0353" modified="2014-04-15" CVSS_version="2.0" CVSS_vector="(AV:A/AC:L/Au:N/C:C/I:N/A:N)" CVSS_score="6.1" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="6.5" CVSS_base_score="6.1">
    <desc>
      <descript source="cve">The ZyXEL Wireless N300 NetUSB NBG-419N router with firmware 1.00(BFQ.6)C0 allows remote attackers to bypass authentication by using %2F sequences in place of / (slash) characters.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <local_network/>
    </range>
    <refs>
      <ref url="http://www.kb.cert.org/vuls/id/939260" source="CERT-VN">VU#939260</ref>
    </refs>
    <vuln_soft>
      <prod vendor="zyxel" name="n300_netusb_nbg-419n">
        <vers num="-"/>
      </prod>
      <prod vendor="zyxel" name="n300_netusb_nbg-419n_firmware">
        <vers num="1.00(bfq_6)c0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0354" published="2014-04-15" name="CVE-2014-0354" modified="2014-04-15" CVSS_version="2.0" CVSS_vector="(AV:A/AC:L/Au:N/C:C/I:C/A:N)" CVSS_score="7.8" CVSS_impact_subscore="9.2" CVSS_exploit_subscore="6.5" CVSS_base_score="7.8">
    <desc>
      <descript source="cve">The ZyXEL Wireless N300 NetUSB NBG-419N router with firmware 1.00(BFQ.6)C0 has a hardcoded password of qweasdzxc for an unspecified account, which allows remote attackers to obtain index.asp login access via an HTTP request.</descript>
    </desc>
    <loss_types>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <local_network/>
    </range>
    <refs>
      <ref url="http://www.kb.cert.org/vuls/id/939260" source="CERT-VN">VU#939260</ref>
    </refs>
    <vuln_soft>
      <prod vendor="zyxel" name="n300_netusb_nbg-419n">
        <vers num="-"/>
      </prod>
      <prod vendor="zyxel" name="n300_netusb_nbg-419n_firmware">
        <vers num="1.00(bfq_6)c0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0355" published="2014-04-15" name="CVE-2014-0355" modified="2014-04-15" CVSS_version="2.0" CVSS_vector="(AV:A/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="7.9" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="5.5" CVSS_base_score="7.9">
    <desc>
      <descript source="cve">Multiple stack-based buffer overflows on the ZyXEL Wireless N300 NetUSB NBG-419N router with firmware 1.00(BFQ.6)C0 allow man-in-the-middle attackers to execute arbitrary code via (1) a long temp attribute in a yweather:condition element in a forecastrss file that is processed by the checkWeather function; the (2) WeatherCity or (3) WeatherDegree variable to the detectWeather function; unspecified input to the (4) UpnpAddRunRLQoS, (5) UpnpDeleteRunRLQoS, or (6) UpnpDeletePortCheckType function; or (7) the SET COUNTRY udps command.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <local_network/>
    </range>
    <refs>
      <ref url="http://www.kb.cert.org/vuls/id/939260" source="CERT-VN">VU#939260</ref>
    </refs>
    <vuln_soft>
      <prod vendor="zyxel" name="n300_netusb_nbg-419n">
        <vers num="-"/>
      </prod>
      <prod vendor="zyxel" name="n300_netusb_nbg-419n_firmware">
        <vers num="1.00(bfq_6)c0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0356" published="2014-04-15" name="CVE-2014-0356" modified="2014-04-15" CVSS_version="2.0" CVSS_vector="(AV:A/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="7.9" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="5.5" CVSS_base_score="7.9">
    <desc>
      <descript source="cve">The ZyXEL Wireless N300 NetUSB NBG-419N router with firmware 1.00(BFQ.6)C0 allows remote attackers to execute arbitrary code via shell metacharacters in input to the (1) detectWeather, (2) set_language, (3) SystemCommand, or (4) NTPSyncWithHost function in management.c, or a (5) SET COUNTRY, (6) SET WLAN SSID, (7) SET WLAN CHANNEL, (8) SET WLAN STATUS, or (9) SET WLAN COUNTRY udps command.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <local_network/>
    </range>
    <refs>
      <ref url="http://www.kb.cert.org/vuls/id/939260" source="CERT-VN">VU#939260</ref>
    </refs>
    <vuln_soft>
      <prod vendor="zyxel" name="n300_netusb_nbg-419n">
        <vers num="-"/>
      </prod>
      <prod vendor="zyxel" name="n300_netusb_nbg-419n_firmware">
        <vers num="1.00(bfq_6)c0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0357" published="2014-04-15" name="CVE-2014-0357" modified="2014-04-15" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:N/A:N)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">Amtelco miSecureMessages allows remote attackers to read the messages of arbitrary users via an XML request containing a valid license key and a modified contactID value, as demonstrated by a request from the iOS or Android application.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.kb.cert.org/vuls/id/251628" source="CERT-VN">VU#251628</ref>
    </refs>
    <vuln_soft>
      <prod vendor="amtelco" name="misecuremessages">
        <vers num="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0358" published="2014-04-15" name="CVE-2014-0358" modified="2014-04-15" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:C/I:N/A:N)" CVSS_score="7.8" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="10.0" CVSS_base_score="7.8">
    <desc>
      <descript source="cve">Multiple directory traversal vulnerabilities in Xangati XSR before 11 and XNR before 7 allow remote attackers to read arbitrary files via a .. (dot dot) in (1) the file parameter in a getUpgradeStatus action to servlet/MGConfigData, (2) the download parameter in a download action to servlet/MGConfigData, (3) the download parameter in a port_svc action to servlet/MGConfigData, (4) the file parameter in a getfile action to servlet/Installer, or (5) the binfile parameter to servlet/MGConfigData.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.kb.cert.org/vuls/id/657622" source="CERT-VN">VU#657622</ref>
    </refs>
    <vuln_soft>
      <prod vendor="xangati" name="xangati_software_release">
        <vers num="-"/>
      </prod>
      <prod vendor="xangati" name="xangati_xnr">
        <vers num="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0359" published="2014-04-15" name="CVE-2014-0359" modified="2014-04-15" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:C/I:C/A:C)" CVSS_score="9.0" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.0" CVSS_base_score="9.0">
    <desc>
      <descript source="cve">Xangati XSR before 11 and XNR before 7 allows remote attackers to execute arbitrary commands via shell metacharacters in a gui_input_test.pl params parameter to servlet/Installer.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.kb.cert.org/vuls/id/657622" source="CERT-VN">VU#657622</ref>
    </refs>
    <vuln_soft>
      <prod vendor="xangati" name="xangati_software_release">
        <vers num="-"/>
      </prod>
      <prod vendor="xangati" name="xangati_xnr">
        <vers num="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" seq="2014-0360" reject="1" published="2014-04-23" name="CVE-2014-0360" modified="2014-04-23">
    <desc>
      <descript source="cve">** REJECT **  DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2014-2741.  Reason: This candidate is a duplicate of CVE-2014-2741.  Notes: All CVE users should reference CVE-2014-2741 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage.</descript>
    </desc>
    <refs/>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-0361" published="2014-04-21" name="CVE-2014-0361" modified="2014-04-22" CVSS_version="2.0" CVSS_vector="(AV:L/AC:M/Au:S/C:P/I:P/A:N)" CVSS_score="3.0" CVSS_impact_subscore="4.9" CVSS_exploit_subscore="2.7" CVSS_base_score="3.0">
    <desc>
      <descript source="cve">The default configuration of IBM 4690 OS, as used in Toshiba Global Commerce Solutions 4690 POS and other products, hashes passwords with the ADXCRYPT algorithm, which makes it easier for context-dependent attackers to obtain sensitive information via a brute-force attack against an ADXCSOUF.DAT file.</descript>
    </desc>
    <loss_types>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="http://www.kb.cert.org/vuls/id/622950" source="CERT-VN">VU#622950</ref>
      <ref url="http://www-01.ibm.com/support/docview.wss?uid=pos1R1005054" source="CONFIRM" adv="1">http://www-01.ibm.com/support/docview.wss?uid=pos1R1005054</ref>
    </refs>
    <vuln_soft>
      <prod vendor="toshibacommerce" name="4690_point_of_sale_operating_system">
        <vers num="6.2"/>
        <vers num="6.3"/>
        <vers num="6.4"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0363" published="2014-04-30" name="CVE-2014-0363" modified="2014-04-30" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:N)" CVSS_score="5.8" CVSS_impact_subscore="4.9" CVSS_exploit_subscore="8.6" CVSS_base_score="5.8">
    <desc>
      <descript source="cve">The ServerTrustManager component in the Ignite Realtime Smack XMPP API before 4.0.0-rc1 does not verify basicConstraints and nameConstraints in X.509 certificate chains from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate chain.</descript>
      <descript source="nvd">Per: http://cwe.mitre.org/data/definitions/358.html

"CWE-358: Improperly Implemented Security Check for Standard"</descript>
    </desc>
    <loss_types>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.kb.cert.org/vuls/id/489228" source="CERT-VN">VU#489228</ref>
      <ref url="http://issues.igniterealtime.org/browse/SMACK-410" source="CONFIRM">http://issues.igniterealtime.org/browse/SMACK-410</ref>
      <ref url="http://community.igniterealtime.org/blogs/ignite/2014/04/17/asmack-400-rc1-has-been-released" source="CONFIRM">http://community.igniterealtime.org/blogs/ignite/2014/04/17/asmack-400-rc1-has-been-released</ref>
    </refs>
    <vuln_soft>
      <prod vendor="igniterealtime" name="smack">
        <vers num="2.2.0"/>
        <vers num="2.2.1"/>
        <vers num="3.0.0"/>
        <vers num="3.0.1"/>
        <vers num="3.0.2"/>
        <vers num="3.0.3"/>
        <vers num="3.1.0"/>
        <vers num="3.2.0"/>
        <vers num="3.2.1"/>
        <vers num="3.2.2"/>
        <vers num="3.3.0"/>
        <vers num="3.3.1"/>
        <vers num="3.4.0"/>
        <vers prev="1" num="4.0.0" edition="snapshot-2014-02-16"/>
        <vers prev="1" num="4.0.0" edition="snapshot-2014-02-18"/>
        <vers prev="1" num="4.0.0" edition="snapshot-2014-02-19"/>
        <vers prev="1" num="4.0.0" edition="snapshot-2014-02-20"/>
        <vers prev="1" num="4.0.0" edition="snapshot-2014-02-21"/>
        <vers prev="1" num="4.0.0" edition="snapshot-2014-02-23"/>
        <vers prev="1" num="4.0.0" edition="snapshot-2014-03-02"/>
        <vers prev="1" num="4.0.0" edition="snapshot-2014-03-03"/>
        <vers prev="1" num="4.0.0" edition="snapshot-2014-03-10"/>
        <vers prev="1" num="4.0.0" edition="snapshot-2014-03-11"/>
        <vers prev="1" num="4.0.0" edition="snapshot-2014-03-12"/>
        <vers prev="1" num="4.0.0" edition="snapshot-2014-03-13"/>
        <vers prev="1" num="4.0.0" edition="snapshot-2014-03-16"/>
        <vers prev="1" num="4.0.0" edition="snapshot-2014-03-18"/>
        <vers prev="1" num="4.0.0" edition="snapshot-2014-03-21"/>
        <vers prev="1" num="4.0.0" edition="snapshot-2014-03-25"/>
        <vers prev="1" num="4.0.0" edition="snapshot-2014-03-26"/>
        <vers prev="1" num="4.0.0" edition="snapshot-2014-03-29"/>
        <vers prev="1" num="4.0.0" edition="snapshot-2014-04-06"/>
        <vers prev="1" num="4.0.0" edition="snapshot-2014-04-09"/>
        <vers prev="1" num="4.0.0" edition="snapshot-2014-04-13"/>
        <vers prev="1" num="4.0.0" edition="snapshot-2014-04-15"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0364" published="2014-04-30" name="CVE-2014-0364" modified="2014-04-30" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:P/A:N)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">The ParseRoster component in the Ignite Realtime Smack XMPP API before 4.0.0-rc1 does not verify the from attribute of a roster-query IQ stanza, which allows remote attackers to spoof IQ responses via a crafted attribute.</descript>
      <descript source="nvd">Per: http://cwe.mitre.org/data/definitions/345.html

"CWE-345: Insufficient Verification of Data Authenticity"</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.kb.cert.org/vuls/id/489228" source="CERT-VN">VU#489228</ref>
      <ref url="http://community.igniterealtime.org/blogs/ignite/2014/04/17/asmack-400-rc1-has-been-released" source="CONFIRM">http://community.igniterealtime.org/blogs/ignite/2014/04/17/asmack-400-rc1-has-been-released</ref>
    </refs>
    <vuln_soft>
      <prod vendor="igniterealtime" name="smack">
        <vers num="2.2.0"/>
        <vers num="2.2.1"/>
        <vers num="3.0.0"/>
        <vers num="3.0.1"/>
        <vers num="3.0.2"/>
        <vers num="3.0.3"/>
        <vers num="3.1.0"/>
        <vers num="3.2.0"/>
        <vers num="3.2.1"/>
        <vers num="3.2.2"/>
        <vers num="3.3.0"/>
        <vers num="3.3.1"/>
        <vers num="3.4.0"/>
        <vers prev="1" num="4.0.0" edition="snapshot-2014-02-16"/>
        <vers prev="1" num="4.0.0" edition="snapshot-2014-02-18"/>
        <vers prev="1" num="4.0.0" edition="snapshot-2014-02-19"/>
        <vers prev="1" num="4.0.0" edition="snapshot-2014-02-20"/>
        <vers prev="1" num="4.0.0" edition="snapshot-2014-02-21"/>
        <vers prev="1" num="4.0.0" edition="snapshot-2014-02-23"/>
        <vers prev="1" num="4.0.0" edition="snapshot-2014-03-02"/>
        <vers prev="1" num="4.0.0" edition="snapshot-2014-03-03"/>
        <vers prev="1" num="4.0.0" edition="snapshot-2014-03-10"/>
        <vers prev="1" num="4.0.0" edition="snapshot-2014-03-11"/>
        <vers prev="1" num="4.0.0" edition="snapshot-2014-03-12"/>
        <vers prev="1" num="4.0.0" edition="snapshot-2014-03-13"/>
        <vers prev="1" num="4.0.0" edition="snapshot-2014-03-16"/>
        <vers prev="1" num="4.0.0" edition="snapshot-2014-03-18"/>
        <vers prev="1" num="4.0.0" edition="snapshot-2014-03-21"/>
        <vers prev="1" num="4.0.0" edition="snapshot-2014-03-25"/>
        <vers prev="1" num="4.0.0" edition="snapshot-2014-03-26"/>
        <vers prev="1" num="4.0.0" edition="snapshot-2014-03-29"/>
        <vers prev="1" num="4.0.0" edition="snapshot-2014-04-06"/>
        <vers prev="1" num="4.0.0" edition="snapshot-2014-04-09"/>
        <vers prev="1" num="4.0.0" edition="snapshot-2014-04-13"/>
        <vers prev="1" num="4.0.0" edition="snapshot-2014-04-15"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0366" published="2014-01-15" name="CVE-2014-0366" modified="2014-02-06" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:P/I:N/A:N)" CVSS_score="4.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.0" CVSS_base_score="4.0">
    <desc>
      <descript source="cve">Unspecified vulnerability in the Oracle Applications Framework component in Oracle E-Business Suite 11.5.10.2, 12.0.6, 12.1.3, and 12.2.2 allows remote authenticated users to affect confidentiality via unknown vectors related to Attachments.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.securitytracker.com/id/1029619" source="SECTRACK">1029619</ref>
      <ref url="http://www.securityfocus.com/bid/64828" source="BID">64828</ref>
      <ref url="http://www.securityfocus.com/bid/64758" source="BID">64758</ref>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html</ref>
      <ref url="http://secunia.com/advisories/56471" source="SECUNIA">56471</ref>
      <ref url="http://osvdb.org/102090" source="OSVDB">102090</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="e-business_suite">
        <vers num="11.5.10.2"/>
        <vers num="12.0.6"/>
        <vers num="12.1.3"/>
        <vers num="12.2.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0367" published="2014-01-15" name="CVE-2014-0367" modified="2014-02-06" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:P/I:P/A:N)" CVSS_score="5.5" CVSS_impact_subscore="4.9" CVSS_exploit_subscore="8.0" CVSS_base_score="5.5">
    <desc>
      <descript source="cve">Unspecified vulnerability in the Hyperion Essbase Administration Services component in Oracle Hyperion 11.1.2.1, 11.1.2.2, and 11.1.2.3 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Admin Console.</descript>
    </desc>
    <loss_types>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.securityfocus.com/bid/64814" source="BID">64814</ref>
      <ref url="http://www.securityfocus.com/bid/64758" source="BID">64758</ref>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html</ref>
      <ref url="http://secunia.com/advisories/56469" source="SECUNIA">56469</ref>
      <ref url="http://osvdb.org/102114" source="OSVDB">102114</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="hyperion">
        <vers num="11.1.2.1"/>
        <vers num="11.1.2.2"/>
        <vers num="11.1.2.3"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0368" published="2014-01-15" name="CVE-2014-0368" modified="2014-04-01" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:N/A:N)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45, and Java SE Embedded 7u45, allows remote attackers to affect confidentiality via unknown vectors related to Networking.  NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that the issue is related to incorrect permission checks when listening on a socket, which allows attackers to escape the sandbox.</descript>
      <descript source="nvd">Per: http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html

"Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets."</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://bugzilla.redhat.com/show_bug.cgi?id=1052919" source="CONFIRM">https://bugzilla.redhat.com/show_bug.cgi?id=1052919</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2124-1" source="UBUNTU">USN-2124-1</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2089-1" source="UBUNTU">USN-2089-1</ref>
      <ref url="http://www.securitytracker.com/id/1029608" source="SECTRACK">1029608</ref>
      <ref url="http://www.securityfocus.com/bid/64930" source="BID">64930</ref>
      <ref url="http://www.securityfocus.com/bid/64758" source="BID">64758</ref>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html</ref>
      <ref url="http://secunia.com/advisories/56535" source="SECUNIA">56535</ref>
      <ref url="http://secunia.com/advisories/56486" source="SECUNIA">56486</ref>
      <ref url="http://secunia.com/advisories/56485" source="SECUNIA">56485</ref>
      <ref url="http://secunia.com/advisories/56432" source="SECUNIA">56432</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0136.html" source="REDHAT">RHSA-2014:0136</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0135.html" source="REDHAT">RHSA-2014:0135</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0134.html" source="REDHAT">RHSA-2014:0134</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0097.html" source="REDHAT">RHSA-2014:0097</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0030.html" source="REDHAT">RHSA-2014:0030</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0027.html" source="REDHAT">RHSA-2014:0027</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0026.html" source="REDHAT">RHSA-2014:0026</ref>
      <ref url="http://marc.info/?l=bugtraq&amp;m=139402749111889&amp;w=2" source="HP">SSRT101455</ref>
      <ref url="http://marc.info/?l=bugtraq&amp;m=139402749111889&amp;w=2" source="HP">HPSBUX02973</ref>
      <ref url="http://marc.info/?l=bugtraq&amp;m=139402697611681&amp;w=2" source="HP">HPSBUX02972</ref>
      <ref url="http://marc.info/?l=bugtraq&amp;m=139402697611681&amp;w=2" source="HP">SSRT101454</ref>
      <ref url="http://lists.opensuse.org/opensuse-updates/2014-02/msg00000.html" source="SUSE">openSUSE-SU-2014:0180</ref>
      <ref url="http://lists.opensuse.org/opensuse-updates/2014-01/msg00107.html" source="SUSE">openSUSE-SU-2014:0177</ref>
      <ref url="http://lists.opensuse.org/opensuse-updates/2014-01/msg00105.html" source="SUSE">openSUSE-SU-2014:0174</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00024.html" source="SUSE">SUSE-SU-2014:0451</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00012.html" source="SUSE">SUSE-SU-2014:0266</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00009.html" source="SUSE">SUSE-SU-2014:0246</ref>
      <ref url="http://hg.openjdk.java.net/jdk7u/jdk7u/jdk/rev/e6160aedadd5" source="MISC">http://hg.openjdk.java.net/jdk7u/jdk7u/jdk/rev/e6160aedadd5</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="jdk">
        <vers num="1.5.0" edition="update_55"/>
        <vers num="1.6.0" edition="update_65"/>
        <vers num="1.7.0" edition="update_45"/>
      </prod>
      <prod vendor="oracle" name="jre">
        <vers num="1.5.0" edition="update_55"/>
        <vers num="1.6.0" edition="update_65"/>
        <vers num="1.7.0" edition="update_45"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0369" published="2014-01-15" name="CVE-2014-0369" modified="2014-02-06" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:N/A:N)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">Unspecified vulnerability in the Siebel Core - EAI component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect confidentiality via unknown vectors related to Java Integration.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.securitytracker.com/id/1029622" source="SECTRACK">1029622</ref>
      <ref url="http://www.securityfocus.com/bid/64832" source="BID">64832</ref>
      <ref url="http://www.securityfocus.com/bid/64758" source="BID">64758</ref>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html</ref>
      <ref url="http://secunia.com/advisories/56480" source="SECUNIA">56480</ref>
      <ref url="http://osvdb.org/102107" source="OSVDB">102107</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="siebel_crm">
        <vers num="8.1.1"/>
        <vers num="8.2.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-0370" published="2014-01-15" name="CVE-2014-0370" modified="2014-02-06" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:M/C:N/I:N/A:P)" CVSS_score="2.8" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="5.5" CVSS_base_score="2.8">
    <desc>
      <descript source="cve">Unspecified vulnerability in the Siebel Life Sciences component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect availability via unknown vectors related to Clinical Trip Report.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.securitytracker.com/id/1029622" source="SECTRACK">1029622</ref>
      <ref url="http://www.securityfocus.com/bid/64837" source="BID">64837</ref>
      <ref url="http://www.securityfocus.com/bid/64758" source="BID">64758</ref>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html</ref>
      <ref url="http://secunia.com/advisories/56481" source="SECUNIA">56481</ref>
      <ref url="http://osvdb.org/102108" source="OSVDB">102108</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="siebel_crm">
        <vers num="8.1.1"/>
        <vers num="8.2.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-0371" published="2014-01-15" name="CVE-2014-0371" modified="2014-02-06" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:S/C:N/I:P/A:N)" CVSS_score="3.5" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="6.8" CVSS_base_score="3.5">
    <desc>
      <descript source="cve">Unspecified vulnerability in the Oracle Demantra Demand Management component in Oracle Supply Chain Products Suite 7.2.0.3 SQL-Server, 7.3.0.x, 7.3.1.x, 12.2.0, 12.2.1, and 12.2.2 allows remote authenticated users to affect integrity via unknown vectors related to DM Others.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.securitytracker.com/id/1029620" source="SECTRACK">1029620</ref>
      <ref url="http://www.securityfocus.com/bid/64886" source="BID">64886</ref>
      <ref url="http://www.securityfocus.com/bid/64758" source="BID">64758</ref>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html</ref>
      <ref url="http://secunia.com/advisories/56474" source="SECUNIA">56474</ref>
      <ref url="http://osvdb.org/102098" source="OSVDB">102098</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="supply_chain_products_suite">
        <vers num="7.2.0.3"/>
      </prod>
      <prod vendor="oracle" name="supply_chain_products_suite_sql-server">
        <vers num="12.2.0"/>
        <vers num="12.2.1"/>
        <vers num="12.2.2"/>
        <vers num="7.3.0"/>
        <vers num="7.3.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0372" published="2014-01-15" name="CVE-2014-0372" modified="2014-02-06" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:P/I:P/A:N)" CVSS_score="5.5" CVSS_impact_subscore="4.9" CVSS_exploit_subscore="8.0" CVSS_base_score="5.5">
    <desc>
      <descript source="cve">Unspecified vulnerability in the Oracle Demantra Demand Management component in Oracle Supply Chain Products Suite 7.2.0.3 SQL-Server, 7.3.0, 7.3.1, 12.2.1, and 12.2.2 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to DM Others.</descript>
    </desc>
    <loss_types>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.securitytracker.com/id/1029620" source="SECTRACK">1029620</ref>
      <ref url="http://www.securityfocus.com/bid/64826" source="BID">64826</ref>
      <ref url="http://www.securityfocus.com/bid/64758" source="BID">64758</ref>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html</ref>
      <ref url="http://secunia.com/advisories/56474" source="SECUNIA">56474</ref>
      <ref url="http://osvdb.org/102103" source="OSVDB">102103</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="supply_chain_products_suite">
        <vers num="7.2.0.3"/>
      </prod>
      <prod vendor="oracle" name="supply_chain_products_suite_sql-server">
        <vers num="12.2.0"/>
        <vers num="12.2.1"/>
        <vers num="12.2.2"/>
        <vers num="7.3.0"/>
        <vers num="7.3.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0373" published="2014-01-15" name="CVE-2014-0373" modified="2014-04-01" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Serviceability.  NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that the issue is related to throwing of an incorrect exception when SnmpStatusException should have been used in the SNMP implementation, which allows attackers to escape the sandbox.</descript>
      <descript source="nvd">per http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html

Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://bugzilla.redhat.com/show_bug.cgi?id=1051699" source="CONFIRM">https://bugzilla.redhat.com/show_bug.cgi?id=1051699</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2124-1" source="UBUNTU">USN-2124-1</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2089-1" source="UBUNTU">USN-2089-1</ref>
      <ref url="http://www.securitytracker.com/id/1029608" source="SECTRACK">1029608</ref>
      <ref url="http://www.securityfocus.com/bid/64922" source="BID">64922</ref>
      <ref url="http://www.securityfocus.com/bid/64758" source="BID">64758</ref>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html" source="CONFIRM">http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html</ref>
      <ref url="http://secunia.com/advisories/56535" source="SECUNIA">56535</ref>
      <ref url="http://secunia.com/advisories/56485" source="SECUNIA">56485</ref>
      <ref url="http://secunia.com/advisories/56432" source="SECUNIA">56432</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0136.html" source="REDHAT">RHSA-2014:0136</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0135.html" source="REDHAT">RHSA-2014:0135</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0134.html" source="REDHAT">RHSA-2014:0134</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0097.html" source="REDHAT">RHSA-2014:0097</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0030.html" source="REDHAT">RHSA-2014:0030</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0027.html" source="REDHAT">RHSA-2014:0027</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0026.html" source="REDHAT">RHSA-2014:0026</ref>
      <ref url="http://marc.info/?l=bugtraq&amp;m=139402749111889&amp;w=2" source="HP">SSRT101455</ref>
      <ref url="http://marc.info/?l=bugtraq&amp;m=139402749111889&amp;w=2" source="HP">HPSBUX02973</ref>
      <ref url="http://marc.info/?l=bugtraq&amp;m=139402697611681&amp;w=2" source="HP">HPSBUX02972</ref>
      <ref url="http://marc.info/?l=bugtraq&amp;m=139402697611681&amp;w=2" source="HP">SSRT101454</ref>
      <ref url="http://lists.opensuse.org/opensuse-updates/2014-02/msg00000.html" source="SUSE">openSUSE-SU-2014:0180</ref>
      <ref url="http://lists.opensuse.org/opensuse-updates/2014-01/msg00107.html" source="SUSE">openSUSE-SU-2014:0177</ref>
      <ref url="http://lists.opensuse.org/opensuse-updates/2014-01/msg00105.html" source="SUSE">openSUSE-SU-2014:0174</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00024.html" source="SUSE">SUSE-SU-2014:0451</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00012.html" source="SUSE">SUSE-SU-2014:0266</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00009.html" source="SUSE">SUSE-SU-2014:0246</ref>
      <ref url="http://hg.openjdk.java.net/jdk7u/jdk7u/jdk/rev/496c51673dec" source="MISC">http://hg.openjdk.java.net/jdk7u/jdk7u/jdk/rev/496c51673dec</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="jdk">
        <vers num="1.5.0" edition="update_55"/>
        <vers num="1.6.0" edition="update_65"/>
        <vers num="1.7.0" edition="update_45"/>
      </prod>
      <prod vendor="oracle" name="jre">
        <vers num="1.5.0" edition="update_55"/>
        <vers num="1.6.0" edition="update_65"/>
        <vers num="1.7.0" edition="update_45"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0374" published="2014-01-15" name="CVE-2014-0374" modified="2014-02-06" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Unspecified vulnerability in the Oracle Portal component in Oracle Fusion Middleware 11.1.1.6 allows remote attackers to affect integrity via unknown vectors related to Page Parameters and Events.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.securitytracker.com/id/1029613" source="SECTRACK">1029613</ref>
      <ref url="http://www.securityfocus.com/bid/64830" source="BID">64830</ref>
      <ref url="http://www.securityfocus.com/bid/64758" source="BID">64758</ref>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html</ref>
      <ref url="http://secunia.com/advisories/56464" source="SECUNIA">56464</ref>
      <ref url="http://osvdb.org/102093" source="OSVDB">102093</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="fusion_middleware">
        <vers num="11.1.1.6.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0375" published="2014-01-15" name="CVE-2014-0375" modified="2014-04-01" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:N)" CVSS_score="5.8" CVSS_impact_subscore="4.9" CVSS_exploit_subscore="8.6" CVSS_base_score="5.8">
    <desc>
      <descript source="cve">Unspecified vulnerability in Oracle Java SE 6u65 and 7u45 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Deployment, a different vulnerability than CVE-2013-5898 and CVE-2014-0403.</descript>
      <descript source="nvd">per: http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html


Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets.</descript>
    </desc>
    <loss_types>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90339" source="XF">oracle-cpujan2014-cve20140375(90339)</ref>
      <ref url="http://www.securitytracker.com/id/1029608" source="SECTRACK">1029608</ref>
      <ref url="http://www.securityfocus.com/bid/64916" source="BID">64916</ref>
      <ref url="http://www.securityfocus.com/bid/64758" source="BID">64758</ref>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html</ref>
      <ref url="http://secunia.com/advisories/56535" source="SECUNIA">56535</ref>
      <ref url="http://secunia.com/advisories/56485" source="SECUNIA">56485</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0135.html" source="REDHAT">RHSA-2014:0135</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0134.html" source="REDHAT">RHSA-2014:0134</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0030.html" source="REDHAT">RHSA-2014:0030</ref>
      <ref url="http://osvdb.org/102007" source="OSVDB">102007</ref>
      <ref url="http://marc.info/?l=bugtraq&amp;m=139402749111889&amp;w=2" source="HP">SSRT101455</ref>
      <ref url="http://marc.info/?l=bugtraq&amp;m=139402749111889&amp;w=2" source="HP">HPSBUX02973</ref>
      <ref url="http://marc.info/?l=bugtraq&amp;m=139402697611681&amp;w=2" source="HP">HPSBUX02972</ref>
      <ref url="http://marc.info/?l=bugtraq&amp;m=139402697611681&amp;w=2" source="HP">SSRT101454</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00024.html" source="SUSE">SUSE-SU-2014:0451</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00012.html" source="SUSE">SUSE-SU-2014:0266</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00009.html" source="SUSE">SUSE-SU-2014:0246</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="jdk">
        <vers num="1.6.0" edition="update_65"/>
        <vers num="1.7.0" edition="update_45"/>
      </prod>
      <prod vendor="oracle" name="jre">
        <vers num="1.6.0" edition="update_65"/>
        <vers num="1.7.0" edition="update_45"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0376" published="2014-01-15" name="CVE-2014-0376" modified="2014-04-01" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:P/A:N)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; Java SE Embedded 7u45; and OpenJDK 7 allows remote attackers to affect integrity via vectors related to JAXP.  NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that the issue is related to an improper check for "code permissions when creating document builder factories."</descript>
      <descript source="nvd">per: http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html


Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://bugzilla.redhat.com/show_bug.cgi?id=1051923" source="CONFIRM">https://bugzilla.redhat.com/show_bug.cgi?id=1051923</ref>
      <ref url="http://xforce.iss.net/xforce/xfdb/90350" source="XF">oracle-cpujan2014-cve20140376(90350)</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2124-1" source="UBUNTU">USN-2124-1</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2089-1" source="UBUNTU">USN-2089-1</ref>
      <ref url="http://www.securitytracker.com/id/1029608" source="SECTRACK">1029608</ref>
      <ref url="http://www.securityfocus.com/bid/64907" source="BID">64907</ref>
      <ref url="http://www.securityfocus.com/bid/64758" source="BID">64758</ref>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html</ref>
      <ref url="http://secunia.com/advisories/56535" source="SECUNIA">56535</ref>
      <ref url="http://secunia.com/advisories/56486" source="SECUNIA">56486</ref>
      <ref url="http://secunia.com/advisories/56485" source="SECUNIA">56485</ref>
      <ref url="http://secunia.com/advisories/56432" source="SECUNIA">56432</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0136.html" source="REDHAT">RHSA-2014:0136</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0135.html" source="REDHAT">RHSA-2014:0135</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0134.html" source="REDHAT">RHSA-2014:0134</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0097.html" source="REDHAT">RHSA-2014:0097</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0030.html" source="REDHAT">RHSA-2014:0030</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0027.html" source="REDHAT">RHSA-2014:0027</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0026.html" source="REDHAT">RHSA-2014:0026</ref>
      <ref url="http://osvdb.org/102018" source="OSVDB">102018</ref>
      <ref url="http://marc.info/?l=bugtraq&amp;m=139402749111889&amp;w=2" source="HP">SSRT101455</ref>
      <ref url="http://marc.info/?l=bugtraq&amp;m=139402749111889&amp;w=2" source="HP">HPSBUX02973</ref>
      <ref url="http://marc.info/?l=bugtraq&amp;m=139402697611681&amp;w=2" source="HP">HPSBUX02972</ref>
      <ref url="http://marc.info/?l=bugtraq&amp;m=139402697611681&amp;w=2" source="HP">SSRT101454</ref>
      <ref url="http://lists.opensuse.org/opensuse-updates/2014-02/msg00000.html" source="SUSE">openSUSE-SU-2014:0180</ref>
      <ref url="http://lists.opensuse.org/opensuse-updates/2014-01/msg00107.html" source="SUSE">openSUSE-SU-2014:0177</ref>
      <ref url="http://lists.opensuse.org/opensuse-updates/2014-01/msg00105.html" source="SUSE">openSUSE-SU-2014:0174</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00024.html" source="SUSE">SUSE-SU-2014:0451</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00012.html" source="SUSE">SUSE-SU-2014:0266</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00009.html" source="SUSE">SUSE-SU-2014:0246</ref>
      <ref url="http://hg.openjdk.java.net/jdk7u/jdk7u/jaxp/rev/783ceae9b736" source="MISC">http://hg.openjdk.java.net/jdk7u/jdk7u/jaxp/rev/783ceae9b736</ref>
      <ref url="http://hg.openjdk.java.net/jdk7u/jdk7u/jaxp/rev/42be8e6266ab" source="MISC">http://hg.openjdk.java.net/jdk7u/jdk7u/jaxp/rev/42be8e6266ab</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="jdk">
        <vers num="1.5.0" edition="update_55"/>
        <vers num="1.6.0" edition="update_65"/>
        <vers num="1.7.0" edition="update_45"/>
      </prod>
      <prod vendor="oracle" name="jre">
        <vers num="1.5.0" edition="update_55"/>
        <vers num="1.6.0" edition="update_65"/>
        <vers num="1.7.0" edition="update_45"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0377" published="2014-01-15" name="CVE-2014-0377" modified="2014-03-05" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:P/I:N/A:N)" CVSS_score="4.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.0" CVSS_base_score="4.0">
    <desc>
      <descript source="cve">Unspecified vulnerability in the Core RDBMS component in Oracle Database Server 11.1.0.7, 11.2.0.3, 11.2.0.4, and 12.1.0.1 allows remote authenticated users to affect confidentiality via vectors related to SYS tables.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.securitytracker.com/id/1029607" source="SECTRACK">1029607</ref>
      <ref url="http://www.securityfocus.com/bid/64824" source="BID">64824</ref>
      <ref url="http://www.securityfocus.com/bid/64758" source="BID">64758</ref>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html</ref>
      <ref url="http://secunia.com/advisories/56452" source="SECUNIA">56452</ref>
      <ref url="http://osvdb.org/102081" source="OSVDB">102081</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-01/msg00007.html" source="SUSE">SUSE-SU-2014:0130</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="database_server">
        <vers num="11.1.0.7"/>
        <vers num="11.2.0.3"/>
        <vers num="11.2.0.4"/>
        <vers num="12.1.0.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0378" published="2014-01-15" name="CVE-2014-0378" modified="2014-03-05" CVSS_version="2.0" CVSS_vector="(AV:L/AC:M/Au:S/C:P/I:P/A:P)" CVSS_score="4.1" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="2.7" CVSS_base_score="4.1">
    <desc>
      <descript source="cve">Unspecified vulnerability in the Spatial component in Oracle Database Server 11.1.0.7, 11.2.0.3, 11.2.0.4, and 12.1.0.1 allows local users to affect confidentiality, integrity, and availability via unknown vectors.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="http://www.securitytracker.com/id/1029607" source="SECTRACK">1029607</ref>
      <ref url="http://www.securityfocus.com/bid/64812" source="BID">64812</ref>
      <ref url="http://www.securityfocus.com/bid/64758" source="BID">64758</ref>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html</ref>
      <ref url="http://secunia.com/advisories/56452" source="SECUNIA">56452</ref>
      <ref url="http://osvdb.org/102080" source="OSVDB">102080</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-01/msg00007.html" source="SUSE">SUSE-SU-2014:0130</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="database_server">
        <vers num="11.1.0.7"/>
        <vers num="11.2.0.3"/>
        <vers num="11.2.0.4"/>
        <vers num="12.1.0.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0379" published="2014-01-15" name="CVE-2014-0379" modified="2014-02-06" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Unspecified vulnerability in the Oracle Demantra Demand Management component in Oracle Supply Chain Products Suite 7.2.0.3 SQL-Server, 7.3.0.x, 7.3.1.x, 12.2.0, 12.2.1, and 12.2.2 allows remote attackers to affect integrity via unknown vectors related to DM Others.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.securitytracker.com/id/1029620" source="SECTRACK">1029620</ref>
      <ref url="http://www.securityfocus.com/bid/64857" source="BID">64857</ref>
      <ref url="http://www.securityfocus.com/bid/64758" source="BID">64758</ref>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html</ref>
      <ref url="http://secunia.com/advisories/56474" source="SECUNIA">56474</ref>
      <ref url="http://osvdb.org/102097" source="OSVDB">102097</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="supply_chain_products_suite">
        <vers num="7.2.0.3"/>
      </prod>
      <prod vendor="oracle" name="supply_chain_products_suite_sql-server">
        <vers num="12.2.0"/>
        <vers num="12.2.1"/>
        <vers num="12.2.2"/>
        <vers num="7.3.0"/>
        <vers num="7.3.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0380" published="2014-01-15" name="CVE-2014-0380" modified="2014-02-06" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.52 and 8.53 allows remote attackers to affect integrity via vectors related to MultiChannel Framework (MCF).</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.securitytracker.com/id/1029623" source="SECTRACK">1029623</ref>
      <ref url="http://www.securityfocus.com/bid/64865" source="BID">64865</ref>
      <ref url="http://www.securityfocus.com/bid/64758" source="BID">64758</ref>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html</ref>
      <ref url="http://secunia.com/advisories/56478" source="SECUNIA">56478</ref>
      <ref url="http://osvdb.org/102037" source="OSVDB">102037</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="peoplesoft_products">
        <vers num="8.52"/>
        <vers num="8.53"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-0381" published="2014-01-15" name="CVE-2014-0381" modified="2014-02-06" CVSS_version="2.0" CVSS_vector="(AV:N/AC:H/Au:N/C:N/I:P/A:N)" CVSS_score="2.6" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="4.9" CVSS_base_score="2.6">
    <desc>
      <descript source="cve">Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.52 and 8.53 allows remote attackers to affect integrity via vectors related to PIA Core Technology, a different vulnerability than CVE-2014-0445.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.securitytracker.com/id/1029623" source="SECTRACK">1029623</ref>
      <ref url="http://www.securityfocus.com/bid/64892" source="BID">64892</ref>
      <ref url="http://www.securityfocus.com/bid/64758" source="BID">64758</ref>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html</ref>
      <ref url="http://secunia.com/advisories/56478" source="SECUNIA">56478</ref>
      <ref url="http://osvdb.org/102045" source="OSVDB">102045</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="peoplesoft_products">
        <vers num="8.52"/>
        <vers num="8.53"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0382" published="2014-01-15" name="CVE-2014-0382" modified="2014-03-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:N/A:P)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Unspecified vulnerability in Oracle Java SE 7u45 and JavaFX 2.2.45 allows remote attackers to affect availability via unknown vectors related to JavaFX.</descript>
      <descript source="nvd">Per: http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html

"Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets."</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90355" source="XF">oracle-cpujan2014-cve20140382(90355)</ref>
      <ref url="http://www.securitytracker.com/id/1029608" source="SECTRACK">1029608</ref>
      <ref url="http://www.securityfocus.com/bid/64936" source="BID">64936</ref>
      <ref url="http://www.securityfocus.com/bid/64758" source="BID">64758</ref>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html</ref>
      <ref url="http://secunia.com/advisories/56535" source="SECUNIA">56535</ref>
      <ref url="http://secunia.com/advisories/56485" source="SECUNIA">56485</ref>
      <ref url="http://secunia.com/advisories/56484" source="SECUNIA">56484</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0030.html" source="REDHAT">RHSA-2014:0030</ref>
      <ref url="http://osvdb.org/102026" source="OSVDB">102026</ref>
      <ref url="http://marc.info/?l=bugtraq&amp;m=139402697611681&amp;w=2" source="HP">SSRT101454</ref>
      <ref url="http://marc.info/?l=bugtraq&amp;m=139402697611681&amp;w=2" source="HP">HPSBUX02972</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="javafx">
        <vers num="2.2.45"/>
      </prod>
      <prod vendor="oracle" name="jdk">
        <vers num="1.7.0" edition="update_45"/>
      </prod>
      <prod vendor="oracle" name="jre">
        <vers num="1.7.0" edition="update_45"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-0383" published="2014-01-15" name="CVE-2014-0383" modified="2014-02-06" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:S/C:P/I:N/A:N)" CVSS_score="3.5" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="6.8" CVSS_base_score="3.5">
    <desc>
      <descript source="cve">Unspecified vulnerability in the Oracle Identity Manager component in Oracle Fusion Middleware 11.1.2.0 and 11.1.2.1 allows remote authenticated users to affect confidentiality via unknown vectors related to Identity Console.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.securitytracker.com/id/1029613" source="SECTRACK">1029613</ref>
      <ref url="http://www.securityfocus.com/bid/64842" source="BID">64842</ref>
      <ref url="http://www.securityfocus.com/bid/64758" source="BID">64758</ref>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html</ref>
      <ref url="http://secunia.com/advisories/56459" source="SECUNIA">56459</ref>
      <ref url="http://osvdb.org/102102" source="OSVDB">102102</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="fusion_middleware">
        <vers num="11.1.2.0"/>
        <vers num="11.1.2.1.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0384" published="2014-04-15" name="CVE-2014-0384" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:N/I:N/A:P)" CVSS_score="4.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.0" CVSS_base_score="4.0">
    <desc>
      <descript source="cve">Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.35 and earlier and 5.6.15 and earlier allows remote authenticated users to affect availability via vectors related to XML.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="mysql" name="mysql">
        <vers num="5.5.0"/>
        <vers num="5.5.1"/>
        <vers num="5.5.2"/>
        <vers num="5.5.3"/>
        <vers num="5.5.4"/>
        <vers num="5.5.5"/>
        <vers num="5.5.6"/>
        <vers num="5.5.7"/>
        <vers num="5.5.8"/>
        <vers num="5.5.9"/>
      </prod>
      <prod vendor="oracle" name="mysql">
        <vers num="5.5.10"/>
        <vers num="5.5.11"/>
        <vers num="5.5.12"/>
        <vers num="5.5.13"/>
        <vers num="5.5.14"/>
        <vers num="5.5.15"/>
        <vers num="5.5.16"/>
        <vers num="5.5.17"/>
        <vers num="5.5.18"/>
        <vers num="5.5.19"/>
        <vers num="5.5.20"/>
        <vers num="5.5.21"/>
        <vers num="5.5.22"/>
        <vers num="5.5.23"/>
        <vers num="5.5.24"/>
        <vers num="5.5.25" edition="a"/>
        <vers num="5.5.26"/>
        <vers num="5.5.27"/>
        <vers num="5.5.28"/>
        <vers num="5.5.29"/>
        <vers num="5.5.30"/>
        <vers num="5.5.31"/>
        <vers num="5.5.32"/>
        <vers num="5.5.33"/>
        <vers num="5.5.34"/>
        <vers prev="1" num="5.5.35"/>
        <vers num="5.6.0"/>
        <vers num="5.6.1"/>
        <vers num="5.6.10"/>
        <vers num="5.6.11"/>
        <vers num="5.6.12"/>
        <vers num="5.6.13"/>
        <vers num="5.6.14"/>
        <vers prev="1" num="5.6.15"/>
        <vers num="5.6.2"/>
        <vers num="5.6.3"/>
        <vers num="5.6.4"/>
        <vers num="5.6.5"/>
        <vers num="5.6.6"/>
        <vers num="5.6.7"/>
        <vers num="5.6.8"/>
        <vers num="5.6.9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0385" published="2014-01-15" name="CVE-2014-0385" modified="2014-02-06" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">Unspecified vulnerability in Oracle Java SE 7u45, when installing on OS X, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Install.</descript>
      <descript source="nvd">per:
http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html

Applies to installation process on client deployment of Java.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.securitytracker.com/id/1029608" source="SECTRACK">1029608</ref>
      <ref url="http://www.securityfocus.com/bid/64901" source="BID">64901</ref>
      <ref url="http://www.securityfocus.com/bid/64758" source="BID">64758</ref>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html</ref>
      <ref url="http://secunia.com/advisories/56485" source="SECUNIA">56485</ref>
      <ref url="http://osvdb.org/101998" source="OSVDB">101998</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="jdk">
        <vers num="1.7.0" edition="update_45"/>
      </prod>
      <prod vendor="oracle" name="jre">
        <vers num="1.7.0" edition="update_45"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0386" published="2014-01-15" name="CVE-2014-0386" modified="2014-03-05" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:N/I:N/A:P)" CVSS_score="4.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.0" CVSS_base_score="4.0">
    <desc>
      <descript source="cve">Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.71 and earlier, 5.5.33 and earlier, and 5.6.13 and earlier allows remote authenticated users to affect availability via unknown vectors related to Optimizer.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90380" source="XF">oracle-cpujan2014-cve20140386(90380)</ref>
      <ref url="http://www.securityfocus.com/bid/64904" source="BID">64904</ref>
      <ref url="http://www.securityfocus.com/bid/64758" source="BID">64758</ref>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2848" source="DEBIAN">DSA-2848</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2845" source="DEBIAN">DSA-2845</ref>
      <ref url="http://ubuntu.com/usn/usn-2086-1" source="UBUNTU">USN-2086-1</ref>
      <ref url="http://secunia.com/advisories/56580" source="SECUNIA">56580</ref>
      <ref url="http://secunia.com/advisories/56541" source="SECUNIA">56541</ref>
      <ref url="http://secunia.com/advisories/56491" source="SECUNIA">56491</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0189.html" source="REDHAT">RHSA-2014:0189</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0186.html" source="REDHAT">RHSA-2014:0186</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0173.html" source="REDHAT">RHSA-2014:0173</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0164.html" source="REDHAT">RHSA-2014:0164</ref>
      <ref url="http://osvdb.org/102069" source="OSVDB">102069</ref>
    </refs>
    <vuln_soft>
      <prod vendor="mysql" name="mysql">
        <vers num="5.1"/>
        <vers num="5.1.1"/>
        <vers num="5.1.10"/>
        <vers num="5.1.11"/>
        <vers num="5.1.12"/>
        <vers num="5.1.13"/>
        <vers num="5.1.14"/>
        <vers num="5.1.15"/>
        <vers num="5.1.16"/>
        <vers num="5.1.17"/>
        <vers num="5.1.18"/>
        <vers num="5.1.19"/>
        <vers num="5.1.2"/>
        <vers num="5.1.20"/>
        <vers num="5.1.21"/>
        <vers num="5.1.22"/>
        <vers num="5.1.23" edition="a"/>
        <vers num="5.1.23_bk"/>
        <vers num="5.1.23a"/>
        <vers num="5.1.24"/>
        <vers num="5.1.25"/>
        <vers num="5.1.26"/>
        <vers num="5.1.27"/>
        <vers num="5.1.28"/>
        <vers num="5.1.29"/>
        <vers num="5.1.3"/>
        <vers num="5.1.30"/>
        <vers num="5.1.31" edition="sp1"/>
        <vers num="5.1.32"/>
        <vers num="5.1.32-bzr"/>
        <vers num="5.1.33"/>
        <vers num="5.1.34" edition="sp1"/>
        <vers num="5.1.35"/>
        <vers num="5.1.36"/>
        <vers num="5.1.37" edition="sp1"/>
        <vers num="5.1.38"/>
        <vers num="5.1.39"/>
        <vers num="5.1.4"/>
        <vers num="5.1.40" edition="sp1"/>
        <vers num="5.1.41"/>
        <vers num="5.1.42"/>
        <vers num="5.1.43" edition="sp1"/>
        <vers num="5.1.44"/>
        <vers num="5.1.45"/>
        <vers num="5.1.46" edition="sp1"/>
        <vers num="5.1.47"/>
        <vers num="5.1.48"/>
        <vers num="5.1.49" edition="sp1"/>
        <vers num="5.1.5"/>
        <vers num="5.1.50"/>
        <vers num="5.1.5a"/>
        <vers num="5.1.6"/>
        <vers num="5.1.7"/>
        <vers num="5.1.8"/>
        <vers num="5.1.9"/>
        <vers num="5.5.0"/>
        <vers num="5.5.1"/>
        <vers num="5.5.2"/>
        <vers num="5.5.3"/>
        <vers num="5.5.4"/>
        <vers num="5.5.5"/>
        <vers num="5.5.6"/>
        <vers num="5.5.7"/>
        <vers num="5.5.8"/>
        <vers num="5.5.9"/>
      </prod>
      <prod vendor="oracle" name="mysql">
        <vers num="5.1.51"/>
        <vers num="5.1.52" edition="sp1"/>
        <vers num="5.1.53"/>
        <vers num="5.1.54"/>
        <vers num="5.1.55"/>
        <vers num="5.1.56"/>
        <vers num="5.1.57"/>
        <vers num="5.1.58"/>
        <vers num="5.1.59"/>
        <vers num="5.1.60"/>
        <vers num="5.1.61"/>
        <vers num="5.1.62"/>
        <vers num="5.1.63"/>
        <vers num="5.1.64"/>
        <vers num="5.1.65"/>
        <vers num="5.1.66"/>
        <vers num="5.1.67"/>
        <vers num="5.1.68"/>
        <vers num="5.1.69"/>
        <vers num="5.1.70"/>
        <vers prev="1" num="5.1.71"/>
        <vers num="5.5.10"/>
        <vers num="5.5.11"/>
        <vers num="5.5.12"/>
        <vers num="5.5.13"/>
        <vers num="5.5.14"/>
        <vers num="5.5.15"/>
        <vers num="5.5.16"/>
        <vers num="5.5.17"/>
        <vers num="5.5.18"/>
        <vers num="5.5.19"/>
        <vers num="5.5.20"/>
        <vers num="5.5.21"/>
        <vers num="5.5.22"/>
        <vers num="5.5.23"/>
        <vers num="5.5.24"/>
        <vers num="5.5.25" edition="a"/>
        <vers num="5.5.26"/>
        <vers num="5.5.27"/>
        <vers num="5.5.28"/>
        <vers num="5.5.29"/>
        <vers num="5.5.30"/>
        <vers num="5.5.31"/>
        <vers num="5.5.32"/>
        <vers prev="1" num="5.5.33"/>
        <vers num="5.6.0"/>
        <vers num="5.6.1"/>
        <vers num="5.6.10"/>
        <vers num="5.6.11"/>
        <vers num="5.6.12"/>
        <vers prev="1" num="5.6.13"/>
        <vers num="5.6.2"/>
        <vers num="5.6.3"/>
        <vers num="5.6.4"/>
        <vers num="5.6.5"/>
        <vers num="5.6.6"/>
        <vers num="5.6.7"/>
        <vers num="5.6.8"/>
        <vers num="5.6.9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0387" published="2014-01-15" name="CVE-2014-0387" modified="2014-04-01" CVSS_version="2.0" CVSS_vector="(AV:N/AC:H/Au:N/C:C/I:C/A:C)" CVSS_score="7.6" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="4.9" CVSS_base_score="7.6">
    <desc>
      <descript source="cve">Unspecified vulnerability in Oracle Java SE 6u65 and Java SE 7u45, when running on Firefox, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment.</descript>
      <descript source="nvd">Per: http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html

"Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets."</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.securitytracker.com/id/1029608" source="SECTRACK">1029608</ref>
      <ref url="http://www.securityfocus.com/bid/64882" source="BID">64882</ref>
      <ref url="http://www.securityfocus.com/bid/64758" source="BID">64758</ref>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html</ref>
      <ref url="http://secunia.com/advisories/56535" source="SECUNIA">56535</ref>
      <ref url="http://secunia.com/advisories/56485" source="SECUNIA">56485</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0135.html" source="REDHAT">RHSA-2014:0135</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0134.html" source="REDHAT">RHSA-2014:0134</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0030.html" source="REDHAT">RHSA-2014:0030</ref>
      <ref url="http://osvdb.org/102002" source="OSVDB">102002</ref>
      <ref url="http://marc.info/?l=bugtraq&amp;m=139402749111889&amp;w=2" source="HP">SSRT101455</ref>
      <ref url="http://marc.info/?l=bugtraq&amp;m=139402749111889&amp;w=2" source="HP">HPSBUX02973</ref>
      <ref url="http://marc.info/?l=bugtraq&amp;m=139402697611681&amp;w=2" source="HP">HPSBUX02972</ref>
      <ref url="http://marc.info/?l=bugtraq&amp;m=139402697611681&amp;w=2" source="HP">SSRT101454</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00024.html" source="SUSE">SUSE-SU-2014:0451</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00012.html" source="SUSE">SUSE-SU-2014:0266</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00009.html" source="SUSE">SUSE-SU-2014:0246</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="jdk">
        <vers num="1.6.0" edition="update_65"/>
        <vers num="1.7.0" edition="update_45"/>
      </prod>
      <prod vendor="oracle" name="jre">
        <vers num="1.6.0" edition="update_65"/>
        <vers num="1.7.0" edition="update_45"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0388" published="2014-01-15" name="CVE-2014-0388" modified="2014-02-06" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:P/I:N/A:N)" CVSS_score="4.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.0" CVSS_base_score="4.0">
    <desc>
      <descript source="cve">Unspecified vulnerability in the PeopleSoft Enterprise HRMS Human Resources component in Oracle PeopleSoft Products 9.1 and 9.2 allows remote authenticated users to affect confidentiality via unknown vectors related to Org and Workforce Dev.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.securitytracker.com/id/1029623" source="SECTRACK">1029623</ref>
      <ref url="http://www.securityfocus.com/bid/64878" source="BID">64878</ref>
      <ref url="http://www.securityfocus.com/bid/64758" source="BID">64758</ref>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html</ref>
      <ref url="http://secunia.com/advisories/56477" source="SECUNIA">56477</ref>
      <ref url="http://osvdb.org/102040" source="OSVDB">102040</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="peoplesoft_products">
        <vers num="9.1"/>
        <vers num="9.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0389" published="2014-01-15" name="CVE-2014-0389" modified="2014-02-06" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Unspecified vulnerability in Oracle iLearning 6.0 allows remote attackers to affect integrity via unknown vectors related to Learner Pages.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.securitytracker.com/id/1029621" source="SECTRACK">1029621</ref>
      <ref url="http://www.securityfocus.com/bid/64845" source="BID">64845</ref>
      <ref url="http://www.securityfocus.com/bid/64758" source="BID">64758</ref>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html</ref>
      <ref url="http://secunia.com/advisories/56482" source="SECUNIA">56482</ref>
      <ref url="http://osvdb.org/102109" source="OSVDB">102109</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="ilearning">
        <vers num="6.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0390" published="2014-01-15" name="CVE-2014-0390" modified="2014-02-06" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Unspecified vulnerability in Oracle Solaris 10 allows remote attackers to affect integrity via unknown vectors related to Java Web Console.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90362" source="XF">oracle-cpujan2014-cve20140390(90362)</ref>
      <ref url="http://www.securityfocus.com/bid/64859" source="BID">64859</ref>
      <ref url="http://www.securityfocus.com/bid/64758" source="BID">64758</ref>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html</ref>
      <ref url="http://secunia.com/advisories/56488" source="SECUNIA">56488</ref>
      <ref url="http://osvdb.org/102052" source="OSVDB">102052</ref>
    </refs>
    <vuln_soft>
      <prod vendor="sun" name="sunos">
        <vers num="5.10"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0391" published="2014-01-15" name="CVE-2014-0391" modified="2014-02-06" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:N/A:N)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">Unspecified vulnerability in the Oracle Identity Manager component in Oracle Fusion Middleware 11.1.1.5, 11.1.1.7, 11.1.2.0, and 11.1.2.1 allows remote attackers to affect confidentiality via unknown vectors related to End User Self Service.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.securitytracker.com/id/1029613" source="SECTRACK">1029613</ref>
      <ref url="http://www.securityfocus.com/bid/64829" source="BID">64829</ref>
      <ref url="http://www.securityfocus.com/bid/64758" source="BID">64758</ref>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html</ref>
      <ref url="http://secunia.com/advisories/56459" source="SECUNIA">56459</ref>
      <ref url="http://osvdb.org/102099" source="OSVDB">102099</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="fusion_middleware">
        <vers num="11.1.1.5.0"/>
        <vers num="11.1.1.7.0"/>
        <vers num="11.1.2.0"/>
        <vers num="11.1.2.1.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0392" published="2014-01-15" name="CVE-2014-0392" modified="2014-02-06" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:P/I:N/A:N)" CVSS_score="4.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.0" CVSS_base_score="4.0">
    <desc>
      <descript source="cve">Unspecified vulnerability in the PeopleSoft Enterprise HRMS component in Oracle PeopleSoft Products 9.1 and 9.2 allows remote authenticated users to affect confidentiality via unknown vectors related to Security.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.securitytracker.com/id/1029623" source="SECTRACK">1029623</ref>
      <ref url="http://www.securityfocus.com/bid/64874" source="BID">64874</ref>
      <ref url="http://www.securityfocus.com/bid/64758" source="BID">64758</ref>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html</ref>
      <ref url="http://secunia.com/advisories/56477" source="SECUNIA">56477</ref>
      <ref url="http://osvdb.org/102039" source="OSVDB">102039</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="peoplesoft_products">
        <vers num="9.1"/>
        <vers num="9.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-0393" published="2014-01-15" name="CVE-2014-0393" modified="2014-03-05" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:M/C:N/I:P/A:N)" CVSS_score="3.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="6.4" CVSS_base_score="3.3">
    <desc>
      <descript source="cve">Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.71 and earlier, 5.5.33 and earlier, and 5.6.13 and earlier allows remote authenticated users to affect integrity via unknown vectors related to InnoDB.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90386" source="XF">oracle-cpujan2014-cve20140393(90386)</ref>
      <ref url="http://www.securityfocus.com/bid/64877" source="BID">64877</ref>
      <ref url="http://www.securityfocus.com/bid/64758" source="BID">64758</ref>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2848" source="DEBIAN">DSA-2848</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2845" source="DEBIAN">DSA-2845</ref>
      <ref url="http://ubuntu.com/usn/usn-2086-1" source="UBUNTU">USN-2086-1</ref>
      <ref url="http://secunia.com/advisories/56580" source="SECUNIA">56580</ref>
      <ref url="http://secunia.com/advisories/56541" source="SECUNIA">56541</ref>
      <ref url="http://secunia.com/advisories/56491" source="SECUNIA">56491</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0189.html" source="REDHAT">RHSA-2014:0189</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0186.html" source="REDHAT">RHSA-2014:0186</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0173.html" source="REDHAT">RHSA-2014:0173</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0164.html" source="REDHAT">RHSA-2014:0164</ref>
      <ref url="http://osvdb.org/102075" source="OSVDB">102075</ref>
    </refs>
    <vuln_soft>
      <prod vendor="mysql" name="mysql">
        <vers num="5.1"/>
        <vers num="5.1.1"/>
        <vers num="5.1.10"/>
        <vers num="5.1.11"/>
        <vers num="5.1.12"/>
        <vers num="5.1.13"/>
        <vers num="5.1.14"/>
        <vers num="5.1.15"/>
        <vers num="5.1.16"/>
        <vers num="5.1.17"/>
        <vers num="5.1.18"/>
        <vers num="5.1.19"/>
        <vers num="5.1.2"/>
        <vers num="5.1.20"/>
        <vers num="5.1.21"/>
        <vers num="5.1.22"/>
        <vers num="5.1.23" edition="a"/>
        <vers num="5.1.23_bk"/>
        <vers num="5.1.23a"/>
        <vers num="5.1.24"/>
        <vers num="5.1.25"/>
        <vers num="5.1.26"/>
        <vers num="5.1.27"/>
        <vers num="5.1.28"/>
        <vers num="5.1.29"/>
        <vers num="5.1.3"/>
        <vers num="5.1.30"/>
        <vers num="5.1.31" edition="sp1"/>
        <vers num="5.1.32"/>
        <vers num="5.1.32-bzr"/>
        <vers num="5.1.33"/>
        <vers num="5.1.34" edition="sp1"/>
        <vers num="5.1.35"/>
        <vers num="5.1.36"/>
        <vers num="5.1.37" edition="sp1"/>
        <vers num="5.1.38"/>
        <vers num="5.1.39"/>
        <vers num="5.1.4"/>
        <vers num="5.1.40" edition="sp1"/>
        <vers num="5.1.41"/>
        <vers num="5.1.42"/>
        <vers num="5.1.43" edition="sp1"/>
        <vers num="5.1.44"/>
        <vers num="5.1.45"/>
        <vers num="5.1.46" edition="sp1"/>
        <vers num="5.1.47"/>
        <vers num="5.1.48"/>
        <vers num="5.1.49" edition="sp1"/>
        <vers num="5.1.5"/>
        <vers num="5.1.50"/>
        <vers num="5.1.5a"/>
        <vers num="5.1.6"/>
        <vers num="5.1.7"/>
        <vers num="5.1.8"/>
        <vers num="5.1.9"/>
        <vers num="5.5.0"/>
        <vers num="5.5.1"/>
        <vers num="5.5.2"/>
        <vers num="5.5.3"/>
        <vers num="5.5.4"/>
        <vers num="5.5.5"/>
        <vers num="5.5.6"/>
        <vers num="5.5.7"/>
        <vers num="5.5.8"/>
        <vers num="5.5.9"/>
      </prod>
      <prod vendor="oracle" name="mysql">
        <vers num="5.1.51"/>
        <vers num="5.1.52" edition="sp1"/>
        <vers num="5.1.53"/>
        <vers num="5.1.54"/>
        <vers num="5.1.55"/>
        <vers num="5.1.56"/>
        <vers num="5.1.57"/>
        <vers num="5.1.58"/>
        <vers num="5.1.59"/>
        <vers num="5.1.60"/>
        <vers num="5.1.61"/>
        <vers num="5.1.62"/>
        <vers num="5.1.63"/>
        <vers num="5.1.64"/>
        <vers num="5.1.65"/>
        <vers num="5.1.66"/>
        <vers num="5.1.67"/>
        <vers num="5.1.68"/>
        <vers num="5.1.69"/>
        <vers num="5.1.70"/>
        <vers prev="1" num="5.1.71"/>
        <vers num="5.5.10"/>
        <vers num="5.5.11"/>
        <vers num="5.5.12"/>
        <vers num="5.5.13"/>
        <vers num="5.5.14"/>
        <vers num="5.5.15"/>
        <vers num="5.5.16"/>
        <vers num="5.5.17"/>
        <vers num="5.5.18"/>
        <vers num="5.5.19"/>
        <vers num="5.5.20"/>
        <vers num="5.5.21"/>
        <vers num="5.5.22"/>
        <vers num="5.5.23"/>
        <vers num="5.5.24"/>
        <vers num="5.5.25" edition="a"/>
        <vers num="5.5.26"/>
        <vers num="5.5.27"/>
        <vers num="5.5.28"/>
        <vers num="5.5.29"/>
        <vers num="5.5.30"/>
        <vers num="5.5.31"/>
        <vers num="5.5.32"/>
        <vers prev="1" num="5.5.33"/>
        <vers num="5.6.0"/>
        <vers num="5.6.1"/>
        <vers num="5.6.10"/>
        <vers num="5.6.11"/>
        <vers num="5.6.12"/>
        <vers prev="1" num="5.6.13"/>
        <vers num="5.6.2"/>
        <vers num="5.6.3"/>
        <vers num="5.6.4"/>
        <vers num="5.6.5"/>
        <vers num="5.6.6"/>
        <vers num="5.6.7"/>
        <vers num="5.6.8"/>
        <vers num="5.6.9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0394" published="2014-01-15" name="CVE-2014-0394" modified="2014-02-06" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:N/A:N)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.52 and 8.53 allows remote attackers to affect confidentiality via unknown vectors related to Updates Environment Mgmt, a different vulnerability than CVE-2014-0395.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.securitytracker.com/id/1029623" source="SECTRACK">1029623</ref>
      <ref url="http://www.securityfocus.com/bid/64848" source="BID">64848</ref>
      <ref url="http://www.securityfocus.com/bid/64758" source="BID">64758</ref>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html</ref>
      <ref url="http://secunia.com/advisories/56478" source="SECUNIA">56478</ref>
      <ref url="http://osvdb.org/102033" source="OSVDB">102033</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="peoplesoft_products">
        <vers num="8.52"/>
        <vers num="8.53"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0395" published="2014-01-15" name="CVE-2014-0395" modified="2014-02-06" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:N/A:N)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.52 and 8.53 allows remote attackers to affect confidentiality via unknown vectors related to Updates Environment Mgmt, a different vulnerability than CVE-2014-0394.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.securitytracker.com/id/1029623" source="SECTRACK">1029623</ref>
      <ref url="http://www.securityfocus.com/bid/64852" source="BID">64852</ref>
      <ref url="http://www.securityfocus.com/bid/64758" source="BID">64758</ref>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html</ref>
      <ref url="http://secunia.com/advisories/56478" source="SECUNIA">56478</ref>
      <ref url="http://osvdb.org/102034" source="OSVDB">102034</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="peoplesoft_products">
        <vers num="8.52"/>
        <vers num="8.53"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0396" published="2014-01-15" name="CVE-2014-0396" modified="2014-02-06" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:N/A:N)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.52 and 8.53 allows remote attackers to affect confidentiality via unknown vectors related to Portal - Web Services.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.securitytracker.com/id/1029623" source="SECTRACK">1029623</ref>
      <ref url="http://www.securityfocus.com/bid/64841" source="BID">64841</ref>
      <ref url="http://www.securityfocus.com/bid/64758" source="BID">64758</ref>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html</ref>
      <ref url="http://secunia.com/advisories/56478" source="SECUNIA">56478</ref>
      <ref url="http://osvdb.org/102031" source="OSVDB">102031</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="peoplesoft_products">
        <vers num="8.52"/>
        <vers num="8.53"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0398" published="2014-01-15" name="CVE-2014-0398" modified="2014-02-06" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:N/A:N)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 11.5.10.2, 12.0.6, 12.1.3, and 12.2.2 allows remote attackers to affect confidentiality via unknown vectors related to Discoverer.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.securitytracker.com/id/1029619" source="SECTRACK">1029619</ref>
      <ref url="http://www.securityfocus.com/bid/64818" source="BID">64818</ref>
      <ref url="http://www.securityfocus.com/bid/64758" source="BID">64758</ref>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html</ref>
      <ref url="http://secunia.com/advisories/56471" source="SECUNIA">56471</ref>
      <ref url="http://osvdb.org/102105" source="OSVDB">102105</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="e-business_suite">
        <vers num="11.5.10.2"/>
        <vers num="12.0.6"/>
        <vers num="12.1.3"/>
        <vers num="12.2.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0399" published="2014-01-15" name="CVE-2014-0399" modified="2014-02-06" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:P/I:N/A:N)" CVSS_score="4.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.0" CVSS_base_score="4.0">
    <desc>
      <descript source="cve">Unspecified vulnerability in the Oracle Transportation Management component in Oracle Supply Chain Products Suite 6.2, 6.3, 6.3.1, and 6.3.2 allows remote authenticated users to affect confidentiality via unknown vectors related to Data, Domain &amp; Function Security.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.securitytracker.com/id/1029620" source="SECTRACK">1029620</ref>
      <ref url="http://www.securityfocus.com/bid/64861" source="BID">64861</ref>
      <ref url="http://www.securityfocus.com/bid/64758" source="BID">64758</ref>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html</ref>
      <ref url="http://osvdb.org/102085" source="OSVDB">102085</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="supply_chain_products_suite">
        <vers num="6.2.0"/>
        <vers num="6.3.0"/>
        <vers num="6.3.1"/>
        <vers num="6.3.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0400" published="2014-01-15" name="CVE-2014-0400" modified="2014-02-06" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:S/C:C/I:N/A:N)" CVSS_score="6.3" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="6.8" CVSS_base_score="6.3">
    <desc>
      <descript source="cve">Unspecified vulnerability in the Oracle Internet Directory component in Oracle Fusion Middleware 11.1.1.6 and 11.1.1.7 allows remote authenticated users to affect confidentiality via vectors related to OID LDAP server.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.securitytracker.com/id/1029618" source="SECTRACK">1029618</ref>
      <ref url="http://www.securityfocus.com/bid/64822" source="BID">64822</ref>
      <ref url="http://www.securityfocus.com/bid/64758" source="BID">64758</ref>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html</ref>
      <ref url="http://secunia.com/advisories/56460" source="SECUNIA">56460</ref>
      <ref url="http://osvdb.org/102112" source="OSVDB">102112</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="fusion_middleware">
        <vers num="11.1.1.6.0"/>
        <vers num="11.1.1.7.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0401" published="2014-01-15" name="CVE-2014-0401" modified="2014-03-05" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:N/I:N/A:P)" CVSS_score="4.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.0" CVSS_base_score="4.0">
    <desc>
      <descript source="cve">Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.72 and earlier, 5.5.34 and earlier, and 5.6.14 and earlier allows remote authenticated users to affect availability via unknown vectors.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90382" source="XF">oracle-cpujan2014-cve20140401(90382)</ref>
      <ref url="http://www.securityfocus.com/bid/64898" source="BID">64898</ref>
      <ref url="http://www.securityfocus.com/bid/64758" source="BID">64758</ref>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2848" source="DEBIAN">DSA-2848</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2845" source="DEBIAN">DSA-2845</ref>
      <ref url="http://ubuntu.com/usn/usn-2086-1" source="UBUNTU">USN-2086-1</ref>
      <ref url="http://secunia.com/advisories/56580" source="SECUNIA">56580</ref>
      <ref url="http://secunia.com/advisories/56541" source="SECUNIA">56541</ref>
      <ref url="http://secunia.com/advisories/56491" source="SECUNIA">56491</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0189.html" source="REDHAT">RHSA-2014:0189</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0186.html" source="REDHAT">RHSA-2014:0186</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0173.html" source="REDHAT">RHSA-2014:0173</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0164.html" source="REDHAT">RHSA-2014:0164</ref>
      <ref url="http://osvdb.org/102071" source="OSVDB">102071</ref>
    </refs>
    <vuln_soft>
      <prod vendor="mysql" name="mysql">
        <vers num="5.1"/>
        <vers num="5.1.1"/>
        <vers num="5.1.10"/>
        <vers num="5.1.11"/>
        <vers num="5.1.12"/>
        <vers num="5.1.13"/>
        <vers num="5.1.14"/>
        <vers num="5.1.15"/>
        <vers num="5.1.16"/>
        <vers num="5.1.17"/>
        <vers num="5.1.18"/>
        <vers num="5.1.19"/>
        <vers num="5.1.2"/>
        <vers num="5.1.20"/>
        <vers num="5.1.21"/>
        <vers num="5.1.22"/>
        <vers num="5.1.23" edition="a"/>
        <vers num="5.1.23_bk"/>
        <vers num="5.1.23a"/>
        <vers num="5.1.24"/>
        <vers num="5.1.25"/>
        <vers num="5.1.26"/>
        <vers num="5.1.27"/>
        <vers num="5.1.28"/>
        <vers num="5.1.29"/>
        <vers num="5.1.3"/>
        <vers num="5.1.30"/>
        <vers num="5.1.31" edition="sp1"/>
        <vers num="5.1.32"/>
        <vers num="5.1.32-bzr"/>
        <vers num="5.1.33"/>
        <vers num="5.1.34" edition="sp1"/>
        <vers num="5.1.35"/>
        <vers num="5.1.36"/>
        <vers num="5.1.37" edition="sp1"/>
        <vers num="5.1.38"/>
        <vers num="5.1.39"/>
        <vers num="5.1.4"/>
        <vers num="5.1.40" edition="sp1"/>
        <vers num="5.1.41"/>
        <vers num="5.1.42"/>
        <vers num="5.1.43" edition="sp1"/>
        <vers num="5.1.44"/>
        <vers num="5.1.45"/>
        <vers num="5.1.46" edition="sp1"/>
        <vers num="5.1.47"/>
        <vers num="5.1.48"/>
        <vers num="5.1.49" edition="sp1"/>
        <vers num="5.1.5"/>
        <vers num="5.1.50"/>
        <vers num="5.1.5a"/>
        <vers num="5.1.6"/>
        <vers num="5.1.7"/>
        <vers num="5.1.8"/>
        <vers num="5.1.9"/>
        <vers num="5.5.0"/>
        <vers num="5.5.1"/>
        <vers num="5.5.2"/>
        <vers num="5.5.3"/>
        <vers num="5.5.4"/>
        <vers num="5.5.5"/>
        <vers num="5.5.6"/>
        <vers num="5.5.7"/>
        <vers num="5.5.8"/>
        <vers num="5.5.9"/>
      </prod>
      <prod vendor="oracle" name="mysql">
        <vers num="5.1.51"/>
        <vers num="5.1.52" edition="sp1"/>
        <vers num="5.1.53"/>
        <vers num="5.1.54"/>
        <vers num="5.1.55"/>
        <vers num="5.1.56"/>
        <vers num="5.1.57"/>
        <vers num="5.1.58"/>
        <vers num="5.1.59"/>
        <vers num="5.1.60"/>
        <vers num="5.1.61"/>
        <vers num="5.1.62"/>
        <vers num="5.1.63"/>
        <vers num="5.1.64"/>
        <vers num="5.1.65"/>
        <vers num="5.1.66"/>
        <vers num="5.1.67"/>
        <vers num="5.1.68"/>
        <vers num="5.1.69"/>
        <vers num="5.1.70"/>
        <vers num="5.1.71"/>
        <vers prev="1" num="5.1.72"/>
        <vers num="5.5.10"/>
        <vers num="5.5.11"/>
        <vers num="5.5.12"/>
        <vers num="5.5.13"/>
        <vers num="5.5.14"/>
        <vers num="5.5.15"/>
        <vers num="5.5.16"/>
        <vers num="5.5.17"/>
        <vers num="5.5.18"/>
        <vers num="5.5.19"/>
        <vers num="5.5.20"/>
        <vers num="5.5.21"/>
        <vers num="5.5.22"/>
        <vers num="5.5.23"/>
        <vers num="5.5.24"/>
        <vers num="5.5.25" edition="a"/>
        <vers num="5.5.26"/>
        <vers num="5.5.27"/>
        <vers num="5.5.28"/>
        <vers num="5.5.29"/>
        <vers num="5.5.30"/>
        <vers num="5.5.31"/>
        <vers num="5.5.32"/>
        <vers num="5.5.33"/>
        <vers prev="1" num="5.5.34"/>
        <vers num="5.6.0"/>
        <vers num="5.6.1"/>
        <vers num="5.6.10"/>
        <vers num="5.6.11"/>
        <vers num="5.6.12"/>
        <vers num="5.6.13"/>
        <vers prev="1" num="5.6.14"/>
        <vers num="5.6.2"/>
        <vers num="5.6.3"/>
        <vers num="5.6.4"/>
        <vers num="5.6.5"/>
        <vers num="5.6.6"/>
        <vers num="5.6.7"/>
        <vers num="5.6.8"/>
        <vers num="5.6.9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0402" published="2014-01-15" name="CVE-2014-0402" modified="2014-03-05" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:N/I:N/A:P)" CVSS_score="4.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.0" CVSS_base_score="4.0">
    <desc>
      <descript source="cve">Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.71 and earlier, 5.5.33 and earlier, and 5.6.13 and earlier allows remote authenticated users to affect availability via unknown vectors related to Locking.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90379" source="XF">oracle-cpujan2014-cve20140402(90379)</ref>
      <ref url="http://www.securityfocus.com/bid/64908" source="BID">64908</ref>
      <ref url="http://www.securityfocus.com/bid/64758" source="BID">64758</ref>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2848" source="DEBIAN">DSA-2848</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2845" source="DEBIAN">DSA-2845</ref>
      <ref url="http://ubuntu.com/usn/usn-2086-1" source="UBUNTU">USN-2086-1</ref>
      <ref url="http://secunia.com/advisories/56580" source="SECUNIA">56580</ref>
      <ref url="http://secunia.com/advisories/56541" source="SECUNIA">56541</ref>
      <ref url="http://secunia.com/advisories/56491" source="SECUNIA">56491</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0189.html" source="REDHAT">RHSA-2014:0189</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0186.html" source="REDHAT">RHSA-2014:0186</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0173.html" source="REDHAT">RHSA-2014:0173</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0164.html" source="REDHAT">RHSA-2014:0164</ref>
      <ref url="http://osvdb.org/102068" source="OSVDB">102068</ref>
    </refs>
    <vuln_soft>
      <prod vendor="mysql" name="mysql">
        <vers num="5.1"/>
        <vers num="5.1.1"/>
        <vers num="5.1.10"/>
        <vers num="5.1.11"/>
        <vers num="5.1.12"/>
        <vers num="5.1.13"/>
        <vers num="5.1.14"/>
        <vers num="5.1.15"/>
        <vers num="5.1.16"/>
        <vers num="5.1.17"/>
        <vers num="5.1.18"/>
        <vers num="5.1.19"/>
        <vers num="5.1.2"/>
        <vers num="5.1.20"/>
        <vers num="5.1.21"/>
        <vers num="5.1.22"/>
        <vers num="5.1.23" edition="a"/>
        <vers num="5.1.23_bk"/>
        <vers num="5.1.23a"/>
        <vers num="5.1.24"/>
        <vers num="5.1.25"/>
        <vers num="5.1.26"/>
        <vers num="5.1.27"/>
        <vers num="5.1.28"/>
        <vers num="5.1.29"/>
        <vers num="5.1.3"/>
        <vers num="5.1.30"/>
        <vers num="5.1.31" edition="sp1"/>
        <vers num="5.1.32"/>
        <vers num="5.1.32-bzr"/>
        <vers num="5.1.33"/>
        <vers num="5.1.34" edition="sp1"/>
        <vers num="5.1.35"/>
        <vers num="5.1.36"/>
        <vers num="5.1.37" edition="sp1"/>
        <vers num="5.1.38"/>
        <vers num="5.1.39"/>
        <vers num="5.1.4"/>
        <vers num="5.1.40" edition="sp1"/>
        <vers num="5.1.41"/>
        <vers num="5.1.42"/>
        <vers num="5.1.43" edition="sp1"/>
        <vers num="5.1.44"/>
        <vers num="5.1.45"/>
        <vers num="5.1.46" edition="sp1"/>
        <vers num="5.1.47"/>
        <vers num="5.1.48"/>
        <vers num="5.1.49" edition="sp1"/>
        <vers num="5.1.5"/>
        <vers num="5.1.50"/>
        <vers num="5.1.5a"/>
        <vers num="5.1.6"/>
        <vers num="5.1.7"/>
        <vers num="5.1.8"/>
        <vers num="5.1.9"/>
        <vers num="5.5.0"/>
        <vers num="5.5.1"/>
        <vers num="5.5.2"/>
        <vers num="5.5.3"/>
        <vers num="5.5.4"/>
        <vers num="5.5.5"/>
        <vers num="5.5.6"/>
        <vers num="5.5.7"/>
        <vers num="5.5.8"/>
        <vers num="5.5.9"/>
      </prod>
      <prod vendor="oracle" name="mysql">
        <vers num="5.1.51"/>
        <vers num="5.1.52" edition="sp1"/>
        <vers num="5.1.53"/>
        <vers num="5.1.54"/>
        <vers num="5.1.55"/>
        <vers num="5.1.56"/>
        <vers num="5.1.57"/>
        <vers num="5.1.58"/>
        <vers num="5.1.59"/>
        <vers num="5.1.60"/>
        <vers num="5.1.61"/>
        <vers num="5.1.62"/>
        <vers num="5.1.63"/>
        <vers num="5.1.64"/>
        <vers num="5.1.65"/>
        <vers num="5.1.66"/>
        <vers num="5.1.67"/>
        <vers num="5.1.68"/>
        <vers num="5.1.69"/>
        <vers num="5.1.70"/>
        <vers prev="1" num="5.1.71"/>
        <vers num="5.5.10"/>
        <vers num="5.5.11"/>
        <vers num="5.5.12"/>
        <vers num="5.5.13"/>
        <vers num="5.5.14"/>
        <vers num="5.5.15"/>
        <vers num="5.5.16"/>
        <vers num="5.5.17"/>
        <vers num="5.5.18"/>
        <vers num="5.5.19"/>
        <vers num="5.5.20"/>
        <vers num="5.5.21"/>
        <vers num="5.5.22"/>
        <vers num="5.5.23"/>
        <vers num="5.5.24"/>
        <vers num="5.5.25" edition="a"/>
        <vers num="5.5.26"/>
        <vers num="5.5.27"/>
        <vers num="5.5.28"/>
        <vers num="5.5.29"/>
        <vers num="5.5.30"/>
        <vers num="5.5.31"/>
        <vers num="5.5.32"/>
        <vers prev="1" num="5.5.33"/>
        <vers num="5.6.0"/>
        <vers num="5.6.1"/>
        <vers num="5.6.10"/>
        <vers num="5.6.11"/>
        <vers num="5.6.12"/>
        <vers prev="1" num="5.6.13"/>
        <vers num="5.6.2"/>
        <vers num="5.6.3"/>
        <vers num="5.6.4"/>
        <vers num="5.6.5"/>
        <vers num="5.6.6"/>
        <vers num="5.6.7"/>
        <vers num="5.6.8"/>
        <vers num="5.6.9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0403" published="2014-01-15" name="CVE-2014-0403" modified="2014-04-01" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:N)" CVSS_score="5.8" CVSS_impact_subscore="4.9" CVSS_exploit_subscore="8.6" CVSS_base_score="5.8">
    <desc>
      <descript source="cve">Unspecified vulnerability in Oracle Java SE 6u65 and 7u45 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Deployment, a different vulnerability than CVE-2013-5898 and CVE-2014-0375.</descript>
      <descript source="nvd">Per: http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html

"Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets."</descript>
    </desc>
    <loss_types>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90338" source="XF">oracle-cpujan2014-cve20140403(90338)</ref>
      <ref url="http://www.securitytracker.com/id/1029608" source="SECTRACK">1029608</ref>
      <ref url="http://www.securityfocus.com/bid/64920" source="BID">64920</ref>
      <ref url="http://www.securityfocus.com/bid/64758" source="BID">64758</ref>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html</ref>
      <ref url="http://secunia.com/advisories/56535" source="SECUNIA">56535</ref>
      <ref url="http://secunia.com/advisories/56485" source="SECUNIA">56485</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0135.html" source="REDHAT">RHSA-2014:0135</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0134.html" source="REDHAT">RHSA-2014:0134</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0030.html" source="REDHAT">RHSA-2014:0030</ref>
      <ref url="http://osvdb.org/102006" source="OSVDB">102006</ref>
      <ref url="http://marc.info/?l=bugtraq&amp;m=139402749111889&amp;w=2" source="HP">SSRT101455</ref>
      <ref url="http://marc.info/?l=bugtraq&amp;m=139402749111889&amp;w=2" source="HP">HPSBUX02973</ref>
      <ref url="http://marc.info/?l=bugtraq&amp;m=139402697611681&amp;w=2" source="HP">HPSBUX02972</ref>
      <ref url="http://marc.info/?l=bugtraq&amp;m=139402697611681&amp;w=2" source="HP">SSRT101454</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00024.html" source="SUSE">SUSE-SU-2014:0451</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00012.html" source="SUSE">SUSE-SU-2014:0266</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00009.html" source="SUSE">SUSE-SU-2014:0246</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="jdk">
        <vers num="1.6.0" edition="update_65"/>
        <vers num="1.7.0" edition="update_45"/>
      </prod>
      <prod vendor="oracle" name="jre">
        <vers num="1.6.0" edition="update_65"/>
        <vers num="1.7.0" edition="update_45"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-0404" published="2014-01-15" name="CVE-2014-0404" modified="2014-03-26" CVSS_version="2.0" CVSS_vector="(AV:L/AC:H/Au:S/C:N/I:P/A:P)" CVSS_score="2.4" CVSS_impact_subscore="4.9" CVSS_exploit_subscore="1.5" CVSS_base_score="2.4">
    <desc>
      <descript source="cve">Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 3.2.20, 4.0.22, 4.1.30, 4.2.20, and 4.3.4 allows local users to affect integrity and availability via unknown vectors related to Core, a different vulnerability than CVE-2014-0406.</descript>
    </desc>
    <loss_types>
      <avail/>
      <int/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90372" source="XF">oracle-cpujan2014-cve20140404(90372)</ref>
      <ref url="http://www.securitytracker.com/id/1029610" source="SECTRACK">1029610</ref>
      <ref url="http://www.securityfocus.com/bid/64911" source="BID">64911</ref>
      <ref url="http://www.securityfocus.com/bid/64758" source="BID">64758</ref>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2878" source="DEBIAN">DSA-2878</ref>
      <ref url="http://secunia.com/advisories/56490" source="SECUNIA">56490</ref>
      <ref url="http://osvdb.org/102061" source="OSVDB">102061</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="vm_virtualbox">
        <vers num="3.2.0"/>
        <vers num="3.2.10"/>
        <vers num="3.2.12"/>
        <vers num="3.2.14"/>
        <vers num="3.2.16"/>
        <vers prev="1" num="3.2.18"/>
        <vers num="3.2.2"/>
        <vers num="3.2.4"/>
        <vers num="3.2.6"/>
        <vers num="3.2.8"/>
        <vers num="4.0"/>
        <vers num="4.0.0"/>
        <vers num="4.0.10"/>
        <vers num="4.0.12"/>
        <vers num="4.0.14"/>
        <vers num="4.0.16"/>
        <vers num="4.0.18"/>
        <vers num="4.0.2"/>
        <vers prev="1" num="4.0.20"/>
        <vers num="4.0.4"/>
        <vers num="4.0.6"/>
        <vers num="4.0.8"/>
        <vers num="4.1.0"/>
        <vers num="4.1.10"/>
        <vers num="4.1.12"/>
        <vers num="4.1.14"/>
        <vers num="4.1.16"/>
        <vers num="4.1.18"/>
        <vers num="4.1.2"/>
        <vers num="4.1.20"/>
        <vers num="4.1.22"/>
        <vers num="4.1.24"/>
        <vers num="4.1.26"/>
        <vers prev="1" num="4.1.28"/>
        <vers num="4.1.4"/>
        <vers num="4.1.6"/>
        <vers num="4.1.8"/>
        <vers num="4.2.0"/>
        <vers num="4.2.10"/>
        <vers num="4.2.12"/>
        <vers num="4.2.14"/>
        <vers num="4.2.16"/>
        <vers prev="1" num="4.2.18"/>
        <vers num="4.2.2"/>
        <vers num="4.2.4"/>
        <vers num="4.2.6"/>
        <vers num="4.2.8"/>
        <vers num="4.3.0"/>
        <vers prev="1" num="4.3.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-0405" published="2014-01-15" name="CVE-2014-0405" modified="2014-02-06" CVSS_version="2.0" CVSS_vector="(AV:L/AC:H/Au:S/C:P/I:P/A:P)" CVSS_score="3.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="1.5" CVSS_base_score="3.5">
    <desc>
      <descript source="cve">Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 3.2.20, 4.0.22, 4.1.30, 4.2.20, and 4.3.4 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Core.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90370" source="XF">oracle-cpujan2014-cve20140405(90370)</ref>
      <ref url="http://www.securitytracker.com/id/1029610" source="SECTRACK">1029610</ref>
      <ref url="http://www.securityfocus.com/bid/64900" source="BID">64900</ref>
      <ref url="http://www.securityfocus.com/bid/64758" source="BID">64758</ref>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html</ref>
      <ref url="http://secunia.com/advisories/56490" source="SECUNIA">56490</ref>
      <ref url="http://osvdb.org/102059" source="OSVDB">102059</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="vm_virtualbox">
        <vers num="3.2.0"/>
        <vers num="3.2.10"/>
        <vers num="3.2.12"/>
        <vers num="3.2.14"/>
        <vers num="3.2.16"/>
        <vers prev="1" num="3.2.18"/>
        <vers num="3.2.2"/>
        <vers num="3.2.4"/>
        <vers num="3.2.6"/>
        <vers num="3.2.8"/>
        <vers num="4.0"/>
        <vers num="4.0.0"/>
        <vers num="4.0.10"/>
        <vers num="4.0.12"/>
        <vers num="4.0.14"/>
        <vers num="4.0.16"/>
        <vers num="4.0.18"/>
        <vers num="4.0.2"/>
        <vers prev="1" num="4.0.20"/>
        <vers num="4.0.4"/>
        <vers num="4.0.6"/>
        <vers num="4.0.8"/>
        <vers num="4.1.0"/>
        <vers num="4.1.10"/>
        <vers num="4.1.12"/>
        <vers num="4.1.14"/>
        <vers num="4.1.16"/>
        <vers num="4.1.18"/>
        <vers num="4.1.2"/>
        <vers num="4.1.20"/>
        <vers num="4.1.22"/>
        <vers num="4.1.24"/>
        <vers num="4.1.26"/>
        <vers prev="1" num="4.1.28"/>
        <vers num="4.1.4"/>
        <vers num="4.1.6"/>
        <vers num="4.1.8"/>
        <vers num="4.2.0"/>
        <vers num="4.2.10"/>
        <vers num="4.2.12"/>
        <vers num="4.2.14"/>
        <vers num="4.2.16"/>
        <vers prev="1" num="4.2.18"/>
        <vers num="4.2.2"/>
        <vers num="4.2.4"/>
        <vers num="4.2.6"/>
        <vers num="4.2.8"/>
        <vers num="4.3.0"/>
        <vers prev="1" num="4.3.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-0406" published="2014-01-15" name="CVE-2014-0406" modified="2014-03-26" CVSS_version="2.0" CVSS_vector="(AV:L/AC:H/Au:S/C:N/I:P/A:P)" CVSS_score="2.4" CVSS_impact_subscore="4.9" CVSS_exploit_subscore="1.5" CVSS_base_score="2.4">
    <desc>
      <descript source="cve">Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 3.2.20, 4.0.22, 4.1.30, 4.2.20, and 4.3.4 allows local users to affect integrity and availability via unknown vectors related to Core, a different vulnerability than CVE-2014-0404.</descript>
    </desc>
    <loss_types>
      <avail/>
      <int/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90371" source="XF">oracle-cpujan2014-cve20140406(90371)</ref>
      <ref url="http://www.securitytracker.com/id/1029610" source="SECTRACK">1029610</ref>
      <ref url="http://www.securityfocus.com/bid/64905" source="BID">64905</ref>
      <ref url="http://www.securityfocus.com/bid/64758" source="BID">64758</ref>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2878" source="DEBIAN">DSA-2878</ref>
      <ref url="http://secunia.com/advisories/56490" source="SECUNIA">56490</ref>
      <ref url="http://osvdb.org/102060" source="OSVDB">102060</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="vm_virtualbox">
        <vers num="3.2.0"/>
        <vers num="3.2.10"/>
        <vers num="3.2.12"/>
        <vers num="3.2.14"/>
        <vers num="3.2.16"/>
        <vers prev="1" num="3.2.18"/>
        <vers num="3.2.2"/>
        <vers num="3.2.4"/>
        <vers num="3.2.6"/>
        <vers num="3.2.8"/>
        <vers num="4.0"/>
        <vers num="4.0.0"/>
        <vers num="4.0.10"/>
        <vers num="4.0.12"/>
        <vers num="4.0.14"/>
        <vers num="4.0.16"/>
        <vers num="4.0.18"/>
        <vers num="4.0.2"/>
        <vers prev="1" num="4.0.20"/>
        <vers num="4.0.4"/>
        <vers num="4.0.6"/>
        <vers num="4.0.8"/>
        <vers num="4.1.0"/>
        <vers num="4.1.10"/>
        <vers num="4.1.12"/>
        <vers num="4.1.14"/>
        <vers num="4.1.16"/>
        <vers num="4.1.18"/>
        <vers num="4.1.2"/>
        <vers num="4.1.20"/>
        <vers num="4.1.22"/>
        <vers num="4.1.24"/>
        <vers num="4.1.26"/>
        <vers prev="1" num="4.1.28"/>
        <vers num="4.1.4"/>
        <vers num="4.1.6"/>
        <vers num="4.1.8"/>
        <vers num="4.2.0"/>
        <vers num="4.2.10"/>
        <vers num="4.2.12"/>
        <vers num="4.2.14"/>
        <vers num="4.2.16"/>
        <vers prev="1" num="4.2.18"/>
        <vers num="4.2.2"/>
        <vers num="4.2.4"/>
        <vers num="4.2.6"/>
        <vers num="4.2.8"/>
        <vers num="4.3.0"/>
        <vers prev="1" num="4.3.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-0407" published="2014-01-15" name="CVE-2014-0407" modified="2014-03-26" CVSS_version="2.0" CVSS_vector="(AV:L/AC:H/Au:S/C:P/I:P/A:P)" CVSS_score="3.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="1.5" CVSS_base_score="3.5">
    <desc>
      <descript source="cve">Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 3.2.20, 4.0.22, 4.1.30, 4.2.20, and 4.3.4 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Core.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90369" source="XF">oracle-cpujan2014-cve20140407(90369)</ref>
      <ref url="http://www.securitytracker.com/id/1029610" source="SECTRACK">1029610</ref>
      <ref url="http://www.securityfocus.com/bid/64913" source="BID">64913</ref>
      <ref url="http://www.securityfocus.com/bid/64758" source="BID">64758</ref>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2878" source="DEBIAN">DSA-2878</ref>
      <ref url="http://secunia.com/advisories/56490" source="SECUNIA">56490</ref>
      <ref url="http://osvdb.org/102058" source="OSVDB">102058</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="vm_virtualbox">
        <vers num="3.2.0"/>
        <vers num="3.2.10"/>
        <vers num="3.2.12"/>
        <vers num="3.2.14"/>
        <vers num="3.2.16"/>
        <vers prev="1" num="3.2.18"/>
        <vers num="3.2.2"/>
        <vers num="3.2.4"/>
        <vers num="3.2.6"/>
        <vers num="3.2.8"/>
        <vers num="4.0"/>
        <vers num="4.0.0"/>
        <vers num="4.0.10"/>
        <vers num="4.0.12"/>
        <vers num="4.0.14"/>
        <vers num="4.0.16"/>
        <vers num="4.0.18"/>
        <vers num="4.0.2"/>
        <vers prev="1" num="4.0.20"/>
        <vers num="4.0.4"/>
        <vers num="4.0.6"/>
        <vers num="4.0.8"/>
        <vers num="4.1.0"/>
        <vers num="4.1.10"/>
        <vers num="4.1.12"/>
        <vers num="4.1.14"/>
        <vers num="4.1.16"/>
        <vers num="4.1.18"/>
        <vers num="4.1.2"/>
        <vers num="4.1.20"/>
        <vers num="4.1.22"/>
        <vers num="4.1.24"/>
        <vers num="4.1.26"/>
        <vers prev="1" num="4.1.28"/>
        <vers num="4.1.4"/>
        <vers num="4.1.6"/>
        <vers num="4.1.8"/>
        <vers num="4.2.0"/>
        <vers num="4.2.10"/>
        <vers num="4.2.12"/>
        <vers num="4.2.14"/>
        <vers num="4.2.16"/>
        <vers prev="1" num="4.2.18"/>
        <vers num="4.2.2"/>
        <vers num="4.2.4"/>
        <vers num="4.2.6"/>
        <vers num="4.2.8"/>
        <vers num="4.3.0"/>
        <vers prev="1" num="4.3.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0408" published="2014-01-15" name="CVE-2014-0408" modified="2014-03-05" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">Unspecified vulnerability in Oracle Java SE 7u45, when running on OS X, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot.</descript>
      <descript source="nvd">Per: http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html

"Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets."</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.ubuntu.com/usn/USN-2089-1" source="UBUNTU">USN-2089-1</ref>
      <ref url="http://www.securitytracker.com/id/1029608" source="SECTRACK">1029608</ref>
      <ref url="http://www.securityfocus.com/bid/64910" source="BID">64910</ref>
      <ref url="http://www.securityfocus.com/bid/64758" source="BID">64758</ref>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html</ref>
      <ref url="http://secunia.com/advisories/56485" source="SECUNIA">56485</ref>
      <ref url="http://osvdb.org/101999" source="OSVDB">101999</ref>
      <ref url="http://lists.opensuse.org/opensuse-updates/2014-02/msg00000.html" source="SUSE">openSUSE-SU-2014:0180</ref>
      <ref url="http://lists.opensuse.org/opensuse-updates/2014-01/msg00107.html" source="SUSE">openSUSE-SU-2014:0177</ref>
      <ref url="http://lists.opensuse.org/opensuse-updates/2014-01/msg00105.html" source="SUSE">openSUSE-SU-2014:0174</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="jdk">
        <vers num="1.7.0" edition="update_45"/>
      </prod>
      <prod vendor="oracle" name="jre">
        <vers num="1.7.0" edition="update_45"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0410" published="2014-01-15" name="CVE-2014-0410" modified="2014-04-01" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:C/I:C/A:C)" CVSS_score="10.0" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="10.0" CVSS_base_score="10.0">
    <desc>
      <descript source="cve">Unspecified vulnerability in Oracle Java SE 6u65 and 7u45 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2013-5889, CVE-2013-5902, CVE-2014-0415, CVE-2014-0418, and CVE-2014-0424.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.securitytracker.com/id/1029608" source="SECTRACK">1029608</ref>
      <ref url="http://www.securityfocus.com/bid/64915" source="BID">64915</ref>
      <ref url="http://www.securityfocus.com/bid/64758" source="BID">64758</ref>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html</ref>
      <ref url="http://secunia.com/advisories/56535" source="SECUNIA">56535</ref>
      <ref url="http://secunia.com/advisories/56485" source="SECUNIA">56485</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0135.html" source="REDHAT">RHSA-2014:0135</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0134.html" source="REDHAT">RHSA-2014:0134</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0030.html" source="REDHAT">RHSA-2014:0030</ref>
      <ref url="http://osvdb.org/102024" source="OSVDB">102024</ref>
      <ref url="http://marc.info/?l=bugtraq&amp;m=139402749111889&amp;w=2" source="HP">SSRT101455</ref>
      <ref url="http://marc.info/?l=bugtraq&amp;m=139402749111889&amp;w=2" source="HP">HPSBUX02973</ref>
      <ref url="http://marc.info/?l=bugtraq&amp;m=139402697611681&amp;w=2" source="HP">HPSBUX02972</ref>
      <ref url="http://marc.info/?l=bugtraq&amp;m=139402697611681&amp;w=2" source="HP">SSRT101454</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00024.html" source="SUSE">SUSE-SU-2014:0451</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00012.html" source="SUSE">SUSE-SU-2014:0266</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00009.html" source="SUSE">SUSE-SU-2014:0246</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="jdk">
        <vers num="1.6.0" edition="update_65"/>
        <vers num="1.7.0" edition="update_45"/>
      </prod>
      <prod vendor="oracle" name="jre">
        <vers num="1.6.0" edition="update_65"/>
        <vers num="1.7.0" edition="update_45"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0411" published="2014-01-15" name="CVE-2014-0411" modified="2014-04-01" CVSS_version="2.0" CVSS_vector="(AV:N/AC:H/Au:N/C:P/I:P/A:N)" CVSS_score="4.0" CVSS_impact_subscore="4.9" CVSS_exploit_subscore="4.9" CVSS_base_score="4.0">
    <desc>
      <descript source="cve">Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; JRockit R27.7.7 and R28.2.9; Java SE Embedded 7u45; and OpenJDK 7 allows remote attackers to affect confidentiality and integrity via vectors related to JSSE.  NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that this issue allows remote attackers to obtain sensitive information about encryption keys via a timing discrepancy during the TLS/SSL handshake.</descript>
    </desc>
    <loss_types>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://bugzilla.redhat.com/show_bug.cgi?id=1053010" source="CONFIRM">https://bugzilla.redhat.com/show_bug.cgi?id=1053010</ref>
      <ref url="http://xforce.iss.net/xforce/xfdb/90357" source="XF">oracle-cpujan2014-cve20140411(90357)</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2124-1" source="UBUNTU">USN-2124-1</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2089-1" source="UBUNTU">USN-2089-1</ref>
      <ref url="http://www.securitytracker.com/id/1029608" source="SECTRACK">1029608</ref>
      <ref url="http://www.securityfocus.com/bid/64918" source="BID">64918</ref>
      <ref url="http://www.securityfocus.com/bid/64758" source="BID">64758</ref>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html</ref>
      <ref url="http://secunia.com/advisories/56535" source="SECUNIA">56535</ref>
      <ref url="http://secunia.com/advisories/56487" source="SECUNIA">56487</ref>
      <ref url="http://secunia.com/advisories/56486" source="SECUNIA">56486</ref>
      <ref url="http://secunia.com/advisories/56485" source="SECUNIA">56485</ref>
      <ref url="http://secunia.com/advisories/56432" source="SECUNIA">56432</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0136.html" source="REDHAT">RHSA-2014:0136</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0135.html" source="REDHAT">RHSA-2014:0135</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0134.html" source="REDHAT">RHSA-2014:0134</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0097.html" source="REDHAT">RHSA-2014:0097</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0030.html" source="REDHAT">RHSA-2014:0030</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0027.html" source="REDHAT">RHSA-2014:0027</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0026.html" source="REDHAT">RHSA-2014:0026</ref>
      <ref url="http://osvdb.org/102028" source="OSVDB">102028</ref>
      <ref url="http://marc.info/?l=bugtraq&amp;m=139402749111889&amp;w=2" source="HP">SSRT101455</ref>
      <ref url="http://marc.info/?l=bugtraq&amp;m=139402749111889&amp;w=2" source="HP">HPSBUX02973</ref>
      <ref url="http://marc.info/?l=bugtraq&amp;m=139402697611681&amp;w=2" source="HP">HPSBUX02972</ref>
      <ref url="http://marc.info/?l=bugtraq&amp;m=139402697611681&amp;w=2" source="HP">SSRT101454</ref>
      <ref url="http://lists.opensuse.org/opensuse-updates/2014-02/msg00000.html" source="SUSE">openSUSE-SU-2014:0180</ref>
      <ref url="http://lists.opensuse.org/opensuse-updates/2014-01/msg00107.html" source="SUSE">openSUSE-SU-2014:0177</ref>
      <ref url="http://lists.opensuse.org/opensuse-updates/2014-01/msg00105.html" source="SUSE">openSUSE-SU-2014:0174</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00024.html" source="SUSE">SUSE-SU-2014:0451</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00012.html" source="SUSE">SUSE-SU-2014:0266</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00009.html" source="SUSE">SUSE-SU-2014:0246</ref>
      <ref url="http://hg.openjdk.java.net/jdk7u/jdk7u/jdk/rev/d533e96c7acc" source="CONFIRM">http://hg.openjdk.java.net/jdk7u/jdk7u/jdk/rev/d533e96c7acc</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="jdk">
        <vers num="1.5.0" edition="update_55"/>
        <vers num="1.6.0" edition="update_65"/>
        <vers num="1.7.0" edition="update_45"/>
      </prod>
      <prod vendor="oracle" name="jre">
        <vers num="1.5.0" edition="update_55"/>
        <vers num="1.6.0" edition="update_65"/>
        <vers num="1.7.0" edition="update_45"/>
      </prod>
      <prod vendor="oracle" name="jrockit">
        <vers num="r27.7.7"/>
        <vers num="r28.2.9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0412" published="2014-01-15" name="CVE-2014-0412" modified="2014-03-05" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:N/I:N/A:P)" CVSS_score="4.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.0" CVSS_base_score="4.0">
    <desc>
      <descript source="cve">Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.72 and earlier, 5.5.34 and earlier, and 5.6.14 and earlier allows remote authenticated users to affect availability via unknown vectors related to InnoDB.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90378" source="XF">oracle-cpujan2014-cve20140412(90378)</ref>
      <ref url="http://www.securityfocus.com/bid/64880" source="BID">64880</ref>
      <ref url="http://www.securityfocus.com/bid/64758" source="BID">64758</ref>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2848" source="DEBIAN">DSA-2848</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2845" source="DEBIAN">DSA-2845</ref>
      <ref url="http://ubuntu.com/usn/usn-2086-1" source="UBUNTU">USN-2086-1</ref>
      <ref url="http://secunia.com/advisories/56580" source="SECUNIA">56580</ref>
      <ref url="http://secunia.com/advisories/56541" source="SECUNIA">56541</ref>
      <ref url="http://secunia.com/advisories/56491" source="SECUNIA">56491</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0189.html" source="REDHAT">RHSA-2014:0189</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0186.html" source="REDHAT">RHSA-2014:0186</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0173.html" source="REDHAT">RHSA-2014:0173</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0164.html" source="REDHAT">RHSA-2014:0164</ref>
      <ref url="http://osvdb.org/102067" source="OSVDB">102067</ref>
    </refs>
    <vuln_soft>
      <prod vendor="mysql" name="mysql">
        <vers num="5.1"/>
        <vers num="5.1.1"/>
        <vers num="5.1.10"/>
        <vers num="5.1.11"/>
        <vers num="5.1.12"/>
        <vers num="5.1.13"/>
        <vers num="5.1.14"/>
        <vers num="5.1.15"/>
        <vers num="5.1.16"/>
        <vers num="5.1.17"/>
        <vers num="5.1.18"/>
        <vers num="5.1.19"/>
        <vers num="5.1.2"/>
        <vers num="5.1.20"/>
        <vers num="5.1.21"/>
        <vers num="5.1.22"/>
        <vers num="5.1.23" edition="a"/>
        <vers num="5.1.23_bk"/>
        <vers num="5.1.23a"/>
        <vers num="5.1.24"/>
        <vers num="5.1.25"/>
        <vers num="5.1.26"/>
        <vers num="5.1.27"/>
        <vers num="5.1.28"/>
        <vers num="5.1.29"/>
        <vers num="5.1.3"/>
        <vers num="5.1.30"/>
        <vers num="5.1.31" edition="sp1"/>
        <vers num="5.1.32"/>
        <vers num="5.1.32-bzr"/>
        <vers num="5.1.33"/>
        <vers num="5.1.34" edition="sp1"/>
        <vers num="5.1.35"/>
        <vers num="5.1.36"/>
        <vers num="5.1.37" edition="sp1"/>
        <vers num="5.1.38"/>
        <vers num="5.1.39"/>
        <vers num="5.1.4"/>
        <vers num="5.1.40" edition="sp1"/>
        <vers num="5.1.41"/>
        <vers num="5.1.42"/>
        <vers num="5.1.43" edition="sp1"/>
        <vers num="5.1.44"/>
        <vers num="5.1.45"/>
        <vers num="5.1.46" edition="sp1"/>
        <vers num="5.1.47"/>
        <vers num="5.1.48"/>
        <vers num="5.1.49" edition="sp1"/>
        <vers num="5.1.5"/>
        <vers num="5.1.50"/>
        <vers num="5.1.5a"/>
        <vers num="5.1.6"/>
        <vers num="5.1.7"/>
        <vers num="5.1.8"/>
        <vers num="5.1.9"/>
        <vers num="5.5.0"/>
        <vers num="5.5.1"/>
        <vers num="5.5.2"/>
        <vers num="5.5.3"/>
        <vers num="5.5.4"/>
        <vers num="5.5.5"/>
        <vers num="5.5.6"/>
        <vers num="5.5.7"/>
        <vers num="5.5.8"/>
        <vers num="5.5.9"/>
      </prod>
      <prod vendor="oracle" name="mysql">
        <vers num="5.1.51"/>
        <vers num="5.1.52" edition="sp1"/>
        <vers num="5.1.53"/>
        <vers num="5.1.54"/>
        <vers num="5.1.55"/>
        <vers num="5.1.56"/>
        <vers num="5.1.57"/>
        <vers num="5.1.58"/>
        <vers num="5.1.59"/>
        <vers num="5.1.60"/>
        <vers num="5.1.61"/>
        <vers num="5.1.62"/>
        <vers num="5.1.63"/>
        <vers num="5.1.64"/>
        <vers num="5.1.65"/>
        <vers num="5.1.66"/>
        <vers num="5.1.67"/>
        <vers num="5.1.68"/>
        <vers num="5.1.69"/>
        <vers num="5.1.70"/>
        <vers num="5.1.71"/>
        <vers prev="1" num="5.1.72"/>
        <vers num="5.5.10"/>
        <vers num="5.5.11"/>
        <vers num="5.5.12"/>
        <vers num="5.5.13"/>
        <vers num="5.5.14"/>
        <vers num="5.5.15"/>
        <vers num="5.5.16"/>
        <vers num="5.5.17"/>
        <vers num="5.5.18"/>
        <vers num="5.5.19"/>
        <vers num="5.5.20"/>
        <vers num="5.5.21"/>
        <vers num="5.5.22"/>
        <vers num="5.5.23"/>
        <vers num="5.5.24"/>
        <vers num="5.5.25" edition="a"/>
        <vers num="5.5.26"/>
        <vers num="5.5.27"/>
        <vers num="5.5.28"/>
        <vers num="5.5.29"/>
        <vers num="5.5.30"/>
        <vers num="5.5.31"/>
        <vers num="5.5.32"/>
        <vers num="5.5.33"/>
        <vers prev="1" num="5.5.34"/>
        <vers num="5.6.0"/>
        <vers num="5.6.1"/>
        <vers num="5.6.10"/>
        <vers num="5.6.11"/>
        <vers num="5.6.12"/>
        <vers num="5.6.13"/>
        <vers prev="1" num="5.6.14"/>
        <vers num="5.6.2"/>
        <vers num="5.6.3"/>
        <vers num="5.6.4"/>
        <vers num="5.6.5"/>
        <vers num="5.6.6"/>
        <vers num="5.6.7"/>
        <vers num="5.6.8"/>
        <vers num="5.6.9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0413" published="2014-04-15" name="CVE-2014-0413" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Unspecified vulnerability in the Oracle Containers for J2EE component in Oracle Fusion Middleware 10.1.3.5 allows remote attackers to affect integrity via vectors related to HTTP Request Handling, a different vulnerability than CVE-2014-0426.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="fusion_middleware">
        <vers num="10.1.3.5"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0414" published="2014-04-15" name="CVE-2014-0414" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:N/A:N)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">Unspecified vulnerability in the Oracle Containers for J2EE component in Oracle Fusion Middleware 10.1.3.5 allows remote attackers to affect confidentiality via vectors related to HTTP Request Handling.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="fusion_middleware">
        <vers num="10.1.3.5"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0415" published="2014-01-15" name="CVE-2014-0415" modified="2014-04-01" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:C/I:C/A:C)" CVSS_score="10.0" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="10.0" CVSS_base_score="10.0">
    <desc>
      <descript source="cve">Unspecified vulnerability in Oracle Java SE 6u65 and 7u45 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2013-5889, CVE-2013-5902, CVE-2014-0410, CVE-2014-0418, and CVE-2014-0424.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.securitytracker.com/id/1029608" source="SECTRACK">1029608</ref>
      <ref url="http://www.securityfocus.com/bid/64899" source="BID">64899</ref>
      <ref url="http://www.securityfocus.com/bid/64758" source="BID">64758</ref>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html</ref>
      <ref url="http://secunia.com/advisories/56535" source="SECUNIA">56535</ref>
      <ref url="http://secunia.com/advisories/56485" source="SECUNIA">56485</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0135.html" source="REDHAT">RHSA-2014:0135</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0134.html" source="REDHAT">RHSA-2014:0134</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0030.html" source="REDHAT">RHSA-2014:0030</ref>
      <ref url="http://osvdb.org/102025" source="OSVDB">102025</ref>
      <ref url="http://marc.info/?l=bugtraq&amp;m=139402749111889&amp;w=2" source="HP">SSRT101455</ref>
      <ref url="http://marc.info/?l=bugtraq&amp;m=139402749111889&amp;w=2" source="HP">HPSBUX02973</ref>
      <ref url="http://marc.info/?l=bugtraq&amp;m=139402697611681&amp;w=2" source="HP">HPSBUX02972</ref>
      <ref url="http://marc.info/?l=bugtraq&amp;m=139402697611681&amp;w=2" source="HP">SSRT101454</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00024.html" source="SUSE">SUSE-SU-2014:0451</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00012.html" source="SUSE">SUSE-SU-2014:0266</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00009.html" source="SUSE">SUSE-SU-2014:0246</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="jdk">
        <vers num="1.6.0" edition="update_65"/>
        <vers num="1.7.0" edition="update_45"/>
      </prod>
      <prod vendor="oracle" name="jre">
        <vers num="1.6.0" edition="update_65"/>
        <vers num="1.7.0" edition="update_45"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0416" published="2014-01-15" name="CVE-2014-0416" modified="2014-04-01" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:P/A:N)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; Java SE Embedded 7u45; and OpenJDK 7 allows remote attackers to affect integrity via vectors related to JAAS.  NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that the issue is related to how principals are set for the Subject class, which allows attackers to escape the sandbox using deserialization of a crafted Subject instance.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://bugzilla.redhat.com/show_bug.cgi?id=1051912" source="CONFIRM">https://bugzilla.redhat.com/show_bug.cgi?id=1051912</ref>
      <ref url="http://xforce.iss.net/xforce/xfdb/90349" source="XF">oracle-cpujan2014-cve20140416(90349)</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2124-1" source="UBUNTU">USN-2124-1</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2089-1" source="UBUNTU">USN-2089-1</ref>
      <ref url="http://www.securitytracker.com/id/1029608" source="SECTRACK">1029608</ref>
      <ref url="http://www.securityfocus.com/bid/64937" source="BID">64937</ref>
      <ref url="http://www.securityfocus.com/bid/64758" source="BID">64758</ref>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html</ref>
      <ref url="http://secunia.com/advisories/56535" source="SECUNIA">56535</ref>
      <ref url="http://secunia.com/advisories/56486" source="SECUNIA">56486</ref>
      <ref url="http://secunia.com/advisories/56485" source="SECUNIA">56485</ref>
      <ref url="http://secunia.com/advisories/56432" source="SECUNIA">56432</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0136.html" source="REDHAT">RHSA-2014:0136</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0135.html" source="REDHAT">RHSA-2014:0135</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0134.html" source="REDHAT">RHSA-2014:0134</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0097.html" source="REDHAT">RHSA-2014:0097</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0030.html" source="REDHAT">RHSA-2014:0030</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0027.html" source="REDHAT">RHSA-2014:0027</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0026.html" source="REDHAT">RHSA-2014:0026</ref>
      <ref url="http://osvdb.org/102017" source="OSVDB">102017</ref>
      <ref url="http://marc.info/?l=bugtraq&amp;m=139402749111889&amp;w=2" source="HP">SSRT101455</ref>
      <ref url="http://marc.info/?l=bugtraq&amp;m=139402749111889&amp;w=2" source="HP">HPSBUX02973</ref>
      <ref url="http://marc.info/?l=bugtraq&amp;m=139402697611681&amp;w=2" source="HP">HPSBUX02972</ref>
      <ref url="http://marc.info/?l=bugtraq&amp;m=139402697611681&amp;w=2" source="HP">SSRT101454</ref>
      <ref url="http://lists.opensuse.org/opensuse-updates/2014-02/msg00000.html" source="SUSE">openSUSE-SU-2014:0180</ref>
      <ref url="http://lists.opensuse.org/opensuse-updates/2014-01/msg00107.html" source="SUSE">openSUSE-SU-2014:0177</ref>
      <ref url="http://lists.opensuse.org/opensuse-updates/2014-01/msg00105.html" source="SUSE">openSUSE-SU-2014:0174</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00024.html" source="SUSE">SUSE-SU-2014:0451</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00012.html" source="SUSE">SUSE-SU-2014:0266</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00009.html" source="SUSE">SUSE-SU-2014:0246</ref>
      <ref url="http://hg.openjdk.java.net/jdk7u/jdk7u/jdk/rev/abe1cb2d27cb" source="MISC">http://hg.openjdk.java.net/jdk7u/jdk7u/jdk/rev/abe1cb2d27cb</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="jdk">
        <vers num="1.5.0" edition="update_55"/>
        <vers num="1.6.0" edition="update_65"/>
        <vers num="1.7.0" edition="update_45"/>
      </prod>
      <prod vendor="oracle" name="jre">
        <vers num="1.5.0" edition="update_55"/>
        <vers num="1.6.0" edition="update_65"/>
        <vers num="1.7.0" edition="update_45"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0417" published="2014-01-15" name="CVE-2014-0417" modified="2014-04-01" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; JavaFX 2.2.45; and Java SE Embedded 7u45 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.securitytracker.com/id/1029608" source="SECTRACK">1029608</ref>
      <ref url="http://www.securityfocus.com/bid/64932" source="BID">64932</ref>
      <ref url="http://www.securityfocus.com/bid/64758" source="BID">64758</ref>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html</ref>
      <ref url="http://secunia.com/advisories/56535" source="SECUNIA">56535</ref>
      <ref url="http://secunia.com/advisories/56486" source="SECUNIA">56486</ref>
      <ref url="http://secunia.com/advisories/56485" source="SECUNIA">56485</ref>
      <ref url="http://secunia.com/advisories/56484" source="SECUNIA">56484</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0136.html" source="REDHAT">RHSA-2014:0136</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0135.html" source="REDHAT">RHSA-2014:0135</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0134.html" source="REDHAT">RHSA-2014:0134</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0030.html" source="REDHAT">RHSA-2014:0030</ref>
      <ref url="http://osvdb.org/102001" source="OSVDB">102001</ref>
      <ref url="http://marc.info/?l=bugtraq&amp;m=139402749111889&amp;w=2" source="HP">SSRT101455</ref>
      <ref url="http://marc.info/?l=bugtraq&amp;m=139402749111889&amp;w=2" source="HP">HPSBUX02973</ref>
      <ref url="http://marc.info/?l=bugtraq&amp;m=139402697611681&amp;w=2" source="HP">HPSBUX02972</ref>
      <ref url="http://marc.info/?l=bugtraq&amp;m=139402697611681&amp;w=2" source="HP">SSRT101454</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00024.html" source="SUSE">SUSE-SU-2014:0451</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00012.html" source="SUSE">SUSE-SU-2014:0266</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00009.html" source="SUSE">SUSE-SU-2014:0246</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="javafx">
        <vers num="2.2.45"/>
      </prod>
      <prod vendor="oracle" name="jdk">
        <vers num="1.5.0" edition="update_55"/>
        <vers num="1.6.0" edition="update_65"/>
        <vers num="1.7.0" edition="update_45"/>
      </prod>
      <prod vendor="oracle" name="jre">
        <vers num="1.5.0" edition="update_55"/>
        <vers num="1.6.0" edition="update_65"/>
        <vers num="1.7.0" edition="update_45"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0418" published="2014-01-15" name="CVE-2014-0418" modified="2014-03-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:H/Au:N/C:P/I:P/A:P)" CVSS_score="5.1" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="4.9" CVSS_base_score="5.1">
    <desc>
      <descript source="cve">Unspecified vulnerability in Oracle Java SE 6u65 and 7u45 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2013-5889, CVE-2013-5902, CVE-2014-0410, CVE-2014-0415, and CVE-2014-0424.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90344" source="XF">oracle-cpujan2014-cve20140418(90344)</ref>
      <ref url="http://www.securitytracker.com/id/1029608" source="SECTRACK">1029608</ref>
      <ref url="http://www.securityfocus.com/bid/64917" source="BID">64917</ref>
      <ref url="http://www.securityfocus.com/bid/64758" source="BID">64758</ref>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html</ref>
      <ref url="http://secunia.com/advisories/56535" source="SECUNIA">56535</ref>
      <ref url="http://secunia.com/advisories/56485" source="SECUNIA">56485</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0030.html" source="REDHAT">RHSA-2014:0030</ref>
      <ref url="http://osvdb.org/102012" source="OSVDB">102012</ref>
      <ref url="http://marc.info/?l=bugtraq&amp;m=139402749111889&amp;w=2" source="HP">SSRT101455</ref>
      <ref url="http://marc.info/?l=bugtraq&amp;m=139402749111889&amp;w=2" source="HP">HPSBUX02973</ref>
      <ref url="http://marc.info/?l=bugtraq&amp;m=139402697611681&amp;w=2" source="HP">HPSBUX02972</ref>
      <ref url="http://marc.info/?l=bugtraq&amp;m=139402697611681&amp;w=2" source="HP">SSRT101454</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="jdk">
        <vers num="1.6.0" edition="update_65"/>
        <vers num="1.7.0" edition="update_45"/>
      </prod>
      <prod vendor="oracle" name="jre">
        <vers num="1.6.0" edition="update_65"/>
        <vers num="1.7.0" edition="update_45"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0419" published="2014-01-15" name="CVE-2014-0419" modified="2014-02-06" CVSS_version="2.0" CVSS_vector="(AV:N/AC:H/Au:N/C:P/I:P/A:P)" CVSS_score="5.1" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="4.9" CVSS_base_score="5.1">
    <desc>
      <descript source="cve">Unspecified vulnerability in the Oracle Secure Global Desktop (SGD) component in Oracle Virtualization SGD before 4.63 with December 2013 PSU, 4.71, 5.0 with December 2013 PSU, and 5.10 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Administration Console and Workspace Web Applications.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90367" source="XF">oracle-cpujan2014-cve20140419(90367)</ref>
      <ref url="http://www.securitytracker.com/id/1029610" source="SECTRACK">1029610</ref>
      <ref url="http://www.securityfocus.com/bid/64902" source="BID">64902</ref>
      <ref url="http://www.securityfocus.com/bid/64758" source="BID">64758</ref>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html</ref>
      <ref url="http://osvdb.org/102110" source="OSVDB">102110</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="virtualization_secure_global_desktop">
        <vers num="4.63"/>
        <vers num="4.71"/>
        <vers num="5.0"/>
        <vers num="5.10"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-0420" published="2014-01-15" name="CVE-2014-0420" modified="2014-03-05" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:M/C:N/I:N/A:P)" CVSS_score="2.8" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="5.5" CVSS_base_score="2.8">
    <desc>
      <descript source="cve">Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.34 and earlier, and 5.6.14 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Replication.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90388" source="XF">oracle-cpujan2014-cve20140420(90388)</ref>
      <ref url="http://www.securityfocus.com/bid/64888" source="BID">64888</ref>
      <ref url="http://www.securityfocus.com/bid/64758" source="BID">64758</ref>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2848" source="DEBIAN">DSA-2848</ref>
      <ref url="http://ubuntu.com/usn/usn-2086-1" source="UBUNTU">USN-2086-1</ref>
      <ref url="http://secunia.com/advisories/56580" source="SECUNIA">56580</ref>
      <ref url="http://secunia.com/advisories/56491" source="SECUNIA">56491</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0189.html" source="REDHAT">RHSA-2014:0189</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0186.html" source="REDHAT">RHSA-2014:0186</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0173.html" source="REDHAT">RHSA-2014:0173</ref>
      <ref url="http://osvdb.org/102077" source="OSVDB">102077</ref>
    </refs>
    <vuln_soft>
      <prod vendor="mysql" name="mysql">
        <vers num="5.5.0"/>
        <vers num="5.5.1"/>
        <vers num="5.5.2"/>
        <vers num="5.5.3"/>
        <vers num="5.5.4"/>
        <vers num="5.5.5"/>
        <vers num="5.5.6"/>
        <vers num="5.5.7"/>
        <vers num="5.5.8"/>
        <vers num="5.5.9"/>
      </prod>
      <prod vendor="oracle" name="mysql">
        <vers num="5.5.10"/>
        <vers num="5.5.11"/>
        <vers num="5.5.12"/>
        <vers num="5.5.13"/>
        <vers num="5.5.14"/>
        <vers num="5.5.15"/>
        <vers num="5.5.16"/>
        <vers num="5.5.17"/>
        <vers num="5.5.18"/>
        <vers num="5.5.19"/>
        <vers num="5.5.20"/>
        <vers num="5.5.21"/>
        <vers num="5.5.22"/>
        <vers num="5.5.23"/>
        <vers num="5.5.24"/>
        <vers num="5.5.25" edition="a"/>
        <vers num="5.5.26"/>
        <vers num="5.5.27"/>
        <vers num="5.5.28"/>
        <vers num="5.5.29"/>
        <vers num="5.5.30"/>
        <vers num="5.5.31"/>
        <vers num="5.5.32"/>
        <vers num="5.5.33"/>
        <vers prev="1" num="5.5.34"/>
        <vers num="5.6.0"/>
        <vers num="5.6.1"/>
        <vers num="5.6.10"/>
        <vers num="5.6.11"/>
        <vers num="5.6.12"/>
        <vers num="5.6.13"/>
        <vers prev="1" num="5.6.14"/>
        <vers num="5.6.2"/>
        <vers num="5.6.3"/>
        <vers num="5.6.4"/>
        <vers num="5.6.5"/>
        <vers num="5.6.6"/>
        <vers num="5.6.7"/>
        <vers num="5.6.8"/>
        <vers num="5.6.9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0421" published="2014-04-15" name="CVE-2014-0421" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:L/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="4.6" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="3.9" CVSS_base_score="4.6">
    <desc>
      <descript source="cve">Unspecified vulnerability in Oracle Solaris 10, when running on the SPARC64-X Platform, allows local users to affect confidentiality, integrity, and availability via unknown vectors.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="sun" name="sunos">
        <vers num="5.10" edition="-:sparc"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0422" published="2014-01-15" name="CVE-2014-0422" modified="2014-04-01" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:C/I:C/A:C)" CVSS_score="10.0" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="10.0" CVSS_base_score="10.0">
    <desc>
      <descript source="cve">Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; Java SE Embedded 7u45; and OpenJDK 7 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JNDI.  NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that the issue is related to missing package access checks in the Naming / JNDI component, which allows attackers to escape the sandbox.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://bugzilla.redhat.com/show_bug.cgi?id=1051528" source="CONFIRM">https://bugzilla.redhat.com/show_bug.cgi?id=1051528</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2124-1" source="UBUNTU">USN-2124-1</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2089-1" source="UBUNTU">USN-2089-1</ref>
      <ref url="http://www.securitytracker.com/id/1029608" source="SECTRACK">1029608</ref>
      <ref url="http://www.securityfocus.com/bid/64921" source="BID">64921</ref>
      <ref url="http://www.securityfocus.com/bid/64758" source="BID">64758</ref>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html</ref>
      <ref url="http://secunia.com/advisories/56535" source="SECUNIA">56535</ref>
      <ref url="http://secunia.com/advisories/56486" source="SECUNIA">56486</ref>
      <ref url="http://secunia.com/advisories/56485" source="SECUNIA">56485</ref>
      <ref url="http://secunia.com/advisories/56432" source="SECUNIA">56432</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0136.html" source="REDHAT">RHSA-2014:0136</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0135.html" source="REDHAT">RHSA-2014:0135</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0134.html" source="REDHAT">RHSA-2014:0134</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0097.html" source="REDHAT">RHSA-2014:0097</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0030.html" source="REDHAT">RHSA-2014:0030</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0027.html" source="REDHAT">RHSA-2014:0027</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0026.html" source="REDHAT">RHSA-2014:0026</ref>
      <ref url="http://osvdb.org/101997" source="OSVDB">101997</ref>
      <ref url="http://marc.info/?l=bugtraq&amp;m=139402749111889&amp;w=2" source="HP">SSRT101455</ref>
      <ref url="http://marc.info/?l=bugtraq&amp;m=139402749111889&amp;w=2" source="HP">HPSBUX02973</ref>
      <ref url="http://marc.info/?l=bugtraq&amp;m=139402697611681&amp;w=2" source="HP">HPSBUX02972</ref>
      <ref url="http://marc.info/?l=bugtraq&amp;m=139402697611681&amp;w=2" source="HP">SSRT101454</ref>
      <ref url="http://lists.opensuse.org/opensuse-updates/2014-02/msg00000.html" source="SUSE">openSUSE-SU-2014:0180</ref>
      <ref url="http://lists.opensuse.org/opensuse-updates/2014-01/msg00107.html" source="SUSE">openSUSE-SU-2014:0177</ref>
      <ref url="http://lists.opensuse.org/opensuse-updates/2014-01/msg00105.html" source="SUSE">openSUSE-SU-2014:0174</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00024.html" source="SUSE">SUSE-SU-2014:0451</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00012.html" source="SUSE">SUSE-SU-2014:0266</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00009.html" source="SUSE">SUSE-SU-2014:0246</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="jdk">
        <vers num="1.5.0" edition="update_55"/>
        <vers num="1.6.0" edition="update_65"/>
        <vers num="1.7.0" edition="update_45"/>
      </prod>
      <prod vendor="oracle" name="jre">
        <vers num="1.5.0" edition="update_55"/>
        <vers num="1.6.0" edition="update_65"/>
        <vers num="1.7.0" edition="update_45"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0423" published="2014-01-15" name="CVE-2014-0423" modified="2014-04-01" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:P/I:N/A:P)" CVSS_score="5.5" CVSS_impact_subscore="4.9" CVSS_exploit_subscore="8.0" CVSS_base_score="5.5">
    <desc>
      <descript source="cve">Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; JRockit R27.7.7 and R28.2.9; Java SE Embedded 7u45; and OpenJDK 7 allows remote authenticated users to affect confidentiality and availability via unknown vectors related to Beans.  NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that this issue is an XML External Entity (XXE) vulnerability in DocumentHandler.java, related to Beans decoding.</descript>
      <descript source="nvd">Per: http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html

"Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service."</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://bugzilla.redhat.com/show_bug.cgi?id=1053066" source="CONFIRM">https://bugzilla.redhat.com/show_bug.cgi?id=1053066</ref>
      <ref url="http://xforce.iss.net/xforce/xfdb/90340" source="XF">oracle-cpujan2014-cve20140423(90340)</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2124-1" source="UBUNTU">USN-2124-1</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2089-1" source="UBUNTU">USN-2089-1</ref>
      <ref url="http://www.securitytracker.com/id/1029608" source="SECTRACK">1029608</ref>
      <ref url="http://www.securityfocus.com/bid/64914" source="BID">64914</ref>
      <ref url="http://www.securityfocus.com/bid/64758" source="BID">64758</ref>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html</ref>
      <ref url="http://secunia.com/advisories/56535" source="SECUNIA">56535</ref>
      <ref url="http://secunia.com/advisories/56487" source="SECUNIA">56487</ref>
      <ref url="http://secunia.com/advisories/56486" source="SECUNIA">56486</ref>
      <ref url="http://secunia.com/advisories/56485" source="SECUNIA">56485</ref>
      <ref url="http://secunia.com/advisories/56432" source="SECUNIA">56432</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0136.html" source="REDHAT">RHSA-2014:0136</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0135.html" source="REDHAT">RHSA-2014:0135</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0134.html" source="REDHAT">RHSA-2014:0134</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0097.html" source="REDHAT">RHSA-2014:0097</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0030.html" source="REDHAT">RHSA-2014:0030</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0027.html" source="REDHAT">RHSA-2014:0027</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0026.html" source="REDHAT">RHSA-2014:0026</ref>
      <ref url="http://marc.info/?l=bugtraq&amp;m=139402749111889&amp;w=2" source="HP">SSRT101455</ref>
      <ref url="http://marc.info/?l=bugtraq&amp;m=139402749111889&amp;w=2" source="HP">HPSBUX02973</ref>
      <ref url="http://marc.info/?l=bugtraq&amp;m=139402697611681&amp;w=2" source="HP">HPSBUX02972</ref>
      <ref url="http://marc.info/?l=bugtraq&amp;m=139402697611681&amp;w=2" source="HP">SSRT101454</ref>
      <ref url="http://lists.opensuse.org/opensuse-updates/2014-02/msg00000.html" source="SUSE">openSUSE-SU-2014:0180</ref>
      <ref url="http://lists.opensuse.org/opensuse-updates/2014-01/msg00107.html" source="SUSE">openSUSE-SU-2014:0177</ref>
      <ref url="http://lists.opensuse.org/opensuse-updates/2014-01/msg00105.html" source="SUSE">openSUSE-SU-2014:0174</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00024.html" source="SUSE">SUSE-SU-2014:0451</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00012.html" source="SUSE">SUSE-SU-2014:0266</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00009.html" source="SUSE">SUSE-SU-2014:0246</ref>
      <ref url="http://hg.openjdk.java.net/jdk7u/jdk7u/jdk/rev/995b32f013f5" source="CONFIRM">http://hg.openjdk.java.net/jdk7u/jdk7u/jdk/rev/995b32f013f5</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="jdk">
        <vers num="1.5.0" edition="update_55"/>
        <vers num="1.6.0" edition="update_65"/>
        <vers num="1.7.0" edition="update_45"/>
      </prod>
      <prod vendor="oracle" name="jre">
        <vers num="1.5.0" edition="update_55"/>
        <vers num="1.6.0" edition="update_65"/>
        <vers num="1.7.0" edition="update_45"/>
      </prod>
      <prod vendor="oracle" name="jrockit">
        <vers num="r27.7.7"/>
        <vers num="r28.2.9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0424" published="2014-01-15" name="CVE-2014-0424" modified="2014-04-01" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">Unspecified vulnerability in Oracle Java SE 6u65 and 7u45 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2013-5889, CVE-2013-5902, CVE-2014-0410, CVE-2014-0415, and CVE-2014-0418.</descript>
      <descript source="nvd">Per: http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html

"Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets."</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.securitytracker.com/id/1029608" source="SECTRACK">1029608</ref>
      <ref url="http://www.securityfocus.com/bid/64919" source="BID">64919</ref>
      <ref url="http://www.securityfocus.com/bid/64758" source="BID">64758</ref>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html</ref>
      <ref url="http://secunia.com/advisories/56535" source="SECUNIA">56535</ref>
      <ref url="http://secunia.com/advisories/56485" source="SECUNIA">56485</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0135.html" source="REDHAT">RHSA-2014:0135</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0134.html" source="REDHAT">RHSA-2014:0134</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0030.html" source="REDHAT">RHSA-2014:0030</ref>
      <ref url="http://osvdb.org/102004" source="OSVDB">102004</ref>
      <ref url="http://marc.info/?l=bugtraq&amp;m=139402749111889&amp;w=2" source="HP">SSRT101455</ref>
      <ref url="http://marc.info/?l=bugtraq&amp;m=139402749111889&amp;w=2" source="HP">HPSBUX02973</ref>
      <ref url="http://marc.info/?l=bugtraq&amp;m=139402697611681&amp;w=2" source="HP">HPSBUX02972</ref>
      <ref url="http://marc.info/?l=bugtraq&amp;m=139402697611681&amp;w=2" source="HP">SSRT101454</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00024.html" source="SUSE">SUSE-SU-2014:0451</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00012.html" source="SUSE">SUSE-SU-2014:0266</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00009.html" source="SUSE">SUSE-SU-2014:0246</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="jdk">
        <vers num="1.6.0" edition="update_65"/>
        <vers num="1.7.0" edition="update_45"/>
      </prod>
      <prod vendor="oracle" name="jre">
        <vers num="1.6.0" edition="update_65"/>
        <vers num="1.7.0" edition="update_45"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0425" published="2014-01-15" name="CVE-2014-0425" modified="2014-02-06" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:P/I:N/A:N)" CVSS_score="4.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.0" CVSS_base_score="4.0">
    <desc>
      <descript source="cve">Unspecified vulnerability in the PeopleSoft Enterprise SCM Services Procurement component in Oracle PeopleSoft Products 9.2 allows remote authenticated users to affect confidentiality via unknown vectors related to Security.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.securitytracker.com/id/1029623" source="SECTRACK">1029623</ref>
      <ref url="http://www.securityfocus.com/bid/64889" source="BID">64889</ref>
      <ref url="http://www.securityfocus.com/bid/64758" source="BID">64758</ref>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html</ref>
      <ref url="http://secunia.com/advisories/56479" source="SECUNIA">56479</ref>
      <ref url="http://osvdb.org/102044" source="OSVDB">102044</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="peoplesoft_products">
        <vers num="9.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0426" published="2014-04-15" name="CVE-2014-0426" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Unspecified vulnerability in the Oracle Containers for J2EE component in Oracle Fusion Middleware 10.1.3.5 allows remote attackers to affect integrity via vectors related to HTTP Request Handling, a different vulnerability than CVE-2014-0413.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="fusion_middleware">
        <vers num="10.1.3.5"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-0427" published="2014-01-15" name="CVE-2014-0427" modified="2014-02-06" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:S/C:N/I:N/A:P)" CVSS_score="3.5" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="6.8" CVSS_base_score="3.5">
    <desc>
      <descript source="cve">Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.6.13 and earlier allows remote authenticated users to affect availability via vectors related to FTS.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90383" source="XF">oracle-cpujan2014-cve20140427(90383)</ref>
      <ref url="http://www.securityfocus.com/bid/64868" source="BID">64868</ref>
      <ref url="http://www.securityfocus.com/bid/64758" source="BID">64758</ref>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html</ref>
      <ref url="http://secunia.com/advisories/56491" source="SECUNIA">56491</ref>
      <ref url="http://osvdb.org/102072" source="OSVDB">102072</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="mysql">
        <vers num="5.6.0"/>
        <vers num="5.6.1"/>
        <vers num="5.6.10"/>
        <vers num="5.6.11"/>
        <vers num="5.6.12"/>
        <vers prev="1" num="5.6.13"/>
        <vers num="5.6.2"/>
        <vers num="5.6.3"/>
        <vers num="5.6.4"/>
        <vers num="5.6.5"/>
        <vers num="5.6.6"/>
        <vers num="5.6.7"/>
        <vers num="5.6.8"/>
        <vers num="5.6.9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0428" published="2014-01-15" name="CVE-2014-0428" modified="2014-04-01" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:C/I:C/A:C)" CVSS_score="10.0" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="10.0" CVSS_base_score="10.0">
    <desc>
      <descript source="cve">Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; Java SE Embedded 7u45; and OpenJDK 7 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to CORBA.  NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that the issue is related to "insufficient security checks in IIOP streams," which allows attackers to escape the sandbox.</descript>
      <descript source="nvd">Per: http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html

"Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets."</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://bugzilla.redhat.com/show_bug.cgi?id=1051519" source="CONFIRM">https://bugzilla.redhat.com/show_bug.cgi?id=1051519</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2124-1" source="UBUNTU">USN-2124-1</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2089-1" source="UBUNTU">USN-2089-1</ref>
      <ref url="http://www.securitytracker.com/id/1029608" source="SECTRACK">1029608</ref>
      <ref url="http://www.securityfocus.com/bid/64935" source="BID">64935</ref>
      <ref url="http://www.securityfocus.com/bid/64758" source="BID">64758</ref>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html</ref>
      <ref url="http://secunia.com/advisories/56535" source="SECUNIA">56535</ref>
      <ref url="http://secunia.com/advisories/56486" source="SECUNIA">56486</ref>
      <ref url="http://secunia.com/advisories/56485" source="SECUNIA">56485</ref>
      <ref url="http://secunia.com/advisories/56432" source="SECUNIA">56432</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0136.html" source="REDHAT">RHSA-2014:0136</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0135.html" source="REDHAT">RHSA-2014:0135</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0134.html" source="REDHAT">RHSA-2014:0134</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0097.html" source="REDHAT">RHSA-2014:0097</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0030.html" source="REDHAT">RHSA-2014:0030</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0027.html" source="REDHAT">RHSA-2014:0027</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0026.html" source="REDHAT">RHSA-2014:0026</ref>
      <ref url="http://osvdb.org/101996" source="OSVDB">101996</ref>
      <ref url="http://marc.info/?l=bugtraq&amp;m=139402749111889&amp;w=2" source="HP">SSRT101455</ref>
      <ref url="http://marc.info/?l=bugtraq&amp;m=139402749111889&amp;w=2" source="HP">HPSBUX02973</ref>
      <ref url="http://marc.info/?l=bugtraq&amp;m=139402697611681&amp;w=2" source="HP">HPSBUX02972</ref>
      <ref url="http://marc.info/?l=bugtraq&amp;m=139402697611681&amp;w=2" source="HP">SSRT101454</ref>
      <ref url="http://lists.opensuse.org/opensuse-updates/2014-02/msg00000.html" source="SUSE">openSUSE-SU-2014:0180</ref>
      <ref url="http://lists.opensuse.org/opensuse-updates/2014-01/msg00107.html" source="SUSE">openSUSE-SU-2014:0177</ref>
      <ref url="http://lists.opensuse.org/opensuse-updates/2014-01/msg00105.html" source="SUSE">openSUSE-SU-2014:0174</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00024.html" source="SUSE">SUSE-SU-2014:0451</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00012.html" source="SUSE">SUSE-SU-2014:0266</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00009.html" source="SUSE">SUSE-SU-2014:0246</ref>
      <ref url="http://hg.openjdk.java.net/jdk7u/jdk7u/corba/rev/0a879f00b698" source="MISC">http://hg.openjdk.java.net/jdk7u/jdk7u/corba/rev/0a879f00b698</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="jdk">
        <vers num="1.5.0" edition="update_55"/>
        <vers num="1.6.0" edition="update_65"/>
        <vers num="1.7.0" edition="update_45"/>
      </prod>
      <prod vendor="oracle" name="jre">
        <vers num="1.5.0" edition="update_55"/>
        <vers num="1.6.0" edition="update_65"/>
        <vers num="1.7.0" edition="update_45"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0429" published="2014-04-15" name="CVE-2014-0429" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:C/I:C/A:C)" CVSS_score="10.0" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="10.0" CVSS_base_score="10.0">
    <desc>
      <descript source="cve">Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JRockit R27.8.1 and R28.3.1; and Java SE Embedded 7u51 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.</descript>
      <descript source="nvd">Per: http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html

"Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service."</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="jdk">
        <vers num="1.5.0" edition="update_61"/>
        <vers num="1.6.0" edition="update_71"/>
        <vers num="1.7.0" edition="update_51"/>
        <vers num="1.8.0"/>
      </prod>
      <prod vendor="oracle" name="jre">
        <vers num="1.5.0" edition="update_61"/>
        <vers num="1.6.0" edition="update_71"/>
        <vers num="1.7.0" edition="update_51"/>
        <vers num="1.8.0"/>
      </prod>
      <prod vendor="oracle" name="jrockit">
        <vers num="r27.8.1"/>
        <vers num="r28.3.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-0430" published="2014-01-15" name="CVE-2014-0430" modified="2014-02-06" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:M/C:N/I:N/A:P)" CVSS_score="2.8" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="5.5" CVSS_base_score="2.8">
    <desc>
      <descript source="cve">Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.6.13 and earlier allows remote authenticated users to affect availability via unknown vectors related to Performance Schema.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90387" source="XF">oracle-cpujan2014-cve20140430(90387)</ref>
      <ref url="http://www.securityfocus.com/bid/64893" source="BID">64893</ref>
      <ref url="http://www.securityfocus.com/bid/64758" source="BID">64758</ref>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html</ref>
      <ref url="http://secunia.com/advisories/56491" source="SECUNIA">56491</ref>
      <ref url="http://osvdb.org/102076" source="OSVDB">102076</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="mysql">
        <vers num="5.6.0"/>
        <vers num="5.6.1"/>
        <vers num="5.6.10"/>
        <vers num="5.6.11"/>
        <vers num="5.6.12"/>
        <vers prev="1" num="5.6.13"/>
        <vers num="5.6.2"/>
        <vers num="5.6.3"/>
        <vers num="5.6.4"/>
        <vers num="5.6.5"/>
        <vers num="5.6.6"/>
        <vers num="5.6.7"/>
        <vers num="5.6.8"/>
        <vers num="5.6.9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-0431" published="2014-01-15" name="CVE-2014-0431" modified="2014-02-06" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:S/C:N/I:N/A:P)" CVSS_score="3.5" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="6.8" CVSS_base_score="3.5">
    <desc>
      <descript source="cve">Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.6.14 and earlier allows remote authenticated users to affect availability via unknown vectors related to InnoDB, a different vulnerability than CVE-2013-5881.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90384" source="XF">oracle-cpujan2014-cve20140431(90384)</ref>
      <ref url="http://www.securityfocus.com/bid/64897" source="BID">64897</ref>
      <ref url="http://www.securityfocus.com/bid/64758" source="BID">64758</ref>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html</ref>
      <ref url="http://secunia.com/advisories/56491" source="SECUNIA">56491</ref>
      <ref url="http://osvdb.org/102073" source="OSVDB">102073</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="mysql">
        <vers num="5.6.0"/>
        <vers num="5.6.1"/>
        <vers num="5.6.10"/>
        <vers num="5.6.11"/>
        <vers num="5.6.12"/>
        <vers num="5.6.13"/>
        <vers prev="1" num="5.6.14"/>
        <vers num="5.6.2"/>
        <vers num="5.6.3"/>
        <vers num="5.6.4"/>
        <vers num="5.6.5"/>
        <vers num="5.6.6"/>
        <vers num="5.6.7"/>
        <vers num="5.6.8"/>
        <vers num="5.6.9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0432" published="2014-04-15" name="CVE-2014-0432" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">Unspecified vulnerability in Oracle Java SE 7u51 and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2014-0455 and CVE-2014-2402.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="jdk">
        <vers num="1.7.0" edition="update_51"/>
        <vers num="1.8.0"/>
      </prod>
      <prod vendor="oracle" name="jre">
        <vers num="1.7.0" edition="update_51"/>
        <vers num="1.8.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0433" published="2014-01-15" name="CVE-2014-0433" modified="2014-02-06" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:N/A:P)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.6.13 and earlier allows remote attackers to affect availability via unknown vectors related to Thread Pooling.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90375" source="XF">oracle-cpujan2014-cve20140433(90375)</ref>
      <ref url="http://www.securityfocus.com/bid/64895" source="BID">64895</ref>
      <ref url="http://www.securityfocus.com/bid/64758" source="BID">64758</ref>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html</ref>
      <ref url="http://secunia.com/advisories/56491" source="SECUNIA">56491</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="mysql">
        <vers num="5.6.0"/>
        <vers num="5.6.1"/>
        <vers num="5.6.10"/>
        <vers num="5.6.11"/>
        <vers num="5.6.12"/>
        <vers prev="1" num="5.6.13"/>
        <vers num="5.6.2"/>
        <vers num="5.6.3"/>
        <vers num="5.6.4"/>
        <vers num="5.6.5"/>
        <vers num="5.6.6"/>
        <vers num="5.6.7"/>
        <vers num="5.6.8"/>
        <vers num="5.6.9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0434" published="2014-01-15" name="CVE-2014-0434" modified="2014-02-06" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Unspecified vulnerability in the Oracle Agile Product Lifecycle Management for Process component in Oracle Supply Chain Products Suite 6.0, 6.1, and 6.1.1 allows remote attackers to affect integrity via unknown vectors related to Installation.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.securitytracker.com/id/1029620" source="SECTRACK">1029620</ref>
      <ref url="http://www.securityfocus.com/bid/64851" source="BID">64851</ref>
      <ref url="http://www.securityfocus.com/bid/64758" source="BID">64758</ref>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html</ref>
      <ref url="http://secunia.com/advisories/56472" source="SECUNIA">56472</ref>
      <ref url="http://osvdb.org/102084" source="OSVDB">102084</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="supply_chain_products_suite">
        <vers num="6.0.0"/>
        <vers num="6.1.0"/>
        <vers num="6.1.1.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0435" published="2014-01-15" name="CVE-2014-0435" modified="2014-02-06" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:N/I:N/A:P)" CVSS_score="4.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.0" CVSS_base_score="4.0">
    <desc>
      <descript source="cve">Unspecified vulnerability in the Oracle Transportation Management component in Oracle Supply Chain Products Suite 6.1, 6.2, 6.3, 6.3.1, and 6.3.2 allows remote authenticated users to affect availability via unknown vectors related to Data, Domain &amp; Function Security.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.securitytracker.com/id/1029620" source="SECTRACK">1029620</ref>
      <ref url="http://www.securityfocus.com/bid/64869" source="BID">64869</ref>
      <ref url="http://www.securityfocus.com/bid/64758" source="BID">64758</ref>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html</ref>
      <ref url="http://osvdb.org/102086" source="OSVDB">102086</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="supply_chain_products_suite">
        <vers num="6.1.0"/>
        <vers num="6.2.0"/>
        <vers num="6.3.0"/>
        <vers num="6.3.1"/>
        <vers num="6.3.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-0437" published="2014-01-15" name="CVE-2014-0437" modified="2014-03-05" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:S/C:N/I:N/A:P)" CVSS_score="3.5" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="6.8" CVSS_base_score="3.5">
    <desc>
      <descript source="cve">Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.72 and earlier, 5.5.34 and earlier, and 5.6.14 and earlier allows remote authenticated users to affect availability via unknown vectors related to Optimizer.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90385" source="XF">oracle-cpujan2014-cve20140437(90385)</ref>
      <ref url="http://www.securityfocus.com/bid/64849" source="BID">64849</ref>
      <ref url="http://www.securityfocus.com/bid/64758" source="BID">64758</ref>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2848" source="DEBIAN">DSA-2848</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2845" source="DEBIAN">DSA-2845</ref>
      <ref url="http://ubuntu.com/usn/usn-2086-1" source="UBUNTU">USN-2086-1</ref>
      <ref url="http://secunia.com/advisories/56580" source="SECUNIA">56580</ref>
      <ref url="http://secunia.com/advisories/56541" source="SECUNIA">56541</ref>
      <ref url="http://secunia.com/advisories/56491" source="SECUNIA">56491</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0189.html" source="REDHAT">RHSA-2014:0189</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0186.html" source="REDHAT">RHSA-2014:0186</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0173.html" source="REDHAT">RHSA-2014:0173</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0164.html" source="REDHAT">RHSA-2014:0164</ref>
      <ref url="http://osvdb.org/102074" source="OSVDB">102074</ref>
    </refs>
    <vuln_soft>
      <prod vendor="mysql" name="mysql">
        <vers num="5.1"/>
        <vers num="5.1.1"/>
        <vers num="5.1.10"/>
        <vers num="5.1.11"/>
        <vers num="5.1.12"/>
        <vers num="5.1.13"/>
        <vers num="5.1.14"/>
        <vers num="5.1.15"/>
        <vers num="5.1.16"/>
        <vers num="5.1.17"/>
        <vers num="5.1.18"/>
        <vers num="5.1.19"/>
        <vers num="5.1.2"/>
        <vers num="5.1.20"/>
        <vers num="5.1.21"/>
        <vers num="5.1.22"/>
        <vers num="5.1.23" edition="a"/>
        <vers num="5.1.23_bk"/>
        <vers num="5.1.23a"/>
        <vers num="5.1.24"/>
        <vers num="5.1.25"/>
        <vers num="5.1.26"/>
        <vers num="5.1.27"/>
        <vers num="5.1.28"/>
        <vers num="5.1.29"/>
        <vers num="5.1.3"/>
        <vers num="5.1.30"/>
        <vers num="5.1.31" edition="sp1"/>
        <vers num="5.1.32"/>
        <vers num="5.1.32-bzr"/>
        <vers num="5.1.33"/>
        <vers num="5.1.34" edition="sp1"/>
        <vers num="5.1.35"/>
        <vers num="5.1.36"/>
        <vers num="5.1.37" edition="sp1"/>
        <vers num="5.1.38"/>
        <vers num="5.1.39"/>
        <vers num="5.1.4"/>
        <vers num="5.1.40" edition="sp1"/>
        <vers num="5.1.41"/>
        <vers num="5.1.42"/>
        <vers num="5.1.43" edition="sp1"/>
        <vers num="5.1.44"/>
        <vers num="5.1.45"/>
        <vers num="5.1.46" edition="sp1"/>
        <vers num="5.1.47"/>
        <vers num="5.1.48"/>
        <vers num="5.1.49" edition="sp1"/>
        <vers num="5.1.5"/>
        <vers num="5.1.50"/>
        <vers num="5.1.5a"/>
        <vers num="5.1.6"/>
        <vers num="5.1.7"/>
        <vers num="5.1.8"/>
        <vers num="5.1.9"/>
        <vers num="5.5.0"/>
        <vers num="5.5.1"/>
        <vers num="5.5.2"/>
        <vers num="5.5.3"/>
        <vers num="5.5.4"/>
        <vers num="5.5.5"/>
        <vers num="5.5.6"/>
        <vers num="5.5.7"/>
        <vers num="5.5.8"/>
        <vers num="5.5.9"/>
      </prod>
      <prod vendor="oracle" name="mysql">
        <vers num="5.1.51"/>
        <vers num="5.1.52" edition="sp1"/>
        <vers num="5.1.53"/>
        <vers num="5.1.54"/>
        <vers num="5.1.55"/>
        <vers num="5.1.56"/>
        <vers num="5.1.57"/>
        <vers num="5.1.58"/>
        <vers num="5.1.59"/>
        <vers num="5.1.60"/>
        <vers num="5.1.61"/>
        <vers num="5.1.62"/>
        <vers num="5.1.63"/>
        <vers num="5.1.64"/>
        <vers num="5.1.65"/>
        <vers num="5.1.66"/>
        <vers num="5.1.67"/>
        <vers num="5.1.68"/>
        <vers num="5.1.69"/>
        <vers num="5.1.70"/>
        <vers num="5.1.71"/>
        <vers prev="1" num="5.1.72"/>
        <vers num="5.5.10"/>
        <vers num="5.5.11"/>
        <vers num="5.5.12"/>
        <vers num="5.5.13"/>
        <vers num="5.5.14"/>
        <vers num="5.5.15"/>
        <vers num="5.5.16"/>
        <vers num="5.5.17"/>
        <vers num="5.5.18"/>
        <vers num="5.5.19"/>
        <vers num="5.5.20"/>
        <vers num="5.5.21"/>
        <vers num="5.5.22"/>
        <vers num="5.5.23"/>
        <vers num="5.5.24"/>
        <vers num="5.5.25" edition="a"/>
        <vers num="5.5.26"/>
        <vers num="5.5.27"/>
        <vers num="5.5.28"/>
        <vers num="5.5.29"/>
        <vers num="5.5.30"/>
        <vers num="5.5.31"/>
        <vers num="5.5.32"/>
        <vers num="5.5.33"/>
        <vers prev="1" num="5.5.34"/>
        <vers num="5.6.0"/>
        <vers num="5.6.1"/>
        <vers num="5.6.10"/>
        <vers num="5.6.11"/>
        <vers num="5.6.12"/>
        <vers num="5.6.13"/>
        <vers prev="1" num="5.6.14"/>
        <vers num="5.6.2"/>
        <vers num="5.6.3"/>
        <vers num="5.6.4"/>
        <vers num="5.6.5"/>
        <vers num="5.6.6"/>
        <vers num="5.6.7"/>
        <vers num="5.6.8"/>
        <vers num="5.6.9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0438" published="2014-01-15" name="CVE-2014-0438" modified="2014-02-06" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:P/I:N/A:N)" CVSS_score="4.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.0" CVSS_base_score="4.0">
    <desc>
      <descript source="cve">Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.52 and 8.53 allows remote authenticated users to affect confidentiality via unknown vectors related to Panel Processor.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.securitytracker.com/id/1029623" source="SECTRACK">1029623</ref>
      <ref url="http://www.securityfocus.com/bid/64887" source="BID">64887</ref>
      <ref url="http://www.securityfocus.com/bid/64758" source="BID">64758</ref>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html</ref>
      <ref url="http://secunia.com/advisories/56478" source="SECUNIA">56478</ref>
      <ref url="http://osvdb.org/102043" source="OSVDB">102043</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="peoplesoft_products">
        <vers num="8.52"/>
        <vers num="8.53"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0439" published="2014-01-15" name="CVE-2014-0439" modified="2014-02-06" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:N/I:P/A:N)" CVSS_score="4.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.0" CVSS_base_score="4.0">
    <desc>
      <descript source="cve">Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.52 and 8.53 allows remote authenticated users to affect integrity via unknown vectors related to Report Distribution.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.securitytracker.com/id/1029623" source="SECTRACK">1029623</ref>
      <ref url="http://www.securityfocus.com/bid/64884" source="BID">64884</ref>
      <ref url="http://www.securityfocus.com/bid/64758" source="BID">64758</ref>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html</ref>
      <ref url="http://secunia.com/advisories/56478" source="SECUNIA">56478</ref>
      <ref url="http://osvdb.org/102042" source="OSVDB">102042</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="peoplesoft_products">
        <vers num="8.52"/>
        <vers num="8.53"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0440" published="2014-01-15" name="CVE-2014-0440" modified="2014-02-06" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:N/I:N/A:P)" CVSS_score="4.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.0" CVSS_base_score="4.0">
    <desc>
      <descript source="cve">Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.52 and 8.53 allows remote authenticated users to affect availability via vectors related to PIA Core Technology.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.securitytracker.com/id/1029623" source="SECTRACK">1029623</ref>
      <ref url="http://www.securityfocus.com/bid/64881" source="BID">64881</ref>
      <ref url="http://www.securityfocus.com/bid/64758" source="BID">64758</ref>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html</ref>
      <ref url="http://secunia.com/advisories/56478" source="SECUNIA">56478</ref>
      <ref url="http://osvdb.org/102041" source="OSVDB">102041</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="peoplesoft_products">
        <vers num="8.52"/>
        <vers num="8.53"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0441" published="2014-01-15" name="CVE-2014-0441" modified="2014-02-06" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:P)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.52 and 8.53 allows remote attackers to affect availability via unknown vectors related to Integration Broker.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.securitytracker.com/id/1029623" source="SECTRACK">1029623</ref>
      <ref url="http://www.securityfocus.com/bid/64839" source="BID">64839</ref>
      <ref url="http://www.securityfocus.com/bid/64758" source="BID">64758</ref>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html</ref>
      <ref url="http://secunia.com/advisories/56478" source="SECUNIA">56478</ref>
      <ref url="http://osvdb.org/102047" source="OSVDB">102047</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="peoplesoft_products">
        <vers num="8.52"/>
        <vers num="8.53"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0442" published="2014-04-15" name="CVE-2014-0442" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:L/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="4.6" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="3.9" CVSS_base_score="4.6">
    <desc>
      <descript source="cve">Unspecified vulnerability in Oracle Solaris 9, 10, and 11.1 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Print Filter Utility.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="sunos">
        <vers num="5.11.1"/>
      </prod>
      <prod vendor="sun" name="sunos">
        <vers num="5.10"/>
        <vers num="5.11"/>
        <vers num="5.9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0443" published="2014-01-15" name="CVE-2014-0443" modified="2014-02-06" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:P/A:N)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.52 allows remote attackers to affect integrity via unknown vectors related to Security.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.securitytracker.com/id/1029623" source="SECTRACK">1029623</ref>
      <ref url="http://www.securityfocus.com/bid/64844" source="BID">64844</ref>
      <ref url="http://www.securityfocus.com/bid/64758" source="BID">64758</ref>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html</ref>
      <ref url="http://secunia.com/advisories/56478" source="SECUNIA">56478</ref>
      <ref url="http://osvdb.org/102032" source="OSVDB">102032</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="peoplesoft_products">
        <vers num="8.52"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-0444" published="2014-01-15" name="CVE-2014-0444" modified="2014-02-06" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:S/C:P/I:N/A:N)" CVSS_score="3.5" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="6.8" CVSS_base_score="3.5">
    <desc>
      <descript source="cve">Unspecified vulnerability in the Oracle AutoVue Electro-Mechanical Professional component in Oracle Supply Chain Products Suite 20.1.1 allows remote authenticated users to affect confidentiality via unknown vectors related to Web General, a different vulnerability than CVE-2013-5868 and CVE-2013-5871.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.securitytracker.com/id/1029620" source="SECTRACK">1029620</ref>
      <ref url="http://www.securityfocus.com/bid/64883" source="BID">64883</ref>
      <ref url="http://www.securityfocus.com/bid/64758" source="BID">64758</ref>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html</ref>
      <ref url="http://secunia.com/advisories/56473" source="SECUNIA">56473</ref>
      <ref url="http://osvdb.org/102089" source="OSVDB">102089</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="supply_chain_products_suite">
        <vers num="20.1.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0445" published="2014-01-15" name="CVE-2014-0445" modified="2014-02-06" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.52 and 8.53 allows remote attackers to affect integrity via vectors related to PIA Core Technology, a different vulnerability than CVE-2014-0381.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.securitytracker.com/id/1029623" source="SECTRACK">1029623</ref>
      <ref url="http://www.securityfocus.com/bid/64867" source="BID">64867</ref>
      <ref url="http://www.securityfocus.com/bid/64758" source="BID">64758</ref>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html</ref>
      <ref url="http://secunia.com/advisories/56478" source="SECUNIA">56478</ref>
      <ref url="http://osvdb.org/102038" source="OSVDB">102038</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="peoplesoft_products">
        <vers num="8.52"/>
        <vers num="8.53"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0446" published="2014-04-15" name="CVE-2014-0446" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="jdk">
        <vers num="1.5.0" edition="update_61"/>
        <vers num="1.6.0" edition="update_71"/>
        <vers num="1.7.0" edition="update_51"/>
        <vers num="1.8.0"/>
      </prod>
      <prod vendor="oracle" name="jre">
        <vers num="1.5.0" edition="update_61"/>
        <vers num="1.6.0" edition="update_71"/>
        <vers num="1.7.0" edition="update_51"/>
        <vers num="1.8.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0447" published="2014-04-15" name="CVE-2014-0447" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:L/AC:L/Au:N/C:N/I:N/A:C)" CVSS_score="4.9" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="3.9" CVSS_base_score="4.9">
    <desc>
      <descript source="cve">Unspecified vulnerability in Oracle Solaris 10 and 11.1 allows local users to affect availability via unknown vectors related to Kernel.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="sunos">
        <vers num="5.11.1"/>
      </prod>
      <prod vendor="sun" name="sunos">
        <vers num="5.10"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0448" published="2014-04-15" name="CVE-2014-0448" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:H/Au:N/C:C/I:C/A:C)" CVSS_score="7.6" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="4.9" CVSS_base_score="7.6">
    <desc>
      <descript source="cve">Unspecified vulnerability in Oracle Java SE 7u51 and 8 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="jdk">
        <vers num="1.7.0" edition="update_51"/>
        <vers num="1.8.0"/>
      </prod>
      <prod vendor="oracle" name="jre">
        <vers num="1.7.0" edition="update_51"/>
        <vers num="1.8.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0449" published="2014-04-15" name="CVE-2014-0449" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:N/A:N)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality via unknown vectors related to Deployment.</descript>
      <descript source="nvd">Per: http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html

"Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets."</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="jdk">
        <vers num="1.6.0" edition="update_71"/>
        <vers num="1.7.0" edition="update_51"/>
        <vers num="1.8.0"/>
      </prod>
      <prod vendor="oracle" name="jre">
        <vers num="1.6.0" edition="update_71"/>
        <vers num="1.7.0" edition="update_51"/>
        <vers num="1.8.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0450" published="2014-04-15" name="CVE-2014-0450" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:N/A:N)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">Unspecified vulnerability in the Oracle WebCenter Portal component in Oracle Fusion Middleware 11.1.1.7 and 11.1.1.8 allows remote attackers to affect confidentiality via unknown vectors related to People Connection.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="fusion_middleware">
        <vers num="11.1.1.7.0"/>
        <vers num="11.1.1.8.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0451" published="2014-04-15" name="CVE-2014-0451" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT, a different vulnerability than CVE-2014-2412.</descript>
      <descript source="nvd">Per: http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html

"Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets."</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="jdk">
        <vers num="1.5.0" edition="update_61"/>
        <vers num="1.6.0" edition="update_71"/>
        <vers num="1.7.0" edition="update_51"/>
        <vers num="1.8.0"/>
      </prod>
      <prod vendor="oracle" name="jre">
        <vers num="1.5.0" edition="update_61"/>
        <vers num="1.6.0" edition="update_71"/>
        <vers num="1.7.0" edition="update_51"/>
        <vers num="1.8.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0452" published="2014-04-15" name="CVE-2014-0452" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JAX-WS, a different vulnerability than CVE-2014-0458 and CVE-2014-2423.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="jdk">
        <vers num="1.6.0" edition="update_71"/>
        <vers num="1.7.0" edition="update_51"/>
        <vers num="1.8.0"/>
      </prod>
      <prod vendor="oracle" name="jre">
        <vers num="1.6.0" edition="update_71"/>
        <vers num="1.7.0" edition="update_51"/>
        <vers num="1.8.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0453" published="2014-04-15" name="CVE-2014-0453" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:H/Au:N/C:P/I:P/A:N)" CVSS_score="4.0" CVSS_impact_subscore="4.9" CVSS_exploit_subscore="4.9" CVSS_base_score="4.0">
    <desc>
      <descript source="cve">Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JRockit R27.8.1 and R28.3.1; and Java SE Embedded 7u51 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Security.</descript>
    </desc>
    <loss_types>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="jdk">
        <vers num="1.5.0" edition="update_61"/>
        <vers num="1.6.0" edition="update_71"/>
        <vers num="1.7.0" edition="update_51"/>
        <vers num="1.8.0"/>
      </prod>
      <prod vendor="oracle" name="jre">
        <vers num="1.5.0" edition="update_61"/>
        <vers num="1.6.0" edition="update_71"/>
        <vers num="1.7.0" edition="update_51"/>
        <vers num="1.8.0"/>
      </prod>
      <prod vendor="oracle" name="jrockit">
        <vers num="r27.8.1"/>
        <vers num="r28.3.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0454" published="2014-04-15" name="CVE-2014-0454" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">Unspecified vulnerability in Oracle Java SE 7u51 and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Security.</descript>
      <descript source="nvd">Per: http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html

"Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets."</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="jdk">
        <vers num="1.7.0" edition="update_51"/>
        <vers num="1.8.0"/>
      </prod>
      <prod vendor="oracle" name="jre">
        <vers num="1.7.0" edition="update_51"/>
        <vers num="1.8.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0455" published="2014-04-15" name="CVE-2014-0455" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">Unspecified vulnerability in Oracle Java SE 7u51 and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2014-0432 and CVE-2014-2402.</descript>
      <descript source="nvd">Per: http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html 

"Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets."
</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="jdk">
        <vers num="1.7.0" edition="update_51"/>
        <vers num="1.8.0"/>
      </prod>
      <prod vendor="oracle" name="jre">
        <vers num="1.7.0" edition="update_51"/>
        <vers num="1.8.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0456" published="2014-04-15" name="CVE-2014-0456" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:C/I:C/A:C)" CVSS_score="10.0" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="10.0" CVSS_base_score="10.0">
    <desc>
      <descript source="cve">Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="jdk">
        <vers num="1.7.0" edition="update_51"/>
        <vers num="1.8.0"/>
      </prod>
      <prod vendor="oracle" name="jre">
        <vers num="1.7.0" edition="update_51"/>
        <vers num="1.8.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0457" published="2014-04-15" name="CVE-2014-0457" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:C/I:C/A:C)" CVSS_score="10.0" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="10.0" CVSS_base_score="10.0">
    <desc>
      <descript source="cve">Unspecified vulnerability in Oracle Java SE 5.0u61, SE 6u71, 7u51, and 8; JRockit R27.8.1 and R28.3.1; and Java SE Embedded 7u51 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="jdk">
        <vers num="1.5.0" edition="update_61"/>
        <vers num="1.6.0" edition="update_71"/>
        <vers num="1.7.0" edition="update_51"/>
        <vers num="1.8.0"/>
      </prod>
      <prod vendor="oracle" name="jre">
        <vers num="1.5.0" edition="update_61"/>
        <vers num="1.6.0" edition="update_71"/>
        <vers num="1.7.0" edition="update_51"/>
        <vers num="1.8.0"/>
      </prod>
      <prod vendor="oracle" name="jrockit">
        <vers num="r27.8.1"/>
        <vers num="r28.3.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0458" published="2014-04-15" name="CVE-2014-0458" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JAX-WS, a different vulnerability than CVE-2014-0452 and CVE-2014-2423.</descript>
      <descript source="nvd">per: http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html


Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="jdk">
        <vers num="1.6.0" edition="update_71"/>
        <vers num="1.7.0" edition="update_51"/>
        <vers num="1.8.0"/>
      </prod>
      <prod vendor="oracle" name="jre">
        <vers num="1.6.0" edition="update_71"/>
        <vers num="1.7.0" edition="update_51"/>
        <vers num="1.8.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0459" published="2014-04-15" name="CVE-2014-0459" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:N/A:P)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Unspecified vulnerability in Oracle Java SE 7u51 and 8, and Java SE Embedded 7u51, allows remote attackers to affect availability via unknown vectors related to 2D.</descript>
      <descript source="nvd">Per: http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html

"Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets."</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="jdk">
        <vers num="1.7.0" edition="update_51"/>
        <vers num="1.8.0"/>
      </prod>
      <prod vendor="oracle" name="jre">
        <vers num="1.7.0" edition="update_51"/>
        <vers num="1.8.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0460" published="2014-04-15" name="CVE-2014-0460" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:N)" CVSS_score="5.8" CVSS_impact_subscore="4.9" CVSS_exploit_subscore="8.6" CVSS_base_score="5.8">
    <desc>
      <descript source="cve">Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JRockit R27.8.1 and R28.3.1; and Java SE Embedded 7u51 allows remote attackers to affect confidentiality and integrity via vectors related to JNDI.</descript>
    </desc>
    <loss_types>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="jdk">
        <vers num="1.5.0" edition="update_61"/>
        <vers num="1.6.0" edition="update_71"/>
        <vers num="1.7.0" edition="update_51"/>
        <vers num="1.8.0"/>
      </prod>
      <prod vendor="oracle" name="jre">
        <vers num="1.5.0" edition="update_61"/>
        <vers num="1.6.0" edition="update_71"/>
        <vers num="1.7.0" edition="update_51"/>
        <vers num="1.8.0"/>
      </prod>
      <prod vendor="oracle" name="jrockit">
        <vers num="r27.8.1"/>
        <vers num="r28.3.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0461" published="2014-04-15" name="CVE-2014-0461" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries.</descript>
      <descript source="nvd">Per: http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html

"Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets."</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="jdk">
        <vers num="1.6.0" edition="update_71"/>
        <vers num="1.7.0" edition="update_51"/>
        <vers num="1.8.0"/>
      </prod>
      <prod vendor="oracle" name="jre">
        <vers num="1.6.0" edition="update_71"/>
        <vers num="1.7.0" edition="update_51"/>
        <vers num="1.8.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0463" published="2014-04-15" name="CVE-2014-0463" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:N/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Unspecified vulnerability in Oracle Java SE 8 allows remote attackers to affect confidentiality via unknown vectors related to Scripting, a different vulnerability than CVE-2014-0464.</descript>
      <descript source="nvd">Per: http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html

"Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets."</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="jdk">
        <vers num="1.8.0"/>
      </prod>
      <prod vendor="oracle" name="jre">
        <vers num="1.8.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0464" published="2014-04-15" name="CVE-2014-0464" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:N/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Unspecified vulnerability in Oracle Java SE 8 allows remote attackers to affect confidentiality via unknown vectors related to Scripting, a different vulnerability than CVE-2014-0463.</descript>
      <descript source="nvd">Per: http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html 

"Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets."</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="jdk">
        <vers num="1.8.0"/>
      </prod>
      <prod vendor="oracle" name="jre">
        <vers num="1.8.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-0465" published="2014-04-15" name="CVE-2014-0465" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:S/C:N/I:P/A:N)" CVSS_score="3.5" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="6.8" CVSS_base_score="3.5">
    <desc>
      <descript source="cve">Unspecified vulnerability in the Oracle OpenSSO component in Oracle Fusion Middleware 8.0 Update 2 Patch 5 allows remote authenticated users to affect integrity via unknown vectors related to Admin Console.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="fusion_middleware">
        <vers num="8.0" edition="update2_patch5"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0466" published="2014-04-03" name="CVE-2014-0466" modified="2014-04-03" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:P)" CVSS_score="6.8" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.6" CVSS_base_score="6.8">
    <desc>
      <descript source="cve">The fixps script in a2ps 4.14 does not use the -dSAFER option when executing gs, which allows context-dependent attackers to delete arbitrary files or execute arbitrary commands via a crafted PostScript file.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=742902" source="CONFIRM">https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=742902</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2892" source="DEBIAN">DSA-2892</ref>
    </refs>
    <vuln_soft>
      <prod vendor="gnu" name="a2ps">
        <vers num="4.14"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0467" published="2014-03-14" name="CVE-2014-0467" modified="2014-04-19" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:P)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">Buffer overflow in copy.c in Mutt before 1.5.23 allows remote attackers to cause a denial of service (crash) via a crafted RFC2047 header line, related to address expansion.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.ubuntu.com/usn/USN-2147-1" source="UBUNTU">USN-2147-1</ref>
      <ref url="http://www.mutt.org/doc/devel/ChangeLog" source="CONFIRM">http://www.mutt.org/doc/devel/ChangeLog</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2874" source="DEBIAN">DSA-2874</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0304.html" source="REDHAT">RHSA-2014:0304</ref>
      <ref url="http://lists.opensuse.org/opensuse-updates/2014-03/msg00085.html" source="SUSE">openSUSE-SU-2014:0436</ref>
      <ref url="http://lists.opensuse.org/opensuse-updates/2014-03/msg00083.html" source="SUSE">openSUSE-SU-2014:0434</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00001.html" source="SUSE">SUSE-SU-2014:0471</ref>
    </refs>
    <vuln_soft>
      <prod vendor="mutt" name="mutt">
        <vers num="1.5"/>
        <vers num="1.5.1"/>
        <vers num="1.5.10"/>
        <vers num="1.5.11"/>
        <vers num="1.5.12"/>
        <vers num="1.5.13"/>
        <vers num="1.5.14"/>
        <vers num="1.5.15"/>
        <vers num="1.5.16"/>
        <vers num="1.5.17"/>
        <vers num="1.5.18"/>
        <vers num="1.5.19"/>
        <vers num="1.5.2"/>
        <vers num="1.5.20"/>
        <vers num="1.5.21"/>
        <vers prev="1" num="1.5.22"/>
        <vers num="1.5.3"/>
        <vers num="1.5.4"/>
        <vers num="1.5.5"/>
        <vers num="1.5.6"/>
        <vers num="1.5.7"/>
        <vers num="1.5.8"/>
        <vers num="1.5.9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0470" published="2014-04-30" name="CVE-2014-0470" modified="2014-04-30" CVSS_version="2.0" CVSS_vector="(AV:L/AC:L/Au:N/C:C/I:C/A:C)" CVSS_score="7.2" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="3.9" CVSS_base_score="7.2">
    <desc>
      <descript source="cve">super.c in Super 3.30.0 does not check the return value of the setuid function when the -F flag is set, which allows local users to gain privileges via unspecified vectors, aka an RLIMIT_NPROC attack.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
      <sec_prot admin="1"/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="http://www.openwall.com/lists/oss-security/2014/04/28/6" source="MLIST">[oss-security] 20140428 super unchecked setuid (CVE-2014-0470)</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2917" source="DEBIAN">DSA-2917</ref>
    </refs>
    <vuln_soft>
      <prod vendor="super_project" name="super">
        <vers num="3.30.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0471" published="2014-04-30" name="CVE-2014-0471" modified="2014-05-01" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">Directory traversal vulnerability in the unpacking functionality in dpkg before 1.15.9, 1.16.x before 1.16.13, and 1.17.x before 1.17.8 allows remote attackers to write arbitrary files via a crafted source package, related to "C-style filename quoting."</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://www.ubuntu.com/usn/USN-2183-1" source="UBUNTU" adv="1">USN-2183-1</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2915" source="DEBIAN" adv="1">DSA-2915</ref>
    </refs>
    <vuln_soft>
      <prod vendor="debian" name="dpkg">
        <vers num="1.10"/>
        <vers num="1.10.1"/>
        <vers num="1.10.11"/>
        <vers num="1.10.12"/>
        <vers num="1.10.13"/>
        <vers num="1.10.14"/>
        <vers num="1.10.15"/>
        <vers num="1.10.16"/>
        <vers num="1.10.17"/>
        <vers num="1.10.18"/>
        <vers num="1.10.18.1"/>
        <vers num="1.10.19"/>
        <vers num="1.10.2"/>
        <vers num="1.10.20"/>
        <vers num="1.10.21"/>
        <vers num="1.10.22"/>
        <vers num="1.10.23"/>
        <vers num="1.10.24"/>
        <vers num="1.10.25"/>
        <vers num="1.10.26"/>
        <vers num="1.10.27"/>
        <vers num="1.10.28"/>
        <vers num="1.10.3"/>
        <vers num="1.10.4"/>
        <vers num="1.10.5"/>
        <vers num="1.10.6"/>
        <vers num="1.10.7"/>
        <vers num="1.10.8"/>
        <vers num="1.10.9"/>
        <vers num="1.13.0"/>
        <vers num="1.13.1"/>
        <vers num="1.13.10"/>
        <vers num="1.13.11"/>
        <vers num="1.13.11.1"/>
        <vers num="1.13.12"/>
        <vers num="1.13.13"/>
        <vers num="1.13.14"/>
        <vers num="1.13.15"/>
        <vers num="1.13.16"/>
        <vers num="1.13.17"/>
        <vers num="1.13.18"/>
        <vers num="1.13.19"/>
        <vers num="1.13.2"/>
        <vers num="1.13.20"/>
        <vers num="1.13.21"/>
        <vers num="1.13.22"/>
        <vers num="1.13.23"/>
        <vers num="1.13.24"/>
        <vers num="1.13.25"/>
        <vers num="1.13.3"/>
        <vers num="1.13.4"/>
        <vers num="1.13.5"/>
        <vers num="1.13.6"/>
        <vers num="1.13.7"/>
        <vers num="1.13.8"/>
        <vers num="1.13.9"/>
        <vers num="1.14.0"/>
        <vers num="1.14.1"/>
        <vers num="1.14.10"/>
        <vers num="1.14.11"/>
        <vers num="1.14.12"/>
        <vers num="1.14.13"/>
        <vers num="1.14.14"/>
        <vers num="1.14.15"/>
        <vers num="1.14.16"/>
        <vers num="1.14.16.1"/>
        <vers num="1.14.16.2"/>
        <vers num="1.14.16.3"/>
        <vers num="1.14.16.4"/>
        <vers num="1.14.16.5"/>
        <vers num="1.14.16.6"/>
        <vers num="1.14.17"/>
        <vers num="1.14.18"/>
        <vers num="1.14.19"/>
        <vers num="1.14.2"/>
        <vers num="1.14.20"/>
        <vers num="1.14.21"/>
        <vers num="1.14.22"/>
        <vers num="1.14.23"/>
        <vers num="1.14.24"/>
        <vers num="1.14.25"/>
        <vers num="1.14.26"/>
        <vers num="1.14.27"/>
        <vers num="1.14.28"/>
        <vers num="1.14.29"/>
        <vers num="1.14.3"/>
        <vers num="1.14.30"/>
        <vers num="1.14.4"/>
        <vers num="1.14.5"/>
        <vers num="1.14.6"/>
        <vers num="1.14.7"/>
        <vers num="1.14.8"/>
        <vers num="1.14.9"/>
        <vers num="1.15.0"/>
        <vers num="1.15.1"/>
        <vers num="1.15.2"/>
        <vers num="1.15.3"/>
        <vers num="1.15.3.1"/>
        <vers num="1.15.4"/>
        <vers num="1.15.4.1"/>
        <vers num="1.15.5"/>
        <vers num="1.15.5.1"/>
        <vers num="1.15.5.2"/>
        <vers num="1.15.5.3"/>
        <vers num="1.15.5.4"/>
        <vers num="1.15.5.5"/>
        <vers num="1.15.5.6"/>
        <vers num="1.15.6"/>
        <vers num="1.15.6.1"/>
        <vers num="1.15.7"/>
        <vers num="1.15.7.1"/>
        <vers num="1.15.7.2"/>
        <vers num="1.15.8"/>
        <vers num="1.15.8.1"/>
        <vers num="1.15.8.2"/>
        <vers num="1.15.8.3"/>
        <vers num="1.15.8.4"/>
        <vers num="1.15.8.5"/>
        <vers num="1.15.8.6"/>
        <vers num="1.15.8.7"/>
        <vers prev="1" num="1.15.8.8"/>
        <vers num="1.15.8.9"/>
        <vers num="1.16.0"/>
        <vers num="1.16.0.1"/>
        <vers num="1.16.0.2"/>
        <vers num="1.16.0.3"/>
        <vers num="1.16.1"/>
        <vers num="1.16.1.1"/>
        <vers num="1.16.1.2"/>
        <vers num="1.16.10"/>
        <vers num="1.16.11"/>
        <vers num="1.16.12"/>
        <vers num="1.16.2"/>
        <vers num="1.16.3"/>
        <vers num="1.16.4"/>
        <vers num="1.16.4.1"/>
        <vers num="1.16.4.2"/>
        <vers num="1.16.4.3"/>
        <vers num="1.16.5"/>
        <vers num="1.16.6"/>
        <vers num="1.16.7"/>
        <vers num="1.16.8"/>
        <vers num="1.16.9"/>
        <vers num="1.17.0"/>
        <vers num="1.17.1"/>
        <vers num="1.17.2"/>
        <vers num="1.17.3"/>
        <vers num="1.17.4"/>
        <vers num="1.17.5"/>
        <vers num="1.17.6"/>
        <vers num="1.17.7"/>
        <vers num="1.9.1"/>
        <vers num="1.9.10"/>
        <vers num="1.9.11"/>
        <vers num="1.9.12"/>
        <vers num="1.9.13"/>
        <vers num="1.9.14"/>
        <vers num="1.9.15"/>
        <vers num="1.9.16"/>
        <vers num="1.9.17"/>
        <vers num="1.9.18"/>
        <vers num="1.9.19"/>
        <vers num="1.9.2"/>
        <vers num="1.9.20"/>
        <vers num="1.9.21"/>
        <vers num="1.9.3"/>
        <vers num="1.9.7"/>
        <vers num="1.9.8"/>
        <vers num="1.9.9"/>
      </prod>
      <prod vendor="canonical" name="ubuntu_linux">
        <vers num="10.04" edition="-:lts"/>
        <vers num="12.04" edition="-:lts"/>
        <vers num="12.10"/>
        <vers num="13.10"/>
        <vers num="14.04" edition=":lts"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0472" published="2014-04-23" name="CVE-2014-0472" modified="2014-04-24" CVSS_version="2.0" CVSS_vector="(AV:N/AC:H/Au:N/C:P/I:P/A:P)" CVSS_score="5.1" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="4.9" CVSS_base_score="5.1">
    <desc>
      <descript source="cve">The django.core.urlresolvers.reverse function in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 allows remote attackers to import and execute arbitrary Python modules by leveraging a view that constructs URLs using user input and a "dotted Python path."</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://www.djangoproject.com/weblog/2014/apr/21/security/" source="CONFIRM" adv="1">https://www.djangoproject.com/weblog/2014/apr/21/security/</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2169-1" source="UBUNTU">USN-2169-1</ref>
    </refs>
    <vuln_soft>
      <prod vendor="djangoproject" name="django">
        <vers num="1.4"/>
        <vers num="1.4.1"/>
        <vers prev="1" num="1.4.10"/>
        <vers num="1.4.2"/>
        <vers num="1.4.3"/>
        <vers num="1.4.4"/>
        <vers num="1.4.5"/>
        <vers num="1.4.6"/>
        <vers num="1.4.7"/>
        <vers num="1.4.8"/>
        <vers num="1.4.9"/>
        <vers num="1.5"/>
        <vers num="1.5.1"/>
        <vers num="1.5.2"/>
        <vers num="1.5.3"/>
        <vers num="1.5.4"/>
        <vers num="1.5.5"/>
        <vers num="1.6"/>
        <vers num="1.6.1"/>
        <vers num="1.6.2"/>
        <vers num="1.7" edition="alpha1"/>
        <vers num="1.7" edition="alpha2"/>
        <vers num="1.7" edition="beta1"/>
      </prod>
      <prod vendor="canonical" name="ubuntu_linux">
        <vers num="10.04" edition="-:lts"/>
        <vers num="12.04" edition="-:lts"/>
        <vers num="12.10"/>
        <vers num="13.10"/>
        <vers num="14.04" edition=":lts"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0473" published="2014-04-23" name="CVE-2014-0473" modified="2014-04-24" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:N/A:N)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">The caching framework in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 reuses a cached CSRF token for all anonymous users, which allows remote attackers to bypass CSRF protections by reading the CSRF cookie for anonymous users.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://www.djangoproject.com/weblog/2014/apr/21/security/" source="CONFIRM" adv="1">https://www.djangoproject.com/weblog/2014/apr/21/security/</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2169-1" source="UBUNTU">USN-2169-1</ref>
    </refs>
    <vuln_soft>
      <prod vendor="djangoproject" name="django">
        <vers num="1.4"/>
        <vers num="1.4.1"/>
        <vers prev="1" num="1.4.10"/>
        <vers num="1.4.2"/>
        <vers num="1.4.3"/>
        <vers num="1.4.4"/>
        <vers num="1.4.5"/>
        <vers num="1.4.6"/>
        <vers num="1.4.7"/>
        <vers num="1.4.8"/>
        <vers num="1.4.9"/>
        <vers num="1.5"/>
        <vers num="1.5.1"/>
        <vers num="1.5.2"/>
        <vers num="1.5.3"/>
        <vers num="1.5.4"/>
        <vers num="1.5.5"/>
        <vers num="1.6"/>
        <vers num="1.6.1"/>
        <vers num="1.6.2"/>
        <vers num="1.7" edition="alpha1"/>
        <vers num="1.7" edition="alpha2"/>
        <vers num="1.7" edition="beta1"/>
      </prod>
      <prod vendor="canonical" name="ubuntu_linux">
        <vers num="10.04" edition="-:lts"/>
        <vers num="12.04" edition="-:lts"/>
        <vers num="12.10"/>
        <vers num="13.10"/>
        <vers num="14.04" edition=":lts"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0474" published="2014-04-23" name="CVE-2014-0474" modified="2014-04-24" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:C/I:C/A:C)" CVSS_score="10.0" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="10.0" CVSS_base_score="10.0">
    <desc>
      <descript source="cve">The (1) FilePathField, (2) GenericIPAddressField, and (3) IPAddressField model field classes in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 do not properly perform type conversion, which allows remote attackers to have unspecified impact and vectors, related to "MySQL typecasting."</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://www.djangoproject.com/weblog/2014/apr/21/security/" source="CONFIRM" adv="1">https://www.djangoproject.com/weblog/2014/apr/21/security/</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2169-1" source="UBUNTU">USN-2169-1</ref>
    </refs>
    <vuln_soft>
      <prod vendor="djangoproject" name="django">
        <vers num="1.4"/>
        <vers num="1.4.1"/>
        <vers prev="1" num="1.4.10"/>
        <vers num="1.4.2"/>
        <vers num="1.4.3"/>
        <vers num="1.4.4"/>
        <vers num="1.4.5"/>
        <vers num="1.4.6"/>
        <vers num="1.4.7"/>
        <vers num="1.4.8"/>
        <vers num="1.4.9"/>
        <vers num="1.5"/>
        <vers num="1.5.1"/>
        <vers num="1.5.2"/>
        <vers num="1.5.3"/>
        <vers num="1.5.4"/>
        <vers num="1.5.5"/>
        <vers num="1.6"/>
        <vers num="1.6.1"/>
        <vers num="1.6.2"/>
        <vers num="1.7" edition="alpha1"/>
        <vers num="1.7" edition="alpha2"/>
        <vers num="1.7" edition="beta1"/>
      </prod>
      <prod vendor="canonical" name="ubuntu_linux">
        <vers num="10.04" edition="-:lts"/>
        <vers num="12.04" edition="-:lts"/>
        <vers num="12.10"/>
        <vers num="13.10"/>
        <vers num="14.04" edition=":lts"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0491" published="2014-01-15" name="CVE-2014-0491" modified="2014-02-21" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:C/I:C/A:C)" CVSS_score="10.0" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="10.0" CVSS_base_score="10.0">
    <desc>
      <descript source="cve">Adobe Flash Player before 11.7.700.260 and 11.8.x and 11.9.x before 12.0.0.38 on Windows and Mac OS X and before 11.2.202.335 on Linux, Adobe AIR before 4.0.0.1390, Adobe AIR SDK before 4.0.0.1390, and Adobe AIR SDK &amp; Compiler before 4.0.0.1390 allow attackers to bypass unspecified protection mechanisms via unknown vectors.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://helpx.adobe.com/security/products/flash-player/apsb14-02.html" source="CONFIRM" patch="1" adv="1">http://helpx.adobe.com/security/products/flash-player/apsb14-02.html</ref>
      <ref url="http://www.securitytracker.com/id/1029602" source="SECTRACK">1029602</ref>
      <ref url="http://secunia.com/advisories/56636" source="SECUNIA">56636</ref>
      <ref url="http://secunia.com/advisories/56516" source="SECUNIA">56516</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0028.html" source="REDHAT">RHSA-2014:0028</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-01/msg00006.html" source="SUSE">openSUSE-SU-2014:0128</ref>
    </refs>
    <vuln_soft>
      <prod vendor="adobe" name="adobe_air">
        <vers num="3.0.0.408"/>
        <vers num="3.0.0.4080"/>
        <vers num="3.1.0.485"/>
        <vers num="3.1.0.488"/>
        <vers num="3.1.0.4880"/>
        <vers num="3.2.0.207"/>
        <vers num="3.2.0.2070"/>
        <vers num="3.3.0.3670"/>
        <vers num="3.4.0.2540"/>
        <vers num="3.4.0.2710"/>
        <vers num="3.5.0.1060"/>
        <vers num="3.5.0.600"/>
        <vers num="3.5.0.880"/>
        <vers num="3.5.0.890"/>
        <vers num="3.6.0.597"/>
        <vers num="3.6.0.6090"/>
        <vers num="3.7.0.1530"/>
        <vers num="3.7.0.1860"/>
        <vers num="3.7.0.2090"/>
        <vers num="3.8.0.870"/>
        <vers num="3.8.0.910"/>
        <vers num="3.9.0.1030"/>
        <vers num="3.9.0.1060"/>
        <vers num="3.9.0.1210"/>
        <vers prev="1" num="3.9.0.1380"/>
      </prod>
      <prod vendor="adobe" name="adobe_air_sdk">
        <vers num="3.0.0.4080"/>
        <vers num="3.1.0.488"/>
        <vers num="3.2.0.2070"/>
        <vers num="3.3.0.3650"/>
        <vers num="3.3.0.3690"/>
        <vers num="3.4.0.2540"/>
        <vers num="3.4.0.2710"/>
        <vers num="3.5.0.1060"/>
        <vers num="3.5.0.600"/>
        <vers num="3.5.0.880"/>
        <vers num="3.5.0.890"/>
        <vers num="3.6.0.599"/>
        <vers num="3.6.0.6090"/>
        <vers num="3.7.0.1530"/>
        <vers num="3.7.0.1860"/>
        <vers num="3.7.0.2090"/>
        <vers num="3.8.0.870"/>
        <vers num="3.8.0.910"/>
        <vers num="3.9.0.1030"/>
        <vers num="3.9.0.1210"/>
        <vers prev="1" num="3.9.0.1380"/>
      </prod>
      <prod vendor="adobe" name="flash_player">
        <vers num="11.0"/>
        <vers num="11.0.1.152"/>
        <vers num="11.0.1.153"/>
        <vers num="11.1"/>
        <vers num="11.1.102.55"/>
        <vers num="11.1.102.59"/>
        <vers num="11.1.102.62"/>
        <vers num="11.1.102.63"/>
        <vers num="11.1.111.44"/>
        <vers num="11.1.111.50"/>
        <vers num="11.1.111.54"/>
        <vers num="11.1.111.8"/>
        <vers num="11.1.115.34"/>
        <vers num="11.1.115.48"/>
        <vers num="11.1.115.54"/>
        <vers num="11.1.115.58"/>
        <vers num="11.1.115.7"/>
        <vers num="11.2.202.223"/>
        <vers num="11.2.202.228"/>
        <vers num="11.2.202.233"/>
        <vers num="11.2.202.235"/>
        <vers num="11.2.202.236"/>
        <vers num="11.2.202.238"/>
        <vers num="11.2.202.243"/>
        <vers num="11.2.202.251"/>
        <vers num="11.2.202.258"/>
        <vers num="11.2.202.261"/>
        <vers num="11.2.202.262"/>
        <vers num="11.2.202.270"/>
        <vers num="11.2.202.273"/>
        <vers num="11.2.202.275"/>
        <vers num="11.2.202.280"/>
        <vers num="11.2.202.285"/>
        <vers num="11.2.202.291"/>
        <vers num="11.2.202.297"/>
        <vers num="11.2.202.310"/>
        <vers num="11.2.202.327"/>
        <vers prev="1" num="11.2.202.332"/>
        <vers num="11.3.300.257"/>
        <vers num="11.3.300.262"/>
        <vers num="11.3.300.265"/>
        <vers num="11.3.300.268"/>
        <vers num="11.3.300.270"/>
        <vers num="11.3.300.271"/>
        <vers num="11.3.300.273"/>
        <vers num="11.4.402.265"/>
        <vers num="11.4.402.278"/>
        <vers num="11.4.402.287"/>
        <vers num="11.5.502.110"/>
        <vers num="11.5.502.135"/>
        <vers num="11.5.502.136"/>
        <vers num="11.5.502.146"/>
        <vers num="11.5.502.149"/>
        <vers num="11.6.602.167"/>
        <vers num="11.6.602.168"/>
        <vers num="11.6.602.171"/>
        <vers num="11.6.602.180"/>
        <vers num="11.7.700.169"/>
        <vers num="11.7.700.202"/>
        <vers num="11.7.700.224"/>
        <vers num="11.7.700.232"/>
        <vers num="11.7.700.242"/>
        <vers num="11.7.700.252"/>
        <vers prev="1" num="11.7.700.257"/>
        <vers num="11.8.800.168"/>
        <vers num="11.8.800.94"/>
        <vers num="11.8.800.97"/>
        <vers num="11.9.900.117"/>
        <vers num="11.9.900.152"/>
        <vers prev="1" num="11.9.900.170"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0492" published="2014-01-15" name="CVE-2014-0492" modified="2014-02-21" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:C/I:C/A:C)" CVSS_score="10.0" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="10.0" CVSS_base_score="10.0">
    <desc>
      <descript source="cve">Adobe Flash Player before 11.7.700.260 and 11.8.x and 11.9.x before 12.0.0.38 on Windows and Mac OS X and before 11.2.202.335 on Linux, Adobe AIR before 4.0.0.1390, Adobe AIR SDK before 4.0.0.1390, and Adobe AIR SDK &amp; Compiler before 4.0.0.1390 allow attackers to defeat the ASLR protection mechanism by leveraging an "address leak."</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://helpx.adobe.com/security/products/flash-player/apsb14-02.html" source="CONFIRM" patch="1" adv="1">http://helpx.adobe.com/security/products/flash-player/apsb14-02.html</ref>
      <ref url="http://www.securitytracker.com/id/1029602" source="SECTRACK">1029602</ref>
      <ref url="http://secunia.com/advisories/56636" source="SECUNIA">56636</ref>
      <ref url="http://secunia.com/advisories/56516" source="SECUNIA">56516</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0028.html" source="REDHAT">RHSA-2014:0028</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-01/msg00006.html" source="SUSE">openSUSE-SU-2014:0128</ref>
    </refs>
    <vuln_soft>
      <prod vendor="adobe" name="adobe_air">
        <vers num="3.0.0.408"/>
        <vers num="3.0.0.4080"/>
        <vers num="3.1.0.485"/>
        <vers num="3.1.0.488"/>
        <vers num="3.1.0.4880"/>
        <vers num="3.2.0.207"/>
        <vers num="3.2.0.2070"/>
        <vers num="3.3.0.3670"/>
        <vers num="3.4.0.2540"/>
        <vers num="3.4.0.2710"/>
        <vers num="3.5.0.1060"/>
        <vers num="3.5.0.600"/>
        <vers num="3.5.0.880"/>
        <vers num="3.5.0.890"/>
        <vers num="3.6.0.597"/>
        <vers num="3.6.0.6090"/>
        <vers num="3.7.0.1530"/>
        <vers num="3.7.0.1860"/>
        <vers num="3.7.0.2090"/>
        <vers num="3.8.0.870"/>
        <vers num="3.8.0.910"/>
        <vers num="3.9.0.1030"/>
        <vers num="3.9.0.1060"/>
        <vers num="3.9.0.1210"/>
        <vers prev="1" num="3.9.0.1380"/>
      </prod>
      <prod vendor="adobe" name="adobe_air_sdk">
        <vers num="3.0.0.4080"/>
        <vers num="3.1.0.488"/>
        <vers num="3.2.0.2070"/>
        <vers num="3.3.0.3650"/>
        <vers num="3.3.0.3690"/>
        <vers num="3.4.0.2540"/>
        <vers num="3.4.0.2710"/>
        <vers num="3.5.0.1060"/>
        <vers num="3.5.0.600"/>
        <vers num="3.5.0.880"/>
        <vers num="3.5.0.890"/>
        <vers num="3.6.0.599"/>
        <vers num="3.6.0.6090"/>
        <vers num="3.7.0.1530"/>
        <vers num="3.7.0.1860"/>
        <vers num="3.7.0.2090"/>
        <vers num="3.8.0.870"/>
        <vers num="3.8.0.910"/>
        <vers num="3.9.0.1030"/>
        <vers num="3.9.0.1210"/>
        <vers prev="1" num="3.9.0.1380"/>
      </prod>
      <prod vendor="adobe" name="flash_player">
        <vers num="11.0"/>
        <vers num="11.0.1.152"/>
        <vers num="11.0.1.153"/>
        <vers num="11.1"/>
        <vers num="11.1.102.55"/>
        <vers num="11.1.102.59"/>
        <vers num="11.1.102.62"/>
        <vers num="11.1.102.63"/>
        <vers num="11.1.111.44"/>
        <vers num="11.1.111.50"/>
        <vers num="11.1.111.54"/>
        <vers num="11.1.111.8"/>
        <vers num="11.1.115.34"/>
        <vers num="11.1.115.48"/>
        <vers num="11.1.115.54"/>
        <vers num="11.1.115.58"/>
        <vers num="11.1.115.7"/>
        <vers num="11.2.202.223"/>
        <vers num="11.2.202.228"/>
        <vers num="11.2.202.233"/>
        <vers num="11.2.202.235"/>
        <vers num="11.2.202.236"/>
        <vers num="11.2.202.238"/>
        <vers num="11.2.202.243"/>
        <vers num="11.2.202.251"/>
        <vers num="11.2.202.258"/>
        <vers num="11.2.202.261"/>
        <vers num="11.2.202.262"/>
        <vers num="11.2.202.270"/>
        <vers num="11.2.202.273"/>
        <vers num="11.2.202.275"/>
        <vers num="11.2.202.280"/>
        <vers num="11.2.202.285"/>
        <vers num="11.2.202.291"/>
        <vers num="11.2.202.297"/>
        <vers num="11.2.202.310"/>
        <vers num="11.2.202.327"/>
        <vers prev="1" num="11.2.202.332"/>
        <vers num="11.3.300.257"/>
        <vers num="11.3.300.262"/>
        <vers num="11.3.300.265"/>
        <vers num="11.3.300.268"/>
        <vers num="11.3.300.270"/>
        <vers num="11.3.300.271"/>
        <vers num="11.3.300.273"/>
        <vers num="11.4.402.265"/>
        <vers num="11.4.402.278"/>
        <vers num="11.4.402.287"/>
        <vers num="11.5.502.110"/>
        <vers num="11.5.502.135"/>
        <vers num="11.5.502.136"/>
        <vers num="11.5.502.146"/>
        <vers num="11.5.502.149"/>
        <vers num="11.6.602.167"/>
        <vers num="11.6.602.168"/>
        <vers num="11.6.602.171"/>
        <vers num="11.6.602.180"/>
        <vers num="11.7.700.169"/>
        <vers num="11.7.700.202"/>
        <vers num="11.7.700.224"/>
        <vers num="11.7.700.232"/>
        <vers num="11.7.700.242"/>
        <vers num="11.7.700.252"/>
        <vers prev="1" num="11.7.700.257"/>
        <vers num="11.8.800.168"/>
        <vers num="11.8.800.94"/>
        <vers num="11.8.800.97"/>
        <vers num="11.9.900.117"/>
        <vers num="11.9.900.152"/>
        <vers prev="1" num="11.9.900.170"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0493" published="2014-01-15" name="CVE-2014-0493" modified="2014-02-06" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:C/I:C/A:C)" CVSS_score="10.0" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="10.0" CVSS_base_score="10.0">
    <desc>
      <descript source="cve">Adobe Reader and Acrobat 10.x before 10.1.9 and 11.x before 11.0.06 on Windows and Mac OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0495.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.securitytracker.com/id/1029604" source="SECTRACK">1029604</ref>
      <ref url="http://helpx.adobe.com/security/products/acrobat/apsb14-01.html" source="CONFIRM" adv="1">http://helpx.adobe.com/security/products/acrobat/apsb14-01.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="adobe" name="acrobat">
        <vers num="10.1"/>
        <vers num="10.1.1"/>
        <vers num="10.1.2"/>
        <vers num="10.1.3"/>
        <vers num="10.1.4"/>
        <vers num="10.1.5"/>
        <vers num="10.1.6"/>
        <vers num="10.1.7"/>
        <vers prev="1" num="10.1.8"/>
        <vers num="11.0"/>
        <vers num="11.0.1"/>
        <vers num="11.0.2"/>
        <vers num="11.0.3"/>
        <vers num="11.0.4"/>
        <vers prev="1" num="11.0.5"/>
      </prod>
      <prod vendor="adobe" name="acrobat_reader">
        <vers num="10.1"/>
        <vers num="10.1.1"/>
        <vers num="10.1.2"/>
        <vers num="10.1.3"/>
        <vers num="10.1.4"/>
        <vers num="10.1.5"/>
        <vers num="10.1.6"/>
        <vers num="10.1.7"/>
        <vers prev="1" num="10.1.8"/>
        <vers num="11.0"/>
        <vers num="11.0.1"/>
        <vers num="11.0.2"/>
        <vers num="11.0.3"/>
        <vers num="11.0.4"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0494" published="2014-01-23" name="CVE-2014-0494" modified="2014-02-06" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:C/I:C/A:C)" CVSS_score="10.0" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="10.0" CVSS_base_score="10.0">
    <desc>
      <descript source="cve">Adobe Digital Editions 2.0.1 allows attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90648" source="XF">adobe-digital-cve20140494-code-exec(90648)</ref>
      <ref url="http://www.securitytracker.com/id/1029680" source="SECTRACK">1029680</ref>
      <ref url="http://www.securityfocus.com/bid/65091" source="BID">65091</ref>
      <ref url="http://secunia.com/advisories/56578" source="SECUNIA">56578</ref>
      <ref url="http://osvdb.org/102364" source="OSVDB">102364</ref>
      <ref url="http://helpx.adobe.com/security/products/Digital-Editions/apsb14-03.html" source="CONFIRM" adv="1">http://helpx.adobe.com/security/products/Digital-Editions/apsb14-03.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="adobe" name="digital_editions">
        <vers num="2.0.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0495" published="2014-01-15" name="CVE-2014-0495" modified="2014-02-06" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:C/I:C/A:C)" CVSS_score="10.0" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="10.0" CVSS_base_score="10.0">
    <desc>
      <descript source="cve">Adobe Reader and Acrobat 10.x before 10.1.9 and 11.x before 11.0.06 on Windows and Mac OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0493.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.securitytracker.com/id/1029604" source="SECTRACK">1029604</ref>
      <ref url="http://helpx.adobe.com/security/products/acrobat/apsb14-01.html" source="CONFIRM" adv="1">http://helpx.adobe.com/security/products/acrobat/apsb14-01.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="adobe" name="acrobat">
        <vers num="10.1"/>
        <vers num="10.1.1"/>
        <vers num="10.1.2"/>
        <vers num="10.1.3"/>
        <vers num="10.1.4"/>
        <vers num="10.1.5"/>
        <vers num="10.1.6"/>
        <vers num="10.1.7"/>
        <vers prev="1" num="10.1.8"/>
        <vers num="11.0"/>
        <vers num="11.0.1"/>
        <vers num="11.0.2"/>
        <vers num="11.0.3"/>
        <vers num="11.0.4"/>
        <vers prev="1" num="11.0.5"/>
      </prod>
      <prod vendor="adobe" name="acrobat_reader">
        <vers num="10.1"/>
        <vers num="10.1.1"/>
        <vers num="10.1.2"/>
        <vers num="10.1.3"/>
        <vers num="10.1.4"/>
        <vers num="10.1.5"/>
        <vers num="10.1.6"/>
        <vers num="10.1.7"/>
        <vers prev="1" num="10.1.8"/>
        <vers num="11.0"/>
        <vers num="11.0.1"/>
        <vers num="11.0.2"/>
        <vers num="11.0.3"/>
        <vers num="11.0.4"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0496" published="2014-01-15" name="CVE-2014-0496" modified="2014-02-06" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:C/I:C/A:C)" CVSS_score="10.0" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="10.0" CVSS_base_score="10.0">
    <desc>
      <descript source="cve">Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.9 and 11.x before 11.0.06 on Windows and Mac OS X allows attackers to execute arbitrary code via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.securitytracker.com/id/1029604" source="SECTRACK">1029604</ref>
      <ref url="http://helpx.adobe.com/security/products/acrobat/apsb14-01.html" source="CONFIRM" adv="1">http://helpx.adobe.com/security/products/acrobat/apsb14-01.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="adobe" name="acrobat">
        <vers num="10.1"/>
        <vers num="10.1.1"/>
        <vers num="10.1.2"/>
        <vers num="10.1.3"/>
        <vers num="10.1.4"/>
        <vers num="10.1.5"/>
        <vers num="10.1.6"/>
        <vers num="10.1.7"/>
        <vers prev="1" num="10.1.8"/>
        <vers num="11.0"/>
        <vers num="11.0.1"/>
        <vers num="11.0.2"/>
        <vers num="11.0.3"/>
        <vers num="11.0.4"/>
        <vers prev="1" num="11.0.5"/>
      </prod>
      <prod vendor="adobe" name="acrobat_reader">
        <vers num="10.1"/>
        <vers num="10.1.1"/>
        <vers num="10.1.2"/>
        <vers num="10.1.3"/>
        <vers num="10.1.4"/>
        <vers num="10.1.5"/>
        <vers num="10.1.6"/>
        <vers num="10.1.7"/>
        <vers prev="1" num="10.1.8"/>
        <vers num="11.0"/>
        <vers num="11.0.1"/>
        <vers num="11.0.2"/>
        <vers num="11.0.3"/>
        <vers num="11.0.4"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0497" published="2014-02-05" name="CVE-2014-0497" modified="2014-02-21" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:C/I:C/A:C)" CVSS_score="10.0" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="10.0" CVSS_base_score="10.0">
    <desc>
      <descript source="cve">Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Mac OS X, and before 11.2.202.336 on Linux, allows remote attackers to execute arbitrary code via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://helpx.adobe.com/security/products/flash-player/apsb14-04.html" source="CONFIRM" patch="1" adv="1">http://helpx.adobe.com/security/products/flash-player/apsb14-04.html</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0137.html" source="REDHAT">RHSA-2014:0137</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00006.html" source="SUSE">SUSE-SU-2014:0221</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00001.html" source="SUSE">openSUSE-SU-2014:0203</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00000.html" source="SUSE">openSUSE-SU-2014:0197</ref>
    </refs>
    <vuln_soft>
      <prod vendor="adobe" name="flash_player">
        <vers num="11.0"/>
        <vers num="11.0.1.152"/>
        <vers num="11.0.1.153"/>
        <vers num="11.1"/>
        <vers num="11.1.102.55"/>
        <vers num="11.1.102.59"/>
        <vers num="11.1.102.62"/>
        <vers num="11.1.102.63"/>
        <vers num="11.1.111.44"/>
        <vers num="11.1.111.50"/>
        <vers num="11.1.111.54"/>
        <vers num="11.1.111.8"/>
        <vers num="11.1.115.34"/>
        <vers num="11.1.115.48"/>
        <vers num="11.1.115.54"/>
        <vers num="11.1.115.58"/>
        <vers num="11.1.115.7"/>
        <vers num="11.2.202.223"/>
        <vers num="11.2.202.228"/>
        <vers num="11.2.202.233"/>
        <vers num="11.2.202.235"/>
        <vers num="11.2.202.236"/>
        <vers num="11.2.202.238"/>
        <vers num="11.2.202.243"/>
        <vers num="11.2.202.251"/>
        <vers num="11.2.202.258"/>
        <vers num="11.2.202.261"/>
        <vers num="11.2.202.262"/>
        <vers num="11.2.202.270"/>
        <vers num="11.2.202.273"/>
        <vers num="11.2.202.275"/>
        <vers num="11.2.202.280"/>
        <vers num="11.2.202.285"/>
        <vers num="11.2.202.291"/>
        <vers num="11.2.202.297"/>
        <vers num="11.2.202.310"/>
        <vers num="11.2.202.327"/>
        <vers num="11.2.202.332"/>
        <vers prev="1" num="11.2.202.335"/>
        <vers num="11.3.300.257"/>
        <vers num="11.3.300.262"/>
        <vers num="11.3.300.265"/>
        <vers num="11.3.300.268"/>
        <vers num="11.3.300.270"/>
        <vers num="11.3.300.271"/>
        <vers num="11.3.300.273"/>
        <vers num="11.4.402.265"/>
        <vers num="11.4.402.278"/>
        <vers num="11.4.402.287"/>
        <vers num="11.5.502.110"/>
        <vers num="11.5.502.135"/>
        <vers num="11.5.502.136"/>
        <vers num="11.5.502.146"/>
        <vers num="11.5.502.149"/>
        <vers num="11.6.602.167"/>
        <vers num="11.6.602.168"/>
        <vers num="11.6.602.171"/>
        <vers num="11.6.602.180"/>
        <vers num="11.7.700.169"/>
        <vers num="11.7.700.202"/>
        <vers num="11.7.700.224"/>
        <vers num="11.7.700.232"/>
        <vers num="11.7.700.242"/>
        <vers num="11.7.700.252"/>
        <vers num="11.7.700.257"/>
        <vers prev="1" num="11.7.700.260"/>
        <vers num="11.8.800.168"/>
        <vers num="11.8.800.94"/>
        <vers num="11.8.800.97"/>
        <vers num="11.9.900.117"/>
        <vers num="11.9.900.152"/>
        <vers num="11.9.900.170"/>
        <vers num="12.0.0.38"/>
        <vers num="12.0.0.41"/>
        <vers prev="1" num="12.0.0.43"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0498" published="2014-02-21" name="CVE-2014-0498" modified="2014-03-05" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:C/I:C/A:C)" CVSS_score="10.0" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="10.0" CVSS_base_score="10.0">
    <desc>
      <descript source="cve">Stack-based buffer overflow in Adobe Flash Player before 11.7.700.269 and 11.8.x through 12.0.x before 12.0.0.70 on Windows and Mac OS X and before 11.2.202.341 on Linux, Adobe AIR before 4.0.0.1628 on Android, Adobe AIR SDK before 4.0.0.1628, and Adobe AIR SDK &amp; Compiler before 4.0.0.1628 allows attackers to execute arbitrary code via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://helpx.adobe.com/security/products/flash-player/apsb14-07.html" source="CONFIRM" patch="1" adv="1">http://helpx.adobe.com/security/products/flash-player/apsb14-07.html</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0196.html" source="REDHAT">RHSA-2014:0196</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00017.html" source="SUSE">SUSE-SU-2014:0290</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00015.html" source="SUSE">openSUSE-SU-2014:0278</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00014.html" source="SUSE">openSUSE-SU-2014:0277</ref>
    </refs>
    <vuln_soft>
      <prod vendor="adobe" name="adobe_air">
        <vers num="1.0"/>
        <vers num="1.0.1"/>
        <vers num="1.0.4990"/>
        <vers num="1.0.8.4990"/>
        <vers num="1.1"/>
        <vers num="1.1.0.5790"/>
        <vers num="1.5"/>
        <vers num="1.5.0.7220"/>
        <vers num="1.5.1"/>
        <vers num="1.5.1.8210"/>
        <vers num="1.5.2"/>
        <vers num="1.5.3"/>
        <vers num="1.5.3.9120"/>
        <vers num="1.5.3.9130"/>
        <vers num="2.0.2"/>
        <vers num="2.0.2.12610"/>
        <vers num="2.0.3"/>
        <vers num="2.0.3.13070"/>
        <vers num="2.0.4"/>
        <vers num="2.5.0.16600"/>
        <vers num="2.5.1.17730"/>
        <vers num="2.6"/>
        <vers num="2.6.0.19120"/>
        <vers num="2.6.0.19140"/>
        <vers num="2.7"/>
        <vers num="2.7.0.1948"/>
        <vers num="2.7.0.19480"/>
        <vers num="2.7.0.1953"/>
        <vers num="2.7.0.19530"/>
        <vers num="2.7.1"/>
        <vers num="2.7.1.19610"/>
        <vers num="3.0.0.408"/>
        <vers num="3.0.0.4080"/>
        <vers num="3.1.0.485"/>
        <vers num="3.1.0.488"/>
        <vers num="3.1.0.4880"/>
        <vers num="3.2.0.207"/>
        <vers num="3.2.0.2070"/>
        <vers num="3.3.0.3670"/>
        <vers num="3.4.0.2540"/>
        <vers num="3.4.0.2710"/>
        <vers num="3.5.0.1060"/>
        <vers num="3.5.0.600"/>
        <vers num="3.5.0.880"/>
        <vers num="3.5.0.890"/>
        <vers num="3.6.0.597"/>
        <vers num="3.6.0.6090"/>
        <vers num="3.7.0.1530"/>
        <vers num="3.7.0.1860"/>
        <vers num="3.7.0.2090"/>
        <vers num="3.8.0.870"/>
        <vers num="3.8.0.910"/>
        <vers num="3.9.0.1030"/>
        <vers num="3.9.0.1060"/>
        <vers num="3.9.0.1210"/>
        <vers num="3.9.0.1380"/>
        <vers prev="1" num="4.0.0.1390"/>
      </prod>
      <prod vendor="adobe" name="adobe_air_sdk">
        <vers num="3.0.0.4080"/>
        <vers num="3.1.0.488"/>
        <vers num="3.2.0.2070"/>
        <vers num="3.3.0.3650"/>
        <vers num="3.3.0.3690"/>
        <vers num="3.4.0.2540"/>
        <vers num="3.4.0.2710"/>
        <vers num="3.5.0.1060"/>
        <vers num="3.5.0.600"/>
        <vers num="3.5.0.880"/>
        <vers num="3.5.0.890"/>
        <vers num="3.6.0.599"/>
        <vers num="3.6.0.6090"/>
        <vers num="3.7.0.1530"/>
        <vers num="3.7.0.1860"/>
        <vers num="3.7.0.2090"/>
        <vers num="3.8.0.1430"/>
        <vers num="3.8.0.870"/>
        <vers num="3.8.0.910"/>
        <vers num="3.9.0.1030"/>
        <vers num="3.9.0.1210"/>
        <vers num="3.9.0.1380"/>
        <vers prev="1" num="4.0.0.1390"/>
      </prod>
      <prod vendor="adobe" name="flash_player">
        <vers num="11.0"/>
        <vers num="11.0.1.152"/>
        <vers num="11.0.1.153"/>
        <vers num="11.1"/>
        <vers num="11.1.102.55"/>
        <vers num="11.1.102.59"/>
        <vers num="11.1.102.62"/>
        <vers num="11.1.102.63"/>
        <vers num="11.1.111.44"/>
        <vers num="11.1.111.50"/>
        <vers num="11.1.111.54"/>
        <vers num="11.1.111.8"/>
        <vers num="11.1.115.34"/>
        <vers num="11.1.115.48"/>
        <vers num="11.1.115.54"/>
        <vers num="11.1.115.58"/>
        <vers num="11.1.115.7"/>
        <vers num="11.2.202.223"/>
        <vers num="11.2.202.228"/>
        <vers num="11.2.202.233"/>
        <vers num="11.2.202.235"/>
        <vers num="11.2.202.236"/>
        <vers num="11.2.202.238"/>
        <vers num="11.2.202.243"/>
        <vers num="11.2.202.251"/>
        <vers num="11.2.202.258"/>
        <vers num="11.2.202.261"/>
        <vers num="11.2.202.262"/>
        <vers num="11.2.202.270"/>
        <vers num="11.2.202.273"/>
        <vers num="11.2.202.275"/>
        <vers num="11.2.202.280"/>
        <vers num="11.2.202.285"/>
        <vers num="11.2.202.291"/>
        <vers num="11.2.202.297"/>
        <vers num="11.2.202.310"/>
        <vers num="11.2.202.327"/>
        <vers num="11.2.202.332"/>
        <vers num="11.2.202.335"/>
        <vers prev="1" num="11.2.202.336"/>
        <vers num="11.3.300.257"/>
        <vers num="11.3.300.262"/>
        <vers num="11.3.300.265"/>
        <vers num="11.3.300.268"/>
        <vers num="11.3.300.270"/>
        <vers num="11.3.300.271"/>
        <vers num="11.3.300.273"/>
        <vers num="11.4.402.265"/>
        <vers num="11.4.402.278"/>
        <vers num="11.4.402.287"/>
        <vers num="11.5.502.110"/>
        <vers num="11.5.502.135"/>
        <vers num="11.5.502.136"/>
        <vers num="11.5.502.146"/>
        <vers num="11.5.502.149"/>
        <vers num="11.6.602.167"/>
        <vers num="11.6.602.168"/>
        <vers num="11.6.602.171"/>
        <vers num="11.6.602.180"/>
        <vers num="11.7.700.169"/>
        <vers num="11.7.700.202"/>
        <vers num="11.7.700.224"/>
        <vers num="11.7.700.225"/>
        <vers num="11.7.700.232"/>
        <vers num="11.7.700.242"/>
        <vers num="11.7.700.252"/>
        <vers num="11.7.700.257"/>
        <vers num="11.7.700.260"/>
        <vers prev="1" num="11.7.700.261"/>
        <vers num="11.8.800.168"/>
        <vers num="11.8.800.94"/>
        <vers num="11.8.800.97"/>
        <vers num="11.9.900.117"/>
        <vers num="11.9.900.152"/>
        <vers num="11.9.900.170"/>
        <vers num="12.0.0.38"/>
        <vers num="12.0.0.41"/>
        <vers num="12.0.0.43"/>
        <vers prev="1" num="12.0.0.44"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0499" published="2014-02-21" name="CVE-2014-0499" modified="2014-03-05" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:C/I:N/A:N)" CVSS_score="7.8" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="10.0" CVSS_base_score="7.8">
    <desc>
      <descript source="cve">Adobe Flash Player before 11.7.700.269 and 11.8.x through 12.0.x before 12.0.0.70 on Windows and Mac OS X and before 11.2.202.341 on Linux, Adobe AIR before 4.0.0.1628 on Android, Adobe AIR SDK before 4.0.0.1628, and Adobe AIR SDK &amp; Compiler before 4.0.0.1628 do not prevent access to address information, which makes it easier for attackers to bypass the ASLR protection mechanism via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://helpx.adobe.com/security/products/flash-player/apsb14-07.html" source="CONFIRM" patch="1" adv="1">http://helpx.adobe.com/security/products/flash-player/apsb14-07.html</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0196.html" source="REDHAT">RHSA-2014:0196</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00017.html" source="SUSE">SUSE-SU-2014:0290</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00015.html" source="SUSE">openSUSE-SU-2014:0278</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00014.html" source="SUSE">openSUSE-SU-2014:0277</ref>
    </refs>
    <vuln_soft>
      <prod vendor="adobe" name="adobe_air">
        <vers num="1.0"/>
        <vers num="1.0.1"/>
        <vers num="1.0.4990"/>
        <vers num="1.0.8.4990"/>
        <vers num="1.1"/>
        <vers num="1.1.0.5790"/>
        <vers num="1.5"/>
        <vers num="1.5.0.7220"/>
        <vers num="1.5.1"/>
        <vers num="1.5.1.8210"/>
        <vers num="1.5.2"/>
        <vers num="1.5.3"/>
        <vers num="1.5.3.9120"/>
        <vers num="1.5.3.9130"/>
        <vers num="2.0.2"/>
        <vers num="2.0.2.12610"/>
        <vers num="2.0.3"/>
        <vers num="2.0.3.13070"/>
        <vers num="2.0.4"/>
        <vers num="2.5.0.16600"/>
        <vers num="2.5.1.17730"/>
        <vers num="2.6"/>
        <vers num="2.6.0.19120"/>
        <vers num="2.6.0.19140"/>
        <vers num="2.7"/>
        <vers num="2.7.0.1948"/>
        <vers num="2.7.0.19480"/>
        <vers num="2.7.0.1953"/>
        <vers num="2.7.0.19530"/>
        <vers num="2.7.1"/>
        <vers num="2.7.1.19610"/>
        <vers num="3.0.0.408"/>
        <vers num="3.0.0.4080"/>
        <vers num="3.1.0.485"/>
        <vers num="3.1.0.488"/>
        <vers num="3.1.0.4880"/>
        <vers num="3.2.0.207"/>
        <vers num="3.2.0.2070"/>
        <vers num="3.3.0.3670"/>
        <vers num="3.4.0.2540"/>
        <vers num="3.4.0.2710"/>
        <vers num="3.5.0.1060"/>
        <vers num="3.5.0.600"/>
        <vers num="3.5.0.880"/>
        <vers num="3.5.0.890"/>
        <vers num="3.6.0.597"/>
        <vers num="3.6.0.6090"/>
        <vers num="3.7.0.1530"/>
        <vers num="3.7.0.1860"/>
        <vers num="3.7.0.2090"/>
        <vers num="3.8.0.870"/>
        <vers num="3.8.0.910"/>
        <vers num="3.9.0.1030"/>
        <vers num="3.9.0.1060"/>
        <vers num="3.9.0.1210"/>
        <vers num="3.9.0.1380"/>
        <vers prev="1" num="4.0.0.1390"/>
      </prod>
      <prod vendor="adobe" name="adobe_air_sdk">
        <vers num="3.0.0.4080"/>
        <vers num="3.1.0.488"/>
        <vers num="3.2.0.2070"/>
        <vers num="3.3.0.3650"/>
        <vers num="3.3.0.3690"/>
        <vers num="3.4.0.2540"/>
        <vers num="3.4.0.2710"/>
        <vers num="3.5.0.1060"/>
        <vers num="3.5.0.600"/>
        <vers num="3.5.0.880"/>
        <vers num="3.5.0.890"/>
        <vers num="3.6.0.599"/>
        <vers num="3.6.0.6090"/>
        <vers num="3.7.0.1530"/>
        <vers num="3.7.0.1860"/>
        <vers num="3.7.0.2090"/>
        <vers num="3.8.0.1430"/>
        <vers num="3.8.0.870"/>
        <vers num="3.8.0.910"/>
        <vers num="3.9.0.1030"/>
        <vers num="3.9.0.1210"/>
        <vers num="3.9.0.1380"/>
        <vers prev="1" num="4.0.0.1390"/>
      </prod>
      <prod vendor="adobe" name="flash_player">
        <vers num="11.0"/>
        <vers num="11.0.1.152"/>
        <vers num="11.0.1.153"/>
        <vers num="11.1"/>
        <vers num="11.1.102.55"/>
        <vers num="11.1.102.59"/>
        <vers num="11.1.102.62"/>
        <vers num="11.1.102.63"/>
        <vers num="11.1.111.44"/>
        <vers num="11.1.111.50"/>
        <vers num="11.1.111.54"/>
        <vers num="11.1.111.8"/>
        <vers num="11.1.115.34"/>
        <vers num="11.1.115.48"/>
        <vers num="11.1.115.54"/>
        <vers num="11.1.115.58"/>
        <vers num="11.1.115.7"/>
        <vers num="11.2.202.223"/>
        <vers num="11.2.202.228"/>
        <vers num="11.2.202.233"/>
        <vers num="11.2.202.235"/>
        <vers num="11.2.202.236"/>
        <vers num="11.2.202.238"/>
        <vers num="11.2.202.243"/>
        <vers num="11.2.202.251"/>
        <vers num="11.2.202.258"/>
        <vers num="11.2.202.261"/>
        <vers num="11.2.202.262"/>
        <vers num="11.2.202.270"/>
        <vers num="11.2.202.273"/>
        <vers num="11.2.202.275"/>
        <vers num="11.2.202.280"/>
        <vers num="11.2.202.285"/>
        <vers num="11.2.202.291"/>
        <vers num="11.2.202.297"/>
        <vers num="11.2.202.310"/>
        <vers num="11.2.202.327"/>
        <vers num="11.2.202.332"/>
        <vers num="11.2.202.335"/>
        <vers prev="1" num="11.2.202.336"/>
        <vers num="11.3.300.257"/>
        <vers num="11.3.300.262"/>
        <vers num="11.3.300.265"/>
        <vers num="11.3.300.268"/>
        <vers num="11.3.300.270"/>
        <vers num="11.3.300.271"/>
        <vers num="11.3.300.273"/>
        <vers num="11.4.402.265"/>
        <vers num="11.4.402.278"/>
        <vers num="11.4.402.287"/>
        <vers num="11.5.502.110"/>
        <vers num="11.5.502.135"/>
        <vers num="11.5.502.136"/>
        <vers num="11.5.502.146"/>
        <vers num="11.5.502.149"/>
        <vers num="11.6.602.167"/>
        <vers num="11.6.602.168"/>
        <vers num="11.6.602.171"/>
        <vers num="11.6.602.180"/>
        <vers num="11.7.700.169"/>
        <vers num="11.7.700.202"/>
        <vers num="11.7.700.224"/>
        <vers num="11.7.700.225"/>
        <vers num="11.7.700.232"/>
        <vers num="11.7.700.242"/>
        <vers num="11.7.700.252"/>
        <vers num="11.7.700.257"/>
        <vers num="11.7.700.260"/>
        <vers prev="1" num="11.7.700.261"/>
        <vers num="11.8.800.168"/>
        <vers num="11.8.800.94"/>
        <vers num="11.8.800.97"/>
        <vers num="11.9.900.117"/>
        <vers num="11.9.900.152"/>
        <vers num="11.9.900.170"/>
        <vers num="12.0.0.38"/>
        <vers num="12.0.0.41"/>
        <vers num="12.0.0.43"/>
        <vers prev="1" num="12.0.0.44"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0500" published="2014-02-11" name="CVE-2014-0500" modified="2014-02-13" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:C/I:C/A:C)" CVSS_score="10.0" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="10.0" CVSS_base_score="10.0">
    <desc>
      <descript source="cve">Adobe Shockwave Player before 12.0.9.149 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0501.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://helpx.adobe.com/security/products/shockwave/apsb14-06.html" source="CONFIRM" adv="1">http://helpx.adobe.com/security/products/shockwave/apsb14-06.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="adobe" name="shockwave_player">
        <vers num="11.0.0.456"/>
        <vers num="11.0.3.471"/>
        <vers num="11.5.0.595"/>
        <vers num="11.5.0.596"/>
        <vers num="11.5.1.601"/>
        <vers num="11.5.10.620"/>
        <vers num="11.5.2.602"/>
        <vers num="11.5.6.606"/>
        <vers num="11.5.7.609"/>
        <vers num="11.5.8.612"/>
        <vers num="11.5.9.615"/>
        <vers num="11.5.9.620"/>
        <vers num="11.6.0.626"/>
        <vers num="11.6.1.629"/>
        <vers num="11.6.3.633"/>
        <vers num="11.6.4.634"/>
        <vers num="11.6.5.635"/>
        <vers num="11.6.6.636"/>
        <vers num="11.6.7.637"/>
        <vers num="11.6.8.638"/>
        <vers num="12.0.0.112"/>
        <vers num="12.0.2.122"/>
        <vers num="12.0.3.133"/>
        <vers num="12.0.4.144"/>
        <vers num="12.0.6.147"/>
        <vers prev="1" num="12.0.7.148"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0501" published="2014-02-11" name="CVE-2014-0501" modified="2014-02-13" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:C/I:C/A:C)" CVSS_score="10.0" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="10.0" CVSS_base_score="10.0">
    <desc>
      <descript source="cve">Adobe Shockwave Player before 12.0.9.149 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0500.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://helpx.adobe.com/security/products/shockwave/apsb14-06.html" source="CONFIRM" adv="1">http://helpx.adobe.com/security/products/shockwave/apsb14-06.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="adobe" name="shockwave_player">
        <vers num="11.0.0.456"/>
        <vers num="11.0.3.471"/>
        <vers num="11.5.0.595"/>
        <vers num="11.5.0.596"/>
        <vers num="11.5.1.601"/>
        <vers num="11.5.10.620"/>
        <vers num="11.5.2.602"/>
        <vers num="11.5.6.606"/>
        <vers num="11.5.7.609"/>
        <vers num="11.5.8.612"/>
        <vers num="11.5.9.615"/>
        <vers num="11.5.9.620"/>
        <vers num="11.6.0.626"/>
        <vers num="11.6.1.629"/>
        <vers num="11.6.3.633"/>
        <vers num="11.6.4.634"/>
        <vers num="11.6.5.635"/>
        <vers num="11.6.6.636"/>
        <vers num="11.6.7.637"/>
        <vers num="11.6.8.638"/>
        <vers num="12.0.0.112"/>
        <vers num="12.0.2.122"/>
        <vers num="12.0.3.133"/>
        <vers num="12.0.4.144"/>
        <vers num="12.0.6.147"/>
        <vers prev="1" num="12.0.7.148"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0502" published="2014-02-21" name="CVE-2014-0502" modified="2014-03-05" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:C/I:C/A:C)" CVSS_score="10.0" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="10.0" CVSS_base_score="10.0">
    <desc>
      <descript source="cve">Double free vulnerability in Adobe Flash Player before 11.7.700.269 and 11.8.x through 12.0.x before 12.0.0.70 on Windows and Mac OS X and before 11.2.202.341 on Linux, Adobe AIR before 4.0.0.1628 on Android, Adobe AIR SDK before 4.0.0.1628, and Adobe AIR SDK &amp; Compiler before 4.0.0.1628 allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in February 2014.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://helpx.adobe.com/security/products/flash-player/apsb14-07.html" source="CONFIRM" patch="1" adv="1">http://helpx.adobe.com/security/products/flash-player/apsb14-07.html</ref>
      <ref url="http://www.alienvault.com/open-threat-exchange/blog/analysis-of-an-attack-exploiting-the-adobe-zero-day-cve-2014-0502/" source="MISC">http://www.alienvault.com/open-threat-exchange/blog/analysis-of-an-attack-exploiting-the-adobe-zero-day-cve-2014-0502/</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0196.html" source="REDHAT">RHSA-2014:0196</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00017.html" source="SUSE">SUSE-SU-2014:0290</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00015.html" source="SUSE">openSUSE-SU-2014:0278</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00014.html" source="SUSE">openSUSE-SU-2014:0277</ref>
    </refs>
    <vuln_soft>
      <prod vendor="adobe" name="adobe_air">
        <vers num="1.0"/>
        <vers num="1.0.1"/>
        <vers num="1.0.4990"/>
        <vers num="1.0.8.4990"/>
        <vers num="1.1"/>
        <vers num="1.1.0.5790"/>
        <vers num="1.5"/>
        <vers num="1.5.0.7220"/>
        <vers num="1.5.1"/>
        <vers num="1.5.1.8210"/>
        <vers num="1.5.2"/>
        <vers num="1.5.3"/>
        <vers num="1.5.3.9120"/>
        <vers num="1.5.3.9130"/>
        <vers num="2.0.2"/>
        <vers num="2.0.2.12610"/>
        <vers num="2.0.3"/>
        <vers num="2.0.3.13070"/>
        <vers num="2.0.4"/>
        <vers num="2.5.0.16600"/>
        <vers num="2.5.1.17730"/>
        <vers num="2.6"/>
        <vers num="2.6.0.19120"/>
        <vers num="2.6.0.19140"/>
        <vers num="2.7"/>
        <vers num="2.7.0.1948"/>
        <vers num="2.7.0.19480"/>
        <vers num="2.7.0.1953"/>
        <vers num="2.7.0.19530"/>
        <vers num="2.7.1"/>
        <vers num="2.7.1.19610"/>
        <vers num="3.0.0.408"/>
        <vers num="3.0.0.4080"/>
        <vers num="3.1.0.485"/>
        <vers num="3.1.0.488"/>
        <vers num="3.1.0.4880"/>
        <vers num="3.2.0.207"/>
        <vers num="3.2.0.2070"/>
        <vers num="3.3.0.3670"/>
        <vers num="3.4.0.2540"/>
        <vers num="3.4.0.2710"/>
        <vers num="3.5.0.1060"/>
        <vers num="3.5.0.600"/>
        <vers num="3.5.0.880"/>
        <vers num="3.5.0.890"/>
        <vers num="3.6.0.597"/>
        <vers num="3.6.0.6090"/>
        <vers num="3.7.0.1530"/>
        <vers num="3.7.0.1860"/>
        <vers num="3.7.0.2090"/>
        <vers num="3.8.0.870"/>
        <vers num="3.8.0.910"/>
        <vers num="3.9.0.1030"/>
        <vers num="3.9.0.1060"/>
        <vers num="3.9.0.1210"/>
        <vers num="3.9.0.1380"/>
        <vers prev="1" num="4.0.0.1390"/>
      </prod>
      <prod vendor="adobe" name="adobe_air_sdk">
        <vers num="3.0.0.4080"/>
        <vers num="3.1.0.488"/>
        <vers num="3.2.0.2070"/>
        <vers num="3.3.0.3650"/>
        <vers num="3.3.0.3690"/>
        <vers num="3.4.0.2540"/>
        <vers num="3.4.0.2710"/>
        <vers num="3.5.0.1060"/>
        <vers num="3.5.0.600"/>
        <vers num="3.5.0.880"/>
        <vers num="3.5.0.890"/>
        <vers num="3.6.0.599"/>
        <vers num="3.6.0.6090"/>
        <vers num="3.7.0.1530"/>
        <vers num="3.7.0.1860"/>
        <vers num="3.7.0.2090"/>
        <vers num="3.8.0.1430"/>
        <vers num="3.8.0.870"/>
        <vers num="3.8.0.910"/>
        <vers num="3.9.0.1030"/>
        <vers num="3.9.0.1210"/>
        <vers num="3.9.0.1380"/>
        <vers prev="1" num="4.0.0.1390"/>
      </prod>
      <prod vendor="adobe" name="flash_player">
        <vers num="11.0"/>
        <vers num="11.0.1.152"/>
        <vers num="11.0.1.153"/>
        <vers num="11.1"/>
        <vers num="11.1.102.55"/>
        <vers num="11.1.102.59"/>
        <vers num="11.1.102.62"/>
        <vers num="11.1.102.63"/>
        <vers num="11.1.111.44"/>
        <vers num="11.1.111.50"/>
        <vers num="11.1.111.54"/>
        <vers num="11.1.111.8"/>
        <vers num="11.1.115.34"/>
        <vers num="11.1.115.48"/>
        <vers num="11.1.115.54"/>
        <vers num="11.1.115.58"/>
        <vers num="11.1.115.7"/>
        <vers num="11.2.202.223"/>
        <vers num="11.2.202.228"/>
        <vers num="11.2.202.233"/>
        <vers num="11.2.202.235"/>
        <vers num="11.2.202.236"/>
        <vers num="11.2.202.238"/>
        <vers num="11.2.202.243"/>
        <vers num="11.2.202.251"/>
        <vers num="11.2.202.258"/>
        <vers num="11.2.202.261"/>
        <vers num="11.2.202.262"/>
        <vers num="11.2.202.270"/>
        <vers num="11.2.202.273"/>
        <vers num="11.2.202.275"/>
        <vers num="11.2.202.280"/>
        <vers num="11.2.202.285"/>
        <vers num="11.2.202.291"/>
        <vers num="11.2.202.297"/>
        <vers num="11.2.202.310"/>
        <vers num="11.2.202.327"/>
        <vers num="11.2.202.332"/>
        <vers num="11.2.202.335"/>
        <vers prev="1" num="11.2.202.336"/>
        <vers num="11.3.300.257"/>
        <vers num="11.3.300.262"/>
        <vers num="11.3.300.265"/>
        <vers num="11.3.300.268"/>
        <vers num="11.3.300.270"/>
        <vers num="11.3.300.271"/>
        <vers num="11.3.300.273"/>
        <vers num="11.4.402.265"/>
        <vers num="11.4.402.278"/>
        <vers num="11.4.402.287"/>
        <vers num="11.5.502.110"/>
        <vers num="11.5.502.135"/>
        <vers num="11.5.502.136"/>
        <vers num="11.5.502.146"/>
        <vers num="11.5.502.149"/>
        <vers num="11.6.602.167"/>
        <vers num="11.6.602.168"/>
        <vers num="11.6.602.171"/>
        <vers num="11.6.602.180"/>
        <vers num="11.7.700.169"/>
        <vers num="11.7.700.202"/>
        <vers num="11.7.700.224"/>
        <vers num="11.7.700.225"/>
        <vers num="11.7.700.232"/>
        <vers num="11.7.700.242"/>
        <vers num="11.7.700.252"/>
        <vers num="11.7.700.257"/>
        <vers num="11.7.700.260"/>
        <vers prev="1" num="11.7.700.261"/>
        <vers num="11.8.800.168"/>
        <vers num="11.8.800.94"/>
        <vers num="11.8.800.97"/>
        <vers num="11.9.900.117"/>
        <vers num="11.9.900.152"/>
        <vers num="11.9.900.170"/>
        <vers num="12.0.0.38"/>
        <vers num="12.0.0.41"/>
        <vers num="12.0.0.43"/>
        <vers prev="1" num="12.0.0.44"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0503" published="2014-03-12" name="CVE-2014-0503" modified="2014-03-26" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:N)" CVSS_score="6.4" CVSS_impact_subscore="4.9" CVSS_exploit_subscore="10.0" CVSS_base_score="6.4">
    <desc>
      <descript source="cve">Adobe Flash Player before 11.7.700.272 and 11.8.x through 12.0.x before 12.0.0.77 on Windows and OS X, and before 11.2.202.346 on Linux, allows remote attackers to bypass the Same Origin Policy via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0289.html" source="REDHAT">RHSA-2014:0289</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00014.html" source="SUSE">SUSE-SU-2014:0387</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00013.html" source="SUSE">openSUSE-SU-2014:0379</ref>
      <ref url="http://helpx.adobe.com/security/products/flash-player/apsb14-08.html" source="CONFIRM" adv="1">http://helpx.adobe.com/security/products/flash-player/apsb14-08.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="adobe" name="flash_player">
        <vers num="11.0"/>
        <vers num="11.0.1.152"/>
        <vers num="11.0.1.153"/>
        <vers num="11.1"/>
        <vers num="11.1.102.55"/>
        <vers num="11.1.102.59"/>
        <vers num="11.1.102.62"/>
        <vers num="11.1.102.63"/>
        <vers num="11.1.111.44"/>
        <vers num="11.1.111.50"/>
        <vers num="11.1.111.54"/>
        <vers num="11.1.111.8"/>
        <vers num="11.1.115.34"/>
        <vers num="11.1.115.48"/>
        <vers num="11.1.115.54"/>
        <vers num="11.1.115.58"/>
        <vers num="11.1.115.7"/>
        <vers num="11.2.202.223"/>
        <vers num="11.2.202.228"/>
        <vers num="11.2.202.233"/>
        <vers num="11.2.202.235"/>
        <vers num="11.2.202.236"/>
        <vers num="11.2.202.238"/>
        <vers num="11.2.202.243"/>
        <vers num="11.2.202.251"/>
        <vers num="11.2.202.258"/>
        <vers num="11.2.202.261"/>
        <vers num="11.2.202.262"/>
        <vers num="11.2.202.270"/>
        <vers num="11.2.202.273"/>
        <vers num="11.2.202.275"/>
        <vers num="11.2.202.280"/>
        <vers num="11.2.202.285"/>
        <vers num="11.2.202.291"/>
        <vers num="11.2.202.297"/>
        <vers num="11.2.202.310"/>
        <vers num="11.2.202.327"/>
        <vers num="11.2.202.332"/>
        <vers num="11.2.202.335"/>
        <vers prev="1" num="11.2.202.336"/>
        <vers prev="1" num="11.2.202.341"/>
        <vers num="11.3.300.257"/>
        <vers num="11.3.300.262"/>
        <vers num="11.3.300.265"/>
        <vers num="11.3.300.268"/>
        <vers num="11.3.300.270"/>
        <vers num="11.3.300.271"/>
        <vers num="11.3.300.273"/>
        <vers num="11.4.402.265"/>
        <vers num="11.4.402.278"/>
        <vers num="11.4.402.287"/>
        <vers num="11.5.502.110"/>
        <vers num="11.5.502.135"/>
        <vers num="11.5.502.136"/>
        <vers num="11.5.502.146"/>
        <vers num="11.5.502.149"/>
        <vers num="11.6.602.167"/>
        <vers num="11.6.602.168"/>
        <vers num="11.6.602.171"/>
        <vers num="11.6.602.180"/>
        <vers num="11.7.700.169"/>
        <vers num="11.7.700.202"/>
        <vers num="11.7.700.224"/>
        <vers num="11.7.700.232"/>
        <vers num="11.7.700.242"/>
        <vers num="11.7.700.252"/>
        <vers num="11.7.700.257"/>
        <vers num="11.7.700.260"/>
        <vers num="11.7.700.261"/>
        <vers prev="1" num="11.7.700.269"/>
        <vers num="11.8.800.168"/>
        <vers num="11.8.800.94"/>
        <vers num="11.8.800.97"/>
        <vers num="11.9.900.117"/>
        <vers num="11.9.900.152"/>
        <vers num="11.9.900.170"/>
        <vers num="12.0.0.38"/>
        <vers num="12.0.0.41"/>
        <vers num="12.0.0.43"/>
        <vers num="12.0.0.44"/>
        <vers prev="1" num="12.0.0.70"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0504" published="2014-03-12" name="CVE-2014-0504" modified="2014-03-26" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:N/A:N)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">Adobe Flash Player before 11.7.700.272 and 11.8.x through 12.0.x before 12.0.0.77 on Windows and OS X, and before 11.2.202.346 on Linux, allows attackers to read the clipboard via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0289.html" source="REDHAT">RHSA-2014:0289</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00014.html" source="SUSE">SUSE-SU-2014:0387</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00013.html" source="SUSE">openSUSE-SU-2014:0379</ref>
      <ref url="http://helpx.adobe.com/security/products/flash-player/apsb14-08.html" source="CONFIRM" adv="1">http://helpx.adobe.com/security/products/flash-player/apsb14-08.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="adobe" name="flash_player">
        <vers num="11.0"/>
        <vers num="11.0.1.152"/>
        <vers num="11.0.1.153"/>
        <vers num="11.1"/>
        <vers num="11.1.102.55"/>
        <vers num="11.1.102.59"/>
        <vers num="11.1.102.62"/>
        <vers num="11.1.102.63"/>
        <vers num="11.1.111.44"/>
        <vers num="11.1.111.50"/>
        <vers num="11.1.111.54"/>
        <vers num="11.1.111.8"/>
        <vers num="11.1.115.34"/>
        <vers num="11.1.115.48"/>
        <vers num="11.1.115.54"/>
        <vers num="11.1.115.58"/>
        <vers num="11.1.115.7"/>
        <vers num="11.2.202.223"/>
        <vers num="11.2.202.228"/>
        <vers num="11.2.202.233"/>
        <vers num="11.2.202.235"/>
        <vers num="11.2.202.236"/>
        <vers num="11.2.202.238"/>
        <vers num="11.2.202.243"/>
        <vers num="11.2.202.251"/>
        <vers num="11.2.202.258"/>
        <vers num="11.2.202.261"/>
        <vers num="11.2.202.262"/>
        <vers num="11.2.202.270"/>
        <vers num="11.2.202.273"/>
        <vers num="11.2.202.275"/>
        <vers num="11.2.202.280"/>
        <vers num="11.2.202.285"/>
        <vers num="11.2.202.291"/>
        <vers num="11.2.202.297"/>
        <vers num="11.2.202.310"/>
        <vers num="11.2.202.327"/>
        <vers num="11.2.202.332"/>
        <vers num="11.2.202.335"/>
        <vers prev="1" num="11.2.202.336"/>
        <vers prev="1" num="11.2.202.341"/>
        <vers num="11.3.300.257"/>
        <vers num="11.3.300.262"/>
        <vers num="11.3.300.265"/>
        <vers num="11.3.300.268"/>
        <vers num="11.3.300.270"/>
        <vers num="11.3.300.271"/>
        <vers num="11.3.300.273"/>
        <vers num="11.4.402.265"/>
        <vers num="11.4.402.278"/>
        <vers num="11.4.402.287"/>
        <vers num="11.5.502.110"/>
        <vers num="11.5.502.135"/>
        <vers num="11.5.502.136"/>
        <vers num="11.5.502.146"/>
        <vers num="11.5.502.149"/>
        <vers num="11.6.602.167"/>
        <vers num="11.6.602.168"/>
        <vers num="11.6.602.171"/>
        <vers num="11.6.602.180"/>
        <vers num="11.7.700.169"/>
        <vers num="11.7.700.202"/>
        <vers num="11.7.700.224"/>
        <vers num="11.7.700.232"/>
        <vers num="11.7.700.242"/>
        <vers num="11.7.700.252"/>
        <vers num="11.7.700.257"/>
        <vers num="11.7.700.260"/>
        <vers num="11.7.700.261"/>
        <vers prev="1" num="11.7.700.269"/>
        <vers num="11.8.800.168"/>
        <vers num="11.8.800.94"/>
        <vers num="11.8.800.97"/>
        <vers num="11.9.900.117"/>
        <vers num="11.9.900.152"/>
        <vers num="11.9.900.170"/>
        <vers num="12.0.0.38"/>
        <vers num="12.0.0.41"/>
        <vers num="12.0.0.43"/>
        <vers num="12.0.0.44"/>
        <vers prev="1" num="12.0.0.70"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0505" published="2014-03-14" name="CVE-2014-0505" modified="2014-03-14" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:C/I:C/A:C)" CVSS_score="10.0" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="10.0" CVSS_base_score="10.0">
    <desc>
      <descript source="cve">Adobe Shockwave Player before 12.1.0.150 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://helpx.adobe.com/security/products/shockwave/apsb14-10.html" source="CONFIRM" adv="1">http://helpx.adobe.com/security/products/shockwave/apsb14-10.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="adobe" name="shockwave_player">
        <vers num="12.0.0.112"/>
        <vers num="12.0.2.122"/>
        <vers num="12.0.3.133"/>
        <vers num="12.0.4.144"/>
        <vers num="12.0.6.147"/>
        <vers num="12.0.7.148"/>
        <vers prev="1" num="12.0.9.149"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0506" published="2014-03-27" name="CVE-2014-0506" modified="2014-04-19" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:C/I:C/A:C)" CVSS_score="10.0" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="10.0" CVSS_base_score="10.0">
    <desc>
      <descript source="cve">Use-after-free vulnerability in Adobe Flash Player before 11.7.700.275 and 11.8.x through 13.0.x before 13.0.0.182 on Windows and OS X and before 11.2.202.350 on Linux, Adobe AIR before 13.0.0.83 on Android, Adobe AIR SDK before 13.0.0.83, and Adobe AIR SDK &amp; Compiler before 13.0.0.83 allows remote attackers to execute arbitrary code, and possibly bypass an Internet Explorer sandbox protection mechanism, via unspecified vectors, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2014.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.pwn2own.com/2014/03/pwn2own-results-for-wednesday-day-one/" source="MISC">http://www.pwn2own.com/2014/03/pwn2own-results-for-wednesday-day-one/</ref>
      <ref url="http://twitter.com/thezdi/statuses/443886338077495296" source="MISC">http://twitter.com/thezdi/statuses/443886338077495296</ref>
      <ref url="http://helpx.adobe.com/security/products/flash-player/apsb14-09.html" source="CONFIRM">http://helpx.adobe.com/security/products/flash-player/apsb14-09.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="adobe" name="flash_player">
        <vers num="12.0.0.77"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0507" published="2014-04-08" name="CVE-2014-0507" modified="2014-04-09" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">Buffer overflow in Adobe Flash Player before 11.7.700.275 and 11.8.x through 13.0.x before 13.0.0.182 on Windows and OS X and before 11.2.202.350 on Linux, Adobe AIR before 13.0.0.83 on Android, Adobe AIR SDK before 13.0.0.83, and Adobe AIR SDK &amp; Compiler before 13.0.0.83 allows attackers to execute arbitrary code via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://helpx.adobe.com/security/products/flash-player/apsb14-09.html" source="CONFIRM" adv="1">http://helpx.adobe.com/security/products/flash-player/apsb14-09.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="adobe" name="adobe_air">
        <vers num="1.0"/>
        <vers num="1.0.1"/>
        <vers num="1.0.4990"/>
        <vers num="1.0.8.4990"/>
        <vers num="1.1"/>
        <vers num="1.1.0.5790"/>
        <vers num="1.5"/>
        <vers num="1.5.0.7220"/>
        <vers num="1.5.1"/>
        <vers num="1.5.1.8210"/>
        <vers num="1.5.2"/>
        <vers num="1.5.3"/>
        <vers num="1.5.3.9120"/>
        <vers num="1.5.3.9130"/>
        <vers num="2.0.2"/>
        <vers num="2.0.2.12610"/>
        <vers num="2.0.3"/>
        <vers num="2.0.3.13070"/>
        <vers num="2.0.4"/>
        <vers num="2.5.0.16600"/>
        <vers num="2.5.1.17730"/>
        <vers num="2.6"/>
        <vers num="2.6.0.19120"/>
        <vers num="2.6.0.19140"/>
        <vers num="2.7"/>
        <vers num="2.7.0.1948"/>
        <vers num="2.7.0.19480"/>
        <vers num="2.7.0.1953"/>
        <vers num="2.7.0.19530"/>
        <vers num="2.7.1"/>
        <vers num="2.7.1.19610"/>
        <vers num="3.0.0.408"/>
        <vers num="3.0.0.4080"/>
        <vers num="3.1.0.485"/>
        <vers num="3.1.0.488"/>
        <vers num="3.1.0.4880"/>
        <vers num="3.2.0.207"/>
        <vers num="3.2.0.2070"/>
        <vers num="3.3.0.3670"/>
        <vers num="3.4.0.2540"/>
        <vers num="3.4.0.2710"/>
        <vers num="3.5.0.1060"/>
        <vers num="3.5.0.600"/>
        <vers num="3.5.0.880"/>
        <vers num="3.5.0.890"/>
        <vers num="3.6.0.597"/>
        <vers num="3.6.0.6090"/>
        <vers num="3.7.0.1530"/>
        <vers num="3.7.0.1860"/>
        <vers num="3.7.0.2090"/>
        <vers num="3.8.0.870"/>
        <vers num="3.8.0.910"/>
        <vers num="3.9.0.1030"/>
        <vers num="3.9.0.1060"/>
        <vers num="3.9.0.1210"/>
        <vers num="3.9.0.1380"/>
        <vers prev="1" num="4.0.0.1390"/>
      </prod>
      <prod vendor="adobe" name="adobe_air_sdk">
        <vers num="3.0.0.4080"/>
        <vers num="3.1.0.488"/>
        <vers num="3.2.0.2070"/>
        <vers num="3.3.0.3650"/>
        <vers num="3.3.0.3690"/>
        <vers num="3.4.0.2540"/>
        <vers num="3.4.0.2710"/>
        <vers num="3.5.0.1060"/>
        <vers num="3.5.0.600"/>
        <vers num="3.5.0.880"/>
        <vers num="3.5.0.890"/>
        <vers num="3.6.0.599"/>
        <vers num="3.6.0.6090"/>
        <vers num="3.7.0.1530"/>
        <vers num="3.7.0.1860"/>
        <vers num="3.7.0.2090"/>
        <vers num="3.8.0.1430"/>
        <vers num="3.8.0.870"/>
        <vers num="3.8.0.910"/>
        <vers num="3.9.0.1030"/>
        <vers num="3.9.0.1210"/>
        <vers num="3.9.0.1380"/>
        <vers num="4.0.0.1390"/>
        <vers prev="1" num="4.0.0.1628"/>
      </prod>
      <prod vendor="adobe" name="flash_player">
        <vers num="11.0"/>
        <vers num="11.0.1.152"/>
        <vers num="11.0.1.153"/>
        <vers num="11.1"/>
        <vers num="11.1.102.55"/>
        <vers num="11.1.102.59"/>
        <vers num="11.1.102.62"/>
        <vers num="11.1.102.63"/>
        <vers num="11.1.111.44"/>
        <vers num="11.1.111.50"/>
        <vers num="11.1.111.54"/>
        <vers num="11.1.111.8"/>
        <vers num="11.1.115.34"/>
        <vers num="11.1.115.48"/>
        <vers num="11.1.115.54"/>
        <vers num="11.1.115.58"/>
        <vers num="11.1.115.7"/>
        <vers num="11.2.202.223"/>
        <vers num="11.2.202.228"/>
        <vers num="11.2.202.233"/>
        <vers num="11.2.202.235"/>
        <vers num="11.2.202.236"/>
        <vers num="11.2.202.238"/>
        <vers num="11.2.202.243"/>
        <vers num="11.2.202.251"/>
        <vers num="11.2.202.258"/>
        <vers num="11.2.202.261"/>
        <vers num="11.2.202.262"/>
        <vers num="11.2.202.270"/>
        <vers num="11.2.202.273"/>
        <vers num="11.2.202.275"/>
        <vers num="11.2.202.280"/>
        <vers num="11.2.202.285"/>
        <vers num="11.2.202.291"/>
        <vers num="11.2.202.297"/>
        <vers num="11.2.202.310"/>
        <vers num="11.2.202.327"/>
        <vers num="11.2.202.332"/>
        <vers num="11.2.202.335"/>
        <vers num="11.2.202.336"/>
        <vers num="11.2.202.341"/>
        <vers prev="1" num="11.2.202.346"/>
        <vers num="11.3.300.257"/>
        <vers num="11.3.300.262"/>
        <vers num="11.3.300.265"/>
        <vers num="11.3.300.268"/>
        <vers num="11.3.300.270"/>
        <vers num="11.3.300.271"/>
        <vers num="11.3.300.273"/>
        <vers num="11.4.402.265"/>
        <vers num="11.4.402.278"/>
        <vers num="11.4.402.287"/>
        <vers num="11.5.502.110"/>
        <vers num="11.5.502.135"/>
        <vers num="11.5.502.136"/>
        <vers num="11.5.502.146"/>
        <vers num="11.5.502.149"/>
        <vers num="11.6.602.167"/>
        <vers num="11.6.602.168"/>
        <vers num="11.6.602.171"/>
        <vers num="11.6.602.180"/>
        <vers num="11.7.700.169"/>
        <vers num="11.7.700.202"/>
        <vers num="11.7.700.224"/>
        <vers num="11.7.700.232"/>
        <vers num="11.7.700.242"/>
        <vers num="11.7.700.252"/>
        <vers num="11.7.700.257"/>
        <vers num="11.7.700.260"/>
        <vers num="11.8.800.168"/>
        <vers num="11.8.800.94"/>
        <vers num="11.8.800.97"/>
        <vers num="11.9.900.117"/>
        <vers num="11.9.900.152"/>
        <vers num="11.9.900.170"/>
        <vers num="12.0.0.38"/>
        <vers num="12.0.0.41"/>
        <vers num="12.0.0.43"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0508" published="2014-04-08" name="CVE-2014-0508" modified="2014-04-09" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:N/A:N)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">Adobe Flash Player before 11.7.700.275 and 11.8.x through 13.0.x before 13.0.0.182 on Windows and OS X and before 11.2.202.350 on Linux, Adobe AIR before 13.0.0.83 on Android, Adobe AIR SDK before 13.0.0.83, and Adobe AIR SDK &amp; Compiler before 13.0.0.83 allow attackers to bypass intended access restrictions and obtain sensitive information via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://helpx.adobe.com/security/products/flash-player/apsb14-09.html" source="CONFIRM" adv="1">http://helpx.adobe.com/security/products/flash-player/apsb14-09.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="adobe" name="adobe_air">
        <vers num="1.0"/>
        <vers num="1.0.1"/>
        <vers num="1.0.4990"/>
        <vers num="1.0.8.4990"/>
        <vers num="1.1"/>
        <vers num="1.1.0.5790"/>
        <vers num="1.5"/>
        <vers num="1.5.0.7220"/>
        <vers num="1.5.1"/>
        <vers num="1.5.1.8210"/>
        <vers num="1.5.2"/>
        <vers num="1.5.3"/>
        <vers num="1.5.3.9120"/>
        <vers num="1.5.3.9130"/>
        <vers num="2.0.2"/>
        <vers num="2.0.2.12610"/>
        <vers num="2.0.3"/>
        <vers num="2.0.3.13070"/>
        <vers num="2.0.4"/>
        <vers num="2.5.0.16600"/>
        <vers num="2.5.1.17730"/>
        <vers num="2.6"/>
        <vers num="2.6.0.19120"/>
        <vers num="2.6.0.19140"/>
        <vers num="2.7"/>
        <vers num="2.7.0.1948"/>
        <vers num="2.7.0.19480"/>
        <vers num="2.7.0.1953"/>
        <vers num="2.7.0.19530"/>
        <vers num="2.7.1"/>
        <vers num="2.7.1.19610"/>
        <vers num="3.0.0.408"/>
        <vers num="3.0.0.4080"/>
        <vers num="3.1.0.485"/>
        <vers num="3.1.0.488"/>
        <vers num="3.1.0.4880"/>
        <vers num="3.2.0.207"/>
        <vers num="3.2.0.2070"/>
        <vers num="3.3.0.3670"/>
        <vers num="3.4.0.2540"/>
        <vers num="3.4.0.2710"/>
        <vers num="3.5.0.1060"/>
        <vers num="3.5.0.600"/>
        <vers num="3.5.0.880"/>
        <vers num="3.5.0.890"/>
        <vers num="3.6.0.597"/>
        <vers num="3.6.0.6090"/>
        <vers num="3.7.0.1530"/>
        <vers num="3.7.0.1860"/>
        <vers num="3.7.0.2090"/>
        <vers num="3.8.0.870"/>
        <vers num="3.8.0.910"/>
        <vers num="3.9.0.1030"/>
        <vers num="3.9.0.1060"/>
        <vers num="3.9.0.1210"/>
        <vers num="3.9.0.1380"/>
        <vers prev="1" num="4.0.0.1390"/>
      </prod>
      <prod vendor="adobe" name="adobe_air_sdk">
        <vers num="3.0.0.4080"/>
        <vers num="3.1.0.488"/>
        <vers num="3.2.0.2070"/>
        <vers num="3.3.0.3650"/>
        <vers num="3.3.0.3690"/>
        <vers num="3.4.0.2540"/>
        <vers num="3.4.0.2710"/>
        <vers num="3.5.0.1060"/>
        <vers num="3.5.0.600"/>
        <vers num="3.5.0.880"/>
        <vers num="3.5.0.890"/>
        <vers num="3.6.0.599"/>
        <vers num="3.6.0.6090"/>
        <vers num="3.7.0.1530"/>
        <vers num="3.7.0.1860"/>
        <vers num="3.7.0.2090"/>
        <vers num="3.8.0.1430"/>
        <vers num="3.8.0.870"/>
        <vers num="3.8.0.910"/>
        <vers num="3.9.0.1030"/>
        <vers num="3.9.0.1210"/>
        <vers num="3.9.0.1380"/>
        <vers num="4.0.0.1390"/>
        <vers prev="1" num="4.0.0.1628"/>
      </prod>
      <prod vendor="adobe" name="flash_player">
        <vers num="11.0"/>
        <vers num="11.0.1.152"/>
        <vers num="11.0.1.153"/>
        <vers num="11.1"/>
        <vers num="11.1.102.55"/>
        <vers num="11.1.102.59"/>
        <vers num="11.1.102.62"/>
        <vers num="11.1.102.63"/>
        <vers num="11.1.111.44"/>
        <vers num="11.1.111.50"/>
        <vers num="11.1.111.54"/>
        <vers num="11.1.111.8"/>
        <vers num="11.1.115.34"/>
        <vers num="11.1.115.48"/>
        <vers num="11.1.115.54"/>
        <vers num="11.1.115.58"/>
        <vers num="11.1.115.7"/>
        <vers num="11.2.202.223"/>
        <vers num="11.2.202.228"/>
        <vers num="11.2.202.233"/>
        <vers num="11.2.202.235"/>
        <vers num="11.2.202.236"/>
        <vers num="11.2.202.238"/>
        <vers num="11.2.202.243"/>
        <vers num="11.2.202.251"/>
        <vers num="11.2.202.258"/>
        <vers num="11.2.202.261"/>
        <vers num="11.2.202.262"/>
        <vers num="11.2.202.270"/>
        <vers num="11.2.202.273"/>
        <vers num="11.2.202.275"/>
        <vers num="11.2.202.280"/>
        <vers num="11.2.202.285"/>
        <vers num="11.2.202.291"/>
        <vers num="11.2.202.297"/>
        <vers num="11.2.202.310"/>
        <vers num="11.2.202.327"/>
        <vers num="11.2.202.332"/>
        <vers num="11.2.202.335"/>
        <vers num="11.2.202.336"/>
        <vers num="11.2.202.341"/>
        <vers prev="1" num="11.2.202.346"/>
        <vers num="11.3.300.257"/>
        <vers num="11.3.300.262"/>
        <vers num="11.3.300.265"/>
        <vers num="11.3.300.268"/>
        <vers num="11.3.300.270"/>
        <vers num="11.3.300.271"/>
        <vers num="11.3.300.273"/>
        <vers num="11.4.402.265"/>
        <vers num="11.4.402.278"/>
        <vers num="11.4.402.287"/>
        <vers num="11.5.502.110"/>
        <vers num="11.5.502.135"/>
        <vers num="11.5.502.136"/>
        <vers num="11.5.502.146"/>
        <vers num="11.5.502.149"/>
        <vers num="11.6.602.167"/>
        <vers num="11.6.602.168"/>
        <vers num="11.6.602.171"/>
        <vers num="11.6.602.180"/>
        <vers num="11.7.700.169"/>
        <vers num="11.7.700.202"/>
        <vers num="11.7.700.224"/>
        <vers num="11.7.700.232"/>
        <vers num="11.7.700.242"/>
        <vers num="11.7.700.252"/>
        <vers num="11.7.700.257"/>
        <vers num="11.7.700.260"/>
        <vers num="11.8.800.168"/>
        <vers num="11.8.800.94"/>
        <vers num="11.8.800.97"/>
        <vers num="11.9.900.117"/>
        <vers num="11.9.900.152"/>
        <vers num="11.9.900.170"/>
        <vers num="12.0.0.38"/>
        <vers num="12.0.0.41"/>
        <vers num="12.0.0.43"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0509" published="2014-04-08" name="CVE-2014-0509" modified="2014-04-09" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 11.7.700.275 and 11.8.x through 13.0.x before 13.0.0.182 on Windows and OS X and before 11.2.202.350 on Linux, Adobe AIR before 13.0.0.83 on Android, Adobe AIR SDK before 13.0.0.83, and Adobe AIR SDK &amp; Compiler before 13.0.0.83 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://helpx.adobe.com/security/products/flash-player/apsb14-09.html" source="CONFIRM" adv="1">http://helpx.adobe.com/security/products/flash-player/apsb14-09.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="adobe" name="adobe_air">
        <vers num="1.0"/>
        <vers num="1.0.1"/>
        <vers num="1.0.4990"/>
        <vers num="1.0.8.4990"/>
        <vers num="1.1"/>
        <vers num="1.1.0.5790"/>
        <vers num="1.5"/>
        <vers num="1.5.0.7220"/>
        <vers num="1.5.1"/>
        <vers num="1.5.1.8210"/>
        <vers num="1.5.2"/>
        <vers num="1.5.3"/>
        <vers num="1.5.3.9120"/>
        <vers num="1.5.3.9130"/>
        <vers num="2.0.2"/>
        <vers num="2.0.2.12610"/>
        <vers num="2.0.3"/>
        <vers num="2.0.3.13070"/>
        <vers num="2.0.4"/>
        <vers num="2.5.0.16600"/>
        <vers num="2.5.1.17730"/>
        <vers num="2.6"/>
        <vers num="2.6.0.19120"/>
        <vers num="2.6.0.19140"/>
        <vers num="2.7"/>
        <vers num="2.7.0.1948"/>
        <vers num="2.7.0.19480"/>
        <vers num="2.7.0.1953"/>
        <vers num="2.7.0.19530"/>
        <vers num="2.7.1"/>
        <vers num="2.7.1.19610"/>
        <vers num="3.0.0.408"/>
        <vers num="3.0.0.4080"/>
        <vers num="3.1.0.485"/>
        <vers num="3.1.0.488"/>
        <vers num="3.1.0.4880"/>
        <vers num="3.2.0.207"/>
        <vers num="3.2.0.2070"/>
        <vers num="3.3.0.3670"/>
        <vers num="3.4.0.2540"/>
        <vers num="3.4.0.2710"/>
        <vers num="3.5.0.1060"/>
        <vers num="3.5.0.600"/>
        <vers num="3.5.0.880"/>
        <vers num="3.5.0.890"/>
        <vers num="3.6.0.597"/>
        <vers num="3.6.0.6090"/>
        <vers num="3.7.0.1530"/>
        <vers num="3.7.0.1860"/>
        <vers num="3.7.0.2090"/>
        <vers num="3.8.0.870"/>
        <vers num="3.8.0.910"/>
        <vers num="3.9.0.1030"/>
        <vers num="3.9.0.1060"/>
        <vers num="3.9.0.1210"/>
        <vers num="3.9.0.1380"/>
        <vers prev="1" num="4.0.0.1390"/>
      </prod>
      <prod vendor="adobe" name="adobe_air_sdk">
        <vers num="3.0.0.4080"/>
        <vers num="3.1.0.488"/>
        <vers num="3.2.0.2070"/>
        <vers num="3.3.0.3650"/>
        <vers num="3.3.0.3690"/>
        <vers num="3.4.0.2540"/>
        <vers num="3.4.0.2710"/>
        <vers num="3.5.0.1060"/>
        <vers num="3.5.0.600"/>
        <vers num="3.5.0.880"/>
        <vers num="3.5.0.890"/>
        <vers num="3.6.0.599"/>
        <vers num="3.6.0.6090"/>
        <vers num="3.7.0.1530"/>
        <vers num="3.7.0.1860"/>
        <vers num="3.7.0.2090"/>
        <vers num="3.8.0.1430"/>
        <vers num="3.8.0.870"/>
        <vers num="3.8.0.910"/>
        <vers num="3.9.0.1030"/>
        <vers num="3.9.0.1210"/>
        <vers num="3.9.0.1380"/>
        <vers num="4.0.0.1390"/>
        <vers prev="1" num="4.0.0.1628"/>
      </prod>
      <prod vendor="adobe" name="flash_player">
        <vers num="11.0"/>
        <vers num="11.0.1.152"/>
        <vers num="11.0.1.153"/>
        <vers num="11.1"/>
        <vers num="11.1.102.55"/>
        <vers num="11.1.102.59"/>
        <vers num="11.1.102.62"/>
        <vers num="11.1.102.63"/>
        <vers num="11.1.111.44"/>
        <vers num="11.1.111.50"/>
        <vers num="11.1.111.54"/>
        <vers num="11.1.111.8"/>
        <vers num="11.1.115.34"/>
        <vers num="11.1.115.48"/>
        <vers num="11.1.115.54"/>
        <vers num="11.1.115.58"/>
        <vers num="11.1.115.7"/>
        <vers num="11.2.202.223"/>
        <vers num="11.2.202.228"/>
        <vers num="11.2.202.233"/>
        <vers num="11.2.202.235"/>
        <vers num="11.2.202.236"/>
        <vers num="11.2.202.238"/>
        <vers num="11.2.202.243"/>
        <vers num="11.2.202.251"/>
        <vers num="11.2.202.258"/>
        <vers num="11.2.202.261"/>
        <vers num="11.2.202.262"/>
        <vers num="11.2.202.270"/>
        <vers num="11.2.202.273"/>
        <vers num="11.2.202.275"/>
        <vers num="11.2.202.280"/>
        <vers num="11.2.202.285"/>
        <vers num="11.2.202.291"/>
        <vers num="11.2.202.297"/>
        <vers num="11.2.202.310"/>
        <vers num="11.2.202.327"/>
        <vers num="11.2.202.332"/>
        <vers num="11.2.202.335"/>
        <vers num="11.2.202.336"/>
        <vers num="11.2.202.341"/>
        <vers prev="1" num="11.2.202.346"/>
        <vers num="11.3.300.257"/>
        <vers num="11.3.300.262"/>
        <vers num="11.3.300.265"/>
        <vers num="11.3.300.268"/>
        <vers num="11.3.300.270"/>
        <vers num="11.3.300.271"/>
        <vers num="11.3.300.273"/>
        <vers num="11.4.402.265"/>
        <vers num="11.4.402.278"/>
        <vers num="11.4.402.287"/>
        <vers num="11.5.502.110"/>
        <vers num="11.5.502.135"/>
        <vers num="11.5.502.136"/>
        <vers num="11.5.502.146"/>
        <vers num="11.5.502.149"/>
        <vers num="11.6.602.167"/>
        <vers num="11.6.602.168"/>
        <vers num="11.6.602.171"/>
        <vers num="11.6.602.180"/>
        <vers num="11.7.700.169"/>
        <vers num="11.7.700.202"/>
        <vers num="11.7.700.224"/>
        <vers num="11.7.700.232"/>
        <vers num="11.7.700.242"/>
        <vers num="11.7.700.252"/>
        <vers num="11.7.700.257"/>
        <vers num="11.7.700.260"/>
        <vers num="11.8.800.168"/>
        <vers num="11.8.800.94"/>
        <vers num="11.8.800.97"/>
        <vers num="11.9.900.117"/>
        <vers num="11.9.900.152"/>
        <vers num="11.9.900.170"/>
        <vers num="12.0.0.38"/>
        <vers num="12.0.0.41"/>
        <vers num="12.0.0.43"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0510" published="2014-03-27" name="CVE-2014-0510" modified="2014-04-01" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:C/I:C/A:C)" CVSS_score="10.0" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="10.0" CVSS_base_score="10.0">
    <desc>
      <descript source="cve">Heap-based buffer overflow in Adobe Flash Player 12.0.0.77 allows remote attackers to execute arbitrary code and bypass a sandbox protection mechanism via unspecified vectors, as demonstrated by Zeguang Zhao and Liang Chen during a Pwn2Own competition at CanSecWest 2014.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.securityfocus.com/bid/66241" source="BID">66241</ref>
      <ref url="http://www.pwn2own.com/2014/03/pwn2own-results-thursday-day-two/" source="MISC">http://www.pwn2own.com/2014/03/pwn2own-results-thursday-day-two/</ref>
      <ref url="http://twitter.com/thezdi/statuses/444262022444621824" source="MISC">http://twitter.com/thezdi/statuses/444262022444621824</ref>
    </refs>
    <vuln_soft>
      <prod vendor="adobe" name="flash_player">
        <vers num="12.0.0.77"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0511" published="2014-03-27" name="CVE-2014-0511" modified="2014-03-27" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:C/I:C/A:C)" CVSS_score="10.0" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="10.0" CVSS_base_score="10.0">
    <desc>
      <descript source="cve">Heap-based buffer overflow in Adobe Reader 11.0.06 allows remote attackers to execute arbitrary code via unspecified vectors, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2014.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.pwn2own.com/2014/03/pwn2own-results-for-wednesday-day-one/" source="MISC">http://www.pwn2own.com/2014/03/pwn2own-results-for-wednesday-day-one/</ref>
      <ref url="http://twitter.com/thezdi/statuses/443827076580122624" source="MISC">http://twitter.com/thezdi/statuses/443827076580122624</ref>
    </refs>
    <vuln_soft>
      <prod vendor="adobe" name="acrobat_reader">
        <vers num="11.0.6"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0512" published="2014-03-27" name="CVE-2014-0512" modified="2014-03-27" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:C/I:C/A:C)" CVSS_score="10.0" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="10.0" CVSS_base_score="10.0">
    <desc>
      <descript source="cve">Adobe Reader 11.0.06 allows attackers to bypass a PDF sandbox protection mechanism via unspecified vectors, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2014.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.pwn2own.com/2014/03/pwn2own-results-for-wednesday-day-one/" source="MISC">http://www.pwn2own.com/2014/03/pwn2own-results-for-wednesday-day-one/</ref>
      <ref url="http://twitter.com/thezdi/statuses/443827076580122624" source="MISC">http://twitter.com/thezdi/statuses/443827076580122624</ref>
    </refs>
    <vuln_soft>
      <prod vendor="adobe" name="acrobat_reader">
        <vers num="11.0.6"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0514" published="2014-04-15" name="CVE-2014-0514" modified="2014-04-24" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">The Adobe Reader Mobile application before 11.2 for Android does not properly restrict use of JavaScript, which allows remote attackers to execute arbitrary code via a crafted PDF document, a related issue to CVE-2012-6636.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://helpx.adobe.com/security/products/reader-mobile/apsb14-12.html" source="CONFIRM" patch="1" adv="1">http://helpx.adobe.com/security/products/reader-mobile/apsb14-12.html</ref>
      <ref url="http://www.securityfocus.com/bid/66798" source="BID">66798</ref>
      <ref url="http://www.securityfocus.com/archive/1/archive/1/531831/100/0/threaded" source="BUGTRAQ">20140413 Adobe Reader for Android exposes insecure Javascript interfaces</ref>
      <ref url="http://www.securify.nl/advisory/SFY20140401/adobe_reader_for_android_exposes_insecure_javascript_interfaces.html" source="MISC">http://www.securify.nl/advisory/SFY20140401/adobe_reader_for_android_exposes_insecure_javascript_interfaces.html</ref>
      <ref url="http://seclists.org/fulldisclosure/2014/Apr/192" source="FULLDISC">20140413 Adobe Reader for Android exposes insecure Javascript interfaces</ref>
    </refs>
    <vuln_soft>
      <prod vendor="adobe" name="adobe_reader">
        <vers num="11.1.0" edition=":~~~android~~"/>
        <vers prev="1" num="11.1.3" edition=":~~~android~~"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0515" published="2014-04-29" name="CVE-2014-0515" modified="2014-04-29" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:C/I:C/A:C)" CVSS_score="10.0" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="10.0" CVSS_base_score="10.0">
    <desc>
      <descript source="cve">Buffer overflow in Adobe Flash Player before 11.7.700.279 and 11.8.x through 13.0.x before 13.0.0.206 on Windows and OS X, and before 11.2.202.356 on Linux, allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in April 2014.</descript>
    </desc>
    <impacts>
      <impact source="nvd">Per: http://helpx.adobe.com/security/products/flash-player/apsb14-13.html

"Affected software versions

    Adobe Flash Player 13.0.0.182 and earlier versions for Windows
    Adobe Flash Player 13.0.0.201 and earlier versions for Macintosh
    Adobe Flash Player 11.2.202.350 and earlier versions for Linux"</impact>
    </impacts>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://helpx.adobe.com/security/products/flash-player/apsb14-13.html" source="CONFIRM" patch="1" adv="1">http://helpx.adobe.com/security/products/flash-player/apsb14-13.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="adobe" name="flash_player">
        <vers num="11.2.202.223"/>
        <vers num="11.2.202.228"/>
        <vers num="11.2.202.233"/>
        <vers num="11.2.202.235"/>
        <vers num="11.2.202.236"/>
        <vers num="11.2.202.238"/>
        <vers num="11.2.202.243"/>
        <vers num="11.2.202.251"/>
        <vers num="11.2.202.258"/>
        <vers num="11.2.202.261"/>
        <vers num="11.2.202.262"/>
        <vers num="11.2.202.270"/>
        <vers num="11.2.202.273"/>
        <vers num="11.2.202.275"/>
        <vers num="11.2.202.280"/>
        <vers num="11.2.202.285"/>
        <vers num="11.2.202.291"/>
        <vers num="11.2.202.297"/>
        <vers num="11.2.202.310"/>
        <vers num="11.2.202.332"/>
        <vers num="11.2.202.335"/>
        <vers num="11.2.202.336"/>
        <vers num="11.2.202.341"/>
        <vers num="11.2.202.346"/>
        <vers prev="1" num="11.2.202.350"/>
        <vers num="11.7.700.169"/>
        <vers num="11.7.700.202"/>
        <vers num="11.7.700.224"/>
        <vers num="11.7.700.225"/>
        <vers num="11.7.700.232"/>
        <vers num="11.7.700.242"/>
        <vers num="11.7.700.257"/>
        <vers num="11.7.700.260"/>
        <vers num="11.7.700.261"/>
        <vers num="11.7.700.269"/>
        <vers num="11.7.700.272"/>
        <vers prev="1" num="11.7.700.275"/>
        <vers num="11.8.800.168"/>
        <vers num="11.8.800.94"/>
        <vers num="11.8.800.97"/>
        <vers prev="1" num="13.0.0.182"/>
        <vers prev="1" num="13.0.0.201"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-0591" published="2014-01-13" name="CVE-2014-0591" modified="2014-02-21" CVSS_version="2.0" CVSS_vector="(AV:N/AC:H/Au:N/C:N/I:N/A:P)" CVSS_score="2.6" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="4.9" CVSS_base_score="2.6">
    <desc>
      <descript source="cve">The query_findclosestnsec3 function in query.c in named in ISC BIND 9.6, 9.7, and 9.8 before 9.8.6-P2 and 9.9 before 9.9.4-P2, and 9.6-ESV before 9.6-ESV-R10-P2, allows remote attackers to cause a denial of service (INSIST assertion failure and daemon exit) via a crafted DNS query to an authoritative nameserver that uses the NSEC3 signing feature.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://kb.isc.org/article/AA-01085" source="CONFIRM" adv="1">https://kb.isc.org/article/AA-01085</ref>
      <ref url="https://kb.isc.org/article/AA-01078" source="CONFIRM" adv="1">https://kb.isc.org/article/AA-01078</ref>
      <ref url="https://bugzilla.redhat.com/show_bug.cgi?id=1051717" source="CONFIRM">https://bugzilla.redhat.com/show_bug.cgi?id=1051717</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2081-1" source="UBUNTU">USN-2081-1</ref>
      <ref url="http://www.slackware.com/security/viewer.php?l=slackware-security&amp;y=2014&amp;m=slackware-security.524465" source="SLACKWARE">SSA:2014-028-01</ref>
      <ref url="http://www.securitytracker.com/id/1029589" source="SECTRACK">1029589</ref>
      <ref url="http://www.securityfocus.com/bid/64801" source="BID">64801</ref>
      <ref url="http://www.mandriva.com/security/advisories?name=MDVSA-2014:002" source="MANDRIVA">MDVSA-2014:002</ref>
      <ref url="http://www.freebsd.org/security/advisories/FreeBSD-SA-14:04.bind.asc" source="FREEBSD">FreeBSD-SA-14:04</ref>
      <ref url="http://secunia.com/advisories/56574" source="SECUNIA">56574</ref>
      <ref url="http://secunia.com/advisories/56522" source="SECUNIA">56522</ref>
      <ref url="http://secunia.com/advisories/56493" source="SECUNIA">56493</ref>
      <ref url="http://secunia.com/advisories/56442" source="SECUNIA">56442</ref>
      <ref url="http://secunia.com/advisories/56427" source="SECUNIA">56427</ref>
      <ref url="http://secunia.com/advisories/56425" source="SECUNIA">56425</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0043.html" source="REDHAT">RHSA-2014:0043</ref>
      <ref url="http://osvdb.org/101973" source="OSVDB">101973</ref>
      <ref url="http://marc.info/?l=bugtraq&amp;m=138995561732658&amp;w=2" source="HP">SSRT101420</ref>
      <ref url="http://marc.info/?l=bugtraq&amp;m=138995561732658&amp;w=2" source="HP">HPSBUX02961</ref>
      <ref url="http://lists.opensuse.org/opensuse-updates/2014-02/msg00019.html" source="SUSE">openSUSE-SU-2014:0202</ref>
      <ref url="http://lists.opensuse.org/opensuse-updates/2014-02/msg00016.html" source="SUSE">openSUSE-SU-2014:0199</ref>
      <ref url="http://lists.fedoraproject.org/pipermail/package-announce/2014-January/126772.html" source="FEDORA">FEDORA-2014-0811</ref>
      <ref url="http://lists.fedoraproject.org/pipermail/package-announce/2014-January/126761.html" source="FEDORA">FEDORA-2014-0858</ref>
    </refs>
    <vuln_soft>
      <prod vendor="isc" name="bind">
        <vers num="9.6-esv"/>
        <vers num="9.6-esv-r1"/>
        <vers num="9.6-esv-r2"/>
        <vers num="9.6-esv-r3"/>
        <vers num="9.6-esv-r4"/>
        <vers num="9.6-esv-r4-p1"/>
        <vers num="9.6-esv-r5" edition="p1"/>
        <vers num="9.6-esv-r5b1"/>
        <vers num="9.6-esv-r6" edition="b1"/>
        <vers num="9.6-esv-r6" edition="rc1"/>
        <vers num="9.6-esv-r6" edition="rc2"/>
        <vers num="9.6-esv-r7" edition="p1"/>
        <vers num="9.6-esv-r7" edition="p2"/>
        <vers num="9.6-esv-r9" edition="p1"/>
        <vers num="9.6.0" edition="p1"/>
        <vers num="9.6.0" edition="rc1"/>
        <vers num="9.6.0" edition="rc2"/>
        <vers num="9.6.0a1"/>
        <vers num="9.6.0b1"/>
        <vers num="9.6.1" edition="p1"/>
        <vers num="9.6.1" edition="p2"/>
        <vers num="9.6.1" edition="p3"/>
        <vers num="9.6.1" edition="rc1"/>
        <vers num="9.6.1b1"/>
        <vers num="9.6.2" edition="rc1"/>
        <vers num="9.6.2-p1"/>
        <vers num="9.6.2-p2"/>
        <vers num="9.6.2-p3"/>
        <vers num="9.6.2b1"/>
        <vers num="9.6.3" edition="rc1"/>
        <vers num="9.6.3b1"/>
        <vers num="9.7.0" edition="beta"/>
        <vers num="9.7.0" edition="p1"/>
        <vers num="9.7.0" edition="p2"/>
        <vers num="9.7.0" edition="rc1"/>
        <vers num="9.7.0" edition="rc2"/>
        <vers num="9.7.0a1"/>
        <vers num="9.7.0a2"/>
        <vers num="9.7.0a3"/>
        <vers num="9.7.0b1"/>
        <vers num="9.7.0b2"/>
        <vers num="9.7.0b3"/>
        <vers num="9.7.1" edition="p1"/>
        <vers num="9.7.1" edition="p2"/>
        <vers num="9.7.1" edition="rc1"/>
        <vers num="9.7.1b1"/>
        <vers num="9.7.2" edition="p1"/>
        <vers num="9.7.2" edition="p2"/>
        <vers num="9.7.2" edition="p3"/>
        <vers num="9.7.2" edition="rc1"/>
        <vers num="9.7.3" edition="b1"/>
        <vers num="9.7.3" edition="p1"/>
        <vers num="9.7.3" edition="rc1"/>
        <vers num="9.7.4" edition="b1"/>
        <vers num="9.7.4" edition="p1"/>
        <vers num="9.7.4" edition="rc1"/>
        <vers num="9.7.4b1"/>
        <vers num="9.7.5" edition="b1"/>
        <vers num="9.7.5" edition="rc1"/>
        <vers num="9.7.5" edition="rc2"/>
        <vers num="9.7.6" edition="p1"/>
        <vers num="9.7.6" edition="p2"/>
        <vers num="9.7.7"/>
        <vers num="9.8.0" edition="a1"/>
        <vers num="9.8.0" edition="b1"/>
        <vers num="9.8.0" edition="p1"/>
        <vers num="9.8.0" edition="p2"/>
        <vers num="9.8.0" edition="p4"/>
        <vers num="9.8.0" edition="rc1"/>
        <vers num="9.8.1" edition="b1"/>
        <vers num="9.8.1" edition="b2"/>
        <vers num="9.8.1" edition="b3"/>
        <vers num="9.8.1" edition="p1"/>
        <vers num="9.8.1" edition="rc1"/>
        <vers num="9.8.2" edition="b1"/>
        <vers num="9.8.2" edition="rc1"/>
        <vers num="9.8.2" edition="rc2"/>
        <vers num="9.8.3" edition="p1"/>
        <vers num="9.8.3" edition="p2"/>
        <vers num="9.8.4"/>
        <vers num="9.8.5" edition="b1"/>
        <vers num="9.8.5" edition="b2"/>
        <vers num="9.8.5" edition="p1"/>
        <vers num="9.8.5" edition="p2"/>
        <vers num="9.8.5" edition="rc1"/>
        <vers num="9.8.5" edition="rc2"/>
        <vers num="9.8.6" edition="b1"/>
        <vers num="9.8.6" edition="p1"/>
        <vers num="9.8.6" edition="rc1"/>
        <vers num="9.8.6" edition="rc2"/>
        <vers num="9.9.4" edition="p1"/>
        <vers num="9.9.4" edition="rc1"/>
        <vers num="9.9.4" edition="rc2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0592" published="2014-04-04" name="CVE-2014-0592" modified="2014-04-04" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">Barclamp (aka barclamp-network) 1.7 for the Crowbar Framework, as used in SUSE Cloud 3, does not enable netfilter on bridges when creating new instances, which allows remote attackers to bypass security group restrictions via unspecified vectors, related to floating IPs.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00025.html" source="SUSE" patch="1" adv="1">SUSE-SU-2014:0452</ref>
      <ref url="https://github.com/crowbar/barclamp-network/pull/269" source="CONFIRM">https://github.com/crowbar/barclamp-network/pull/269</ref>
      <ref url="https://bugzilla.novell.com/show_bug.cgi?id=864183" source="CONFIRM">https://bugzilla.novell.com/show_bug.cgi?id=864183</ref>
      <ref url="http://www.securityfocus.com/bid/66519" source="BID">66519</ref>
      <ref url="http://secunia.com/advisories/57509" source="SECUNIA" adv="1">57509</ref>
    </refs>
    <vuln_soft>
      <prod vendor="crowbar" name="barclamp">
        <vers num="1.7"/>
      </prod>
      <prod vendor="novell" name="suse_cloud">
        <vers num="3.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0612" published="2014-04-14" name="CVE-2014-0612" modified="2014-04-19" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:P)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">Unspecified vulnerability in Juniper Junos before 11.4R10-S1, before 11.4R11, 12.1X44 before 12.1X44-D26, 12.1X44 before 12.1X44-D30, 12.1X45 before 12.1X45-D20, and 12.1X46 before 12.1X46-D10, when Dynamic IPsec VPN is configured, allows remote attackers to cause a denial of service (new Dynamic VPN connection failures and CPU and disk consumption) via unknown vectors.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.securityfocus.com/bid/66759" source="BID">66759</ref>
      <ref url="http://securitytracker.com/id?1030057" source="SECTRACK">1030057</ref>
      <ref url="http://secunia.com/advisories/57845" source="SECUNIA" adv="1">57845</ref>
      <ref url="http://kb.juniper.net/InfoCenter/index?page=content&amp;id=JSA10620" source="CONFIRM" adv="1">http://kb.juniper.net/InfoCenter/index?page=content&amp;id=JSA10620</ref>
    </refs>
    <vuln_soft>
      <prod vendor="juniper" name="srx100">
        <vers num="-"/>
      </prod>
      <prod vendor="juniper" name="srx110">
        <vers num="-"/>
      </prod>
      <prod vendor="juniper" name="srx210">
        <vers num="-"/>
      </prod>
      <prod vendor="juniper" name="srx220">
        <vers num="-"/>
      </prod>
      <prod vendor="juniper" name="srx240">
        <vers num="-"/>
      </prod>
      <prod vendor="juniper" name="srx550">
        <vers num="-"/>
      </prod>
      <prod vendor="juniper" name="srx650">
        <vers num="-"/>
      </prod>
      <prod vendor="juniper" name="junos">
        <vers num="11.4"/>
        <vers num="12.1"/>
        <vers num="12.1x44"/>
        <vers num="12.1x45"/>
        <vers num="12.1x46"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0613" published="2014-01-15" name="CVE-2014-0613" modified="2014-01-15" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:N/A:C)" CVSS_score="7.1" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="8.6" CVSS_base_score="7.1">
    <desc>
      <descript source="cve">The XNM command processor in Juniper Junos 10.4 before 10.4R16, 11.4 before 11.4R10, 12.1R before 12.1R8-S2, 12.1X44 before 12.1X44-D30, 12.1X45 before 12.1X45-D20, 12.1X46 before 12.1X46-D10, 12.2 before 12.2R7, 12.3 before 12.3R5, 13.1 before 13.1R3-S1, 13.2 before 13.2R2-S2, and 13.3 before 13.3R1, when xnm-ssl or xnm-clear-text is enabled, allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.securitytracker.com/id/1029586" source="SECTRACK">1029586</ref>
      <ref url="http://osvdb.org/101861" source="OSVDB">101861</ref>
      <ref url="http://kb.juniper.net/InfoCenter/index?page=content&amp;id=JSA10607" source="CONFIRM" adv="1">http://kb.juniper.net/InfoCenter/index?page=content&amp;id=JSA10607</ref>
    </refs>
    <vuln_soft>
      <prod vendor="juniper" name="junos">
        <vers num="10.4"/>
        <vers num="11.4"/>
        <vers num="12.1r"/>
        <vers num="12.1x44"/>
        <vers num="12.1x45"/>
        <vers num="12.1x46"/>
        <vers num="12.2"/>
        <vers num="12.3"/>
        <vers num="13.1"/>
        <vers num="13.2"/>
        <vers num="13.3"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0614" published="2014-04-14" name="CVE-2014-0614" modified="2014-04-15" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:N/A:C)" CVSS_score="7.1" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="8.6" CVSS_base_score="7.1">
    <desc>
      <descript source="cve">Juniper Junos 13.2 before 13.2R3 and 13.3 before 13.3R1, when PIM is enabled, allows remote attackers to cause a denial of service (kernel panic and crash) via a large number of crafted IGMP packets.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.securityfocus.com/bid/66762" source="BID">66762</ref>
      <ref url="http://securitytracker.com/id?1030062" source="SECTRACK">1030062</ref>
      <ref url="http://secunia.com/advisories/57819" source="SECUNIA" adv="1">57819</ref>
      <ref url="http://kb.juniper.net/InfoCenter/index?page=content&amp;id=JSA10618" source="CONFIRM" adv="1">http://kb.juniper.net/InfoCenter/index?page=content&amp;id=JSA10618</ref>
    </refs>
    <vuln_soft>
      <prod vendor="juniper" name="junos">
        <vers num="13.2"/>
        <vers num="13.3"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0615" published="2014-01-15" name="CVE-2014-0615" modified="2014-01-24" CVSS_version="2.0" CVSS_vector="(AV:L/AC:L/Au:N/C:C/I:C/A:C)" CVSS_score="7.2" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="3.9" CVSS_base_score="7.2">
    <desc>
      <descript source="cve">Juniper Junos 10.4 before 10.4R16, 11.4 before 11.4R10, 12.1R before 12.1R8-S2, 12.1X44 before 12.1X44-D30, 12.1X45 before 12.1X45-D20, 12.1X46 before 12.1X46-D10, 12.2 before 12.2R7, 12.3 before 12.3R5, 13.1 before 13.1R3-S1, 13.2 before 13.2R2, and 13.3 before 13.3R1 allows local users to gain privileges via vectors related to "certain combinations of Junos OS CLI commands and arguments."</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="http://www.securitytracker.com/id/1029585" source="SECTRACK">1029585</ref>
      <ref url="http://www.securityfocus.com/bid/64762" source="BID">64762</ref>
      <ref url="http://osvdb.org/101862" source="OSVDB">101862</ref>
      <ref url="http://kb.juniper.net/InfoCenter/index?page=content&amp;id=JSA10608" source="CONFIRM" adv="1">http://kb.juniper.net/InfoCenter/index?page=content&amp;id=JSA10608</ref>
    </refs>
    <vuln_soft>
      <prod vendor="juniper" name="junos">
        <vers num="10.4"/>
        <vers num="11.4"/>
        <vers num="12.1r"/>
        <vers num="12.1x44"/>
        <vers num="12.1x45"/>
        <vers num="12.1x46"/>
        <vers num="12.2"/>
        <vers num="12.3"/>
        <vers num="13.1"/>
        <vers num="13.2"/>
        <vers num="13.3"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0616" published="2014-01-15" name="CVE-2014-0616" modified="2014-01-24" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:N/A:C)" CVSS_score="7.1" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="8.6" CVSS_base_score="7.1">
    <desc>
      <descript source="cve">Juniper Junos 10.4 before 10.4R16, 11.4 before 11.4R10, 12.1R before 12.1R8-S2, 12.1X44 before 12.1X44-D30, 12.1X45 before 12.1X45-D20, 12.1X46 before 12.1X46-D10, 12.2 before 12.2R7, 12.3 before 12.3R4-S2, 13.1 before 13.1R3-S1, 13.2 before 13.2R2, and 13.3 before 13.3R1 allows remote attackers to cause a denial of service (rdp crash) via a large BGP UPDATE message which immediately triggers a withdraw message to be sent, as demonstrated by a long AS_PATH and a large number of BGP Communities.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.securitytracker.com/id/1029582" source="SECTRACK">1029582</ref>
      <ref url="http://www.securityfocus.com/bid/64766" source="BID">64766</ref>
      <ref url="http://osvdb.org/101868" source="OSVDB">101868</ref>
      <ref url="http://kb.juniper.net/InfoCenter/index?page=content&amp;id=JSA10609" source="CONFIRM" adv="1">http://kb.juniper.net/InfoCenter/index?page=content&amp;id=JSA10609</ref>
    </refs>
    <vuln_soft>
      <prod vendor="juniper" name="junos">
        <vers num="10.4"/>
        <vers num="11.4"/>
        <vers num="12.1r"/>
        <vers num="12.1x44"/>
        <vers num="12.1x45"/>
        <vers num="12.1x46"/>
        <vers num="12.2"/>
        <vers num="12.3"/>
        <vers num="13.1"/>
        <vers num="13.2"/>
        <vers num="13.3"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0617" published="2014-01-15" name="CVE-2014-0617" modified="2014-01-15" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:N/A:C)" CVSS_score="7.1" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="8.6" CVSS_base_score="7.1">
    <desc>
      <descript source="cve">Juniper Junos 10.4S before 10.4S15, 10.4R before 10.4R16, 11.4 before 11.4R9, and 12.1R before 12.1R7 on SRX Series service gateways allows remote attackers to cause a denial of service (flowd crash) via a crafted IP packet.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.securitytracker.com/id/1029583" source="SECTRACK">1029583</ref>
      <ref url="http://www.securityfocus.com/bid/64764" source="BID">64764</ref>
      <ref url="http://osvdb.org/101863" source="OSVDB">101863</ref>
      <ref url="http://kb.juniper.net/InfoCenter/index?page=content&amp;id=JSA10610" source="CONFIRM" adv="1">http://kb.juniper.net/InfoCenter/index?page=content&amp;id=JSA10610</ref>
    </refs>
    <vuln_soft>
      <prod vendor="juniper" name="srx100">
        <vers num="-"/>
      </prod>
      <prod vendor="juniper" name="srx110">
        <vers num="-"/>
      </prod>
      <prod vendor="juniper" name="srx1400">
        <vers num="-"/>
      </prod>
      <prod vendor="juniper" name="srx210">
        <vers num="-"/>
      </prod>
      <prod vendor="juniper" name="srx220">
        <vers num="-"/>
      </prod>
      <prod vendor="juniper" name="srx240">
        <vers num="-"/>
      </prod>
      <prod vendor="juniper" name="srx3400">
        <vers num="-"/>
      </prod>
      <prod vendor="juniper" name="srx3600">
        <vers num="-"/>
      </prod>
      <prod vendor="juniper" name="srx550">
        <vers num="-"/>
      </prod>
      <prod vendor="juniper" name="srx5600">
        <vers num="-"/>
      </prod>
      <prod vendor="juniper" name="srx5800">
        <vers num="-"/>
      </prod>
      <prod vendor="juniper" name="srx650">
        <vers num="-"/>
      </prod>
      <prod vendor="juniper" name="junos">
        <vers num="10.4r"/>
        <vers num="10.4s"/>
        <vers num="11.4"/>
        <vers num="12.1r"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0618" published="2014-01-10" name="CVE-2014-0618" modified="2014-01-17" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:C)" CVSS_score="7.8" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="10.0" CVSS_base_score="7.8">
    <desc>
      <descript source="cve">Juniper Junos before 10.4 before 10.4R16, 11.4 before 11.4R8, 12.1R before 12.1R7, 12.1X44 before 12.1X44-D20, and 12.1X45 before 12.1X45-D10 on SRX Series service gateways, when used as a UAC enforcer and captive portal is enabled, allows remote attackers to cause a denial of service (flowd crash) via a crafted HTTP message.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://kb.juniper.net/InfoCenter/index?page=content&amp;id=JSA10611" source="CONFIRM" adv="1">https://kb.juniper.net/InfoCenter/index?page=content&amp;id=JSA10611</ref>
      <ref url="http://xforce.iss.net/xforce/xfdb/90238" source="XF">juniper-junos-srx-cve20140618-dos(90238)</ref>
      <ref url="http://www.securitytracker.com/id/1029584" source="SECTRACK">1029584</ref>
      <ref url="http://www.securityfocus.com/bid/64769" source="BID">64769</ref>
      <ref url="http://osvdb.org/101864" source="OSVDB">101864</ref>
    </refs>
    <vuln_soft>
      <prod vendor="juniper" name="srx100">
        <vers num="-"/>
      </prod>
      <prod vendor="juniper" name="srx110">
        <vers num="-"/>
      </prod>
      <prod vendor="juniper" name="srx1400">
        <vers num="-"/>
      </prod>
      <prod vendor="juniper" name="srx210">
        <vers num="-"/>
      </prod>
      <prod vendor="juniper" name="srx220">
        <vers num="-"/>
      </prod>
      <prod vendor="juniper" name="srx240">
        <vers num="-"/>
      </prod>
      <prod vendor="juniper" name="srx3400">
        <vers num="-"/>
      </prod>
      <prod vendor="juniper" name="srx3600">
        <vers num="-"/>
      </prod>
      <prod vendor="juniper" name="srx550">
        <vers num="-"/>
      </prod>
      <prod vendor="juniper" name="srx5600">
        <vers num="-"/>
      </prod>
      <prod vendor="juniper" name="srx5800">
        <vers num="-"/>
      </prod>
      <prod vendor="juniper" name="srx650">
        <vers num="-"/>
      </prod>
      <prod vendor="juniper" name="junos">
        <vers num="10.4"/>
        <vers num="11.4"/>
        <vers num="12.1r"/>
        <vers num="12.1x44"/>
        <vers num="12.1x45"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0620" published="2014-01-08" name="CVE-2014-0620" modified="2014-02-25" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Multiple cross-site scripting (XSS) vulnerabilities in Technicolor (formerly Thomson) TC7200 STD6.01.12 allow remote attackers to inject arbitrary web script or HTML via the (1) ADDNewDomain parameter to parental/website-filters.asp or (2) VmTracerouteHost parameter to goform/status/diagnostics-route.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://www.exploit-db.com/exploits/30668" source="EXPLOIT-DB">30668</ref>
    </refs>
    <vuln_soft>
      <prod vendor="technicolor" name="tc7200">
        <vers num="std6.01.12"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0621" published="2014-01-08" name="CVE-2014-0621" modified="2014-02-24" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:P)" CVSS_score="6.8" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.6" CVSS_base_score="6.8">
    <desc>
      <descript source="cve">Multiple cross-site request forgery (CSRF) vulnerabilities in Technicolor (formerly Thomson) TC7200 STD6.01.12 allow remote attackers to hijack the authentication of administrators for requests that (1) perform a factory reset via a request to goform/system/factory, (2) disable advanced options via a request to goform/advanced/options, (3) remove ip-filters via the IpFilterAddressDelete1 parameter to goform/advanced/ip-filters, or (4) remove firewall settings via the cbFirewall parameter to goform/advanced/firewall.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://www.exploit-db.com/exploits/30667" source="EXPLOIT-DB">30667</ref>
    </refs>
    <vuln_soft>
      <prod vendor="technicolor" name="tc7200">
        <vers num="std6.01.12"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0622" published="2014-02-06" name="CVE-2014-0622" modified="2014-02-07" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:C/I:C/A:C)" CVSS_score="9.0" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.0" CVSS_base_score="9.0">
    <desc>
      <descript source="cve">The web service in EMC Documentum Foundation Services (DFS) 6.5 through 6.7 before 6.7 SP1 P22, 6.7 SP2 before P08, 7.0 before P12, and 7.1 before P01 does not properly implement content uploading, which allows remote authenticated users to bypass intended content access restrictions via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-02/0007.html" source="BUGTRAQ">20140205 ESA-2014-005: EMC Documentum Foundation Services (DFS) Content Access Vulnerability</ref>
    </refs>
    <vuln_soft>
      <prod vendor="emc" name="documentum_foundation_services">
        <vers num="6.5"/>
        <vers num="6.6"/>
        <vers num="6.7"/>
        <vers num="7.0"/>
        <vers num="7.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0623" published="2014-03-27" name="CVE-2014-0623" modified="2014-03-27" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in the Self-Service Console in EMC RSA Authentication Manager 7.1 before SP4 P32 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to a "cross frame scripting" issue.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-03/0146.html" source="BUGTRAQ">20140326 ESA-2014-015: RSA Authentication Manager Cross Frame Scripting Vulnerability</ref>
    </refs>
    <vuln_soft>
      <prod vendor="rsa" name="authentication_manager">
        <vers num="7.1" edition="-"/>
        <vers num="7.1" edition="sp4"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-0624" published="2014-03-06" name="CVE-2014-0624" modified="2014-03-07" CVSS_version="2.0" CVSS_vector="(AV:A/AC:L/Au:S/C:P/I:N/A:N)" CVSS_score="2.7" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="5.1" CVSS_base_score="2.7">
    <desc>
      <descript source="cve">EMC RSA Data Loss Prevention (DLP) 9.x before 9.6-SP2 does not properly manage sessions, which allows remote authenticated users to gain privileges and bypass intended content-reading restrictions via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <local_network/>
    </range>
    <refs>
      <ref url="http://seclists.org/bugtraq/2014/Mar/8" source="BUGTRAQ">20140228 ESA-2014-003: RSA Data Loss Prevention Improper Session Management Vulnerability</ref>
    </refs>
    <vuln_soft>
      <prod vendor="emc" name="rsa_data_loss_prevention">
        <vers num="9.0"/>
        <vers num="9.5"/>
        <vers num="9.6"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0625" published="2014-02-17" name="CVE-2014-0625" modified="2014-02-18" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:P)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">The SSLSocket implementation in the (1) JSAFE and (2) JSSE APIs in EMC RSA BSAFE SSL-J 5.x before 5.1.3 and 6.x before 6.0.2 allows remote attackers to cause a denial of service (memory consumption) by triggering application-data processing during the TLS handshake, a time at which the data is internally buffered.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-02/0061.html" source="BUGTRAQ">20140214 ESA-2014-009: RSA BSAFE SSL-J Multiple Vulnerabilities</ref>
    </refs>
    <vuln_soft>
      <prod vendor="emc" name="rsa_bsafe_ssl-j">
        <vers num="5.0"/>
        <vers num="5.1.0"/>
        <vers num="5.1.1"/>
        <vers num="5.1.2"/>
        <vers num="6.0"/>
        <vers num="6.0.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0626" published="2014-02-17" name="CVE-2014-0626" modified="2014-02-18" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:N/A:N)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">The (1) JSAFE and (2) JSSE APIs in EMC RSA BSAFE SSL-J 5.x before 5.1.3 and 6.x before 6.0.2 make it easier for remote attackers to bypass intended cryptographic protection mechanisms by triggering application-data processing during the TLS handshake, a time at which the data is both unencrypted and unauthenticated.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-02/0061.html" source="BUGTRAQ">20140214 ESA-2014-009: RSA BSAFE SSL-J Multiple Vulnerabilities</ref>
    </refs>
    <vuln_soft>
      <prod vendor="emc" name="rsa_bsafe_ssl-j">
        <vers num="5.0"/>
        <vers num="5.1.0"/>
        <vers num="5.1.1"/>
        <vers num="5.1.2"/>
        <vers num="6.0"/>
        <vers num="6.0.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0627" published="2014-02-17" name="CVE-2014-0627" modified="2014-02-18" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:P/A:N)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">The SSLEngine API implementation in EMC RSA BSAFE SSL-J 5.x before 5.1.3 and 6.x before 6.0.2 allows remote attackers to trigger the selection of a weak cipher suite by using the wrap method during a certain incomplete-handshake state.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-02/0061.html" source="BUGTRAQ">20140214 ESA-2014-009: RSA BSAFE SSL-J Multiple Vulnerabilities</ref>
    </refs>
    <vuln_soft>
      <prod vendor="emc" name="rsa_bsafe_ssl-j">
        <vers num="5.0"/>
        <vers num="5.1.0"/>
        <vers num="5.1.1"/>
        <vers num="5.1.2"/>
        <vers num="6.0"/>
        <vers num="6.0.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0628" published="2014-03-25" name="CVE-2014-0628" modified="2014-03-25" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:P)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">The server in EMC RSA BSAFE Micro Edition Suite (MES) 4.0.x before 4.0.5 does not properly process certificate chains, which allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-03/0130.html" source="BUGTRAQ">20140324 ESA-2014-011: RSA BSAFE Micro Edition Suite Server Crash Vulnerability</ref>
    </refs>
    <vuln_soft>
      <prod vendor="emc" name="rsa_bsafe">
        <vers num="4.0.0" edition=":~~micro_edition_suite~~~"/>
        <vers num="4.0.1" edition=":~~micro_edition_suite~~~"/>
        <vers num="4.0.2" edition=":~~micro_edition_suite~~~"/>
        <vers num="4.0.3" edition=":~~micro_edition_suite~~~"/>
        <vers num="4.0.4" edition=":~~micro_edition_suite~~~"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0629" published="2014-03-06" name="CVE-2014-0629" modified="2014-03-07" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:S/C:C/I:C/A:C)" CVSS_score="8.5" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="6.8" CVSS_base_score="8.5">
    <desc>
      <descript source="cve">EMC Documentum TaskSpace (TSP) 6.7SP1 before P25 and 6.7SP2 before P11 does not properly handle the interaction between the dm_world group and the dm_superusers_dynamic group, which allows remote authenticated users to obtain sensitive information and gain privileges in opportunistic circumstances by leveraging an incorrect group-addition implementation.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://seclists.org/bugtraq/2014/Mar/33" source="BUGTRAQ">20140305 ESA-2014-012: EMC Documentum TaskSpace Multiple Vulnerabilities</ref>
    </refs>
    <vuln_soft>
      <prod vendor="emc" name="documentum_taskspace">
        <vers num="6.7" edition="sp1"/>
        <vers num="6.7" edition="sp2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0630" published="2014-03-06" name="CVE-2014-0630" modified="2014-03-07" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:P/I:N/A:N)" CVSS_score="4.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.0" CVSS_base_score="4.0">
    <desc>
      <descript source="cve">EMC Documentum TaskSpace (TSP) 6.7SP1 before P25 and 6.7SP2 before P11 allows remote authenticated users to read arbitrary files via a modified imaging-service URL.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://seclists.org/bugtraq/2014/Mar/33" source="BUGTRAQ">20140305 ESA-2014-012: EMC Documentum TaskSpace Multiple Vulnerabilities</ref>
    </refs>
    <vuln_soft>
      <prod vendor="emc" name="documentum_taskspace">
        <vers num="6.7" edition="sp1"/>
        <vers num="6.7" edition="sp2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0632" published="2014-04-01" name="CVE-2014-0632" modified="2014-04-01" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:C/I:C/A:C)" CVSS_score="9.0" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.0" CVSS_base_score="9.0">
    <desc>
      <descript source="cve">Directory traversal vulnerability in EMC VPLEX GeoSynchrony 4.x and 5.x before 5.3 allows remote authenticated users to execute arbitrary code via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-03/0157.html" source="BUGTRAQ">20140326 ESA-2014-016: EMC VPLEX Multiple Vulnerabilities</ref>
    </refs>
    <vuln_soft>
      <prod vendor="emc" name="vplex_geosynchrony">
        <vers num="4.0"/>
        <vers num="5.0"/>
        <vers num="5.1"/>
        <vers num="5.2"/>
        <vers num="5.2.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0633" published="2014-04-01" name="CVE-2014-0633" modified="2014-04-01" CVSS_version="2.0" CVSS_vector="(AV:A/AC:L/Au:S/C:C/I:C/A:C)" CVSS_score="7.7" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="5.1" CVSS_base_score="7.7">
    <desc>
      <descript source="cve">The GUI in EMC VPLEX GeoSynchrony 4.x and 5.x before 5.3 does not properly validate session-timeout values, which might make it easier for remote attackers to execute arbitrary code by leveraging an unattended workstation.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <local_network/>
    </range>
    <refs>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-03/0157.html" source="BUGTRAQ">20140326 ESA-2014-016: EMC VPLEX Multiple Vulnerabilities</ref>
    </refs>
    <vuln_soft>
      <prod vendor="emc" name="vplex_geosynchrony">
        <vers num="4.0"/>
        <vers num="5.0"/>
        <vers num="5.1"/>
        <vers num="5.2"/>
        <vers num="5.2.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0634" published="2014-04-01" name="CVE-2014-0634" modified="2014-04-01" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:S/C:P/I:P/A:P)" CVSS_score="6.0" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="6.8" CVSS_base_score="6.0">
    <desc>
      <descript source="cve">EMC VPLEX GeoSynchrony 4.x and 5.x before 5.3 does not include the HTTPOnly flag in a Set-Cookie header for an unspecified cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-03/0157.html" source="BUGTRAQ">20140326 ESA-2014-016: EMC VPLEX Multiple Vulnerabilities</ref>
    </refs>
    <vuln_soft>
      <prod vendor="emc" name="vplex_geosynchrony">
        <vers num="4.0"/>
        <vers num="5.0"/>
        <vers num="5.1"/>
        <vers num="5.2"/>
        <vers num="5.2.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0635" published="2014-04-01" name="CVE-2014-0635" modified="2014-04-01" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:S/C:C/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="8.5" CVSS_exploit_subscore="6.8" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">Session fixation vulnerability in EMC VPLEX GeoSynchrony 4.x and 5.x before 5.3 allows remote attackers to hijack web sessions via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-03/0157.html" source="BUGTRAQ">20140326 ESA-2014-016: EMC VPLEX Multiple Vulnerabilities</ref>
    </refs>
    <vuln_soft>
      <prod vendor="emc" name="vplex_geosynchrony">
        <vers num="4.0"/>
        <vers num="5.0"/>
        <vers num="5.1"/>
        <vers num="5.2"/>
        <vers num="5.2.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0636" published="2014-04-11" name="CVE-2014-0636" modified="2014-04-14" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:N)" CVSS_score="5.8" CVSS_impact_subscore="4.9" CVSS_exploit_subscore="8.6" CVSS_base_score="5.8">
    <desc>
      <descript source="cve">EMC RSA BSAFE Micro Edition Suite (MES) 3.2.x before 3.2.6 and 4.0.x before 4.0.5 does not properly validate X.509 certificate chains, which allows man-in-the-middle attackers to spoof SSL servers via a crafted certificate chain.</descript>
    </desc>
    <loss_types>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-04/0069.html" source="BUGTRAQ">20140411 ESA-2014-019: RSA BSAFE Micro Edition Suite Certificate Chain Processing Vulnerability</ref>
    </refs>
    <vuln_soft>
      <prod vendor="emc" name="rsa_bsafe">
        <vers num="3.2.0" edition=":~~micro_edition_suite~~~"/>
        <vers num="3.2.1" edition=":~~micro_edition_suite~~~"/>
        <vers num="3.2.2" edition=":~~micro_edition_suite~~~"/>
        <vers num="3.2.3" edition=":~~micro_edition_suite~~~"/>
        <vers num="3.2.4" edition=":~~micro_edition_suite~~~"/>
        <vers num="3.2.5" edition=":~~micro_edition_suite~~~"/>
        <vers num="4.0.0" edition=":~~micro_edition_suite~~~"/>
        <vers num="4.0.1" edition=":~~micro_edition_suite~~~"/>
        <vers num="4.0.2" edition=":~~micro_edition_suite~~~"/>
        <vers num="4.0.3" edition=":~~micro_edition_suite~~~"/>
        <vers num="4.0.4" edition=":~~micro_edition_suite~~~"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0637" published="2014-04-04" name="CVE-2014-0637" modified="2014-04-04" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in the back-office case-management application in RSA Adaptive Authentication (On-Premise) 6.x and 7.x before 7.1 SP0 P2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-04/0007.html" source="BUGTRAQ">20140401 ESA-2014-020: RSA Adaptive Authentication (On-Premise) Multiple Vulnerabilities</ref>
    </refs>
    <vuln_soft>
      <prod vendor="emc" name="rsa_adaptive_authentication_on-premise">
        <vers num="6.0"/>
        <vers num="6.0.2.1" edition="sp1_patch2"/>
        <vers num="6.0.2.1" edition="sp1_patch3"/>
        <vers num="6.0.2.1" edition="sp2"/>
        <vers num="6.0.2.1" edition="sp2_patch1"/>
        <vers num="6.0.2.1" edition="sp3"/>
        <vers num="6.0.2.1" edition="sp3_p3"/>
        <vers num="7.0"/>
        <vers num="7.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0638" published="2014-04-04" name="CVE-2014-0638" modified="2014-04-04" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in RSA Adaptive Authentication (On-Premise) 6.x and 7.x before 7.1 SP0 P2 allows remote attackers to inject arbitrary web script or HTML via vectors involving FRAME elements, related to a "cross-frame scripting" issue.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-04/0007.html" source="BUGTRAQ">20140401 ESA-2014-020: RSA Adaptive Authentication (On-Premise) Multiple Vulnerabilities</ref>
    </refs>
    <vuln_soft>
      <prod vendor="emc" name="rsa_adaptive_authentication_on-premise">
        <vers num="6.0"/>
        <vers num="6.0.2.1" edition="sp1_patch2"/>
        <vers num="6.0.2.1" edition="sp1_patch3"/>
        <vers num="6.0.2.1" edition="sp2"/>
        <vers num="6.0.2.1" edition="sp2_patch1"/>
        <vers num="6.0.2.1" edition="sp3"/>
        <vers num="6.0.2.1" edition="sp3_p3"/>
        <vers num="7.0"/>
        <vers num="7.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0642" published="2014-04-15" name="CVE-2014-0642" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:P/I:P/A:N)" CVSS_score="5.5" CVSS_impact_subscore="4.9" CVSS_exploit_subscore="8.0" CVSS_base_score="5.5">
    <desc>
      <descript source="cve">EMC Documentum Content Server before 6.7 SP1 P26, 6.7 SP2 before P13, 7.0 before P13, and 7.1 before P02 allows remote authenticated users to bypass intended access restrictions and read metadata from certain folders via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://twitter.com/artika4biz/statuses/455358950116823040" source="MISC">http://twitter.com/artika4biz/statuses/455358950116823040</ref>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-04/0072.html" source="BUGTRAQ">20140411 ESA-2014-026: EMC Documentum Content Server Information Disclosure Vulnerability</ref>
    </refs>
    <vuln_soft>
      <prod vendor="emc" name="documentum_content_server">
        <vers num="6.0"/>
        <vers num="6.5" edition="sp1"/>
        <vers num="6.5" edition="sp2"/>
        <vers num="6.5" edition="sp3"/>
        <vers num="6.6"/>
        <vers prev="1" num="6.7" edition="-"/>
        <vers prev="1" num="6.7" edition="sp1"/>
        <vers prev="1" num="6.7" edition="sp2"/>
        <vers num="7.0"/>
        <vers num="7.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0644" published="2014-04-16" name="CVE-2014-0644" modified="2014-04-17" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:C/I:N/A:N)" CVSS_score="7.8" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="10.0" CVSS_base_score="7.8">
    <desc>
      <descript source="cve">EMC Cloud Tiering Appliance (CTA) 10 through SP1 allows remote attackers to read arbitrary files via an api/login request containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, as demonstrated by reading the /etc/shadow file.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://gist.github.com/brandonprry/9895721" source="MISC">https://gist.github.com/brandonprry/9895721</ref>
      <ref url="http://seclists.org/fulldisclosure/2014/Mar/426" source="FULLDISC">20140331 EMC CTA v10.0 unauthenticated XXE with root perms</ref>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-04/0094.html" source="BUGTRAQ">20140416 ESA-2014-028: EMC Cloud Tiering Appliance XML External Entity (XXE) and Information Disclosure Vulnerabilities</ref>
    </refs>
    <vuln_soft>
      <prod vendor="emc" name="cloud_tiering_appliance_software">
        <vers num="10.0" edition="-"/>
        <vers num="10.0" edition="sp1"/>
      </prod>
      <prod vendor="emc" name="cloud_tiering_appliance">
        <vers num="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0645" published="2014-04-16" name="CVE-2014-0645" modified="2014-04-17" CVSS_version="2.0" CVSS_vector="(AV:L/AC:M/Au:N/C:C/I:N/A:N)" CVSS_score="4.7" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="3.4" CVSS_base_score="4.7">
    <desc>
      <descript source="cve">EMC Cloud Tiering Appliance (CTA) 9.x through 10 SP1 and File Management Appliance (FMA) 7.x store DES password hashes for the root, super, and admin accounts, which makes it easier for context-dependent attackers to obtain sensitive information via a brute-force attack.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="https://gist.github.com/brandonprry/9895721" source="MISC">https://gist.github.com/brandonprry/9895721</ref>
      <ref url="http://seclists.org/fulldisclosure/2014/Mar/426" source="FULLDISC">20140331 EMC CTA v10.0 unauthenticated XXE with root perms</ref>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-04/0094.html" source="BUGTRAQ">20140416 ESA-2014-028: EMC Cloud Tiering Appliance XML External Entity (XXE) and Information Disclosure Vulnerabilities</ref>
    </refs>
    <vuln_soft>
      <prod vendor="emc" name="cloud_tiering_appliance_software">
        <vers num="10.0" edition="-"/>
        <vers num="10.0" edition="sp1"/>
        <vers num="9.0"/>
      </prod>
      <prod vendor="emc" name="file_management_appliance_software">
        <vers num="7.0"/>
      </prod>
      <prod vendor="emc" name="cloud_tiering_appliance">
        <vers num="-"/>
      </prod>
      <prod vendor="emc" name="file_management_appliance">
        <vers num="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0646" published="2014-05-01" name="CVE-2014-0646" modified="2014-05-02" CVSS_version="2.0" CVSS_vector="(AV:L/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="6.9" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="3.4" CVSS_base_score="6.9">
    <desc>
      <descript source="cve">The runtime WS component in the server in EMC RSA Access Manager 6.1.3 before 6.1.3.39, 6.1.4 before 6.1.4.22, 6.2.0 before 6.2.0.11, and 6.2.1 before 6.2.1.03, when INFO logging is enabled, allows local users to discover cleartext passwords by reading log files.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-04/0191.html" source="BUGTRAQ">20140430 ESA-2014-029: RSA Access Manager Sensitive Information Disclosure Vulnerability</ref>
    </refs>
    <vuln_soft>
      <prod vendor="emc" name="rsa_access_manager">
        <vers num="6.1" edition="sp3"/>
        <vers num="6.1" edition="sp4"/>
        <vers num="6.2" edition="-"/>
        <vers num="6.2" edition="sp1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-0647" published="2014-01-27" name="CVE-2014-0647" modified="2014-02-24" CVSS_version="2.0" CVSS_vector="(AV:L/AC:L/Au:N/C:P/I:N/A:N)" CVSS_score="2.1" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="3.9" CVSS_base_score="2.1">
    <desc>
      <descript source="cve">The Starbucks 2.6.1 application for iOS stores sensitive information in plaintext in the Crashlytics log file (/Library/Caches/com.crashlytics.data/com.starbucks.mystarbucks/session.clslog), which allows attackers to discover usernames, passwords, and e-mail addresses via an application that reads session.clslog.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="https://itunes.apple.com/us/app/starbucks/id331177714?mt=8" source="MISC">https://itunes.apple.com/us/app/starbucks/id331177714?mt=8</ref>
      <ref url="http://xforce.iss.net/xforce/xfdb/90412" source="XF">starbucks-cve20140647-info-disclosure(90412)</ref>
      <ref url="http://www.zdnet.com/the-starbucks-bug-not-as-awful-as-reported-7000025269/" source="MISC">http://www.zdnet.com/the-starbucks-bug-not-as-awful-as-reported-7000025269/</ref>
      <ref url="http://www.zdnet.com/starbucks-fixes-ios-app-bugs-7000025323/" source="MISC">http://www.zdnet.com/starbucks-fixes-ios-app-bugs-7000025323/</ref>
      <ref url="http://www.securityfocus.com/bid/64942" source="BID">64942</ref>
      <ref url="http://www.securityfocus.com/archive/1/archive/1/530756/100/0/threaded" source="BUGTRAQ">20140114 [CVE-2014-0647] Insecure Data Storage of User Data Elements in Starbucks v2.6.1 iOS mobile application</ref>
      <ref url="http://www.osvdb.org/102514" source="OSVDB">102514</ref>
      <ref url="http://seclists.org/fulldisclosure/2014/Jan/64" source="FULLDISC">20140113 [CVE-2014-0647] Insecure Data Storage of User Data Elements in Starbucks v2.6.1 iOS mobile application</ref>
      <ref url="http://seclists.org/fulldisclosure/2014/Jan/123" source="FULLDISC">20140117 Re: [CVE-2014-0647] Insecure Data Storage of User Data Elements in Starbucks v2.6.1 iOS mobile application</ref>
    </refs>
    <vuln_soft>
      <prod vendor="starbucks" name="starbucks">
        <vers num="2.6.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0648" published="2014-01-16" name="CVE-2014-0648" modified="2014-01-23" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:C/I:C/A:C)" CVSS_score="10.0" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="10.0" CVSS_base_score="10.0">
    <desc>
      <descript source="cve">The RMI interface in Cisco Secure Access Control System (ACS) 5.x before 5.5 does not properly enforce authentication and authorization requirements, which allows remote attackers to obtain administrative access via a request to this interface, aka Bug ID CSCud75187.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90431" source="XF">cisco-acs-cve20140648-unauth-access(90431)</ref>
      <ref url="http://www.securitytracker.com/id/1029634" source="SECTRACK">1029634</ref>
      <ref url="http://www.securityfocus.com/bid/64962" source="BID">64962</ref>
      <ref url="http://tools.cisco.com/security/center/viewAlert.x?alertId=32379" source="CONFIRM">http://tools.cisco.com/security/center/viewAlert.x?alertId=32379</ref>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140115-csacs" source="CISCO" adv="1">20140115 Multiple Vulnerabilities in Cisco Secure Access Control System</ref>
      <ref url="http://secunia.com/advisories/56213" source="SECUNIA">56213</ref>
      <ref url="http://osvdb.org/102117" source="OSVDB">102117</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="secure_access_control_system">
        <vers num="5.1"/>
        <vers num="5.1.0.44"/>
        <vers num="5.1.0.44.1"/>
        <vers num="5.1.0.44.2"/>
        <vers num="5.1.0.44.3"/>
        <vers num="5.1.0.44.4"/>
        <vers num="5.1.0.44.5"/>
        <vers num="5.2"/>
        <vers num="5.2.0.26"/>
        <vers num="5.2.0.26.1"/>
        <vers num="5.2.0.26.2"/>
        <vers num="5.3.0.40.1"/>
        <vers num="5.3.0.40.2"/>
        <vers num="5.3.0.40.3"/>
        <vers num="5.3.0.40.4"/>
        <vers num="5.3.0.40.5"/>
        <vers num="5.3.0.40.6"/>
        <vers num="5.3.0.40.7"/>
        <vers num="5.3.0.40.8"/>
        <vers num="5.3.0.40.9"/>
        <vers num="5.4.0.46.1"/>
        <vers num="5.4.0.46.2"/>
        <vers num="5.4.0.46.3"/>
        <vers num="5.4.0.46.4"/>
        <vers num="5.4.0.46.5"/>
        <vers prev="1" num="5.4.0.46.6"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0649" published="2014-01-16" name="CVE-2014-0649" modified="2014-01-23" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:C/I:C/A:C)" CVSS_score="9.0" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.0" CVSS_base_score="9.0">
    <desc>
      <descript source="cve">The RMI interface in Cisco Secure Access Control System (ACS) 5.x before 5.5 does not properly enforce authorization requirements, which allows remote authenticated users to obtain superadmin access via a request to this interface, aka Bug ID CSCud75180.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90430" source="XF">cisco-acs-cve20140649-priv-esc(90430)</ref>
      <ref url="http://www.securitytracker.com/id/1029634" source="SECTRACK">1029634</ref>
      <ref url="http://www.securityfocus.com/bid/64958" source="BID">64958</ref>
      <ref url="http://tools.cisco.com/security/center/viewAlert.x?alertId=32378" source="CONFIRM">http://tools.cisco.com/security/center/viewAlert.x?alertId=32378</ref>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140115-csacs" source="CISCO" adv="1">20140115 Multiple Vulnerabilities in Cisco Secure Access Control System</ref>
      <ref url="http://secunia.com/advisories/56213" source="SECUNIA">56213</ref>
      <ref url="http://osvdb.org/102116" source="OSVDB">102116</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="secure_access_control_system">
        <vers num="5.1"/>
        <vers num="5.1.0.44"/>
        <vers num="5.1.0.44.1"/>
        <vers num="5.1.0.44.2"/>
        <vers num="5.1.0.44.3"/>
        <vers num="5.1.0.44.4"/>
        <vers num="5.1.0.44.5"/>
        <vers num="5.2"/>
        <vers num="5.2.0.26"/>
        <vers num="5.2.0.26.1"/>
        <vers num="5.2.0.26.2"/>
        <vers num="5.3.0.40.1"/>
        <vers num="5.3.0.40.2"/>
        <vers num="5.3.0.40.3"/>
        <vers num="5.3.0.40.4"/>
        <vers num="5.3.0.40.5"/>
        <vers num="5.3.0.40.6"/>
        <vers num="5.3.0.40.7"/>
        <vers num="5.3.0.40.8"/>
        <vers num="5.3.0.40.9"/>
        <vers num="5.4.0.46.1"/>
        <vers num="5.4.0.46.2"/>
        <vers num="5.4.0.46.3"/>
        <vers num="5.4.0.46.4"/>
        <vers num="5.4.0.46.5"/>
        <vers prev="1" num="5.4.0.46.6"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0650" published="2014-01-16" name="CVE-2014-0650" modified="2014-01-31" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:C/I:C/A:C)" CVSS_score="10.0" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="10.0" CVSS_base_score="10.0">
    <desc>
      <descript source="cve">The web interface in Cisco Secure Access Control System (ACS) 5.x before 5.4 Patch 3 allows remote attackers to execute arbitrary operating-system commands via a request to this interface, aka Bug ID CSCue65962.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90432" source="XF">cisco-acs-cve20140650-command-exec(90432)</ref>
      <ref url="http://www.securitytracker.com/id/1029634" source="SECTRACK">1029634</ref>
      <ref url="http://www.securityfocus.com/bid/64964" source="BID">64964</ref>
      <ref url="http://tools.cisco.com/security/center/viewAlert.x?alertId=32380" source="CONFIRM">http://tools.cisco.com/security/center/viewAlert.x?alertId=32380</ref>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140115-csacs" source="CISCO" adv="1">20140115 Multiple Vulnerabilities in Cisco Secure Access Control System</ref>
      <ref url="http://secunia.com/advisories/56213" source="SECUNIA">56213</ref>
      <ref url="http://osvdb.org/102115" source="OSVDB">102115</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="secure_access_control_system">
        <vers num="5.1"/>
        <vers num="5.1.0.44"/>
        <vers num="5.1.0.44.1"/>
        <vers num="5.1.0.44.2"/>
        <vers num="5.1.0.44.3"/>
        <vers num="5.1.0.44.4"/>
        <vers num="5.1.0.44.5"/>
        <vers num="5.2"/>
        <vers num="5.2.0.26"/>
        <vers num="5.2.0.26.1"/>
        <vers num="5.2.0.26.2"/>
        <vers num="5.3.0.40.1"/>
        <vers num="5.3.0.40.2"/>
        <vers num="5.3.0.40.3"/>
        <vers num="5.3.0.40.4"/>
        <vers num="5.3.0.40.5"/>
        <vers num="5.3.0.40.6"/>
        <vers num="5.3.0.40.7"/>
        <vers num="5.3.0.40.8"/>
        <vers num="5.3.0.40.9"/>
        <vers num="5.4.0.46.1"/>
        <vers prev="1" num="5.4.0.46.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0651" published="2014-01-08" name="CVE-2014-0651" modified="2014-01-17" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:S/C:P/I:P/A:N)" CVSS_score="4.9" CVSS_impact_subscore="4.9" CVSS_exploit_subscore="6.8" CVSS_base_score="4.9">
    <desc>
      <descript source="cve">The administrative interface in Cisco Context Directory Agent (CDA) does not properly enforce authorization requirements, which allows remote authenticated users to obtain administrative access by hijacking a session, aka Bug ID CSCuj45347.</descript>
    </desc>
    <loss_types>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90166" source="XF">cisco-cda-cve20140651-priv-esc(90166)</ref>
      <ref url="http://www.securitytracker.com/id/1029573" source="SECTRACK">1029573</ref>
      <ref url="http://www.securityfocus.com/bid/64706" source="BID">64706</ref>
      <ref url="http://tools.cisco.com/security/center/viewAlert.x?alertId=32364" source="CONFIRM">http://tools.cisco.com/security/center/viewAlert.x?alertId=32364</ref>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0651" source="CISCO" adv="1">20140107 Cisco Context Directory Agent Privilege Escalation Vulnerability</ref>
      <ref url="http://secunia.com/advisories/56365" source="SECUNIA">56365</ref>
      <ref url="http://osvdb.org/101809" source="OSVDB">101809</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="context_directory_agent">
        <vers num="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0652" published="2014-01-08" name="CVE-2014-0652" modified="2014-01-17" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in the Mappings page in Cisco Context Directory Agent (CDA) allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCuj45358.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90167" source="XF">cisco-cda-cve20140652-xss(90167)</ref>
      <ref url="http://www.securitytracker.com/id/1029572" source="SECTRACK">1029572</ref>
      <ref url="http://www.securityfocus.com/bid/64703" source="BID">64703</ref>
      <ref url="http://tools.cisco.com/security/center/viewAlert.x?alertId=32365" source="CONFIRM">http://tools.cisco.com/security/center/viewAlert.x?alertId=32365</ref>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0652" source="CISCO" adv="1">20140107 Cisco Context Directory Agent Mappings Page Cross-Site Scripting Vulnerability</ref>
      <ref url="http://secunia.com/advisories/56365" source="SECUNIA">56365</ref>
      <ref url="http://osvdb.org/101803" source="OSVDB">101803</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="context_directory_agent">
        <vers num="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0653" published="2014-01-08" name="CVE-2014-0653" modified="2014-01-17" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">The Identity Firewall (IDFW) functionality in Cisco Adaptive Security Appliance (ASA) Software allows remote attackers to trigger authentication-state modifications via a crafted NetBIOS logout probe response, aka Bug ID CSCuj45340.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90165" source="XF">cisco-asa-cve20140653-sec-bypass(90165)</ref>
      <ref url="http://www.securitytracker.com/id/1029570" source="SECTRACK">1029570</ref>
      <ref url="http://www.securityfocus.com/bid/64708" source="BID">64708</ref>
      <ref url="http://tools.cisco.com/security/center/viewAlert.x?alertId=32363" source="CONFIRM">http://tools.cisco.com/security/center/viewAlert.x?alertId=32363</ref>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0653" source="CISCO" adv="1">20140107 Cisco Adaptive Security Appliance Identity Firewall NetBIOS Logout Probe Auth State Change Vulnerability</ref>
      <ref url="http://secunia.com/advisories/56366" source="SECUNIA">56366</ref>
      <ref url="http://osvdb.org/101834" source="OSVDB">101834</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="adaptive_security_appliance">
        <vers num=""/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0654" published="2014-01-08" name="CVE-2014-0654" modified="2014-01-17" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Cisco Context Directory Agent (CDA) allows remote attackers to modify the cache via a replay attack involving crafted RADIUS accounting messages, aka Bug ID CSCuj45383.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90168" source="XF">cisco-cda-cve20140654-sec-bypass(90168)</ref>
      <ref url="http://www.securitytracker.com/id/1029574" source="SECTRACK">1029574</ref>
      <ref url="http://www.securityfocus.com/bid/64709" source="BID">64709</ref>
      <ref url="http://tools.cisco.com/security/center/viewAlert.x?alertId=32366" source="CONFIRM">http://tools.cisco.com/security/center/viewAlert.x?alertId=32366</ref>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0654" source="CISCO" adv="1">20140107 Cisco Context Directory Agent Replayed RADIUS Accounting Message Vulnerability</ref>
      <ref url="http://secunia.com/advisories/56365" source="SECUNIA">56365</ref>
      <ref url="http://osvdb.org/101802" source="OSVDB">101802</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="context_directory_agent">
        <vers num="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0655" published="2014-01-08" name="CVE-2014-0655" modified="2014-01-17" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">The Identity Firewall (IDFW) functionality in Cisco Adaptive Security Appliance (ASA) Software allows remote attackers to change the user-cache contents via a replay attack involving crafted RADIUS Change of Authorization (CoA) messages, aka Bug ID CSCuj45332.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90164" source="XF">cisco-asa-cve20140655-sec-bypass(90164)</ref>
      <ref url="http://www.securitytracker.com/id/1029575" source="SECTRACK">1029575</ref>
      <ref url="http://www.securityfocus.com/bid/64700" source="BID">64700</ref>
      <ref url="http://tools.cisco.com/security/center/viewAlert.x?alertId=32362" source="CONFIRM">http://tools.cisco.com/security/center/viewAlert.x?alertId=32362</ref>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0655" source="CISCO" adv="1">20140107 Cisco Adaptive Security Appliance RADIUS Change of Authorization Message Replay Vulnerability</ref>
      <ref url="http://secunia.com/advisories/56366" source="SECUNIA">56366</ref>
      <ref url="http://osvdb.org/101838" source="OSVDB">101838</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="adaptive_security_appliance">
        <vers num=""/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0656" published="2014-01-08" name="CVE-2014-0656" modified="2014-01-17" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:N/I:P/A:N)" CVSS_score="4.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.0" CVSS_base_score="4.0">
    <desc>
      <descript source="cve">Cisco Context Directory Agent (CDA) allows remote authenticated users to trigger the omission of certain user-interface data via crafted field values, aka Bug ID CSCuj45353.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90169" source="XF">cisco-cda-cve20140656-sec-bypass(90169)</ref>
      <ref url="http://www.securitytracker.com/id/1029569" source="SECTRACK">1029569</ref>
      <ref url="http://www.securityfocus.com/bid/64701" source="BID">64701</ref>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0656" source="CISCO" adv="1">20140107 Cisco Context Directory Agent Hidden Input Vulnerability</ref>
      <ref url="http://osvdb.org/101801" source="OSVDB">101801</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="context_directory_agent">
        <vers num="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0657" published="2014-01-08" name="CVE-2014-0657" modified="2014-01-17" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:P/I:N/A:N)" CVSS_score="4.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.0" CVSS_base_score="4.0">
    <desc>
      <descript source="cve">The administration portal in Cisco Unified Communications Manager (Unified CM) 9.1(1) and earlier does not properly handle role restrictions, which allows remote authenticated users to bypass role-based access control via multiple visits to a forbidden portal URL, aka Bug ID CSCuj83540.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90120" source="XF">cisco-ucm-cve20140657-sec-bypass(90120)</ref>
      <ref url="http://www.securitytracker.com/id/1029571" source="SECTRACK">1029571</ref>
      <ref url="http://www.securityfocus.com/bid/64690" source="BID">64690</ref>
      <ref url="http://tools.cisco.com/security/center/viewAlert.x?alertId=32341" source="CONFIRM" adv="1">http://tools.cisco.com/security/center/viewAlert.x?alertId=32341</ref>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0657" source="CISCO" adv="1">20140107 Cisco Unified Communications Manager Role Bypass Vulnerability</ref>
      <ref url="http://secunia.com/advisories/56368" source="SECUNIA">56368</ref>
      <ref url="http://osvdb.org/101800" source="OSVDB">101800</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="unified_communications_manager">
        <vers num="3.3(5)"/>
        <vers num="3.3(5)sr1"/>
        <vers num="3.3(5)sr2a"/>
        <vers num="4.1(3)"/>
        <vers num="4.1(3)sr1"/>
        <vers num="4.1(3)sr2"/>
        <vers num="4.1(3)sr3"/>
        <vers num="4.1(3)sr4"/>
        <vers num="4.2"/>
        <vers num="4.2.1"/>
        <vers num="4.2.2"/>
        <vers num="4.2.3"/>
        <vers num="4.2.3sr1"/>
        <vers num="4.2.3sr2"/>
        <vers num="4.2.3sr2b"/>
        <vers num="4.3"/>
        <vers num="4.3(1)"/>
        <vers num="5.0"/>
        <vers num="5.1"/>
        <vers num="5.1(1)"/>
        <vers num="5.1(1b)"/>
        <vers num="5.1(1c)"/>
        <vers num="5.1(2)"/>
        <vers num="5.1(2a)"/>
        <vers num="5.1(2b)"/>
        <vers num="5.1(3)"/>
        <vers num="5.1(3a)"/>
        <vers num="5.1(3c)"/>
        <vers num="5.1(3d)"/>
        <vers num="5.1(3e)"/>
        <vers num="5.1.2"/>
        <vers num="6.0"/>
        <vers num="6.0(1)"/>
        <vers num="6.0(1a)"/>
        <vers num="6.0(1b)"/>
        <vers num="6.1(1)"/>
        <vers num="6.1(1a)"/>
        <vers num="6.1(1b)"/>
        <vers num="6.1(2)"/>
        <vers num="6.1(2)su1"/>
        <vers num="6.1(2)su1a"/>
        <vers num="6.1(3)"/>
        <vers num="6.1(3a)"/>
        <vers num="6.1(3b)"/>
        <vers num="6.1(3b)su1"/>
        <vers num="6.1(4)"/>
        <vers num="6.1(4)su1"/>
        <vers num="6.1(4a)"/>
        <vers num="6.1(4a)su2"/>
        <vers num="6.1(5)"/>
        <vers num="6.1(5)su1"/>
        <vers num="6.1(5)su2"/>
        <vers num="6.1(5)su3"/>
        <vers num="7.0(1)su1"/>
        <vers num="7.0(1)su1a"/>
        <vers num="7.0(2)"/>
        <vers num="7.0(2a)"/>
        <vers num="7.0(2a)su1"/>
        <vers num="7.0(2a)su2"/>
        <vers num="7.1(2a)"/>
        <vers num="7.1(2a)su1"/>
        <vers num="7.1(2b)"/>
        <vers num="7.1(2b)su1"/>
        <vers num="7.1(3)"/>
        <vers num="7.1(3a)"/>
        <vers num="7.1(3a)su1"/>
        <vers num="7.1(3a)su1a"/>
        <vers num="7.1(3b)"/>
        <vers num="7.1(3b)su1"/>
        <vers num="7.1(3b)su2"/>
        <vers num="7.1(5)"/>
        <vers num="7.1(5)su1"/>
        <vers num="7.1(5)su1a"/>
        <vers num="7.1(5a)"/>
        <vers num="7.1(5b)"/>
        <vers num="7.1(5b)su1"/>
        <vers num="7.1(5b)su1a"/>
        <vers num="7.1(5b)su2"/>
        <vers num="7.1(5b)su3"/>
        <vers num="7.1(5b)su4"/>
        <vers num="7.1(5b)su5"/>
        <vers num="7.1(5b)su6"/>
        <vers num="8.0"/>
        <vers num="8.0(1)"/>
        <vers num="8.0(2)"/>
        <vers num="8.0(2a)"/>
        <vers num="8.0(2b)"/>
        <vers num="8.0(2c)"/>
        <vers num="8.0(2c)su1"/>
        <vers num="8.0(3)"/>
        <vers num="8.0(3a)"/>
        <vers num="8.0(3a)su1"/>
        <vers num="8.0(3a)su2"/>
        <vers num="8.0(3a)su3"/>
        <vers num="8.5"/>
        <vers num="8.5(1)"/>
        <vers num="8.5(1)su1"/>
        <vers num="8.5(1)su2"/>
        <vers num="8.5(1)su3"/>
        <vers num="8.5(1)su4"/>
        <vers num="8.5(1)su5"/>
        <vers num="8.6"/>
        <vers num="8.6(1)"/>
        <vers num="8.6(1a)"/>
        <vers num="8.6(2)"/>
        <vers num="8.6(2a)"/>
        <vers num="8.6(2a)su1"/>
        <vers num="8.6(2a)su2"/>
        <vers num="8.6(2a)su3"/>
        <vers num="8.6(3)"/>
        <vers num="8.6(4)"/>
        <vers num="9.0(1)"/>
        <vers prev="1" num="9.1(1)"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0658" published="2014-01-10" name="CVE-2014-0658" modified="2014-01-17" CVSS_version="2.0" CVSS_vector="(AV:N/AC:H/Au:N/C:N/I:N/A:C)" CVSS_score="5.4" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="4.9" CVSS_base_score="5.4">
    <desc>
      <descript source="cve">Cisco 9900 Unified IP phones allow remote attackers to cause a denial of service (unregistration) via a crafted SIP header, aka Bug ID CSCul24898.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90236" source="XF">cisco-unified-cve20140658-dos(90236)</ref>
      <ref url="http://www.securitytracker.com/id/1029596" source="SECTRACK">1029596</ref>
      <ref url="http://www.securityfocus.com/bid/64770" source="BID">64770</ref>
      <ref url="http://tools.cisco.com/security/center/viewAlert.x?alertId=32402" source="CONFIRM">http://tools.cisco.com/security/center/viewAlert.x?alertId=32402</ref>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0658" source="CISCO" adv="1">20140110 Cisco 9900 Series IP Phone Crafted Header Unregister Vulnerability</ref>
      <ref url="http://secunia.com/advisories/56384" source="SECUNIA">56384</ref>
      <ref url="http://osvdb.org/101913" source="OSVDB">101913</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="unified_ip_phone_9951">
        <vers num=""/>
      </prod>
      <prod vendor="cisco" name="unified_ip_phone_9971">
        <vers num=""/>
      </prod>
      <prod vendor="cisco" name="unified_ip_phones_9900_series_firmware">
        <vers num="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0659" published="2014-01-12" name="CVE-2014-0659" modified="2014-01-17" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:C/I:C/A:C)" CVSS_score="10.0" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="10.0" CVSS_base_score="10.0">
    <desc>
      <descript source="cve">The Cisco WAP4410N access point with firmware through 2.0.6.1, WRVS4400N router with firmware 1.x through 1.1.13 and 2.x through 2.0.2.1, and RVS4000 router with firmware through 2.0.3.2 allow remote attackers to read credential and configuration data, and execute arbitrary commands, via requests to the test interface on TCP port 32764, aka Bug IDs CSCum37566, CSCum43693, CSCum43700, and CSCum43685.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://github.com/elvanderb/TCP-32764" source="MISC">https://github.com/elvanderb/TCP-32764</ref>
      <ref url="http://xforce.iss.net/xforce/xfdb/90233" source="XF">cisco-small-cve20140659-priv-esc(90233)</ref>
      <ref url="http://www.securitytracker.com/id/1029580" source="SECTRACK">1029580</ref>
      <ref url="http://www.securitytracker.com/id/1029579" source="SECTRACK">1029579</ref>
      <ref url="http://www.securityfocus.com/bid/64776" source="BID">64776</ref>
      <ref url="http://tools.cisco.com/security/center/viewAlert.x?alertId=32381" source="CONFIRM">http://tools.cisco.com/security/center/viewAlert.x?alertId=32381</ref>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140110-sbd" source="CISCO" adv="1">20140110 Undocumented Test Interface in Cisco Small Business Devices</ref>
      <ref url="http://secunia.com/advisories/56292" source="SECUNIA">56292</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="rvs4000">
        <vers num="-"/>
      </prod>
      <prod vendor="cisco" name="wap4410n">
        <vers num="-"/>
      </prod>
      <prod vendor="cisco" name="wrvs4400n">
        <vers num="-"/>
      </prod>
      <prod vendor="cisco" name="rvs4000_firmware">
        <vers num="1.3.2.0"/>
        <vers num="1.3.3.5"/>
        <vers num="2.0.0.3"/>
        <vers num="2.0.2.7"/>
        <vers prev="1" num="2.0.3.2"/>
      </prod>
      <prod vendor="cisco" name="wap4410n_firmware">
        <vers num="2.0.2.1"/>
        <vers num="2.0.3.3"/>
        <vers num="2.0.4.2"/>
        <vers prev="1" num="2.0.6.1"/>
      </prod>
      <prod vendor="cisco" name="wrvs4400n_firmware">
        <vers num="1.1.03"/>
        <vers num="1.1.13"/>
        <vers num="2.0.1.3"/>
        <vers num="2.0.2.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0660" published="2014-01-22" name="CVE-2014-0660" modified="2014-01-31" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:N/A:C)" CVSS_score="7.1" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="8.6" CVSS_base_score="7.1">
    <desc>
      <descript source="cve">Cisco TelePresence ISDN Gateway with software before 2.2(1.92) allows remote attackers to cause a denial of service (D-channel call outage) via a crafted Q.931 STATUS message, aka Bug ID CSCui50360.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90622" source="XF">cisco-isdn-cve20140660-dos(90622)</ref>
      <ref url="http://www.securitytracker.com/id/1029657" source="SECTRACK">1029657</ref>
      <ref url="http://www.securityfocus.com/bid/65072" source="BID">65072</ref>
      <ref url="http://tools.cisco.com/security/center/viewAlert.x?alertId=32460" source="CONFIRM">http://tools.cisco.com/security/center/viewAlert.x?alertId=32460</ref>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140122-isdngw" source="CISCO" adv="1">20140122 Cisco TelePresence ISDN Gateway D-Channel Denial of Service Vulnerability</ref>
      <ref url="http://secunia.com/advisories/56591" source="SECUNIA">56591</ref>
      <ref url="http://osvdb.org/102361" source="OSVDB">102361</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="telepresence_isdn_gateway_software">
        <vers num="2.1(1.43)"/>
        <vers num="2.1(1.49)"/>
        <vers num="2.1(1.56)"/>
        <vers prev="1" num="2.1(1.79)"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0661" published="2014-01-22" name="CVE-2014-0661" modified="2014-01-31" CVSS_version="2.0" CVSS_vector="(AV:A/AC:L/Au:N/C:C/I:C/A:C)" CVSS_score="8.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="6.5" CVSS_base_score="8.3">
    <desc>
      <descript source="cve">The System Status Collection Daemon (SSCD) in Cisco TelePresence System 500-37, 1000, 1300-65, and 3xxx before 1.10.2(42), and 500-32, 1300-47, TX1310 65, and TX9xxx before 6.0.4(11), allows remote attackers to execute arbitrary commands or cause a denial of service (stack memory corruption) via a crafted XML-RPC message, aka Bug ID CSCui32796.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <local_network/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90624" source="XF">cisco-telepresence-cve20140661-command-exec(90624)</ref>
      <ref url="http://www.securitytracker.com/id/1029656" source="SECTRACK">1029656</ref>
      <ref url="http://www.securityfocus.com/bid/65071" source="BID">65071</ref>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140122-cts" source="CISCO" adv="1">20140122 Cisco TelePresence System Software Command Execution Vulnerability</ref>
      <ref url="http://secunia.com/advisories/56533" source="SECUNIA">56533</ref>
      <ref url="http://osvdb.org/102362" source="OSVDB">102362</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="telepresence_system_software">
        <vers num="1.10.0"/>
        <vers num="1.10.0(259)"/>
        <vers num="1.10.1"/>
        <vers prev="1" num="1.10.1(43)"/>
        <vers num="1.5.10(3648)"/>
        <vers num="1.7.5(42)"/>
        <vers num="1.7.6(4)"/>
        <vers num="1.8.0(55)"/>
        <vers num="1.8.1(34)"/>
        <vers num="1.8.2(11)"/>
        <vers num="1.8.3(4)"/>
        <vers num="1.8.4(13)"/>
        <vers num="1.8.5(4)"/>
        <vers num="1.9.0(46)"/>
        <vers num="1.9.1(68)"/>
        <vers num="1.9.2(19)"/>
        <vers num="1.9.3(44)"/>
        <vers num="1.9.4(19)"/>
        <vers num="1.9.5(7)"/>
        <vers num="1.9.6(2)"/>
        <vers num="1.9.6.1(3)"/>
        <vers num="6.0.0.1(4)"/>
        <vers num="6.0.1(50)"/>
        <vers num="6.0.2(28)"/>
        <vers prev="1" num="6.0.3(33)"/>
        <vers num="6.1.0(90)"/>
      </prod>
      <prod vendor="cisco" name="telepresence_system_1000">
        <vers num="-"/>
      </prod>
      <prod vendor="cisco" name="telepresence_system_1100">
        <vers num="-"/>
      </prod>
      <prod vendor="cisco" name="telepresence_system_1300-65">
        <vers num="-"/>
      </prod>
      <prod vendor="cisco" name="telepresence_system_3000">
        <vers num=""/>
      </prod>
      <prod vendor="cisco" name="telepresence_system_3010">
        <vers num=""/>
      </prod>
      <prod vendor="cisco" name="telepresence_system_3200">
        <vers num=""/>
      </prod>
      <prod vendor="cisco" name="telepresence_system_3210">
        <vers num=""/>
      </prod>
      <prod vendor="cisco" name="telepresence_system_500-32">
        <vers num="-"/>
      </prod>
      <prod vendor="cisco" name="telepresence_system_500-37">
        <vers num="-"/>
      </prod>
      <prod vendor="cisco" name="telepresence_system_tx1300_47">
        <vers num=""/>
      </prod>
      <prod vendor="cisco" name="telepresence_system_tx1310_65">
        <vers num=""/>
      </prod>
      <prod vendor="cisco" name="telepresence_system_tx9000">
        <vers num=""/>
      </prod>
      <prod vendor="cisco" name="telepresence_system_tx9200">
        <vers num=""/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0662" published="2014-01-22" name="CVE-2014-0662" modified="2014-01-31" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:N/A:C)" CVSS_score="7.1" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="8.6" CVSS_base_score="7.1">
    <desc>
      <descript source="cve">The SIP module in Cisco TelePresence Video Communication Server (VCS) before 8.1 allows remote attackers to cause a denial of service (process failure) via a crafted SDP message, aka Bug ID CSCue97632.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90621" source="XF">cisco-vcs-cve20140662-dos(90621)</ref>
      <ref url="http://www.securitytracker.com/id/1029655" source="SECTRACK">1029655</ref>
      <ref url="http://www.securityfocus.com/bid/65076" source="BID">65076</ref>
      <ref url="http://tools.cisco.com/security/center/viewAMBAlert.x?alertId=32409" source="CONFIRM">http://tools.cisco.com/security/center/viewAMBAlert.x?alertId=32409</ref>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140122-vcs" source="CISCO" adv="1">20140122 Cisco TelePresence Video Communication Server SIP Denial of Service Vulnerability</ref>
      <ref url="http://secunia.com/advisories/56592" source="SECUNIA">56592</ref>
      <ref url="http://osvdb.org/102363" source="OSVDB">102363</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="telepresence_video_communication_servers_software">
        <vers num="x6"/>
        <vers num="x6.1"/>
        <vers num="x7.0"/>
        <vers num="x7.0.1"/>
        <vers num="x7.0.2"/>
        <vers num="x7.0.3"/>
        <vers num="x7.1"/>
        <vers num="x7.2"/>
        <vers num="x7.2.1"/>
        <vers prev="1" num="x7.2.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0663" published="2014-01-10" name="CVE-2014-0663" modified="2014-01-17" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in the web framework in Cisco Secure Access Control System (ACS) allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCum03625.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90232" source="XF">cisco-acs-cve20140663-xss(90232)</ref>
      <ref url="http://www.securitytracker.com/id/1029595" source="SECTRACK">1029595</ref>
      <ref url="http://www.securityfocus.com/bid/64773" source="BID">64773</ref>
      <ref url="http://tools.cisco.com/security/center/viewAlert.x?alertId=32403" source="CONFIRM">http://tools.cisco.com/security/center/viewAlert.x?alertId=32403</ref>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0663" source="CISCO" adv="1">20140110 Cisco Secure Access Control System Cross-Site Scripting Vulnerability</ref>
      <ref url="http://secunia.com/advisories/56382" source="SECUNIA">56382</ref>
      <ref url="http://osvdb.org/101914" source="OSVDB">101914</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="secure_access_control_system">
        <vers num="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0664" published="2014-01-10" name="CVE-2014-0664" modified="2014-04-04" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:N/I:N/A:C)" CVSS_score="6.8" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="8.0" CVSS_base_score="6.8">
    <desc>
      <descript source="cve">The server in Cisco Unity Connection allows remote authenticated users to cause a denial of service (CPU consumption) via unspecified IMAP commands, aka Bug ID CSCul49976.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90234" source="XF">cisco-unity-cve20140664-dos(90234)</ref>
      <ref url="http://www.securitytracker.com/id/1029593" source="SECTRACK">1029593</ref>
      <ref url="http://www.securityfocus.com/bid/64772" source="BID">64772</ref>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0664" source="CISCO" adv="1">20140110 Cisco Unity Connection Internet Message Access Protocol Denial of Service Vulnerability</ref>
      <ref url="http://secunia.com/advisories/56370" source="SECUNIA">56370</ref>
      <ref url="http://osvdb.org/101915" source="OSVDB">101915</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="unity_connection">
        <vers num="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0665" published="2014-01-15" name="CVE-2014-0665" modified="2014-01-23" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:P/I:N/A:N)" CVSS_score="4.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.0" CVSS_base_score="4.0">
    <desc>
      <descript source="cve">The RBAC implementation in Cisco Identity Services Engine (ISE) Software does not properly verify privileges for support-bundle downloads, which allows remote authenticated users to obtain sensitive information via a download action, as demonstrated by obtaining read access to the user database, aka Bug ID CSCul83904.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90463" source="XF">cisco-ise-cve2040665-unsuth-access(90463)</ref>
      <ref url="http://www.securitytracker.com/id/1029624" source="SECTRACK">1029624</ref>
      <ref url="http://www.securityfocus.com/bid/64939" source="BID">64939</ref>
      <ref url="http://tools.cisco.com/security/center/viewAlert.x?alertId=32448" source="CONFIRM">http://tools.cisco.com/security/center/viewAlert.x?alertId=32448</ref>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0665" source="CISCO" adv="1">20140115 Cisco ISE Unprivileged Support Bundle Download Vulnerability</ref>
      <ref url="http://secunia.com/advisories/56439" source="SECUNIA">56439</ref>
      <ref url="http://osvdb.org/102118" source="OSVDB">102118</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="identity_services_engine_software">
        <vers num="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0666" published="2014-01-16" name="CVE-2014-0666" modified="2014-01-23" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Directory traversal vulnerability in the Send Screen Capture implementation in Cisco Jabber 9.2(.1) and earlier on Windows allows remote attackers to upload arbitrary types of files, and consequently execute arbitrary code, via modified packets, aka Bug ID CSCug48056.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90435" source="XF">cisco-jabber-cve20140666-code-exec(90435)</ref>
      <ref url="http://www.securitytracker.com/id/1029635" source="SECTRACK">1029635</ref>
      <ref url="http://www.securityfocus.com/bid/64965" source="BID">64965</ref>
      <ref url="http://tools.cisco.com/security/center/viewAlert.x?alertId=32451" source="CONFIRM" adv="1">http://tools.cisco.com/security/center/viewAlert.x?alertId=32451</ref>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0666" source="CISCO" adv="1">20140115 Cisco Jabber for Windows Remote Code Execution Vulnerability</ref>
      <ref url="http://secunia.com/advisories/56331" source="SECUNIA">56331</ref>
      <ref url="http://osvdb.org/102122" source="OSVDB">102122</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="jabber">
        <vers num="9.0" edition="-:~-~-~windows~~"/>
        <vers num="9.0(.0)" edition="-:~-~-~windows~~"/>
        <vers num="9.0(.1)" edition="-:~-~-~windows~~"/>
        <vers num="9.0(.2)" edition="-:~-~-~windows~~"/>
        <vers num="9.0(.3)" edition="-:~-~-~windows~~"/>
        <vers num="9.0(.4)" edition="-:~-~-~windows~~"/>
        <vers num="9.0(.5)" edition="-:~-~-~windows~~"/>
        <vers num="9.1" edition="-:~-~-~windows~~"/>
        <vers num="9.1(.0)" edition="-:~-~-~windows~~"/>
        <vers num="9.1(.1)" edition="-:~-~-~windows~~"/>
        <vers num="9.1(.2)" edition="-:~-~-~windows~~"/>
        <vers num="9.1(.3)" edition="-:~-~-~windows~~"/>
        <vers num="9.1(.4)" edition="-:~-~-~windows~~"/>
        <vers num="9.1(.5)" edition="-:~-~-~windows~~"/>
        <vers num="9.2" edition="-:~-~-~windows~~"/>
        <vers num="9.2(.0)" edition="-:~-~-~windows~~"/>
        <vers prev="1" num="9.2(.1)" edition="-:~-~-~windows~~"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0667" published="2014-01-16" name="CVE-2014-0667" modified="2014-01-23" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:S/C:C/I:N/A:N)" CVSS_score="6.3" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="6.8" CVSS_base_score="6.3">
    <desc>
      <descript source="cve">The RMI interface in Cisco Secure Access Control System (ACS) does not properly enforce authorization requirements, which allows remote authenticated users to read arbitrary files via a request to this interface, aka Bug ID CSCud75169.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90497" source="XF">cisco-acs-cve20140667-info-disc(90497)</ref>
      <ref url="http://www.securitytracker.com/id/1029641" source="SECTRACK">1029641</ref>
      <ref url="http://www.securityfocus.com/bid/64983" source="BID">64983</ref>
      <ref url="http://tools.cisco.com/security/center/viewAlert.x?alertId=32468" source="CONFIRM">http://tools.cisco.com/security/center/viewAlert.x?alertId=32468</ref>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0667" source="CISCO" adv="1">20140116 Cisco Secure ACS RMI Arbitrary File Read Vulnerability</ref>
      <ref url="http://osvdb.org/102168" source="OSVDB">102168</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="secure_access_control_system">
        <vers num="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0668" published="2014-01-19" name="CVE-2014-0668" modified="2014-01-31" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in the portal in Cisco Secure Access Control System (ACS) allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCue65949.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90561" source="XF">cisco-acs-cve20140668-xss(90561)</ref>
      <ref url="http://www.securitytracker.com/id/1029654" source="SECTRACK">1029654</ref>
      <ref url="http://www.securityfocus.com/bid/65016" source="BID">65016</ref>
      <ref url="http://tools.cisco.com/security/center/viewAlert.x?alertId=32489" source="CONFIRM">http://tools.cisco.com/security/center/viewAlert.x?alertId=32489</ref>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0668" source="CISCO" adv="1">20140117 Cisco Secure ACS Portal Cross-Site Scripting Vulnerability</ref>
      <ref url="http://secunia.com/advisories/56543" source="SECUNIA">56543</ref>
      <ref url="http://osvdb.org/102256" source="OSVDB">102256</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="secure_access_control_system">
        <vers num="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0669" published="2014-01-22" name="CVE-2014-0669" modified="2014-01-31" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:P/A:N)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">The Wireless Session Protocol (WSP) feature in the Gateway GPRS Support Node (GGSN) component on Cisco ASR 5000 series devices allows remote attackers to bypass intended Top-Up payment restrictions via unspecified WSP packets, aka Bug ID CSCuh28371.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90614" source="XF">cisco-ggsn-cve20140669-sec-bypass(90614)</ref>
      <ref url="http://www.securitytracker.com/id/1029666" source="SECTRACK">1029666</ref>
      <ref url="http://www.securityfocus.com/bid/65052" source="BID">65052</ref>
      <ref url="http://tools.cisco.com/security/center/viewAlert.x?alertId=32513" source="CONFIRM">http://tools.cisco.com/security/center/viewAlert.x?alertId=32513</ref>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0669" source="CISCO" adv="1">20140121 Cisco ASR 5000 Series Gateway GPRS Support Node Traffic Bypass Vulnerability</ref>
      <ref url="http://secunia.com/advisories/56546" source="SECUNIA">56546</ref>
      <ref url="http://osvdb.org/102318" source="OSVDB">102318</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="asr_5000_series_software">
        <vers num="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0670" published="2014-01-22" name="CVE-2014-0670" modified="2014-01-31" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in the Search and Play interface in Cisco MediaSense allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCum16686.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90615" source="XF">cisco-mediasense-cve20140670-xss(90615)</ref>
      <ref url="http://www.securitytracker.com/id/1029667" source="SECTRACK">1029667</ref>
      <ref url="http://www.securityfocus.com/bid/65053" source="BID">65053</ref>
      <ref url="http://tools.cisco.com/security/center/viewAlert.x?alertId=32514" source="CONFIRM">http://tools.cisco.com/security/center/viewAlert.x?alertId=32514</ref>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0670" source="CISCO" adv="1">20140121 Cisco MediaSense Search and Play Cross-Site Scripting Vulnerability</ref>
      <ref url="http://secunia.com/advisories/56563" source="SECUNIA">56563</ref>
      <ref url="http://osvdb.org/102319" source="OSVDB">102319</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="mediasense">
        <vers num="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0671" published="2014-01-22" name="CVE-2014-0671" modified="2014-01-31" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:N)" CVSS_score="5.8" CVSS_impact_subscore="4.9" CVSS_exploit_subscore="8.6" CVSS_base_score="5.8">
    <desc>
      <descript source="cve">Open redirect vulnerability in Cisco MediaSense allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via an unspecified parameter, aka Bug ID CSCum16749.</descript>
    </desc>
    <loss_types>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90617" source="XF">cisco-mediasense-cve20140671-open-redirect(90617)</ref>
      <ref url="http://www.securitytracker.com/id/1029669" source="SECTRACK">1029669</ref>
      <ref url="http://www.securityfocus.com/bid/65055" source="BID">65055</ref>
      <ref url="http://tools.cisco.com/security/center/viewAlert.x?alertId=32517" source="CONFIRM">http://tools.cisco.com/security/center/viewAlert.x?alertId=32517</ref>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0671" source="CISCO" adv="1">20140121 Cisco MediaSense Open Redirection Vulnerability</ref>
      <ref url="http://secunia.com/advisories/56544" source="SECUNIA">56544</ref>
      <ref url="http://osvdb.org/102341" source="OSVDB">102341</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="mediasense">
        <vers num="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0672" published="2014-01-22" name="CVE-2014-0672" modified="2014-04-04" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:P/I:N/A:N)" CVSS_score="4.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.0" CVSS_base_score="4.0">
    <desc>
      <descript source="cve">The Search and Play interface in Cisco MediaSense does not properly enforce authorization requirements, which allows remote authenticated users to download arbitrary recordings via a request to this interface.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90616" source="XF">cisco-mediasense-cve20140672-info-disc(90616)</ref>
      <ref url="http://www.securitytracker.com/id/1029668" source="SECTRACK">1029668</ref>
      <ref url="http://www.securityfocus.com/bid/65054" source="BID">65054</ref>
      <ref url="http://tools.cisco.com/security/center/viewAlert.x?alertId=32516" source="CONFIRM">http://tools.cisco.com/security/center/viewAlert.x?alertId=32516</ref>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0672" source="CISCO" adv="1">20140121 Cisco MediaSense Search and Play Authorization Vulnerability</ref>
      <ref url="http://secunia.com/advisories/56600" source="SECUNIA">56600</ref>
      <ref url="http://osvdb.org/102342" source="OSVDB">102342</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="mediasense">
        <vers num="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0673" published="2014-01-25" name="CVE-2014-0673" modified="2014-04-22" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Multiple cross-site scripting (XSS) vulnerabilities in the web interface on Cisco Video Surveillance 5000 HD IP Dome cameras allow remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug IDs CSCud10943 and CSCud10950.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90733" source="XF">cisco-video-cve20140673-xss(90733)</ref>
      <ref url="http://www.securitytracker.com/id/1029689" source="SECTRACK">1029689</ref>
      <ref url="http://www.securityfocus.com/bid/65145" source="BID">65145</ref>
      <ref url="http://tools.cisco.com/security/center/viewAlert.x?alertId=32568" source="CONFIRM">http://tools.cisco.com/security/center/viewAlert.x?alertId=32568</ref>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0673" source="CISCO" adv="1">20140124 Cisco Video Surveillance 5000 Series HD IP Dome Camera Multiple Cross-Site Scripting Vulnerabilities</ref>
      <ref url="http://secunia.com/advisories/56552" source="SECUNIA">56552</ref>
      <ref url="http://osvdb.org/102557" source="OSVDB">102557</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="video_surveillance_indoor_fixed_dome_ip_hd_camera">
        <vers num="5010"/>
        <vers num="5011"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0674" published="2014-01-23" name="CVE-2014-0674" modified="2014-01-31" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:P)" CVSS_score="6.8" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.6" CVSS_base_score="6.8">
    <desc>
      <descript source="cve">Cisco Video Surveillance Operations Manager (VSOM) does not require authentication for MySQL database connections, which allows remote attackers to obtain sensitive information, modify data, or cause a denial of service by leveraging network connectivity from a client system with a crafted host name, aka Bug ID CSCud10992.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90651" source="XF">cisco-vsom-cve20140674-unauth-access(90651)</ref>
      <ref url="http://www.securitytracker.com/id/1029692" source="SECTRACK">1029692</ref>
      <ref url="http://www.securityfocus.com/bid/65111" source="BID">65111</ref>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0674" source="CISCO" adv="1">20140123 Cisco Video Surveillance Operations Manager MySQL Database Insufficient Authentication Controls</ref>
      <ref url="http://secunia.com/advisories/56619" source="SECUNIA">56619</ref>
      <ref url="http://osvdb.org/102409" source="OSVDB">102409</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="video_surveillance_operations_manager">
        <vers num="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0675" published="2014-01-22" name="CVE-2014-0675" modified="2014-01-30" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:N)" CVSS_score="6.4" CVSS_impact_subscore="4.9" CVSS_exploit_subscore="10.0" CVSS_base_score="6.4">
    <desc>
      <descript source="cve">The Expressway component in Cisco TelePresence Video Communication Server (VCS) uses the same default X.509 certificate across different customers' installations, which makes it easier for remote attackers to conduct man-in-the-middle attacks against SSL sessions by leveraging the certificate's trust relationship, aka Bug ID CSCue07471.</descript>
    </desc>
    <loss_types>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90650" source="XF">cisco-telepresence-cve20140675-mitm(90650)</ref>
      <ref url="http://www.securitytracker.com/id/1029682" source="SECTRACK">1029682</ref>
      <ref url="http://www.securityfocus.com/bid/65101" source="BID">65101</ref>
      <ref url="http://tools.cisco.com/security/center/viewAlert.x?alertId=32540" source="CONFIRM">http://tools.cisco.com/security/center/viewAlert.x?alertId=32540</ref>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0675" source="CISCO" adv="1">20140122 Cisco TelePresence Video Communication Server Expressway Default SSL Certificate Vulnerability</ref>
      <ref url="http://secunia.com/advisories/56621" source="SECUNIA">56621</ref>
      <ref url="http://osvdb.org/102377" source="OSVDB">102377</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="telepresence_video_communication_server">
        <vers num="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0676" published="2014-01-22" name="CVE-2014-0676" modified="2014-01-31" CVSS_version="2.0" CVSS_vector="(AV:L/AC:L/Au:S/C:C/I:C/A:C)" CVSS_score="6.8" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="3.1" CVSS_base_score="6.8">
    <desc>
      <descript source="cve">Cisco NX-OS allows local users to bypass intended TACACS+ command restrictions via a series of multiple commands, aka Bug ID CSCum47367.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90627" source="XF">cisco-nxos-cve20140676-priv-esc(90627)</ref>
      <ref url="http://www.securitytracker.com/id/1029690" source="SECTRACK">1029690</ref>
      <ref url="http://www.securityfocus.com/bid/65083" source="BID">65083</ref>
      <ref url="http://tools.cisco.com/security/center/viewAlert.x?alertId=32531" source="CONFIRM">http://tools.cisco.com/security/center/viewAlert.x?alertId=32531</ref>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0676" source="CISCO" adv="1">20140122 Cisco NX-OS Software TACACS+ Command Authorization Vulnerability</ref>
      <ref url="http://secunia.com/advisories/56597" source="SECUNIA">56597</ref>
      <ref url="http://osvdb.org/102366" source="OSVDB">102366</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="nx-os">
        <vers num="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0677" published="2014-01-22" name="CVE-2014-0677" modified="2014-01-31" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:P)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">The Label Distribution Protocol (LDP) functionality in Cisco NX-OS allows remote attackers to cause a denial of service (temporary LDP session outage) via LDP discovery traffic containing malformed Hello messages, aka Bug ID CSCul88851.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90623" source="XF">cisco-nxos-cve20140677-dos(90623)</ref>
      <ref url="http://www.securitytracker.com/id/1029691" source="SECTRACK">1029691</ref>
      <ref url="http://www.securityfocus.com/bid/65074" source="BID">65074</ref>
      <ref url="http://tools.cisco.com/security/center/viewAlert.x?alertId=32532" source="CONFIRM">http://tools.cisco.com/security/center/viewAlert.x?alertId=32532</ref>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0677" source="CISCO" adv="1">20140122 Cisco NX-OS Software Label Distribution Protocol Message Vulnerability</ref>
      <ref url="http://secunia.com/advisories/56611" source="SECUNIA">56611</ref>
      <ref url="http://osvdb.org/102368" source="OSVDB">102368</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="nx-os">
        <vers num="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0678" published="2014-01-25" name="CVE-2014-0678" modified="2014-02-06" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:P/I:P/A:N)" CVSS_score="5.5" CVSS_impact_subscore="4.9" CVSS_exploit_subscore="8.0" CVSS_base_score="5.5">
    <desc>
      <descript source="cve">The portal interface in Cisco Secure Access Control System (ACS) does not properly manage sessions, which allows remote authenticated users to hijack sessions and gain privileges via unspecified vectors, aka Bug ID CSCue65951.</descript>
    </desc>
    <loss_types>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90732" source="XF">cisco-acs-cve20140678-unauth-access(90732)</ref>
      <ref url="http://www.securitytracker.com/id/1029688" source="SECTRACK">1029688</ref>
      <ref url="http://www.securityfocus.com/bid/65144" source="BID">65144</ref>
      <ref url="http://tools.cisco.com/security/center/viewAlert.x?alertId=32567" source="CONFIRM">http://tools.cisco.com/security/center/viewAlert.x?alertId=32567</ref>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0678" source="CISCO" adv="1">20140124 Cisco Secure ACS Portal Session Management Vulnerability</ref>
      <ref url="http://secunia.com/advisories/56540" source="SECUNIA">56540</ref>
      <ref url="http://osvdb.org/102558" source="OSVDB">102558</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="secure_access_control_system">
        <vers num="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0679" published="2014-02-27" name="CVE-2014-0679" modified="2014-02-28" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:C/I:C/A:C)" CVSS_score="9.0" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.0" CVSS_base_score="9.0">
    <desc>
      <descript source="cve">Cisco Prime Infrastructure 1.2 and 1.3 before 1.3.0.20-2, 1.4 before 1.4.0.45-2, and 2.0 before 2.0.0.0.294-2 allows remote authenticated users to execute arbitrary commands with root privileges via an unspecified URL, aka Bug ID CSCum71308.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140226-pi" source="CISCO" adv="1">20140226 Cisco Prime Infrastructure Command Execution Vulnerability</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="prime_infrastructure">
        <vers num="1.2.0"/>
        <vers num="1.2.1"/>
        <vers num="1.3.0"/>
        <vers num="1.4.0"/>
        <vers num="1.4.1"/>
        <vers num="2.0.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0680" published="2014-01-29" name="CVE-2014-0680" modified="2014-02-06" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in the HTTP control interface in the NAC Web Agent component in Cisco Identity Services Engine (ISE) allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCui15038.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/viewAlert.x?alertId=32617" source="CONFIRM">http://tools.cisco.com/security/center/viewAlert.x?alertId=32617</ref>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0680" source="CISCO" adv="1">20140128 Cisco Identity Services Engine HTTP Control Interface for NAC Web Agent Cross-Site Scripting Vulnerability</ref>
      <ref url="http://secunia.com/advisories/56672" source="SECUNIA">56672</ref>
      <ref url="http://osvdb.org/102588" source="OSVDB">102588</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="identity_services_engine">
        <vers num="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0681" published="2014-01-29" name="CVE-2014-0681" modified="2014-02-06" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in Cisco Identity Services Engine (ISE) 1.2 patch 2 and earlier allows remote attackers to inject arbitrary web script or HTML via a report containing a crafted URL that is not properly handled during generation of report-output pages, aka Bug ID CSCui15064.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://www.securityfocus.com/bid/65183" source="BID">65183</ref>
      <ref url="http://tools.cisco.com/security/center/viewAlert.x?alertId=32609" source="CONFIRM" adv="1">http://tools.cisco.com/security/center/viewAlert.x?alertId=32609</ref>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0681" source="CISCO" adv="1">20140128 Cisco Identity Services Engine Reports Output Cross-Site Scripting Vulnerability</ref>
      <ref url="http://secunia.com/advisories/56714" source="SECUNIA">56714</ref>
      <ref url="http://osvdb.org/102589" source="OSVDB">102589</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="identity_services_engine_software">
        <vers prev="1" num="1.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0682" published="2014-01-29" name="CVE-2014-0682" modified="2014-02-06" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:S/C:P/I:N/A:P)" CVSS_score="4.9" CVSS_impact_subscore="4.9" CVSS_exploit_subscore="6.8" CVSS_base_score="4.9">
    <desc>
      <descript source="cve">Cisco WebEx Meetings Server allows remote authenticated users to bypass authorization checks and (1) join arbitrary meetings, or (2) terminate a meeting without having a host role, via a crafted URL, aka Bug ID CSCuj42346.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.securityfocus.com/bid/65198" source="BID">65198</ref>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0682" source="CISCO" adv="1">20140128 Cisco WebEx Meetings Server Unauthorized Meeting Actions Vulnerability</ref>
      <ref url="http://osvdb.org/102590" source="OSVDB">102590</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="webex_meetings_server">
        <vers num="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0683" published="2014-03-06" name="CVE-2014-0683" modified="2014-03-07" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:C/I:C/A:C)" CVSS_score="10.0" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="10.0" CVSS_base_score="10.0">
    <desc>
      <descript source="cve">The web management interface on the Cisco RV110W firewall with firmware 1.2.0.9 and earlier, RV215W router with firmware 1.1.0.5 and earlier, and CVR100W router with firmware 1.0.1.19 and earlier does not prevent replaying of modified authentication requests, which allows remote attackers to obtain administrative access by leveraging the ability to intercept requests, aka Bug IDs CSCul94527, CSCum86264, and CSCum86275.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140305-rpd" source="CISCO" patch="1" adv="1">20140305 Cisco Small Business Router Password Disclosure Vulnerability</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="cvr100w">
        <vers num="-"/>
      </prod>
      <prod vendor="cisco" name="rv110w">
        <vers num="-"/>
      </prod>
      <prod vendor="cisco" name="rv215w">
        <vers num="-"/>
      </prod>
      <prod vendor="cisco" name="cvr100w_firmware">
        <vers prev="1" num="1.0.1.19"/>
      </prod>
      <prod vendor="cisco" name="rv110w_firmware">
        <vers prev="1" num="1.2.0.9"/>
      </prod>
      <prod vendor="cisco" name="rv215w_firmware">
        <vers prev="1" num="1.1.0.5"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0686" published="2014-02-04" name="CVE-2014-0686" modified="2014-02-24" CVSS_version="2.0" CVSS_vector="(AV:L/AC:H/Au:S/C:C/I:C/A:C)" CVSS_score="6.0" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="1.5" CVSS_base_score="6.0">
    <desc>
      <descript source="cve">Cisco Unified Communications Manager (aka Unified CM) 9.1 (2.10000.28) and earlier allows local users to gain privileges by leveraging incorrect file permissions, aka Bug IDs CSCul24917 and CSCul24908.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/viewAlert.x?alertId=32683" source="CONFIRM" adv="1">http://tools.cisco.com/security/center/viewAlert.x?alertId=32683</ref>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0686" source="CISCO" adv="1">20140131 Cisco Unified Communications Manager Operating System-Level Privilege Escalation Vulnerability</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="unified_communications_manager">
        <vers num="9.1(1)"/>
        <vers num="9.1(2)"/>
        <vers prev="1" num="9.1(2.10000.28)"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0694" published="2014-03-14" name="CVE-2014-0694" modified="2014-03-14" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:N/A:N)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">Intelligent Automation for Cloud (IAC) in Cisco Cloud Portal 9.4.1 and earlier includes a cryptographic key in binary files, which makes it easier for remote attackers to obtain cleartext data from an arbitrary IAC installation by leveraging knowledge of this key, aka Bug IDs CSCui34764, CSCui34772, CSCui34776, CSCui34798, CSCui34800, CSCui34805, CSCui34809, CSCui34810, CSCui34813, CSCui34814, and CSCui34818.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/viewAlert.x?alertId=33336" source="CONFIRM">http://tools.cisco.com/security/center/viewAlert.x?alertId=33336</ref>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0694" source="CISCO">20140312 Cisco Intelligent Automation for Cloud Cryptographic Implementation Issues</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="cloud_portal">
        <vers num="9.1" edition="sp1"/>
        <vers num="9.1" edition="sp2"/>
        <vers num="9.1" edition="sp3"/>
        <vers num="9.3"/>
        <vers num="9.3.1"/>
        <vers num="9.3.2"/>
        <vers num="9.4"/>
        <vers prev="1" num="9.4.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0701" published="2014-03-06" name="CVE-2014-0701" modified="2014-03-07" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:C)" CVSS_score="7.8" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="10.0" CVSS_base_score="7.8">
    <desc>
      <descript source="cve">Cisco Wireless LAN Controller (WLC) devices 7.0 before 7.0.250.0, 7.2, 7.3, and 7.4 before 7.4.110.0 do not properly deallocate memory, which allows remote attackers to cause a denial of service (reboot) by sending WebAuth login requests at a high rate, aka Bug ID CSCuf52361.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140305-wlc" source="CISCO" adv="1">20140305 Multiple Vulnerabilities in Cisco Wireless LAN Controllers</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="wireless_lan_controller_software">
        <vers num="7.0"/>
        <vers num="7.0.220.0"/>
        <vers num="7.0.235.0"/>
        <vers num="7.2"/>
        <vers num="7.2.103.0"/>
        <vers num="7.2.110.0"/>
        <vers num="7.3"/>
        <vers num="7.3.101.0"/>
        <vers num="7.4.100.0"/>
        <vers num="7.4.100.60"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0703" published="2014-03-06" name="CVE-2014-0703" modified="2014-03-07" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:C/I:C/A:C)" CVSS_score="10.0" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="10.0" CVSS_base_score="10.0">
    <desc>
      <descript source="cve">Cisco Wireless LAN Controller (WLC) devices 7.4 before 7.4.110.0 distribute Aironet IOS software with a race condition in the status of the administrative HTTP server, which allows remote attackers to bypass intended access restrictions by connecting to an Aironet access point on which this server had been disabled ineffectively, aka Bug ID CSCuf66202.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140305-wlc" source="CISCO" adv="1">20140305 Multiple Vulnerabilities in Cisco Wireless LAN Controllers</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="wireless_lan_controller">
        <vers num=""/>
      </prod>
      <prod vendor="cisco" name="wireless_lan_controller_software">
        <vers num="7.4.100.0"/>
        <vers num="7.4.100.60"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0704" published="2014-03-06" name="CVE-2014-0704" modified="2014-03-07" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:N/A:C)" CVSS_score="7.1" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="8.6" CVSS_base_score="7.1">
    <desc>
      <descript source="cve">The IGMP implementation on Cisco Wireless LAN Controller (WLC) devices 4.x, 5.x, 6.x, 7.0 before 7.0.250.0, 7.1, 7.2, and 7.3, when IGMPv3 Snooping is enabled, allows remote attackers to cause a denial of service (memory over-read and device restart) via a crafted field in an IGMPv3 message, aka Bug ID CSCuh33240.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140305-wlc" source="CISCO" adv="1">20140305 Multiple Vulnerabilities in Cisco Wireless LAN Controllers</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="wireless_lan_controller">
        <vers num=""/>
      </prod>
      <prod vendor="cisco" name="wireless_lan_controller_software">
        <vers num="4.0"/>
        <vers num="4.0.108"/>
        <vers num="4.0.155.0"/>
        <vers num="4.0.155.5"/>
        <vers num="4.0.179.11"/>
        <vers num="4.0.179.8"/>
        <vers num="4.0.196"/>
        <vers num="4.0.206.0"/>
        <vers num="4.0.217.0"/>
        <vers num="4.0.219.0"/>
        <vers num="4.1"/>
        <vers num="4.1.171.0"/>
        <vers num="4.1.181.0"/>
        <vers num="4.1.185.0"/>
        <vers num="4.1m"/>
        <vers num="4.2"/>
        <vers num="4.2.112.0"/>
        <vers num="4.2.117.0"/>
        <vers num="4.2.130.0"/>
        <vers num="4.2.173.0"/>
        <vers num="4.2.174.0"/>
        <vers num="4.2.176.0"/>
        <vers num="4.2.182.0"/>
        <vers num="4.2.61.0"/>
        <vers num="4.2.99.0"/>
        <vers num="4.2m"/>
        <vers num="5.0"/>
        <vers num="5.0.148.0"/>
        <vers num="5.0.148.2"/>
        <vers num="5.1"/>
        <vers num="5.1.151.0"/>
        <vers num="5.1.152.0"/>
        <vers num="5.1.160.0"/>
        <vers num="5.2"/>
        <vers num="5.2.157.0"/>
        <vers num="5.2.169.0"/>
        <vers num="6.0"/>
        <vers num="6.0.182.0"/>
        <vers num="6.0.188.0"/>
        <vers num="6.0.196.0"/>
        <vers num="6.0.199.0"/>
        <vers num="6.0.199.4"/>
        <vers num="7.0"/>
        <vers num="7.0.220.0"/>
        <vers num="7.0.235.0"/>
        <vers num="7.0.98.0"/>
        <vers num="7.1"/>
        <vers num="7.1.91.0"/>
        <vers num="7.2"/>
        <vers num="7.2.103.0"/>
        <vers num="7.2.110.0"/>
        <vers num="7.3"/>
        <vers num="7.3.101.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0705" published="2014-03-06" name="CVE-2014-0705" modified="2014-03-07" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:N/A:C)" CVSS_score="7.1" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="8.6" CVSS_base_score="7.1">
    <desc>
      <descript source="cve">The multicast listener discovery (MLD) service on Cisco Wireless LAN Controller (WLC) devices 7.2, 7.3, 7.4 before 7.4.121.0, and 7.5, when MLDv2 Snooping is enabled, allows remote attackers to cause a denial of service (device restart) via a malformed IPv6 MLDv2 packet, aka Bug ID CSCuh74233.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140305-wlc" source="CISCO" adv="1">20140305 Multiple Vulnerabilities in Cisco Wireless LAN Controllers</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="wireless_lan_controller">
        <vers num=""/>
      </prod>
      <prod vendor="cisco" name="wireless_lan_controller_software">
        <vers num="7.2"/>
        <vers num="7.2.103.0"/>
        <vers num="7.2.110.0"/>
        <vers num="7.3"/>
        <vers num="7.3.101.0"/>
        <vers num="7.4.100.0"/>
        <vers num="7.4.100.60"/>
        <vers num="7.5"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0706" published="2014-03-06" name="CVE-2014-0706" modified="2014-03-07" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:C)" CVSS_score="7.8" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="10.0" CVSS_base_score="7.8">
    <desc>
      <descript source="cve">Cisco Wireless LAN Controller (WLC) devices 7.2 before 7.2.115.2, 7.3, and 7.4 before 7.4.110.0 allow remote attackers to cause a denial of service (device restart) via a crafted 802.11 Ethernet frame, aka Bug ID CSCue87929.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140305-wlc" source="CISCO" adv="1">20140305 Multiple Vulnerabilities in Cisco Wireless LAN Controllers</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="wireless_lan_controller">
        <vers num=""/>
      </prod>
      <prod vendor="cisco" name="wireless_lan_controller_software">
        <vers num="7.2"/>
        <vers num="7.2.103.0"/>
        <vers num="7.2.110.0"/>
        <vers num="7.3"/>
        <vers num="7.3.101.0"/>
        <vers num="7.4.100.0"/>
        <vers num="7.4.100.60"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0707" published="2014-03-06" name="CVE-2014-0707" modified="2014-03-07" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:C)" CVSS_score="7.8" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="10.0" CVSS_base_score="7.8">
    <desc>
      <descript source="cve">Cisco Wireless LAN Controller (WLC) devices 7.2, 7.3, and 7.4 before 7.4.110.0 allow remote attackers to cause a denial of service (device restart) via a crafted 802.11 Ethernet frame, aka Bug ID CSCuf80681.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140305-wlc" source="CISCO" adv="1">20140305 Multiple Vulnerabilities in Cisco Wireless LAN Controllers</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="wireless_lan_controller">
        <vers num=""/>
      </prod>
      <prod vendor="cisco" name="wireless_lan_controller_software">
        <vers num="7.2"/>
        <vers num="7.2.103.0"/>
        <vers num="7.2.110.0"/>
        <vers num="7.3"/>
        <vers num="7.3.101.0"/>
        <vers num="7.4.100.0"/>
        <vers num="7.4.100.60"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0708" published="2014-03-20" name="CVE-2014-0708" modified="2014-03-24" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:N/A:N)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">WebEx Meeting Center in Cisco WebEx Business Suite does not properly compose URLs for HTTP GET requests, which allows remote attackers to obtain sensitive information by reading (1) web-server access logs, (2) web-server Referer logs, or (3) a browser's history, aka Bug ID CSCul98272.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0708" source="CISCO" adv="1">20140318 Cisco WebEx Business Suite HTTP GET Parameters Include Sensitive Information</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="webex_meeting_center">
        <vers num=""/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0709" published="2014-02-22" name="CVE-2014-0709" modified="2014-03-05" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">Cisco UCS Director (formerly Cloupia) before 4.0.0.3 has a hardcoded password for the root account, which makes it easier for remote attackers to obtain administrative access via an SSH session to the CLI interface, aka Bug ID CSCui73930.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140219-ucsd" source="CISCO" adv="1">20140219 Cisco UCS Director Default Credentials Vulnerability</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="ucs_director">
        <vers num="4.0.0.0"/>
        <vers num="4.0.0.1"/>
        <vers prev="1" num="4.0.0.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0710" published="2014-02-22" name="CVE-2014-0710" modified="2014-02-24" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:N/A:C)" CVSS_score="7.1" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="8.6" CVSS_base_score="7.1">
    <desc>
      <descript source="cve">Race condition in the cut-through proxy feature in Cisco Firewall Services Module (FWSM) Software 3.x before 3.2(28) and 4.x before 4.1(15) allows remote attackers to cause a denial of service (device reload) via certain matching traffic, aka Bug ID CSCuj16824.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140219-fwsm" source="CISCO" adv="1">20140219 Cisco Firewall Services Module Cut-Through Proxy Denial of Service Vulnerability</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="firewall_services_module_software">
        <vers num="3.1"/>
        <vers num="3.1(10)"/>
        <vers num="3.1(11)"/>
        <vers num="3.1(12)"/>
        <vers num="3.1(13)"/>
        <vers num="3.1(14)"/>
        <vers num="3.1(15)"/>
        <vers num="3.1(16)"/>
        <vers num="3.1(17)"/>
        <vers num="3.1(18)"/>
        <vers num="3.1(19)"/>
        <vers num="3.1(2)"/>
        <vers num="3.1(20)"/>
        <vers num="3.1(21)"/>
        <vers num="3.1(3)"/>
        <vers num="3.1(4)"/>
        <vers num="3.1(5)"/>
        <vers num="3.1(6)"/>
        <vers num="3.1(7)"/>
        <vers num="3.1(8)"/>
        <vers num="3.1(9)"/>
        <vers num="3.2"/>
        <vers num="3.2(1)"/>
        <vers num="3.2(10)"/>
        <vers num="3.2(11)"/>
        <vers num="3.2(12)"/>
        <vers num="3.2(13)"/>
        <vers num="3.2(14)"/>
        <vers num="3.2(15)"/>
        <vers num="3.2(16)"/>
        <vers num="3.2(17)"/>
        <vers num="3.2(18)"/>
        <vers num="3.2(19)"/>
        <vers num="3.2(2)"/>
        <vers num="3.2(20)"/>
        <vers num="3.2(21)"/>
        <vers num="3.2(22)"/>
        <vers num="3.2(23)"/>
        <vers num="3.2(24)"/>
        <vers num="3.2(25)"/>
        <vers num="3.2(26)"/>
        <vers num="3.2(27)"/>
        <vers num="3.2(3)"/>
        <vers num="3.2(4)"/>
        <vers num="3.2(5)"/>
        <vers num="3.2(6)"/>
        <vers num="3.2(7)"/>
        <vers num="3.2(8)"/>
        <vers num="3.2(9)"/>
        <vers num="4.0"/>
        <vers num="4.0(1)"/>
        <vers num="4.0(10)"/>
        <vers num="4.0(11)"/>
        <vers num="4.0(12)"/>
        <vers num="4.0(13)"/>
        <vers num="4.0(14)"/>
        <vers num="4.0(15)"/>
        <vers num="4.0(2)"/>
        <vers num="4.0(3)"/>
        <vers num="4.0(4)"/>
        <vers num="4.0(5)"/>
        <vers num="4.0(6)"/>
        <vers num="4.0(7)"/>
        <vers num="4.0(8)"/>
        <vers num="4.1"/>
        <vers num="4.1(1)"/>
        <vers num="4.1(10)"/>
        <vers num="4.1(11)"/>
        <vers num="4.1(12)"/>
        <vers num="4.1(13)"/>
        <vers num="4.1(14)"/>
        <vers num="4.1(2)"/>
        <vers num="4.1(3)"/>
        <vers num="4.1(4)"/>
        <vers num="4.1(5)"/>
        <vers num="4.1(6)"/>
        <vers num="4.1(7)"/>
        <vers num="4.1(8)"/>
        <vers num="4.1(9)"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0718" published="2014-02-22" name="CVE-2014-0718" modified="2014-03-05" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:N/A:C)" CVSS_score="7.1" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="8.6" CVSS_base_score="7.1">
    <desc>
      <descript source="cve">The produce-verbose-alert feature in Cisco IPS Software 7.1 before 7.1(8)E4 and 7.2 before 7.2(2)E4 allows remote attackers to cause a denial of service (Analysis Engine process outage) via fragmented packets, aka Bug ID CSCui91266.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140219-ips" source="CISCO" adv="1">20140219 Multiple Vulnerabilities in Cisco IPS Software</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="ips_sensor_software">
        <vers prev="1" num="7.1(1)e4"/>
        <vers num="7.1(2)e4"/>
        <vers num="7.1(3)e4"/>
        <vers num="7.1(4)e4"/>
        <vers num="7.1(6)e4"/>
        <vers num="7.1(7)e4"/>
        <vers num="7.1(8)e4"/>
        <vers num="7.2(1)e4"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0719" published="2014-02-22" name="CVE-2014-0719" modified="2014-03-05" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:C)" CVSS_score="7.8" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="10.0" CVSS_base_score="7.8">
    <desc>
      <descript source="cve">The control-plane access-list implementation in Cisco IPS Software before 7.1(8p2)E4 and 7.2 before 7.2(2)E4 allows remote attackers to cause a denial of service (MainApp process outage) via crafted packets to TCP port 7000, aka Bug ID CSCui67394.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140219-ips" source="CISCO" adv="1">20140219 Multiple Vulnerabilities in Cisco IPS Software</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="ips_sensor_software">
        <vers prev="1" num="7.1(1)e4"/>
        <vers num="7.1(2)e4"/>
        <vers num="7.1(3)e4"/>
        <vers num="7.1(4)e4"/>
        <vers num="7.1(6)e4"/>
        <vers num="7.1(7)e4"/>
        <vers num="7.1(8)e4"/>
        <vers num="7.2(1)e4"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0720" published="2014-02-22" name="CVE-2014-0720" modified="2014-03-05" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:N/A:C)" CVSS_score="7.1" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="8.6" CVSS_base_score="7.1">
    <desc>
      <descript source="cve">Cisco IPS Software 7.1 before 7.1(8)E4 and 7.2 before 7.2(2)E4 allows remote attackers to cause a denial of service (Analysis Engine process outage) via a flood of jumbo frames, aka Bug ID CSCuh94944.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140219-ips" source="CISCO" adv="1">20140219 Multiple Vulnerabilities in Cisco IPS Software</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="ips_sensor_software">
        <vers prev="1" num="7.1(1)e4"/>
        <vers num="7.1(2)e4"/>
        <vers num="7.1(3)e4"/>
        <vers num="7.1(4)e4"/>
        <vers num="7.1(6)e4"/>
        <vers num="7.1(7)e4"/>
        <vers num="7.1(8)e4"/>
        <vers num="7.2(1)e4"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0721" published="2014-02-22" name="CVE-2014-0721" modified="2014-03-05" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:C/I:C/A:C)" CVSS_score="10.0" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="10.0" CVSS_base_score="10.0">
    <desc>
      <descript source="cve">The Cisco Unified SIP Phone 3905 with firmware before 9.4(1) allows remote attackers to obtain root access via a session on the test interface on TCP port 7870, aka Bug ID CSCuh75574.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140219-phone" source="CISCO" adv="1">20140219 Unauthorized Access Vulnerability in Cisco Unified SIP Phone 3905</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="unified_sip_phone_3905">
        <vers num="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0722" published="2014-02-13" name="CVE-2014-0722" modified="2014-02-13" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:P)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">The log4jinit web application in Cisco Unified Communications Manager (UCM) does not properly validate authentication, which allows remote attackers to cause a denial of service (performance degradation) via unspecified use of this application, aka Bug ID CSCum05347.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0722" source="CISCO" adv="1">20140211 Cisco Unified Communications Manager Unauthenticated log4jinit Access Vulnerability</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="unified_communications_manager">
        <vers num=""/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0723" published="2014-02-13" name="CVE-2014-0723" modified="2014-02-13" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in the IP Manager Assistant (IPMA) interface in Cisco Unified Communications Manager (UCM) allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCum05343.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0723" source="CISCO" adv="1">20140211 Cisco Unified Communications Manager IPMA Cross-Site Scripting Vulnerability</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="unified_communications_manager">
        <vers num=""/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0724" published="2014-02-13" name="CVE-2014-0724" modified="2014-02-13" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:P/I:N/A:N)" CVSS_score="4.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.0" CVSS_base_score="4.0">
    <desc>
      <descript source="cve">The bulk administration interface in Cisco Unified Communications Manager (UCM) 10.0(1) and earlier allows remote attackers to bypass authentication and read arbitrary files by using an unspecified prompt, aka Bug ID CSCum05340.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/viewAlert.x?alertId=32825" source="CONFIRM" adv="1">http://tools.cisco.com/security/center/viewAlert.x?alertId=32825</ref>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0724" source="CISCO" adv="1">20140211 Cisco Unified Communications Manager Arbitrary File Read Vulnerability</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="unified_communications_manager">
        <vers num="10.0"/>
        <vers prev="1" num="10.0(1)"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0725" published="2014-02-13" name="CVE-2014-0725" modified="2014-02-13" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:N/A:N)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">Cisco Unified Communications Manager (UCM) does not require authentication for reading WAR files, which allows remote attackers to obtain sensitive information via unspecified access to a "file storage location," aka Bug ID CSCum05337.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0725" source="CISCO" adv="1">20140212 Cisco Unified Communications Manager WAR File Availability Vulnerability</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="unified_communications_manager">
        <vers num=""/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0726" published="2014-02-13" name="CVE-2014-0726" modified="2014-02-13" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">SQL injection vulnerability in the IP Manager Assistant (IPMA) interface in Cisco Unified Communications Manager (UCM) 10.0(1) and earlier allows remote attackers to execute arbitrary SQL commands via a crafted URL, aka Bug ID CSCum05326.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/viewAlert.x?alertId=32843" source="CONFIRM" adv="1">http://tools.cisco.com/security/center/viewAlert.x?alertId=32843</ref>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0726" source="CISCO" adv="1">20140212 Cisco Unified Communications Manager IPMA Blind SQL Injection Vulnerability</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="unified_communications_manager">
        <vers num="10.0"/>
        <vers prev="1" num="10.0(1)"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0727" published="2014-02-13" name="CVE-2014-0727" modified="2014-02-13" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">SQL injection vulnerability in the CallManager Interactive Voice Response (CMIVR) interface in Cisco Unified Communications Manager (UCM) allows remote attackers to execute arbitrary SQL commands via a crafted URL, aka Bug ID CSCum05318.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0727" source="CISCO" adv="1">20140212 Cisco Unified Communications Manager CMIVR Blind SQL Injection Vulnerability</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="unified_communications_manager">
        <vers num=""/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0728" published="2014-02-13" name="CVE-2014-0728" modified="2014-02-13" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">SQL injection vulnerability in the Java database interface in Cisco Unified Communications Manager (UCM) 10.0(1) and earlier allows remote attackers to execute arbitrary SQL commands via a crafted URL, aka Bug ID CSCum05313.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/viewAlert.x?alertId=32834" source="CONFIRM" adv="1">http://tools.cisco.com/security/center/viewAlert.x?alertId=32834</ref>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0728" source="CISCO" adv="1">20140211 Cisco Unified Communications Manager Java Interface SQL Injection Vulnerability</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="unified_communications_manager">
        <vers num="10.0"/>
        <vers prev="1" num="10.0(1)"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0729" published="2014-02-13" name="CVE-2014-0729" modified="2014-02-13" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">SQL injection vulnerability in the Enterprise Mobility Application (EMApp) interface in Cisco Unified Communications Manager (UCM) allows remote attackers to execute arbitrary SQL commands via a crafted URL, aka Bug ID CSCum05302.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0729" source="CISCO" adv="1">20140211 Cisco Unified Communications Manager Enterprise Mobility Application Blind SQL Injection Vulnerability</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="unified_communications_manager">
        <vers num=""/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0730" published="2014-02-22" name="CVE-2014-0730" modified="2014-02-24" CVSS_version="2.0" CVSS_vector="(AV:L/AC:L/Au:S/C:C/I:C/A:C)" CVSS_score="6.8" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="3.1" CVSS_base_score="6.8">
    <desc>
      <descript source="cve">Cisco Unified Computing System (UCS) Central Software 1.1 and earlier allows local users to gain privileges via a CLI copy command in a local-mgmt context, aka Bug ID CSCul53128.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/viewAlert.x?alertId=32910" source="CONFIRM" adv="1">http://tools.cisco.com/security/center/viewAlert.x?alertId=32910</ref>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0730" source="CISCO" adv="1">20140218 Cisco Unified Computing System Central Software Privilege Escalation Vulnerability</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="unified_computing_system_central_software">
        <vers num="1.0"/>
        <vers prev="1" num="1.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0731" published="2014-02-22" name="CVE-2014-0731" modified="2014-03-05" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:N/A:N)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">The administration interface in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier allows remote attackers to bypass authentication and read Java class files via a direct request, aka Bug ID CSCum46497.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/viewAlert.x?alertId=32915" source="CONFIRM" adv="1">http://tools.cisco.com/security/center/viewAlert.x?alertId=32915</ref>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0731" source="CISCO" adv="1">20140218 Cisco Unified Communications Manager Java Class File Availability Vulnerability</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="unified_communications_manager">
        <vers num="10.0"/>
        <vers prev="1" num="10.0(1)"/>
        <vers num="3.3(5)"/>
        <vers num="3.3(5)sr1"/>
        <vers num="3.3(5)sr2a"/>
        <vers num="4.1(3)"/>
        <vers num="4.1(3)sr1"/>
        <vers num="4.1(3)sr2"/>
        <vers num="4.1(3)sr3"/>
        <vers num="4.1(3)sr4"/>
        <vers num="4.2"/>
        <vers num="4.2.1"/>
        <vers num="4.2.2"/>
        <vers num="4.2.3"/>
        <vers num="4.2.3sr1"/>
        <vers num="4.2.3sr2"/>
        <vers num="4.2.3sr2b"/>
        <vers num="4.3"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0732" published="2014-02-20" name="CVE-2014-0732" modified="2014-02-20" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:N/A:N)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">The Real Time Monitoring Tool (RTMT) web application in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier does not properly enforce authentication requirements, which allows remote attackers to read application files via a direct request to a URL, aka Bug ID CSCum46495.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/viewAlert.x?alertId=32913" source="CONFIRM" adv="1">http://tools.cisco.com/security/center/viewAlert.x?alertId=32913</ref>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0732" source="CISCO" adv="1">20140218 Cisco Unified Communications Manager Real Time Monitoring Tool Information Disclosure Vulnerability</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="unified_communications_manager">
        <vers num="10.0"/>
        <vers prev="1" num="10.0(1)"/>
        <vers num="3.3(5)"/>
        <vers num="3.3(5)sr1"/>
        <vers num="3.3(5)sr2a"/>
        <vers num="4.1(3)"/>
        <vers num="4.1(3)sr1"/>
        <vers num="4.1(3)sr2"/>
        <vers num="4.1(3)sr3"/>
        <vers num="4.1(3)sr4"/>
        <vers num="4.2"/>
        <vers num="4.2.1"/>
        <vers num="4.2.2"/>
        <vers num="4.2.3"/>
        <vers num="4.2.3sr1"/>
        <vers num="4.2.3sr2"/>
        <vers num="4.2.3sr2b"/>
        <vers num="4.3"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0733" published="2014-02-20" name="CVE-2014-0733" modified="2014-02-20" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:N/A:N)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">The Enterprise License Manager (ELM) component in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier does not properly enforce authentication requirements, which allows remote attackers to read ELM files via a direct request to a URL, aka Bug ID CSCum46494.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/viewAlert.x?alertId=32914" source="CONFIRM" adv="1">http://tools.cisco.com/security/center/viewAlert.x?alertId=32914</ref>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0733" source="CISCO" adv="1">20140218 Cisco Unified Communications Manager Enterprise License Manager Information Disclosure Vulnerability</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="unified_communications_manager">
        <vers num="10.0"/>
        <vers prev="1" num="10.0(1)"/>
        <vers num="3.3(5)"/>
        <vers num="3.3(5)sr1"/>
        <vers num="3.3(5)sr2a"/>
        <vers num="4.1(3)"/>
        <vers num="4.1(3)sr1"/>
        <vers num="4.1(3)sr2"/>
        <vers num="4.1(3)sr3"/>
        <vers num="4.1(3)sr4"/>
        <vers num="4.2"/>
        <vers num="4.2.1"/>
        <vers num="4.2.2"/>
        <vers num="4.2.3"/>
        <vers num="4.2.3sr1"/>
        <vers num="4.2.3sr2"/>
        <vers num="4.2.3sr2b"/>
        <vers num="4.3"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0734" published="2014-02-20" name="CVE-2014-0734" modified="2014-02-20" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">SQL injection vulnerability in the Certificate Authority Proxy Function (CAPF) implementation in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier allows remote attackers to execute arbitrary SQL commands via a crafted URL, aka Bug ID CSCum46483.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/viewAlert.x?alertId=32916" source="CONFIRM" adv="1">http://tools.cisco.com/security/center/viewAlert.x?alertId=32916</ref>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0734" source="CISCO" adv="1">20140218 Cisco Unified Communications Manager CAPF Unauthenticated Blind SQL Injection Vulnerability</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="unified_communications_manager">
        <vers num="10.0"/>
        <vers prev="1" num="10.0(1)"/>
        <vers num="3.3(5)"/>
        <vers num="3.3(5)sr1"/>
        <vers num="3.3(5)sr2a"/>
        <vers num="4.1(3)"/>
        <vers num="4.1(3)sr1"/>
        <vers num="4.1(3)sr2"/>
        <vers num="4.1(3)sr3"/>
        <vers num="4.1(3)sr4"/>
        <vers num="4.2"/>
        <vers num="4.2.1"/>
        <vers num="4.2.2"/>
        <vers num="4.2.3"/>
        <vers num="4.2.3sr1"/>
        <vers num="4.2.3sr2"/>
        <vers num="4.2.3sr2b"/>
        <vers num="4.3"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0735" published="2014-02-20" name="CVE-2014-0735" modified="2014-02-20" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in the IP Manager Assistant (IPMA) interface in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCum46470.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/viewAlert.x?alertId=32912" source="CONFIRM" adv="1">http://tools.cisco.com/security/center/viewAlert.x?alertId=32912</ref>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0735" source="CISCO" adv="1">20140218 Cisco Unified Communications Manager IPMA Reflected Cross-Site Scripting Vulnerability</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="unified_communications_manager">
        <vers num="10.0"/>
        <vers prev="1" num="10.0(1)"/>
        <vers num="3.3(5)"/>
        <vers num="3.3(5)sr1"/>
        <vers num="3.3(5)sr2a"/>
        <vers num="4.1(3)"/>
        <vers num="4.1(3)sr1"/>
        <vers num="4.1(3)sr2"/>
        <vers num="4.1(3)sr3"/>
        <vers num="4.1(3)sr4"/>
        <vers num="4.2"/>
        <vers num="4.2.1"/>
        <vers num="4.2.2"/>
        <vers num="4.2.3"/>
        <vers num="4.2.3sr1"/>
        <vers num="4.2.3sr2"/>
        <vers num="4.2.3sr2b"/>
        <vers num="4.3"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0736" published="2014-02-20" name="CVE-2014-0736" modified="2014-02-20" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:P)" CVSS_score="6.8" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.6" CVSS_base_score="6.8">
    <desc>
      <descript source="cve">Cross-site request forgery (CSRF) vulnerability in the Call Detail Records Analysis and Reporting (CAR) page in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier allows remote attackers to hijack the authentication of arbitrary users for requests that make CAR modifications, aka Bug ID CSCum46468.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/viewAlert.x?alertId=32911" source="CONFIRM" adv="1">http://tools.cisco.com/security/center/viewAlert.x?alertId=32911</ref>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0736" source="CISCO" adv="1">20140218 Cisco Unified Communications Manager CAR Page CSRF Vulnerability</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="unified_communications_manager">
        <vers num="10.0"/>
        <vers prev="1" num="10.0(1)"/>
        <vers num="3.3(5)"/>
        <vers num="3.3(5)sr1"/>
        <vers num="3.3(5)sr2a"/>
        <vers num="4.1(3)"/>
        <vers num="4.1(3)sr1"/>
        <vers num="4.1(3)sr2"/>
        <vers num="4.1(3)sr3"/>
        <vers num="4.1(3)sr4"/>
        <vers num="4.2"/>
        <vers num="4.2.1"/>
        <vers num="4.2.2"/>
        <vers num="4.2.3"/>
        <vers num="4.2.3sr1"/>
        <vers num="4.2.3sr2"/>
        <vers num="4.2.3sr2b"/>
        <vers num="4.3"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0737" published="2014-02-22" name="CVE-2014-0737" modified="2014-03-05" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">The Cisco Unified IP Phone 7960G 9.2(1) and earlier allows remote attackers to bypass authentication and change trust relationships by injecting a Certificate Trust List (CTL) file, aka Bug ID CSCuj66795.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/viewAlert.x?alertId=32957" source="CONFIRM">http://tools.cisco.com/security/center/viewAlert.x?alertId=32957</ref>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0737" source="CISCO" adv="1">20140220 Cisco Third-Generation IP Phone CTL Trust Chain Enforcement Vulnerability</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="unified_ip_phone_7960g">
        <vers num=""/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0738" published="2014-02-22" name="CVE-2014-0738" modified="2014-03-05" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">The Phone Proxy component in Cisco Adaptive Security Appliance (ASA) Software 9.1(.3) and earlier allows remote attackers to bypass authentication and change trust relationships by injecting a Certificate Trust List (CTL) file, aka Bug ID CSCuj66770.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/viewAlert.x?alertId=32956" source="CONFIRM">http://tools.cisco.com/security/center/viewAlert.x?alertId=32956</ref>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0738" source="CISCO" adv="1">20140220 Cisco Adaptive Security Appliance Phone Proxy CTL Authentication Vulnerability</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="adaptive_security_appliance_software">
        <vers num="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0739" published="2014-02-22" name="CVE-2014-0739" modified="2014-03-05" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Race condition in the Phone Proxy component in Cisco Adaptive Security Appliance (ASA) Software 9.1(.3) and earlier allows remote attackers to bypass sec_db authentication and provide certain pass-through services to untrusted devices via a crafted configuration-file TFTP request, aka Bug ID CSCuj66766.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/viewAlert.x?alertId=32955" source="CONFIRM">http://tools.cisco.com/security/center/viewAlert.x?alertId=32955</ref>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0739" source="CISCO" adv="1">20140220 Cisco Adaptive Security Appliance Phone Proxy sec_db Race Condition Vulnerability</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="adaptive_security_appliance_software">
        <vers num="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0740" published="2014-02-26" name="CVE-2014-0740" modified="2014-03-10" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:P)" CVSS_score="6.8" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.6" CVSS_base_score="6.8">
    <desc>
      <descript source="cve">Cross-site request forgery (CSRF) vulnerability in the Call Detail Records Analysis and Reporting (CAR) interface in the OS Administration component in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier allows remote attackers to hijack the authentication of administrators for requests that make administrative changes, aka Bug ID CSCun00701.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/viewAlert.x?alertId=33049" source="CONFIRM" adv="1">http://tools.cisco.com/security/center/viewAlert.x?alertId=33049</ref>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0740" source="CISCO" adv="1">20140225 Cisco Unified Communications Manager OS Administration CSRF Vulnerability</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="unified_communications_manager">
        <vers num="10.0"/>
        <vers prev="1" num="10.0(1)"/>
        <vers num="3.3(5)"/>
        <vers num="3.3(5)sr1"/>
        <vers num="3.3(5)sr2a"/>
        <vers num="4.1(3)"/>
        <vers num="4.1(3)sr1"/>
        <vers num="4.1(3)sr2"/>
        <vers num="4.1(3)sr3"/>
        <vers num="4.1(3)sr4"/>
        <vers num="4.2"/>
        <vers num="4.2.1"/>
        <vers num="4.2.2"/>
        <vers num="4.2.3"/>
        <vers num="4.2.3sr1"/>
        <vers num="4.2.3sr2"/>
        <vers num="4.2.3sr2b"/>
        <vers num="4.3"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0741" published="2014-02-26" name="CVE-2014-0741" modified="2014-03-10" CVSS_version="2.0" CVSS_vector="(AV:L/AC:L/Au:S/C:C/I:C/A:N)" CVSS_score="6.2" CVSS_impact_subscore="9.2" CVSS_exploit_subscore="3.1" CVSS_base_score="6.2">
    <desc>
      <descript source="cve">The certificate-import feature in the Certificate Authority Proxy Function (CAPF) CLI implementation in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier allows local users to read or modify arbitrary files via a crafted command, aka Bug ID CSCum95461.</descript>
    </desc>
    <loss_types>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/viewAlert.x?alertId=33046" source="CONFIRM" adv="1">http://tools.cisco.com/security/center/viewAlert.x?alertId=33046</ref>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0741" source="CISCO" adv="1">20140225 Cisco Unified Communications Manager CAPF Certificate Import Arbitrary File Read/Write Vulnerability</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="unified_communications_manager">
        <vers num="10.0"/>
        <vers prev="1" num="10.0(1)"/>
        <vers num="3.3(5)"/>
        <vers num="3.3(5)sr1"/>
        <vers num="3.3(5)sr2a"/>
        <vers num="4.1(3)"/>
        <vers num="4.1(3)sr1"/>
        <vers num="4.1(3)sr2"/>
        <vers num="4.1(3)sr3"/>
        <vers num="4.1(3)sr4"/>
        <vers num="4.2"/>
        <vers num="4.2.1"/>
        <vers num="4.2.2"/>
        <vers num="4.2.3"/>
        <vers num="4.2.3sr1"/>
        <vers num="4.2.3sr2"/>
        <vers num="4.2.3sr2b"/>
        <vers num="4.3"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0742" published="2014-02-26" name="CVE-2014-0742" modified="2014-03-07" CVSS_version="2.0" CVSS_vector="(AV:L/AC:L/Au:S/C:C/I:C/A:N)" CVSS_score="6.2" CVSS_impact_subscore="9.2" CVSS_exploit_subscore="3.1" CVSS_base_score="6.2">
    <desc>
      <descript source="cve">The Certificate Authority Proxy Function (CAPF) CLI implementation in the CSR management feature in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier allows local users to read or modify arbitrary files via unspecified vectors, aka Bug ID CSCum95464.</descript>
    </desc>
    <loss_types>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/viewAlert.x?alertId=33045" source="CONFIRM" adv="1">http://tools.cisco.com/security/center/viewAlert.x?alertId=33045</ref>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0742" source="CISCO" adv="1">20140225 Cisco Unified Communications Manager CAPF CSR Arbitrary File Read/Write Vulnerability</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="unified_communications_manager">
        <vers num="10.0"/>
        <vers prev="1" num="10.0(1)"/>
        <vers num="3.3(5)"/>
        <vers num="3.3(5)sr1"/>
        <vers num="3.3(5)sr2a"/>
        <vers num="4.1(3)"/>
        <vers num="4.1(3)sr1"/>
        <vers num="4.1(3)sr2"/>
        <vers num="4.1(3)sr3"/>
        <vers num="4.1(3)sr4"/>
        <vers num="4.2"/>
        <vers num="4.2.1"/>
        <vers num="4.2.2"/>
        <vers num="4.2.3"/>
        <vers num="4.2.3sr1"/>
        <vers num="4.2.3sr2"/>
        <vers num="4.2.3sr2b"/>
        <vers num="4.3"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0743" published="2014-02-26" name="CVE-2014-0743" modified="2014-03-10" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:P/A:N)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">The Certificate Authority Proxy Function (CAPF) component in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier allows remote attackers to bypass authentication and modify registered-device information via crafted data, aka Bug ID CSCum95468.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/viewAlert.x?alertId=33044" source="CONFIRM" adv="1">http://tools.cisco.com/security/center/viewAlert.x?alertId=33044</ref>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0743" source="CISCO" adv="1">20140225 Cisco Unified Communications Manager CAPF Unauthenticated Device Information Update Vulnerability</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="unified_communications_manager">
        <vers num="10.0"/>
        <vers prev="1" num="10.0(1)"/>
        <vers num="3.3(5)"/>
        <vers num="3.3(5)sr1"/>
        <vers num="3.3(5)sr2a"/>
        <vers num="4.1(3)"/>
        <vers num="4.1(3)sr1"/>
        <vers num="4.1(3)sr2"/>
        <vers num="4.1(3)sr3"/>
        <vers num="4.1(3)sr4"/>
        <vers num="4.2"/>
        <vers num="4.2.1"/>
        <vers num="4.2.2"/>
        <vers num="4.2.3"/>
        <vers num="4.2.3sr1"/>
        <vers num="4.2.3sr2"/>
        <vers num="4.2.3sr2b"/>
        <vers num="4.3"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0745" published="2014-02-26" name="CVE-2014-0745" modified="2014-03-10" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:P)" CVSS_score="6.8" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.6" CVSS_base_score="6.8">
    <desc>
      <descript source="cve">Cross-site request forgery (CSRF) vulnerability in the Unified Serviceability subsystem in Cisco Unified Contact Center Express (Unified CCX) allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCum95502.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0745" source="CISCO" adv="1">20140225 Cisco Unified Contact Center Express Serviceability Page CSRF Vulnerability</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="unified_contact_center_express_editor_software">
        <vers num="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0746" published="2014-02-26" name="CVE-2014-0746" modified="2014-03-10" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:P/I:N/A:N)" CVSS_score="4.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.0" CVSS_base_score="4.0">
    <desc>
      <descript source="cve">The disaster recovery system (DRS) in Cisco Unified Contact Center Express (Unified CCX) allows remote authenticated users to obtain sensitive information by reading extraneous fields in an HTML document, aka Bug ID CSCum95536.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0746" source="CISCO" adv="1">20140225 Cisco Unified Contact Center Express DRS Sensitive Information Disclosure Vulnerability</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="unified_contact_center_express_editor_software">
        <vers num="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0747" published="2014-02-26" name="CVE-2014-0747" modified="2014-03-10" CVSS_version="2.0" CVSS_vector="(AV:L/AC:L/Au:S/C:C/I:C/A:C)" CVSS_score="6.8" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="3.1" CVSS_base_score="6.8">
    <desc>
      <descript source="cve">The Certificate Authority Proxy Function (CAPF) CLI implementation in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier allows local users to inject commands via unspecified CAPF programs, aka Bug ID CSCum95493.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/viewAlert.x?alertId=33048" source="CONFIRM" adv="1">http://tools.cisco.com/security/center/viewAlert.x?alertId=33048</ref>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0747" source="CISCO" adv="1">20140225 Cisco Unified Communications Manager CAPF CLI Command Injection Vulnerability</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="unified_communications_manager">
        <vers num="10.0"/>
        <vers prev="1" num="10.0(1)"/>
        <vers num="3.3(5)"/>
        <vers num="3.3(5)sr1"/>
        <vers num="3.3(5)sr2a"/>
        <vers num="4.1(3)"/>
        <vers num="4.1(3)sr1"/>
        <vers num="4.1(3)sr2"/>
        <vers num="4.1(3)sr3"/>
        <vers num="4.1(3)sr4"/>
        <vers num="4.2"/>
        <vers num="4.2.1"/>
        <vers num="4.2.2"/>
        <vers num="4.2.3"/>
        <vers num="4.2.3sr1"/>
        <vers num="4.2.3sr2"/>
        <vers num="4.2.3sr2b"/>
        <vers num="4.3"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0750" published="2014-01-25" name="CVE-2014-0750" modified="2014-02-21" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">Directory traversal vulnerability in gefebt.exe in the WebView CimWeb components in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY through 8.2 SIM 24, and Proficy Process Systems with CIMPLICITY, allows remote attackers to execute arbitrary code via a crafted HTTP request, aka ZDI-CAN-1622.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://ics-cert.us-cert.gov/advisories/ICSA-14-023-01" source="MISC">http://ics-cert.us-cert.gov/advisories/ICSA-14-023-01</ref>
      <ref url="http://www.securityfocus.com/bid/65124" source="BID">65124</ref>
      <ref url="http://support.ge-ip.com/support/index?page=kbchannel&amp;id=KB15939" source="CONFIRM" adv="1">http://support.ge-ip.com/support/index?page=kbchannel&amp;id=KB15939</ref>
    </refs>
    <vuln_soft>
      <prod vendor="ge" name="intelligent_platforms_proficy_hmi%2fscada_cimplicity">
        <vers prev="1" num="8.2" edition="sim24"/>
      </prod>
      <prod vendor="ge" name="intelligent_platforms_proficy_hmi/scada_cimplicity">
        <vers num="4.01"/>
        <vers num="7.5"/>
        <vers num="8.0"/>
        <vers num="8.1"/>
        <vers num="8.2"/>
      </prod>
      <prod vendor="ge" name="intelligent_platforms_proficy_process_systems_with_cimplicity">
        <vers num="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0751" published="2014-01-25" name="CVE-2014-0751" modified="2014-02-21" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">Directory traversal vulnerability in CimWebServer.exe (aka the WebView component) in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY before 8.2 SIM 24, and Proficy Process Systems with CIMPLICITY, allows remote attackers to execute arbitrary code via a crafted message to TCP port 10212, aka ZDI-CAN-1623.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.securityfocus.com/bid/65117" source="BID">65117</ref>
      <ref url="http://support.ge-ip.com/support/index?page=kbchannel&amp;id=KB15940" source="CONFIRM" adv="1">http://support.ge-ip.com/support/index?page=kbchannel&amp;id=KB15940</ref>
      <ref url="http://ics-cert.us-cert.gov/advisories/ICSA-14-023-01" source="MISC">http://ics-cert.us-cert.gov/advisories/ICSA-14-023-01</ref>
    </refs>
    <vuln_soft>
      <prod vendor="ge" name="intelligent_platforms_proficy_hmi%2fscada_cimplicity">
        <vers prev="1" num="8.2" edition="sim24"/>
      </prod>
      <prod vendor="ge" name="intelligent_platforms_proficy_hmi/scada_cimplicity">
        <vers num="4.01"/>
        <vers num="7.5"/>
        <vers num="8.0"/>
        <vers num="8.1"/>
        <vers num="8.2"/>
      </prod>
      <prod vendor="ge" name="intelligent_platforms_proficy_process_systems_with_cimplicity">
        <vers num="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0752" published="2014-01-09" name="CVE-2014-0752" modified="2014-01-10" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:N/A:N)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">The SCADA server in Ecava IntegraXor before 4.1.4369 allows remote attackers to read arbitrary project backup files via a crafted URL.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://ics-cert.us-cert.gov/advisories/ICSA-14-008-01" source="MISC" patch="1">http://ics-cert.us-cert.gov/advisories/ICSA-14-008-01</ref>
      <ref url="http://www.integraxor.com/blog/category/security/vulnerability-note/" source="CONFIRM" patch="1" adv="1">http://www.integraxor.com/blog/category/security/vulnerability-note/</ref>
    </refs>
    <vuln_soft>
      <prod vendor="ecava" name="integraxor">
        <vers num="3.5.3900.10"/>
        <vers num="3.5.3900.5"/>
        <vers num="3.6.4000.0"/>
        <vers num="3.60.4061"/>
        <vers num="3.71"/>
        <vers num="3.71.4200"/>
        <vers num="3.72"/>
        <vers num="4.00"/>
        <vers num="4.1"/>
        <vers prev="1" num="4.1.4360"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0753" published="2014-01-20" name="CVE-2014-0753" modified="2014-01-22" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:C)" CVSS_score="7.8" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="10.0" CVSS_base_score="7.8">
    <desc>
      <descript source="cve">Stack-based buffer overflow in the SCADA server in Ecava IntegraXor before 4.1.4390 allows remote attackers to cause a denial of service (system crash) by triggering access to DLL code located in the IntegraXor directory.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://ics-cert.us-cert.gov/advisories/ICSA-14-016-01" source="MISC">http://ics-cert.us-cert.gov/advisories/ICSA-14-016-01</ref>
      <ref url="http://www.integraxor.com/blog/buffer-overflow-vulnerability-note/" source="CONFIRM">http://www.integraxor.com/blog/buffer-overflow-vulnerability-note/</ref>
    </refs>
    <vuln_soft>
      <prod vendor="ecava" name="integraxor">
        <vers num="3.5.3900.10"/>
        <vers num="3.5.3900.5"/>
        <vers num="3.6.4000.0"/>
        <vers num="3.60.4061"/>
        <vers num="3.71"/>
        <vers num="3.71.4200"/>
        <vers num="3.72"/>
        <vers num="4.00"/>
        <vers num="4.1"/>
        <vers num="4.1.4360"/>
        <vers num="4.1.4369"/>
        <vers prev="1" num="4.1.4380"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0755" published="2014-02-05" name="CVE-2014-0755" modified="2014-02-21" CVSS_version="2.0" CVSS_vector="(AV:L/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="6.9" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="3.4" CVSS_base_score="6.9">
    <desc>
      <descript source="cve">Rockwell Automation RSLogix 5000 7 through 20.01, and 21.0, does not properly implement password protection for .ACD files (aka project files), which allows local users to obtain sensitive information or modify data via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="http://ics-cert.us-cert.gov/advisories/ICSA-14-021-01" source="MISC">http://ics-cert.us-cert.gov/advisories/ICSA-14-021-01</ref>
      <ref url="http://xforce.iss.net/xforce/xfdb/90981" source="XF">rslogix-cve20140755-info-disc(90981)</ref>
      <ref url="http://www.securityfocus.com/bid/65337" source="BID">65337</ref>
      <ref url="http://osvdb.org/102858" source="OSVDB">102858</ref>
    </refs>
    <vuln_soft>
      <prod vendor="rockwellautomation" name="rslogix_5000_design_and_configuration_software">
        <vers num="18.0"/>
        <vers num="20.01"/>
        <vers num="21.0"/>
        <vers num="7.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0757" published="2014-01-31" name="CVE-2014-0757" modified="2014-02-21" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:P)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">Smart Software Solutions (3S) CoDeSys Runtime Toolkit before 2.4.7.44 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://ics-cert.us-cert.gov/advisories/ICSA-14-030-01" source="MISC">http://ics-cert.us-cert.gov/advisories/ICSA-14-030-01</ref>
      <ref url="http://secunia.com/advisories/56713" source="SECUNIA">56713</ref>
    </refs>
    <vuln_soft>
      <prod vendor="3s-software" name="codesys_runtime_toolkit">
        <vers prev="1" num="2.4.7.43"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0758" published="2014-02-23" name="CVE-2014-0758" modified="2014-02-24" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">An ActiveX control in GenLaunch.htm in ICONICS GENESIS32 8.0, 8.02, 8.04, and 8.05 allows remote attackers to execute arbitrary programs via a crafted HTML document.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://ics-cert.us-cert.gov/advisories/ICSA-14-051-01" source="MISC">http://ics-cert.us-cert.gov/advisories/ICSA-14-051-01</ref>
    </refs>
    <vuln_soft>
      <prod vendor="iconics" name="genesis32">
        <vers num="8.0"/>
        <vers num="8.02"/>
        <vers num="8.04"/>
        <vers num="8.05"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0759" published="2014-02-28" name="CVE-2014-0759" modified="2014-02-28" CVSS_version="2.0" CVSS_vector="(AV:L/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="6.9" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="3.4" CVSS_base_score="6.9">
    <desc>
      <descript source="cve">Unquoted Windows search path vulnerability in Schneider Electric Floating License Manager 1.0.0 through 1.4.0 allows local users to gain privileges via a Trojan horse application with a name composed of an initial substring of a path that contains a space character.</descript>
      <descript source="nvd">Per: http://cwe.mitre.org/data/definitions/428.html

"CWE-428: Unquoted Search Path or Element"</descript>
    </desc>
    <sols>
      <sol source="nvd">Per: http://ics-cert.us-cert.gov/advisories/ICSA-14-058-01

"This license manager is used in the following Schneider Electric products:

    Power Monitoring Expert,
    Struxureware process Expert (PES),
    Struxureware process Expert libraries,
    Vijeo Citect (SCADA), and
    Vijeo Citect Historian."</sol>
    </sols>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="http://ics-cert.us-cert.gov/advisories/ICSA-14-058-01" source="MISC">http://ics-cert.us-cert.gov/advisories/ICSA-14-058-01</ref>
      <ref url="http://download.schneider-electric.com/files?p_Doc_Ref=SEVD%202014-015-01" source="CONFIRM" adv="1">http://download.schneider-electric.com/files?p_Doc_Ref=SEVD%202014-015-01</ref>
    </refs>
    <vuln_soft>
      <prod vendor="schneider-electric" name="floating_license_manager">
        <vers num="1.0.0"/>
        <vers num="1.4.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0760" published="2014-04-25" name="CVE-2014-0760" modified="2014-04-25" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">The Festo CECX-X-C1 Modular Master Controller with CoDeSys and CECX-X-M1 Modular Controller with CoDeSys and SoftMotion provide an undocumented access method involving the FTP protocol, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://ics-cert.us-cert.gov/advisories/ICSA-14-084-01" source="MISC">http://ics-cert.us-cert.gov/advisories/ICSA-14-084-01</ref>
    </refs>
    <vuln_soft>
      <prod vendor="3s-software" name="codesys_runtime_system">
        <vers num="-"/>
      </prod>
      <prod vendor="softmotion3d" name="softmotion">
        <vers num="-"/>
      </prod>
      <prod vendor="festo" name="cecx-x-c1_modular_master_controller">
        <vers num="-"/>
      </prod>
      <prod vendor="festo" name="cecx-x-m1_modular_controller">
        <vers num="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0763" published="2014-04-12" name="CVE-2014-0763" modified="2014-04-14" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">Multiple SQL injection vulnerabilities in DBVisitor.dll in Advantech WebAccess before 7.2 allow remote attackers to execute arbitrary SQL commands via SOAP requests to unspecified functions.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://ics-cert.us-cert.gov/advisories/ICSA-14-079-03" source="MISC">http://ics-cert.us-cert.gov/advisories/ICSA-14-079-03</ref>
    </refs>
    <vuln_soft>
      <prod vendor="advantech" name="advantech_webaccess">
        <vers num="5.0"/>
        <vers num="6.0"/>
        <vers num="7.0"/>
        <vers prev="1" num="7.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0764" published="2014-04-12" name="CVE-2014-0764" modified="2014-04-14" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">Stack-based buffer overflow in Advantech WebAccess before 7.2 allows remote attackers to execute arbitrary code via a long NodeName parameter.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://ics-cert.us-cert.gov/advisories/ICSA-14-079-03" source="MISC">http://ics-cert.us-cert.gov/advisories/ICSA-14-079-03</ref>
    </refs>
    <vuln_soft>
      <prod vendor="advantech" name="advantech_webaccess">
        <vers num="5.0"/>
        <vers num="6.0"/>
        <vers num="7.0"/>
        <vers prev="1" num="7.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0765" published="2014-04-12" name="CVE-2014-0765" modified="2014-04-14" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">Stack-based buffer overflow in Advantech WebAccess before 7.2 allows remote attackers to execute arbitrary code via a long GotoCmd argument.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://ics-cert.us-cert.gov/advisories/ICSA-14-079-03" source="MISC">http://ics-cert.us-cert.gov/advisories/ICSA-14-079-03</ref>
    </refs>
    <vuln_soft>
      <prod vendor="advantech" name="advantech_webaccess">
        <vers num="5.0"/>
        <vers num="6.0"/>
        <vers num="7.0"/>
        <vers prev="1" num="7.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0766" published="2014-04-12" name="CVE-2014-0766" modified="2014-04-14" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">Stack-based buffer overflow in Advantech WebAccess before 7.2 allows remote attackers to execute arbitrary code via a long NodeName2 argument.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://ics-cert.us-cert.gov/advisories/ICSA-14-079-03" source="MISC">http://ics-cert.us-cert.gov/advisories/ICSA-14-079-03</ref>
    </refs>
    <vuln_soft>
      <prod vendor="advantech" name="advantech_webaccess">
        <vers num="5.0"/>
        <vers num="6.0"/>
        <vers num="7.0"/>
        <vers prev="1" num="7.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0767" published="2014-04-12" name="CVE-2014-0767" modified="2014-04-14" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">Stack-based buffer overflow in Advantech WebAccess before 7.2 allows remote attackers to execute arbitrary code via a long AccessCode argument.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://ics-cert.us-cert.gov/advisories/ICSA-14-079-03" source="MISC">http://ics-cert.us-cert.gov/advisories/ICSA-14-079-03</ref>
    </refs>
    <vuln_soft>
      <prod vendor="advantech" name="advantech_webaccess">
        <vers num="5.0"/>
        <vers num="6.0"/>
        <vers num="7.0"/>
        <vers prev="1" num="7.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0768" published="2014-04-12" name="CVE-2014-0768" modified="2014-04-14" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">Stack-based buffer overflow in Advantech WebAccess before 7.2 allows remote attackers to execute arbitrary code via a long AccessCode2 argument.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://ics-cert.us-cert.gov/advisories/ICSA-14-079-03" source="MISC">http://ics-cert.us-cert.gov/advisories/ICSA-14-079-03</ref>
    </refs>
    <vuln_soft>
      <prod vendor="advantech" name="advantech_webaccess">
        <vers num="5.0"/>
        <vers num="6.0"/>
        <vers num="7.0"/>
        <vers prev="1" num="7.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0769" published="2014-04-25" name="CVE-2014-0769" modified="2014-04-25" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">The Festo CECX-X-C1 Modular Master Controller with CoDeSys and CECX-X-M1 Modular Controller with CoDeSys and SoftMotion do not require authentication for connections to certain TCP ports, which allows remote attackers to (1) modify the configuration via a request to the debug service on port 4000 or (2) delete log entries via a request to the log service on port 4001.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://ics-cert.us-cert.gov/advisories/ICSA-14-084-01" source="MISC">http://ics-cert.us-cert.gov/advisories/ICSA-14-084-01</ref>
    </refs>
    <vuln_soft>
      <prod vendor="3s-software" name="codesys_runtime_system">
        <vers num="-"/>
      </prod>
      <prod vendor="softmotion3d" name="softmotion">
        <vers num="-"/>
      </prod>
      <prod vendor="festo" name="cecx-x-c1_modular_master_controller">
        <vers num="-"/>
      </prod>
      <prod vendor="festo" name="cecx-x-m1_modular_controller">
        <vers num="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0770" published="2014-04-12" name="CVE-2014-0770" modified="2014-04-14" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">Stack-based buffer overflow in Advantech WebAccess before 7.2 allows remote attackers to execute arbitrary code via a long UserName parameter.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://ics-cert.us-cert.gov/advisories/ICSA-14-079-03" source="MISC">http://ics-cert.us-cert.gov/advisories/ICSA-14-079-03</ref>
    </refs>
    <vuln_soft>
      <prod vendor="advantech" name="advantech_webaccess">
        <vers num="5.0"/>
        <vers num="6.0"/>
        <vers num="7.0"/>
        <vers prev="1" num="7.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0771" published="2014-04-12" name="CVE-2014-0771" modified="2014-04-14" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:N/A:N)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">The OpenUrlToBuffer method in the BWOCXRUN.BwocxrunCtrl.1 ActiveX control in bwocxrun.ocx in Advantech WebAccess before 7.2 allows remote attackers to read arbitrary files via a file: URL.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://ics-cert.us-cert.gov/advisories/ICSA-14-079-03" source="MISC">http://ics-cert.us-cert.gov/advisories/ICSA-14-079-03</ref>
    </refs>
    <vuln_soft>
      <prod vendor="advantech" name="advantech_webaccess">
        <vers num="5.0"/>
        <vers num="6.0"/>
        <vers num="7.0"/>
        <vers prev="1" num="7.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0772" published="2014-04-12" name="CVE-2014-0772" modified="2014-04-14" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:N/A:N)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">The OpenUrlToBufferTimeout method in the BWOCXRUN.BwocxrunCtrl.1 ActiveX control in bwocxrun.ocx in Advantech WebAccess before 7.2 allows remote attackers to read arbitrary files via a file: URL.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://ics-cert.us-cert.gov/advisories/ICSA-14-079-03" source="MISC">http://ics-cert.us-cert.gov/advisories/ICSA-14-079-03</ref>
    </refs>
    <vuln_soft>
      <prod vendor="advantech" name="advantech_webaccess">
        <vers num="5.0"/>
        <vers num="6.0"/>
        <vers num="7.0"/>
        <vers prev="1" num="7.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0773" published="2014-04-12" name="CVE-2014-0773" modified="2014-04-14" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">The CreateProcess method in the BWOCXRUN.BwocxrunCtrl.1 ActiveX control in bwocxrun.ocx in Advantech WebAccess before 7.2 allows remote attackers to execute (1) setup.exe, (2) bwvbprt.exe, and (3) bwvbprtl.exe programs from arbitrary pathnames via a crafted argument, as demonstrated by a UNC share pathname.</descript>
      <descript source="nvd">CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://ics-cert.us-cert.gov/advisories/ICSA-14-079-03" source="MISC">http://ics-cert.us-cert.gov/advisories/ICSA-14-079-03</ref>
    </refs>
    <vuln_soft>
      <prod vendor="advantech" name="advantech_webaccess">
        <vers num="5.0"/>
        <vers num="6.0"/>
        <vers num="7.0"/>
        <vers prev="1" num="7.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0774" published="2014-02-28" name="CVE-2014-0774" modified="2014-02-28" CVSS_version="2.0" CVSS_vector="(AV:L/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="6.9" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="3.4" CVSS_base_score="6.9">
    <desc>
      <descript source="cve">Stack-based buffer overflow in the C++ sample client in Schneider Electric OPC Factory Server (OFS) TLXCDSUOFS33 - 3.35, TLXCDSTOFS33 - 3.35, TLXCDLUOFS33 - 3.35, TLXCDLTOFS33 - 3.35, and TLXCDLFOFS33 - 3.35 allows local users to gain privileges via vectors involving a malformed configuration file.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <local/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://ics-cert.us-cert.gov/advisories/ICSA-14-058-02" source="MISC">http://ics-cert.us-cert.gov/advisories/ICSA-14-058-02</ref>
      <ref url="http://download.schneider-electric.com/files?p_Doc_Ref=SEVD%202014-031-01" source="CONFIRM" adv="1">http://download.schneider-electric.com/files?p_Doc_Ref=SEVD%202014-031-01</ref>
    </refs>
    <vuln_soft>
      <prod vendor="schneider-electric" name="ofs_test_client_tlxcdlfofs33">
        <vers num="3.35"/>
      </prod>
      <prod vendor="schneider-electric" name="ofs_test_client_tlxcdltofs33">
        <vers num="3.35"/>
      </prod>
      <prod vendor="schneider-electric" name="ofs_test_client_tlxcdluofs33">
        <vers num="3.35"/>
      </prod>
      <prod vendor="schneider-electric" name="ofs_test_client_tlxcdstofs33">
        <vers num="3.35"/>
      </prod>
      <prod vendor="schneider-electric" name="ofs_test_client_tlxcdsuofs33">
        <vers num="3.35"/>
      </prod>
      <prod vendor="schneider-electric" name="opc_factory_server">
        <vers num="3.35"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0777" published="2014-04-11" name="CVE-2014-0777" modified="2014-04-14" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:C)" CVSS_score="7.8" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="10.0" CVSS_base_score="7.8">
    <desc>
      <descript source="cve">The Modbus slave/outstation driver in the OPC Drivers 1.0.20 and earlier in IOServer OPC Server allows remote attackers to cause a denial of service (out-of-bounds read and daemon crash) via a crafted packet.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://ics-cert.us-cert.gov/advisories/ICSA-14-100-01" source="MISC">http://ics-cert.us-cert.gov/advisories/ICSA-14-100-01</ref>
    </refs>
    <vuln_soft>
      <prod vendor="ioserver" name="ioserver_opc_server">
        <vers num="-"/>
      </prod>
      <prod vendor="ioserver" name="opc_drivers">
        <vers prev="1" num="1.0.20"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0778" published="2014-04-19" name="CVE-2014-0778" modified="2014-04-21" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:N/A:N)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">The TCPUploader module in Progea Movicon 11.4 before 11.4.1150 allows remote attackers to obtain potentially sensitive version information via network traffic to TCP port 10651.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://ics-cert.us-cert.gov/advisories/ICSA-14-105-01" source="MISC">http://ics-cert.us-cert.gov/advisories/ICSA-14-105-01</ref>
    </refs>
    <vuln_soft>
      <prod vendor="progea" name="movicon">
        <vers num="11.4"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0779" published="2014-03-14" name="CVE-2014-0779" modified="2014-03-14" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:P)" CVSS_score="6.8" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.6" CVSS_base_score="6.8">
    <desc>
      <descript source="cve">The PLC driver in ServerMain.exe in the Kepware KepServerEX 4 component in Schneider Electric StruxureWare SCADA Expert ClearSCADA 2010 R2 build 71.4165, 2010 R2.1 build 71.4325, 2010 R3 build 72.4560, 2010 R3.1 build 72.4644, 2013 R1 build 73.4729, 2013 R1.1 build 73.4832, 2013 R1.1a build 73.4903, 2013 R1.2 build 73.4955, and 2013 R2 build 74.5094 allows remote attackers to cause a denial of service (application crash) via a crafted OPF file (aka project file).</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://ics-cert.us-cert.gov/advisories/ICSA-14-072-01" source="MISC">http://ics-cert.us-cert.gov/advisories/ICSA-14-072-01</ref>
      <ref url="http://download.schneider-electric.com/files?p_Doc_Ref=SEVD%202014-024-01" source="CONFIRM" adv="1">http://download.schneider-electric.com/files?p_Doc_Ref=SEVD%202014-024-01</ref>
    </refs>
    <vuln_soft>
      <prod vendor="schneider-electric" name="clearscada">
        <vers num="2010" edition="r2"/>
        <vers num="2010" edition="r2.1"/>
        <vers num="2010" edition="r3"/>
        <vers num="2010" edition="r3.1"/>
      </prod>
      <prod vendor="schneider-electric" name="scada_expert_clearscada">
        <vers num="2013" edition="r1"/>
        <vers num="2013" edition="r1.1"/>
        <vers num="2013" edition="r1.1a"/>
        <vers num="2013" edition="r1.2"/>
        <vers num="2013" edition="r2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0780" published="2014-04-25" name="CVE-2014-0780" modified="2014-04-25" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">Directory traversal vulnerability in NTWebServer in InduSoft Web Studio 7.1 before SP2 Patch 4 allows remote attackers to read administrative passwords in APP files, and consequently execute arbitrary code, via unspecified web requests.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://ics-cert.us-cert.gov/advisories/ICSA-14-107-02" source="MISC" patch="1">http://ics-cert.us-cert.gov/advisories/ICSA-14-107-02</ref>
    </refs>
    <vuln_soft>
      <prod vendor="indusoft" name="web_studio">
        <vers prev="1" num="7.1" edition="-"/>
        <vers prev="1" num="7.1" edition="sp1"/>
        <vers prev="1" num="7.1" edition="sp2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0781" published="2014-03-14" name="CVE-2014-0781" modified="2014-03-14" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">Heap-based buffer overflow in BKCLogSvr.exe in Yokogawa CENTUM CS 3000 R3.09.50 and earlier allows remote attackers to execute arbitrary code via crafted UDP packets.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://ics-cert.us-cert.gov/advisories/ICSA-14-070-01" source="MISC">http://ics-cert.us-cert.gov/advisories/ICSA-14-070-01</ref>
    </refs>
    <vuln_soft>
      <prod vendor="yokogawa" name="centum_cs_3000">
        <vers num="r3.01"/>
        <vers num="r3.02"/>
        <vers num="r3.03"/>
        <vers num="r3.04"/>
        <vers num="r3.05"/>
        <vers num="r3.06"/>
        <vers num="r3.07"/>
        <vers num="r3.08"/>
        <vers num="r3.08.50"/>
        <vers num="r3.08.70"/>
        <vers num="r3.09"/>
        <vers prev="1" num="r3.09.50"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0783" published="2014-03-14" name="CVE-2014-0783" modified="2014-03-14" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:C)" CVSS_score="9.0" CVSS_impact_subscore="8.5" CVSS_exploit_subscore="10.0" CVSS_base_score="9.0">
    <desc>
      <descript source="cve">Stack-based buffer overflow in BKHOdeq.exe in Yokogawa CENTUM CS 3000 R3.09.50 and earlier allows remote attackers to execute arbitrary code via a crafted TCP packet.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://ics-cert.us-cert.gov/advisories/ICSA-14-070-01" source="MISC">http://ics-cert.us-cert.gov/advisories/ICSA-14-070-01</ref>
    </refs>
    <vuln_soft>
      <prod vendor="yokogawa" name="centum_cs_3000">
        <vers num="r3.01"/>
        <vers num="r3.02"/>
        <vers num="r3.03"/>
        <vers num="r3.04"/>
        <vers num="r3.05"/>
        <vers num="r3.06"/>
        <vers num="r3.07"/>
        <vers num="r3.08"/>
        <vers num="r3.08.50"/>
        <vers num="r3.08.70"/>
        <vers num="r3.09"/>
        <vers prev="1" num="r3.09.50"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0784" published="2014-03-14" name="CVE-2014-0784" modified="2014-03-14" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:C)" CVSS_score="8.3" CVSS_impact_subscore="8.5" CVSS_exploit_subscore="8.6" CVSS_base_score="8.3">
    <desc>
      <descript source="cve">Stack-based buffer overflow in BKBCopyD.exe in Yokogawa CENTUM CS 3000 R3.09.50 and earlier allows remote attackers to execute arbitrary code via a crafted TCP packet.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://ics-cert.us-cert.gov/advisories/ICSA-14-070-01" source="MISC">http://ics-cert.us-cert.gov/advisories/ICSA-14-070-01</ref>
    </refs>
    <vuln_soft>
      <prod vendor="yokogawa" name="centum_cs_3000">
        <vers num="r3.01"/>
        <vers num="r3.02"/>
        <vers num="r3.03"/>
        <vers num="r3.04"/>
        <vers num="r3.05"/>
        <vers num="r3.06"/>
        <vers num="r3.07"/>
        <vers num="r3.08"/>
        <vers num="r3.08.50"/>
        <vers num="r3.08.70"/>
        <vers num="r3.09"/>
        <vers prev="1" num="r3.09.50"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0786" published="2014-04-30" name="CVE-2014-0786" modified="2014-05-01" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:N/A:N)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">Ecava IntegraXor before 4.1.4393 allows remote attackers to read cleartext credentials for administrative accounts via SELECT statements that leverage the guest role.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://ics-cert.us-cert.gov/advisories/ICSA-14-091-01" source="MISC" patch="1">http://ics-cert.us-cert.gov/advisories/ICSA-14-091-01</ref>
      <ref url="http://www.integraxor.com/blog/category/security/vulnerability-note/" source="CONFIRM" adv="1">http://www.integraxor.com/blog/category/security/vulnerability-note/</ref>
    </refs>
    <vuln_soft>
      <prod vendor="ecava" name="integraxor">
        <vers num="4.1"/>
        <vers num="4.1.4340"/>
        <vers num="4.1.4360"/>
        <vers num="4.1.4369"/>
        <vers num="4.1.4380"/>
        <vers prev="1" num="4.1.4390"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0787" published="2014-04-12" name="CVE-2014-0787" modified="2014-04-14" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:C/I:C/A:C)" CVSS_score="10.0" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="10.0" CVSS_base_score="10.0">
    <desc>
      <descript source="cve">Stack-based buffer overflow in WellinTech KingSCADA before 3.1.2.13 allows remote attackers to execute arbitrary code via a crafted packet.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://ics-cert.us-cert.gov/advisories/ICSA-14-098-02" source="MISC">http://ics-cert.us-cert.gov/advisories/ICSA-14-098-02</ref>
    </refs>
    <vuln_soft>
      <prod vendor="wellintech" name="kingscada">
        <vers num="3.1"/>
        <vers prev="1" num="3.1.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0789" published="2014-04-04" name="CVE-2014-0789" modified="2014-04-04" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:C)" CVSS_score="7.8" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="10.0" CVSS_base_score="7.8">
    <desc>
      <descript source="cve">Multiple buffer overflows in the OPC Automation 2.0 Server Object ActiveX control in Schneider Electric OPC Factory Server (OFS) TLXCDSUOFS33 3.5 and earlier, TLXCDSTOFS33 3.5 and earlier, TLXCDLUOFS33 3.5 and earlier, TLXCDLTOFS33 3.5 and earlier, and TLXCDLFOFS33 3.5 and earlier allow remote attackers to cause a denial of service via long arguments to unspecified functions.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://ics-cert.us-cert.gov/advisories/ICSA-14-093-01" source="MISC">http://ics-cert.us-cert.gov/advisories/ICSA-14-093-01</ref>
      <ref url="http://www.schneider-electric.com/corporate/en/support/cybersecurity/viewer-news.page?c_filepath=/templatedata/Content/News/data/en/local/cybersecurity/general_information/2014/03/20140325_vulnerability_disclosure_opc_factory_server.xml" source="CONFIRM" adv="1">http://www.schneider-electric.com/corporate/en/support/cybersecurity/viewer-news.page?c_filepath=/templatedata/Content/News/data/en/local/cybersecurity/general_information/2014/03/20140325_vulnerability_disclosure_opc_factory_server.xml</ref>
    </refs>
    <vuln_soft>
      <prod vendor="schneider-electric" name="opc_factory_server_tlxcdlfofs">
        <vers prev="1" num="3.35"/>
      </prod>
      <prod vendor="schneider-electric" name="opc_factory_server_tlxcdltofs">
        <vers prev="1" num="3.35"/>
      </prod>
      <prod vendor="schneider-electric" name="opc_factory_server_tlxcdluofs">
        <vers prev="1" num="3.35"/>
      </prod>
      <prod vendor="schneider-electric" name="opc_factory_server_tlxcdstofs">
        <vers prev="1" num="3.35"/>
      </prod>
      <prod vendor="schneider-electric" name="opc_factory_server_tlxcdsuofs">
        <vers prev="1" num="3.35"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0791" published="2014-01-03" name="CVE-2014-0791" modified="2014-01-06" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:P)" CVSS_score="6.8" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.6" CVSS_base_score="6.8">
    <desc>
      <descript source="cve">Integer overflow in the license_read_scope_list function in libfreerdp/core/license.c in FreeRDP through 1.0.2 allows remote RDP servers to cause a denial of service (application crash) or possibly have unspecified other impact via a large ScopeCount value in a Scope List in a Server License Request packet.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://github.com/sidhpurwala-huzaifa/FreeRDP/commit/e2745807c4c3e0a590c0f69a9b655dc74ebaa03e" source="MISC">https://github.com/sidhpurwala-huzaifa/FreeRDP/commit/e2745807c4c3e0a590c0f69a9b655dc74ebaa03e</ref>
      <ref url="https://github.com/FreeRDP/FreeRDP/pull/1649" source="MISC">https://github.com/FreeRDP/FreeRDP/pull/1649</ref>
      <ref url="https://bugzilla.redhat.com/show_bug.cgi?id=998941" source="MISC">https://bugzilla.redhat.com/show_bug.cgi?id=998941</ref>
      <ref url="http://openwall.com/lists/oss-security/2014/01/03/4" source="MLIST">[oss-security] 20140103 Re: CVE for freerdp int overflow?</ref>
      <ref url="http://openwall.com/lists/oss-security/2014/01/02/5" source="MLIST">[oss-security] 20140102 CVE for freerdp int overflow?</ref>
    </refs>
    <vuln_soft>
      <prod vendor="freerdp_project" name="freerdp">
        <vers num="1.0.0"/>
        <vers num="1.0.1"/>
        <vers num="1.0.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0792" published="2014-01-17" name="CVE-2014-0792" modified="2014-01-21" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">Sonatype Nexus 1.x and 2.x before 2.7.1 allows remote attackers to create arbitrary objects and execute arbitrary code via unspecified vectors related to unmarshalling of unintended Object types.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://support.sonatype.com/entries/37828023-Nexus-Security-Vulnerability" source="CONFIRM" patch="1" adv="1">https://support.sonatype.com/entries/37828023-Nexus-Security-Vulnerability</ref>
      <ref url="http://www.sonatype.org/advisories/archive/2014-01-13-Nexus" source="CONFIRM" patch="1" adv="1">http://www.sonatype.org/advisories/archive/2014-01-13-Nexus</ref>
      <ref url="https://sonatype.zendesk.com/entries/37551958-Configuring-Xstream-Whitelist" source="CONFIRM">https://sonatype.zendesk.com/entries/37551958-Configuring-Xstream-Whitelist</ref>
    </refs>
    <vuln_soft>
      <prod vendor="sonatype" name="nexus">
        <vers num="1.0"/>
        <vers num="2.0"/>
        <vers num="2.0.1"/>
        <vers num="2.0.2"/>
        <vers num="2.0.3"/>
        <vers num="2.0.4" edition="1"/>
        <vers num="2.0.5"/>
        <vers num="2.0.6"/>
        <vers num="2.1"/>
        <vers num="2.1.1"/>
        <vers num="2.2"/>
        <vers num="2.3.1"/>
        <vers num="2.4.0"/>
        <vers num="2.5.0"/>
        <vers num="2.5.1"/>
        <vers num="2.6.0"/>
        <vers num="2.6.1"/>
        <vers num="2.6.2"/>
        <vers num="2.6.3"/>
        <vers num="2.6.4"/>
        <vers num="2.7.0" edition="04"/>
        <vers num="2.7.0" edition="05"/>
        <vers num="2.7.0" edition="06"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0793" published="2014-01-30" name="CVE-2014-0793" modified="2014-02-21" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Multiple cross-site scripting (XSS) vulnerabilities in the StackIdeas Komento (com_komento) component before 1.7.3 for Joomla! allow remote attackers to inject arbitrary web script or HTML via the (1) website or (2) latitude parameter in a comment to the default URI.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="https://www.htbridge.com/advisory/HTB23194" source="MISC">https://www.htbridge.com/advisory/HTB23194</ref>
      <ref url="http://www.securityfocus.com/archive/1/archive/1/530873/100/0/threaded" source="BUGTRAQ">20140123 Cross-Site Scripting (XSS) in Komento Joomla Extension</ref>
      <ref url="http://www.exploit-db.com/exploits/31174" source="EXPLOIT-DB">31174</ref>
      <ref url="http://stackideas.com/downloads/changelog/komento" source="CONFIRM">http://stackideas.com/downloads/changelog/komento</ref>
    </refs>
    <vuln_soft>
      <prod vendor="stackideas" name="komento">
        <vers num="1.7.0"/>
        <vers num="1.7.1"/>
        <vers prev="1" num="1.7.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0794" published="2014-01-26" name="CVE-2014-0794" modified="2014-02-24" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in JV Comment (com_jvcomment) 3.0.2 for Joomla! allows remote attackers to inject arbitrary web script or HTML via the id parameter in a comment.like action.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="https://www.htbridge.com/advisory/HTB23195" source="MISC">https://www.htbridge.com/advisory/HTB23195</ref>
      <ref url="http://xforce.iss.net/xforce/xfdb/90532" source="XF">joomla-jvcomment-unspecified-sql-injection(90532)</ref>
      <ref url="http://www.securityfocus.com/bid/64661" source="BID">64661</ref>
      <ref url="http://www.securityfocus.com/archive/1/archive/1/530872/100/0/threaded" source="BUGTRAQ">20140123 SQL Injection in JV Comment Joomla Extension</ref>
      <ref url="http://www.osvdb.org/101960" source="OSVDB">101960</ref>
      <ref url="http://www.exploit-db.com/exploits/31175" source="EXPLOIT-DB">31175</ref>
      <ref url="http://extensions.joomla.org/extensions/contacts-and-feedback/articles-comments/23394" source="CONFIRM" adv="1">http://extensions.joomla.org/extensions/contacts-and-feedback/articles-comments/23394</ref>
    </refs>
    <vuln_soft>
      <prod vendor="joomla" name="com_jvcomment">
        <vers num="3.0.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0802" published="2014-01-12" name="CVE-2014-0802" modified="2014-01-13" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:P)" CVSS_score="5.8" CVSS_impact_subscore="4.9" CVSS_exploit_subscore="8.6" CVSS_base_score="5.8">
    <desc>
      <descript source="cve">Directory traversal vulnerability in the aokitaka ZIP with Pass application 4.5.7 and earlier, and ZIP with Pass Pro application 6.3.8 and earlier, for Android allows attackers to overwrite or create arbitrary files via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <avail/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://jvndb.jvn.jp/jvndb/JVNDB-2014-000001" source="JVNDB">JVNDB-2014-000001</ref>
      <ref url="http://jvn.jp/en/jp/JVN88313872/index.html" source="JVN">JVN#88313872</ref>
    </refs>
    <vuln_soft>
      <prod vendor="aokitaka" name="zip_with_pass">
        <vers prev="1" num="4.5.7" edition="-:~-~-~android~~"/>
      </prod>
      <prod vendor="aokitaka" name="zip_with_pass_pro">
        <vers num="6.2.1" edition="-:~-~-~android~~"/>
        <vers num="6.2.2" edition="-:~-~-~android~~"/>
        <vers num="6.3.0" edition="-:~-~-~android~~"/>
        <vers num="6.3.4" edition="-:~-~-~android~~"/>
        <vers num="6.3.5" edition="-:~-~-~android~~"/>
        <vers num="6.3.7" edition="-:~-~-~android~~"/>
        <vers prev="1" num="6.3.8" edition="-:~-~-~android~~"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0803" published="2014-01-12" name="CVE-2014-0803" modified="2014-01-13" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:P)" CVSS_score="5.8" CVSS_impact_subscore="4.9" CVSS_exploit_subscore="8.6" CVSS_base_score="5.8">
    <desc>
      <descript source="cve">Directory traversal vulnerability in the tetra filer application 2.3.1 and earlier for Android 4.0.3, tetra filer free application 2.3.1 and earlier for Android 4.0.3, tetra filer application 1.5.1 and earlier for Android before 4.0.3, and tetra filer free application 1.5.1 and earlier for Android before 4.0.3 allows attackers to overwrite or create arbitrary files via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <avail/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://play.google.com/store/apps/details?id=jp.main.brits.android.filer.free" source="CONFIRM">https://play.google.com/store/apps/details?id=jp.main.brits.android.filer.free</ref>
      <ref url="https://play.google.com/store/apps/details?id=jp.main.brits.android.filer.app" source="CONFIRM">https://play.google.com/store/apps/details?id=jp.main.brits.android.filer.app</ref>
      <ref url="http://jvndb.jvn.jp/jvndb/JVNDB-2014-000002" source="JVNDB">JVNDB-2014-000002</ref>
      <ref url="http://jvn.jp/en/jp/JVN51285738/index.html" source="JVN">JVN#51285738</ref>
    </refs>
    <vuln_soft>
      <prod vendor="yuichiro_okuyama" name="tetra_filer">
        <vers prev="1" num="1.5.1" edition="-:~-~-~android~~"/>
        <vers prev="1" num="2.3.1" edition="-:~-~-~android~~"/>
      </prod>
      <prod vendor="yuichiro_okuyama" name="tetra_filer_free">
        <vers prev="1" num="1.5.1" edition="-:~-~-~android~~"/>
        <vers prev="1" num="2.3.1" edition="-:~-~-~android~~"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0804" published="2014-01-12" name="CVE-2014-0804" modified="2014-01-13" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:P)" CVSS_score="5.8" CVSS_impact_subscore="4.9" CVSS_exploit_subscore="8.6" CVSS_base_score="5.8">
    <desc>
      <descript source="cve">Directory traversal vulnerability in the CGENE Security File Manager Pro application 1.0.6 and earlier, and Security File Manager Trial application 1.0.6 and earlier, for Android allows attackers to overwrite or create arbitrary files via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <avail/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://play.google.com/store/apps/details?id=com.cgene.android.secret.filelock.pro" source="CONFIRM">https://play.google.com/store/apps/details?id=com.cgene.android.secret.filelock.pro</ref>
      <ref url="https://play.google.com/store/apps/details?id=com.cgene.android.secret.filelock.free" source="CONFIRM">https://play.google.com/store/apps/details?id=com.cgene.android.secret.filelock.free</ref>
      <ref url="http://jvndb.jvn.jp/jvndb/JVNDB-2014-000003" source="JVNDB">JVNDB-2014-000003</ref>
      <ref url="http://jvn.jp/en/jp/JVN44392991/index.html" source="JVN">JVN#44392991</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cgene" name="security_file_manager">
        <vers prev="1" num="1.0.6" edition="-:~-~trial~android~~"/>
        <vers prev="1" num="1.0.6" edition="-:~-~pro~android~~"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0805" published="2014-01-12" name="CVE-2014-0805" modified="2014-01-13" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:P)" CVSS_score="5.8" CVSS_impact_subscore="4.9" CVSS_exploit_subscore="8.6" CVSS_base_score="5.8">
    <desc>
      <descript source="cve">Directory traversal vulnerability in the NeoFiler application 5.4.3 and earlier, NeoFiler Free application 5.4.3 and earlier, and NeoFiler Lite application 2.4.2 and earlier for Android allows attackers to overwrite or create arbitrary files via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <avail/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://play.google.com/store/apps/details?id=com.skyarts.android.neofilerlite" source="CONFIRM">https://play.google.com/store/apps/details?id=com.skyarts.android.neofilerlite</ref>
      <ref url="https://play.google.com/store/apps/details?id=com.skyarts.android.neofilerfree" source="CONFIRM">https://play.google.com/store/apps/details?id=com.skyarts.android.neofilerfree</ref>
      <ref url="https://play.google.com/store/apps/details?id=com.skyarts.android.neofiler" source="CONFIRM">https://play.google.com/store/apps/details?id=com.skyarts.android.neofiler</ref>
      <ref url="http://www.skyarts.com/products/android/neofiler/index.html" source="CONFIRM">http://www.skyarts.com/products/android/neofiler/index.html</ref>
      <ref url="http://jvndb.jvn.jp/jvndb/JVNDB-2014-000004" source="JVNDB">JVNDB-2014-000004</ref>
      <ref url="http://jvn.jp/en/jp/JVN85716574/index.html" source="JVN">JVN#85716574</ref>
    </refs>
    <vuln_soft>
      <prod vendor="skyarts" name="neofiler">
        <vers prev="1" num="2.4.2" edition="-:~-~lite~android~~"/>
        <vers prev="1" num="5.4.3" edition="-:~-~free~android~~"/>
        <vers prev="1" num="5.4.3" edition="-:~-~-~android~~"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0806" published="2014-01-22" name="CVE-2014-0806" modified="2014-01-23" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:N/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">The Sleipnir Mobile application 2.12.1 and earlier and Sleipnir Mobile Black Edition application 2.12.1 and earlier for Android provide Geolocation API data without verifying user consent, which allows remote attackers to obtain sensitive location information via a web site that makes API calls.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://jvndb.jvn.jp/jvndb/JVNDB-2014-000007" source="JVNDB">JVNDB-2014-000007</ref>
      <ref url="http://jvn.jp/en/jp/JVN81637882/index.html" source="JVN">JVN#81637882</ref>
    </refs>
    <vuln_soft>
      <prod vendor="fenrir-inc" name="sleipnir_mobile">
        <vers num="1.0.0" edition="alpha:black"/>
        <vers num="1.0.0" edition="beta_update1:black"/>
        <vers num="1.0.0" edition="rc:black"/>
        <vers num="1.1.0" edition="-:black"/>
        <vers num="1.2.0" edition="-:black"/>
        <vers num="1.3.0" edition="-:black"/>
        <vers num="1.4.0" edition="-:black"/>
        <vers num="1.5.0" edition="-:black"/>
        <vers num="1.5.1" edition="-:black"/>
        <vers num="1.6.0" edition="-:black"/>
        <vers num="1.7.0" edition="-:black"/>
        <vers num="1.7.1" edition="-:black"/>
        <vers num="2.0.0" edition="-:black"/>
        <vers num="2.0.1" edition="-:black"/>
        <vers num="2.0.2" edition="-:black"/>
        <vers num="2.0.3" edition="-:black"/>
        <vers num="2.0.4" edition="-:black"/>
        <vers num="2.1.0" edition="-:black"/>
        <vers num="2.10" edition="-:black"/>
        <vers num="2.10.0" edition="-:black"/>
        <vers num="2.11" edition="-:black"/>
        <vers num="2.12" edition="-:black"/>
        <vers prev="1" num="2.12.1" edition="-:black"/>
        <vers num="2.2.0" edition="-:black"/>
        <vers num="2.2.1" edition="-:black"/>
        <vers num="2.2.2" edition="-:black"/>
        <vers num="2.2.3" edition="-:black"/>
        <vers num="2.3.0" edition="-:black"/>
        <vers num="2.4.0" edition="-:black"/>
        <vers num="2.4.1" edition="-:black"/>
        <vers num="2.5.0" edition="-:black"/>
        <vers num="2.5.1" edition="-:black"/>
        <vers num="2.6.0" edition="-:black"/>
        <vers num="2.7.0" edition="-:black"/>
        <vers num="2.8.0" edition="-:black"/>
        <vers num="2.9.0" edition="-:black"/>
        <vers num="2.9.1" edition="-:black"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0807" published="2014-01-22" name="CVE-2014-0807" modified="2014-01-23" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:P/A:P)" CVSS_score="6.4" CVSS_impact_subscore="4.9" CVSS_exploit_subscore="10.0" CVSS_base_score="6.4">
    <desc>
      <descript source="cve">data/class/pages/shopping/LC_Page_Shopping_Deliv.php in LOCKON EC-CUBE 2.4.4 and earlier, and 2.11.0 through 2.12.2, allows remote attackers to modify data via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <avail/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.ec-cube.net/info/weakness/weakness.php?id=56" source="CONFIRM" adv="1">http://www.ec-cube.net/info/weakness/weakness.php?id=56</ref>
      <ref url="http://jvndb.jvn.jp/jvndb/JVNDB-2014-000005" source="JVNDB">JVNDB-2014-000005</ref>
      <ref url="http://jvn.jp/en/jp/JVN17849447/index.html" source="JVN">JVN#17849447</ref>
    </refs>
    <vuln_soft>
      <prod vendor="lockon" name="ec-cube">
        <vers num="2.11.0" edition="beta"/>
        <vers num="2.11.0" edition="beta2"/>
        <vers num="2.11.1"/>
        <vers num="2.11.2"/>
        <vers num="2.11.3"/>
        <vers num="2.11.4"/>
        <vers num="2.11.5"/>
        <vers num="2.12.0"/>
        <vers num="2.12.1"/>
        <vers num="2.12.2"/>
        <vers num="2.4.0" edition="rc1"/>
        <vers num="2.4.1"/>
        <vers num="2.4.2"/>
        <vers num="2.4.3"/>
        <vers prev="1" num="2.4.4"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0808" published="2014-01-22" name="CVE-2014-0808" modified="2014-01-23" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:N/A:N)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">The lfCheckError function in data/class/pages/shopping/LC_Page_Shopping_Multiple.php in LOCKON EC-CUBE 2.11.0 through 2.12.2 allows remote attackers to obtain sensitive shipping information via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.ec-cube.net/info/weakness/weakness.php?id=57" source="CONFIRM" adv="1">http://www.ec-cube.net/info/weakness/weakness.php?id=57</ref>
      <ref url="http://jvndb.jvn.jp/jvndb/JVNDB-2014-000006" source="JVNDB">JVNDB-2014-000006</ref>
      <ref url="http://jvn.jp/en/jp/JVN51770585/index.html" source="JVN">JVN#51770585</ref>
    </refs>
    <vuln_soft>
      <prod vendor="lockon" name="ec-cube">
        <vers num="2.11.0" edition="beta"/>
        <vers num="2.11.0" edition="beta2"/>
        <vers num="2.11.1"/>
        <vers num="2.11.2"/>
        <vers num="2.11.3"/>
        <vers num="2.11.4"/>
        <vers num="2.11.5"/>
        <vers num="2.12.0"/>
        <vers num="2.12.1"/>
        <vers num="2.12.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0809" published="2014-01-24" name="CVE-2014-0809" modified="2014-02-21" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Directory traversal vulnerability in the Gapless Player SimZip (aka Simple Zip Viewer) application before 1.2.1 for Android allows remote attackers to overwrite or create arbitrary files via a crafted filename.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://play.google.com/store/apps/details?id=com.acidzazz.simzip" source="CONFIRM">https://play.google.com/store/apps/details?id=com.acidzazz.simzip</ref>
      <ref url="http://xforce.iss.net/xforce/xfdb/90980" source="XF">simple-zip-cve20140809-dir-traversal(90980)</ref>
      <ref url="http://jvndb.jvn.jp/jvndb/JVNDB-2014-000008" source="JVNDB">JVNDB-2014-000008</ref>
      <ref url="http://jvn.jp/en/jp/JVN49384502/index.html" source="JVN">JVN#49384502</ref>
    </refs>
    <vuln_soft>
      <prod vendor="gapless_player" name="simzip">
        <vers num="1.1"/>
        <vers prev="1" num="1.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0810" published="2014-01-29" name="CVE-2014-0810" modified="2014-01-29" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">Unspecified vulnerability in JustSystems Sanshiro 2007 before update 3, 2008 before update 5, 2009 before update 6, and 2010 before update 6, and Sanshiro Viewer before 2.0.2.0, allows remote attackers to execute arbitrary code via a crafted document.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.justsystems.com/jp/info/js14001.html" source="CONFIRM" adv="1">http://www.justsystems.com/jp/info/js14001.html</ref>
      <ref url="http://jvndb.jvn.jp/jvndb/JVNDB-2014-000011" source="JVNDB">JVNDB-2014-000011</ref>
      <ref url="http://jvn.jp/en/jp/JVN28011378/index.html" source="JVN">JVN#28011378</ref>
    </refs>
    <vuln_soft>
      <prod vendor="justsystems" name="sanshiro">
        <vers num="2007"/>
        <vers num="2008"/>
        <vers num="2009"/>
        <vers num="2010"/>
        <vers num="viewer"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0811" published="2014-02-22" name="CVE-2014-0811" modified="2014-02-24" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in Blackboard Vista/CE 8.0 SP6 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://jvndb.jvn.jp/jvndb/JVNDB-2014-000012" source="JVNDB">JVNDB-2014-000012</ref>
      <ref url="http://jvn.jp/en/jp/JVN24730765/index.html" source="JVN">JVN#24730765</ref>
    </refs>
    <vuln_soft>
      <prod vendor="blackboard" name="vista/ce">
        <vers prev="1" num="8.0" edition="sp6"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0812" published="2014-02-01" name="CVE-2014-0812" modified="2014-02-03" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in KENT-WEB Joyful Note 2.8 and earlier, when Internet Explorer 7 or earlier is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://www.kent-web.com/bbs/joyful.html" source="CONFIRM">http://www.kent-web.com/bbs/joyful.html</ref>
      <ref url="http://jvndb.jvn.jp/jvndb/JVNDB-2014-000013" source="JVNDB">JVNDB-2014-000013</ref>
      <ref url="http://jvn.jp/en/jp/JVN30718178/index.html" source="JVN">JVN#30718178</ref>
    </refs>
    <vuln_soft>
      <prod vendor="kent-web" name="joyful_note">
        <vers prev="1" num="2.8"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0813" published="2014-02-14" name="CVE-2014-0813" modified="2014-02-21" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:P)" CVSS_score="6.8" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.6" CVSS_base_score="6.8">
    <desc>
      <descript source="cve">Cross-site request forgery (CSRF) vulnerability in phpMyFAQ before 2.8.6 allows remote attackers to hijack the authentication of arbitrary users for requests that modify settings.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://www.phpmyfaq.de/advisory_2014-02-04.php" source="CONFIRM" patch="1" adv="1">http://www.phpmyfaq.de/advisory_2014-02-04.php</ref>
      <ref url="http://xforce.iss.net/xforce/xfdb/90963" source="XF">phpmyfaq-cve20140813-csrf(90963)</ref>
      <ref url="http://www.securityfocus.com/bid/65368" source="BID">65368</ref>
      <ref url="http://secunia.com/advisories/56006" source="SECUNIA">56006</ref>
      <ref url="http://osvdb.org/102939" source="OSVDB">102939</ref>
      <ref url="http://jvndb.jvn.jp/jvndb/JVNDB-2014-000016" source="JVNDB">JVNDB-2014-000016</ref>
      <ref url="http://jvn.jp/en/jp/JVN50943964/index.html" source="JVN">JVN#50943964</ref>
    </refs>
    <vuln_soft>
      <prod vendor="phpmyfaq" name="phpmyfaq">
        <vers num="1.0"/>
        <vers num="1.0.1"/>
        <vers num="1.0.1a"/>
        <vers num="1.1.0"/>
        <vers num="1.1.1"/>
        <vers num="1.1.2"/>
        <vers num="1.1.3"/>
        <vers num="1.1.4"/>
        <vers num="1.1.4a"/>
        <vers num="1.1.5"/>
        <vers num="1.2.0"/>
        <vers num="1.2.1"/>
        <vers num="1.2.2"/>
        <vers num="1.2.3"/>
        <vers num="1.2.4"/>
        <vers num="1.2.5"/>
        <vers num="1.2.5a"/>
        <vers num="1.2.5b"/>
        <vers num="1.3.0"/>
        <vers num="1.3.1"/>
        <vers num="1.3.10"/>
        <vers num="1.3.11"/>
        <vers num="1.3.12"/>
        <vers num="1.3.13"/>
        <vers num="1.3.14"/>
        <vers num="1.3.2"/>
        <vers num="1.3.3"/>
        <vers num="1.3.4"/>
        <vers num="1.3.5"/>
        <vers num="1.3.6"/>
        <vers num="1.3.7"/>
        <vers num="1.3.8"/>
        <vers num="1.3.9" edition="pl1"/>
        <vers num="1.4" edition="alpha1"/>
        <vers num="1.4" edition="alpha2"/>
        <vers num="1.4.0"/>
        <vers num="1.4.0a"/>
        <vers num="1.4.1"/>
        <vers num="1.4.10"/>
        <vers num="1.4.11"/>
        <vers num="1.4.2"/>
        <vers num="1.4.3"/>
        <vers num="1.4.4"/>
        <vers num="1.4.5"/>
        <vers num="1.4.6"/>
        <vers num="1.4.7"/>
        <vers num="1.4.8"/>
        <vers num="1.4.9"/>
        <vers num="1.5" edition="alpha1"/>
        <vers num="1.5" edition="alpha2"/>
        <vers num="1.5" edition="beta1"/>
        <vers num="1.5" edition="beta2"/>
        <vers num="1.5" edition="beta3"/>
        <vers num="1.5" edition="rc1"/>
        <vers num="1.5" edition="rc2"/>
        <vers num="1.5" edition="rc3"/>
        <vers num="1.5" edition="rc4"/>
        <vers num="1.5" edition="rc5"/>
        <vers num="1.5.0"/>
        <vers num="1.5.1"/>
        <vers num="1.5.2"/>
        <vers num="1.5.3"/>
        <vers num="1.5.4"/>
        <vers num="1.5.5"/>
        <vers num="1.5.6"/>
        <vers num="1.5.7"/>
        <vers num="1.5.8"/>
        <vers num="1.5.9"/>
        <vers num="1.6.0"/>
        <vers num="1.6.1"/>
        <vers num="1.6.10"/>
        <vers num="1.6.11"/>
        <vers num="1.6.12"/>
        <vers num="1.6.2"/>
        <vers num="1.6.3"/>
        <vers num="1.6.4"/>
        <vers num="1.6.5"/>
        <vers num="1.6.6"/>
        <vers num="1.6.7"/>
        <vers num="1.6.8"/>
        <vers num="1.6.9"/>
        <vers num="2.0.0"/>
        <vers num="2.0.1"/>
        <vers num="2.0.10"/>
        <vers num="2.0.11"/>
        <vers num="2.0.12"/>
        <vers num="2.0.13"/>
        <vers num="2.0.14"/>
        <vers num="2.0.15"/>
        <vers num="2.0.16"/>
        <vers num="2.0.17"/>
        <vers num="2.0.2"/>
        <vers num="2.0.3"/>
        <vers num="2.0.4"/>
        <vers num="2.0.5"/>
        <vers num="2.0.6"/>
        <vers num="2.0.7"/>
        <vers num="2.0.8"/>
        <vers num="2.0.9"/>
        <vers num="2.5.0"/>
        <vers num="2.5.1"/>
        <vers num="2.5.2"/>
        <vers num="2.5.3"/>
        <vers num="2.5.4"/>
        <vers num="2.5.5"/>
        <vers num="2.5.6"/>
        <vers num="2.5.7"/>
        <vers num="2.6.0"/>
        <vers num="2.6.1"/>
        <vers num="2.6.10"/>
        <vers num="2.6.11"/>
        <vers num="2.6.12"/>
        <vers num="2.6.13"/>
        <vers num="2.6.14"/>
        <vers num="2.6.15"/>
        <vers num="2.6.16"/>
        <vers num="2.6.17"/>
        <vers num="2.6.18"/>
        <vers num="2.6.2"/>
        <vers num="2.6.3"/>
        <vers num="2.6.4"/>
        <vers num="2.6.5"/>
        <vers num="2.6.6"/>
        <vers num="2.6.7"/>
        <vers num="2.6.8"/>
        <vers num="2.6.9"/>
        <vers num="2.7.0"/>
        <vers num="2.7.1"/>
        <vers num="2.7.2"/>
        <vers num="2.7.3"/>
        <vers num="2.7.4"/>
        <vers num="2.7.5"/>
        <vers num="2.7.6"/>
        <vers num="2.7.7"/>
        <vers num="2.7.8"/>
        <vers num="2.7.9"/>
        <vers num="2.8.0"/>
        <vers num="2.8.1"/>
        <vers num="2.8.2"/>
        <vers num="2.8.3"/>
        <vers num="2.8.4"/>
        <vers prev="1" num="2.8.5"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0814" published="2014-02-14" name="CVE-2014-0814" modified="2014-02-21" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in phpMyFAQ before 2.8.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://www.phpmyfaq.de/advisory_2014-02-04.php" source="CONFIRM" patch="1" adv="1">http://www.phpmyfaq.de/advisory_2014-02-04.php</ref>
      <ref url="http://www.securityfocus.com/bid/65368" source="BID">65368</ref>
      <ref url="http://secunia.com/advisories/56006" source="SECUNIA">56006</ref>
      <ref url="http://osvdb.org/102940" source="OSVDB">102940</ref>
      <ref url="http://jvndb.jvn.jp/jvndb/JVNDB-2014-000015" source="JVNDB">JVNDB-2014-000015</ref>
      <ref url="http://jvn.jp/en/jp/JVN30050348/index.html" source="JVN">JVN#30050348</ref>
    </refs>
    <vuln_soft>
      <prod vendor="phpmyfaq" name="phpmyfaq">
        <vers num="1.0"/>
        <vers num="1.0.1"/>
        <vers num="1.0.1a"/>
        <vers num="1.1.0"/>
        <vers num="1.1.1"/>
        <vers num="1.1.2"/>
        <vers num="1.1.3"/>
        <vers num="1.1.4"/>
        <vers num="1.1.4a"/>
        <vers num="1.1.5"/>
        <vers num="1.2.0"/>
        <vers num="1.2.1"/>
        <vers num="1.2.2"/>
        <vers num="1.2.3"/>
        <vers num="1.2.4"/>
        <vers num="1.2.5"/>
        <vers num="1.2.5a"/>
        <vers num="1.2.5b"/>
        <vers num="1.3.0"/>
        <vers num="1.3.1"/>
        <vers num="1.3.10"/>
        <vers num="1.3.11"/>
        <vers num="1.3.12"/>
        <vers num="1.3.13"/>
        <vers num="1.3.14"/>
        <vers num="1.3.2"/>
        <vers num="1.3.3"/>
        <vers num="1.3.4"/>
        <vers num="1.3.5"/>
        <vers num="1.3.6"/>
        <vers num="1.3.7"/>
        <vers num="1.3.8"/>
        <vers num="1.3.9" edition="pl1"/>
        <vers num="1.4" edition="alpha1"/>
        <vers num="1.4" edition="alpha2"/>
        <vers num="1.4.0"/>
        <vers num="1.4.0a"/>
        <vers num="1.4.1"/>
        <vers num="1.4.10"/>
        <vers num="1.4.11"/>
        <vers num="1.4.2"/>
        <vers num="1.4.3"/>
        <vers num="1.4.4"/>
        <vers num="1.4.5"/>
        <vers num="1.4.6"/>
        <vers num="1.4.7"/>
        <vers num="1.4.8"/>
        <vers num="1.4.9"/>
        <vers num="1.5" edition="alpha1"/>
        <vers num="1.5" edition="alpha2"/>
        <vers num="1.5" edition="beta1"/>
        <vers num="1.5" edition="beta2"/>
        <vers num="1.5" edition="beta3"/>
        <vers num="1.5" edition="rc1"/>
        <vers num="1.5" edition="rc2"/>
        <vers num="1.5" edition="rc3"/>
        <vers num="1.5" edition="rc4"/>
        <vers num="1.5" edition="rc5"/>
        <vers num="1.5.0"/>
        <vers num="1.5.1"/>
        <vers num="1.5.2"/>
        <vers num="1.5.3"/>
        <vers num="1.5.4"/>
        <vers num="1.5.5"/>
        <vers num="1.5.6"/>
        <vers num="1.5.7"/>
        <vers num="1.5.8"/>
        <vers num="1.5.9"/>
        <vers num="1.6.0"/>
        <vers num="1.6.1"/>
        <vers num="1.6.10"/>
        <vers num="1.6.11"/>
        <vers num="1.6.12"/>
        <vers num="1.6.2"/>
        <vers num="1.6.3"/>
        <vers num="1.6.4"/>
        <vers num="1.6.5"/>
        <vers num="1.6.6"/>
        <vers num="1.6.7"/>
        <vers num="1.6.8"/>
        <vers num="1.6.9"/>
        <vers num="2.0.0"/>
        <vers num="2.0.1"/>
        <vers num="2.0.10"/>
        <vers num="2.0.11"/>
        <vers num="2.0.12"/>
        <vers num="2.0.13"/>
        <vers num="2.0.14"/>
        <vers num="2.0.15"/>
        <vers num="2.0.16"/>
        <vers num="2.0.17"/>
        <vers num="2.0.2"/>
        <vers num="2.0.3"/>
        <vers num="2.0.4"/>
        <vers num="2.0.5"/>
        <vers num="2.0.6"/>
        <vers num="2.0.7"/>
        <vers num="2.0.8"/>
        <vers num="2.0.9"/>
        <vers num="2.5.0"/>
        <vers num="2.5.1"/>
        <vers num="2.5.2"/>
        <vers num="2.5.3"/>
        <vers num="2.5.4"/>
        <vers num="2.5.5"/>
        <vers num="2.5.6"/>
        <vers num="2.5.7"/>
        <vers num="2.6.0"/>
        <vers num="2.6.1"/>
        <vers num="2.6.10"/>
        <vers num="2.6.11"/>
        <vers num="2.6.12"/>
        <vers num="2.6.13"/>
        <vers num="2.6.14"/>
        <vers num="2.6.15"/>
        <vers num="2.6.16"/>
        <vers num="2.6.17"/>
        <vers num="2.6.18"/>
        <vers num="2.6.2"/>
        <vers num="2.6.3"/>
        <vers num="2.6.4"/>
        <vers num="2.6.5"/>
        <vers num="2.6.6"/>
        <vers num="2.6.7"/>
        <vers num="2.6.8"/>
        <vers num="2.6.9"/>
        <vers num="2.7.0"/>
        <vers num="2.7.1"/>
        <vers num="2.7.2"/>
        <vers num="2.7.3"/>
        <vers num="2.7.4"/>
        <vers num="2.7.5"/>
        <vers num="2.7.6"/>
        <vers num="2.7.7"/>
        <vers num="2.7.8"/>
        <vers num="2.7.9"/>
        <vers num="2.8.0"/>
        <vers num="2.8.1"/>
        <vers num="2.8.2"/>
        <vers num="2.8.3"/>
        <vers num="2.8.4"/>
        <vers prev="1" num="2.8.5"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0815" published="2014-02-06" name="CVE-2014-0815" modified="2014-02-21" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:N/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">The intent: URL implementation in Opera before 18 on Android allows attackers to read local files by leveraging an interaction error, as demonstrated by reading stored cookies.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/91090" source="XF">opera-android-cve20140815-info-disc(91090)</ref>
      <ref url="http://www.securityfocus.com/bid/65391" source="BID">65391</ref>
      <ref url="http://jvndb.jvn.jp/jvndb/JVNDB-2014-000014" source="JVNDB">JVNDB-2014-000014</ref>
      <ref url="http://jvn.jp/en/jp/JVN23256725/index.html" source="JVN">JVN#23256725</ref>
      <ref url="http://blogs.opera.com/security/2014/01/security-changes-features-opera-19/" source="CONFIRM" adv="1">http://blogs.opera.com/security/2014/01/security-changes-features-opera-19/</ref>
    </refs>
    <vuln_soft>
      <prod vendor="opera" name="opera_browser">
        <vers num="1.00"/>
        <vers num="10.00" edition="alpha"/>
        <vers num="10.00" edition="beta1"/>
        <vers num="10.00" edition="beta2"/>
        <vers num="10.00" edition="beta3"/>
        <vers num="10.01"/>
        <vers num="10.10" edition="beta1"/>
        <vers num="10.11"/>
        <vers num="10.20" edition="alpha"/>
        <vers num="10.50" edition="beta1"/>
        <vers num="10.50" edition="beta2"/>
        <vers num="10.51"/>
        <vers num="10.52" edition="beta1"/>
        <vers num="10.52" edition="beta2"/>
        <vers num="10.53" edition="b"/>
        <vers num="10.53" edition="beta1"/>
        <vers num="10.54"/>
        <vers num="10.60" edition="alpha"/>
        <vers num="10.60" edition="beta1"/>
        <vers num="10.61"/>
        <vers num="10.62"/>
        <vers num="10.63"/>
        <vers num="11.00" edition="beta"/>
        <vers num="11.01"/>
        <vers num="11.10" edition="beta"/>
        <vers num="11.11"/>
        <vers num="11.50" edition="beta"/>
        <vers num="11.51"/>
        <vers num="11.52"/>
        <vers num="11.52.1100"/>
        <vers num="11.60" edition="beta"/>
        <vers num="11.61"/>
        <vers num="11.62"/>
        <vers num="11.64"/>
        <vers num="11.65"/>
        <vers num="11.66"/>
        <vers num="11.67"/>
        <vers num="12.00" edition="beta"/>
        <vers num="12.01"/>
        <vers num="12.02"/>
        <vers num="12.10" edition="beta"/>
        <vers num="12.11"/>
        <vers num="12.12"/>
        <vers num="12.13"/>
        <vers num="12.14"/>
        <vers num="12.15"/>
        <vers num="15.00" edition="next"/>
        <vers num="16.00"/>
        <vers prev="1" num="17.00"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0816" published="2014-02-26" name="CVE-2014-0816" modified="2014-02-27" CVSS_version="2.0" CVSS_vector="(AV:L/AC:L/Au:N/C:C/I:C/A:C)" CVSS_score="7.2" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="3.9" CVSS_base_score="7.2">
    <desc>
      <descript source="cve">Unspecified vulnerability in Norman Security Suite 10.1 and earlier allows local users to gain privileges via unknown vectors.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="http://jvndb.jvn.jp/jvndb/JVNDB-2014-000026" source="JVNDB">JVNDB-2014-000026</ref>
      <ref url="http://jvn.jp/en/jp/JVN02017463/index.html" source="JVN">JVN#02017463</ref>
      <ref url="http://jvn.jp/en/jp/JVN02017463/995510/index.html" source="CONFIRM">http://jvn.jp/en/jp/JVN02017463/995510/index.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="norman" name="security_suite">
        <vers num="10.0"/>
        <vers prev="1" num="10.1"/>
        <vers num="8.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0817" published="2014-02-26" name="CVE-2014-0817" modified="2014-02-27" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:S/C:P/I:P/A:N)" CVSS_score="4.9" CVSS_impact_subscore="4.9" CVSS_exploit_subscore="6.8" CVSS_base_score="4.9">
    <desc>
      <descript source="cve">Cybozu Garoon 2.x through 2.5.4 and 3.x through 3.7 SP3 does not properly manage sessions, which allows remote authenticated users to impersonate arbitrary users via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://support.cybozu.com/ja-jp/article/7992" source="CONFIRM" patch="1" adv="1">https://support.cybozu.com/ja-jp/article/7992</ref>
      <ref url="http://jvndb.jvn.jp/jvndb/JVNDB-2014-000021" source="JVNDB">JVNDB-2014-000021</ref>
      <ref url="http://jvn.jp/en/jp/JVN24035499/index.html" source="JVN">JVN#24035499</ref>
      <ref url="http://cs.cybozu.co.jp/information/gr20140225up03.php" source="CONFIRM" adv="1">http://cs.cybozu.co.jp/information/gr20140225up03.php</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cybozu" name="garoon">
        <vers num="2.0" edition="sp1"/>
        <vers num="2.0" edition="sp2"/>
        <vers num="2.0" edition="sp3"/>
        <vers num="2.0" edition="sp4"/>
        <vers num="2.0" edition="sp5"/>
        <vers num="2.0" edition="sp6"/>
        <vers num="2.0.0"/>
        <vers num="2.0.1"/>
        <vers num="2.0.2"/>
        <vers num="2.0.3"/>
        <vers num="2.0.4"/>
        <vers num="2.0.5"/>
        <vers num="2.0.6"/>
        <vers num="2.1" edition="sp1"/>
        <vers num="2.1" edition="sp2"/>
        <vers num="2.1" edition="sp3"/>
        <vers num="2.1.0"/>
        <vers num="2.1.1"/>
        <vers num="2.1.2"/>
        <vers num="2.1.3"/>
        <vers num="2.5" edition="sp1"/>
        <vers num="2.5" edition="sp2"/>
        <vers num="2.5" edition="sp3"/>
        <vers num="2.5" edition="sp4"/>
        <vers num="2.5.0"/>
        <vers num="2.5.1"/>
        <vers num="2.5.2"/>
        <vers num="2.5.3"/>
        <vers num="2.5.4"/>
        <vers num="3.0" edition="sp1"/>
        <vers num="3.0" edition="sp2"/>
        <vers num="3.0" edition="sp3"/>
        <vers num="3.1" edition="sp1"/>
        <vers num="3.1" edition="sp2"/>
        <vers num="3.1" edition="sp3"/>
        <vers num="3.5" edition="sp1"/>
        <vers num="3.5" edition="sp2"/>
        <vers num="3.5" edition="sp3"/>
        <vers num="3.5" edition="sp4"/>
        <vers num="3.5" edition="sp5"/>
        <vers num="3.5.3"/>
        <vers num="3.7" edition="sp1"/>
        <vers num="3.7" edition="sp2"/>
        <vers num="3.7" edition="sp3"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0818" published="2014-02-22" name="CVE-2014-0818" modified="2014-03-05" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">Untrusted search path vulnerability in Autodesk AutoCAD before 2014 allows local users to gain privileges and execute arbitrary VBScript code via a Trojan horse FAS file in the FAS file search path.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://jvndb.jvn.jp/jvndb/JVNDB-2014-000019" source="JVNDB">JVNDB-2014-000019</ref>
      <ref url="http://jvn.jp/en/jp/JVN33382534/index.html" source="JVN">JVN#33382534</ref>
    </refs>
    <vuln_soft>
      <prod vendor="autodesk" name="autocad">
        <vers num="2005" edition="::english"/>
        <vers num="2006"/>
        <vers num="2007" edition="::english"/>
        <vers num="2010"/>
        <vers num="2011"/>
        <vers num="2012"/>
        <vers prev="1" num="2013"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0819" published="2014-02-22" name="CVE-2014-0819" modified="2014-02-24" CVSS_version="2.0" CVSS_vector="(AV:L/AC:M/Au:N/C:P/I:P/A:P)" CVSS_score="4.4" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="3.4" CVSS_base_score="4.4">
    <desc>
      <descript source="cve">Untrusted search path vulnerability in Autodesk AutoCAD before 2014 allows local users to gain privileges via a Trojan horse DLL in the current working directory.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <local/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://jvndb.jvn.jp/jvndb/JVNDB-2014-000020" source="JVNDB">JVNDB-2014-000020</ref>
      <ref url="http://jvn.jp/en/jp/JVN43254599/index.html" source="JVN">JVN#43254599</ref>
    </refs>
    <vuln_soft>
      <prod vendor="autodesk" name="autocad">
        <vers num="2005" edition="::english"/>
        <vers num="2006"/>
        <vers num="2007" edition="::english"/>
        <vers num="2010"/>
        <vers num="2011"/>
        <vers num="2012"/>
        <vers prev="1" num="2013"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0820" published="2014-02-26" name="CVE-2014-0820" modified="2014-03-10" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:P/I:N/A:N)" CVSS_score="4.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.0" CVSS_base_score="4.0">
    <desc>
      <descript source="cve">Directory traversal vulnerability in the download feature in Cybozu Garoon 2.x through 2.5.4 and 3.x through 3.7 SP3 allows remote authenticated users to read arbitrary files via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://support.cybozu.com/ja-jp/article/7994" source="CONFIRM" adv="1">https://support.cybozu.com/ja-jp/article/7994</ref>
      <ref url="http://jvndb.jvn.jp/jvndb/JVNDB-2014-000023" source="JVNDB">JVNDB-2014-000023</ref>
      <ref url="http://jvn.jp/en/jp/JVN26393529/index.html" source="JVN">JVN#26393529</ref>
      <ref url="http://cs.cybozu.co.jp/information/gr20140225up05.php" source="CONFIRM" adv="1">http://cs.cybozu.co.jp/information/gr20140225up05.php</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cybozu" name="garoon">
        <vers num="2.0" edition="sp1"/>
        <vers num="2.0" edition="sp2"/>
        <vers num="2.0" edition="sp3"/>
        <vers num="2.0" edition="sp4"/>
        <vers num="2.0" edition="sp5"/>
        <vers num="2.0" edition="sp6"/>
        <vers num="2.0.0"/>
        <vers num="2.0.1"/>
        <vers num="2.0.2"/>
        <vers num="2.0.3"/>
        <vers num="2.0.4"/>
        <vers num="2.0.5"/>
        <vers num="2.0.6"/>
        <vers num="2.1" edition="sp1"/>
        <vers num="2.1" edition="sp2"/>
        <vers num="2.1" edition="sp3"/>
        <vers num="2.1.0"/>
        <vers num="2.1.1"/>
        <vers num="2.1.2"/>
        <vers num="2.1.3"/>
        <vers num="2.5" edition="sp1"/>
        <vers num="2.5" edition="sp2"/>
        <vers num="2.5" edition="sp3"/>
        <vers num="2.5" edition="sp4"/>
        <vers num="2.5.0"/>
        <vers num="2.5.1"/>
        <vers num="2.5.2"/>
        <vers num="2.5.3"/>
        <vers num="2.5.4"/>
        <vers num="3.0" edition="sp1"/>
        <vers num="3.0" edition="sp2"/>
        <vers num="3.0" edition="sp3"/>
        <vers num="3.1" edition="sp1"/>
        <vers num="3.1" edition="sp2"/>
        <vers num="3.1" edition="sp3"/>
        <vers num="3.5" edition="sp1"/>
        <vers num="3.5" edition="sp2"/>
        <vers num="3.5" edition="sp3"/>
        <vers num="3.5" edition="sp4"/>
        <vers num="3.5" edition="sp5"/>
        <vers num="3.5.3"/>
        <vers num="3.7" edition="sp1"/>
        <vers num="3.7" edition="sp2"/>
        <vers num="3.7" edition="sp3"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0821" published="2014-02-26" name="CVE-2014-0821" modified="2014-03-07" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:P/I:P/A:P)" CVSS_score="6.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.0" CVSS_base_score="6.5">
    <desc>
      <descript source="cve">SQL injection vulnerability in the download feature in Cybozu Garoon 2.x through 2.5.4 and 3.x through 3.7 SP3 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, a different vulnerability than CVE-2013-6930 and CVE-2013-6931.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://support.cybozu.com/ja-jp/article/7993" source="CONFIRM" adv="1">https://support.cybozu.com/ja-jp/article/7993</ref>
      <ref url="http://jvndb.jvn.jp/jvndb/JVNDB-2014-000024" source="JVNDB">JVNDB-2014-000024</ref>
      <ref url="http://jvn.jp/en/jp/JVN71045461/index.html" source="JVN">JVN#71045461</ref>
      <ref url="http://cs.cybozu.co.jp/information/gr20140225up04.php" source="CONFIRM" adv="1">http://cs.cybozu.co.jp/information/gr20140225up04.php</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cybozu" name="garoon">
        <vers num="2.0" edition="sp1"/>
        <vers num="2.0" edition="sp2"/>
        <vers num="2.0" edition="sp3"/>
        <vers num="2.0" edition="sp4"/>
        <vers num="2.0" edition="sp5"/>
        <vers num="2.0" edition="sp6"/>
        <vers num="2.0.0"/>
        <vers num="2.0.1"/>
        <vers num="2.0.2"/>
        <vers num="2.0.3"/>
        <vers num="2.0.4"/>
        <vers num="2.0.5"/>
        <vers num="2.0.6"/>
        <vers num="2.1" edition="sp1"/>
        <vers num="2.1" edition="sp2"/>
        <vers num="2.1" edition="sp3"/>
        <vers num="2.1.0"/>
        <vers num="2.1.1"/>
        <vers num="2.1.2"/>
        <vers num="2.1.3"/>
        <vers num="2.5" edition="sp1"/>
        <vers num="2.5" edition="sp2"/>
        <vers num="2.5" edition="sp3"/>
        <vers num="2.5" edition="sp4"/>
        <vers num="2.5.0"/>
        <vers num="2.5.1"/>
        <vers num="2.5.2"/>
        <vers num="2.5.3"/>
        <vers num="2.5.4"/>
        <vers num="3.0" edition="sp1"/>
        <vers num="3.0" edition="sp2"/>
        <vers num="3.0" edition="sp3"/>
        <vers num="3.1" edition="sp1"/>
        <vers num="3.1" edition="sp2"/>
        <vers num="3.1" edition="sp3"/>
        <vers num="3.5" edition="sp1"/>
        <vers num="3.5" edition="sp2"/>
        <vers num="3.5" edition="sp3"/>
        <vers num="3.5" edition="sp4"/>
        <vers num="3.5" edition="sp5"/>
        <vers num="3.5.3"/>
        <vers num="3.7" edition="sp1"/>
        <vers num="3.7" edition="sp2"/>
        <vers num="3.7" edition="sp3"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0822" published="2014-02-06" name="CVE-2014-0822" modified="2014-02-07" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:C)" CVSS_score="7.8" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="10.0" CVSS_base_score="7.8">
    <desc>
      <descript source="cve">The IMAP server in IBM Domino 8.5.x before 8.5.3 FP6 IF1 and 9.0.x before 9.0.1 FP1 allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors, aka SPR KLYH9F4S2Z.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90235" source="XF">ibm-domino-cve20140822-dos(90235)</ref>
      <ref url="http://www-01.ibm.com/support/docview.wss?uid=swg21663023" source="CONFIRM" adv="1">http://www-01.ibm.com/support/docview.wss?uid=swg21663023</ref>
    </refs>
    <vuln_soft>
      <prod vendor="ibm" name="lotus_domino_server">
        <vers num="8.5.3.0"/>
        <vers num="8.5.3.1"/>
        <vers num="8.5.3.2"/>
        <vers num="8.5.3.3"/>
        <vers num="8.5.3.4"/>
        <vers num="8.5.3.5"/>
        <vers num="9.0.0.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0823" published="2014-05-01" name="CVE-2014-0823" modified="2014-05-02" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:N/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">IBM WebSphere Application Server (WAS) 8.x before 8.0.0.9 and 8.5.x before 8.5.5.2 allows remote attackers to read arbitrary files via a crafted URL.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90498" source="XF">ibm-was-cve20140823-viewfiles(90498)</ref>
      <ref url="http://www-01.ibm.com/support/docview.wss?uid=swg21669554" source="CONFIRM" adv="1">http://www-01.ibm.com/support/docview.wss?uid=swg21669554</ref>
      <ref url="http://www-01.ibm.com/support/docview.wss?uid=swg1PI05324" source="AIXAPAR">PI05324</ref>
    </refs>
    <vuln_soft>
      <prod vendor="ibm" name="websphere_application_server">
        <vers num="8.0.0.0"/>
        <vers num="8.0.0.1"/>
        <vers num="8.0.0.2"/>
        <vers num="8.0.0.3"/>
        <vers num="8.0.0.4"/>
        <vers num="8.0.0.5"/>
        <vers num="8.0.0.6"/>
        <vers num="8.0.0.7"/>
        <vers num="8.0.0.8"/>
        <vers num="8.5.0.0"/>
        <vers num="8.5.0.1"/>
        <vers num="8.5.0.2"/>
        <vers num="8.5.5.0"/>
        <vers num="8.5.5.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0827" published="2014-04-05" name="CVE-2014-0827" modified="2014-04-07" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in IBM InfoSphere Optim Workload Replay 1.1 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90503" source="XF">ibm-infosphere-cve20140827-xss(90503)</ref>
      <ref url="http://www-01.ibm.com/support/docview.wss?uid=swg21669093" source="CONFIRM" adv="1">http://www-01.ibm.com/support/docview.wss?uid=swg21669093</ref>
    </refs>
    <vuln_soft>
      <prod vendor="ibm" name="optim_workload_replay">
        <vers num="1.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0828" published="2014-04-01" name="CVE-2014-0828" modified="2014-04-02" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in the WCM (Web Content Manager) UI in IBM WebSphere Portal 6.1.0.x through 6.1.0.6 CF27, 6.1.5.x through 6.1.5.3 CF27, 7.0.0.x through 7.0.0.2 CF27, and 8.0.0.x before 8.0.0.1 CF11 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90566" source="XF">ibm-wsportal-cve20140828-wcm-xss(90566)</ref>
      <ref url="http://www-01.ibm.com/support/docview.wss?uid=swg21667016" source="CONFIRM" adv="1">http://www-01.ibm.com/support/docview.wss?uid=swg21667016</ref>
      <ref url="http://www-01.ibm.com/support/docview.wss?uid=swg1PI10734" source="AIXAPAR">PI10734</ref>
    </refs>
    <vuln_soft>
      <prod vendor="ibm" name="websphere_portal">
        <vers num="6.1.0.0"/>
        <vers num="6.1.0.1"/>
        <vers num="6.1.0.2"/>
        <vers num="6.1.0.3"/>
        <vers num="6.1.0.4"/>
        <vers num="6.1.0.5"/>
        <vers num="6.1.0.6"/>
        <vers num="6.1.5.0"/>
        <vers num="6.1.5.1"/>
        <vers num="6.1.5.2"/>
        <vers num="6.1.5.3"/>
        <vers num="7.0.0.0"/>
        <vers num="7.0.0.1"/>
        <vers num="7.0.0.2"/>
        <vers num="8.0.0.0"/>
        <vers num="8.0.0.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0829" published="2014-03-21" name="CVE-2014-0829" modified="2014-03-24" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:P/I:P/A:P)" CVSS_score="6.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.0" CVSS_base_score="6.5">
    <desc>
      <descript source="cve">Multiple buffer overflows in IBM Rational ClearCase 7.x before 7.1.2.13, 8.0.0.x before 8.0.0.10, and 8.0.1.x before 8.0.1.3 allow remote authenticated users to obtain privileged access via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www-01.ibm.com/support/docview.wss?&amp;uid=swg21662086" source="CONFIRM" patch="1" adv="1">http://www-01.ibm.com/support/docview.wss?&amp;uid=swg21662086</ref>
      <ref url="http://xforce.iss.net/xforce/xfdb/90568" source="XF">ibm-clearcase-cve20140829-bo(90568)</ref>
    </refs>
    <vuln_soft>
      <prod vendor="ibm" name="rational_clearcase">
        <vers num="7.0.0.3"/>
        <vers num="7.0.0.4"/>
        <vers num="7.0.0.5"/>
        <vers num="7.0.0.6"/>
        <vers num="7.0.0.7"/>
        <vers num="7.0.0.8"/>
        <vers num="7.0.0.9"/>
        <vers num="7.0.1"/>
        <vers num="7.0.1.1"/>
        <vers num="7.0.1.10"/>
        <vers num="7.0.1.11"/>
        <vers num="7.0.1.2"/>
        <vers num="7.0.1.3"/>
        <vers num="7.0.1.4"/>
        <vers num="7.0.1.5"/>
        <vers num="7.0.1.6"/>
        <vers num="7.0.1.7"/>
        <vers num="7.0.1.8"/>
        <vers num="7.0.1.9"/>
        <vers num="7.1"/>
        <vers num="7.1.0.1"/>
        <vers num="7.1.0.2"/>
        <vers num="7.1.1"/>
        <vers num="7.1.1.1"/>
        <vers num="7.1.1.2"/>
        <vers num="7.1.1.3"/>
        <vers num="7.1.1.4"/>
        <vers num="7.1.1.5"/>
        <vers num="7.1.1.6"/>
        <vers num="7.1.1.7"/>
        <vers num="7.1.1.8"/>
        <vers num="7.1.1.9"/>
        <vers num="7.1.2"/>
        <vers num="7.1.2.1"/>
        <vers num="7.1.2.10"/>
        <vers num="7.1.2.11"/>
        <vers num="7.1.2.12"/>
        <vers num="7.1.2.2"/>
        <vers num="7.1.2.3"/>
        <vers num="7.1.2.4"/>
        <vers num="7.1.2.5"/>
        <vers num="7.1.2.6"/>
        <vers num="7.1.2.7"/>
        <vers num="7.1.2.9"/>
        <vers num="8.0"/>
        <vers num="8.0.0"/>
        <vers num="8.0.0.1"/>
        <vers num="8.0.0.2"/>
        <vers num="8.0.0.3"/>
        <vers num="8.0.0.4"/>
        <vers num="8.0.0.5"/>
        <vers num="8.0.0.6"/>
        <vers num="8.0.0.7"/>
        <vers num="8.0.0.8"/>
        <vers num="8.0.0.9"/>
        <vers num="8.0.1"/>
        <vers num="8.0.1.1"/>
        <vers num="8.0.1.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0830" published="2014-02-01" name="CVE-2014-0830" modified="2014-02-03" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:P/I:N/A:N)" CVSS_score="4.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.0" CVSS_base_score="4.0">
    <desc>
      <descript source="cve">Directory traversal vulnerability in the table-export implementation in the OAC component in IBM Financial Transaction Manager (FTM) 2.0 before 2.0.0.3 and 2.1 before 2.1.0.1 allows remote authenticated users to read arbitrary files via a modified pathname.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90584" source="XF">ibm-ftm-cve20140830-trav(90584)</ref>
      <ref url="http://www-01.ibm.com/support/docview.wss?uid=swg21662714" source="CONFIRM" adv="1">http://www-01.ibm.com/support/docview.wss?uid=swg21662714</ref>
    </refs>
    <vuln_soft>
      <prod vendor="ibm" name="financial_transaction_manager">
        <vers num="2.0.0.0"/>
        <vers num="2.0.0.1"/>
        <vers num="2.0.0.2"/>
        <vers num="2.1.0.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0831" published="2014-02-01" name="CVE-2014-0831" modified="2014-02-03" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:P)" CVSS_score="6.8" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.6" CVSS_base_score="6.8">
    <desc>
      <descript source="cve">Cross-site request forgery (CSRF) vulnerability in the OAC component in IBM Financial Transaction Manager (FTM) 2.0 before 2.0.0.3 allows remote attackers to hijack the authentication of arbitrary users for requests that modify configuration data.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90585" source="XF">ibm-ftm-cve20140831-csrf(90585)</ref>
      <ref url="http://www-01.ibm.com/support/docview.wss?uid=swg21662714" source="CONFIRM" adv="1">http://www-01.ibm.com/support/docview.wss?uid=swg21662714</ref>
    </refs>
    <vuln_soft>
      <prod vendor="ibm" name="financial_transaction_manager">
        <vers num="2.0.0.0"/>
        <vers num="2.0.0.1"/>
        <vers num="2.0.0.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-0832" published="2014-02-01" name="CVE-2014-0832" modified="2014-02-03" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:S/C:N/I:P/A:N)" CVSS_score="3.5" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="6.8" CVSS_base_score="3.5">
    <desc>
      <descript source="cve">Multiple cross-site scripting (XSS) vulnerabilities in configuration-details screens in the OAC component in IBM Financial Transaction Manager (FTM) 2.0 before 2.0.0.3 allow remote authenticated users to inject arbitrary web script or HTML via a crafted text value.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90586" source="XF">ibm-ftm-cve20140832-xss(90586)</ref>
      <ref url="http://www-01.ibm.com/support/docview.wss?uid=swg21662714" source="CONFIRM" adv="1">http://www-01.ibm.com/support/docview.wss?uid=swg21662714</ref>
    </refs>
    <vuln_soft>
      <prod vendor="ibm" name="financial_transaction_manager">
        <vers num="2.0.0.0"/>
        <vers num="2.0.0.1"/>
        <vers num="2.0.0.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0833" published="2014-02-01" name="CVE-2014-0833" modified="2014-02-03" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:P/I:P/A:N)" CVSS_score="5.5" CVSS_impact_subscore="4.9" CVSS_exploit_subscore="8.0" CVSS_base_score="5.5">
    <desc>
      <descript source="cve">The OAC component in IBM Financial Transaction Manager (FTM) 2.0 before 2.0.0.3 does not properly enforce operator-intervention requirements, which allows remote authenticated users to bypass intended access restrictions via an unspecified process step.</descript>
    </desc>
    <loss_types>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90612" source="XF">ibm-ftm-cve20140833-auth(90612)</ref>
      <ref url="http://www-01.ibm.com/support/docview.wss?uid=swg21662714" source="CONFIRM" adv="1">http://www-01.ibm.com/support/docview.wss?uid=swg21662714</ref>
    </refs>
    <vuln_soft>
      <prod vendor="ibm" name="financial_transaction_manager">
        <vers num="2.0.0.0"/>
        <vers num="2.0.0.1"/>
        <vers num="2.0.0.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0834" published="2014-02-04" name="CVE-2014-0834" modified="2014-02-06" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:N/I:N/A:P)" CVSS_score="4.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.0" CVSS_base_score="4.0">
    <desc>
      <descript source="cve">IBM General Parallel File System (GPFS) 3.4 through 3.4.0.27 and 3.5 through 3.5.0.16 allows attackers to cause a denial of service (daemon crash) via crafted arguments to a setuid program.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90647" source="XF">ibm-gpfs-cve20140834-dos(90647)</ref>
      <ref url="http://www.securityfocus.com/bid/65297" source="BID">65297</ref>
      <ref url="http://www-01.ibm.com/support/docview.wss?uid=swg1IV54381" source="AIXAPAR" adv="1">IV54381</ref>
      <ref url="http://www-01.ibm.com/support/docview.wss?uid=swg1IV52863" source="AIXAPAR" adv="1">IV52863</ref>
      <ref url="http://www-01.ibm.com/support/docview.wss?uid=isg3T1020542" source="CONFIRM" adv="1">http://www-01.ibm.com/support/docview.wss?uid=isg3T1020542</ref>
      <ref url="http://osvdb.org/102765" source="OSVDB">102765</ref>
    </refs>
    <vuln_soft>
      <prod vendor="ibm" name="general_parallel_file_system">
        <vers num="3.4.0.0"/>
        <vers num="3.4.0.10"/>
        <vers num="3.4.0.11"/>
        <vers num="3.4.0.12"/>
        <vers num="3.4.0.13"/>
        <vers num="3.4.0.14"/>
        <vers num="3.4.0.15"/>
        <vers num="3.4.0.16"/>
        <vers num="3.4.0.17"/>
        <vers num="3.4.0.18"/>
        <vers num="3.4.0.19"/>
        <vers num="3.4.0.2"/>
        <vers num="3.4.0.20"/>
        <vers num="3.4.0.21"/>
        <vers num="3.4.0.22"/>
        <vers num="3.4.0.23"/>
        <vers num="3.4.0.24"/>
        <vers num="3.4.0.25"/>
        <vers num="3.4.0.26"/>
        <vers num="3.4.0.27"/>
        <vers num="3.4.0.3"/>
        <vers num="3.4.0.4"/>
        <vers num="3.4.0.5"/>
        <vers num="3.4.0.6"/>
        <vers num="3.4.0.7"/>
        <vers num="3.4.0.8"/>
        <vers num="3.4.0.9"/>
        <vers num="3.5.0.0"/>
        <vers num="3.5.0.10"/>
        <vers num="3.5.0.11"/>
        <vers num="3.5.0.12"/>
        <vers num="3.5.0.13"/>
        <vers num="3.5.0.14"/>
        <vers num="3.5.0.15"/>
        <vers num="3.5.0.16"/>
        <vers num="3.5.0.2"/>
        <vers num="3.5.0.3"/>
        <vers num="3.5.0.4"/>
        <vers num="3.5.0.6"/>
        <vers num="3.5.0.7"/>
        <vers num="3.5.0.8"/>
        <vers num="3.5.0.9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0835" published="2014-01-30" name="CVE-2014-0835" modified="2014-02-11" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:P)" CVSS_score="6.8" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.6" CVSS_base_score="6.8">
    <desc>
      <descript source="cve">Cross-site request forgery (CSRF) vulnerability in IBM Security QRadar SIEM 7.2 MR1 and earlier allows remote attackers to hijack the authentication of administrators for requests that modify console Auto Update settings.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90678" source="XF">ibm-qradar-cve20140835-csrf(90678)</ref>
      <ref url="http://www.securityfocus.com/bid/65127" source="BID">65127</ref>
      <ref url="http://www-01.ibm.com/support/docview.wss?uid=swg21663066" source="CONFIRM" adv="1">http://www-01.ibm.com/support/docview.wss?uid=swg21663066</ref>
      <ref url="http://thomaspollet.blogspot.be/2014/01/ibm-qradar-siem-csrf-xss-mitm-rce.html" source="MISC">http://thomaspollet.blogspot.be/2014/01/ibm-qradar-siem-csrf-xss-mitm-rce.html</ref>
      <ref url="http://secunia.com/advisories/56653" source="SECUNIA">56653</ref>
      <ref url="http://seclists.org/fulldisclosure/2014/Jan/166" source="FULLDISC">20140124 ADV: IBM QRadar SIEM</ref>
      <ref url="http://osvdb.org/102554" source="OSVDB">102554</ref>
    </refs>
    <vuln_soft>
      <prod vendor="ibm" name="qradar_security_information_and_event_manager">
        <vers prev="1" num="7.2.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0836" published="2014-01-30" name="CVE-2014-0836" modified="2014-02-11" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in IBM Security QRadar SIEM 7.2 MR1 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted URL.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90679" source="XF">ibm-qradar-cve20140836-xss(90679)</ref>
      <ref url="http://www.securityfocus.com/bid/65127" source="BID">65127</ref>
      <ref url="http://www-01.ibm.com/support/docview.wss?uid=swg21663066" source="CONFIRM" adv="1">http://www-01.ibm.com/support/docview.wss?uid=swg21663066</ref>
      <ref url="http://secunia.com/advisories/56653" source="SECUNIA">56653</ref>
      <ref url="http://seclists.org/fulldisclosure/2014/Jan/166" source="FULLDISC">20140124 ADV: IBM QRadar SIEM</ref>
      <ref url="http://osvdb.org/102555" source="OSVDB">102555</ref>
    </refs>
    <vuln_soft>
      <prod vendor="ibm" name="qradar_security_information_and_event_manager">
        <vers prev="1" num="7.2.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0837" published="2014-01-30" name="CVE-2014-0837" modified="2014-02-11" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">The AutoUpdate process in IBM Security QRadar SIEM 7.2 MR1 and earlier does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers via a crafted certificate.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90680" source="XF">ibm-qradar-cve20140837-mitm(90680)</ref>
      <ref url="http://www.securityfocus.com/bid/65127" source="BID">65127</ref>
      <ref url="http://www-01.ibm.com/support/docview.wss?uid=swg21663066" source="CONFIRM" adv="1">http://www-01.ibm.com/support/docview.wss?uid=swg21663066</ref>
      <ref url="http://secunia.com/advisories/56653" source="SECUNIA">56653</ref>
      <ref url="http://seclists.org/fulldisclosure/2014/Jan/166" source="FULLDISC">20140124 ADV: IBM QRadar SIEM</ref>
      <ref url="http://osvdb.org/102552" source="OSVDB">102552</ref>
    </refs>
    <vuln_soft>
      <prod vendor="ibm" name="qradar_security_information_and_event_manager">
        <vers prev="1" num="7.2.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0838" published="2014-01-30" name="CVE-2014-0838" modified="2014-02-06" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">The AutoUpdate package before 6.4 for IBM Security QRadar SIEM 7.2 MR1 and earlier allows remote attackers to execute arbitrary console commands by leveraging control of the server.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90681" source="XF">ibm-qradar-cve20140838-command-exec(90681)</ref>
      <ref url="http://www.securityfocus.com/bid/65127" source="BID">65127</ref>
      <ref url="http://www-01.ibm.com/support/docview.wss?uid=swg21663066" source="CONFIRM" adv="1">http://www-01.ibm.com/support/docview.wss?uid=swg21663066</ref>
      <ref url="http://osvdb.org/102553" source="OSVDB">102553</ref>
    </refs>
    <vuln_soft>
      <prod vendor="ibm" name="qradar_security_information_and_event_manager">
        <vers prev="1" num="7.2.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0839" published="2014-02-25" name="CVE-2014-0839" modified="2014-02-26" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:N/I:P/A:N)" CVSS_score="4.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.0" CVSS_base_score="4.0">
    <desc>
      <descript source="cve">IBM Rational Focal Point 6.4.x and 6.5.x before 6.5.2.3 and 6.6.x before 6.6.1 allows remote authenticated users to modify data via vectors involving a direct object reference.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www-01.ibm.com/support/docview.wss?uid=swg21665005" source="CONFIRM" patch="1" adv="1">http://www-01.ibm.com/support/docview.wss?uid=swg21665005</ref>
      <ref url="http://xforce.iss.net/xforce/xfdb/90696" source="XF">ibm-focalpoint-cve20140839-sec-bypass(90696)</ref>
    </refs>
    <vuln_soft>
      <prod vendor="ibm" name="rational_focal_point">
        <vers num="6.4"/>
        <vers num="6.4.0.1"/>
        <vers num="6.4.1.0"/>
        <vers num="6.4.1.1"/>
        <vers num="6.4.1.2"/>
        <vers num="6.4.1.3"/>
        <vers num="6.5"/>
        <vers num="6.5.0.1"/>
        <vers num="6.5.0.2"/>
        <vers num="6.5.1"/>
        <vers num="6.5.1.1"/>
        <vers num="6.5.2"/>
        <vers num="6.5.2.1"/>
        <vers num="6.5.2.2"/>
        <vers num="6.5.2.3"/>
        <vers num="6.6"/>
        <vers num="6.6.0.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-0840" published="2014-02-25" name="CVE-2014-0840" modified="2014-02-26" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:S/C:N/I:P/A:N)" CVSS_score="3.5" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="6.8" CVSS_base_score="3.5">
    <desc>
      <descript source="cve">Multiple cross-site scripting (XSS) vulnerabilities in IBM Rational Focal Point 6.4.x and 6.5.x before 6.5.2.3 and 6.6.x before 6.6.1 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://www-01.ibm.com/support/docview.wss?uid=swg21665005" source="CONFIRM" patch="1" adv="1">http://www-01.ibm.com/support/docview.wss?uid=swg21665005</ref>
      <ref url="http://xforce.iss.net/xforce/xfdb/90698" source="XF">ibm-focalpoint-cve20140840-xss(90698)</ref>
    </refs>
    <vuln_soft>
      <prod vendor="ibm" name="rational_focal_point">
        <vers num="6.4"/>
        <vers num="6.4.0.1"/>
        <vers num="6.4.1.0"/>
        <vers num="6.4.1.1"/>
        <vers num="6.4.1.2"/>
        <vers num="6.4.1.3"/>
        <vers num="6.5"/>
        <vers num="6.5.0.1"/>
        <vers num="6.5.0.2"/>
        <vers num="6.5.1"/>
        <vers num="6.5.1.1"/>
        <vers num="6.5.2"/>
        <vers num="6.5.2.1"/>
        <vers num="6.5.2.2"/>
        <vers num="6.5.2.3"/>
        <vers num="6.6"/>
        <vers num="6.6.0.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0842" published="2014-02-25" name="CVE-2014-0842" modified="2014-02-26" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:N/A:N)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">The account-creation functionality in IBM Rational Focal Point 6.4.x and 6.5.x before 6.5.2.3 and 6.6.x before 6.6.1 places the new user's default password within the creation page, which allows remote attackers to obtain sensitive information by reading the HTML source code.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www-01.ibm.com/support/docview.wss?uid=swg21665005" source="CONFIRM" patch="1" adv="1">http://www-01.ibm.com/support/docview.wss?uid=swg21665005</ref>
      <ref url="http://xforce.iss.net/xforce/xfdb/90706" source="XF">ibm-focalpoint-cve20140842-default-pw(90706)</ref>
    </refs>
    <vuln_soft>
      <prod vendor="ibm" name="rational_focal_point">
        <vers num="6.4"/>
        <vers num="6.4.0.1"/>
        <vers num="6.4.1.0"/>
        <vers num="6.4.1.1"/>
        <vers num="6.4.1.2"/>
        <vers num="6.4.1.3"/>
        <vers num="6.5"/>
        <vers num="6.5.0.1"/>
        <vers num="6.5.0.2"/>
        <vers num="6.5.1"/>
        <vers num="6.5.1.1"/>
        <vers num="6.5.2"/>
        <vers num="6.5.2.1"/>
        <vers num="6.5.2.2"/>
        <vers num="6.5.2.3"/>
        <vers num="6.6"/>
        <vers num="6.6.0.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-0843" published="2014-02-25" name="CVE-2014-0843" modified="2014-02-26" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:S/C:N/I:P/A:N)" CVSS_score="3.5" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="6.8" CVSS_base_score="3.5">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in IBM Rational Focal Point 6.4.x and 6.5.x before 6.5.2.3 and 6.6.x before 6.6.1 allows remote authenticated users to inject arbitrary web script or HTML by uploading a file.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://www-01.ibm.com/support/docview.wss?uid=swg21665005" source="CONFIRM" patch="1" adv="1">http://www-01.ibm.com/support/docview.wss?uid=swg21665005</ref>
      <ref url="http://xforce.iss.net/xforce/xfdb/90714" source="XF">ibm-focalpoint-cve20140843-file-upload(90714)</ref>
    </refs>
    <vuln_soft>
      <prod vendor="ibm" name="rational_focal_point">
        <vers num="6.4"/>
        <vers num="6.4.0.1"/>
        <vers num="6.4.1.0"/>
        <vers num="6.4.1.1"/>
        <vers num="6.4.1.2"/>
        <vers num="6.4.1.3"/>
        <vers num="6.5"/>
        <vers num="6.5.0.1"/>
        <vers num="6.5.0.2"/>
        <vers num="6.5.1"/>
        <vers num="6.5.1.1"/>
        <vers num="6.5.2"/>
        <vers num="6.5.2.1"/>
        <vers num="6.5.2.2"/>
        <vers num="6.5.2.3"/>
        <vers num="6.6"/>
        <vers num="6.6.0.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-0844" published="2014-03-04" name="CVE-2014-0844" modified="2014-03-05" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:S/C:P/I:N/A:N)" CVSS_score="3.5" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="6.8" CVSS_base_score="3.5">
    <desc>
      <descript source="cve">Unspecified vulnerability in IBM Rational Requirements Composer 3.x before 3.0.1.6 iFix2 and 4.x before 4.0.6, and Rational DOORS Next Generation 4.x before 4.0.6, allows remote authenticated users to read arbitrary data via unknown vectors.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90718" source="XF">ibm-rrc-cve20140844-retrieval(90718)</ref>
      <ref url="http://www-01.ibm.com/support/docview.wss?uid=swg21664412" source="CONFIRM" adv="1">http://www-01.ibm.com/support/docview.wss?uid=swg21664412</ref>
    </refs>
    <vuln_soft>
      <prod vendor="ibm" name="rational_doors_next_generation">
        <vers num="4.0.0"/>
        <vers num="4.0.1"/>
        <vers num="4.0.2"/>
        <vers num="4.0.3"/>
        <vers num="4.0.4"/>
        <vers num="4.0.5"/>
      </prod>
      <prod vendor="ibm" name="rational_requirements_composer">
        <vers num="3.0.1"/>
        <vers num="3.0.1.1"/>
        <vers num="3.0.1.2"/>
        <vers num="3.0.1.3"/>
        <vers num="3.0.1.4"/>
        <vers num="3.0.1.5"/>
        <vers num="3.0.1.6"/>
        <vers num="4.0.0"/>
        <vers num="4.0.0.1"/>
        <vers num="4.0.0.2"/>
        <vers num="4.0.1"/>
        <vers num="4.0.2"/>
        <vers num="4.0.3"/>
        <vers num="4.0.4"/>
        <vers num="4.0.5"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0845" published="2014-03-04" name="CVE-2014-0845" modified="2014-03-05" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:S/C:P/I:P/A:N)" CVSS_score="4.9" CVSS_impact_subscore="4.9" CVSS_exploit_subscore="6.8" CVSS_base_score="4.9">
    <desc>
      <descript source="cve">Open redirect vulnerability in IBM Rational Requirements Composer 3.x before 3.0.1.6 iFix2 and 4.x before 4.0.6, and Rational DOORS Next Generation 4.x before 4.0.6, allows remote authenticated users to redirect users to arbitrary web sites and conduct phishing attacks via a crafted URL.</descript>
    </desc>
    <loss_types>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90719" source="XF">ibm-rrc-cve20140845-redirect(90719)</ref>
      <ref url="http://www-01.ibm.com/support/docview.wss?uid=swg21664412" source="CONFIRM" adv="1">http://www-01.ibm.com/support/docview.wss?uid=swg21664412</ref>
    </refs>
    <vuln_soft>
      <prod vendor="ibm" name="rational_doors_next_generation">
        <vers num="4.0.0"/>
        <vers num="4.0.1"/>
        <vers num="4.0.2"/>
        <vers num="4.0.3"/>
        <vers num="4.0.4"/>
        <vers num="4.0.5"/>
      </prod>
      <prod vendor="ibm" name="rational_requirements_composer">
        <vers num="3.0.1"/>
        <vers num="3.0.1.1"/>
        <vers num="3.0.1.2"/>
        <vers num="3.0.1.3"/>
        <vers num="3.0.1.4"/>
        <vers num="3.0.1.5"/>
        <vers num="3.0.1.6"/>
        <vers num="4.0.0"/>
        <vers num="4.0.0.1"/>
        <vers num="4.0.0.2"/>
        <vers num="4.0.1"/>
        <vers num="4.0.2"/>
        <vers num="4.0.3"/>
        <vers num="4.0.4"/>
        <vers num="4.0.5"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-0846" published="2014-03-04" name="CVE-2014-0846" modified="2014-03-05" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:S/C:N/I:P/A:N)" CVSS_score="3.5" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="6.8" CVSS_base_score="3.5">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in IBM Rational Requirements Composer 3.x before 3.0.1.6 iFix2 and 4.x before 4.0.6, and Rational DOORS Next Generation 4.x before 4.0.6, allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90720" source="XF">ibm-rrc-cve20140846-xss(90720)</ref>
      <ref url="http://www-01.ibm.com/support/docview.wss?uid=swg21664412" source="CONFIRM" adv="1">http://www-01.ibm.com/support/docview.wss?uid=swg21664412</ref>
    </refs>
    <vuln_soft>
      <prod vendor="ibm" name="rational_doors_next_generation">
        <vers num="4.0.0"/>
        <vers num="4.0.1"/>
        <vers num="4.0.2"/>
        <vers num="4.0.3"/>
        <vers num="4.0.4"/>
        <vers num="4.0.5"/>
      </prod>
      <prod vendor="ibm" name="rational_requirements_composer">
        <vers num="3.0.1"/>
        <vers num="3.0.1.1"/>
        <vers num="3.0.1.2"/>
        <vers num="3.0.1.3"/>
        <vers num="3.0.1.4"/>
        <vers num="3.0.1.5"/>
        <vers num="3.0.1.6"/>
        <vers num="4.0.0"/>
        <vers num="4.0.0.1"/>
        <vers num="4.0.0.2"/>
        <vers num="4.0.1"/>
        <vers num="4.0.2"/>
        <vers num="4.0.3"/>
        <vers num="4.0.4"/>
        <vers num="4.0.5"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-0848" published="2014-03-26" name="CVE-2014-0848" modified="2014-03-26" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:S/C:P/I:N/A:N)" CVSS_score="3.5" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="6.8" CVSS_base_score="3.5">
    <desc>
      <descript source="cve">The (1) ssl.conf and (2) httpd.conf files in the Apache HTTP Server component in IBM Netezza Performance Portal 2.0 before 2.0.0.4 have weak SSLCipherSuite values, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via a brute-force attack.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90723" source="XF">ibm-netezza-cve20140848-weak-sec(90723)</ref>
      <ref url="http://www-01.ibm.com/support/docview.wss?uid=swg21665278" source="CONFIRM" adv="1">http://www-01.ibm.com/support/docview.wss?uid=swg21665278</ref>
    </refs>
    <vuln_soft>
      <prod vendor="ibm" name="netezza_performance_portal">
        <vers num="2.0.0.0"/>
        <vers num="2.0.0.1"/>
        <vers num="2.0.0.2"/>
        <vers num="2.0.0.3"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-0850" published="2014-03-16" name="CVE-2014-0850" modified="2014-03-17" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:S/C:N/I:P/A:N)" CVSS_score="3.5" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="6.8" CVSS_base_score="3.5">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in IBM InfoSphere Master Data Management Reference Data Management (RDM) Hub 10.1 and 11.0 before 11.0.0.0-MDM-IF008 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90751" source="XF">ibm-mdm-rdm-cve20140850-xss(90751)</ref>
      <ref url="http://www-01.ibm.com/support/docview.wss?uid=swg21666119" source="CONFIRM" adv="1">http://www-01.ibm.com/support/docview.wss?uid=swg21666119</ref>
    </refs>
    <vuln_soft>
      <prod vendor="ibm" name="infosphere_master_data_management_reference_data_management_hub">
        <vers num="10.1"/>
        <vers num="11.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-0853" published="2014-02-25" name="CVE-2014-0853" modified="2014-02-26" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:S/C:N/I:P/A:N)" CVSS_score="3.5" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="6.8" CVSS_base_score="3.5">
    <desc>
      <descript source="cve">Multiple cross-site scripting (XSS) vulnerabilities in the (1) ForwardController and (2) AttributeEditor scripts in IBM Rational Focal Point 6.4.x and 6.5.x before 6.5.2.3 and 6.6.x before 6.6.1 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://www-01.ibm.com/support/docview.wss?uid=swg21665005" source="CONFIRM" patch="1" adv="1">http://www-01.ibm.com/support/docview.wss?uid=swg21665005</ref>
      <ref url="http://xforce.iss.net/xforce/xfdb/90754" source="XF">ibm-focalpoint-cve20140853-xss(90754)</ref>
    </refs>
    <vuln_soft>
      <prod vendor="ibm" name="rational_focal_point">
        <vers num="6.4"/>
        <vers num="6.4.0.1"/>
        <vers num="6.4.1.0"/>
        <vers num="6.4.1.1"/>
        <vers num="6.4.1.2"/>
        <vers num="6.4.1.3"/>
        <vers num="6.5"/>
        <vers num="6.5.0.1"/>
        <vers num="6.5.0.2"/>
        <vers num="6.5.1"/>
        <vers num="6.5.1.1"/>
        <vers num="6.5.2"/>
        <vers num="6.5.2.1"/>
        <vers num="6.5.2.2"/>
        <vers num="6.5.2.3"/>
        <vers num="6.6"/>
        <vers num="6.6.0.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0854" published="2014-02-22" name="CVE-2014-0854" modified="2014-03-05" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:N/A:N)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">The server in IBM Cognos Business Intelligence (BI) 8.4.1, 10.1 before IF6, 10.1.1 before IF5, 10.2 before IF7, 10.2.1 before IF4, and 10.2.1.1 before IF4 allows remote authenticated users to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90794" source="XF">ibm-cognos-cve20140854-xxe(90794)</ref>
      <ref url="http://www-01.ibm.com/support/docview.wss?uid=swg21662856" source="CONFIRM" adv="1">http://www-01.ibm.com/support/docview.wss?uid=swg21662856</ref>
    </refs>
    <vuln_soft>
      <prod vendor="ibm" name="cognos_business_intelligence">
        <vers num="10.1"/>
        <vers num="10.1.1"/>
        <vers num="10.2"/>
        <vers num="10.2.1"/>
        <vers num="10.2.1.1"/>
        <vers num="8.4.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0855" published="2014-02-14" name="CVE-2014-0855" modified="2014-02-14" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Multiple cross-site scripting (XSS) vulnerabilities in IBM Connections Portlets 4.x before 4.5.1 FP1 for IBM WebSphere Portal 7.0.0.2 and 8.0.0.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90802" source="XF">ibm-websphere-cve20140855-xss(90802)</ref>
      <ref url="http://www-01.ibm.com/support/docview.wss?uid=swg21663921" source="CONFIRM" adv="1">http://www-01.ibm.com/support/docview.wss?uid=swg21663921</ref>
    </refs>
    <vuln_soft>
      <prod vendor="ibm" name="connections_portlets">
        <vers num="4.0"/>
        <vers num="4.5"/>
        <vers num="4.5.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0857" published="2014-05-01" name="CVE-2014-0857" modified="2014-05-02" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:P/I:N/A:N)" CVSS_score="4.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.0" CVSS_base_score="4.0">
    <desc>
      <descript source="cve">The Administrative Console in IBM WebSphere Application Server (WAS) 8.x before 8.0.0.9 and 8.5.x before 8.5.5.2 allows remote authenticated users to obtain sensitive information via a crafted request.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90863" source="XF">ibm-was-cve20140857-info-disc(90863)</ref>
      <ref url="http://www-01.ibm.com/support/docview.wss?uid=swg21669554" source="CONFIRM" adv="1">http://www-01.ibm.com/support/docview.wss?uid=swg21669554</ref>
      <ref url="http://www-01.ibm.com/support/docview.wss?uid=swg1PI07808" source="AIXAPAR">PI07808</ref>
    </refs>
    <vuln_soft>
      <prod vendor="ibm" name="websphere_application_server">
        <vers num="8.0.0.0"/>
        <vers num="8.0.0.1"/>
        <vers num="8.0.0.2"/>
        <vers num="8.0.0.3"/>
        <vers num="8.0.0.4"/>
        <vers num="8.0.0.5"/>
        <vers num="8.0.0.6"/>
        <vers num="8.0.0.7"/>
        <vers num="8.0.0.8"/>
        <vers num="8.5.0.0"/>
        <vers num="8.5.0.1"/>
        <vers num="8.5.0.2"/>
        <vers num="8.5.5.0"/>
        <vers num="8.5.5.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-0858" published="2014-02-27" name="CVE-2014-0858" modified="2014-02-28" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:S/C:N/I:P/A:N)" CVSS_score="3.5" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="6.8" CVSS_base_score="3.5">
    <desc>
      <descript source="cve">IBM Content Navigator 2.x before 2.0.2.2-ICN-FP002 allows remote authenticated users to bypass intended access restrictions and conduct deleteAction attacks via a modified URL.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90864" source="XF">ibm-navigator-cve20140858-xss(90864)</ref>
      <ref url="http://www-01.ibm.com/support/docview.wss?uid=swg21665358" source="CONFIRM" adv="1">http://www-01.ibm.com/support/docview.wss?uid=swg21665358</ref>
    </refs>
    <vuln_soft>
      <prod vendor="ibm" name="content_navigator">
        <vers num="2.0.0"/>
        <vers num="2.0.1"/>
        <vers num="2.0.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0859" published="2014-05-01" name="CVE-2014-0859" modified="2014-05-02" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:P)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">The web-server plugin in IBM WebSphere Application Server (WAS) 7.x before 7.0.0.33, 8.x before 8.0.0.9, and 8.5.x before 8.5.5.2, when POST retries are enabled, allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90879" source="XF">ibm-was-cve20140859-retry(90879)</ref>
      <ref url="http://www-01.ibm.com/support/docview.wss?uid=swg21669554" source="CONFIRM" adv="1">http://www-01.ibm.com/support/docview.wss?uid=swg21669554</ref>
      <ref url="http://www-01.ibm.com/support/docview.wss?uid=swg1PI08892" source="AIXAPAR">PI08892</ref>
    </refs>
    <vuln_soft>
      <prod vendor="ibm" name="websphere_application_server">
        <vers num="7.0"/>
        <vers num="7.0.0.1"/>
        <vers num="7.0.0.10"/>
        <vers num="7.0.0.11"/>
        <vers num="7.0.0.12"/>
        <vers num="7.0.0.13"/>
        <vers num="7.0.0.14"/>
        <vers num="7.0.0.15"/>
        <vers num="7.0.0.16"/>
        <vers num="7.0.0.17"/>
        <vers num="7.0.0.18"/>
        <vers num="7.0.0.19"/>
        <vers num="7.0.0.2"/>
        <vers num="7.0.0.21"/>
        <vers num="7.0.0.22"/>
        <vers num="7.0.0.23"/>
        <vers num="7.0.0.24"/>
        <vers num="7.0.0.25"/>
        <vers num="7.0.0.27"/>
        <vers num="7.0.0.29"/>
        <vers num="7.0.0.3"/>
        <vers num="7.0.0.31"/>
        <vers num="7.0.0.4"/>
        <vers num="7.0.0.5"/>
        <vers num="7.0.0.6"/>
        <vers num="7.0.0.7"/>
        <vers num="7.0.0.8"/>
        <vers num="7.0.0.9"/>
        <vers num="8.0.0.0"/>
        <vers num="8.0.0.1"/>
        <vers num="8.0.0.2"/>
        <vers num="8.0.0.3"/>
        <vers num="8.0.0.4"/>
        <vers num="8.0.0.5"/>
        <vers num="8.0.0.6"/>
        <vers num="8.0.0.7"/>
        <vers num="8.0.0.8"/>
        <vers num="8.5.0.0"/>
        <vers num="8.5.0.1"/>
        <vers num="8.5.0.2"/>
        <vers num="8.5.5.0"/>
        <vers num="8.5.5.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-0861" published="2014-02-22" name="CVE-2014-0861" modified="2014-03-05" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:S/C:N/I:P/A:N)" CVSS_score="3.5" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="6.8" CVSS_base_score="3.5">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in the server in IBM Cognos Business Intelligence (BI) 8.4.1, 10.1 before IF6, 10.1.1 before IF5, 10.2 before IF7, 10.2.1 before IF4, and 10.2.1.1 before IF4 allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter that is not properly handled during use of the Back button.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://www-01.ibm.com/support/docview.wss?uid=swg21662856" source="CONFIRM" adv="1">http://www-01.ibm.com/support/docview.wss?uid=swg21662856</ref>
    </refs>
    <vuln_soft>
      <prod vendor="ibm" name="cognos_business_intelligence">
        <vers num="10.1"/>
        <vers num="10.1.1"/>
        <vers num="10.2"/>
        <vers num="10.2.1"/>
        <vers num="10.2.1.1"/>
        <vers num="8.4.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0862" published="2014-03-01" name="CVE-2014-0862" modified="2014-03-03" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:C/I:C/A:C)" CVSS_score="10.0" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="10.0" CVSS_base_score="10.0">
    <desc>
      <descript source="cve">Unspecified vulnerability in Jazz Team Server in IBM Rational Collaborative Lifecycle Management (CLM) 3.x before 3.0.1.6 iFix 2 and 4.x before 4.0.6 allows remote attackers to execute arbitrary code via unknown vectors.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90895" source="XF">ibm-rationalclm-cve20140862-rce(90895)</ref>
      <ref url="http://www-01.ibm.com/support/docview.wss?uid=swg21664566" source="CONFIRM" adv="1">http://www-01.ibm.com/support/docview.wss?uid=swg21664566</ref>
    </refs>
    <vuln_soft>
      <prod vendor="ibm" name="rational_collaborative_lifecycle_management">
        <vers num="3.0.0"/>
        <vers num="3.0.1"/>
        <vers num="3.0.1.1"/>
        <vers num="3.0.1.2"/>
        <vers num="3.0.1.3"/>
        <vers num="3.0.1.4"/>
        <vers num="3.0.1.5"/>
        <vers num="3.0.1.6"/>
        <vers num="4.0.0"/>
        <vers num="4.0.1"/>
        <vers num="4.0.2"/>
        <vers num="4.0.3"/>
        <vers num="4.0.4"/>
        <vers num="4.0.5"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0873" published="2014-03-16" name="CVE-2014-0873" modified="2014-03-27" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:P)" CVSS_score="6.8" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.6" CVSS_base_score="6.8">
    <desc>
      <descript source="cve">Multiple cross-site request forgery (CSRF) vulnerabilities in the (1) Data Stewardship, (2) Business Admin, and (3) Product interfaces in IBM InfoSphere Master Data Management (MDM) Server 8.5 before 8.5.0.82, 9.0.1 before 9.0.1.38, 9.0.2 before 9.0.2.35, 10.0 before 10.0.0.0.26, and 10.1 before 10.1.0.0.15 allow remote attackers to hijack the authentication of arbitrary users.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90994" source="XF">ibm-infosphere-cve20140873-csrf(90994)</ref>
      <ref url="http://www-01.ibm.com/support/docview.wss?uid=swg21666462" source="CONFIRM" adv="1">http://www-01.ibm.com/support/docview.wss?uid=swg21666462</ref>
    </refs>
    <vuln_soft>
      <prod vendor="ibm" name="infosphere_master_data_management_server">
        <vers num="10.0"/>
        <vers num="10.1"/>
        <vers num="8.5"/>
        <vers num="9.0.1"/>
        <vers num="9.0.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-0874" published="2014-02-28" name="CVE-2014-0874" modified="2014-02-28" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:S/C:N/I:P/A:N)" CVSS_score="3.5" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="6.8" CVSS_base_score="3.5">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in IBM Content Navigator 2.x before 2.0.2.2-ICN-FP002 allows remote authenticated users to inject arbitrary web script or HTML via an unspecified parameter.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/91002" source="XF">ibm-cn-cve20140874-xss(91002)</ref>
      <ref url="http://www-01.ibm.com/support/docview.wss?uid=swg21665362" source="CONFIRM" adv="1">http://www-01.ibm.com/support/docview.wss?uid=swg21665362</ref>
    </refs>
    <vuln_soft>
      <prod vendor="ibm" name="content_navigator">
        <vers num="2.0.0"/>
        <vers num="2.0.1"/>
        <vers num="2.0.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0879" published="2014-03-21" name="CVE-2014-0879" modified="2014-03-24" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">Stack-based buffer overflow in the Taskmaster Capture ActiveX control in IBM Datacap Taskmaster Capture 8.0.1, and 8.1 before FP2, allows remote attackers to execute arbitrary code via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://www-01.ibm.com/support/docview.wss?uid=swg21666888" source="CONFIRM" patch="1" adv="1">http://www-01.ibm.com/support/docview.wss?uid=swg21666888</ref>
      <ref url="http://xforce.iss.net/xforce/xfdb/91115" source="XF">ibm-taskmaster-cve20140879-code-exec(91115)</ref>
    </refs>
    <vuln_soft>
      <prod vendor="ibm" name="datacap_taskmaster_capture">
        <vers num="8.0.1"/>
        <vers num="8.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0880" published="2014-03-28" name="CVE-2014-0880" modified="2014-03-31" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">IBM SAN Volume Controller; Storwize V3500, V3700, V5000, and V7000; and Flex System V7000 with software 6.3 and 6.4 before 6.4.1.8, and 7.1 and 7.2 before 7.2.0.3, allow remote attackers to obtain CLI access, and consequently cause a denial of service, via unspecified traffic to the administrative IP address.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/91145" source="XF">ibm-storwize-cve20140880-cli(91145)</ref>
      <ref url="http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004570" source="CONFIRM" adv="1">http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004570</ref>
    </refs>
    <vuln_soft>
      <prod vendor="ibm" name="flex_system_v7000_software">
        <vers num="6.4.1.2"/>
        <vers num="6.4.1.3"/>
        <vers num="6.4.1.4"/>
        <vers num="6.4.1.5"/>
        <vers num="6.4.1.6"/>
        <vers num="6.4.1.7"/>
        <vers num="7.1.0.1"/>
        <vers num="7.1.0.2"/>
        <vers num="7.1.0.3"/>
        <vers num="7.1.0.5"/>
        <vers num="7.1.0.6"/>
        <vers num="7.1.0.7"/>
        <vers num="7.2.0.0"/>
        <vers num="7.2.0.1"/>
        <vers num="7.2.0.2"/>
      </prod>
      <prod vendor="ibm" name="san_volume_controller_software">
        <vers num="6.1.0.0"/>
        <vers num="6.1.0.1"/>
        <vers num="6.1.0.10"/>
        <vers num="6.1.0.2"/>
        <vers num="6.1.0.3"/>
        <vers num="6.1.0.4"/>
        <vers num="6.1.0.5"/>
        <vers num="6.1.0.6"/>
        <vers num="6.1.0.7"/>
        <vers num="6.1.0.8"/>
        <vers num="6.1.0.9"/>
        <vers num="6.2.0.0"/>
        <vers num="6.2.0.1"/>
        <vers num="6.2.0.2"/>
        <vers num="6.2.0.3"/>
        <vers num="6.2.0.4"/>
        <vers num="6.2.0.5"/>
        <vers num="6.2.0.6"/>
        <vers num="6.3.0.0"/>
        <vers num="6.3.0.1"/>
        <vers num="6.3.0.2"/>
        <vers num="6.3.0.3"/>
        <vers num="6.3.0.4"/>
        <vers num="6.3.0.5"/>
        <vers num="6.3.0.6"/>
        <vers num="6.3.0.7"/>
        <vers num="6.4.0.0"/>
        <vers num="6.4.0.1"/>
        <vers num="6.4.0.2"/>
        <vers num="6.4.0.3"/>
        <vers num="6.4.0.4"/>
        <vers num="6.4.1.1"/>
        <vers num="6.4.1.2"/>
        <vers num="6.4.1.3"/>
        <vers num="6.4.1.4"/>
        <vers num="6.4.1.5"/>
        <vers num="6.4.1.6"/>
        <vers num="6.4.1.7"/>
        <vers num="7.1.0.0"/>
        <vers num="7.1.0.1"/>
        <vers num="7.1.0.2"/>
        <vers num="7.1.0.3"/>
        <vers num="7.1.0.5"/>
        <vers num="7.1.0.6"/>
        <vers num="7.1.0.7"/>
        <vers num="7.2.0.0"/>
        <vers num="7.2.0.1"/>
        <vers num="7.2.0.2"/>
      </prod>
      <prod vendor="ibm" name="storwize_v3500_software">
        <vers num="6.4.1.0"/>
        <vers num="6.4.1.1"/>
        <vers num="6.4.1.2"/>
        <vers num="6.4.1.3"/>
        <vers num="6.4.1.4"/>
        <vers num="6.4.1.5"/>
        <vers num="6.4.1.6"/>
        <vers num="6.4.1.7"/>
        <vers num="7.1.0.0"/>
        <vers num="7.1.0.1"/>
        <vers num="7.1.0.2"/>
        <vers num="7.1.0.3"/>
        <vers num="7.1.0.5"/>
        <vers num="7.1.0.6"/>
        <vers num="7.2.0.0"/>
        <vers num="7.2.0.1"/>
        <vers num="7.2.0.2"/>
      </prod>
      <prod vendor="ibm" name="storwize_v3700_software">
        <vers num="6.4.1.0"/>
        <vers num="6.4.1.1"/>
        <vers num="6.4.1.2"/>
        <vers num="6.4.1.3"/>
        <vers num="6.4.1.4"/>
        <vers num="6.4.1.5"/>
        <vers num="6.4.1.6"/>
        <vers num="6.4.1.7"/>
        <vers num="7.1.0.0"/>
        <vers num="7.1.0.1"/>
        <vers num="7.1.0.2"/>
        <vers num="7.1.0.3"/>
        <vers num="7.1.0.5"/>
        <vers num="7.1.0.6"/>
        <vers num="7.1.0.7"/>
        <vers num="7.2.0.0"/>
        <vers num="7.2.0.1"/>
        <vers num="7.2.0.2"/>
      </prod>
      <prod vendor="ibm" name="storwize_v5000_software">
        <vers num="7.1.0.2"/>
        <vers num="7.1.0.3"/>
        <vers num="7.1.0.4"/>
        <vers num="7.1.0.5"/>
        <vers num="7.1.0.6"/>
        <vers num="7.1.0.7"/>
        <vers num="7.2.0.0"/>
        <vers num="7.2.0.1"/>
        <vers num="7.2.0.2"/>
      </prod>
      <prod vendor="ibm" name="storwize_v7000_software">
        <vers num="6.3.0.0"/>
        <vers num="6.3.0.1"/>
        <vers num="6.3.0.2"/>
        <vers num="6.3.0.3"/>
        <vers num="6.3.0.4"/>
        <vers num="6.3.0.5"/>
        <vers num="6.3.0.6"/>
        <vers num="6.3.0.7"/>
        <vers num="6.4.0.0"/>
        <vers num="6.4.0.1"/>
        <vers num="6.4.0.2"/>
        <vers num="6.4.0.3"/>
        <vers num="6.4.0.4"/>
        <vers num="6.4.1.1"/>
        <vers num="6.4.1.2"/>
        <vers num="6.4.1.3"/>
        <vers num="6.4.1.4"/>
        <vers num="6.4.1.5"/>
        <vers num="6.4.1.6"/>
        <vers num="6.4.1.7"/>
        <vers num="7.1.0.0"/>
        <vers num="7.1.0.1"/>
        <vers num="7.1.0.2"/>
        <vers num="7.1.0.3"/>
        <vers num="7.1.0.5"/>
        <vers num="7.1.0.6"/>
        <vers num="7.1.0.7"/>
        <vers num="7.2.0.0"/>
        <vers num="7.2.0.1"/>
        <vers num="7.2.0.2"/>
      </prod>
      <prod vendor="ibm" name="flex_system_v7000">
        <vers num="-"/>
      </prod>
      <prod vendor="ibm" name="san_volume_controller">
        <vers num="-"/>
      </prod>
      <prod vendor="ibm" name="storwize_v3500">
        <vers num="-"/>
      </prod>
      <prod vendor="ibm" name="storwize_v3700">
        <vers num="-"/>
      </prod>
      <prod vendor="ibm" name="storwize_v5000">
        <vers num="-"/>
      </prod>
      <prod vendor="ibm" name="storwize_v7000">
        <vers num="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-0884" published="2014-03-25" name="CVE-2014-0884" modified="2014-03-26" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:S/C:N/I:P/A:N)" CVSS_score="3.5" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="6.8" CVSS_base_score="3.5">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in the Admin Web UI in IBM Lotus Protector for Mail Security 2.8.x before 2.8.1-22905 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/91170" source="XF">ibm-lpms-cve20140884-xss(91170)</ref>
      <ref url="http://www-01.ibm.com/support/docview.wss?uid=swg21668124" source="CONFIRM" adv="1">http://www-01.ibm.com/support/docview.wss?uid=swg21668124</ref>
    </refs>
    <vuln_soft>
      <prod vendor="ibm" name="lotus_protector_for_mail_security">
        <vers num="2.8"/>
        <vers num="2.8.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0885" published="2014-03-25" name="CVE-2014-0885" modified="2014-03-26" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:P)" CVSS_score="6.8" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.6" CVSS_base_score="6.8">
    <desc>
      <descript source="cve">Cross-site request forgery (CSRF) vulnerability in the Admin Web UI in IBM Lotus Protector for Mail Security 2.8.x before 2.8.1-22905 allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/91171" source="XF">ibm-lpms-cve20140885-csrf(91171)</ref>
      <ref url="http://www-01.ibm.com/support/docview.wss?uid=swg21668124" source="CONFIRM" adv="1">http://www-01.ibm.com/support/docview.wss?uid=swg21668124</ref>
    </refs>
    <vuln_soft>
      <prod vendor="ibm" name="lotus_protector_for_mail_security">
        <vers num="2.8"/>
        <vers num="2.8.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0886" published="2014-03-25" name="CVE-2014-0886" modified="2014-03-26" CVSS_version="2.0" CVSS_vector="(AV:N/AC:H/Au:S/C:C/I:C/A:C)" CVSS_score="7.1" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="3.9" CVSS_base_score="7.1">
    <desc>
      <descript source="cve">The Admin Web UI in IBM Lotus Protector for Mail Security 2.8.x before 2.8.1-22905 allows remote authenticated users to bypass intended access restrictions and execute arbitrary commands via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/91172" source="XF">ibm-lpms-cve20140886-command(91172)</ref>
      <ref url="http://www-01.ibm.com/support/docview.wss?uid=swg21668124" source="CONFIRM" adv="1">http://www-01.ibm.com/support/docview.wss?uid=swg21668124</ref>
    </refs>
    <vuln_soft>
      <prod vendor="ibm" name="lotus_protector_for_mail_security">
        <vers num="2.8"/>
        <vers num="2.8.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0887" published="2014-03-25" name="CVE-2014-0887" modified="2014-03-26" CVSS_version="2.0" CVSS_vector="(AV:N/AC:H/Au:S/C:C/I:C/A:C)" CVSS_score="7.1" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="3.9" CVSS_base_score="7.1">
    <desc>
      <descript source="cve">The Admin Web UI in IBM Lotus Protector for Mail Security 2.8.x before 2.8.1-22905 allows remote authenticated users to execute arbitrary commands with root privileges via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/91173" source="XF">ibm-lpms-cve20140887-command-root(91173)</ref>
      <ref url="http://www-01.ibm.com/support/docview.wss?uid=swg21668124" source="CONFIRM" adv="1">http://www-01.ibm.com/support/docview.wss?uid=swg21668124</ref>
    </refs>
    <vuln_soft>
      <prod vendor="ibm" name="lotus_protector_for_mail_security">
        <vers num="2.8"/>
        <vers num="2.8.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-0890" published="2014-03-06" name="CVE-2014-0890" modified="2014-03-07" CVSS_version="2.0" CVSS_vector="(AV:L/AC:M/Au:N/C:P/I:N/A:N)" CVSS_score="1.9" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="3.4" CVSS_base_score="1.9">
    <desc>
      <descript source="cve">The Connect client in IBM Sametime 8.5.1, 8.5.1.1, 8.5.1.2, 8.5.2, 8.5.2.1, 9.0, and 9.0.0.1, when a certain com.ibm.collaboration.realtime.telephony.*.level setting is used, logs cleartext passwords during Audio/Video chat sessions, which allows local users to obtain sensitive information by reading a log file.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/91282" source="XF">ibm-lotus-cve20148090-info-disc(91282)</ref>
      <ref url="http://www-01.ibm.com/support/docview.wss?uid=swg21665658" source="CONFIRM" adv="1">http://www-01.ibm.com/support/docview.wss?uid=swg21665658</ref>
    </refs>
    <vuln_soft>
      <prod vendor="ibm" name="sametime">
        <vers num="8.5.1.0"/>
        <vers num="8.5.1.1"/>
        <vers num="8.5.1.2"/>
        <vers num="8.5.2.0"/>
        <vers num="8.5.2.1"/>
        <vers num="9.0.0.0"/>
        <vers num="9.0.0.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0892" published="2014-04-23" name="CVE-2014-0892" modified="2014-04-24" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:N/A:N)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">IBM Notes and Domino 8.5.x before 8.5.3 FP6 IF3 and 9.x before 9.0.1 FP1 on 32-bit Linux platforms use incorrect gcc options, which makes it easier for remote attackers to execute arbitrary code by leveraging the absence of the NX protection mechanism and placing crafted x86 code on the stack, aka SPR KLYH9GGS9W.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.kb.cert.org/vuls/id/350089" source="CERT-VN">VU#350089</ref>
      <ref url="http://xforce.iss.net/xforce/xfdb/91286" source="XF">ibm-notes-cve20140892-linux32-rce(91286)</ref>
      <ref url="http://www-01.ibm.com/support/docview.wss?uid=swg21670264" source="CONFIRM" adv="1">http://www-01.ibm.com/support/docview.wss?uid=swg21670264</ref>
    </refs>
    <vuln_soft>
      <prod vendor="ibm" name="lotus_domino">
        <vers num="8.5.0"/>
        <vers num="8.5.0.1"/>
        <vers num="8.5.1"/>
        <vers num="8.5.1.1"/>
        <vers num="8.5.1.2"/>
        <vers num="8.5.1.3"/>
        <vers num="8.5.1.4"/>
        <vers num="8.5.1.5"/>
        <vers num="8.5.2.0"/>
        <vers num="8.5.2.1"/>
        <vers num="8.5.2.2"/>
        <vers num="8.5.2.3"/>
        <vers num="8.5.2.4"/>
        <vers num="8.5.3.0"/>
        <vers num="8.5.3.1"/>
        <vers num="8.5.3.2"/>
        <vers num="8.5.3.3"/>
        <vers num="8.5.3.4"/>
        <vers num="8.5.3.5"/>
        <vers num="8.5.3.6"/>
        <vers num="9.0.0.0"/>
        <vers num="9.0.1.0"/>
      </prod>
      <prod vendor="ibm" name="lotus_notes">
        <vers num="8.5"/>
        <vers num="8.5.0.0"/>
        <vers num="8.5.0.1"/>
        <vers num="8.5.1"/>
        <vers num="8.5.1.0"/>
        <vers num="8.5.1.1"/>
        <vers num="8.5.1.2"/>
        <vers num="8.5.1.3"/>
        <vers num="8.5.1.4"/>
        <vers num="8.5.1.5"/>
        <vers num="8.5.2.0"/>
        <vers num="8.5.2.1"/>
        <vers num="8.5.2.2"/>
        <vers num="8.5.2.3"/>
        <vers num="8.5.3"/>
        <vers num="8.5.3.1"/>
        <vers num="8.5.3.2"/>
        <vers num="8.5.3.3"/>
        <vers num="8.5.3.4"/>
        <vers num="8.5.3.5"/>
        <vers num="8.5.3.6"/>
        <vers num="9.0.0.0"/>
        <vers num="9.0.1.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0895" published="2014-03-16" name="CVE-2014-0895" modified="2014-03-17" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">Buffer overflow in the vsflex8l ActiveX control in IBM SPSS SamplePower 3.0.1 before FP1 3.0.1-IM-S3SAMPC-WIN32-FP001-IF02 allows remote attackers to execute arbitrary code via a crafted ComboList property value.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/91314" source="XF">ibm-spss-cve20140895-code-exec(91314)</ref>
      <ref url="http://www-01.ibm.com/support/docview.wss?uid=swg21666790" source="CONFIRM" adv="1">http://www-01.ibm.com/support/docview.wss?uid=swg21666790</ref>
      <ref url="http://www-01.ibm.com/support/docview.wss?uid=swg1PI09800" source="AIXAPAR">PI09800</ref>
    </refs>
    <vuln_soft>
      <prod vendor="ibm" name="spss_samplepower">
        <vers num="3.0.1.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0896" published="2014-05-01" name="CVE-2014-0896" modified="2014-05-02" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:N/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">IBM WebSphere Application Server (WAS) Liberty Profile 8.5.x before 8.5.5.2 allows remote attackers to obtain sensitive information via a crafted request.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/91326" source="XF">ibm-was-cve20140896-info-disc(91326)</ref>
      <ref url="http://www-01.ibm.com/support/docview.wss?uid=swg21669554" source="CONFIRM">http://www-01.ibm.com/support/docview.wss?uid=swg21669554</ref>
      <ref url="http://www-01.ibm.com/support/docview.wss?uid=swg1PI10134" source="AIXAPAR">PI10134</ref>
    </refs>
    <vuln_soft>
      <prod vendor="ibm" name="websphere_application_server">
        <vers num="8.5.0.0" edition="-:liberty_profile"/>
        <vers num="8.5.0.1" edition="-:liberty_profile"/>
        <vers num="8.5.0.2" edition="-:liberty_profile"/>
        <vers num="8.5.5.0" edition="-:liberty_profile"/>
        <vers num="8.5.5.1" edition="-:liberty_profile"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0899" published="2014-03-11" name="CVE-2014-0899" modified="2014-03-11" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:P/I:P/A:P)" CVSS_score="6.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.0" CVSS_base_score="6.5">
    <desc>
      <descript source="cve">ftpd in IBM AIX 7.1.1 before SP10 and 7.1.2 before SP5, when a Workload Partition (aka WPAR) for AIX 5.2 or 5.3 is used, allows remote authenticated users to bypass intended permission settings and modify arbitrary files via FTP commands.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/91396" source="XF">ibm-aix-wpar-ftpd(91396)</ref>
      <ref url="http://www.ibm.com/support/docview.wss?uid=isg1IV51421" source="AIXAPAR">IV51421</ref>
      <ref url="http://www.ibm.com/support/docview.wss?uid=isg1IV51420" source="AIXAPAR" adv="1">IV51420</ref>
      <ref url="http://aix.software.ibm.com/aix/efixes/security/wparcre_advisory.asc" source="CONFIRM" adv="1">http://aix.software.ibm.com/aix/efixes/security/wparcre_advisory.asc</ref>
    </refs>
    <vuln_soft>
      <prod vendor="ibm" name="aix">
        <vers num="7.1.1"/>
        <vers num="7.1.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-0901" published="2014-04-01" name="CVE-2014-0901" modified="2014-04-02" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:S/C:N/I:P/A:N)" CVSS_score="3.5" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="6.8" CVSS_base_score="3.5">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in the Social Rendering implementation in the IBM Connections integration in IBM WebSphere Portal 8.0.0.x before 8.0.0.1 CF11 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/91398" source="XF">ibm-wsportal-cve20140901-sr-xss(91398)</ref>
      <ref url="http://www-01.ibm.com/support/docview.wss?uid=swg21667016" source="CONFIRM" adv="1">http://www-01.ibm.com/support/docview.wss?uid=swg21667016</ref>
      <ref url="http://www-01.ibm.com/support/docview.wss?uid=swg1PI12659" source="AIXAPAR">PI12659</ref>
    </refs>
    <vuln_soft>
      <prod vendor="ibm" name="websphere_portal">
        <vers num="8.0.0.0"/>
        <vers num="8.0.0.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0904" published="2014-03-26" name="CVE-2014-0904" modified="2014-03-26" CVSS_version="2.0" CVSS_vector="(AV:N/AC:H/Au:N/C:C/I:C/A:C)" CVSS_score="7.6" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="4.9" CVSS_base_score="7.6">
    <desc>
      <descript source="cve">The update process in IBM Security AppScan Standard 7.9 through 8.8 does not require integrity checks of downloaded files, which allows remote attackers to execute arbitrary code via a crafted file.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/91536" source="XF">ibm-appscan-cve20140904-code-exec(91536)</ref>
      <ref url="http://www-01.ibm.com/support/docview.wss?uid=swg21666775" source="CONFIRM" adv="1">http://www-01.ibm.com/support/docview.wss?uid=swg21666775</ref>
    </refs>
    <vuln_soft>
      <prod vendor="ibm" name="security_appscan">
        <vers num="7.9" edition="-:standard"/>
        <vers num="8.0" edition="-:standard"/>
        <vers num="8.5" edition="-:standard"/>
        <vers num="8.6" edition="-:standard"/>
        <vers num="8.7" edition="-:standard"/>
        <vers num="8.8" edition="-:standard"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0908" published="2014-04-10" name="CVE-2014-0908" modified="2014-04-11" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:S/C:P/I:P/A:P)" CVSS_score="6.0" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="6.8" CVSS_base_score="6.0">
    <desc>
      <descript source="cve">The User Attribute implementation in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.2, and 8.5.x through 8.5.0.1 does not verify authorization for read or write access to attribute values, which allows remote authenticated users to obtain sensitive information, configure e-mail notifications, or modify task assignments via REST API calls.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/91870" source="XF">ibm-bpm-cve20140908-priv-escalation(91870)</ref>
      <ref url="http://www-01.ibm.com/support/docview.wss?uid=swg21669330" source="CONFIRM" adv="1">http://www-01.ibm.com/support/docview.wss?uid=swg21669330</ref>
      <ref url="http://www-01.ibm.com/support/docview.wss?uid=swg1JR49505" source="AIXAPAR">JR49505</ref>
    </refs>
    <vuln_soft>
      <prod vendor="ibm" name="business_process_manager">
        <vers num="7.5.0.0"/>
        <vers num="7.5.0.1"/>
        <vers num="7.5.1.0"/>
        <vers num="7.5.1.1"/>
        <vers num="7.5.1.2"/>
        <vers num="8.0.0.0"/>
        <vers num="8.0.1.0"/>
        <vers num="8.0.1.1"/>
        <vers num="8.0.1.2"/>
        <vers num="8.5.0.0"/>
        <vers num="8.5.0.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0920" published="2014-04-10" name="CVE-2014-0920" modified="2014-04-11" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:P/I:N/A:N)" CVSS_score="4.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.0" CVSS_base_score="4.0">
    <desc>
      <descript source="cve">IBM SPSS Analytic Server 1.0 before IF002 and 1.0.1 before IF004 logs cleartext passwords, which allows remote authenticated users to obtain sensitive information via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/92073" source="XF">ibm-spssas-cve20140920-plaintext-pw(92073)</ref>
      <ref url="http://www-01.ibm.com/support/docview.wss?uid=swg21669506" source="CONFIRM" adv="1">http://www-01.ibm.com/support/docview.wss?uid=swg21669506</ref>
      <ref url="http://www-01.ibm.com/support/docview.wss?uid=swg1PI13527" source="AIXAPAR">PI13527</ref>
    </refs>
    <vuln_soft>
      <prod vendor="ibm" name="spss_analytic_server">
        <vers num="1.0.0.0"/>
        <vers num="1.0.1.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0921" published="2014-04-15" name="CVE-2014-0921" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:N/A:P)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">The server in IBM MessageSight 1.x before 1.1.0.0-IBM-IMA-IT01015 allows remote attackers to cause a denial of service (daemon crash and message data loss) via malformed headers during a WebSockets connection upgrade.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/92074" source="XF">ibm-messagesight-cve20140921-dos(92074)</ref>
      <ref url="http://www-01.ibm.com/support/docview.wss?uid=swg21670278" source="CONFIRM" adv="1">http://www-01.ibm.com/support/docview.wss?uid=swg21670278</ref>
      <ref url="http://www-01.ibm.com/support/docview.wss?uid=swg1IC98583" source="AIXAPAR">IC98583</ref>
    </refs>
    <vuln_soft>
      <prod vendor="ibm" name="messagesight_jms_client">
        <vers num="1.0.0.0"/>
        <vers num="1.0.0.1"/>
        <vers num="1.1.0.0"/>
      </prod>
      <prod vendor="ibm" name="messagesight">
        <vers num="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0922" published="2014-04-15" name="CVE-2014-0922" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:N/A:P)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">IBM MessageSight 1.x before 1.1.0.0-IBM-IMA-IT01015 allows remote attackers to cause a denial of service (resource consumption) via WebSockets MQ Telemetry Transport (MQTT) data.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/92075" source="XF">ibm-messagesight-cve20140922-dos(92075)</ref>
      <ref url="http://www-01.ibm.com/support/docview.wss?uid=swg21670278" source="CONFIRM" adv="1">http://www-01.ibm.com/support/docview.wss?uid=swg21670278</ref>
      <ref url="http://www-01.ibm.com/support/docview.wss?uid=swg1IC98692" source="AIXAPAR">IC98692</ref>
    </refs>
    <vuln_soft>
      <prod vendor="ibm" name="messagesight_jms_client">
        <vers num="1.0.0.0"/>
        <vers num="1.0.0.1"/>
        <vers num="1.1.0.0"/>
      </prod>
      <prod vendor="ibm" name="messagesight">
        <vers num="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0923" published="2014-04-15" name="CVE-2014-0923" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:N/A:P)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">IBM MessageSight 1.x before 1.1.0.0-IBM-IMA-IT01015 allows remote attackers to cause a denial of service (daemon restart) via crafted MQ Telemetry Transport (MQTT) authentication data.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/92076" source="XF">ibm-messagesight-cve20140923-dos(92076)</ref>
      <ref url="http://www-01.ibm.com/support/docview.wss?uid=swg21670278" source="CONFIRM" adv="1">http://www-01.ibm.com/support/docview.wss?uid=swg21670278</ref>
      <ref url="http://www-01.ibm.com/support/docview.wss?uid=swg1IT00582" source="AIXAPAR">IT00582</ref>
    </refs>
    <vuln_soft>
      <prod vendor="ibm" name="messagesight_jms_client">
        <vers num="1.0.0.0"/>
        <vers num="1.0.0.1"/>
        <vers num="1.1.0.0"/>
      </prod>
      <prod vendor="ibm" name="messagesight">
        <vers num="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0924" published="2014-04-15" name="CVE-2014-0924" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:H/Au:S/C:P/I:P/A:P)" CVSS_score="4.6" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="3.9" CVSS_base_score="4.6">
    <desc>
      <descript source="cve">IBM MessageSight 1.x before 1.1.0.0-IBM-IMA-IT01015 does not verify that all of the characters of a password are correct, which makes it easier for remote authenticated users to bypass intended access restrictions by leveraging knowledge of a password substring.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/92077" source="XF">ibm-messagesight-cve20140924-sec-bypass(92077)</ref>
      <ref url="http://www-01.ibm.com/support/docview.wss?uid=swg21670278" source="CONFIRM" adv="1">http://www-01.ibm.com/support/docview.wss?uid=swg21670278</ref>
      <ref url="http://www-01.ibm.com/support/docview.wss?uid=swg1IT00583" source="AIXAPAR">IT00583</ref>
    </refs>
    <vuln_soft>
      <prod vendor="ibm" name="messagesight_jms_client">
        <vers num="1.0.0.0"/>
        <vers num="1.0.0.1"/>
        <vers num="1.1.0.0"/>
      </prod>
      <prod vendor="ibm" name="messagesight">
        <vers num="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-0932" published="2014-04-21" name="CVE-2014-0932" modified="2014-04-22" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:S/C:N/I:P/A:N)" CVSS_score="3.5" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="6.8" CVSS_base_score="3.5">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in IBM Sterling Order Management 8.5 before HF105 and Sterling Selling and Fulfillment Foundation 9.0 before HF85 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/92264" source="XF">ibm-sterlingom-cve20140932-xss(92264)</ref>
      <ref url="http://www-01.ibm.com/support/docview.wss?uid=swg21670912" source="CONFIRM" adv="1">http://www-01.ibm.com/support/docview.wss?uid=swg21670912</ref>
      <ref url="http://www-01.ibm.com/support/docview.wss?uid=swg1IT00419" source="AIXAPAR">IT00419</ref>
    </refs>
    <vuln_soft>
      <prod vendor="ibm" name="sterling_order_management">
        <vers num="8.5"/>
      </prod>
      <prod vendor="ibm" name="sterling_selling_and_fulfillment_foundation">
        <vers num="9.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-0941" published="2014-05-01" name="CVE-2014-0941" modified="2014-05-02" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:S/C:N/I:P/A:N)" CVSS_score="3.5" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="6.8" CVSS_base_score="3.5">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in webtop/eventviewer/eventViewer.jsp in the Web GUI in IBM Netcool/OMNIbus 7.4.0 before FP2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2014-0942.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/92400" source="XF">ibm-netcoolomnibus-cve20140941-xss(92400)</ref>
      <ref url="http://www-01.ibm.com/support/docview.wss?uid=swg21671686" source="CONFIRM" adv="1">http://www-01.ibm.com/support/docview.wss?uid=swg21671686</ref>
    </refs>
    <vuln_soft>
      <prod vendor="ibm" name="tivoli_netcool/omnibus">
        <vers num="7.4.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-0942" published="2014-05-01" name="CVE-2014-0942" modified="2014-05-02" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:S/C:N/I:P/A:N)" CVSS_score="3.5" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="6.8" CVSS_base_score="3.5">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in webtop/eventviewer/eventViewer.jsp in the Web GUI in IBM Netcool/OMNIbus 7.4.0 before FP2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2014-0941.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/92401" source="XF">ibm-netcoolomnibus-cve20140942-xss(92401)</ref>
      <ref url="http://www-01.ibm.com/support/docview.wss?uid=swg21671686" source="CONFIRM" adv="1">http://www-01.ibm.com/support/docview.wss?uid=swg21671686</ref>
    </refs>
    <vuln_soft>
      <prod vendor="ibm" name="tivoli_netcool/omnibus">
        <vers num="7.4.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0977" published="2014-01-10" name="CVE-2014-0977" modified="2014-02-21" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in the Rich Text Editor in Movable Type 5.0x, 5.1x before 5.161, 5.2.x before 5.2.9, and 6.0.x before 6.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90095" source="XF">movabletype-richtexteditor-xss(90095)</ref>
      <ref url="http://www.securitytracker.com/id/1029588" source="SECTRACK">1029588</ref>
      <ref url="http://www.securityfocus.com/bid/64657" source="BID">64657</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2841" source="DEBIAN">DSA-2841</ref>
      <ref url="http://secunia.com/advisories/56405" source="SECUNIA">56405</ref>
      <ref url="http://secunia.com/advisories/56295" source="SECUNIA" adv="1">56295</ref>
      <ref url="http://seclists.org/oss-sec/2014/q1/36" source="MLIST">[oss-security] 20140107 Re: CVE Request: cross-site scripting vulnerabilities in movable type 6.0.1, 5.2.9, and 5.161</ref>
      <ref url="http://seclists.org/oss-sec/2014/q1/24" source="MLIST">[oss-security] 20140106 CVE Request: cross-site scripting vulnerabilities in movable type 6.0.1, 5.2.9, and 5.161</ref>
      <ref url="http://movabletype.org/news/2013/11/movable_type_601_529_and_5161_released_to_close_security_vul.html" source="CONFIRM" adv="1">http://movabletype.org/news/2013/11/movable_type_601_529_and_5161_released_to_close_security_vul.html</ref>
      <ref url="http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=734304" source="CONFIRM">http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=734304</ref>
    </refs>
    <vuln_soft>
      <prod vendor="sixapart" name="movabletype">
        <vers num="5.0" edition="rc2"/>
        <vers num="5.01"/>
        <vers num="5.02"/>
        <vers num="5.03"/>
        <vers num="5.031"/>
        <vers num="5.04"/>
        <vers num="5.11"/>
        <vers num="5.12"/>
        <vers num="5.13"/>
        <vers num="5.14"/>
        <vers num="5.15"/>
        <vers num="5.2"/>
        <vers num="5.2.2"/>
        <vers num="5.2.3"/>
        <vers num="5.2.6"/>
        <vers num="5.2.7"/>
        <vers num="6.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0978" published="2014-01-10" name="CVE-2014-0978" modified="2014-02-21" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">Stack-based buffer overflow in the yyerror function in lib/cgraph/scan.l in Graphviz 2.34.0 allows remote attackers to have unspecified impact via a long line in a dot file.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="https://github.com/ellson/graphviz/commit/7aaddf52cd98589fb0c3ab72a393f8411838438a" source="CONFIRM" patch="1">https://github.com/ellson/graphviz/commit/7aaddf52cd98589fb0c3ab72a393f8411838438a</ref>
      <ref url="https://bugzilla.redhat.com/show_bug.cgi?id=1049165" source="CONFIRM">https://bugzilla.redhat.com/show_bug.cgi?id=1049165</ref>
      <ref url="https://bugs.gentoo.org/show_bug.cgi?id=497274" source="MISC">https://bugs.gentoo.org/show_bug.cgi?id=497274</ref>
      <ref url="http://xforce.iss.net/xforce/xfdb/90085" source="XF">graphviz-yyerror-bo(90085)</ref>
      <ref url="http://www.securityfocus.com/bid/64674" source="BID">64674</ref>
      <ref url="http://www.mandriva.com/security/advisories?name=MDVSA-2014:024" source="MANDRIVA">MDVSA-2014:024</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2843" source="DEBIAN">DSA-2843</ref>
      <ref url="http://secunia.com/advisories/56244" source="SECUNIA">56244</ref>
      <ref url="http://secunia.com/advisories/55666" source="SECUNIA" adv="1">55666</ref>
      <ref url="http://seclists.org/oss-sec/2014/q1/38" source="MLIST">[oss-security] 20140107 Re: CVE Request: graphviz: stack-based buffer overflow in yyerror()</ref>
      <ref url="http://seclists.org/oss-sec/2014/q1/28" source="MLIST">[oss-security] 20140107 CVE Request: graphviz: stack-based buffer overflow in yyerror()</ref>
    </refs>
    <vuln_soft>
      <prod vendor="graphviz" name="graphviz">
        <vers num="2.34.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-0979" published="2014-01-22" name="CVE-2014-0979" modified="2014-02-21" CVSS_version="2.0" CVSS_vector="(AV:L/AC:L/Au:N/C:N/I:N/A:P)" CVSS_score="2.1" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="3.9" CVSS_base_score="2.1">
    <desc>
      <descript source="cve">The start_authentication function in lightdm-gtk-greeter.c in LightDM GTK+ Greeter before 1.7.1 does not properly handle the return value from the lightdm_greeter_get_authentication_user function, which allows local users to cause a denial of service (NULL pointer dereference) via an empty username.</descript>
      <descript source="nvd">Per: http://cwe.mitre.org/data/definitions/476.html

"CWE-476: NULL Pointer Dereference"</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="https://bugzilla.novell.com/show_bug.cgi?id=857303" source="CONFIRM">https://bugzilla.novell.com/show_bug.cgi?id=857303</ref>
      <ref url="https://bugs.launchpad.net/lightdm-gtk-greeter/+bug/1266449" source="CONFIRM">https://bugs.launchpad.net/lightdm-gtk-greeter/+bug/1266449</ref>
      <ref url="http://www.securityfocus.com/bid/64679" source="BID">64679</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/01/07/15" source="MLIST">[oss-security] 20140107 Re: CVE request: lightdm-gtk-greeter - local DOS due to NULL pointer dereference</ref>
      <ref url="http://secunia.com/advisories/56423" source="SECUNIA" adv="1">56423</ref>
      <ref url="http://secunia.com/advisories/56211" source="SECUNIA" adv="1">56211</ref>
      <ref url="http://lists.opensuse.org/opensuse-updates/2014-01/msg00048.html" source="SUSE">openSUSE-SU-2014:0071</ref>
      <ref url="http://lists.fedoraproject.org/pipermail/package-announce/2014-February/128150.html" source="FEDORA">FEDORA-2014-1648</ref>
      <ref url="http://lists.fedoraproject.org/pipermail/package-announce/2014-February/128117.html" source="FEDORA">FEDORA-2014-1647</ref>
    </refs>
    <vuln_soft>
      <prod vendor="lightdm_gtk+_greeter_project" name="lightdm_gtk+_greeter">
        <vers num="1.1.1"/>
        <vers num="1.1.2"/>
        <vers num="1.1.3"/>
        <vers num="1.1.4"/>
        <vers num="1.1.5"/>
        <vers num="1.1.6"/>
        <vers num="1.3.0"/>
        <vers num="1.3.1"/>
        <vers num="1.5.0"/>
        <vers num="1.5.1"/>
        <vers num="1.5.2"/>
        <vers num="1.6.0"/>
        <vers num="1.6.1"/>
        <vers prev="1" num="1.7.0"/>
      </prod>
      <prod vendor="novell" name="opensuse">
        <vers num="12.2"/>
        <vers num="12.3"/>
        <vers num="13.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-0980" published="2014-02-11" name="CVE-2014-0980" modified="2014-02-21" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">Buffer overflow in Poster Software PUBLISH-iT 3.6d allows remote attackers to execute arbitrary code via a crafted PUI file.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90989" source="XF">publishit-cve20140980-bo(90989)</ref>
      <ref url="http://www.securityfocus.com/bid/65366" source="BID">65366</ref>
      <ref url="http://www.securityfocus.com/archive/1/archive/1/530943/100/0/threaded" source="BUGTRAQ">20140205 CORE-2014-0001 - Publish-It Buffer Overflow Vulnerability</ref>
      <ref url="http://www.exploit-db.com/exploits/31461" source="EXPLOIT-DB">31461</ref>
      <ref url="http://www.coresecurity.com/advisories/publish-it-buffer-overflow-vulnerability" source="MISC">http://www.coresecurity.com/advisories/publish-it-buffer-overflow-vulnerability</ref>
      <ref url="http://secunia.com/advisories/56618" source="SECUNIA" adv="1">56618</ref>
      <ref url="http://seclists.org/fulldisclosure/2014/Feb/34" source="FULLDISC">20140205 CORE-2014-0001 - Publish-It Buffer Overflow Vulnerability</ref>
      <ref url="http://packetstormsecurity.com/files/125089" source="MISC">http://packetstormsecurity.com/files/125089</ref>
      <ref url="http://osvdb.org/102911" source="OSVDB">102911</ref>
    </refs>
    <vuln_soft>
      <prod vendor="poster_software" name="publish_it">
        <vers num="3.6d"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0981" published="2014-03-31" name="CVE-2014-0981" modified="2014-04-24" CVSS_version="2.0" CVSS_vector="(AV:L/AC:M/Au:N/C:P/I:P/A:P)" CVSS_score="4.4" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="3.4" CVSS_base_score="4.4">
    <desc>
      <descript source="cve">VBox/GuestHost/OpenGL/util/net.c in Oracle VirtualBox before 3.2.22, 4.0.x before 4.0.24, 4.1.x before 4.1.32, 4.2.x before 4.2.24, and 4.3.x before 4.3.8, when using 3D Acceleration allows local guest OS users to execute arbitrary code on the Chromium server via crafted Chromium network pointer in a (1) CR_MESSAGE_READBACK or (2) CR_MESSAGE_WRITEBACK message to the VBoxSharedCrOpenGL service, which triggers an arbitrary pointer dereference and memory corruption.  NOTE: this issue was MERGED with CVE-2014-0982 because it is the same type of vulnerability affecting the same set of versions. All CVE users should reference CVE-2014-0981 instead of CVE-2014-0982.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="https://www.virtualbox.org/changeset/50437/vbox" source="CONFIRM">https://www.virtualbox.org/changeset/50437/vbox</ref>
      <ref url="http://www.securityfocus.com/archive/1/archive/1/531418/100/0/threaded" source="BUGTRAQ">20140311 CORE-2014-0002 - Oracle VirtualBox 3D Acceleration Multiple Memory Corruption Vulnerabilities</ref>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
      <ref url="http://www.exploit-db.com/exploits/32208" source="EXPLOIT-DB">32208</ref>
      <ref url="http://www.coresecurity.com/advisories/oracle-virtualbox-3d-acceleration-multiple-memory-corruption-vulnerabilities" source="MISC">http://www.coresecurity.com/advisories/oracle-virtualbox-3d-acceleration-multiple-memory-corruption-vulnerabilities</ref>
      <ref url="http://secunia.com/advisories/57384" source="SECUNIA" adv="1">57384</ref>
      <ref url="http://seclists.org/fulldisclosure/2014/Mar/95" source="FULLDISC">20140311 CORE-2014-0002 - Oracle VirtualBox 3D Acceleration Multiple Memory Corruption Vulnerabilities</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="vm_virtualbox">
        <vers num="4.2.0"/>
        <vers num="4.2.10"/>
        <vers num="4.2.12"/>
        <vers num="4.2.14"/>
        <vers num="4.2.16"/>
        <vers num="4.2.18"/>
        <vers num="4.2.2"/>
        <vers num="4.2.20"/>
        <vers num="4.2.4"/>
        <vers num="4.2.6"/>
        <vers num="4.2.8"/>
        <vers num="4.3.0"/>
        <vers num="4.3.2"/>
        <vers num="4.3.4"/>
        <vers num="4.3.6"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" seq="2014-0982" reject="1" published="2014-03-31" name="CVE-2014-0982" modified="2014-03-31">
    <desc>
      <descript source="cve">** REJECT **  DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-0981. Reason: This issue was MERGED into CVE-2014-0981 in accordance with CVE content decisions, because it is the same type of vulnerability and affects the same versions. Notes: All CVE users should reference CVE-2014-0981 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.</descript>
    </desc>
    <refs/>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0983" published="2014-03-31" name="CVE-2014-0983" modified="2014-04-24" CVSS_version="2.0" CVSS_vector="(AV:L/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="6.9" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="3.4" CVSS_base_score="6.9">
    <desc>
      <descript source="cve">Multiple array index errors in programs that are automatically generated by VBox/HostServices/SharedOpenGL/crserverlib/server_dispatch.py in Oracle VirtualBox 4.2.x through 4.2.20 and 4.3.x before 4.3.8, when using 3D Acceleration, allow local guest OS users to execute arbitrary code on the Chromium server via certain CR_MESSAGE_OPCODES messages with a crafted index, which are not properly handled by the (1) CR_VERTEXATTRIB4NUBARB_OPCODE to the crServerDispatchVertexAttrib4NubARB function, (2) CR_VERTEXATTRIB1DARB_OPCODE to the crServerDispatchVertexAttrib1dARB function, (3) CR_VERTEXATTRIB1FARB_OPCODE to the crServerDispatchVertexAttrib1fARB function, (4) CR_VERTEXATTRIB1SARB_OPCODE to the crServerDispatchVertexAttrib1sARB function, (5) CR_VERTEXATTRIB2DARB_OPCODE to the crServerDispatchVertexAttrib2dARB function, (6) CR_VERTEXATTRIB2FARB_OPCODE to the crServerDispatchVertexAttrib2fARB function, (7) CR_VERTEXATTRIB2SARB_OPCODE to the crServerDispatchVertexAttrib2sARB function, (8) CR_VERTEXATTRIB3DARB_OPCODE to the crServerDispatchVertexAttrib3dARB function, (9) CR_VERTEXATTRIB3FARB_OPCODE to the crServerDispatchVertexAttrib3fARB function, (10) CR_VERTEXATTRIB3SARB_OPCODE to the crServerDispatchVertexAttrib3sARB function, (11) CR_VERTEXATTRIB4DARB_OPCODE to the crServerDispatchVertexAttrib4dARB function, (12) CR_VERTEXATTRIB4FARB_OPCODE to the crServerDispatchVertexAttrib4fARB function, and (13) CR_VERTEXATTRIB4SARB_OPCODE to the crServerDispatchVertexAttrib4sARB function.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="https://www.virtualbox.org/changeset/50441/vbox" source="CONFIRM">https://www.virtualbox.org/changeset/50441/vbox</ref>
      <ref url="http://www.securityfocus.com/archive/1/archive/1/531418/100/0/threaded" source="BUGTRAQ">20140311 CORE-2014-0002 - Oracle VirtualBox 3D Acceleration Multiple Memory Corruption Vulnerabilities</ref>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
      <ref url="http://www.exploit-db.com/exploits/32208" source="EXPLOIT-DB">32208</ref>
      <ref url="http://www.coresecurity.com/advisories/oracle-virtualbox-3d-acceleration-multiple-memory-corruption-vulnerabilities" source="MISC">http://www.coresecurity.com/advisories/oracle-virtualbox-3d-acceleration-multiple-memory-corruption-vulnerabilities</ref>
      <ref url="http://secunia.com/advisories/57384" source="SECUNIA" adv="1">57384</ref>
      <ref url="http://seclists.org/fulldisclosure/2014/Mar/95" source="FULLDISC">20140311 CORE-2014-0002 - Oracle VirtualBox 3D Acceleration Multiple Memory Corruption Vulnerabilities</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="vm_virtualbox">
        <vers num="4.2.0"/>
        <vers num="4.2.10"/>
        <vers num="4.2.12"/>
        <vers num="4.2.14"/>
        <vers num="4.2.16"/>
        <vers num="4.2.18"/>
        <vers num="4.2.2"/>
        <vers num="4.2.20"/>
        <vers num="4.2.4"/>
        <vers num="4.2.6"/>
        <vers num="4.2.8"/>
        <vers num="4.3.0"/>
        <vers num="4.3.2"/>
        <vers num="4.3.4"/>
        <vers num="4.3.6"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-0984" published="2014-04-17" name="CVE-2014-0984" modified="2014-04-24" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:N/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">The passwordCheck function in SAP Router 721 patch 117, 720 patch 411, 710 patch 029, and earlier terminates validation of a Route Permission Table entry password upon encountering the first incorrect character, which allows remote attackers to obtrain passwords via a brute-force attack that relies on timing differences in responses to incorrect password guesses, aka a timing side-channel attack.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://service.sap.com/sap/support/notes/1986895" source="CONFIRM">https://service.sap.com/sap/support/notes/1986895</ref>
      <ref url="http://www.securityfocus.com/archive/1/archive/1/531854/100/0/threaded" source="BUGTRAQ">20140416 [CORE-2014-0003] - SAP Router Password Timing Attack</ref>
      <ref url="http://www.exploit-db.com/exploits/32919" source="EXPLOIT-DB">32919</ref>
      <ref url="http://www.coresecurity.com/advisories/sap-router-password-timing-attack" source="MISC">http://www.coresecurity.com/advisories/sap-router-password-timing-attack</ref>
      <ref url="http://scn.sap.com/docs/DOC-8218" source="CONFIRM">http://scn.sap.com/docs/DOC-8218</ref>
    </refs>
    <vuln_soft>
      <prod vendor="sap" name="router">
        <vers num="710" edition="029"/>
        <vers num="720" edition="411"/>
        <vers num="721" edition="117"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1201" published="2014-01-15" name="CVE-2014-1201" modified="2014-04-22" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:C/I:C/A:C)" CVSS_score="10.0" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="10.0" CVSS_base_score="10.0">
    <desc>
      <descript source="cve">Buffer overflow in the INetViewX ActiveX control in the Lorex Edge LH310 and Edge+ LH320 series with firmware 7-35-28-1B26E, Edge2 LH330 series with firmware 11.17.38-33_1D97A, and Edge3 LH340 series with firmware 11.19.85_1FE3A allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in the HTTP_PORT parameter.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://github.com/pedrib/PoC/blob/master/lorexActivex/lorex-testcase.html" source="MISC">https://github.com/pedrib/PoC/blob/master/lorexActivex/lorex-testcase.html</ref>
      <ref url="https://github.com/pedrib/PoC/blob/master/lorexActivex/lorex-report.txt" source="MISC">https://github.com/pedrib/PoC/blob/master/lorexActivex/lorex-report.txt</ref>
      <ref url="http://xforce.iss.net/xforce/xfdb/90223" source="XF">lorex-cve20141201-bo(90223)</ref>
      <ref url="http://www.securityfocus.com/archive/1/archive/1/530739/100/0/threaded" source="BUGTRAQ">20140110 [CVE -2014-1201] Lorex security DVR ActiveX control buffer overflow</ref>
      <ref url="http://osvdb.org/101903" source="OSVDB">101903</ref>
    </refs>
    <vuln_soft>
      <prod vendor="lorex_technology" name="edge+_lh320_firmware">
        <vers num="7-35-28-1b26e"/>
      </prod>
      <prod vendor="lorex_technology" name="edge2_lh330_firmware">
        <vers num="11.17.38-33_1d97a"/>
      </prod>
      <prod vendor="lorex_technology" name="edge3_lh340_firmware">
        <vers num="11.19.85_1fe3a"/>
      </prod>
      <prod vendor="lorex_technology" name="edge_lh310_firmware">
        <vers num="7-35-28-1b26e"/>
      </prod>
      <prod vendor="lorextechnology" name="edge">
        <vers num="lh310"/>
      </prod>
      <prod vendor="lorextechnology" name="edge+">
        <vers num="lh320"/>
      </prod>
      <prod vendor="lorextechnology" name="edge2">
        <vers num="lh330"/>
      </prod>
      <prod vendor="lorextechnology" name="edge3">
        <vers num="lh340"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1202" published="2014-01-24" name="CVE-2014-1202" modified="2014-01-27" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">The WSDL/WADL import functionality in SoapUI before 4.6.4 allows remote attackers to execute arbitrary Java code via a crafted request parameter in a WSDL file.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="https://github.com/SmartBear/soapui/blob/master/RELEASENOTES.txt" source="CONFIRM">https://github.com/SmartBear/soapui/blob/master/RELEASENOTES.txt</ref>
      <ref url="http://www.youtube.com/watch?v=3lCLE64rsc0" source="MISC">http://www.youtube.com/watch?v=3lCLE64rsc0</ref>
      <ref url="http://www.exploit-db.com/exploits/30908" source="EXPLOIT-DB">30908</ref>
      <ref url="http://packetstormsecurity.com/files/124773/SoapUI-Remote-Code-Execution.html" source="MISC">http://packetstormsecurity.com/files/124773/SoapUI-Remote-Code-Execution.html</ref>
      <ref url="http://baraktawily.blogspot.com/2014/01/soapui-code-execution-vulnerability-cve.html" source="MISC">http://baraktawily.blogspot.com/2014/01/soapui-code-execution-vulnerability-cve.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="eviware" name="soapui">
        <vers num="2.5.1"/>
        <vers num="3.0.1"/>
        <vers num="3.5"/>
        <vers num="3.5.1"/>
        <vers num="3.6"/>
        <vers num="3.6.1"/>
      </prod>
      <prod vendor="smartbear" name="soapui">
        <vers num="4.0" edition="beta1"/>
        <vers num="4.0" edition="beta2"/>
        <vers num="4.0.1"/>
        <vers num="4.5"/>
        <vers num="4.5.1"/>
        <vers num="4.5.2"/>
        <vers num="4.6.0"/>
        <vers num="4.6.1"/>
        <vers num="4.6.2"/>
        <vers prev="1" num="4.6.3"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1204" published="2014-01-31" name="CVE-2014-1204" modified="2014-02-21" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">SQL injection vulnerability in Tableau Server 8.0.x before 8.0.7 and 8.1.x before 8.1.2 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.  NOTE: this can be exploited by unauthenticated remote attackers if the guest user is enabled.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://www.trustwave.com/spiderlabs/advisories/TWSL2014-003.txt" source="MISC">https://www.trustwave.com/spiderlabs/advisories/TWSL2014-003.txt</ref>
      <ref url="http://xforce.iss.net/xforce/xfdb/90730" source="XF">tableau-server-cve20141204-sql-injection(90730)</ref>
      <ref url="http://www.tableausoftware.com/support/releases/812" source="CONFIRM" adv="1">http://www.tableausoftware.com/support/releases/812</ref>
      <ref url="http://www.tableausoftware.com/support/releases/8.0.7" source="CONFIRM">http://www.tableausoftware.com/support/releases/8.0.7</ref>
      <ref url="http://www.securitytracker.com/id/1029706" source="SECTRACK">1029706</ref>
      <ref url="http://www.securityfocus.com/bid/65171" source="BID">65171</ref>
      <ref url="http://www.exploit-db.com/exploits/31578" source="EXPLOIT-DB">31578</ref>
      <ref url="http://secunia.com/advisories/56620" source="SECUNIA" adv="1">56620</ref>
      <ref url="http://osvdb.org/102568" source="OSVDB">102568</ref>
    </refs>
    <vuln_soft>
      <prod vendor="tableau_software" name="tableau_server">
        <vers num="8.0"/>
        <vers num="8.0.1"/>
        <vers num="8.0.2"/>
        <vers num="8.0.3"/>
        <vers num="8.0.4"/>
        <vers num="8.0.5"/>
        <vers num="8.0.6"/>
        <vers num="8.1"/>
        <vers num="8.1.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1206" published="2014-01-15" name="CVE-2014-1206" modified="2014-02-21" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">SQL injection vulnerability in the password reset page in Open Web Analytics (OWA) before 1.5.5 allows remote attackers to execute arbitrary SQL commands via the owa_email_address parameter in a base.passwordResetRequest action to index.php.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.securityfocus.com/bid/64774" source="BID">64774</ref>
      <ref url="http://www.securityfocus.com/archive/1/archive/1/531105/100/0/threaded" source="BUGTRAQ">20140214 [SWRX-2014-001] Open Web Analytics Pre-Auth SQL Injection</ref>
      <ref url="http://www.secureworks.com/advisories/SWRX-2014-001/SWRX-2014-001.pdf" source="MISC">http://www.secureworks.com/advisories/SWRX-2014-001/SWRX-2014-001.pdf</ref>
      <ref url="http://www.exploit-db.com/exploits/31738" source="EXPLOIT-DB">31738</ref>
      <ref url="http://wiki.openwebanalytics.com/index.php?title=1.5.5" source="CONFIRM" adv="1">http://wiki.openwebanalytics.com/index.php?title=1.5.5</ref>
      <ref url="http://secunia.com/advisories/56350" source="SECUNIA" adv="1">56350</ref>
    </refs>
    <vuln_soft>
      <prod vendor="openwebanalytics" name="open_web_analytics">
        <vers num="1.0"/>
        <vers num="1.0.1"/>
        <vers num="1.0.2"/>
        <vers num="1.0.3"/>
        <vers num="1.0.4"/>
        <vers num="1.0.5"/>
        <vers num="1.0.6"/>
        <vers num="1.0.7"/>
        <vers num="1.0.8"/>
        <vers num="1.1.0" edition="rc1"/>
        <vers num="1.1.0" edition="rc2"/>
        <vers num="1.1.0" edition="rc3"/>
        <vers num="1.1.0" edition="rc4"/>
        <vers num="1.1.1"/>
        <vers num="1.2.0" edition="rc1"/>
        <vers num="1.2.0" edition="rc2"/>
        <vers num="1.2.0" edition="rc3"/>
        <vers num="1.2.1" edition="rc1"/>
        <vers num="1.2.2"/>
        <vers num="1.2.3"/>
        <vers num="1.2.4"/>
        <vers num="1.3.0" edition="rc1"/>
        <vers num="1.3.1"/>
        <vers num="1.4.0" edition="rc1"/>
        <vers num="1.4.0" edition="rc2"/>
        <vers num="1.4.0" edition="rc3"/>
        <vers num="1.4.0" edition="rc4"/>
        <vers num="1.4.1"/>
        <vers num="1.5.0" edition="rc1"/>
        <vers num="1.5.0" edition="rc2"/>
        <vers num="1.5.0" edition="rc3"/>
        <vers num="1.5.1"/>
        <vers num="1.5.2"/>
        <vers num="1.5.3"/>
        <vers prev="1" num="1.5.4"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1207" published="2014-01-17" name="CVE-2014-1207" modified="2014-01-30" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:N/A:P)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">VMware ESXi 4.0 through 5.1 and ESX 4.0 and 4.1 allow remote attackers to cause a denial of service (NULL pointer dereference) by intercepting and modifying Network File Copy (NFC) traffic.</descript>
      <descript source="nvd">Per: http://cwe.mitre.org/data/definitions/476.html

"CWE-476: NULL Pointer Dereference"</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90559" source="XF">vmware-esx-cve20141207-dos(90559)</ref>
      <ref url="http://www.vmware.com/security/advisories/VMSA-2014-0001.html" source="CONFIRM" adv="1">http://www.vmware.com/security/advisories/VMSA-2014-0001.html</ref>
      <ref url="http://www.securitytracker.com/id/1029643" source="SECTRACK">1029643</ref>
      <ref url="http://www.securityfocus.com/bid/64995" source="BID">64995</ref>
      <ref url="http://secunia.com/advisories/56499" source="SECUNIA">56499</ref>
      <ref url="http://osvdb.org/102196" source="OSVDB">102196</ref>
    </refs>
    <vuln_soft>
      <prod vendor="vmware" name="esx">
        <vers num="4.0"/>
        <vers num="4.1"/>
      </prod>
      <prod vendor="vmware" name="esxi">
        <vers num="4.0" edition="1"/>
        <vers num="4.0" edition="2"/>
        <vers num="4.0" edition="3"/>
        <vers num="4.0" edition="4"/>
        <vers num="4.1" edition="1"/>
        <vers num="4.1" edition="2"/>
        <vers num="5.0" edition="1"/>
        <vers num="5.0" edition="2"/>
        <vers num="5.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-1208" published="2014-01-17" name="CVE-2014-1208" modified="2014-01-30" CVSS_version="2.0" CVSS_vector="(AV:A/AC:L/Au:N/C:N/I:N/A:P)" CVSS_score="3.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="6.5" CVSS_base_score="3.3">
    <desc>
      <descript source="cve">VMware Workstation 9.x before 9.0.1, VMware Player 5.x before 5.0.1, VMware Fusion 5.x before 5.0.1, VMware ESXi 4.0 through 5.1, and VMware ESX 4.0 and 4.1 allow guest OS users to cause a denial of service (VMX process disruption) by using an invalid port.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <local_network/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90558" source="XF">vmware-esx-cve20141208-dos(90558)</ref>
      <ref url="http://www.vmware.com/security/advisories/VMSA-2014-0001.html" source="CONFIRM" adv="1">http://www.vmware.com/security/advisories/VMSA-2014-0001.html</ref>
      <ref url="http://www.securitytracker.com/id/1029644" source="SECTRACK">1029644</ref>
      <ref url="http://www.securitytracker.com/id/1029643" source="SECTRACK">1029643</ref>
      <ref url="http://www.securityfocus.com/bid/64994" source="BID">64994</ref>
      <ref url="http://secunia.com/advisories/56499" source="SECUNIA">56499</ref>
      <ref url="http://osvdb.org/102197" source="OSVDB">102197</ref>
    </refs>
    <vuln_soft>
      <prod vendor="vmware" name="fusion">
        <vers num="5.0"/>
      </prod>
      <prod vendor="vmware" name="player">
        <vers num="5.0"/>
      </prod>
      <prod vendor="vmware" name="workstation">
        <vers num="9.0"/>
      </prod>
      <prod vendor="vmware" name="esx">
        <vers num="4.0"/>
        <vers num="4.1"/>
      </prod>
      <prod vendor="vmware" name="esxi">
        <vers num="4.0" edition="1"/>
        <vers num="4.0" edition="2"/>
        <vers num="4.0" edition="3"/>
        <vers num="4.0" edition="4"/>
        <vers num="4.1" edition="1"/>
        <vers num="4.1" edition="2"/>
        <vers num="5.0" edition="1"/>
        <vers num="5.0" edition="2"/>
        <vers num="5.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1209" published="2014-04-11" name="CVE-2014-1209" modified="2014-04-14" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">VMware vSphere Client 4.0, 4.1, 5.0 before Update 3, and 5.1 before Update 2 does not properly validate updates to Client files, which allows remote attackers to trigger the downloading and execution of an arbitrary program via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://www.vmware.com/security/advisories/VMSA-2014-0003.html" source="CONFIRM" adv="1">http://www.vmware.com/security/advisories/VMSA-2014-0003.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="vmware" name="vsphere_client">
        <vers num="4.0"/>
        <vers num="4.1"/>
        <vers num="5.0"/>
        <vers num="5.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1210" published="2014-04-11" name="CVE-2014-1210" modified="2014-04-14" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:N)" CVSS_score="5.8" CVSS_impact_subscore="4.9" CVSS_exploit_subscore="8.6" CVSS_base_score="5.8">
    <desc>
      <descript source="cve">VMware vSphere Client 5.0 before Update 3 and 5.1 before Update 2 does not properly validate X.509 certificates, which allows man-in-the-middle attackers to spoof SSL servers via a crafted certificate.</descript>
    </desc>
    <loss_types>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.vmware.com/security/advisories/VMSA-2014-0003.html" source="CONFIRM" adv="1">http://www.vmware.com/security/advisories/VMSA-2014-0003.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="vmware" name="vsphere_client">
        <vers num="5.0"/>
        <vers num="5.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1211" published="2014-01-17" name="CVE-2014-1211" modified="2014-01-30" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:P)" CVSS_score="6.8" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.6" CVSS_base_score="6.8">
    <desc>
      <descript source="cve">Cross-site request forgery (CSRF) vulnerability in VMware vCloud Director 5.1.x before 5.1.3 allows remote attackers to hijack the authentication of arbitrary users for requests that trigger a logout.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90560" source="XF">vmware-vcloud-cve20141211-csrf(90560)</ref>
      <ref url="http://www.vmware.com/security/advisories/VMSA-2014-0001.html" source="CONFIRM" adv="1">http://www.vmware.com/security/advisories/VMSA-2014-0001.html</ref>
      <ref url="http://www.securitytracker.com/id/1029645" source="SECTRACK">1029645</ref>
      <ref url="http://www.securityfocus.com/bid/64993" source="BID">64993</ref>
      <ref url="http://osvdb.org/102198" source="OSVDB">102198</ref>
    </refs>
    <vuln_soft>
      <prod vendor="vmware" name="vcloud_director">
        <vers num="5.1.0"/>
        <vers num="5.1.1"/>
        <vers num="5.1.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1213" published="2014-02-10" name="CVE-2014-1213" modified="2014-02-11" CVSS_version="2.0" CVSS_vector="(AV:L/AC:L/Au:N/C:N/I:P/A:C)" CVSS_score="5.6" CVSS_impact_subscore="7.8" CVSS_exploit_subscore="3.9" CVSS_base_score="5.6">
    <desc>
      <descript source="cve">Sophos Anti-Virus engine (SAVi) before 3.50.1, as used in VDL 4.97G 9.7.x before 9.7.9, 10.0.x before 10.0.11, and 10.3.x before 10.3.1 does not set an ACL for certain global and session objects, which allows local users to bypass anti-virus protection, cause a denial of service (resource consumption, CPU consumption, and eventual crash) or spoof "ready for update" messages by performing certain operations on mutexes or events including (1) DataUpdateRequest, (2) MmfMutexSAV-****, (3) MmfMutexSAV-Info, (4) ReadyForUpdateSAV-****, (5) ReadyForUpdateSAV-Info, (6) SAV-****, (7) SAV-Info, (8) StateChange, (9) SuspendedSAV-****, (10) SuspendedSAV-Info, (11) UpdateComplete, (12) UpdateMutex, (13) UpdateRequest, or (14) SophosALMonSessionInstance, as demonstrated by triggering a ReadyForUpdateSAV event and modifying the UpdateComplete, UpdateMutex, and UpdateRequest objects.</descript>
    </desc>
    <loss_types>
      <avail/>
      <int/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="http://www.sophos.com/en-us/support/knowledgebase/2300/7200/1031/120401.aspx" source="CONFIRM">http://www.sophos.com/en-us/support/knowledgebase/2300/7200/1031/120401.aspx</ref>
      <ref url="http://www.securityfocus.com/bid/65286" source="BID">65286</ref>
      <ref url="http://www.securityfocus.com/archive/1/archive/1/530915/100/0/threaded" source="BUGTRAQ">20140131 CVE-2014-1213 - Denial of Service in Sophos Anti Virus</ref>
      <ref url="http://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-1213/" source="MISC">http://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-1213/</ref>
      <ref url="http://seclists.org/fulldisclosure/2014/Feb/1" source="FULLDISC">20140131 CVE-2014-1213 - Denial of Service in Sophos Anti Virus</ref>
      <ref url="http://packetstormsecurity.com/files/125024/Sophos-Anti-Virus-Denial-Of-Service.html" source="MISC">http://packetstormsecurity.com/files/125024/Sophos-Anti-Virus-Denial-Of-Service.html</ref>
      <ref url="http://osvdb.org/102762" source="OSVDB">102762</ref>
    </refs>
    <vuln_soft>
      <prod vendor="sophos" name="scanning_engine">
        <vers prev="1" num="3.48"/>
      </prod>
      <prod vendor="sophos" name="sophos_anti-virus">
        <vers num="10.0.11"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1216" published="2014-04-22" name="CVE-2014-1216" modified="2014-04-22" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">FitNesse Wiki 20131110, 20140201, and earlier allows remote attackers to execute arbitrary commands by defining a COMMAND_PATTERN and TEST_RUNNER in the pageContent parameter when editing a page.</descript>
      <descript source="nvd">Per: https://cwe.mitre.org/data/definitions/77.html

"CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')"</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-1216/" source="MISC">https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-1216/</ref>
      <ref url="http://www.exploit-db.com/exploits/32568" source="EXPLOIT-DB">32568</ref>
    </refs>
    <vuln_soft>
      <prod vendor="fitnesse" name="fitnesse_wiki">
        <vers num="20131110"/>
        <vers prev="1" num="20140201"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1217" published="2014-04-28" name="CVE-2014-1217" modified="2014-04-29" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">Livetecs Timelive before 6.2.8 does not properly restrict access to systemsetting.aspx, which allows remote attackers to change configurations and obtain the database connection string and credentials via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-1217/" source="MISC">https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-1217/</ref>
      <ref url="http://www.securityfocus.com/bid/67043" source="BID">67043</ref>
      <ref url="http://www.securityfocus.com/archive/1/archive/1/531911/100/0/threaded" source="BUGTRAQ">20140423 CVE-2014-1217 - Unauthenticated access to sensitive information and functionality in Livetecs Timelive</ref>
      <ref url="http://seclists.org/fulldisclosure/2014/Apr/259" source="FULLDISC">20140423 CVE-2014-1217 - Unauthenticated access to sensitive information and functionality in Livetecs Timelive</ref>
    </refs>
    <vuln_soft>
      <prod vendor="livetecs" name="timeline">
        <vers num="2.81"/>
        <vers num="2.91"/>
        <vers num="2.94"/>
        <vers num="3.0.1"/>
        <vers num="3.0.3"/>
        <vers num="3.0.5"/>
        <vers num="3.1.1"/>
        <vers num="3.2.1"/>
        <vers num="3.5.1"/>
        <vers num="3.6.1"/>
        <vers num="3.7.1"/>
        <vers num="3.8.1"/>
        <vers num="4.2.1"/>
        <vers num="4.3.1"/>
        <vers num="4.9.1"/>
        <vers num="5.2.1"/>
        <vers num="6.0.1"/>
        <vers num="6.2.1"/>
        <vers num="6.2.3"/>
        <vers num="6.2.4"/>
        <vers num="6.2.6"/>
        <vers num="6.2.7"/>
        <vers num="6.2.71"/>
        <vers num="7.1.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1219" published="2014-02-14" name="CVE-2014-1219" modified="2014-02-21" CVSS_version="2.0" CVSS_vector="(AV:N/AC:H/Au:N/C:P/I:P/A:P)" CVSS_score="5.1" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="4.9" CVSS_base_score="5.1">
    <desc>
      <descript source="cve">CA 2E Web Option r8.1.2 accepts a predictable substring of a W2E_SSNID session token in place of the entire token, which allows remote attackers to hijack sessions by changing characters at the end of this substring, as demonstrated by terminating a session via a modified SSNID parameter to web2edoc/close.htm.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.securityfocus.com/bid/65537" source="BID">65537</ref>
      <ref url="http://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-1219/" source="MISC">http://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-1219/</ref>
    </refs>
    <vuln_soft>
      <prod vendor="ca" name="2e_web_option">
        <vers num="r8.1.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1223" published="2014-02-27" name="CVE-2014-1223" modified="2014-02-28" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in controlpanel/loading.aspx in Telligent Evolution before 6.1.19.36103, 7.x before 7.1.12.36162, 7.5.x, and 7.6.x before 7.6.7.36651 allows remote attackers to inject arbitrary web script or HTML via the msg parameter.  NOTE: some of these details are obtained from third party information.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-1223" source="MISC">https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-1223</ref>
      <ref url="http://www.securityfocus.com/archive/1/archive/1/531223/100/0/threaded" source="BUGTRAQ">20140221 CVE-2014-1223 - Cross-site Scripting in Telligent Evolution</ref>
      <ref url="http://secunia.com/advisories/56779" source="SECUNIA" adv="1">56779</ref>
    </refs>
    <vuln_soft>
      <prod vendor="telligent" name="evolution">
        <vers prev="1" num="6.1.19"/>
        <vers prev="1" num="7.1.12"/>
        <vers prev="1" num="7.5.0"/>
        <vers prev="1" num="7.5.0.32466"/>
        <vers prev="1" num="7.6.7"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1232" published="2014-01-08" name="CVE-2014-1232" modified="2014-01-13" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in the Foliopress WYSIWYG plugin before 2.6.8.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://wordpress.org/plugins/foliopress-wysiwyg/changelog" source="CONFIRM" patch="1" adv="1">http://wordpress.org/plugins/foliopress-wysiwyg/changelog</ref>
      <ref url="http://xforce.iss.net/xforce/xfdb/90102" source="XF">foliopress-unspecified-xss(90102)</ref>
      <ref url="http://secunia.com/advisories/56261" source="SECUNIA" adv="1">56261</ref>
    </refs>
    <vuln_soft>
      <prod vendor="foliovision" name="foliopress_wysiwyg">
        <vers num="2.6.8"/>
        <vers num="2.6.8.1"/>
        <vers num="2.6.8.2"/>
        <vers num="2.6.8.3"/>
        <vers prev="1" num="2.6.8.4"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-1233" published="2014-01-10" name="CVE-2014-1233" modified="2014-01-10" CVSS_version="2.0" CVSS_vector="(AV:L/AC:L/Au:N/C:P/I:N/A:N)" CVSS_score="2.1" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="3.9" CVSS_base_score="2.1">
    <desc>
      <descript source="cve">The paratrooper-pingdom gem 1.0.0 for Ruby allows local users to obtain the App-Key, username, and password values by listing the curl process.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="http://www.vapid.dhs.org/advisories/paratrooper-api-key-pingdom.html" source="MISC">http://www.vapid.dhs.org/advisories/paratrooper-api-key-pingdom.html</ref>
      <ref url="http://openwall.com/lists/oss-security/2014/01/08/1" source="MLIST">[oss-security] 20140107 paratrooper-pingdom-1.0.0 ruby gem exposes API login credentials</ref>
    </refs>
    <vuln_soft>
      <prod vendor="tobias_maier" name="paratrooper-pingdom">
        <vers num="1.0.0" edition="-:~-~-~ruby~~"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-1234" published="2014-01-10" name="CVE-2014-1234" modified="2014-01-10" CVSS_version="2.0" CVSS_vector="(AV:L/AC:L/Au:N/C:P/I:N/A:N)" CVSS_score="2.1" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="3.9" CVSS_base_score="2.1">
    <desc>
      <descript source="cve">The paratrooper-newrelic gem 1.0.1 for Ruby allows local users to obtain the X-Api-Key value by listing the curl process.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="http://www.vapid.dhs.org/advisories/paratrooper-newrelic-api.html" source="MISC">http://www.vapid.dhs.org/advisories/paratrooper-newrelic-api.html</ref>
      <ref url="http://openwall.com/lists/oss-security/2014/01/08/2" source="MLIST">[oss-security] 20140107 Paratrooper-newrelic 1.0.1 Ruby Gem exposes API key</ref>
    </refs>
    <vuln_soft>
      <prod vendor="paratrooper-newrelic_project" name="paratrooper-newrelic">
        <vers num="1.0.1" edition="-:~-~-~ruby~~"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1236" published="2014-01-10" name="CVE-2014-1236" modified="2014-03-05" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:C/I:C/A:C)" CVSS_score="10.0" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="10.0" CVSS_base_score="10.0">
    <desc>
      <descript source="cve">Stack-based buffer overflow in the chkNum function in lib/cgraph/scan.l in Graphviz 2.34.0 allows remote attackers to have unspecified impact via vectors related to a "badly formed number" and a "long digit list."</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://github.com/ellson/graphviz/commit/1d1bdec6318746f6f19f245db589eddc887ae8ff" source="CONFIRM" patch="1">https://github.com/ellson/graphviz/commit/1d1bdec6318746f6f19f245db589eddc887ae8ff</ref>
      <ref url="https://bugzilla.redhat.com/show_bug.cgi?id=1050872" source="CONFIRM">https://bugzilla.redhat.com/show_bug.cgi?id=1050872</ref>
      <ref url="http://www.securityfocus.com/bid/64737" source="BID">64737</ref>
      <ref url="http://www.mandriva.com/security/advisories?name=MDVSA-2014:024" source="MANDRIVA">MDVSA-2014:024</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2843" source="DEBIAN">DSA-2843</ref>
      <ref url="http://secunia.com/advisories/56244" source="SECUNIA">56244</ref>
      <ref url="http://secunia.com/advisories/55666" source="SECUNIA" adv="1">55666</ref>
      <ref url="http://seclists.org/oss-sec/2014/q1/54" source="MLIST">[oss-security] 20140108 Re: CVE Request: graphviz: stack-based buffer overflow in yyerror()</ref>
      <ref url="http://seclists.org/oss-sec/2014/q1/51" source="MLIST">[oss-security] 20140108 Re: Re: CVE Request: graphviz: stack-based buffer overflow in yyerror()</ref>
      <ref url="http://seclists.org/oss-sec/2014/q1/46" source="MLIST">[oss-security] 20140108 Re: Re: CVE Request: graphviz: stack-based buffer overflow in yyerror()</ref>
    </refs>
    <vuln_soft>
      <prod vendor="graphviz" name="graphviz">
        <vers num="2.34.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1237" published="2014-02-11" name="CVE-2014-1237" modified="2014-02-21" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in synetics i-doit pro before 1.2.4 allows remote attackers to inject arbitrary web script or HTML via the call parameter.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90969" source="XF">idoit-cve20141237-xss(90969)</ref>
      <ref url="http://www.securityfocus.com/bid/65353" source="BID">65353</ref>
      <ref url="http://www.i-doit.com/en/company/news/single-news/?tx_ttnews%5Btt_news%5D=136" source="CONFIRM" adv="1">http://www.i-doit.com/en/company/news/single-news/?tx_ttnews%5Btt_news%5D=136</ref>
      <ref url="http://www.csnc.ch/misc/files/advisories/CVE-2014-1237_i-doit_Cross-site_Scripting_-_XSS.txt" source="MISC">http://www.csnc.ch/misc/files/advisories/CVE-2014-1237_i-doit_Cross-site_Scripting_-_XSS.txt</ref>
      <ref url="http://secunia.com/advisories/56834" source="SECUNIA" adv="1">56834</ref>
      <ref url="http://secunia.com/advisories/56802" source="SECUNIA">56802</ref>
      <ref url="http://seclists.org/fulldisclosure/2014/Feb/26" source="FULLDISC">20140205 CVE-2014-1237 (XSS in i-doit Pro)</ref>
      <ref url="http://packetstormsecurity.com/files/125062" source="MISC">http://packetstormsecurity.com/files/125062</ref>
      <ref url="http://osvdb.org/102910" source="OSVDB">102910</ref>
    </refs>
    <vuln_soft>
      <prod vendor="i-doit" name="i-doit">
        <vers num="1.1.1" edition=":~~pro~~~"/>
        <vers num="1.1.2" edition=":~~pro~~~"/>
        <vers num="1.2.1" edition=":~~pro~~~"/>
        <vers num="1.2.2" edition=":~~pro~~~"/>
        <vers prev="1" num="1.2.3" edition=":~~pro~~~"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1242" published="2014-01-23" name="CVE-2014-1242" modified="2014-01-30" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:P)" CVSS_score="5.8" CVSS_impact_subscore="4.9" CVSS_exploit_subscore="8.6" CVSS_base_score="5.8">
    <desc>
      <descript source="cve">Apple iTunes before 11.1.4 uses HTTP for the iTunes Tutorials window, which allows man-in-the-middle attackers to spoof content by gaining control over the client-server data stream.</descript>
    </desc>
    <loss_types>
      <avail/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90653" source="XF">apple-itunes-cve20141242-mitm(90653)</ref>
      <ref url="http://www.securitytracker.com/id/1029671" source="SECTRACK">1029671</ref>
      <ref url="http://www.securityfocus.com/bid/65088" source="BID">65088</ref>
      <ref url="http://support.apple.com/kb/HT6001" source="CONFIRM" adv="1">http://support.apple.com/kb/HT6001</ref>
      <ref url="http://osvdb.org/102410" source="OSVDB">102410</ref>
    </refs>
    <vuln_soft>
      <prod vendor="apple" name="itunes">
        <vers num="11.0"/>
        <vers num="11.0.1"/>
        <vers num="11.0.2"/>
        <vers num="11.0.3"/>
        <vers num="11.0.4"/>
        <vers num="11.0.5"/>
        <vers num="11.1"/>
        <vers num="11.1.1"/>
        <vers num="11.1.2"/>
        <vers prev="1" num="11.1.3"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1243" published="2014-02-26" name="CVE-2014-1243" modified="2014-02-27" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">Apple QuickTime before 7.7.5 does not initialize an unspecified pointer, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted track list in a movie file.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://support.apple.com/kb/HT6151" source="CONFIRM" adv="1">http://support.apple.com/kb/HT6151</ref>
    </refs>
    <vuln_soft>
      <prod vendor="apple" name="quicktime">
        <vers num="7.0.0"/>
        <vers num="7.0.1"/>
        <vers num="7.0.2"/>
        <vers num="7.0.3"/>
        <vers num="7.0.4"/>
        <vers num="7.1.0"/>
        <vers num="7.1.1"/>
        <vers num="7.1.2"/>
        <vers num="7.1.3"/>
        <vers num="7.1.4"/>
        <vers num="7.1.5"/>
        <vers num="7.1.6"/>
        <vers num="7.2.0"/>
        <vers num="7.2.1"/>
        <vers num="7.3.0"/>
        <vers num="7.3.1"/>
        <vers num="7.3.1.70"/>
        <vers num="7.4.0"/>
        <vers num="7.4.1"/>
        <vers num="7.4.5"/>
        <vers num="7.5.0"/>
        <vers num="7.5.5"/>
        <vers num="7.6.0"/>
        <vers num="7.6.1"/>
        <vers num="7.6.2"/>
        <vers num="7.6.5"/>
        <vers num="7.6.6"/>
        <vers num="7.6.7"/>
        <vers num="7.6.8"/>
        <vers num="7.6.9"/>
        <vers num="7.60.92.0"/>
        <vers num="7.62.14.0"/>
        <vers num="7.64.17.73"/>
        <vers num="7.65.17.80"/>
        <vers num="7.66.71.0"/>
        <vers num="7.67.75.0"/>
        <vers num="7.68.75.0"/>
        <vers num="7.69.80.9"/>
        <vers num="7.7.0"/>
        <vers num="7.7.1"/>
        <vers num="7.7.2"/>
        <vers num="7.7.3"/>
        <vers prev="1" num="7.7.4"/>
        <vers num="7.70.80.34"/>
        <vers num="7.71.80.42"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1244" published="2014-02-26" name="CVE-2014-1244" modified="2014-03-10" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">Buffer overflow in Apple QuickTime before 7.7.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted movie file with H.264 encoding.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://support.apple.com/kb/HT6151" source="CONFIRM" adv="1">http://support.apple.com/kb/HT6151</ref>
    </refs>
    <vuln_soft>
      <prod vendor="apple" name="quicktime">
        <vers num="7.0.0"/>
        <vers num="7.0.1"/>
        <vers num="7.0.2"/>
        <vers num="7.0.3"/>
        <vers num="7.0.4"/>
        <vers num="7.1.0"/>
        <vers num="7.1.1"/>
        <vers num="7.1.2"/>
        <vers num="7.1.3"/>
        <vers num="7.1.4"/>
        <vers num="7.1.5"/>
        <vers num="7.1.6"/>
        <vers num="7.2.0"/>
        <vers num="7.2.1"/>
        <vers num="7.3.0"/>
        <vers num="7.3.1"/>
        <vers num="7.3.1.70"/>
        <vers num="7.4.0"/>
        <vers num="7.4.1"/>
        <vers num="7.4.5"/>
        <vers num="7.5.0"/>
        <vers num="7.5.5"/>
        <vers num="7.6.0"/>
        <vers num="7.6.1"/>
        <vers num="7.6.2"/>
        <vers num="7.6.5"/>
        <vers num="7.6.6"/>
        <vers num="7.6.7"/>
        <vers num="7.6.8"/>
        <vers num="7.6.9"/>
        <vers num="7.60.92.0"/>
        <vers num="7.62.14.0"/>
        <vers num="7.64.17.73"/>
        <vers num="7.65.17.80"/>
        <vers num="7.66.71.0"/>
        <vers num="7.67.75.0"/>
        <vers num="7.68.75.0"/>
        <vers num="7.69.80.9"/>
        <vers num="7.7.0"/>
        <vers num="7.7.1"/>
        <vers num="7.7.2"/>
        <vers num="7.7.3"/>
        <vers prev="1" num="7.7.4"/>
        <vers num="7.70.80.34"/>
        <vers num="7.71.80.42"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1245" published="2014-02-26" name="CVE-2014-1245" modified="2014-03-10" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">Integer signedness error in Apple QuickTime before 7.7.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted stsz atom in a movie file.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://support.apple.com/kb/HT6151" source="CONFIRM" adv="1">http://support.apple.com/kb/HT6151</ref>
      <ref url="http://support.apple.com/kb/HT6150" source="CONFIRM" adv="1">http://support.apple.com/kb/HT6150</ref>
    </refs>
    <vuln_soft>
      <prod vendor="apple" name="quicktime">
        <vers num="7.0.0"/>
        <vers num="7.0.1"/>
        <vers num="7.0.2"/>
        <vers num="7.0.3"/>
        <vers num="7.0.4"/>
        <vers num="7.1.0"/>
        <vers num="7.1.1"/>
        <vers num="7.1.2"/>
        <vers num="7.1.3"/>
        <vers num="7.1.4"/>
        <vers num="7.1.5"/>
        <vers num="7.1.6"/>
        <vers num="7.2.0"/>
        <vers num="7.2.1"/>
        <vers num="7.3.0"/>
        <vers num="7.3.1"/>
        <vers num="7.3.1.70"/>
        <vers num="7.4.0"/>
        <vers num="7.4.1"/>
        <vers num="7.4.5"/>
        <vers num="7.5.0"/>
        <vers num="7.5.5"/>
        <vers num="7.6.0"/>
        <vers num="7.6.1"/>
        <vers num="7.6.2"/>
        <vers num="7.6.5"/>
        <vers num="7.6.6"/>
        <vers num="7.6.7"/>
        <vers num="7.6.8"/>
        <vers num="7.6.9"/>
        <vers num="7.60.92.0"/>
        <vers num="7.62.14.0"/>
        <vers num="7.64.17.73"/>
        <vers num="7.65.17.80"/>
        <vers num="7.66.71.0"/>
        <vers num="7.67.75.0"/>
        <vers num="7.68.75.0"/>
        <vers num="7.69.80.9"/>
        <vers num="7.7.0"/>
        <vers num="7.7.1"/>
        <vers num="7.7.2"/>
        <vers num="7.7.3"/>
        <vers prev="1" num="7.7.4"/>
        <vers num="7.70.80.34"/>
        <vers num="7.71.80.42"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1246" published="2014-02-26" name="CVE-2014-1246" modified="2014-02-27" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">Buffer overflow in Apple QuickTime before 7.7.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted ftab atom in a movie file.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://support.apple.com/kb/HT6151" source="CONFIRM" adv="1">http://support.apple.com/kb/HT6151</ref>
      <ref url="http://support.apple.com/kb/HT6150" source="CONFIRM" adv="1">http://support.apple.com/kb/HT6150</ref>
    </refs>
    <vuln_soft>
      <prod vendor="apple" name="quicktime">
        <vers num="7.0.0"/>
        <vers num="7.0.1"/>
        <vers num="7.0.2"/>
        <vers num="7.0.3"/>
        <vers num="7.0.4"/>
        <vers num="7.1.0"/>
        <vers num="7.1.1"/>
        <vers num="7.1.2"/>
        <vers num="7.1.3"/>
        <vers num="7.1.4"/>
        <vers num="7.1.5"/>
        <vers num="7.1.6"/>
        <vers num="7.2.0"/>
        <vers num="7.2.1"/>
        <vers num="7.3.0"/>
        <vers num="7.3.1"/>
        <vers num="7.3.1.70"/>
        <vers num="7.4.0"/>
        <vers num="7.4.1"/>
        <vers num="7.4.5"/>
        <vers num="7.5.0"/>
        <vers num="7.5.5"/>
        <vers num="7.6.0"/>
        <vers num="7.6.1"/>
        <vers num="7.6.2"/>
        <vers num="7.6.5"/>
        <vers num="7.6.6"/>
        <vers num="7.6.7"/>
        <vers num="7.6.8"/>
        <vers num="7.6.9"/>
        <vers num="7.60.92.0"/>
        <vers num="7.62.14.0"/>
        <vers num="7.64.17.73"/>
        <vers num="7.65.17.80"/>
        <vers num="7.66.71.0"/>
        <vers num="7.67.75.0"/>
        <vers num="7.68.75.0"/>
        <vers num="7.69.80.9"/>
        <vers num="7.7.0"/>
        <vers num="7.7.1"/>
        <vers num="7.7.2"/>
        <vers num="7.7.3"/>
        <vers prev="1" num="7.7.4"/>
        <vers num="7.70.80.34"/>
        <vers num="7.71.80.42"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1247" published="2014-02-26" name="CVE-2014-1247" modified="2014-03-10" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">Apple QuickTime before 7.7.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted dref atom in a movie file.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://support.apple.com/kb/HT6151" source="CONFIRM" adv="1">http://support.apple.com/kb/HT6151</ref>
      <ref url="http://support.apple.com/kb/HT6150" source="CONFIRM" adv="1">http://support.apple.com/kb/HT6150</ref>
    </refs>
    <vuln_soft>
      <prod vendor="apple" name="quicktime">
        <vers num="7.0.0"/>
        <vers num="7.0.1"/>
        <vers num="7.0.2"/>
        <vers num="7.0.3"/>
        <vers num="7.0.4"/>
        <vers num="7.1.0"/>
        <vers num="7.1.1"/>
        <vers num="7.1.2"/>
        <vers num="7.1.3"/>
        <vers num="7.1.4"/>
        <vers num="7.1.5"/>
        <vers num="7.1.6"/>
        <vers num="7.2.0"/>
        <vers num="7.2.1"/>
        <vers num="7.3.0"/>
        <vers num="7.3.1"/>
        <vers num="7.3.1.70"/>
        <vers num="7.4.0"/>
        <vers num="7.4.1"/>
        <vers num="7.4.5"/>
        <vers num="7.5.0"/>
        <vers num="7.5.5"/>
        <vers num="7.6.0"/>
        <vers num="7.6.1"/>
        <vers num="7.6.2"/>
        <vers num="7.6.5"/>
        <vers num="7.6.6"/>
        <vers num="7.6.7"/>
        <vers num="7.6.8"/>
        <vers num="7.6.9"/>
        <vers num="7.60.92.0"/>
        <vers num="7.62.14.0"/>
        <vers num="7.64.17.73"/>
        <vers num="7.65.17.80"/>
        <vers num="7.66.71.0"/>
        <vers num="7.67.75.0"/>
        <vers num="7.68.75.0"/>
        <vers num="7.69.80.9"/>
        <vers num="7.7.0"/>
        <vers num="7.7.1"/>
        <vers num="7.7.2"/>
        <vers num="7.7.3"/>
        <vers prev="1" num="7.7.4"/>
        <vers num="7.70.80.34"/>
        <vers num="7.71.80.42"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1248" published="2014-02-26" name="CVE-2014-1248" modified="2014-03-10" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">Buffer overflow in Apple QuickTime before 7.7.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted ldat atom in a movie file.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://support.apple.com/kb/HT6151" source="CONFIRM" adv="1">http://support.apple.com/kb/HT6151</ref>
      <ref url="http://support.apple.com/kb/HT6150" source="CONFIRM" adv="1">http://support.apple.com/kb/HT6150</ref>
    </refs>
    <vuln_soft>
      <prod vendor="apple" name="quicktime">
        <vers num="7.0.0"/>
        <vers num="7.0.1"/>
        <vers num="7.0.2"/>
        <vers num="7.0.3"/>
        <vers num="7.0.4"/>
        <vers num="7.1.0"/>
        <vers num="7.1.1"/>
        <vers num="7.1.2"/>
        <vers num="7.1.3"/>
        <vers num="7.1.4"/>
        <vers num="7.1.5"/>
        <vers num="7.1.6"/>
        <vers num="7.2.0"/>
        <vers num="7.2.1"/>
        <vers num="7.3.0"/>
        <vers num="7.3.1"/>
        <vers num="7.3.1.70"/>
        <vers num="7.4.0"/>
        <vers num="7.4.1"/>
        <vers num="7.4.5"/>
        <vers num="7.5.0"/>
        <vers num="7.5.5"/>
        <vers num="7.6.0"/>
        <vers num="7.6.1"/>
        <vers num="7.6.2"/>
        <vers num="7.6.5"/>
        <vers num="7.6.6"/>
        <vers num="7.6.7"/>
        <vers num="7.6.8"/>
        <vers num="7.6.9"/>
        <vers num="7.60.92.0"/>
        <vers num="7.62.14.0"/>
        <vers num="7.64.17.73"/>
        <vers num="7.65.17.80"/>
        <vers num="7.66.71.0"/>
        <vers num="7.67.75.0"/>
        <vers num="7.68.75.0"/>
        <vers num="7.69.80.9"/>
        <vers num="7.7.0"/>
        <vers num="7.7.1"/>
        <vers num="7.7.2"/>
        <vers num="7.7.3"/>
        <vers prev="1" num="7.7.4"/>
        <vers num="7.70.80.34"/>
        <vers num="7.71.80.42"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1249" published="2014-02-26" name="CVE-2014-1249" modified="2014-03-10" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">Buffer overflow in Apple QuickTime before 7.7.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted PSD image.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://support.apple.com/kb/HT6151" source="CONFIRM" adv="1">http://support.apple.com/kb/HT6151</ref>
      <ref url="http://support.apple.com/kb/HT6150" source="CONFIRM" adv="1">http://support.apple.com/kb/HT6150</ref>
    </refs>
    <vuln_soft>
      <prod vendor="apple" name="quicktime">
        <vers num="7.0.0"/>
        <vers num="7.0.1"/>
        <vers num="7.0.2"/>
        <vers num="7.0.3"/>
        <vers num="7.0.4"/>
        <vers num="7.1.0"/>
        <vers num="7.1.1"/>
        <vers num="7.1.2"/>
        <vers num="7.1.3"/>
        <vers num="7.1.4"/>
        <vers num="7.1.5"/>
        <vers num="7.1.6"/>
        <vers num="7.2.0"/>
        <vers num="7.2.1"/>
        <vers num="7.3.0"/>
        <vers num="7.3.1"/>
        <vers num="7.3.1.70"/>
        <vers num="7.4.0"/>
        <vers num="7.4.1"/>
        <vers num="7.4.5"/>
        <vers num="7.5.0"/>
        <vers num="7.5.5"/>
        <vers num="7.6.0"/>
        <vers num="7.6.1"/>
        <vers num="7.6.2"/>
        <vers num="7.6.5"/>
        <vers num="7.6.6"/>
        <vers num="7.6.7"/>
        <vers num="7.6.8"/>
        <vers num="7.6.9"/>
        <vers num="7.60.92.0"/>
        <vers num="7.62.14.0"/>
        <vers num="7.64.17.73"/>
        <vers num="7.65.17.80"/>
        <vers num="7.66.71.0"/>
        <vers num="7.67.75.0"/>
        <vers num="7.68.75.0"/>
        <vers num="7.69.80.9"/>
        <vers num="7.7.0"/>
        <vers num="7.7.1"/>
        <vers num="7.7.2"/>
        <vers num="7.7.3"/>
        <vers prev="1" num="7.7.4"/>
        <vers num="7.70.80.34"/>
        <vers num="7.71.80.42"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1250" published="2014-02-26" name="CVE-2014-1250" modified="2014-03-10" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">Apple QuickTime before 7.7.5 does not properly perform a byte-swapping operation, which allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds memory access and application crash) via a crafted ttfo element in a movie file.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://support.apple.com/kb/HT6151" source="CONFIRM" adv="1">http://support.apple.com/kb/HT6151</ref>
      <ref url="http://support.apple.com/kb/HT6150" source="CONFIRM" adv="1">http://support.apple.com/kb/HT6150</ref>
    </refs>
    <vuln_soft>
      <prod vendor="apple" name="quicktime">
        <vers num="7.0.0"/>
        <vers num="7.0.1"/>
        <vers num="7.0.2"/>
        <vers num="7.0.3"/>
        <vers num="7.0.4"/>
        <vers num="7.1.0"/>
        <vers num="7.1.1"/>
        <vers num="7.1.2"/>
        <vers num="7.1.3"/>
        <vers num="7.1.4"/>
        <vers num="7.1.5"/>
        <vers num="7.1.6"/>
        <vers num="7.2.0"/>
        <vers num="7.2.1"/>
        <vers num="7.3.0"/>
        <vers num="7.3.1"/>
        <vers num="7.3.1.70"/>
        <vers num="7.4.0"/>
        <vers num="7.4.1"/>
        <vers num="7.4.5"/>
        <vers num="7.5.0"/>
        <vers num="7.5.5"/>
        <vers num="7.6.0"/>
        <vers num="7.6.1"/>
        <vers num="7.6.2"/>
        <vers num="7.6.5"/>
        <vers num="7.6.6"/>
        <vers num="7.6.7"/>
        <vers num="7.6.8"/>
        <vers num="7.6.9"/>
        <vers num="7.60.92.0"/>
        <vers num="7.62.14.0"/>
        <vers num="7.64.17.73"/>
        <vers num="7.65.17.80"/>
        <vers num="7.66.71.0"/>
        <vers num="7.67.75.0"/>
        <vers num="7.68.75.0"/>
        <vers num="7.69.80.9"/>
        <vers num="7.7.0"/>
        <vers num="7.7.1"/>
        <vers num="7.7.2"/>
        <vers num="7.7.3"/>
        <vers prev="1" num="7.7.4"/>
        <vers num="7.70.80.34"/>
        <vers num="7.71.80.42"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1251" published="2014-02-26" name="CVE-2014-1251" modified="2014-03-07" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">Buffer overflow in Apple QuickTime before 7.7.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted clef atom in a movie file.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://support.apple.com/kb/HT6151" source="CONFIRM" adv="1">http://support.apple.com/kb/HT6151</ref>
    </refs>
    <vuln_soft>
      <prod vendor="apple" name="quicktime">
        <vers num="7.0.0"/>
        <vers num="7.0.1"/>
        <vers num="7.0.2"/>
        <vers num="7.0.3"/>
        <vers num="7.0.4"/>
        <vers num="7.1.0"/>
        <vers num="7.1.1"/>
        <vers num="7.1.2"/>
        <vers num="7.1.3"/>
        <vers num="7.1.4"/>
        <vers num="7.1.5"/>
        <vers num="7.1.6"/>
        <vers num="7.2.0"/>
        <vers num="7.2.1"/>
        <vers num="7.3.0"/>
        <vers num="7.3.1"/>
        <vers num="7.3.1.70"/>
        <vers num="7.4.0"/>
        <vers num="7.4.1"/>
        <vers num="7.4.5"/>
        <vers num="7.5.0"/>
        <vers num="7.5.5"/>
        <vers num="7.6.0"/>
        <vers num="7.6.1"/>
        <vers num="7.6.2"/>
        <vers num="7.6.5"/>
        <vers num="7.6.6"/>
        <vers num="7.6.7"/>
        <vers num="7.6.8"/>
        <vers num="7.6.9"/>
        <vers num="7.60.92.0"/>
        <vers num="7.62.14.0"/>
        <vers num="7.64.17.73"/>
        <vers num="7.65.17.80"/>
        <vers num="7.66.71.0"/>
        <vers num="7.67.75.0"/>
        <vers num="7.68.75.0"/>
        <vers num="7.69.80.9"/>
        <vers num="7.7.0"/>
        <vers num="7.7.1"/>
        <vers num="7.7.2"/>
        <vers num="7.7.3"/>
        <vers prev="1" num="7.7.4"/>
        <vers num="7.70.80.34"/>
        <vers num="7.71.80.42"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1252" published="2014-01-24" name="CVE-2014-1252" modified="2014-04-04" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">Double free vulnerability in Apple Pages 2.x before 2.1 and 5.x before 5.1 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted Microsoft Word file.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90672" source="XF">apple-pages-cve20141252-code-exec(90672)</ref>
      <ref url="http://www.securitytracker.com/id/1029683" source="SECTRACK">1029683</ref>
      <ref url="http://www.securityfocus.com/bid/65113" source="BID">65113</ref>
      <ref url="http://support.apple.com/kb/HT6162" source="CONFIRM">http://support.apple.com/kb/HT6162</ref>
      <ref url="http://support.apple.com/kb/HT6150" source="CONFIRM">http://support.apple.com/kb/HT6150</ref>
      <ref url="http://support.apple.com/kb/HT6117" source="CONFIRM" adv="1">http://support.apple.com/kb/HT6117</ref>
      <ref url="http://secunia.com/advisories/56630" source="SECUNIA">56630</ref>
      <ref url="http://secunia.com/advisories/56615" source="SECUNIA">56615</ref>
      <ref url="http://osvdb.org/102460" source="OSVDB">102460</ref>
    </refs>
    <vuln_soft>
      <prod vendor="apple" name="pages">
        <vers num="2.0"/>
        <vers num="2.0.1"/>
        <vers num="2.0.2"/>
        <vers num="5.0"/>
        <vers num="5.0.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1253" published="2014-02-14" name="CVE-2014-1253" modified="2014-02-14" CVSS_version="2.0" CVSS_vector="(AV:L/AC:M/Au:N/C:N/I:N/A:C)" CVSS_score="4.7" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="3.4" CVSS_base_score="4.7">
    <desc>
      <descript source="cve">AppleMNT.sys in Apple Boot Camp 5 before 5.1 allows local users to cause a denial of service (kernel memory corruption) or possibly have unspecified other impact via a malformed header in a Portable Executable (PE) file.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="http://support.apple.com/kb/HT6126" source="CONFIRM" adv="1">http://support.apple.com/kb/HT6126</ref>
      <ref url="http://seclists.org/bugtraq/2014/Feb/47" source="APPLE">APPLE-SA-2014-02-11-1</ref>
    </refs>
    <vuln_soft>
      <prod vendor="apple" name="boot_camp">
        <vers num="5.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1254" published="2014-02-26" name="CVE-2014-1254" modified="2014-02-27" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:P)" CVSS_score="6.8" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.6" CVSS_base_score="6.8">
    <desc>
      <descript source="cve">Apple Type Services (ATS) in Apple OS X before 10.9.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Type 1 font that is embedded in a document.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://support.apple.com/kb/HT6150" source="CONFIRM" adv="1">http://support.apple.com/kb/HT6150</ref>
    </refs>
    <vuln_soft>
      <prod vendor="apple" name="mac_os_x">
        <vers num="10.8.0"/>
        <vers num="10.8.1"/>
        <vers num="10.8.2"/>
        <vers num="10.8.3"/>
        <vers num="10.8.4"/>
        <vers num="10.8.5" edition="supplemental_update"/>
        <vers num="10.9"/>
        <vers prev="1" num="10.9.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1255" published="2014-02-26" name="CVE-2014-1255" modified="2014-02-27" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">Apple Type Services (ATS) in Apple OS X before 10.9.2 does not properly validate calls to the free function, which allows attackers to bypass the App Sandbox protection mechanism via crafted Mach messages.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://support.apple.com/kb/HT6150" source="CONFIRM" adv="1">http://support.apple.com/kb/HT6150</ref>
    </refs>
    <vuln_soft>
      <prod vendor="apple" name="mac_os_x">
        <vers num="10.9"/>
        <vers prev="1" num="10.9.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1256" published="2014-02-26" name="CVE-2014-1256" modified="2014-02-27" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">Buffer overflow in Apple Type Services (ATS) in Apple OS X before 10.9.2 allows attackers to bypass the App Sandbox protection mechanism via crafted Mach messages.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://support.apple.com/kb/HT6150" source="CONFIRM" adv="1">http://support.apple.com/kb/HT6150</ref>
    </refs>
    <vuln_soft>
      <prod vendor="apple" name="mac_os_x">
        <vers num="10.7.0"/>
        <vers num="10.7.1"/>
        <vers num="10.7.2"/>
        <vers num="10.7.3"/>
        <vers num="10.7.4"/>
        <vers num="10.7.5"/>
        <vers num="10.8.0"/>
        <vers num="10.8.1"/>
        <vers num="10.8.2"/>
        <vers num="10.8.3"/>
        <vers num="10.8.4"/>
        <vers num="10.8.5" edition="supplemental_update"/>
        <vers num="10.9"/>
        <vers prev="1" num="10.9.1"/>
      </prod>
      <prod vendor="apple" name="mac_os_x_server">
        <vers num="10.7.0"/>
        <vers num="10.7.1"/>
        <vers num="10.7.2"/>
        <vers num="10.7.3"/>
        <vers num="10.7.4"/>
        <vers num="10.7.5"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-1257" published="2014-02-26" name="CVE-2014-1257" modified="2014-02-27" CVSS_version="2.0" CVSS_vector="(AV:L/AC:L/Au:N/C:P/I:P/A:N)" CVSS_score="3.6" CVSS_impact_subscore="4.9" CVSS_exploit_subscore="3.9" CVSS_base_score="3.6">
    <desc>
      <descript source="cve">CFNetwork in Apple OS X through 10.8.5 does not remove session cookies upon a Safari reset action, which allows physically proximate attackers to bypass intended access restrictions by leveraging an unattended workstation.</descript>
    </desc>
    <loss_types>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="http://support.apple.com/kb/HT6150" source="CONFIRM" adv="1">http://support.apple.com/kb/HT6150</ref>
    </refs>
    <vuln_soft>
      <prod vendor="apple" name="mac_os_x">
        <vers num="10.8.0"/>
        <vers num="10.8.1"/>
        <vers num="10.8.2"/>
        <vers num="10.8.3"/>
        <vers num="10.8.4"/>
        <vers prev="1" num="10.8.5" edition="supplemental_update"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1258" published="2014-02-26" name="CVE-2014-1258" modified="2014-02-27" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:P)" CVSS_score="6.8" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.6" CVSS_base_score="6.8">
    <desc>
      <descript source="cve">Heap-based buffer overflow in CoreAnimation in Apple OS X before 10.9.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted image.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://support.apple.com/kb/HT6150" source="CONFIRM" adv="1">http://support.apple.com/kb/HT6150</ref>
    </refs>
    <vuln_soft>
      <prod vendor="apple" name="mac_os_x">
        <vers num="10.8.0"/>
        <vers num="10.8.1"/>
        <vers num="10.8.2"/>
        <vers num="10.8.3"/>
        <vers num="10.8.4"/>
        <vers num="10.8.5" edition="supplemental_update"/>
        <vers num="10.9"/>
        <vers prev="1" num="10.9.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1259" published="2014-02-26" name="CVE-2014-1259" modified="2014-03-10" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:P)" CVSS_score="6.8" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.6" CVSS_base_score="6.8">
    <desc>
      <descript source="cve">Buffer overflow in File Bookmark in Apple OS X before 10.9.2 allows attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted filename.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://support.apple.com/kb/HT6150" source="CONFIRM" adv="1">http://support.apple.com/kb/HT6150</ref>
    </refs>
    <vuln_soft>
      <prod vendor="apple" name="mac_os_x">
        <vers num="10.7.0"/>
        <vers num="10.7.1"/>
        <vers num="10.7.2"/>
        <vers num="10.7.3"/>
        <vers num="10.7.4"/>
        <vers num="10.7.5"/>
        <vers num="10.8.0"/>
        <vers num="10.8.1"/>
        <vers num="10.8.2"/>
        <vers num="10.8.3"/>
        <vers num="10.8.4"/>
        <vers num="10.8.5" edition="supplemental_update"/>
        <vers num="10.9"/>
        <vers prev="1" num="10.9.1"/>
      </prod>
      <prod vendor="apple" name="mac_os_x_server">
        <vers num="10.7.0"/>
        <vers num="10.7.1"/>
        <vers num="10.7.2"/>
        <vers num="10.7.3"/>
        <vers num="10.7.4"/>
        <vers num="10.7.5"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1260" published="2014-02-26" name="CVE-2014-1260" modified="2014-03-10" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:P)" CVSS_score="6.8" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.6" CVSS_base_score="6.8">
    <desc>
      <descript source="cve">QuickLook in Apple OS X through 10.8.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted Microsoft Office document.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://support.apple.com/kb/HT6150" source="CONFIRM" adv="1">http://support.apple.com/kb/HT6150</ref>
    </refs>
    <vuln_soft>
      <prod vendor="apple" name="mac_os_x">
        <vers num="10.8.0"/>
        <vers num="10.8.1"/>
        <vers num="10.8.2"/>
        <vers num="10.8.3"/>
        <vers num="10.8.4"/>
        <vers prev="1" num="10.8.5" edition="supplemental_update"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1261" published="2014-02-26" name="CVE-2014-1261" modified="2014-02-27" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">Integer signedness error in CoreText in Apple OS X before 10.9.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted Unicode font.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://support.apple.com/kb/HT6150" source="CONFIRM" adv="1">http://support.apple.com/kb/HT6150</ref>
    </refs>
    <vuln_soft>
      <prod vendor="apple" name="mac_os_x">
        <vers num="10.9"/>
        <vers prev="1" num="10.9.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1262" published="2014-02-26" name="CVE-2014-1262" modified="2014-02-27" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">Apple Type Services (ATS) in Apple OS X before 10.9.2 allows attackers to bypass the App Sandbox protection mechanism via crafted Mach messages that trigger memory corruption.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://support.apple.com/kb/HT6150" source="CONFIRM" adv="1">http://support.apple.com/kb/HT6150</ref>
    </refs>
    <vuln_soft>
      <prod vendor="apple" name="mac_os_x">
        <vers num="10.9"/>
        <vers prev="1" num="10.9.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1263" published="2014-02-26" name="CVE-2014-1263" modified="2014-04-24" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:N/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">curl in Apple OS X 10.9.x before 10.9.2 does not verify X.509 certificates from HTTPS servers that are accessed using a numerical IP address, which allows man-in-the-middle attackers to spoof servers via a crafted certificate.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="https://gist.github.com/rmoriz/fb2b0a6a0ce10550ab73" source="MISC">https://gist.github.com/rmoriz/fb2b0a6a0ce10550ab73</ref>
      <ref url="http://www.getchef.com/blog/2014/04/09/enterprise-chef-11-1-3-release/" source="CONFIRM">http://www.getchef.com/blog/2014/04/09/enterprise-chef-11-1-3-release/</ref>
      <ref url="http://www.getchef.com/blog/2014/04/09/enterprise-chef-1-4-9-release/" source="CONFIRM">http://www.getchef.com/blog/2014/04/09/enterprise-chef-1-4-9-release/</ref>
      <ref url="http://www.getchef.com/blog/2014/04/09/chef-server-11-0-12-release/" source="CONFIRM">http://www.getchef.com/blog/2014/04/09/chef-server-11-0-12-release/</ref>
      <ref url="http://twitter.com/okoeroo/statuses/437272014043496449" source="MISC">http://twitter.com/okoeroo/statuses/437272014043496449</ref>
      <ref url="http://twitter.com/agl__/statuses/437029812046422016" source="MISC">http://twitter.com/agl__/statuses/437029812046422016</ref>
      <ref url="http://support.apple.com/kb/HT6150" source="CONFIRM" adv="1">http://support.apple.com/kb/HT6150</ref>
      <ref url="http://secunia.com/advisories/57968" source="SECUNIA">57968</ref>
      <ref url="http://secunia.com/advisories/57966" source="SECUNIA">57966</ref>
      <ref url="http://secunia.com/advisories/57836" source="SECUNIA">57836</ref>
    </refs>
    <vuln_soft>
      <prod vendor="apple" name="mac_os_x">
        <vers num="10.9"/>
        <vers prev="1" num="10.9.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-1264" published="2014-02-26" name="CVE-2014-1264" modified="2014-03-10" CVSS_version="2.0" CVSS_vector="(AV:L/AC:M/Au:N/C:P/I:P/A:N)" CVSS_score="3.3" CVSS_impact_subscore="4.9" CVSS_exploit_subscore="3.4" CVSS_base_score="3.3">
    <desc>
      <descript source="cve">Finder in Apple OS X before 10.9.2 does not ensure ACL integrity after the viewing of file ACL information, which allows local users to bypass intended access restrictions in opportunistic circumstances via standard filesystem operations on a file with a damaged ACL.</descript>
    </desc>
    <loss_types>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="http://support.apple.com/kb/HT6150" source="CONFIRM" adv="1">http://support.apple.com/kb/HT6150</ref>
    </refs>
    <vuln_soft>
      <prod vendor="apple" name="mac_os_x">
        <vers num="10.9"/>
        <vers prev="1" num="10.9.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1265" published="2014-02-26" name="CVE-2014-1265" modified="2014-02-27" CVSS_version="2.0" CVSS_vector="(AV:L/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="4.6" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="3.9" CVSS_base_score="4.6">
    <desc>
      <descript source="cve">The systemsetup program in the Date and Time subsystem in Apple OS X before 10.9.2 allows local users to bypass intended access restrictions by changing the current time on the system clock.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="http://support.apple.com/kb/HT6150" source="CONFIRM" adv="1">http://support.apple.com/kb/HT6150</ref>
    </refs>
    <vuln_soft>
      <prod vendor="apple" name="mac_os_x">
        <vers num="10.7.0"/>
        <vers num="10.7.1"/>
        <vers num="10.7.2"/>
        <vers num="10.7.3"/>
        <vers num="10.7.4"/>
        <vers num="10.7.5"/>
        <vers num="10.8.0"/>
        <vers num="10.8.1"/>
        <vers num="10.8.2"/>
        <vers num="10.8.3"/>
        <vers num="10.8.4"/>
        <vers num="10.8.5" edition="supplemental_update"/>
        <vers num="10.9"/>
        <vers prev="1" num="10.9.1"/>
      </prod>
      <prod vendor="apple" name="mac_os_x_server">
        <vers num="10.7.0"/>
        <vers num="10.7.1"/>
        <vers num="10.7.2"/>
        <vers num="10.7.3"/>
        <vers num="10.7.4"/>
        <vers num="10.7.5"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1266" published="2014-02-22" name="CVE-2014-1266" modified="2014-03-05" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:P)" CVSS_score="6.8" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.6" CVSS_base_score="6.8">
    <desc>
      <descript source="cve">The SSLVerifySignedServerKeyExchange function in libsecurity_ssl/lib/sslKeyExchange.c in the Secure Transport feature in the Data Security component in Apple iOS 6.x before 6.1.6 and 7.x before 7.0.6, Apple TV 6.x before 6.0.2, and Apple OS X 10.9.x before 10.9.2 does not check the signature in a TLS Server Key Exchange message, which allows man-in-the-middle attackers to spoof SSL servers by (1) using an arbitrary private key for the signing step or (2) omitting the signing step.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://www.imperialviolet.org/2014/02/22/applebug.html" source="MISC">https://www.imperialviolet.org/2014/02/22/applebug.html</ref>
      <ref url="https://www.cs.columbia.edu/~smb/blog/2014-02/2014-02-24.html" source="MISC">https://www.cs.columbia.edu/~smb/blog/2014-02/2014-02-24.html</ref>
      <ref url="https://www.cs.columbia.edu/~smb/blog/2014-02/2014-02-23.html" source="MISC">https://www.cs.columbia.edu/~smb/blog/2014-02/2014-02-23.html</ref>
      <ref url="https://news.ycombinator.com/item?id=7281378" source="MISC">https://news.ycombinator.com/item?id=7281378</ref>
      <ref url="http://support.apple.com/kb/HT6150" source="CONFIRM">http://support.apple.com/kb/HT6150</ref>
      <ref url="http://support.apple.com/kb/HT6148" source="CONFIRM" adv="1">http://support.apple.com/kb/HT6148</ref>
      <ref url="http://support.apple.com/kb/HT6147" source="CONFIRM" adv="1">http://support.apple.com/kb/HT6147</ref>
      <ref url="http://support.apple.com/kb/HT6146" source="CONFIRM" adv="1">http://support.apple.com/kb/HT6146</ref>
      <ref url="http://it.slashdot.org/comments.pl?sid=4821073&amp;cid=46310187" source="MISC">http://it.slashdot.org/comments.pl?sid=4821073&amp;cid=46310187</ref>
    </refs>
    <vuln_soft>
      <prod vendor="apple" name="apple_tv">
        <vers num="6.0"/>
        <vers num="6.0.1"/>
      </prod>
      <prod vendor="apple" name="iphone_os">
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers num="6.0.2"/>
        <vers num="6.1"/>
        <vers num="6.1.2"/>
        <vers num="6.1.3"/>
        <vers num="6.1.4"/>
        <vers num="6.1.5"/>
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="7.0.2"/>
        <vers num="7.0.3"/>
        <vers num="7.0.4"/>
        <vers num="7.0.5"/>
      </prod>
      <prod vendor="apple" name="mac_os_x">
        <vers num="10.9"/>
        <vers num="10.9.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1267" published="2014-03-14" name="CVE-2014-1267" modified="2014-03-14" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:N)" CVSS_score="5.8" CVSS_impact_subscore="4.9" CVSS_exploit_subscore="8.6" CVSS_base_score="5.8">
    <desc>
      <descript source="cve">The Configuration Profiles component in Apple iOS before 7.1 and Apple TV before 6.1 does not properly evaluate the expiration date of a mobile configuration profile, which allows attackers to bypass intended access restrictions by using a profile after the date has passed.</descript>
    </desc>
    <loss_types>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://support.apple.com/kb/HT6163" source="CONFIRM" adv="1">http://support.apple.com/kb/HT6163</ref>
      <ref url="http://support.apple.com/kb/HT6162" source="CONFIRM" adv="1">http://support.apple.com/kb/HT6162</ref>
    </refs>
    <vuln_soft>
      <prod vendor="apple" name="apple_tv">
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers prev="1" num="6.0.2"/>
      </prod>
      <prod vendor="apple" name="iphone_os">
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="7.0.2"/>
        <vers num="7.0.3"/>
        <vers num="7.0.4"/>
        <vers num="7.0.5"/>
        <vers prev="1" num="7.0.6"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1268" published="2014-02-26" name="CVE-2014-1268" modified="2014-02-27" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:P)" CVSS_score="6.8" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.6" CVSS_base_score="6.8">
    <desc>
      <descript source="cve">WebKit, as used in Apple Safari before 6.1.2 and 7.x before 7.0.2, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2014-1269 and CVE-2014-1270.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://support.apple.com/kb/HT6145" source="CONFIRM" adv="1">http://support.apple.com/kb/HT6145</ref>
    </refs>
    <vuln_soft>
      <prod vendor="apple" name="safari">
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers num="6.0.2"/>
        <vers num="6.0.3"/>
        <vers num="6.0.4"/>
        <vers num="6.0.5"/>
        <vers num="6.1"/>
        <vers prev="1" num="6.1.1"/>
        <vers num="7.0"/>
        <vers num="7.0.1"/>
      </prod>
      <prod vendor="apple" name="webkit">
        <vers num=""/>
      </prod>
      <prod vendor="apple" name="mac_os_x">
        <vers num="10.7.0"/>
        <vers num="10.7.1"/>
        <vers num="10.7.2"/>
        <vers num="10.7.3"/>
        <vers num="10.7.4"/>
        <vers num="10.7.5"/>
        <vers num="10.8.0"/>
        <vers num="10.8.1"/>
        <vers num="10.8.2"/>
        <vers num="10.8.3"/>
        <vers num="10.8.4"/>
        <vers num="10.8.5" edition="supplemental_update"/>
        <vers num="10.9"/>
        <vers num="10.9.1"/>
      </prod>
      <prod vendor="apple" name="mac_os_x_server">
        <vers num="10.7.0"/>
        <vers num="10.7.1"/>
        <vers num="10.7.2"/>
        <vers num="10.7.3"/>
        <vers num="10.7.4"/>
        <vers num="10.7.5"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1269" published="2014-02-26" name="CVE-2014-1269" modified="2014-03-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:P)" CVSS_score="6.8" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.6" CVSS_base_score="6.8">
    <desc>
      <descript source="cve">WebKit, as used in Apple Safari before 6.1.2 and 7.x before 7.0.2, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2014-1268 and CVE-2014-1270.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://support.apple.com/kb/HT6163" source="CONFIRM">http://support.apple.com/kb/HT6163</ref>
      <ref url="http://support.apple.com/kb/HT6162" source="CONFIRM">http://support.apple.com/kb/HT6162</ref>
      <ref url="http://support.apple.com/kb/HT6145" source="CONFIRM" adv="1">http://support.apple.com/kb/HT6145</ref>
    </refs>
    <vuln_soft>
      <prod vendor="apple" name="safari">
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers num="6.0.2"/>
        <vers num="6.0.3"/>
        <vers num="6.0.4"/>
        <vers num="6.0.5"/>
        <vers num="6.1"/>
        <vers prev="1" num="6.1.1"/>
        <vers num="7.0"/>
        <vers num="7.0.1"/>
      </prod>
      <prod vendor="apple" name="webkit">
        <vers num=""/>
      </prod>
      <prod vendor="apple" name="mac_os_x">
        <vers num="10.7.0"/>
        <vers num="10.7.1"/>
        <vers num="10.7.2"/>
        <vers num="10.7.3"/>
        <vers num="10.7.4"/>
        <vers num="10.7.5"/>
        <vers num="10.8.0"/>
        <vers num="10.8.1"/>
        <vers num="10.8.2"/>
        <vers num="10.8.3"/>
        <vers num="10.8.4"/>
        <vers num="10.8.5" edition="supplemental_update"/>
        <vers num="10.9"/>
        <vers num="10.9.1"/>
      </prod>
      <prod vendor="apple" name="mac_os_x_server">
        <vers num="10.7.0"/>
        <vers num="10.7.1"/>
        <vers num="10.7.2"/>
        <vers num="10.7.3"/>
        <vers num="10.7.4"/>
        <vers num="10.7.5"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1270" published="2014-02-26" name="CVE-2014-1270" modified="2014-03-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:P)" CVSS_score="6.8" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.6" CVSS_base_score="6.8">
    <desc>
      <descript source="cve">WebKit, as used in Apple Safari before 6.1.2 and 7.x before 7.0.2, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2014-1268 and CVE-2014-1269.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://support.apple.com/kb/HT6163" source="CONFIRM">http://support.apple.com/kb/HT6163</ref>
      <ref url="http://support.apple.com/kb/HT6162" source="CONFIRM">http://support.apple.com/kb/HT6162</ref>
      <ref url="http://support.apple.com/kb/HT6145" source="CONFIRM" adv="1">http://support.apple.com/kb/HT6145</ref>
    </refs>
    <vuln_soft>
      <prod vendor="apple" name="safari">
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers num="6.0.2"/>
        <vers num="6.0.3"/>
        <vers num="6.0.4"/>
        <vers num="6.0.5"/>
        <vers num="6.1"/>
        <vers prev="1" num="6.1.1"/>
        <vers num="7.0"/>
        <vers num="7.0.1"/>
      </prod>
      <prod vendor="apple" name="webkit">
        <vers num=""/>
      </prod>
      <prod vendor="apple" name="mac_os_x">
        <vers num="10.7.0"/>
        <vers num="10.7.1"/>
        <vers num="10.7.2"/>
        <vers num="10.7.3"/>
        <vers num="10.7.4"/>
        <vers num="10.7.5"/>
        <vers num="10.8.0"/>
        <vers num="10.8.1"/>
        <vers num="10.8.2"/>
        <vers num="10.8.3"/>
        <vers num="10.8.4"/>
        <vers num="10.8.5" edition="supplemental_update"/>
        <vers num="10.9"/>
        <vers num="10.9.1"/>
      </prod>
      <prod vendor="apple" name="mac_os_x_server">
        <vers num="10.7.0"/>
        <vers num="10.7.1"/>
        <vers num="10.7.2"/>
        <vers num="10.7.3"/>
        <vers num="10.7.4"/>
        <vers num="10.7.5"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1271" published="2014-03-14" name="CVE-2014-1271" modified="2014-03-14" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:C)" CVSS_score="7.8" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="10.0" CVSS_base_score="7.8">
    <desc>
      <descript source="cve">CoreCapture in Apple iOS before 7.1 and Apple TV before 6.1 does not properly validate IOKit API calls, which allows attackers to cause a denial of service (assertion failure and device crash) via a crafted app.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://support.apple.com/kb/HT6163" source="CONFIRM" adv="1">http://support.apple.com/kb/HT6163</ref>
      <ref url="http://support.apple.com/kb/HT6162" source="CONFIRM" adv="1">http://support.apple.com/kb/HT6162</ref>
    </refs>
    <vuln_soft>
      <prod vendor="apple" name="apple_tv">
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers prev="1" num="6.0.2"/>
      </prod>
      <prod vendor="apple" name="iphone_os">
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="7.0.2"/>
        <vers num="7.0.3"/>
        <vers num="7.0.4"/>
        <vers num="7.0.5"/>
        <vers prev="1" num="7.0.6"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1272" published="2014-03-14" name="CVE-2014-1272" modified="2014-03-14" CVSS_version="2.0" CVSS_vector="(AV:L/AC:M/Au:N/C:N/I:C/A:C)" CVSS_score="6.3" CVSS_impact_subscore="9.2" CVSS_exploit_subscore="3.4" CVSS_base_score="6.3">
    <desc>
      <descript source="cve">CrashHouseKeeping in Crash Reporting in Apple iOS before 7.1 and Apple TV before 6.1 allows local users to change arbitrary file permissions by leveraging a symlink.</descript>
    </desc>
    <loss_types>
      <avail/>
      <int/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="http://support.apple.com/kb/HT6163" source="CONFIRM" adv="1">http://support.apple.com/kb/HT6163</ref>
      <ref url="http://support.apple.com/kb/HT6162" source="CONFIRM" adv="1">http://support.apple.com/kb/HT6162</ref>
    </refs>
    <vuln_soft>
      <prod vendor="apple" name="apple_tv">
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers prev="1" num="6.0.2"/>
      </prod>
      <prod vendor="apple" name="iphone_os">
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="7.0.2"/>
        <vers num="7.0.3"/>
        <vers num="7.0.4"/>
        <vers num="7.0.5"/>
        <vers prev="1" num="7.0.6"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1273" published="2014-03-14" name="CVE-2014-1273" modified="2014-03-14" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:N)" CVSS_score="5.8" CVSS_impact_subscore="4.9" CVSS_exploit_subscore="8.6" CVSS_base_score="5.8">
    <desc>
      <descript source="cve">dyld in Apple iOS before 7.1 and Apple TV before 6.1 allows attackers to bypass code-signing requirements by leveraging use of text-relocation instructions in a dynamic library.</descript>
    </desc>
    <loss_types>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://support.apple.com/kb/HT6163" source="CONFIRM" adv="1">http://support.apple.com/kb/HT6163</ref>
      <ref url="http://support.apple.com/kb/HT6162" source="CONFIRM" adv="1">http://support.apple.com/kb/HT6162</ref>
    </refs>
    <vuln_soft>
      <prod vendor="apple" name="apple_tv">
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers prev="1" num="6.0.2"/>
      </prod>
      <prod vendor="apple" name="iphone_os">
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="7.0.2"/>
        <vers num="7.0.3"/>
        <vers num="7.0.4"/>
        <vers num="7.0.5"/>
        <vers prev="1" num="7.0.6"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-1274" published="2014-03-14" name="CVE-2014-1274" modified="2014-03-14" CVSS_version="2.0" CVSS_vector="(AV:L/AC:L/Au:N/C:P/I:N/A:N)" CVSS_score="2.1" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="3.9" CVSS_base_score="2.1">
    <desc>
      <descript source="cve">FaceTime in Apple iOS before 7.1 allows physically proximate attackers to obtain sensitive FaceTime contact information by using the lock screen for an invalid FaceTime call.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="http://support.apple.com/kb/HT6162" source="CONFIRM" adv="1">http://support.apple.com/kb/HT6162</ref>
    </refs>
    <vuln_soft>
      <prod vendor="apple" name="iphone_os">
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="7.0.2"/>
        <vers num="7.0.3"/>
        <vers num="7.0.4"/>
        <vers num="7.0.5"/>
        <vers prev="1" num="7.0.6"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1275" published="2014-03-14" name="CVE-2014-1275" modified="2014-03-14" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:P)" CVSS_score="6.8" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.6" CVSS_base_score="6.8">
    <desc>
      <descript source="cve">Buffer overflow in ImageIO in Apple iOS before 7.1 and Apple TV before 6.1 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted JPEG2000 data in a PDF document.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://support.apple.com/kb/HT6163" source="CONFIRM" adv="1">http://support.apple.com/kb/HT6163</ref>
      <ref url="http://support.apple.com/kb/HT6162" source="CONFIRM" adv="1">http://support.apple.com/kb/HT6162</ref>
    </refs>
    <vuln_soft>
      <prod vendor="apple" name="apple_tv">
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers prev="1" num="6.0.2"/>
      </prod>
      <prod vendor="apple" name="iphone_os">
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="7.0.2"/>
        <vers num="7.0.3"/>
        <vers num="7.0.4"/>
        <vers num="7.0.5"/>
        <vers prev="1" num="7.0.6"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1276" published="2014-03-14" name="CVE-2014-1276" modified="2014-03-14" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:N/A:N)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">IOKit HID Event in Apple iOS before 7.1 allows attackers to conduct user-action monitoring attacks against arbitrary apps via a crafted app that accesses an IOKit framework interface.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://support.apple.com/kb/HT6162" source="CONFIRM" adv="1">http://support.apple.com/kb/HT6162</ref>
    </refs>
    <vuln_soft>
      <prod vendor="apple" name="iphone_os">
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="7.0.2"/>
        <vers num="7.0.3"/>
        <vers num="7.0.4"/>
        <vers num="7.0.5"/>
        <vers prev="1" num="7.0.6"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" seq="2014-1277" reject="1" published="2014-03-13" name="CVE-2014-1277" modified="2014-03-13">
    <desc>
      <descript source="cve">** REJECT **  DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2013-3948.  Reason: This candidate is a duplicate of CVE-2013-3948.  Notes: All CVE users should reference CVE-2013-3948 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage.</descript>
    </desc>
    <refs/>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1278" published="2014-03-14" name="CVE-2014-1278" modified="2014-03-14" CVSS_version="2.0" CVSS_vector="(AV:L/AC:L/Au:N/C:C/I:C/A:C)" CVSS_score="7.2" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="3.9" CVSS_base_score="7.2">
    <desc>
      <descript source="cve">The ptmx_get_ioctl function in the ARM kernel in Apple iOS before 7.1 and Apple TV before 6.1 allows local users to gain privileges or cause a denial of service (out-of-bounds memory access and device crash) via a crafted call.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="http://support.apple.com/kb/HT6163" source="CONFIRM" adv="1">http://support.apple.com/kb/HT6163</ref>
      <ref url="http://support.apple.com/kb/HT6162" source="CONFIRM" adv="1">http://support.apple.com/kb/HT6162</ref>
    </refs>
    <vuln_soft>
      <prod vendor="apple" name="apple_tv">
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers prev="1" num="6.0.2"/>
      </prod>
      <prod vendor="apple" name="iphone_os">
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="7.0.2"/>
        <vers num="7.0.3"/>
        <vers num="7.0.4"/>
        <vers num="7.0.5"/>
        <vers prev="1" num="7.0.6"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-1279" published="2014-03-14" name="CVE-2014-1279" modified="2014-03-14" CVSS_version="2.0" CVSS_vector="(AV:L/AC:L/Au:N/C:P/I:N/A:N)" CVSS_score="2.1" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="3.9" CVSS_base_score="2.1">
    <desc>
      <descript source="cve">Apple TV before 6.1 does not properly restrict logging, which allows local users to obtain sensitive information by reading log data.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="http://support.apple.com/kb/HT6163" source="CONFIRM" adv="1">http://support.apple.com/kb/HT6163</ref>
    </refs>
    <vuln_soft>
      <prod vendor="apple" name="apple_tv">
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers prev="1" num="6.0.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1280" published="2014-03-14" name="CVE-2014-1280" modified="2014-03-14" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:N/A:C)" CVSS_score="7.1" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="8.6" CVSS_base_score="7.1">
    <desc>
      <descript source="cve">Video Driver in Apple iOS before 7.1 and Apple TV before 6.1 allows remote attackers to cause a denial of service (NULL pointer dereference and device hang) via a crafted video file with MPEG-4 encoding.</descript>
      <descript source="nvd">Per: http://cwe.mitre.org/data/definitions/476.html

"CWE-476: NULL Pointer Dereference"</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://support.apple.com/kb/HT6163" source="CONFIRM" adv="1">http://support.apple.com/kb/HT6163</ref>
      <ref url="http://support.apple.com/kb/HT6162" source="CONFIRM" adv="1">http://support.apple.com/kb/HT6162</ref>
    </refs>
    <vuln_soft>
      <prod vendor="apple" name="apple_tv">
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers prev="1" num="6.0.2"/>
      </prod>
      <prod vendor="apple" name="iphone_os">
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="7.0.2"/>
        <vers num="7.0.3"/>
        <vers num="7.0.4"/>
        <vers num="7.0.5"/>
        <vers prev="1" num="7.0.6"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-1281" published="2014-03-14" name="CVE-2014-1281" modified="2014-03-14" CVSS_version="2.0" CVSS_vector="(AV:L/AC:M/Au:N/C:P/I:N/A:N)" CVSS_score="1.9" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="3.4" CVSS_base_score="1.9">
    <desc>
      <descript source="cve">Photos Backend in Apple iOS before 7.1 does not properly manage the asset-library cache during deletions, which allows physically proximate attackers to obtain sensitive photo data by launching the Photos app and looking under a transparent image.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="http://support.apple.com/kb/HT6162" source="CONFIRM" adv="1">http://support.apple.com/kb/HT6162</ref>
    </refs>
    <vuln_soft>
      <prod vendor="apple" name="iphone_os">
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="7.0.2"/>
        <vers num="7.0.3"/>
        <vers num="7.0.4"/>
        <vers num="7.0.5"/>
        <vers prev="1" num="7.0.6"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1282" published="2014-03-14" name="CVE-2014-1282" modified="2014-03-14" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:N)" CVSS_score="5.8" CVSS_impact_subscore="4.9" CVSS_exploit_subscore="8.6" CVSS_base_score="5.8">
    <desc>
      <descript source="cve">The Profiles component in Apple iOS before 7.1 and Apple TV before 6.1 allows attackers to bypass intended configuration-profile visibility requirements via a long name.</descript>
    </desc>
    <loss_types>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://support.apple.com/kb/HT6163" source="CONFIRM" adv="1">http://support.apple.com/kb/HT6163</ref>
      <ref url="http://support.apple.com/kb/HT6162" source="CONFIRM" adv="1">http://support.apple.com/kb/HT6162</ref>
    </refs>
    <vuln_soft>
      <prod vendor="apple" name="apple_tv">
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers prev="1" num="6.0.2"/>
      </prod>
      <prod vendor="apple" name="iphone_os">
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="7.0.2"/>
        <vers num="7.0.3"/>
        <vers num="7.0.4"/>
        <vers num="7.0.5"/>
        <vers prev="1" num="7.0.6"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" seq="2014-1284" reject="1" published="2014-03-13" name="CVE-2014-1284" modified="2014-03-13">
    <desc>
      <descript source="cve">** REJECT **  DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2014-2019.  Reason: This candidate is a duplicate of CVE-2014-2019.  Notes: All CVE users should reference CVE-2014-2019 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage.</descript>
    </desc>
    <refs/>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1285" published="2014-03-14" name="CVE-2014-1285" modified="2014-03-14" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:N)" CVSS_score="5.8" CVSS_impact_subscore="4.9" CVSS_exploit_subscore="8.6" CVSS_base_score="5.8">
    <desc>
      <descript source="cve">Springboard in Apple iOS before 7.1 allows physically proximate attackers to bypass intended access restrictions and read the home screen by leveraging an application crash during activation of an unactivated device.</descript>
    </desc>
    <loss_types>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://support.apple.com/kb/HT6162" source="CONFIRM" adv="1">http://support.apple.com/kb/HT6162</ref>
    </refs>
    <vuln_soft>
      <prod vendor="apple" name="iphone_os">
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="7.0.2"/>
        <vers num="7.0.3"/>
        <vers num="7.0.4"/>
        <vers num="7.0.5"/>
        <vers prev="1" num="7.0.6"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1286" published="2014-03-14" name="CVE-2014-1286" modified="2014-03-14" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:P)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">SpringBoard Lock Screen in Apple iOS before 7.1 allows remote attackers to cause a denial of service (lock-screen hang) by leveraging a state-management error.</descript>
      <descript source="nvd">Per: https://cwe.mitre.org/data/definitions/361.html

"CWE-361: Time and State"</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://support.apple.com/kb/HT6162" source="CONFIRM" adv="1">http://support.apple.com/kb/HT6162</ref>
    </refs>
    <vuln_soft>
      <prod vendor="apple" name="iphone_os">
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="7.0.2"/>
        <vers num="7.0.3"/>
        <vers num="7.0.4"/>
        <vers num="7.0.5"/>
        <vers prev="1" num="7.0.6"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1287" published="2014-03-14" name="CVE-2014-1287" modified="2014-03-14" CVSS_version="2.0" CVSS_vector="(AV:L/AC:L/Au:N/C:C/I:C/A:C)" CVSS_score="7.2" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="3.9" CVSS_base_score="7.2">
    <desc>
      <descript source="cve">USB Host in Apple iOS before 7.1 and Apple TV before 6.1 allows physically proximate attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted USB messages.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="http://support.apple.com/kb/HT6163" source="CONFIRM" adv="1">http://support.apple.com/kb/HT6163</ref>
      <ref url="http://support.apple.com/kb/HT6162" source="CONFIRM" adv="1">http://support.apple.com/kb/HT6162</ref>
    </refs>
    <vuln_soft>
      <prod vendor="apple" name="apple_tv">
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers prev="1" num="6.0.2"/>
      </prod>
      <prod vendor="apple" name="iphone_os">
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="7.0.2"/>
        <vers num="7.0.3"/>
        <vers num="7.0.4"/>
        <vers num="7.0.5"/>
        <vers prev="1" num="7.0.6"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1289" published="2014-03-14" name="CVE-2014-1289" modified="2014-04-04" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:P)" CVSS_score="6.8" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.6" CVSS_base_score="6.8">
    <desc>
      <descript source="cve">WebKit, as used in Apple iOS before 7.1 and Apple TV before 6.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2014-1290, CVE-2014-1291, CVE-2014-1292, CVE-2014-1293, and CVE-2014-1294.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://support.apple.com/kb/HT6163" source="CONFIRM" adv="1">http://support.apple.com/kb/HT6163</ref>
      <ref url="http://support.apple.com/kb/HT6162" source="CONFIRM" adv="1">http://support.apple.com/kb/HT6162</ref>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-04/0009.html" source="APPLE">APPLE-SA-2014-04-01-1</ref>
    </refs>
    <vuln_soft>
      <prod vendor="apple" name="apple_tv">
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers prev="1" num="6.0.2"/>
      </prod>
      <prod vendor="apple" name="iphone_os">
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="7.0.2"/>
        <vers num="7.0.3"/>
        <vers num="7.0.4"/>
        <vers num="7.0.5"/>
        <vers prev="1" num="7.0.6"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1290" published="2014-03-14" name="CVE-2014-1290" modified="2014-04-04" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:P)" CVSS_score="6.8" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.6" CVSS_base_score="6.8">
    <desc>
      <descript source="cve">WebKit, as used in Apple iOS before 7.1 and Apple TV before 6.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2014-1289, CVE-2014-1291, CVE-2014-1292, CVE-2014-1293, and CVE-2014-1294.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://support.apple.com/kb/HT6163" source="CONFIRM" adv="1">http://support.apple.com/kb/HT6163</ref>
      <ref url="http://support.apple.com/kb/HT6162" source="CONFIRM" adv="1">http://support.apple.com/kb/HT6162</ref>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-04/0009.html" source="APPLE">APPLE-SA-2014-04-01-1</ref>
    </refs>
    <vuln_soft>
      <prod vendor="apple" name="apple_tv">
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers prev="1" num="6.0.2"/>
      </prod>
      <prod vendor="apple" name="iphone_os">
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="7.0.2"/>
        <vers num="7.0.3"/>
        <vers num="7.0.4"/>
        <vers num="7.0.5"/>
        <vers prev="1" num="7.0.6"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1291" published="2014-03-14" name="CVE-2014-1291" modified="2014-04-04" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:P)" CVSS_score="6.8" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.6" CVSS_base_score="6.8">
    <desc>
      <descript source="cve">WebKit, as used in Apple iOS before 7.1 and Apple TV before 6.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2014-1289, CVE-2014-1290, CVE-2014-1292, CVE-2014-1293, and CVE-2014-1294.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://support.apple.com/kb/HT6163" source="CONFIRM" adv="1">http://support.apple.com/kb/HT6163</ref>
      <ref url="http://support.apple.com/kb/HT6162" source="CONFIRM" adv="1">http://support.apple.com/kb/HT6162</ref>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-04/0009.html" source="APPLE">APPLE-SA-2014-04-01-1</ref>
    </refs>
    <vuln_soft>
      <prod vendor="apple" name="apple_tv">
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers prev="1" num="6.0.2"/>
      </prod>
      <prod vendor="apple" name="iphone_os">
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="7.0.2"/>
        <vers num="7.0.3"/>
        <vers num="7.0.4"/>
        <vers num="7.0.5"/>
        <vers prev="1" num="7.0.6"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1292" published="2014-03-14" name="CVE-2014-1292" modified="2014-04-04" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:P)" CVSS_score="6.8" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.6" CVSS_base_score="6.8">
    <desc>
      <descript source="cve">WebKit, as used in Apple iOS before 7.1 and Apple TV before 6.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2014-1289, CVE-2014-1290, CVE-2014-1291, CVE-2014-1293, and CVE-2014-1294.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://support.apple.com/kb/HT6163" source="CONFIRM" adv="1">http://support.apple.com/kb/HT6163</ref>
      <ref url="http://support.apple.com/kb/HT6162" source="CONFIRM" adv="1">http://support.apple.com/kb/HT6162</ref>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-04/0009.html" source="APPLE">APPLE-SA-2014-04-01-1</ref>
    </refs>
    <vuln_soft>
      <prod vendor="apple" name="apple_tv">
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers prev="1" num="6.0.2"/>
      </prod>
      <prod vendor="apple" name="iphone_os">
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="7.0.2"/>
        <vers num="7.0.3"/>
        <vers num="7.0.4"/>
        <vers num="7.0.5"/>
        <vers prev="1" num="7.0.6"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1293" published="2014-03-14" name="CVE-2014-1293" modified="2014-04-05" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:P)" CVSS_score="6.8" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.6" CVSS_base_score="6.8">
    <desc>
      <descript source="cve">WebKit, as used in Apple iOS before 7.1 and Apple TV before 6.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2014-1289, CVE-2014-1290, CVE-2014-1291, CVE-2014-1292, and CVE-2014-1294.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://support.apple.com/kb/HT6163" source="CONFIRM" adv="1">http://support.apple.com/kb/HT6163</ref>
      <ref url="http://support.apple.com/kb/HT6162" source="CONFIRM" adv="1">http://support.apple.com/kb/HT6162</ref>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-04/0009.html" source="APPLE">APPLE-SA-2014-04-01-1</ref>
    </refs>
    <vuln_soft>
      <prod vendor="apple" name="apple_tv">
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers prev="1" num="6.0.2"/>
      </prod>
      <prod vendor="apple" name="iphone_os">
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="7.0.2"/>
        <vers num="7.0.3"/>
        <vers num="7.0.4"/>
        <vers num="7.0.5"/>
        <vers prev="1" num="7.0.6"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1294" published="2014-03-14" name="CVE-2014-1294" modified="2014-04-05" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:P)" CVSS_score="6.8" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.6" CVSS_base_score="6.8">
    <desc>
      <descript source="cve">WebKit, as used in Apple iOS before 7.1 and Apple TV before 6.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2014-1289, CVE-2014-1290, CVE-2014-1291, CVE-2014-1292, and CVE-2014-1293.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://support.apple.com/kb/HT6163" source="CONFIRM" adv="1">http://support.apple.com/kb/HT6163</ref>
      <ref url="http://support.apple.com/kb/HT6162" source="CONFIRM" adv="1">http://support.apple.com/kb/HT6162</ref>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-04/0009.html" source="APPLE">APPLE-SA-2014-04-01-1</ref>
    </refs>
    <vuln_soft>
      <prod vendor="apple" name="apple_tv">
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers prev="1" num="6.0.2"/>
      </prod>
      <prod vendor="apple" name="iphone_os">
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="7.0.2"/>
        <vers num="7.0.3"/>
        <vers num="7.0.4"/>
        <vers num="7.0.5"/>
        <vers prev="1" num="7.0.6"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1295" published="2014-04-23" name="CVE-2014-1295" modified="2014-04-23" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:P)" CVSS_score="6.8" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.6" CVSS_base_score="6.8">
    <desc>
      <descript source="cve">Secure Transport in Apple iOS before 7.1.1, Apple OS X 10.8.x and 10.9.x through 10.9.2, and Apple TV before 6.1.1 does not ensure that a server's X.509 certificate is the same during renegotiation as it was before renegotiation, which allows man-in-the-middle attackers to obtain sensitive information or modify TLS session data via a "triple handshake attack."</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://secure-resumption.com/" source="MISC">https://secure-resumption.com/</ref>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-04/0136.html" source="APPLE">APPLE-SA-2014-04-22-2</ref>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-04/0135.html" source="APPLE">APPLE-SA-2014-04-22-3</ref>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-04/0134.html" source="APPLE">APPLE-SA-2014-04-22-1</ref>
    </refs>
    <vuln_soft>
      <prod vendor="apple" name="apple_tv">
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers num="6.0.2"/>
        <vers prev="1" num="6.1"/>
      </prod>
      <prod vendor="apple" name="iphone_os">
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="7.0.2"/>
        <vers num="7.0.3"/>
        <vers num="7.0.4"/>
        <vers num="7.0.5"/>
        <vers num="7.0.6"/>
        <vers prev="1" num="7.1"/>
      </prod>
      <prod vendor="apple" name="mac_os_x">
        <vers num="10.8.0"/>
        <vers num="10.8.1"/>
        <vers num="10.8.2"/>
        <vers num="10.8.3"/>
        <vers num="10.8.4"/>
        <vers num="10.8.5" edition="supplemental_update"/>
        <vers num="10.9"/>
        <vers num="10.9.1"/>
        <vers num="10.9.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1296" published="2014-04-23" name="CVE-2014-1296" modified="2014-04-23" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:N/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">CFNetwork in Apple iOS before 7.1.1, Apple OS X through 10.9.2, and Apple TV before 6.1.1 does not ensure that a Set-Cookie HTTP header is complete before interpreting the header's value, which allows remote attackers to bypass intended access restrictions by triggering the closing of a TCP connection during transmission of a header, as demonstrated by an HTTPOnly restriction.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-04/0136.html" source="APPLE">APPLE-SA-2014-04-22-2</ref>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-04/0135.html" source="APPLE">APPLE-SA-2014-04-22-3</ref>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-04/0134.html" source="APPLE">APPLE-SA-2014-04-22-1</ref>
    </refs>
    <vuln_soft>
      <prod vendor="apple" name="apple_tv">
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers num="6.0.2"/>
        <vers prev="1" num="6.1"/>
      </prod>
      <prod vendor="apple" name="iphone_os">
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="7.0.2"/>
        <vers num="7.0.3"/>
        <vers num="7.0.4"/>
        <vers num="7.0.5"/>
        <vers num="7.0.6"/>
        <vers prev="1" num="7.1"/>
      </prod>
      <prod vendor="apple" name="mac_os_x">
        <vers num="10.7.0"/>
        <vers num="10.7.1"/>
        <vers num="10.7.2"/>
        <vers num="10.7.3"/>
        <vers num="10.7.4"/>
        <vers num="10.7.5"/>
        <vers num="10.8.0"/>
        <vers num="10.8.1"/>
        <vers num="10.8.2"/>
        <vers num="10.8.3"/>
        <vers num="10.8.4"/>
        <vers num="10.8.5" edition="supplemental_update"/>
        <vers num="10.9"/>
        <vers num="10.9.1"/>
        <vers prev="1" num="10.9.2"/>
      </prod>
      <prod vendor="apple" name="mac_os_x_server">
        <vers num="10.7.0"/>
        <vers num="10.7.1"/>
        <vers num="10.7.2"/>
        <vers num="10.7.3"/>
        <vers num="10.7.4"/>
        <vers num="10.7.5"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1297" published="2014-04-02" name="CVE-2014-1297" modified="2014-04-02" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:N/A:N)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, does not properly validate WebProcess IPC messages, which allows remote attackers to bypass a sandbox protection mechanism and read arbitrary files by leveraging WebProcess access.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-04/0009.html" source="APPLE">APPLE-SA-2014-04-01-1</ref>
    </refs>
    <vuln_soft>
      <prod vendor="apple" name="safari">
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers num="6.0.2"/>
        <vers num="6.0.3"/>
        <vers num="6.0.4"/>
        <vers num="6.0.5"/>
        <vers num="6.1"/>
        <vers num="6.1.1"/>
        <vers prev="1" num="6.1.2"/>
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="7.0.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1298" published="2014-04-02" name="CVE-2014-1298" modified="2014-04-24" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:P)" CVSS_score="6.8" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.6" CVSS_base_score="6.8">
    <desc>
      <descript source="cve">WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-04/0136.html" source="APPLE">APPLE-SA-2014-04-22-2</ref>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-04/0135.html" source="APPLE">APPLE-SA-2014-04-22-3</ref>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-04/0009.html" source="APPLE">APPLE-SA-2014-04-01-1</ref>
    </refs>
    <vuln_soft>
      <prod vendor="apple" name="safari">
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers num="6.0.2"/>
        <vers num="6.0.3"/>
        <vers num="6.0.4"/>
        <vers num="6.0.5"/>
        <vers num="6.1"/>
        <vers num="6.1.1"/>
        <vers prev="1" num="6.1.2"/>
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="7.0.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1299" published="2014-04-02" name="CVE-2014-1299" modified="2014-04-24" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:P)" CVSS_score="6.8" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.6" CVSS_base_score="6.8">
    <desc>
      <descript source="cve">WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-04/0136.html" source="APPLE">APPLE-SA-2014-04-22-2</ref>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-04/0135.html" source="APPLE">APPLE-SA-2014-04-22-3</ref>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-04/0009.html" source="APPLE">APPLE-SA-2014-04-01-1</ref>
    </refs>
    <vuln_soft>
      <prod vendor="apple" name="safari">
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers num="6.0.2"/>
        <vers num="6.0.3"/>
        <vers num="6.0.4"/>
        <vers num="6.0.5"/>
        <vers num="6.1"/>
        <vers num="6.1.1"/>
        <vers prev="1" num="6.1.2"/>
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="7.0.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1300" published="2014-03-26" name="CVE-2014-1300" modified="2014-04-24" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:C/I:C/A:C)" CVSS_score="10.0" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="10.0" CVSS_base_score="10.0">
    <desc>
      <descript source="cve">Unspecified vulnerability in Apple Safari 7.0.2 on OS X allows remote attackers to execute arbitrary code with root privileges via unknown vectors, as demonstrated by Google during a Pwn4Fun competition at CanSecWest 2014.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.pwn2own.com/2014/03/pwn2own-results-for-wednesday-day-one/" source="MISC">http://www.pwn2own.com/2014/03/pwn2own-results-for-wednesday-day-one/</ref>
      <ref url="http://twitter.com/thezdi/statuses/443796547872903168" source="MISC">http://twitter.com/thezdi/statuses/443796547872903168</ref>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-04/0136.html" source="APPLE">APPLE-SA-2014-04-22-2</ref>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-04/0135.html" source="APPLE">APPLE-SA-2014-04-22-3</ref>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-04/0009.html" source="APPLE">APPLE-SA-2014-04-01-1</ref>
    </refs>
    <vuln_soft>
      <prod vendor="apple" name="safari">
        <vers num="7.0.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1301" published="2014-04-02" name="CVE-2014-1301" modified="2014-04-02" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:P)" CVSS_score="6.8" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.6" CVSS_base_score="6.8">
    <desc>
      <descript source="cve">WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-04/0009.html" source="APPLE">APPLE-SA-2014-04-01-1</ref>
    </refs>
    <vuln_soft>
      <prod vendor="apple" name="safari">
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers num="6.0.2"/>
        <vers num="6.0.3"/>
        <vers num="6.0.4"/>
        <vers num="6.0.5"/>
        <vers num="6.1"/>
        <vers num="6.1.1"/>
        <vers prev="1" num="6.1.2"/>
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="7.0.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1302" published="2014-04-02" name="CVE-2014-1302" modified="2014-04-24" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:P)" CVSS_score="6.8" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.6" CVSS_base_score="6.8">
    <desc>
      <descript source="cve">WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-04/0136.html" source="APPLE">APPLE-SA-2014-04-22-2</ref>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-04/0135.html" source="APPLE">APPLE-SA-2014-04-22-3</ref>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-04/0009.html" source="APPLE">APPLE-SA-2014-04-01-1</ref>
    </refs>
    <vuln_soft>
      <prod vendor="apple" name="safari">
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers num="6.0.2"/>
        <vers num="6.0.3"/>
        <vers num="6.0.4"/>
        <vers num="6.0.5"/>
        <vers num="6.1"/>
        <vers num="6.1.1"/>
        <vers prev="1" num="6.1.2"/>
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="7.0.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1303" published="2014-03-26" name="CVE-2014-1303" modified="2014-04-24" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:C/I:C/A:C)" CVSS_score="10.0" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="10.0" CVSS_base_score="10.0">
    <desc>
      <descript source="cve">Heap-based buffer overflow in Apple Safari 7.0.2 allows remote attackers to execute arbitrary code and bypass a sandbox protection mechanism via unspecified vectors, as demonstrated by Liang Chen during a Pwn2Own competition at CanSecWest 2014.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.pwn2own.com/2014/03/pwn2own-results-thursday-day-two/" source="MISC">http://www.pwn2own.com/2014/03/pwn2own-results-thursday-day-two/</ref>
      <ref url="http://twitter.com/thezdi/statuses/444157530139136000" source="MISC">http://twitter.com/thezdi/statuses/444157530139136000</ref>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-04/0136.html" source="APPLE">APPLE-SA-2014-04-22-2</ref>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-04/0135.html" source="APPLE">APPLE-SA-2014-04-22-3</ref>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-04/0009.html" source="APPLE">APPLE-SA-2014-04-01-1</ref>
    </refs>
    <vuln_soft>
      <prod vendor="apple" name="safari">
        <vers num="7.0.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1304" published="2014-04-02" name="CVE-2014-1304" modified="2014-04-24" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:P)" CVSS_score="6.8" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.6" CVSS_base_score="6.8">
    <desc>
      <descript source="cve">WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-04/0136.html" source="APPLE">APPLE-SA-2014-04-22-2</ref>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-04/0135.html" source="APPLE">APPLE-SA-2014-04-22-3</ref>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-04/0009.html" source="APPLE">APPLE-SA-2014-04-01-1</ref>
    </refs>
    <vuln_soft>
      <prod vendor="apple" name="safari">
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers num="6.0.2"/>
        <vers num="6.0.3"/>
        <vers num="6.0.4"/>
        <vers num="6.0.5"/>
        <vers num="6.1"/>
        <vers num="6.1.1"/>
        <vers prev="1" num="6.1.2"/>
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="7.0.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1305" published="2014-04-02" name="CVE-2014-1305" modified="2014-04-24" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:P)" CVSS_score="6.8" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.6" CVSS_base_score="6.8">
    <desc>
      <descript source="cve">WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-04/0136.html" source="APPLE">APPLE-SA-2014-04-22-2</ref>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-04/0135.html" source="APPLE">APPLE-SA-2014-04-22-3</ref>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-04/0009.html" source="APPLE">APPLE-SA-2014-04-01-1</ref>
    </refs>
    <vuln_soft>
      <prod vendor="apple" name="safari">
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers num="6.0.2"/>
        <vers num="6.0.3"/>
        <vers num="6.0.4"/>
        <vers num="6.0.5"/>
        <vers num="6.1"/>
        <vers num="6.1.1"/>
        <vers prev="1" num="6.1.2"/>
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="7.0.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1307" published="2014-04-02" name="CVE-2014-1307" modified="2014-04-24" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:P)" CVSS_score="6.8" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.6" CVSS_base_score="6.8">
    <desc>
      <descript source="cve">WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-04/0136.html" source="APPLE">APPLE-SA-2014-04-22-2</ref>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-04/0135.html" source="APPLE">APPLE-SA-2014-04-22-3</ref>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-04/0009.html" source="APPLE">APPLE-SA-2014-04-01-1</ref>
    </refs>
    <vuln_soft>
      <prod vendor="apple" name="safari">
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers num="6.0.2"/>
        <vers num="6.0.3"/>
        <vers num="6.0.4"/>
        <vers num="6.0.5"/>
        <vers num="6.1"/>
        <vers num="6.1.1"/>
        <vers prev="1" num="6.1.2"/>
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="7.0.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1308" published="2014-04-02" name="CVE-2014-1308" modified="2014-04-24" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:P)" CVSS_score="6.8" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.6" CVSS_base_score="6.8">
    <desc>
      <descript source="cve">WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-04/0136.html" source="APPLE">APPLE-SA-2014-04-22-2</ref>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-04/0135.html" source="APPLE">APPLE-SA-2014-04-22-3</ref>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-04/0009.html" source="APPLE">APPLE-SA-2014-04-01-1</ref>
    </refs>
    <vuln_soft>
      <prod vendor="apple" name="safari">
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers num="6.0.2"/>
        <vers num="6.0.3"/>
        <vers num="6.0.4"/>
        <vers num="6.0.5"/>
        <vers num="6.1"/>
        <vers num="6.1.1"/>
        <vers prev="1" num="6.1.2"/>
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="7.0.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1309" published="2014-04-02" name="CVE-2014-1309" modified="2014-04-24" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:P)" CVSS_score="6.8" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.6" CVSS_base_score="6.8">
    <desc>
      <descript source="cve">WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-04/0136.html" source="APPLE">APPLE-SA-2014-04-22-2</ref>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-04/0135.html" source="APPLE">APPLE-SA-2014-04-22-3</ref>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-04/0009.html" source="APPLE">APPLE-SA-2014-04-01-1</ref>
    </refs>
    <vuln_soft>
      <prod vendor="apple" name="safari">
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers num="6.0.2"/>
        <vers num="6.0.3"/>
        <vers num="6.0.4"/>
        <vers num="6.0.5"/>
        <vers num="6.1"/>
        <vers num="6.1.1"/>
        <vers prev="1" num="6.1.2"/>
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="7.0.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1310" published="2014-04-02" name="CVE-2014-1310" modified="2014-04-24" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:P)" CVSS_score="6.8" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.6" CVSS_base_score="6.8">
    <desc>
      <descript source="cve">WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-04/0136.html" source="APPLE">APPLE-SA-2014-04-22-2</ref>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-04/0135.html" source="APPLE">APPLE-SA-2014-04-22-3</ref>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-04/0009.html" source="APPLE">APPLE-SA-2014-04-01-1</ref>
    </refs>
    <vuln_soft>
      <prod vendor="apple" name="safari">
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers num="6.0.2"/>
        <vers num="6.0.3"/>
        <vers num="6.0.4"/>
        <vers num="6.0.5"/>
        <vers num="6.1"/>
        <vers num="6.1.1"/>
        <vers prev="1" num="6.1.2"/>
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="7.0.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1311" published="2014-04-02" name="CVE-2014-1311" modified="2014-04-24" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:P)" CVSS_score="6.8" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.6" CVSS_base_score="6.8">
    <desc>
      <descript source="cve">WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-04/0136.html" source="APPLE">APPLE-SA-2014-04-22-2</ref>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-04/0135.html" source="APPLE">APPLE-SA-2014-04-22-3</ref>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-04/0009.html" source="APPLE">APPLE-SA-2014-04-01-1</ref>
    </refs>
    <vuln_soft>
      <prod vendor="apple" name="safari">
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers num="6.0.2"/>
        <vers num="6.0.3"/>
        <vers num="6.0.4"/>
        <vers num="6.0.5"/>
        <vers num="6.1"/>
        <vers num="6.1.1"/>
        <vers prev="1" num="6.1.2"/>
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="7.0.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1312" published="2014-04-02" name="CVE-2014-1312" modified="2014-04-24" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:P)" CVSS_score="6.8" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.6" CVSS_base_score="6.8">
    <desc>
      <descript source="cve">WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-04/0136.html" source="APPLE">APPLE-SA-2014-04-22-2</ref>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-04/0135.html" source="APPLE">APPLE-SA-2014-04-22-3</ref>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-04/0009.html" source="APPLE">APPLE-SA-2014-04-01-1</ref>
    </refs>
    <vuln_soft>
      <prod vendor="apple" name="safari">
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers num="6.0.2"/>
        <vers num="6.0.3"/>
        <vers num="6.0.4"/>
        <vers num="6.0.5"/>
        <vers num="6.1"/>
        <vers num="6.1.1"/>
        <vers prev="1" num="6.1.2"/>
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="7.0.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1313" published="2014-04-02" name="CVE-2014-1313" modified="2014-04-24" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:P)" CVSS_score="6.8" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.6" CVSS_base_score="6.8">
    <desc>
      <descript source="cve">WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-04/0136.html" source="APPLE">APPLE-SA-2014-04-22-2</ref>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-04/0135.html" source="APPLE">APPLE-SA-2014-04-22-3</ref>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-04/0009.html" source="APPLE">APPLE-SA-2014-04-01-1</ref>
    </refs>
    <vuln_soft>
      <prod vendor="apple" name="safari">
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers num="6.0.2"/>
        <vers num="6.0.3"/>
        <vers num="6.0.4"/>
        <vers num="6.0.5"/>
        <vers num="6.1"/>
        <vers num="6.1.1"/>
        <vers prev="1" num="6.1.2"/>
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="7.0.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1314" published="2014-04-23" name="CVE-2014-1314" modified="2014-04-24" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:C/I:C/A:C)" CVSS_score="10.0" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="10.0" CVSS_base_score="10.0">
    <desc>
      <descript source="cve">WindowServer in Apple OS X through 10.9.2 does not prevent session creation by a sandboxed application, which allows attackers to bypass the sandbox protection mechanism and execute arbitrary code via a crafted application.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-04/0134.html" source="APPLE">APPLE-SA-2014-04-22-1</ref>
    </refs>
    <vuln_soft>
      <prod vendor="apple" name="mac_os_x">
        <vers num="10.8.0"/>
        <vers num="10.8.1"/>
        <vers num="10.8.2"/>
        <vers num="10.8.3"/>
        <vers num="10.8.4"/>
        <vers num="10.8.5" edition="supplemental_update"/>
        <vers num="10.9"/>
        <vers num="10.9.1"/>
        <vers prev="1" num="10.9.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1315" published="2014-04-23" name="CVE-2014-1315" modified="2014-04-23" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:P)" CVSS_score="6.8" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.6" CVSS_base_score="6.8">
    <desc>
      <descript source="cve">Format string vulnerability in CoreServicesUIAgent in Apple OS X 10.9.x through 10.9.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via format string specifiers in a URL.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-04/0134.html" source="APPLE">APPLE-SA-2014-04-22-1</ref>
    </refs>
    <vuln_soft>
      <prod vendor="apple" name="mac_os_x">
        <vers num="10.9"/>
        <vers num="10.9.1"/>
        <vers num="10.9.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1316" published="2014-04-23" name="CVE-2014-1316" modified="2014-04-23" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:P)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">Heimdal, as used in Apple OS X through 10.9.2, allows remote attackers to cause a denial of service (abort and daemon exit) via ASN.1 data encountered in the Kerberos 5 protocol.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-04/0134.html" source="APPLE">APPLE-SA-2014-04-22-1</ref>
    </refs>
    <vuln_soft>
      <prod vendor="apple" name="mac_os_x">
        <vers num="10.9"/>
        <vers num="10.9.1"/>
        <vers prev="1" num="10.9.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1318" published="2014-04-23" name="CVE-2014-1318" modified="2014-04-23" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:C/I:C/A:C)" CVSS_score="10.0" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="10.0" CVSS_base_score="10.0">
    <desc>
      <descript source="cve">The Intel Graphics Driver in Apple OS X through 10.9.2 does not properly validate a certain pointer, which allows attackers to execute arbitrary code via a crafted application.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-04/0134.html" source="APPLE">APPLE-SA-2014-04-22-1</ref>
    </refs>
    <vuln_soft>
      <prod vendor="apple" name="mac_os_x">
        <vers num="10.8.0"/>
        <vers num="10.8.1"/>
        <vers num="10.8.2"/>
        <vers num="10.8.3"/>
        <vers num="10.8.4"/>
        <vers num="10.8.5" edition="supplemental_update"/>
        <vers num="10.9"/>
        <vers num="10.9.1"/>
        <vers prev="1" num="10.9.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1319" published="2014-04-23" name="CVE-2014-1319" modified="2014-04-23" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:P)" CVSS_score="6.8" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.6" CVSS_base_score="6.8">
    <desc>
      <descript source="cve">Buffer overflow in ImageIO in Apple OS X 10.9.x through 10.9.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted JPEG image.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-04/0134.html" source="APPLE">APPLE-SA-2014-04-22-1</ref>
    </refs>
    <vuln_soft>
      <prod vendor="apple" name="mac_os_x">
        <vers num="10.9"/>
        <vers num="10.9.1"/>
        <vers num="10.9.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1320" published="2014-04-23" name="CVE-2014-1320" modified="2014-04-24" CVSS_version="2.0" CVSS_vector="(AV:L/AC:L/Au:N/C:C/I:N/A:N)" CVSS_score="4.9" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="3.9" CVSS_base_score="4.9">
    <desc>
      <descript source="cve">IOKit in Apple iOS before 7.1.1, Apple OS X through 10.9.2, and Apple TV before 6.1.1 places kernel pointers into an object data structure, which makes it easier for local users to bypass the ASLR protection mechanism by reading unspecified attributes of the object.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-04/0136.html" source="APPLE">APPLE-SA-2014-04-22-2</ref>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-04/0135.html" source="APPLE">APPLE-SA-2014-04-22-3</ref>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-04/0134.html" source="APPLE">APPLE-SA-2014-04-22-1</ref>
    </refs>
    <vuln_soft>
      <prod vendor="apple" name="apple_tv">
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers num="6.0.2"/>
        <vers prev="1" num="6.1"/>
      </prod>
      <prod vendor="apple" name="iphone_os">
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="7.0.2"/>
        <vers num="7.0.3"/>
        <vers num="7.0.4"/>
        <vers num="7.0.5"/>
        <vers num="7.0.6"/>
        <vers prev="1" num="7.1"/>
      </prod>
      <prod vendor="apple" name="mac_os_x">
        <vers num="10.9"/>
        <vers num="10.9.1"/>
        <vers prev="1" num="10.9.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-1321" published="2014-04-23" name="CVE-2014-1321" modified="2014-04-24" CVSS_version="2.0" CVSS_vector="(AV:L/AC:M/Au:N/C:P/I:P/A:N)" CVSS_score="3.3" CVSS_impact_subscore="4.9" CVSS_exploit_subscore="3.4" CVSS_base_score="3.3">
    <desc>
      <descript source="cve">Power Management in Apple OS X 10.9.x through 10.9.2 allows physically proximate attackers to bypass an intended transition into the locked-screen state by touching (1) a key or (2) the trackpad during a lid-close action.</descript>
    </desc>
    <loss_types>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-04/0134.html" source="APPLE">APPLE-SA-2014-04-22-1</ref>
    </refs>
    <vuln_soft>
      <prod vendor="apple" name="mac_os_x">
        <vers num="10.9"/>
        <vers num="10.9.1"/>
        <vers num="10.9.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1322" published="2014-04-23" name="CVE-2014-1322" modified="2014-04-24" CVSS_version="2.0" CVSS_vector="(AV:L/AC:L/Au:N/C:C/I:N/A:N)" CVSS_score="4.9" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="3.9" CVSS_base_score="4.9">
    <desc>
      <descript source="cve">The kernel in Apple OS X through 10.9.2 places a kernel pointer into an XNU object data structure accessible from user space, which makes it easier for local users to bypass the ASLR protection mechanism by reading an unspecified attribute of the object.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-04/0134.html" source="APPLE">APPLE-SA-2014-04-22-1</ref>
    </refs>
    <vuln_soft>
      <prod vendor="apple" name="mac_os_x">
        <vers num="10.9"/>
        <vers num="10.9.1"/>
        <vers prev="1" num="10.9.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1401" published="2014-02-11" name="CVE-2014-1401" modified="2014-02-21" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:P/I:P/A:P)" CVSS_score="6.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.0" CVSS_base_score="6.5">
    <desc>
      <descript source="cve">Multiple SQL injection vulnerabilities in AuraCMS 2.3 and earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) search parameter to mod/content/content.php or (2) CLIENT_IP, (3) X_FORWARDED_FOR, (4) X_FORWARDED, (5) FORWARDED_FOR, or (6) FORWARDED HTTP header to index.php.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://www.htbridge.com/advisory/HTB23196" source="MISC">https://www.htbridge.com/advisory/HTB23196</ref>
      <ref url="https://github.com/auracms/AuraCMS/commit/790f66ffbc4f23a6e13636fc79d0aa1a7d81e747" source="CONFIRM">https://github.com/auracms/AuraCMS/commit/790f66ffbc4f23a6e13636fc79d0aa1a7d81e747</ref>
      <ref url="https://github.com/auracms/AuraCMS/commit/4fe9d0d31a32df392f4d6ced8e5c25ed4af19ade" source="CONFIRM">https://github.com/auracms/AuraCMS/commit/4fe9d0d31a32df392f4d6ced8e5c25ed4af19ade</ref>
      <ref url="http://xforce.iss.net/xforce/xfdb/90965" source="XF">auracms-cve20141401-sql-injection(90965)</ref>
      <ref url="http://www.securityfocus.com/archive/1/archive/1/530930/100/0/threaded" source="BUGTRAQ">20140205 Multiple SQL Injection Vulnerabilities in AuraCMS</ref>
      <ref url="http://www.exploit-db.com/exploits/31520" source="EXPLOIT-DB">31520</ref>
      <ref url="http://secunia.com/advisories/56804" source="SECUNIA">56804</ref>
      <ref url="http://packetstormsecurity.com/files/125079" source="MISC">http://packetstormsecurity.com/files/125079</ref>
    </refs>
    <vuln_soft>
      <prod vendor="auracms" name="auracms">
        <vers num="1.0"/>
        <vers num="1.1"/>
        <vers num="1.2"/>
        <vers num="1.3"/>
        <vers num="1.5"/>
        <vers num="1.61"/>
        <vers num="1.62"/>
        <vers num="2.0"/>
        <vers num="2.1"/>
        <vers num="2.2"/>
        <vers num="2.2.1"/>
        <vers num="2.2.2"/>
        <vers prev="1" num="2.3"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1403" published="2014-02-05" name="CVE-2014-1403" modified="2014-02-21" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in name.html in easyXDM before 2.4.19 allows remote attackers to inject arbitrary web script or HTML via the location.hash value.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="https://github.com/oyvindkinsey/easyXDM/releases/tag/2.4.19" source="CONFIRM" patch="1" adv="1">https://github.com/oyvindkinsey/easyXDM/releases/tag/2.4.19</ref>
      <ref url="https://github.com/oyvindkinsey/easyXDM/commit/a3194d32c25a0d27a10a47304eb9c9be93ffbf13#diff-6489956f1e1f52236929b4d33cbeb2db" source="CONFIRM" patch="1">https://github.com/oyvindkinsey/easyXDM/commit/a3194d32c25a0d27a10a47304eb9c9be93ffbf13#diff-6489956f1e1f52236929b4d33cbeb2db</ref>
      <ref url="http://xforce.iss.net/xforce/xfdb/90876" source="XF">easyxdm-cve20141403-xss(90876)</ref>
      <ref url="http://www.securityfocus.com/bid/65291" source="BID">65291</ref>
      <ref url="http://secunia.com/advisories/56634" source="SECUNIA" adv="1">56634</ref>
      <ref url="http://seclists.org/fulldisclosure/2014/Feb/5" source="FULLDISC">20140131 [CVE-2014-1403] DOM XSS in EasyXDM 2.4.18</ref>
      <ref url="http://osvdb.org/102803" source="OSVDB">102803</ref>
      <ref url="http://blog.kotowicz.net/2014/01/xssing-with-shakespeare-name-calling.html" source="MISC">http://blog.kotowicz.net/2014/01/xssing-with-shakespeare-name-calling.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="easyxdm" name="easyxdm">
        <vers num="2.3.2"/>
        <vers num="2.3.3"/>
        <vers num="2.4.0"/>
        <vers num="2.4.1"/>
        <vers prev="1" num="2.4.18"/>
        <vers num="2.4.2"/>
        <vers num="2.4.3"/>
        <vers num="2.4.4"/>
        <vers num="2.4.5"/>
        <vers num="2.4.6"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1405" published="2014-01-10" name="CVE-2014-1405" modified="2014-01-10" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:N)" CVSS_score="5.8" CVSS_impact_subscore="4.9" CVSS_exploit_subscore="8.6" CVSS_base_score="5.8">
    <desc>
      <descript source="cve">Multiple open redirect vulnerabilities on the Conceptronic C54APM access point with runtime code 1.26 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via (1) the submit-url parameter in a Refresh action to goform/formWlSiteSurvey or (2) the wlan-url parameter to goform/formWlanSetup.</descript>
    </desc>
    <loss_types>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://antoniovazquezblanco.github.io/docs/advisories/Advisory_C54APM_Multiple.pdf" source="MISC" adv="1">http://antoniovazquezblanco.github.io/docs/advisories/Advisory_C54APM_Multiple.pdf</ref>
    </refs>
    <vuln_soft>
      <prod vendor="conceptronic" name="c54apm">
        <vers num="1.26"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1406" published="2014-01-10" name="CVE-2014-1406" modified="2014-01-10" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">CRLF injection vulnerability in goform/formWlSiteSurvey on the Conceptronic C54APM access point with runtime code 1.26 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the submit-url parameter in a Refresh action.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://antoniovazquezblanco.github.io/docs/advisories/Advisory_C54APM_Multiple.pdf" source="MISC" adv="1">http://antoniovazquezblanco.github.io/docs/advisories/Advisory_C54APM_Multiple.pdf</ref>
    </refs>
    <vuln_soft>
      <prod vendor="conceptronic" name="c54apm">
        <vers num="1.26"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1407" published="2014-01-10" name="CVE-2014-1407" modified="2014-01-10" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Multiple cross-site scripting (XSS) vulnerabilities on the Conceptronic C54APM access point with runtime code 1.26 allow remote attackers to inject arbitrary web script or HTML via (1) the submit-url parameter in a Refresh action to goform/formWlSiteSurvey or (2) the wlan-url parameter to goform/formWlanSetup.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://antoniovazquezblanco.github.io/docs/advisories/Advisory_C54APM_Multiple.pdf" source="MISC" adv="1">http://antoniovazquezblanco.github.io/docs/advisories/Advisory_C54APM_Multiple.pdf</ref>
    </refs>
    <vuln_soft>
      <prod vendor="conceptronic" name="c54apm">
        <vers num="1.26"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1408" published="2014-01-10" name="CVE-2014-1408" modified="2014-01-13" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:C/I:N/A:N)" CVSS_score="7.8" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="10.0" CVSS_base_score="7.8">
    <desc>
      <descript source="cve">The Conceptronic C54APM access point with runtime code 1.26 has a default password of admin for the admin account, which makes it easier for remote attackers to obtain access via an HTTP request, as demonstrated by stored XSS attacks.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://download.conceptronic.net/manuals/C04-058_C54APM_v2.0_Quick_Guide_ML.pdf" source="CONFIRM">http://download.conceptronic.net/manuals/C04-058_C54APM_v2.0_Quick_Guide_ML.pdf</ref>
      <ref url="http://antoniovazquezblanco.github.io/docs/advisories/Advisory_C54APM_Multiple.pdf" source="MISC" adv="1">http://antoniovazquezblanco.github.io/docs/advisories/Advisory_C54APM_Multiple.pdf</ref>
    </refs>
    <vuln_soft>
      <prod vendor="conceptronic" name="c54apm">
        <vers num="1.26"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1438" published="2014-01-18" name="CVE-2014-1438" modified="2014-03-16" CVSS_version="2.0" CVSS_vector="(AV:L/AC:M/Au:N/C:N/I:N/A:C)" CVSS_score="4.7" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="3.4" CVSS_base_score="4.7">
    <desc>
      <descript source="cve">The restore_fpu_checking function in arch/x86/include/asm/fpu-internal.h in the Linux kernel before 3.12.8 on the AMD K7 and K8 platforms does not clear pending exceptions before proceeding to an EMMS instruction, which allows local users to cause a denial of service (task kill) or possibly gain privileges via a crafted application.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=26bef1318adc1b3a530ecc807ef99346db2aa8b0" source="CONFIRM" patch="1">http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=26bef1318adc1b3a530ecc807ef99346db2aa8b0</ref>
      <ref url="https://lkml.org/lkml/2014/1/9/637" source="MLIST">[linux-kernel] 20140110 Re: Sanitize CPU-state when switching tasks (was sanitize CPU-state when switching from virtual-8086 mode to other task)</ref>
      <ref url="https://github.com/torvalds/linux/commit/26bef1318adc1b3a530ecc807ef99346db2aa8b0" source="CONFIRM">https://github.com/torvalds/linux/commit/26bef1318adc1b3a530ecc807ef99346db2aa8b0</ref>
      <ref url="https://bugzilla.redhat.com/show_bug.cgi?id=1052914" source="CONFIRM">https://bugzilla.redhat.com/show_bug.cgi?id=1052914</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2141-1" source="UBUNTU">USN-2141-1</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2139-1" source="UBUNTU">USN-2139-1</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2138-1" source="UBUNTU">USN-2138-1</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2136-1" source="UBUNTU">USN-2136-1</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2135-1" source="UBUNTU">USN-2135-1</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2134-1" source="UBUNTU">USN-2134-1</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2133-1" source="UBUNTU">USN-2133-1</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2117-1" source="UBUNTU">USN-2117-1</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2113-1" source="UBUNTU">USN-2113-1</ref>
      <ref url="http://www.securitytracker.com/id/1029592" source="SECTRACK">1029592</ref>
      <ref url="http://www.securityfocus.com/bid/64781" source="BID">64781</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/01/14/1" source="MLIST">[oss-security] 20140114 Re: Linux kernel: missing CPU-state sanitation during task-switch causes DOS / privilege escalation</ref>
      <ref url="http://www.mandriva.com/security/advisories?name=MDVSA-2014:038" source="MANDRIVA">MDVSA-2014:038</ref>
      <ref url="http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.12.8" source="CONFIRM">http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.12.8</ref>
      <ref url="http://www.halfdog.net/Security/2013/Vm86SyscallTaskSwitchKernelPanic/" source="MISC">http://www.halfdog.net/Security/2013/Vm86SyscallTaskSwitchKernelPanic/</ref>
      <ref url="http://lists.fedoraproject.org/pipermail/package-announce/2014-January/126874.html" source="FEDORA">FEDORA-2014-1062</ref>
      <ref url="http://lists.fedoraproject.org/pipermail/package-announce/2014-January/126858.html" source="FEDORA">FEDORA-2014-1072</ref>
    </refs>
    <vuln_soft>
      <prod vendor="linux" name="linux_kernel">
        <vers num="3.12"/>
        <vers num="3.12.1"/>
        <vers num="3.12.2"/>
        <vers num="3.12.3"/>
        <vers num="3.12.4"/>
        <vers num="3.12.5"/>
        <vers num="3.12.6"/>
        <vers prev="1" num="3.12.7"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1439" published="2014-02-05" name="CVE-2014-1439" modified="2014-02-21" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:N/A:N)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">The libxml_disable_entity_loader function in runtime/ext/ext_simplexml.cpp in HipHop Virtual Machine for PHP (HHVM) before 2.4.0 and 2.3.x before 2.3.3 does not properly disable a certain libxml handler, which allows remote attackers to conduct XML External Entity (XXE) attacks.</descript>
      <descript source="nvd">CWE-611: Improper Restriction of XML External Entity Reference ('XXE')</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://github.com/facebook/hhvm/commit/95f96e7287effe2fcdfb9a5338d1a7e4f55b083b" source="CONFIRM">https://github.com/facebook/hhvm/commit/95f96e7287effe2fcdfb9a5338d1a7e4f55b083b</ref>
      <ref url="http://xforce.iss.net/xforce/xfdb/90979" source="XF">hhvm-cve20141439-info-disc(90979)</ref>
      <ref url="http://www.hhvm.com/blog/3287/hhvm-2-4-0" source="CONFIRM" adv="1">http://www.hhvm.com/blog/3287/hhvm-2-4-0</ref>
    </refs>
    <vuln_soft>
      <prod vendor="hiphop_virtual_machine_for_php_project" name="hiphop_virtual_machine_for_php">
        <vers num="2.0.0"/>
        <vers num="2.0.1"/>
        <vers num="2.0.2"/>
        <vers num="2.1.0"/>
        <vers num="2.2.0"/>
        <vers num="2.3.0"/>
        <vers num="2.3.1"/>
        <vers prev="1" num="2.3.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1441" published="2014-05-01" name="CVE-2014-1441" modified="2014-05-02" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:N/A:P)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Core FTP Server 1.2 before build 515 allows remote attackers to cause a denial of service (reachable assertion and crash) via an AUTH SSL command with malformed data, as demonstrated by pressing the enter key twice.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.osvdb.org/102966" source="OSVDB">102966</ref>
      <ref url="http://secunia.com/advisories/56850" source="SECUNIA" adv="1">56850</ref>
      <ref url="http://seclists.org/fulldisclosure/2014/Feb/39" source="FULLDISC">20140205 Core FTP Server Vulnerabilities</ref>
      <ref url="http://packetstormsecurity.com/files/125073/Core-FTP-Server-1.2-DoS-Traversal-Disclosure.html" source="MISC">http://packetstormsecurity.com/files/125073/Core-FTP-Server-1.2-DoS-Traversal-Disclosure.html</ref>
      <ref url="http://coreftp.com/forums/viewtopic.php?t=2985707" source="CONFIRM" adv="1">http://coreftp.com/forums/viewtopic.php?t=2985707</ref>
    </refs>
    <vuln_soft>
      <prod vendor="coreftp" name="core_ftp">
        <vers num="1.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1442" published="2014-05-01" name="CVE-2014-1442" modified="2014-05-02" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:P/I:N/A:N)" CVSS_score="4.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.0" CVSS_base_score="4.0">
    <desc>
      <descript source="cve">Directory traversal vulnerability in Core FTP Server 1.2 before build 515 allows remote authenticated users to determine the existence of arbitrary files via a /../ sequence in an XCRC command.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.osvdb.org/102967" source="OSVDB">102967</ref>
      <ref url="http://secunia.com/advisories/56850" source="SECUNIA" adv="1">56850</ref>
      <ref url="http://seclists.org/fulldisclosure/2014/Feb/39" source="FULLDISC">20140205 Core FTP Server Vulnerabilities</ref>
      <ref url="http://packetstormsecurity.com/files/125073/Core-FTP-Server-1.2-DoS-Traversal-Disclosure.html" source="MISC">http://packetstormsecurity.com/files/125073/Core-FTP-Server-1.2-DoS-Traversal-Disclosure.html</ref>
      <ref url="http://coreftp.com/forums/viewtopic.php?t=2985707" source="CONFIRM" adv="1">http://coreftp.com/forums/viewtopic.php?t=2985707</ref>
    </refs>
    <vuln_soft>
      <prod vendor="coreftp" name="core_ftp">
        <vers num="1.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1443" published="2014-05-01" name="CVE-2014-1443" modified="2014-05-02" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:P/I:N/A:N)" CVSS_score="4.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.0" CVSS_base_score="4.0">
    <desc>
      <descript source="cve">Core FTP Server 1.2 before build 515 allows remote authenticated users to obtain sensitive information (password for the previous user) via a USER command with a specific length, possibly related to an out-of-bounds read.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.osvdb.org/102968" source="OSVDB">102968</ref>
      <ref url="http://secunia.com/advisories/56850" source="SECUNIA" adv="1">56850</ref>
      <ref url="http://seclists.org/fulldisclosure/2014/Feb/39" source="FULLDISC">20140205 Core FTP Server Vulnerabilities</ref>
      <ref url="http://packetstormsecurity.com/files/125073/Core-FTP-Server-1.2-DoS-Traversal-Disclosure.html" source="MISC">http://packetstormsecurity.com/files/125073/Core-FTP-Server-1.2-DoS-Traversal-Disclosure.html</ref>
      <ref url="http://coreftp.com/forums/viewtopic.php?t=2985707" source="CONFIRM" adv="1">http://coreftp.com/forums/viewtopic.php?t=2985707</ref>
    </refs>
    <vuln_soft>
      <prod vendor="coreftp" name="core_ftp">
        <vers num="1.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-1444" published="2014-01-18" name="CVE-2014-1444" modified="2014-03-16" CVSS_version="2.0" CVSS_vector="(AV:L/AC:L/Au:S/C:P/I:N/A:N)" CVSS_score="1.7" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="3.1" CVSS_base_score="1.7">
    <desc>
      <descript source="cve">The fst_get_iface function in drivers/net/wan/farsync.c in the Linux kernel before 3.11.7 does not properly initialize a certain data structure, which allows local users to obtain sensitive information from kernel memory by leveraging the CAP_NET_ADMIN capability for an SIOCWANDEV ioctl call.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="https://github.com/torvalds/linux/commit/96b340406724d87e4621284ebac5e059d67b2194" source="CONFIRM" patch="1">https://github.com/torvalds/linux/commit/96b340406724d87e4621284ebac5e059d67b2194</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/01/15/3" source="MLIST" patch="1">[oss-security] 20140115 Re: CVE request: assorted kernel infoleak security fixes</ref>
      <ref url="https://bugzilla.redhat.com/show_bug.cgi?id=1053610" source="CONFIRM">https://bugzilla.redhat.com/show_bug.cgi?id=1053610</ref>
      <ref url="http://xforce.iss.net/xforce/xfdb/90443" source="XF">linux-kernel-cve20141444-info-disc(90443)</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2129-1" source="UBUNTU">USN-2129-1</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2128-1" source="UBUNTU">USN-2128-1</ref>
      <ref url="http://www.securityfocus.com/bid/64952" source="BID">64952</ref>
      <ref url="http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.11.7" source="CONFIRM">http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.11.7</ref>
      <ref url="http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=96b340406724d87e4621284ebac5e059d67b2194" source="CONFIRM">http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=96b340406724d87e4621284ebac5e059d67b2194</ref>
    </refs>
    <vuln_soft>
      <prod vendor="linux" name="linux_kernel">
        <vers num="3.11"/>
        <vers num="3.11.1"/>
        <vers num="3.11.2"/>
        <vers num="3.11.3"/>
        <vers num="3.11.4"/>
        <vers num="3.11.5"/>
        <vers prev="1" num="3.11.6"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-1445" published="2014-01-18" name="CVE-2014-1445" modified="2014-03-16" CVSS_version="2.0" CVSS_vector="(AV:L/AC:L/Au:N/C:P/I:N/A:N)" CVSS_score="2.1" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="3.9" CVSS_base_score="2.1">
    <desc>
      <descript source="cve">The wanxl_ioctl function in drivers/net/wan/wanxl.c in the Linux kernel before 3.11.7 does not properly initialize a certain data structure, which allows local users to obtain sensitive information from kernel memory via an ioctl call.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="https://github.com/torvalds/linux/commit/2b13d06c9584b4eb773f1e80bbaedab9a1c344e1" source="CONFIRM" patch="1">https://github.com/torvalds/linux/commit/2b13d06c9584b4eb773f1e80bbaedab9a1c344e1</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/01/15/3" source="MLIST" patch="1">[oss-security] 20140115 Re: CVE request: assorted kernel infoleak security fixes</ref>
      <ref url="http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=2b13d06c9584b4eb773f1e80bbaedab9a1c344e1" source="CONFIRM" patch="1">http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=2b13d06c9584b4eb773f1e80bbaedab9a1c344e1</ref>
      <ref url="https://bugzilla.redhat.com/show_bug.cgi?id=1053613" source="CONFIRM">https://bugzilla.redhat.com/show_bug.cgi?id=1053613</ref>
      <ref url="http://xforce.iss.net/xforce/xfdb/90444" source="XF">linux-kernel-cve20141445-info-disc(90444)</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2129-1" source="UBUNTU">USN-2129-1</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2128-1" source="UBUNTU">USN-2128-1</ref>
      <ref url="http://www.securityfocus.com/bid/64953" source="BID">64953</ref>
      <ref url="http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.11.7" source="CONFIRM">http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.11.7</ref>
    </refs>
    <vuln_soft>
      <prod vendor="linux" name="linux_kernel">
        <vers num="3.11"/>
        <vers num="3.11.1"/>
        <vers num="3.11.2"/>
        <vers num="3.11.3"/>
        <vers num="3.11.4"/>
        <vers num="3.11.5"/>
        <vers prev="1" num="3.11.6"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-1446" published="2014-01-18" name="CVE-2014-1446" modified="2014-03-16" CVSS_version="2.0" CVSS_vector="(AV:L/AC:M/Au:N/C:P/I:N/A:N)" CVSS_score="1.9" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="3.4" CVSS_base_score="1.9">
    <desc>
      <descript source="cve">The yam_ioctl function in drivers/net/hamradio/yam.c in the Linux kernel before 3.12.8 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel memory by leveraging the CAP_NET_ADMIN capability for an SIOCYAMGCFG ioctl call.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="https://github.com/torvalds/linux/commit/8e3fbf870481eb53b2d3a322d1fc395ad8b367ed" source="CONFIRM" patch="1">https://github.com/torvalds/linux/commit/8e3fbf870481eb53b2d3a322d1fc395ad8b367ed</ref>
      <ref url="https://bugzilla.redhat.com/show_bug.cgi?id=1053620" source="CONFIRM">https://bugzilla.redhat.com/show_bug.cgi?id=1053620</ref>
      <ref url="http://xforce.iss.net/xforce/xfdb/90445" source="XF">linux-kernel-cve20141446-info-disc(90445)</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2141-1" source="UBUNTU">USN-2141-1</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2139-1" source="UBUNTU">USN-2139-1</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2138-1" source="UBUNTU">USN-2138-1</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2136-1" source="UBUNTU">USN-2136-1</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2135-1" source="UBUNTU">USN-2135-1</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2134-1" source="UBUNTU">USN-2134-1</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2133-1" source="UBUNTU">USN-2133-1</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2129-1" source="UBUNTU">USN-2129-1</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2128-1" source="UBUNTU">USN-2128-1</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2117-1" source="UBUNTU">USN-2117-1</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2113-1" source="UBUNTU">USN-2113-1</ref>
      <ref url="http://www.securityfocus.com/bid/64954" source="BID">64954</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/01/15/3" source="MLIST">[oss-security] 20140115 Re: CVE request: assorted kernel infoleak security fixes</ref>
      <ref url="http://www.mandriva.com/security/advisories?name=MDVSA-2014:038" source="MANDRIVA">MDVSA-2014:038</ref>
      <ref url="http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.12.8" source="CONFIRM">http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.12.8</ref>
      <ref url="http://lists.fedoraproject.org/pipermail/package-announce/2014-January/126874.html" source="FEDORA">FEDORA-2014-1062</ref>
      <ref url="http://lists.fedoraproject.org/pipermail/package-announce/2014-January/126858.html" source="FEDORA">FEDORA-2014-1072</ref>
      <ref url="http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=8e3fbf870481eb53b2d3a322d1fc395ad8b367ed" source="CONFIRM">http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=8e3fbf870481eb53b2d3a322d1fc395ad8b367ed</ref>
    </refs>
    <vuln_soft>
      <prod vendor="linux" name="linux_kernel">
        <vers num="3.12"/>
        <vers num="3.12.1"/>
        <vers num="3.12.2"/>
        <vers num="3.12.3"/>
        <vers num="3.12.4"/>
        <vers num="3.12.5"/>
        <vers num="3.12.6"/>
        <vers prev="1" num="3.12.7"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-1447" published="2014-01-24" name="CVE-2014-1447" modified="2014-03-05" CVSS_version="2.0" CVSS_vector="(AV:A/AC:L/Au:N/C:N/I:N/A:P)" CVSS_score="3.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="6.5" CVSS_base_score="3.3">
    <desc>
      <descript source="cve">Race condition in the virNetServerClientStartKeepAlive function in libvirt before 1.2.1 allows remote attackers to cause a denial of service (libvirtd crash) by closing a connection before a keepalive response is sent.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <local_network/>
    </range>
    <refs>
      <ref url="https://bugzilla.redhat.com/show_bug.cgi?id=1047577" source="CONFIRM" adv="1">https://bugzilla.redhat.com/show_bug.cgi?id=1047577</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2093-1" source="UBUNTU">USN-2093-1</ref>
      <ref url="http://www.securitytracker.com/id/1029695" source="SECTRACK">1029695</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2846" source="DEBIAN">DSA-2846</ref>
      <ref url="http://secunia.com/advisories/56446" source="SECUNIA" adv="1">56446</ref>
      <ref url="http://secunia.com/advisories/56321" source="SECUNIA" adv="1">56321</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0103.html" source="REDHAT">RHSA-2014:0103</ref>
      <ref url="http://lists.opensuse.org/opensuse-updates/2014-02/msg00062.html" source="SUSE">openSUSE-SU-2014:0270</ref>
      <ref url="http://lists.opensuse.org/opensuse-updates/2014-02/msg00060.html" source="SUSE">openSUSE-SU-2014:0268</ref>
      <ref url="http://libvirt.org/news.html" source="CONFIRM">http://libvirt.org/news.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="redhat" name="libvirt">
        <vers num="0.0.1"/>
        <vers num="0.0.2"/>
        <vers num="0.0.3"/>
        <vers num="0.0.4"/>
        <vers num="0.0.5"/>
        <vers num="0.0.6"/>
        <vers num="0.1.0"/>
        <vers num="0.1.1"/>
        <vers num="0.1.3"/>
        <vers num="0.1.4"/>
        <vers num="0.1.5"/>
        <vers num="0.1.6"/>
        <vers num="0.1.7"/>
        <vers num="0.1.8"/>
        <vers num="0.1.9"/>
        <vers num="0.10.0"/>
        <vers num="0.10.1"/>
        <vers num="0.10.2"/>
        <vers num="0.10.2.1"/>
        <vers num="0.10.2.2"/>
        <vers num="0.10.2.3"/>
        <vers num="0.10.2.4"/>
        <vers num="0.10.2.5"/>
        <vers num="0.10.2.6"/>
        <vers num="0.10.2.7"/>
        <vers num="0.10.2.8"/>
        <vers num="0.2.0"/>
        <vers num="0.2.1"/>
        <vers num="0.2.2"/>
        <vers num="0.2.3"/>
        <vers num="0.3.0"/>
        <vers num="0.3.1"/>
        <vers num="0.3.2"/>
        <vers num="0.3.3"/>
        <vers num="0.4.0"/>
        <vers num="0.4.1"/>
        <vers num="0.4.2"/>
        <vers num="0.4.3"/>
        <vers num="0.4.4"/>
        <vers num="0.4.5"/>
        <vers num="0.4.6"/>
        <vers num="0.5.0"/>
        <vers num="0.5.1"/>
        <vers num="0.6.0"/>
        <vers num="0.6.1"/>
        <vers num="0.6.2"/>
        <vers num="0.6.3"/>
        <vers num="0.6.4"/>
        <vers num="0.6.5"/>
        <vers num="0.7.0"/>
        <vers num="0.7.1"/>
        <vers num="0.7.2"/>
        <vers num="0.7.3"/>
        <vers num="0.7.4"/>
        <vers num="0.7.5"/>
        <vers num="0.7.6"/>
        <vers num="0.7.7"/>
        <vers num="0.8.0"/>
        <vers num="0.8.1"/>
        <vers num="0.8.2"/>
        <vers num="0.8.3"/>
        <vers num="0.8.4"/>
        <vers num="0.8.5"/>
        <vers num="0.8.6"/>
        <vers num="0.8.7"/>
        <vers num="0.8.8"/>
        <vers num="0.9.0"/>
        <vers num="0.9.1"/>
        <vers num="0.9.10"/>
        <vers num="0.9.11"/>
        <vers num="0.9.11.1"/>
        <vers num="0.9.11.2"/>
        <vers num="0.9.11.3"/>
        <vers num="0.9.11.4"/>
        <vers num="0.9.11.5"/>
        <vers num="0.9.11.6"/>
        <vers num="0.9.11.7"/>
        <vers num="0.9.11.8"/>
        <vers num="0.9.12"/>
        <vers num="0.9.13"/>
        <vers num="0.9.2"/>
        <vers num="0.9.3"/>
        <vers num="0.9.4"/>
        <vers num="0.9.5"/>
        <vers num="0.9.6"/>
        <vers num="0.9.6.1"/>
        <vers num="0.9.6.2"/>
        <vers num="0.9.6.3"/>
        <vers num="0.9.7"/>
        <vers num="0.9.8"/>
        <vers num="0.9.9"/>
        <vers num="1.0.0"/>
        <vers num="1.0.1"/>
        <vers num="1.0.2"/>
        <vers num="1.0.3"/>
        <vers num="1.0.4"/>
        <vers num="1.0.5"/>
        <vers num="1.0.5.1"/>
        <vers num="1.0.5.2"/>
        <vers num="1.0.5.3"/>
        <vers num="1.0.5.4"/>
        <vers num="1.0.5.5"/>
        <vers num="1.0.5.6"/>
        <vers num="1.0.6"/>
        <vers num="1.1.0"/>
        <vers num="1.1.1"/>
        <vers num="1.1.2"/>
        <vers num="1.1.3"/>
        <vers num="1.1.4"/>
        <vers prev="1" num="1.2.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" seq="2014-1448" reject="1" published="2014-01-15" name="CVE-2014-1448" modified="2014-01-15">
    <desc>
      <descript source="cve">** REJECT **  DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2014-1447.  Reason: This candidate is a reservation duplicate of CVE-2014-1447.  Only one candidate was needed for the disclosure in question.  Notes: All CVE users should reference CVE-2014-1447 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage.</descript>
    </desc>
    <refs/>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1452" published="2014-01-21" name="CVE-2014-1452" modified="2014-02-21" CVSS_version="2.0" CVSS_vector="(AV:A/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="5.8" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="6.5" CVSS_base_score="5.8">
    <desc>
      <descript source="cve">Stack-based buffer overflow in lib/snmpagent.c in bsnmpd, as used in FreeBSD 8.3 through 10.0, allows remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via a crafted GETBULK PDU request.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <local_network/>
    </range>
    <refs>
      <ref url="http://svnweb.freebsd.org/base?view=revision&amp;amp;revision=260636" source="CONFIRM" patch="1">http://svnweb.freebsd.org/base?view=revision&amp;amp;revision=260636</ref>
      <ref url="http://www.securitytracker.com/id/1029616" source="SECTRACK">1029616</ref>
      <ref url="http://www.freebsd.org/security/advisories/FreeBSD-SA-14:01.bsnmpd.asc" source="FREEBSD" adv="1">FreeBSD-SA-14:01</ref>
      <ref url="http://secunia.com/advisories/56496" source="SECUNIA" adv="1">56496</ref>
    </refs>
    <vuln_soft>
      <prod vendor="freebsd" name="freebsd">
        <vers num="10.0"/>
        <vers num="8.3"/>
        <vers num="8.4"/>
        <vers num="9.0"/>
        <vers num="9.1" edition="release-p4"/>
        <vers num="9.1" edition="release-p5"/>
        <vers num="9.2" edition="prerelease"/>
        <vers num="9.2" edition="rc1"/>
        <vers num="9.2" edition="rc2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1453" published="2014-04-16" name="CVE-2014-1453" modified="2014-04-17" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:N/I:N/A:P)" CVSS_score="4.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.0" CVSS_base_score="4.0">
    <desc>
      <descript source="cve">The NFS server (nfsserver) in FreeBSD 8.3 through 10.0 does not acquire locks in the proper order when converting a directory file handle to a vnode, which allows remote authenticated users to cause a denial of service (deadlock) via vectors involving a thread that uses the correct locking order.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.securitytracker.com/id/1030041" source="SECTRACK">1030041</ref>
      <ref url="http://www.securityfocus.com/bid/66726" source="BID">66726</ref>
      <ref url="http://www.freebsd.org/security/advisories/FreeBSD-SA-14:05.nfsserver.asc" source="FREEBSD" adv="1">FreeBSD-SA-14:05</ref>
      <ref url="http://secunia.com/advisories/57760" source="SECUNIA" adv="1">57760</ref>
    </refs>
    <vuln_soft>
      <prod vendor="freebsd" name="freebsd">
        <vers num="10.0"/>
        <vers num="8.3"/>
        <vers num="8.4"/>
        <vers num="9.0" edition="beta1"/>
        <vers num="9.0" edition="beta2"/>
        <vers num="9.0" edition="beta3"/>
        <vers num="9.1" edition="release-p4"/>
        <vers num="9.1" edition="release-p5"/>
        <vers num="9.2" edition="prerelease"/>
        <vers num="9.2" edition="rc1"/>
        <vers num="9.2" edition="rc2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1455" published="2014-04-10" name="CVE-2014-1455" modified="2014-04-11" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">SQL injection vulnerability in the password reset functionality in Pearson eSIS Enterprise Student Information System, possibly 3.3.0.13 and earlier, allows remote attackers to execute arbitrary SQL commands via the new password.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.securityfocus.com/archive/1/archive/1/531751/100/0/threaded" source="BUGTRAQ">20140406 Pearson eSIS Enterprise Student Information System SQL Injection</ref>
    </refs>
    <vuln_soft>
      <prod vendor="pearson" name="esis_enterprise_student_information_system">
        <vers prev="1" num="3.3.0.13"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1456" published="2014-02-28" name="CVE-2014-1456" modified="2014-03-03" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in the login page in Open Web Analytics (OWA) before 1.5.6 allows remote attackers to inject arbitrary web script or HTML via the owa_user_id parameter to index.php.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/91124" source="XF">owa-cve20141456-xss(91124)</ref>
      <ref url="http://www.secureworks.com/cyber-threat-intelligence/advisories/SWRX-2014-004" source="MISC">http://www.secureworks.com/cyber-threat-intelligence/advisories/SWRX-2014-004</ref>
      <ref url="http://www.openwebanalytics.com/?p=384" source="MISC" adv="1">http://www.openwebanalytics.com/?p=384</ref>
      <ref url="http://secunia.com/advisories/56885" source="SECUNIA" adv="1">56885</ref>
    </refs>
    <vuln_soft>
      <prod vendor="openwebanalytics" name="open_web_analytics">
        <vers num="1.0"/>
        <vers num="1.0.1"/>
        <vers num="1.0.2"/>
        <vers num="1.0.3"/>
        <vers num="1.0.4"/>
        <vers num="1.0.5"/>
        <vers num="1.0.6"/>
        <vers num="1.0.7"/>
        <vers num="1.0.8" edition="rc1"/>
        <vers num="1.0.8" edition="rc2"/>
        <vers num="1.0.8" edition="rc3"/>
        <vers num="1.0.8" edition="rc4"/>
        <vers num="1.0.8" edition="rc5"/>
        <vers num="1.1.0" edition="rc1"/>
        <vers num="1.1.0" edition="rc2"/>
        <vers num="1.1.0" edition="rc3"/>
        <vers num="1.1.0" edition="rc4"/>
        <vers num="1.1.1"/>
        <vers num="1.2.0" edition="rc1"/>
        <vers num="1.2.0" edition="rc2"/>
        <vers num="1.2.0" edition="rc3"/>
        <vers num="1.2.1" edition="rc1"/>
        <vers num="1.2.2"/>
        <vers num="1.2.3"/>
        <vers num="1.2.4"/>
        <vers num="1.3.0" edition="rc1"/>
        <vers num="1.3.1"/>
        <vers num="1.4.0" edition="rc1"/>
        <vers num="1.4.0" edition="rc2"/>
        <vers num="1.4.0" edition="rc3"/>
        <vers num="1.4.0" edition="rc4"/>
        <vers num="1.4.1"/>
        <vers num="1.5.0" edition="rc1"/>
        <vers num="1.5.0" edition="rc2"/>
        <vers num="1.5.0" edition="rc3"/>
        <vers num="1.5.1"/>
        <vers num="1.5.2"/>
        <vers num="1.5.3"/>
        <vers num="1.5.4"/>
        <vers prev="1" num="1.5.5"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-1458" published="2014-02-04" name="CVE-2014-1458" modified="2014-02-21" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:S/C:N/I:P/A:N)" CVSS_score="3.5" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="6.8" CVSS_base_score="3.5">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in the web administration interface in FortiGuard FortiWeb 5.0.3 and earlier allows remote authenticated administrators to inject arbitrary web script or HTML via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90978" source="XF">fortiweb-cve20141458-xss(90978)</ref>
      <ref url="http://www.fortiguard.com/advisory/FG-IR-14-001/" source="CONFIRM" adv="1">http://www.fortiguard.com/advisory/FG-IR-14-001/</ref>
    </refs>
    <vuln_soft>
      <prod vendor="fortinet" name="fortiweb">
        <vers prev="1" num="5.0.3"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1459" published="2014-02-11" name="CVE-2014-1459" modified="2014-02-21" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:P/I:P/A:P)" CVSS_score="6.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.0" CVSS_base_score="6.5">
    <desc>
      <descript source="cve">SQL injection vulnerability in dg-admin/index.php in doorGets CMS 5.2 and earlier allows remote authenticated administrators to execute arbitrary SQL commands via the _position_down_id parameter.  NOTE: this can be leveraged using CSRF to allow remote attackers to execute arbitrary SQL commands.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://www.htbridge.com/advisory/HTB23197" source="MISC">https://www.htbridge.com/advisory/HTB23197</ref>
      <ref url="https://github.com/doorgets/doorGets/commit/6b81541fc1e5dd1c70614585c1a04d04ccdb3b19" source="CONFIRM">https://github.com/doorgets/doorGets/commit/6b81541fc1e5dd1c70614585c1a04d04ccdb3b19</ref>
      <ref url="http://xforce.iss.net/xforce/xfdb/90967" source="XF">doorgets-cve20141459-sql-injection(90967)</ref>
      <ref url="http://www.securityfocus.com/bid/65439" source="BID">65439</ref>
      <ref url="http://www.securityfocus.com/archive/1/archive/1/530931/100/0/threaded" source="BUGTRAQ">20140205 SQL Injection in doorGets CMS</ref>
      <ref url="http://www.exploit-db.com/exploits/31521" source="EXPLOIT-DB">31521</ref>
      <ref url="http://packetstormsecurity.com/files/125078" source="MISC">http://packetstormsecurity.com/files/125078</ref>
    </refs>
    <vuln_soft>
      <prod vendor="doorgets" name="doorgets_cms">
        <vers num="3.0"/>
        <vers num="4.0"/>
        <vers prev="1" num="5.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1466" published="2014-01-15" name="CVE-2014-1466" modified="2014-01-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">SQL injection vulnerability in CSP MySQL User Manager 2.3 allows remote attackers to execute arbitrary SQL commands via the login field of the login page.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90210" source="XF">cpsmysql-login-sql-injection(90210)</ref>
      <ref url="http://www.securityfocus.com/bid/64731" source="BID">64731</ref>
      <ref url="http://secunia.com/advisories/56348" source="SECUNIA">56348</ref>
      <ref url="http://packetstormsecurity.com/files/124724/cspmysql-sql.txt" source="MISC">http://packetstormsecurity.com/files/124724/cspmysql-sql.txt</ref>
      <ref url="http://osvdb.org/101867" source="OSVDB">101867</ref>
    </refs>
    <vuln_soft>
      <prod vendor="csp_mysql_user_manager_project" name="csp_mysql_user_manager">
        <vers num="2.3"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1467" published="2014-02-14" name="CVE-2014-1467" modified="2014-02-14" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:N/A:N)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">BlackBerry Enterprise Service 10 before 10.2.1, Universal Device Service 6, Enterprise Server Express for Domino through 5.0.4, Enterprise Server Express for Exchange through 5.0.4, Enterprise Server for Domino through 5.0.4 MR6, Enterprise Server for Exchange through 5.0.4 MR6, and Enterprise Server for GroupWise through 5.0.4 MR6 log cleartext credentials during exception handling, which might allow context-dependent attackers to obtain sensitive information by reading a log file.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.blackberry.com/btsc/KB35647" source="CONFIRM" adv="1">http://www.blackberry.com/btsc/KB35647</ref>
    </refs>
    <vuln_soft>
      <prod vendor="blackberry" name="blackberry_enterprise_service">
        <vers num="10.0"/>
        <vers num="10.1.0"/>
        <vers num="10.1.2"/>
        <vers num="10.2.0"/>
      </prod>
      <prod vendor="blackberry" name="blackberry_universal_device_service">
        <vers num="6.0"/>
      </prod>
      <prod vendor="blackberry" name="enterprise_server">
        <vers prev="1" num="5.0.4" edition="mr6:~~~lotus_domino~~"/>
        <vers prev="1" num="5.0.4" edition="mr6:~~~exchange_server~~"/>
        <vers prev="1" num="5.0.4" edition="mr6:~~~groupwise~~"/>
      </prod>
      <prod vendor="blackberry" name="enterprise_server_express">
        <vers prev="1" num="5.0.4" edition=":~~~exchange_server~~"/>
        <vers prev="1" num="5.0.4" edition=":~~~lotus_domino~~"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1471" published="2014-02-04" name="CVE-2014-1471" modified="2014-03-05" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">SQL injection vulnerability in the StateGetStatesByType function in Kernel/System/State.pm in Open Ticket Request System (OTRS) 3.1.x before 3.1.19, 3.2.x before 3.2.14, and 3.3.x before 3.3.4 allows remote attackers to execute arbitrary SQL commands via vectors related to a ticket search URL.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://www.otrs.com/security-advisory-2014-02-sql-injection-issue" source="CONFIRM" patch="1" adv="1">https://www.otrs.com/security-advisory-2014-02-sql-injection-issue</ref>
      <ref url="https://github.com/OTRS/otrs/commit/c4ec9205bde9c49770ddad94c1a980c006164949" source="CONFIRM" patch="1">https://github.com/OTRS/otrs/commit/c4ec9205bde9c49770ddad94c1a980c006164949</ref>
      <ref url="https://github.com/OTRS/otrs/commit/2997b36a7c84e933c4b025930cabe93efc4d261d" source="CONFIRM" patch="1">https://github.com/OTRS/otrs/commit/2997b36a7c84e933c4b025930cabe93efc4d261d</ref>
      <ref url="https://github.com/OTRS/otrs/commit/0680603a07b8dc37c2ddca6ff14e0236babefc82" source="CONFIRM" patch="1">https://github.com/OTRS/otrs/commit/0680603a07b8dc37c2ddca6ff14e0236babefc82</ref>
      <ref url="https://www.otrs.com/release-notes-otrs-help-desk-3-3-4" source="CONFIRM">https://www.otrs.com/release-notes-otrs-help-desk-3-3-4</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/01/29/15" source="MLIST">[oss-security] 20140129 Re: CVE Request: otrs: CSRF issue in customer web interface</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2867" source="DEBIAN">DSA-2867</ref>
      <ref url="http://secunia.com/advisories/56655" source="SECUNIA" adv="1">56655</ref>
      <ref url="http://secunia.com/advisories/56644" source="SECUNIA" adv="1">56644</ref>
      <ref url="http://osvdb.org/102661" source="OSVDB">102661</ref>
    </refs>
    <vuln_soft>
      <prod vendor="otrs" name="otrs">
        <vers num="3.1.0"/>
        <vers num="3.1.1"/>
        <vers num="3.1.10"/>
        <vers num="3.1.11"/>
        <vers num="3.1.13"/>
        <vers num="3.1.14"/>
        <vers num="3.1.15"/>
        <vers num="3.1.16"/>
        <vers num="3.1.17"/>
        <vers num="3.1.18"/>
        <vers num="3.1.2"/>
        <vers num="3.1.3"/>
        <vers num="3.1.4"/>
        <vers num="3.1.5"/>
        <vers num="3.1.6"/>
        <vers num="3.1.7"/>
        <vers num="3.1.8"/>
        <vers num="3.1.9"/>
        <vers num="3.2.0" edition="beta1"/>
        <vers num="3.2.0" edition="beta2"/>
        <vers num="3.2.0" edition="beta3"/>
        <vers num="3.2.0" edition="beta4"/>
        <vers num="3.2.0" edition="beta5"/>
        <vers num="3.2.0" edition="rc1"/>
        <vers num="3.2.1"/>
        <vers num="3.2.10"/>
        <vers num="3.2.2"/>
        <vers num="3.2.3"/>
        <vers num="3.2.4"/>
        <vers num="3.2.5"/>
        <vers num="3.2.6"/>
        <vers num="3.2.7"/>
        <vers num="3.2.8"/>
        <vers num="3.2.9"/>
        <vers num="3.3.0" edition="beta1"/>
        <vers num="3.3.0" edition="beta2"/>
        <vers num="3.3.0" edition="beta3"/>
        <vers num="3.3.0" edition="beta4"/>
        <vers num="3.3.0" edition="beta5"/>
        <vers num="3.3.0" edition="rc1"/>
        <vers num="3.3.1"/>
        <vers num="3.3.2"/>
        <vers num="3.3.3"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1472" published="2014-01-16" name="CVE-2014-1472" modified="2014-01-27" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Multiple cross-site scripting (XSS) vulnerabilities in the Enterprise Manager in McAfee Vulnerability Manager (MVM) 7.5.5 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="https://kc.mcafee.com/corporate/index?page=content&amp;id=SB10061" source="CONFIRM" adv="1">https://kc.mcafee.com/corporate/index?page=content&amp;id=SB10061</ref>
      <ref url="http://xforce.iss.net/xforce/xfdb/90244" source="XF">mcafee-vm-unspec-xss(90244)</ref>
      <ref url="http://www.securitytracker.com/id/1029591" source="SECTRACK">1029591</ref>
      <ref url="http://www.securityfocus.com/bid/64795" source="BID">64795</ref>
      <ref url="http://secunia.com/advisories/56394" source="SECUNIA" adv="1">56394</ref>
      <ref url="http://osvdb.org/101940" source="OSVDB">101940</ref>
    </refs>
    <vuln_soft>
      <prod vendor="mcafee" name="vulnerability_manager">
        <vers num="7.0.11"/>
        <vers num="7.5.4"/>
        <vers prev="1" num="7.5.5"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1473" published="2014-01-16" name="CVE-2014-1473" modified="2014-01-27" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:P)" CVSS_score="6.8" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.6" CVSS_base_score="6.8">
    <desc>
      <descript source="cve">Multiple cross-site request forgery (CSRF) vulnerabilities in the Enterprise Manager in McAfee Vulnerability Manager (MVM) 7.5.5 and earlier allow remote attackers to hijack the authentication of users for requests that modify HTML via unspecified vectors related to the "response web page."</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="https://kc.mcafee.com/corporate/index?page=content&amp;id=SB10061" source="CONFIRM" adv="1">https://kc.mcafee.com/corporate/index?page=content&amp;id=SB10061</ref>
      <ref url="http://xforce.iss.net/xforce/xfdb/90245" source="XF">mcafee-vm-unspec-csrf(90245)</ref>
      <ref url="http://www.securitytracker.com/id/1029591" source="SECTRACK">1029591</ref>
      <ref url="http://www.securityfocus.com/bid/64795" source="BID">64795</ref>
      <ref url="http://secunia.com/advisories/56394" source="SECUNIA" adv="1">56394</ref>
      <ref url="http://osvdb.org/101939" source="OSVDB">101939</ref>
    </refs>
    <vuln_soft>
      <prod vendor="mcafee" name="vulnerability_manager">
        <vers num="7.0.11"/>
        <vers num="7.5.4"/>
        <vers prev="1" num="7.5.5"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1475" published="2014-01-24" name="CVE-2014-1475" modified="2014-02-21" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">The OpenID module in Drupal 6.x before 6.30 and 7.x before 7.26 allows remote OpenID users to authenticate as other users via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://drupal.org/SA-CORE-2014-001" source="CONFIRM" adv="1">https://drupal.org/SA-CORE-2014-001</ref>
      <ref url="http://www.securityfocus.com/bid/64973" source="BID">64973</ref>
      <ref url="http://www.mandriva.com/security/advisories?name=MDVSA-2014:031" source="MANDRIVA">MDVSA-2014:031</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2851" source="DEBIAN">DSA-2851</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2847" source="DEBIAN">DSA-2847</ref>
      <ref url="http://secunia.com/advisories/56601" source="SECUNIA">56601</ref>
      <ref url="http://secunia.com/advisories/56260" source="SECUNIA" adv="1">56260</ref>
    </refs>
    <vuln_soft>
      <prod vendor="drupal" name="drupal">
        <vers num="6.0" edition="beta1"/>
        <vers num="6.0" edition="beta2"/>
        <vers num="6.0" edition="beta3"/>
        <vers num="6.0" edition="beta4"/>
        <vers num="6.0" edition="dev"/>
        <vers num="6.0" edition="rc-1"/>
        <vers num="6.0" edition="rc-2"/>
        <vers num="6.0" edition="rc-3"/>
        <vers num="6.0" edition="rc-4"/>
        <vers num="6.0" edition="rc1"/>
        <vers num="6.0" edition="rc2"/>
        <vers num="6.0" edition="rc3"/>
        <vers num="6.0" edition="rc4"/>
        <vers num="6.1"/>
        <vers num="6.10"/>
        <vers num="6.11"/>
        <vers num="6.12"/>
        <vers num="6.13"/>
        <vers num="6.14"/>
        <vers num="6.15"/>
        <vers num="6.16"/>
        <vers num="6.17"/>
        <vers num="6.18"/>
        <vers num="6.19"/>
        <vers num="6.2"/>
        <vers num="6.20"/>
        <vers num="6.21"/>
        <vers num="6.22"/>
        <vers num="6.23"/>
        <vers num="6.24"/>
        <vers num="6.25"/>
        <vers num="6.26"/>
        <vers num="6.27"/>
        <vers num="6.28"/>
        <vers num="7.0" edition="alpha1"/>
        <vers num="7.0" edition="alpha2"/>
        <vers num="7.0" edition="alpha3"/>
        <vers num="7.0" edition="alpha4"/>
        <vers num="7.0" edition="alpha5"/>
        <vers num="7.0" edition="alpha6"/>
        <vers num="7.0" edition="alpha7"/>
        <vers num="7.0" edition="beta1"/>
        <vers num="7.0" edition="beta2"/>
        <vers num="7.0" edition="beta3"/>
        <vers num="7.0" edition="dev"/>
        <vers num="7.0" edition="rc1"/>
        <vers num="7.0" edition="rc2"/>
        <vers num="7.0" edition="rc3"/>
        <vers num="7.0" edition="rc4"/>
        <vers num="7.1"/>
        <vers num="7.10"/>
        <vers num="7.11"/>
        <vers num="7.12"/>
        <vers num="7.13"/>
        <vers num="7.14"/>
        <vers num="7.15"/>
        <vers num="7.16"/>
        <vers num="7.17"/>
        <vers num="7.18"/>
        <vers num="7.19"/>
        <vers num="7.2"/>
        <vers num="7.20"/>
        <vers num="7.21"/>
        <vers num="7.22"/>
        <vers num="7.23"/>
        <vers num="7.24"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1476" published="2014-01-24" name="CVE-2014-1476" modified="2014-02-21" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:P/I:N/A:N)" CVSS_score="4.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.0" CVSS_base_score="4.0">
    <desc>
      <descript source="cve">The Taxonomy module in Drupal 7.x before 7.26, when upgraded from an earlier version of Drupal, does not properly restrict access to unpublished content, which allows remote authenticated users to obtain sensitive information via a listing page.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://drupal.org/SA-CORE-2014-001" source="CONFIRM">https://drupal.org/SA-CORE-2014-001</ref>
      <ref url="http://www.securityfocus.com/bid/64973" source="BID">64973</ref>
      <ref url="http://www.mandriva.com/security/advisories?name=MDVSA-2014:031" source="MANDRIVA">MDVSA-2014:031</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2847" source="DEBIAN">DSA-2847</ref>
      <ref url="http://secunia.com/advisories/56260" source="SECUNIA" adv="1">56260</ref>
    </refs>
    <vuln_soft>
      <prod vendor="drupal" name="drupal">
        <vers num="7.0" edition="alpha1"/>
        <vers num="7.0" edition="alpha2"/>
        <vers num="7.0" edition="alpha3"/>
        <vers num="7.0" edition="alpha4"/>
        <vers num="7.0" edition="alpha5"/>
        <vers num="7.0" edition="alpha6"/>
        <vers num="7.0" edition="alpha7"/>
        <vers num="7.0" edition="beta1"/>
        <vers num="7.0" edition="beta2"/>
        <vers num="7.0" edition="beta3"/>
        <vers num="7.0" edition="dev"/>
        <vers num="7.0" edition="rc1"/>
        <vers num="7.0" edition="rc2"/>
        <vers num="7.0" edition="rc3"/>
        <vers num="7.0" edition="rc4"/>
        <vers num="7.1"/>
        <vers num="7.10"/>
        <vers num="7.11"/>
        <vers num="7.12"/>
        <vers num="7.13"/>
        <vers num="7.14"/>
        <vers num="7.15"/>
        <vers num="7.16"/>
        <vers num="7.17"/>
        <vers num="7.18"/>
        <vers num="7.19"/>
        <vers num="7.2"/>
        <vers num="7.20"/>
        <vers num="7.21"/>
        <vers num="7.22"/>
        <vers num="7.23"/>
        <vers num="7.24"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1477" published="2014-02-06" name="CVE-2014-1477" modified="2014-04-01" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:C/I:C/A:C)" CVSS_score="10.0" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="10.0" CVSS_base_score="10.0">
    <desc>
      <descript source="cve">Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=953114" source="CONFIRM">https://bugzilla.mozilla.org/show_bug.cgi?id=953114</ref>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=951366" source="CONFIRM">https://bugzilla.mozilla.org/show_bug.cgi?id=951366</ref>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=950438" source="CONFIRM">https://bugzilla.mozilla.org/show_bug.cgi?id=950438</ref>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=950000" source="CONFIRM">https://bugzilla.mozilla.org/show_bug.cgi?id=950000</ref>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=945939" source="CONFIRM">https://bugzilla.mozilla.org/show_bug.cgi?id=945939</ref>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=945334" source="CONFIRM">https://bugzilla.mozilla.org/show_bug.cgi?id=945334</ref>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=937697" source="CONFIRM">https://bugzilla.mozilla.org/show_bug.cgi?id=937697</ref>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=937132" source="CONFIRM">https://bugzilla.mozilla.org/show_bug.cgi?id=937132</ref>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=936808" source="CONFIRM">https://bugzilla.mozilla.org/show_bug.cgi?id=936808</ref>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=925896" source="CONFIRM">https://bugzilla.mozilla.org/show_bug.cgi?id=925896</ref>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=921470" source="CONFIRM">https://bugzilla.mozilla.org/show_bug.cgi?id=921470</ref>
      <ref url="https://8pecxstudios.com/?page_id=44080" source="CONFIRM">https://8pecxstudios.com/?page_id=44080</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2119-1" source="UBUNTU">USN-2119-1</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2102-2" source="UBUNTU">USN-2102-2</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2102-1" source="UBUNTU">USN-2102-1</ref>
      <ref url="http://www.mozilla.org/security/announce/2014/mfsa2014-01.html" source="CONFIRM" adv="1">http://www.mozilla.org/security/announce/2014/mfsa2014-01.html</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2858" source="DEBIAN">DSA-2858</ref>
      <ref url="http://secunia.com/advisories/56706" source="SECUNIA">56706</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0133.html" source="REDHAT">RHSA-2014:0133</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0132.html" source="REDHAT">RHSA-2014:0132</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.html" source="SUSE">openSUSE-SU-2014:0419</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00010.html" source="SUSE">SUSE-SU-2014:0248</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00005.html" source="SUSE">openSUSE-SU-2014:0213</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00004.html" source="SUSE">openSUSE-SU-2014:0212</ref>
      <ref url="http://lists.fedoraproject.org/pipermail/package-announce/2014-February/129218.html" source="FEDORA">FEDORA-2014-2083</ref>
      <ref url="http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127966.html" source="FEDORA">FEDORA-2014-2041</ref>
    </refs>
    <vuln_soft>
      <prod vendor="mozilla" name="firefox">
        <vers num="0.1"/>
        <vers num="0.10"/>
        <vers num="0.10.1"/>
        <vers num="0.2"/>
        <vers num="0.3"/>
        <vers num="0.4"/>
        <vers num="0.5"/>
        <vers num="0.6"/>
        <vers num="0.6.1"/>
        <vers num="0.7"/>
        <vers num="0.7.1"/>
        <vers num="0.8"/>
        <vers num="0.9" edition="rc"/>
        <vers num="0.9.1"/>
        <vers num="0.9.2"/>
        <vers num="0.9.3"/>
        <vers num="1.0" edition="preview_release"/>
        <vers num="1.0.1"/>
        <vers num="1.0.2"/>
        <vers num="1.0.3"/>
        <vers num="1.0.4"/>
        <vers num="1.0.5"/>
        <vers num="1.0.6"/>
        <vers num="1.0.7"/>
        <vers num="1.0.8"/>
        <vers num="1.5" edition="beta1"/>
        <vers num="1.5" edition="beta2"/>
        <vers num="1.5.0.1"/>
        <vers num="1.5.0.10"/>
        <vers num="1.5.0.11"/>
        <vers num="1.5.0.12"/>
        <vers num="1.5.0.2"/>
        <vers num="1.5.0.3"/>
        <vers num="1.5.0.4"/>
        <vers num="1.5.0.5"/>
        <vers num="1.5.0.6"/>
        <vers num="1.5.0.7"/>
        <vers num="1.5.0.8"/>
        <vers num="1.5.0.9"/>
        <vers num="1.5.1"/>
        <vers num="1.5.2"/>
        <vers num="1.5.3"/>
        <vers num="1.5.4"/>
        <vers num="1.5.5"/>
        <vers num="1.5.6"/>
        <vers num="1.5.7"/>
        <vers num="1.5.8"/>
        <vers num="10.0"/>
        <vers num="10.0.1"/>
        <vers num="10.0.10"/>
        <vers num="10.0.11"/>
        <vers num="10.0.12"/>
        <vers num="10.0.2"/>
        <vers num="10.0.3"/>
        <vers num="10.0.4"/>
        <vers num="10.0.5"/>
        <vers num="10.0.6"/>
        <vers num="10.0.7"/>
        <vers num="10.0.8"/>
        <vers num="10.0.9"/>
        <vers num="11.0"/>
        <vers num="12.0" edition="beta6"/>
        <vers num="13.0"/>
        <vers num="13.0.1"/>
        <vers num="14.0"/>
        <vers num="14.0.1"/>
        <vers num="15.0"/>
        <vers num="15.0.1"/>
        <vers num="16.0"/>
        <vers num="16.0.1"/>
        <vers num="16.0.2"/>
        <vers num="17.0.10"/>
        <vers num="17.0.11"/>
        <vers num="17.0.2"/>
        <vers num="17.0.3"/>
        <vers num="17.0.4"/>
        <vers num="17.0.5"/>
        <vers num="17.0.6"/>
        <vers num="17.0.7"/>
        <vers num="17.0.8"/>
        <vers num="17.0.9"/>
        <vers num="18.0"/>
        <vers num="18.0.1"/>
        <vers num="18.0.2"/>
        <vers num="19.0"/>
        <vers num="19.0.1"/>
        <vers num="19.0.2"/>
        <vers num="2.0"/>
        <vers num="2.0.0.1"/>
        <vers num="2.0.0.10"/>
        <vers num="2.0.0.11"/>
        <vers num="2.0.0.12"/>
        <vers num="2.0.0.13"/>
        <vers num="2.0.0.14"/>
        <vers num="2.0.0.15"/>
        <vers num="2.0.0.16"/>
        <vers num="2.0.0.17"/>
        <vers num="2.0.0.18"/>
        <vers num="2.0.0.19"/>
        <vers num="2.0.0.2"/>
        <vers num="2.0.0.20"/>
        <vers num="2.0.0.3"/>
        <vers num="2.0.0.4"/>
        <vers num="2.0.0.5"/>
        <vers num="2.0.0.6"/>
        <vers num="2.0.0.7"/>
        <vers num="2.0.0.8"/>
        <vers num="2.0.0.9"/>
        <vers num="20.0"/>
        <vers num="20.0.1"/>
        <vers num="21.0"/>
        <vers num="23.0"/>
        <vers num="23.0.1"/>
        <vers num="24.0"/>
        <vers num="24.1"/>
        <vers num="24.1.1"/>
        <vers num="25.0"/>
        <vers num="25.0.1"/>
        <vers prev="1" num="26.0"/>
        <vers num="3.0"/>
        <vers num="3.0.1"/>
        <vers num="3.0.10"/>
        <vers num="3.0.11"/>
        <vers num="3.0.12"/>
        <vers num="3.0.13"/>
        <vers num="3.0.14"/>
        <vers num="3.0.15"/>
        <vers num="3.0.16"/>
        <vers num="3.0.17"/>
        <vers num="3.0.18"/>
        <vers num="3.0.19"/>
        <vers num="3.0.2"/>
        <vers num="3.0.3"/>
        <vers num="3.0.4"/>
        <vers num="3.0.5"/>
        <vers num="3.0.6"/>
        <vers num="3.0.7"/>
        <vers num="3.0.8"/>
        <vers num="3.0.9"/>
        <vers num="3.5"/>
        <vers num="3.5.1"/>
        <vers num="3.5.10"/>
        <vers num="3.5.11"/>
        <vers num="3.5.12"/>
        <vers num="3.5.13"/>
        <vers num="3.5.14"/>
        <vers num="3.5.15"/>
        <vers num="3.5.16"/>
        <vers num="3.5.17"/>
        <vers num="3.5.18"/>
        <vers num="3.5.19"/>
        <vers num="3.5.2"/>
        <vers num="3.5.3"/>
        <vers num="3.5.4"/>
        <vers num="3.5.5"/>
        <vers num="3.5.6"/>
        <vers num="3.5.7"/>
        <vers num="3.5.8"/>
        <vers num="3.5.9"/>
        <vers num="3.6"/>
        <vers num="3.6.10"/>
        <vers num="3.6.11"/>
        <vers num="3.6.12"/>
        <vers num="3.6.13"/>
        <vers num="3.6.14"/>
        <vers num="3.6.15"/>
        <vers num="3.6.16"/>
        <vers num="3.6.17"/>
        <vers num="3.6.18"/>
        <vers num="3.6.19"/>
        <vers num="3.6.2"/>
        <vers num="3.6.20"/>
        <vers num="3.6.21"/>
        <vers num="3.6.22"/>
        <vers num="3.6.23"/>
        <vers num="3.6.24"/>
        <vers num="3.6.25"/>
        <vers num="3.6.26"/>
        <vers num="3.6.27"/>
        <vers num="3.6.28"/>
        <vers num="3.6.3"/>
        <vers num="3.6.4"/>
        <vers num="3.6.6"/>
        <vers num="3.6.7"/>
        <vers num="3.6.8"/>
        <vers num="3.6.9"/>
        <vers num="4.0" edition="beta1"/>
        <vers num="4.0" edition="beta10"/>
        <vers num="4.0" edition="beta11"/>
        <vers num="4.0" edition="beta12"/>
        <vers num="4.0" edition="beta2"/>
        <vers num="4.0" edition="beta3"/>
        <vers num="4.0" edition="beta4"/>
        <vers num="4.0" edition="beta5"/>
        <vers num="4.0" edition="beta6"/>
        <vers num="4.0" edition="beta7"/>
        <vers num="4.0" edition="beta8"/>
        <vers num="4.0" edition="beta9"/>
        <vers num="4.0.1"/>
        <vers num="5.0"/>
        <vers num="5.0.1"/>
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers num="6.0.2"/>
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="8.0"/>
        <vers num="8.0.1"/>
        <vers num="9.0"/>
        <vers num="9.0.1"/>
      </prod>
      <prod vendor="mozilla" name="firefox_esr">
        <vers num="24.0"/>
        <vers num="24.0.1"/>
        <vers num="24.0.2"/>
        <vers num="24.1.0"/>
        <vers num="24.1.1"/>
        <vers num="24.2"/>
      </prod>
      <prod vendor="mozilla" name="seamonkey">
        <vers num="2.0" edition="alpha_1"/>
        <vers num="2.0" edition="alpha_2"/>
        <vers num="2.0" edition="alpha_3"/>
        <vers num="2.0" edition="beta_1"/>
        <vers num="2.0" edition="beta_2"/>
        <vers num="2.0" edition="rc1"/>
        <vers num="2.0" edition="rc2"/>
        <vers num="2.0.1"/>
        <vers num="2.0.10"/>
        <vers num="2.0.11"/>
        <vers num="2.0.12"/>
        <vers num="2.0.13"/>
        <vers num="2.0.14"/>
        <vers num="2.0.2"/>
        <vers num="2.0.3"/>
        <vers num="2.0.4"/>
        <vers num="2.0.5"/>
        <vers num="2.0.6"/>
        <vers num="2.0.7"/>
        <vers num="2.0.8"/>
        <vers num="2.0.9"/>
        <vers num="2.1" edition="alpha1"/>
        <vers num="2.1" edition="alpha2"/>
        <vers num="2.1" edition="alpha3"/>
        <vers num="2.1" edition="beta1"/>
        <vers num="2.1" edition="beta2"/>
        <vers num="2.1" edition="beta3"/>
        <vers num="2.1" edition="rc1"/>
        <vers num="2.1" edition="rc2"/>
        <vers num="2.10" edition="beta1"/>
        <vers num="2.10" edition="beta2"/>
        <vers num="2.10" edition="beta3"/>
        <vers num="2.10.1"/>
        <vers num="2.11" edition="beta1"/>
        <vers num="2.11" edition="beta2"/>
        <vers num="2.11" edition="beta3"/>
        <vers num="2.11" edition="beta4"/>
        <vers num="2.11" edition="beta5"/>
        <vers num="2.11" edition="beta6"/>
        <vers num="2.12" edition="beta1"/>
        <vers num="2.12" edition="beta2"/>
        <vers num="2.12" edition="beta3"/>
        <vers num="2.12" edition="beta4"/>
        <vers num="2.12" edition="beta5"/>
        <vers num="2.12" edition="beta6"/>
        <vers num="2.12.1"/>
        <vers num="2.13" edition="beta1"/>
        <vers num="2.13" edition="beta2"/>
        <vers num="2.13" edition="beta3"/>
        <vers num="2.13" edition="beta4"/>
        <vers num="2.13" edition="beta5"/>
        <vers num="2.13" edition="beta6"/>
        <vers num="2.13.1"/>
        <vers num="2.13.2"/>
        <vers num="2.14" edition="beta1"/>
        <vers num="2.14" edition="beta2"/>
        <vers num="2.14" edition="beta3"/>
        <vers num="2.14" edition="beta4"/>
        <vers num="2.14" edition="beta5"/>
        <vers num="2.15" edition="beta1"/>
        <vers num="2.15" edition="beta2"/>
        <vers num="2.15" edition="beta3"/>
        <vers num="2.15" edition="beta4"/>
        <vers num="2.15" edition="beta5"/>
        <vers num="2.15" edition="beta6"/>
        <vers num="2.15.1"/>
        <vers num="2.15.2"/>
        <vers num="2.16" edition="beta1"/>
        <vers num="2.16" edition="beta2"/>
        <vers num="2.16" edition="beta3"/>
        <vers num="2.16" edition="beta4"/>
        <vers num="2.16" edition="beta5"/>
        <vers num="2.16.1"/>
        <vers num="2.16.2"/>
        <vers num="2.17" edition="beta1"/>
        <vers num="2.17" edition="beta2"/>
        <vers num="2.17" edition="beta3"/>
        <vers num="2.17" edition="beta4"/>
        <vers num="2.17.1"/>
        <vers num="2.18" edition="beta1"/>
        <vers num="2.18" edition="beta2"/>
        <vers num="2.18" edition="beta3"/>
        <vers num="2.18" edition="beta4"/>
        <vers num="2.19" edition="beta1"/>
        <vers num="2.19" edition="beta2"/>
        <vers num="2.2" edition="beta1"/>
        <vers num="2.2" edition="beta2"/>
        <vers num="2.2" edition="beta3"/>
        <vers num="2.20" edition="beta1"/>
        <vers num="2.20" edition="beta2"/>
        <vers num="2.20" edition="beta3"/>
        <vers num="2.21" edition="beta1"/>
        <vers num="2.21" edition="beta2"/>
        <vers num="2.22" edition="beta1"/>
        <vers num="2.22" edition="beta2"/>
        <vers num="2.22.1"/>
        <vers num="2.23" edition="beta1"/>
        <vers num="2.23" edition="beta2"/>
        <vers prev="1" num="2.24" edition="beta1"/>
        <vers num="2.3" edition="beta1"/>
        <vers num="2.3" edition="beta2"/>
        <vers num="2.3" edition="beta3"/>
        <vers num="2.3.1"/>
        <vers num="2.3.2"/>
        <vers num="2.3.3"/>
        <vers num="2.4" edition="beta1"/>
        <vers num="2.4" edition="beta2"/>
        <vers num="2.4" edition="beta3"/>
        <vers num="2.4.1"/>
        <vers num="2.5" edition="beta1"/>
        <vers num="2.5" edition="beta2"/>
        <vers num="2.5" edition="beta3"/>
        <vers num="2.5" edition="beta4"/>
        <vers num="2.6" edition="beta1"/>
        <vers num="2.6" edition="beta2"/>
        <vers num="2.6" edition="beta3"/>
        <vers num="2.6" edition="beta4"/>
        <vers num="2.6.1"/>
        <vers num="2.7" edition="beta1"/>
        <vers num="2.7" edition="beta2"/>
        <vers num="2.7" edition="beta3"/>
        <vers num="2.7" edition="beta4"/>
        <vers num="2.7" edition="beta5"/>
        <vers num="2.7.1"/>
        <vers num="2.7.2"/>
        <vers num="2.8" edition="beta1"/>
        <vers num="2.8" edition="beta2"/>
        <vers num="2.8" edition="beta3"/>
        <vers num="2.8" edition="beta4"/>
        <vers num="2.8" edition="beta5"/>
        <vers num="2.8" edition="beta6"/>
        <vers num="2.9" edition="beta1"/>
        <vers num="2.9" edition="beta2"/>
        <vers num="2.9" edition="beta3"/>
        <vers num="2.9" edition="beta4"/>
        <vers num="2.9.1"/>
      </prod>
      <prod vendor="mozilla" name="thunderbird">
        <vers num="0.1"/>
        <vers num="0.2"/>
        <vers num="0.3"/>
        <vers num="0.4"/>
        <vers num="0.5"/>
        <vers num="0.6"/>
        <vers num="0.7"/>
        <vers num="0.7.1"/>
        <vers num="0.7.2"/>
        <vers num="0.7.3"/>
        <vers num="0.8"/>
        <vers num="0.9"/>
        <vers num="1.0"/>
        <vers num="1.0.1"/>
        <vers num="1.0.2"/>
        <vers num="1.0.3"/>
        <vers num="1.0.4"/>
        <vers num="1.0.5" edition="beta"/>
        <vers num="1.0.6"/>
        <vers num="1.0.7"/>
        <vers num="1.0.8"/>
        <vers num="1.5" edition="beta2"/>
        <vers num="1.5.0.1"/>
        <vers num="1.5.0.10"/>
        <vers num="1.5.0.11"/>
        <vers num="1.5.0.12"/>
        <vers num="1.5.0.13"/>
        <vers num="1.5.0.14"/>
        <vers num="1.5.0.2"/>
        <vers num="1.5.0.3"/>
        <vers num="1.5.0.4"/>
        <vers num="1.5.0.5"/>
        <vers num="1.5.0.6"/>
        <vers num="1.5.0.7"/>
        <vers num="1.5.0.8"/>
        <vers num="1.5.0.9"/>
        <vers num="1.5.1"/>
        <vers num="1.5.2"/>
        <vers num="1.7.1"/>
        <vers num="1.7.3"/>
        <vers num="10.0"/>
        <vers num="10.0.1"/>
        <vers num="10.0.2"/>
        <vers num="10.0.3"/>
        <vers num="10.0.4"/>
        <vers num="11.0"/>
        <vers num="11.0.1"/>
        <vers num="12.0"/>
        <vers num="12.0.1"/>
        <vers num="13.0"/>
        <vers num="13.0.1"/>
        <vers num="14.0"/>
        <vers num="15.0"/>
        <vers num="15.0.1"/>
        <vers num="16.0"/>
        <vers num="16.0.1"/>
        <vers num="16.0.2"/>
        <vers num="17.0"/>
        <vers num="17.0.1"/>
        <vers num="17.0.2"/>
        <vers num="17.0.3"/>
        <vers num="17.0.4"/>
        <vers num="17.0.5"/>
        <vers num="17.0.6"/>
        <vers num="17.0.7"/>
        <vers num="17.0.8"/>
        <vers num="2.0"/>
        <vers num="2.0.0.0"/>
        <vers num="2.0.0.1"/>
        <vers num="2.0.0.11"/>
        <vers num="2.0.0.12"/>
        <vers num="2.0.0.13"/>
        <vers num="2.0.0.14"/>
        <vers num="2.0.0.15"/>
        <vers num="2.0.0.16"/>
        <vers num="2.0.0.17"/>
        <vers num="2.0.0.18"/>
        <vers num="2.0.0.19"/>
        <vers num="2.0.0.2"/>
        <vers num="2.0.0.20"/>
        <vers num="2.0.0.21"/>
        <vers num="2.0.0.22"/>
        <vers num="2.0.0.23"/>
        <vers num="2.0.0.3"/>
        <vers num="2.0.0.4"/>
        <vers num="2.0.0.5"/>
        <vers num="2.0.0.6"/>
        <vers num="2.0.0.7"/>
        <vers num="2.0.0.8"/>
        <vers num="2.0.0.9"/>
        <vers num="24.0"/>
        <vers num="24.0.1"/>
        <vers num="24.1"/>
        <vers num="24.1.1"/>
        <vers prev="1" num="24.2"/>
        <vers num="3.0"/>
        <vers num="3.0.1"/>
        <vers num="3.0.10"/>
        <vers num="3.0.11"/>
        <vers num="3.0.2"/>
        <vers num="3.0.3"/>
        <vers num="3.0.4"/>
        <vers num="3.0.5"/>
        <vers num="3.0.6"/>
        <vers num="3.0.7"/>
        <vers num="3.0.8"/>
        <vers num="3.0.9"/>
        <vers num="3.1"/>
        <vers num="3.1.1"/>
        <vers num="3.1.10"/>
        <vers num="3.1.11"/>
        <vers num="3.1.12"/>
        <vers num="3.1.13"/>
        <vers num="3.1.14"/>
        <vers num="3.1.15"/>
        <vers num="3.1.16"/>
        <vers num="3.1.17"/>
        <vers num="3.1.2"/>
        <vers num="3.1.3"/>
        <vers num="3.1.4"/>
        <vers num="3.1.5"/>
        <vers num="3.1.6"/>
        <vers num="3.1.7"/>
        <vers num="3.1.8"/>
        <vers num="3.1.9"/>
        <vers num="5.0"/>
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers num="6.0.2"/>
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="8.0"/>
        <vers num="9.0"/>
        <vers num="9.0.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1478" published="2014-02-06" name="CVE-2014-1478" modified="2014-04-01" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:C/I:C/A:C)" CVSS_score="10.0" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="10.0" CVSS_base_score="10.0">
    <desc>
      <descript source="cve">Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 27.0 and SeaMonkey before 2.24 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to the MPostWriteBarrier class in js/src/jit/MIR.h and stack alignment in js/src/jit/AsmJS.cpp in OdinMonkey, and unknown other vectors.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=953373" source="CONFIRM" adv="1">https://bugzilla.mozilla.org/show_bug.cgi?id=953373</ref>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=950452" source="CONFIRM" adv="1">https://bugzilla.mozilla.org/show_bug.cgi?id=950452</ref>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=946733" source="CONFIRM" adv="1">https://bugzilla.mozilla.org/show_bug.cgi?id=946733</ref>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=945585" source="CONFIRM" adv="1">https://bugzilla.mozilla.org/show_bug.cgi?id=945585</ref>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=944851" source="CONFIRM" adv="1">https://bugzilla.mozilla.org/show_bug.cgi?id=944851</ref>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=944321" source="CONFIRM" adv="1">https://bugzilla.mozilla.org/show_bug.cgi?id=944321</ref>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=944278" source="CONFIRM" adv="1">https://bugzilla.mozilla.org/show_bug.cgi?id=944278</ref>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=942940" source="CONFIRM" adv="1">https://bugzilla.mozilla.org/show_bug.cgi?id=942940</ref>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=942152" source="CONFIRM" adv="1">https://bugzilla.mozilla.org/show_bug.cgi?id=942152</ref>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=939472" source="CONFIRM" adv="1">https://bugzilla.mozilla.org/show_bug.cgi?id=939472</ref>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=938431" source="CONFIRM" adv="1">https://bugzilla.mozilla.org/show_bug.cgi?id=938431</ref>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=932162" source="CONFIRM" adv="1">https://bugzilla.mozilla.org/show_bug.cgi?id=932162</ref>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=925308" source="CONFIRM" adv="1">https://bugzilla.mozilla.org/show_bug.cgi?id=925308</ref>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=924348" source="CONFIRM" adv="1">https://bugzilla.mozilla.org/show_bug.cgi?id=924348</ref>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=922603" source="CONFIRM" adv="1">https://bugzilla.mozilla.org/show_bug.cgi?id=922603</ref>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=916635" source="CONFIRM" adv="1">https://bugzilla.mozilla.org/show_bug.cgi?id=916635</ref>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=911845" source="CONFIRM" adv="1">https://bugzilla.mozilla.org/show_bug.cgi?id=911845</ref>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=911707" source="CONFIRM" adv="1">https://bugzilla.mozilla.org/show_bug.cgi?id=911707</ref>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=867597" source="CONFIRM" adv="1">https://bugzilla.mozilla.org/show_bug.cgi?id=867597</ref>
      <ref url="https://8pecxstudios.com/?page_id=44080" source="CONFIRM">https://8pecxstudios.com/?page_id=44080</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2102-2" source="UBUNTU">USN-2102-2</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2102-1" source="UBUNTU">USN-2102-1</ref>
      <ref url="http://www.mozilla.org/security/announce/2014/mfsa2014-01.html" source="CONFIRM" adv="1">http://www.mozilla.org/security/announce/2014/mfsa2014-01.html</ref>
      <ref url="http://secunia.com/advisories/56706" source="SECUNIA">56706</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.html" source="SUSE">openSUSE-SU-2014:0419</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00005.html" source="SUSE">openSUSE-SU-2014:0213</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00004.html" source="SUSE">openSUSE-SU-2014:0212</ref>
    </refs>
    <vuln_soft>
      <prod vendor="mozilla" name="firefox">
        <vers num="0.1"/>
        <vers num="0.10"/>
        <vers num="0.10.1"/>
        <vers num="0.2"/>
        <vers num="0.3"/>
        <vers num="0.4"/>
        <vers num="0.5"/>
        <vers num="0.6"/>
        <vers num="0.6.1"/>
        <vers num="0.7"/>
        <vers num="0.7.1"/>
        <vers num="0.8"/>
        <vers num="0.9" edition="rc"/>
        <vers num="0.9.1"/>
        <vers num="0.9.2"/>
        <vers num="0.9.3"/>
        <vers num="1.0" edition="preview_release"/>
        <vers num="1.0.1"/>
        <vers num="1.0.2"/>
        <vers num="1.0.3"/>
        <vers num="1.0.4"/>
        <vers num="1.0.5"/>
        <vers num="1.0.6"/>
        <vers num="1.0.7"/>
        <vers num="1.0.8"/>
        <vers num="1.5" edition="beta1"/>
        <vers num="1.5" edition="beta2"/>
        <vers num="1.5.0.1"/>
        <vers num="1.5.0.10"/>
        <vers num="1.5.0.11"/>
        <vers num="1.5.0.12"/>
        <vers num="1.5.0.2"/>
        <vers num="1.5.0.3"/>
        <vers num="1.5.0.4"/>
        <vers num="1.5.0.5"/>
        <vers num="1.5.0.6"/>
        <vers num="1.5.0.7"/>
        <vers num="1.5.0.8"/>
        <vers num="1.5.0.9"/>
        <vers num="1.5.1"/>
        <vers num="1.5.2"/>
        <vers num="1.5.3"/>
        <vers num="1.5.4"/>
        <vers num="1.5.5"/>
        <vers num="1.5.6"/>
        <vers num="1.5.7"/>
        <vers num="1.5.8"/>
        <vers num="10.0"/>
        <vers num="10.0.1"/>
        <vers num="10.0.10"/>
        <vers num="10.0.11"/>
        <vers num="10.0.12"/>
        <vers num="10.0.2"/>
        <vers num="10.0.3"/>
        <vers num="10.0.4"/>
        <vers num="10.0.5"/>
        <vers num="10.0.6"/>
        <vers num="10.0.7"/>
        <vers num="10.0.8"/>
        <vers num="10.0.9"/>
        <vers num="11.0"/>
        <vers num="12.0" edition="beta6"/>
        <vers num="13.0"/>
        <vers num="13.0.1"/>
        <vers num="14.0"/>
        <vers num="14.0.1"/>
        <vers num="15.0"/>
        <vers num="15.0.1"/>
        <vers num="16.0"/>
        <vers num="16.0.1"/>
        <vers num="16.0.2"/>
        <vers num="17.0.10"/>
        <vers num="17.0.11"/>
        <vers num="17.0.2"/>
        <vers num="17.0.3"/>
        <vers num="17.0.4"/>
        <vers num="17.0.5"/>
        <vers num="17.0.6"/>
        <vers num="17.0.7"/>
        <vers num="17.0.8"/>
        <vers num="17.0.9"/>
        <vers num="18.0"/>
        <vers num="18.0.1"/>
        <vers num="18.0.2"/>
        <vers num="19.0"/>
        <vers num="19.0.1"/>
        <vers num="19.0.2"/>
        <vers num="2.0"/>
        <vers num="2.0.0.1"/>
        <vers num="2.0.0.10"/>
        <vers num="2.0.0.11"/>
        <vers num="2.0.0.12"/>
        <vers num="2.0.0.13"/>
        <vers num="2.0.0.14"/>
        <vers num="2.0.0.15"/>
        <vers num="2.0.0.16"/>
        <vers num="2.0.0.17"/>
        <vers num="2.0.0.18"/>
        <vers num="2.0.0.19"/>
        <vers num="2.0.0.2"/>
        <vers num="2.0.0.20"/>
        <vers num="2.0.0.3"/>
        <vers num="2.0.0.4"/>
        <vers num="2.0.0.5"/>
        <vers num="2.0.0.6"/>
        <vers num="2.0.0.7"/>
        <vers num="2.0.0.8"/>
        <vers num="2.0.0.9"/>
        <vers num="20.0"/>
        <vers num="20.0.1"/>
        <vers num="21.0"/>
        <vers num="23.0"/>
        <vers num="23.0.1"/>
        <vers num="24.0"/>
        <vers num="24.1"/>
        <vers num="24.1.1"/>
        <vers num="25.0"/>
        <vers num="25.0.1"/>
        <vers prev="1" num="26.0"/>
        <vers num="3.0"/>
        <vers num="3.0.1"/>
        <vers num="3.0.10"/>
        <vers num="3.0.11"/>
        <vers num="3.0.12"/>
        <vers num="3.0.13"/>
        <vers num="3.0.14"/>
        <vers num="3.0.15"/>
        <vers num="3.0.16"/>
        <vers num="3.0.17"/>
        <vers num="3.0.18"/>
        <vers num="3.0.19"/>
        <vers num="3.0.2"/>
        <vers num="3.0.3"/>
        <vers num="3.0.4"/>
        <vers num="3.0.5"/>
        <vers num="3.0.6"/>
        <vers num="3.0.7"/>
        <vers num="3.0.8"/>
        <vers num="3.0.9"/>
        <vers num="3.5"/>
        <vers num="3.5.1"/>
        <vers num="3.5.10"/>
        <vers num="3.5.11"/>
        <vers num="3.5.12"/>
        <vers num="3.5.13"/>
        <vers num="3.5.14"/>
        <vers num="3.5.15"/>
        <vers num="3.5.16"/>
        <vers num="3.5.17"/>
        <vers num="3.5.18"/>
        <vers num="3.5.19"/>
        <vers num="3.5.2"/>
        <vers num="3.5.3"/>
        <vers num="3.5.4"/>
        <vers num="3.5.5"/>
        <vers num="3.5.6"/>
        <vers num="3.5.7"/>
        <vers num="3.5.8"/>
        <vers num="3.5.9"/>
        <vers num="3.6"/>
        <vers num="3.6.10"/>
        <vers num="3.6.11"/>
        <vers num="3.6.12"/>
        <vers num="3.6.13"/>
        <vers num="3.6.14"/>
        <vers num="3.6.15"/>
        <vers num="3.6.16"/>
        <vers num="3.6.17"/>
        <vers num="3.6.18"/>
        <vers num="3.6.19"/>
        <vers num="3.6.2"/>
        <vers num="3.6.20"/>
        <vers num="3.6.21"/>
        <vers num="3.6.22"/>
        <vers num="3.6.23"/>
        <vers num="3.6.24"/>
        <vers num="3.6.25"/>
        <vers num="3.6.26"/>
        <vers num="3.6.27"/>
        <vers num="3.6.28"/>
        <vers num="3.6.3"/>
        <vers num="3.6.4"/>
        <vers num="3.6.6"/>
        <vers num="3.6.7"/>
        <vers num="3.6.8"/>
        <vers num="3.6.9"/>
        <vers num="4.0" edition="beta1"/>
        <vers num="4.0" edition="beta10"/>
        <vers num="4.0" edition="beta11"/>
        <vers num="4.0" edition="beta12"/>
        <vers num="4.0" edition="beta2"/>
        <vers num="4.0" edition="beta3"/>
        <vers num="4.0" edition="beta4"/>
        <vers num="4.0" edition="beta5"/>
        <vers num="4.0" edition="beta6"/>
        <vers num="4.0" edition="beta7"/>
        <vers num="4.0" edition="beta8"/>
        <vers num="4.0" edition="beta9"/>
        <vers num="4.0.1"/>
        <vers num="5.0"/>
        <vers num="5.0.1"/>
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers num="6.0.2"/>
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="8.0"/>
        <vers num="8.0.1"/>
        <vers num="9.0"/>
        <vers num="9.0.1"/>
      </prod>
      <prod vendor="mozilla" name="seamonkey">
        <vers num="2.0" edition="alpha_1"/>
        <vers num="2.0" edition="alpha_2"/>
        <vers num="2.0" edition="alpha_3"/>
        <vers num="2.0" edition="beta_1"/>
        <vers num="2.0" edition="beta_2"/>
        <vers num="2.0" edition="rc1"/>
        <vers num="2.0" edition="rc2"/>
        <vers num="2.0.1"/>
        <vers num="2.0.10"/>
        <vers num="2.0.11"/>
        <vers num="2.0.12"/>
        <vers num="2.0.13"/>
        <vers num="2.0.14"/>
        <vers num="2.0.2"/>
        <vers num="2.0.3"/>
        <vers num="2.0.4"/>
        <vers num="2.0.5"/>
        <vers num="2.0.6"/>
        <vers num="2.0.7"/>
        <vers num="2.0.8"/>
        <vers num="2.0.9"/>
        <vers num="2.1" edition="alpha1"/>
        <vers num="2.1" edition="alpha2"/>
        <vers num="2.1" edition="alpha3"/>
        <vers num="2.1" edition="beta1"/>
        <vers num="2.1" edition="beta2"/>
        <vers num="2.1" edition="beta3"/>
        <vers num="2.1" edition="rc1"/>
        <vers num="2.1" edition="rc2"/>
        <vers num="2.10" edition="beta1"/>
        <vers num="2.10" edition="beta2"/>
        <vers num="2.10" edition="beta3"/>
        <vers num="2.10.1"/>
        <vers num="2.11" edition="beta1"/>
        <vers num="2.11" edition="beta2"/>
        <vers num="2.11" edition="beta3"/>
        <vers num="2.11" edition="beta4"/>
        <vers num="2.11" edition="beta5"/>
        <vers num="2.11" edition="beta6"/>
        <vers num="2.12" edition="beta1"/>
        <vers num="2.12" edition="beta2"/>
        <vers num="2.12" edition="beta3"/>
        <vers num="2.12" edition="beta4"/>
        <vers num="2.12" edition="beta5"/>
        <vers num="2.12" edition="beta6"/>
        <vers num="2.12.1"/>
        <vers num="2.13" edition="beta1"/>
        <vers num="2.13" edition="beta2"/>
        <vers num="2.13" edition="beta3"/>
        <vers num="2.13" edition="beta4"/>
        <vers num="2.13" edition="beta5"/>
        <vers num="2.13" edition="beta6"/>
        <vers num="2.13.1"/>
        <vers num="2.13.2"/>
        <vers num="2.14" edition="beta1"/>
        <vers num="2.14" edition="beta2"/>
        <vers num="2.14" edition="beta3"/>
        <vers num="2.14" edition="beta4"/>
        <vers num="2.14" edition="beta5"/>
        <vers num="2.15" edition="beta1"/>
        <vers num="2.15" edition="beta2"/>
        <vers num="2.15" edition="beta3"/>
        <vers num="2.15" edition="beta4"/>
        <vers num="2.15" edition="beta5"/>
        <vers num="2.15" edition="beta6"/>
        <vers num="2.15.1"/>
        <vers num="2.15.2"/>
        <vers num="2.16" edition="beta1"/>
        <vers num="2.16" edition="beta2"/>
        <vers num="2.16" edition="beta3"/>
        <vers num="2.16" edition="beta4"/>
        <vers num="2.16" edition="beta5"/>
        <vers num="2.16.1"/>
        <vers num="2.16.2"/>
        <vers num="2.17" edition="beta1"/>
        <vers num="2.17" edition="beta2"/>
        <vers num="2.17" edition="beta3"/>
        <vers num="2.17" edition="beta4"/>
        <vers num="2.17.1"/>
        <vers num="2.18" edition="beta1"/>
        <vers num="2.18" edition="beta2"/>
        <vers num="2.18" edition="beta3"/>
        <vers num="2.18" edition="beta4"/>
        <vers num="2.19" edition="beta1"/>
        <vers num="2.19" edition="beta2"/>
        <vers num="2.2" edition="beta1"/>
        <vers num="2.2" edition="beta2"/>
        <vers num="2.2" edition="beta3"/>
        <vers num="2.20" edition="beta1"/>
        <vers num="2.20" edition="beta2"/>
        <vers num="2.20" edition="beta3"/>
        <vers num="2.21" edition="beta1"/>
        <vers num="2.21" edition="beta2"/>
        <vers num="2.22" edition="beta1"/>
        <vers num="2.22" edition="beta2"/>
        <vers num="2.22.1"/>
        <vers num="2.23" edition="beta1"/>
        <vers num="2.23" edition="beta2"/>
        <vers prev="1" num="2.24" edition="beta1"/>
        <vers num="2.3" edition="beta1"/>
        <vers num="2.3" edition="beta2"/>
        <vers num="2.3" edition="beta3"/>
        <vers num="2.3.1"/>
        <vers num="2.3.2"/>
        <vers num="2.3.3"/>
        <vers num="2.4" edition="beta1"/>
        <vers num="2.4" edition="beta2"/>
        <vers num="2.4" edition="beta3"/>
        <vers num="2.4.1"/>
        <vers num="2.5" edition="beta1"/>
        <vers num="2.5" edition="beta2"/>
        <vers num="2.5" edition="beta3"/>
        <vers num="2.5" edition="beta4"/>
        <vers num="2.6" edition="beta1"/>
        <vers num="2.6" edition="beta2"/>
        <vers num="2.6" edition="beta3"/>
        <vers num="2.6" edition="beta4"/>
        <vers num="2.6.1"/>
        <vers num="2.7" edition="beta1"/>
        <vers num="2.7" edition="beta2"/>
        <vers num="2.7" edition="beta3"/>
        <vers num="2.7" edition="beta4"/>
        <vers num="2.7" edition="beta5"/>
        <vers num="2.7.1"/>
        <vers num="2.7.2"/>
        <vers num="2.8" edition="beta1"/>
        <vers num="2.8" edition="beta2"/>
        <vers num="2.8" edition="beta3"/>
        <vers num="2.8" edition="beta4"/>
        <vers num="2.8" edition="beta5"/>
        <vers num="2.8" edition="beta6"/>
        <vers num="2.9" edition="beta1"/>
        <vers num="2.9" edition="beta2"/>
        <vers num="2.9" edition="beta3"/>
        <vers num="2.9" edition="beta4"/>
        <vers num="2.9.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1479" published="2014-02-06" name="CVE-2014-1479" modified="2014-04-01" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:P/A:N)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">The System Only Wrapper (SOW) implementation in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 does not prevent certain cloning operations, which allows remote attackers to bypass intended restrictions on XUL content via vectors involving XBL content scopes.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=911864" source="CONFIRM" adv="1">https://bugzilla.mozilla.org/show_bug.cgi?id=911864</ref>
      <ref url="https://8pecxstudios.com/?page_id=44080" source="CONFIRM">https://8pecxstudios.com/?page_id=44080</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2119-1" source="UBUNTU">USN-2119-1</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2102-2" source="UBUNTU">USN-2102-2</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2102-1" source="UBUNTU">USN-2102-1</ref>
      <ref url="http://www.mozilla.org/security/announce/2014/mfsa2014-02.html" source="CONFIRM" adv="1">http://www.mozilla.org/security/announce/2014/mfsa2014-02.html</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2858" source="DEBIAN">DSA-2858</ref>
      <ref url="http://secunia.com/advisories/56706" source="SECUNIA">56706</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0133.html" source="REDHAT">RHSA-2014:0133</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0132.html" source="REDHAT">RHSA-2014:0132</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.html" source="SUSE">openSUSE-SU-2014:0419</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00010.html" source="SUSE">SUSE-SU-2014:0248</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00005.html" source="SUSE">openSUSE-SU-2014:0213</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00004.html" source="SUSE">openSUSE-SU-2014:0212</ref>
      <ref url="http://lists.fedoraproject.org/pipermail/package-announce/2014-February/129218.html" source="FEDORA">FEDORA-2014-2083</ref>
      <ref url="http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127966.html" source="FEDORA">FEDORA-2014-2041</ref>
    </refs>
    <vuln_soft>
      <prod vendor="mozilla" name="firefox">
        <vers num="0.1"/>
        <vers num="0.10"/>
        <vers num="0.10.1"/>
        <vers num="0.2"/>
        <vers num="0.3"/>
        <vers num="0.4"/>
        <vers num="0.5"/>
        <vers num="0.6"/>
        <vers num="0.6.1"/>
        <vers num="0.7"/>
        <vers num="0.7.1"/>
        <vers num="0.8"/>
        <vers num="0.9" edition="rc"/>
        <vers num="0.9.1"/>
        <vers num="0.9.2"/>
        <vers num="0.9.3"/>
        <vers num="1.0" edition="preview_release"/>
        <vers num="1.0.1"/>
        <vers num="1.0.2"/>
        <vers num="1.0.3"/>
        <vers num="1.0.4"/>
        <vers num="1.0.5"/>
        <vers num="1.0.6"/>
        <vers num="1.0.7"/>
        <vers num="1.0.8"/>
        <vers num="1.5" edition="beta1"/>
        <vers num="1.5" edition="beta2"/>
        <vers num="1.5.0.1"/>
        <vers num="1.5.0.10"/>
        <vers num="1.5.0.11"/>
        <vers num="1.5.0.12"/>
        <vers num="1.5.0.2"/>
        <vers num="1.5.0.3"/>
        <vers num="1.5.0.4"/>
        <vers num="1.5.0.5"/>
        <vers num="1.5.0.6"/>
        <vers num="1.5.0.7"/>
        <vers num="1.5.0.8"/>
        <vers num="1.5.0.9"/>
        <vers num="1.5.1"/>
        <vers num="1.5.2"/>
        <vers num="1.5.3"/>
        <vers num="1.5.4"/>
        <vers num="1.5.5"/>
        <vers num="1.5.6"/>
        <vers num="1.5.7"/>
        <vers num="1.5.8"/>
        <vers num="10.0"/>
        <vers num="10.0.1"/>
        <vers num="10.0.10"/>
        <vers num="10.0.11"/>
        <vers num="10.0.12"/>
        <vers num="10.0.2"/>
        <vers num="10.0.3"/>
        <vers num="10.0.4"/>
        <vers num="10.0.5"/>
        <vers num="10.0.6"/>
        <vers num="10.0.7"/>
        <vers num="10.0.8"/>
        <vers num="10.0.9"/>
        <vers num="11.0"/>
        <vers num="12.0" edition="beta6"/>
        <vers num="13.0"/>
        <vers num="13.0.1"/>
        <vers num="14.0"/>
        <vers num="14.0.1"/>
        <vers num="15.0"/>
        <vers num="15.0.1"/>
        <vers num="16.0"/>
        <vers num="16.0.1"/>
        <vers num="16.0.2"/>
        <vers num="17.0.10"/>
        <vers num="17.0.11"/>
        <vers num="17.0.2"/>
        <vers num="17.0.3"/>
        <vers num="17.0.4"/>
        <vers num="17.0.5"/>
        <vers num="17.0.6"/>
        <vers num="17.0.7"/>
        <vers num="17.0.8"/>
        <vers num="17.0.9"/>
        <vers num="18.0"/>
        <vers num="18.0.1"/>
        <vers num="18.0.2"/>
        <vers num="19.0"/>
        <vers num="19.0.1"/>
        <vers num="19.0.2"/>
        <vers num="2.0"/>
        <vers num="2.0.0.1"/>
        <vers num="2.0.0.10"/>
        <vers num="2.0.0.11"/>
        <vers num="2.0.0.12"/>
        <vers num="2.0.0.13"/>
        <vers num="2.0.0.14"/>
        <vers num="2.0.0.15"/>
        <vers num="2.0.0.16"/>
        <vers num="2.0.0.17"/>
        <vers num="2.0.0.18"/>
        <vers num="2.0.0.19"/>
        <vers num="2.0.0.2"/>
        <vers num="2.0.0.20"/>
        <vers num="2.0.0.3"/>
        <vers num="2.0.0.4"/>
        <vers num="2.0.0.5"/>
        <vers num="2.0.0.6"/>
        <vers num="2.0.0.7"/>
        <vers num="2.0.0.8"/>
        <vers num="2.0.0.9"/>
        <vers num="20.0"/>
        <vers num="20.0.1"/>
        <vers num="21.0"/>
        <vers num="23.0"/>
        <vers num="23.0.1"/>
        <vers num="24.0"/>
        <vers num="24.1"/>
        <vers num="24.1.1"/>
        <vers num="25.0"/>
        <vers num="25.0.1"/>
        <vers prev="1" num="26.0"/>
        <vers num="3.0"/>
        <vers num="3.0.1"/>
        <vers num="3.0.10"/>
        <vers num="3.0.11"/>
        <vers num="3.0.12"/>
        <vers num="3.0.13"/>
        <vers num="3.0.14"/>
        <vers num="3.0.15"/>
        <vers num="3.0.16"/>
        <vers num="3.0.17"/>
        <vers num="3.0.18"/>
        <vers num="3.0.19"/>
        <vers num="3.0.2"/>
        <vers num="3.0.3"/>
        <vers num="3.0.4"/>
        <vers num="3.0.5"/>
        <vers num="3.0.6"/>
        <vers num="3.0.7"/>
        <vers num="3.0.8"/>
        <vers num="3.0.9"/>
        <vers num="3.5"/>
        <vers num="3.5.1"/>
        <vers num="3.5.10"/>
        <vers num="3.5.11"/>
        <vers num="3.5.12"/>
        <vers num="3.5.13"/>
        <vers num="3.5.14"/>
        <vers num="3.5.15"/>
        <vers num="3.5.16"/>
        <vers num="3.5.17"/>
        <vers num="3.5.18"/>
        <vers num="3.5.19"/>
        <vers num="3.5.2"/>
        <vers num="3.5.3"/>
        <vers num="3.5.4"/>
        <vers num="3.5.5"/>
        <vers num="3.5.6"/>
        <vers num="3.5.7"/>
        <vers num="3.5.8"/>
        <vers num="3.5.9"/>
        <vers num="3.6"/>
        <vers num="3.6.10"/>
        <vers num="3.6.11"/>
        <vers num="3.6.12"/>
        <vers num="3.6.13"/>
        <vers num="3.6.14"/>
        <vers num="3.6.15"/>
        <vers num="3.6.16"/>
        <vers num="3.6.17"/>
        <vers num="3.6.18"/>
        <vers num="3.6.19"/>
        <vers num="3.6.2"/>
        <vers num="3.6.20"/>
        <vers num="3.6.21"/>
        <vers num="3.6.22"/>
        <vers num="3.6.23"/>
        <vers num="3.6.24"/>
        <vers num="3.6.25"/>
        <vers num="3.6.26"/>
        <vers num="3.6.27"/>
        <vers num="3.6.28"/>
        <vers num="3.6.3"/>
        <vers num="3.6.4"/>
        <vers num="3.6.6"/>
        <vers num="3.6.7"/>
        <vers num="3.6.8"/>
        <vers num="3.6.9"/>
        <vers num="4.0" edition="beta1"/>
        <vers num="4.0" edition="beta10"/>
        <vers num="4.0" edition="beta11"/>
        <vers num="4.0" edition="beta12"/>
        <vers num="4.0" edition="beta2"/>
        <vers num="4.0" edition="beta3"/>
        <vers num="4.0" edition="beta4"/>
        <vers num="4.0" edition="beta5"/>
        <vers num="4.0" edition="beta6"/>
        <vers num="4.0" edition="beta7"/>
        <vers num="4.0" edition="beta8"/>
        <vers num="4.0" edition="beta9"/>
        <vers num="4.0.1"/>
        <vers num="5.0"/>
        <vers num="5.0.1"/>
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers num="6.0.2"/>
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="8.0"/>
        <vers num="8.0.1"/>
        <vers num="9.0"/>
        <vers num="9.0.1"/>
      </prod>
      <prod vendor="mozilla" name="firefox_esr">
        <vers num="24.0"/>
        <vers num="24.0.1"/>
        <vers num="24.0.2"/>
        <vers num="24.1.0"/>
        <vers num="24.1.1"/>
        <vers num="24.2"/>
      </prod>
      <prod vendor="mozilla" name="seamonkey">
        <vers num="2.0" edition="alpha_1"/>
        <vers num="2.0" edition="alpha_2"/>
        <vers num="2.0" edition="alpha_3"/>
        <vers num="2.0" edition="beta_1"/>
        <vers num="2.0" edition="beta_2"/>
        <vers num="2.0" edition="rc1"/>
        <vers num="2.0" edition="rc2"/>
        <vers num="2.0.1"/>
        <vers num="2.0.10"/>
        <vers num="2.0.11"/>
        <vers num="2.0.12"/>
        <vers num="2.0.13"/>
        <vers num="2.0.14"/>
        <vers num="2.0.2"/>
        <vers num="2.0.3"/>
        <vers num="2.0.4"/>
        <vers num="2.0.5"/>
        <vers num="2.0.6"/>
        <vers num="2.0.7"/>
        <vers num="2.0.8"/>
        <vers num="2.0.9"/>
        <vers num="2.1" edition="alpha1"/>
        <vers num="2.1" edition="alpha2"/>
        <vers num="2.1" edition="alpha3"/>
        <vers num="2.1" edition="beta1"/>
        <vers num="2.1" edition="beta2"/>
        <vers num="2.1" edition="beta3"/>
        <vers num="2.1" edition="rc1"/>
        <vers num="2.1" edition="rc2"/>
        <vers num="2.10" edition="beta1"/>
        <vers num="2.10" edition="beta2"/>
        <vers num="2.10" edition="beta3"/>
        <vers num="2.10.1"/>
        <vers num="2.11" edition="beta1"/>
        <vers num="2.11" edition="beta2"/>
        <vers num="2.11" edition="beta3"/>
        <vers num="2.11" edition="beta4"/>
        <vers num="2.11" edition="beta5"/>
        <vers num="2.11" edition="beta6"/>
        <vers num="2.12" edition="beta1"/>
        <vers num="2.12" edition="beta2"/>
        <vers num="2.12" edition="beta3"/>
        <vers num="2.12" edition="beta4"/>
        <vers num="2.12" edition="beta5"/>
        <vers num="2.12" edition="beta6"/>
        <vers num="2.12.1"/>
        <vers num="2.13" edition="beta1"/>
        <vers num="2.13" edition="beta2"/>
        <vers num="2.13" edition="beta3"/>
        <vers num="2.13" edition="beta4"/>
        <vers num="2.13" edition="beta5"/>
        <vers num="2.13" edition="beta6"/>
        <vers num="2.13.1"/>
        <vers num="2.13.2"/>
        <vers num="2.14" edition="beta1"/>
        <vers num="2.14" edition="beta2"/>
        <vers num="2.14" edition="beta3"/>
        <vers num="2.14" edition="beta4"/>
        <vers num="2.14" edition="beta5"/>
        <vers num="2.15" edition="beta1"/>
        <vers num="2.15" edition="beta2"/>
        <vers num="2.15" edition="beta3"/>
        <vers num="2.15" edition="beta4"/>
        <vers num="2.15" edition="beta5"/>
        <vers num="2.15" edition="beta6"/>
        <vers num="2.15.1"/>
        <vers num="2.15.2"/>
        <vers num="2.16" edition="beta1"/>
        <vers num="2.16" edition="beta2"/>
        <vers num="2.16" edition="beta3"/>
        <vers num="2.16" edition="beta4"/>
        <vers num="2.16" edition="beta5"/>
        <vers num="2.16.1"/>
        <vers num="2.16.2"/>
        <vers num="2.17" edition="beta1"/>
        <vers num="2.17" edition="beta2"/>
        <vers num="2.17" edition="beta3"/>
        <vers num="2.17" edition="beta4"/>
        <vers num="2.17.1"/>
        <vers num="2.18" edition="beta1"/>
        <vers num="2.18" edition="beta2"/>
        <vers num="2.18" edition="beta3"/>
        <vers num="2.18" edition="beta4"/>
        <vers num="2.19" edition="beta1"/>
        <vers num="2.19" edition="beta2"/>
        <vers num="2.2" edition="beta1"/>
        <vers num="2.2" edition="beta2"/>
        <vers num="2.2" edition="beta3"/>
        <vers num="2.20" edition="beta1"/>
        <vers num="2.20" edition="beta2"/>
        <vers num="2.20" edition="beta3"/>
        <vers num="2.21" edition="beta1"/>
        <vers num="2.21" edition="beta2"/>
        <vers num="2.22" edition="beta1"/>
        <vers num="2.22" edition="beta2"/>
        <vers num="2.22.1"/>
        <vers num="2.23" edition="beta1"/>
        <vers num="2.23" edition="beta2"/>
        <vers prev="1" num="2.24" edition="beta1"/>
        <vers num="2.3" edition="beta1"/>
        <vers num="2.3" edition="beta2"/>
        <vers num="2.3" edition="beta3"/>
        <vers num="2.3.1"/>
        <vers num="2.3.2"/>
        <vers num="2.3.3"/>
        <vers num="2.4" edition="beta1"/>
        <vers num="2.4" edition="beta2"/>
        <vers num="2.4" edition="beta3"/>
        <vers num="2.4.1"/>
        <vers num="2.5" edition="beta1"/>
        <vers num="2.5" edition="beta2"/>
        <vers num="2.5" edition="beta3"/>
        <vers num="2.5" edition="beta4"/>
        <vers num="2.6" edition="beta1"/>
        <vers num="2.6" edition="beta2"/>
        <vers num="2.6" edition="beta3"/>
        <vers num="2.6" edition="beta4"/>
        <vers num="2.6.1"/>
        <vers num="2.7" edition="beta1"/>
        <vers num="2.7" edition="beta2"/>
        <vers num="2.7" edition="beta3"/>
        <vers num="2.7" edition="beta4"/>
        <vers num="2.7" edition="beta5"/>
        <vers num="2.7.1"/>
        <vers num="2.7.2"/>
        <vers num="2.8" edition="beta1"/>
        <vers num="2.8" edition="beta2"/>
        <vers num="2.8" edition="beta3"/>
        <vers num="2.8" edition="beta4"/>
        <vers num="2.8" edition="beta5"/>
        <vers num="2.8" edition="beta6"/>
        <vers num="2.9" edition="beta1"/>
        <vers num="2.9" edition="beta2"/>
        <vers num="2.9" edition="beta3"/>
        <vers num="2.9" edition="beta4"/>
        <vers num="2.9.1"/>
      </prod>
      <prod vendor="mozilla" name="thunderbird">
        <vers num="0.1"/>
        <vers num="0.2"/>
        <vers num="0.3"/>
        <vers num="0.4"/>
        <vers num="0.5"/>
        <vers num="0.6"/>
        <vers num="0.7"/>
        <vers num="0.7.1"/>
        <vers num="0.7.2"/>
        <vers num="0.7.3"/>
        <vers num="0.8"/>
        <vers num="0.9"/>
        <vers num="1.0"/>
        <vers num="1.0.1"/>
        <vers num="1.0.2"/>
        <vers num="1.0.3"/>
        <vers num="1.0.4"/>
        <vers num="1.0.5" edition="beta"/>
        <vers num="1.0.6"/>
        <vers num="1.0.7"/>
        <vers num="1.0.8"/>
        <vers num="1.5" edition="beta2"/>
        <vers num="1.5.0.1"/>
        <vers num="1.5.0.10"/>
        <vers num="1.5.0.11"/>
        <vers num="1.5.0.12"/>
        <vers num="1.5.0.13"/>
        <vers num="1.5.0.14"/>
        <vers num="1.5.0.2"/>
        <vers num="1.5.0.3"/>
        <vers num="1.5.0.4"/>
        <vers num="1.5.0.5"/>
        <vers num="1.5.0.6"/>
        <vers num="1.5.0.7"/>
        <vers num="1.5.0.8"/>
        <vers num="1.5.0.9"/>
        <vers num="1.5.1"/>
        <vers num="1.5.2"/>
        <vers num="1.7.1"/>
        <vers num="1.7.3"/>
        <vers num="10.0"/>
        <vers num="10.0.1"/>
        <vers num="10.0.2"/>
        <vers num="10.0.3"/>
        <vers num="10.0.4"/>
        <vers num="11.0"/>
        <vers num="11.0.1"/>
        <vers num="12.0"/>
        <vers num="12.0.1"/>
        <vers num="13.0"/>
        <vers num="13.0.1"/>
        <vers num="14.0"/>
        <vers num="15.0"/>
        <vers num="15.0.1"/>
        <vers num="16.0"/>
        <vers num="16.0.1"/>
        <vers num="16.0.2"/>
        <vers num="17.0"/>
        <vers num="17.0.1"/>
        <vers num="17.0.2"/>
        <vers num="17.0.3"/>
        <vers num="17.0.4"/>
        <vers num="17.0.5"/>
        <vers num="17.0.6"/>
        <vers num="17.0.7"/>
        <vers num="17.0.8"/>
        <vers num="2.0"/>
        <vers num="2.0.0.0"/>
        <vers num="2.0.0.1"/>
        <vers num="2.0.0.11"/>
        <vers num="2.0.0.12"/>
        <vers num="2.0.0.13"/>
        <vers num="2.0.0.14"/>
        <vers num="2.0.0.15"/>
        <vers num="2.0.0.16"/>
        <vers num="2.0.0.17"/>
        <vers num="2.0.0.18"/>
        <vers num="2.0.0.19"/>
        <vers num="2.0.0.2"/>
        <vers num="2.0.0.20"/>
        <vers num="2.0.0.21"/>
        <vers num="2.0.0.22"/>
        <vers num="2.0.0.23"/>
        <vers num="2.0.0.3"/>
        <vers num="2.0.0.4"/>
        <vers num="2.0.0.5"/>
        <vers num="2.0.0.6"/>
        <vers num="2.0.0.7"/>
        <vers num="2.0.0.8"/>
        <vers num="2.0.0.9"/>
        <vers num="24.0"/>
        <vers num="24.0.1"/>
        <vers num="24.1"/>
        <vers num="24.1.1"/>
        <vers prev="1" num="24.2"/>
        <vers num="3.0"/>
        <vers num="3.0.1"/>
        <vers num="3.0.10"/>
        <vers num="3.0.11"/>
        <vers num="3.0.2"/>
        <vers num="3.0.3"/>
        <vers num="3.0.4"/>
        <vers num="3.0.5"/>
        <vers num="3.0.6"/>
        <vers num="3.0.7"/>
        <vers num="3.0.8"/>
        <vers num="3.0.9"/>
        <vers num="3.1"/>
        <vers num="3.1.1"/>
        <vers num="3.1.10"/>
        <vers num="3.1.11"/>
        <vers num="3.1.12"/>
        <vers num="3.1.13"/>
        <vers num="3.1.14"/>
        <vers num="3.1.15"/>
        <vers num="3.1.16"/>
        <vers num="3.1.17"/>
        <vers num="3.1.2"/>
        <vers num="3.1.3"/>
        <vers num="3.1.4"/>
        <vers num="3.1.5"/>
        <vers num="3.1.6"/>
        <vers num="3.1.7"/>
        <vers num="3.1.8"/>
        <vers num="3.1.9"/>
        <vers num="5.0"/>
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers num="6.0.2"/>
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="8.0"/>
        <vers num="9.0"/>
        <vers num="9.0.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1480" published="2014-02-06" name="CVE-2014-1480" modified="2014-04-01" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">The file-download implementation in Mozilla Firefox before 27.0 and SeaMonkey before 2.24 does not properly restrict the timing of button selections, which allows remote attackers to conduct clickjacking attacks, and trigger unintended launching of a downloaded file, via a crafted web site.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=916726" source="CONFIRM" adv="1">https://bugzilla.mozilla.org/show_bug.cgi?id=916726</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2102-2" source="UBUNTU">USN-2102-2</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2102-1" source="UBUNTU">USN-2102-1</ref>
      <ref url="http://www.mozilla.org/security/announce/2014/mfsa2014-03.html" source="CONFIRM" adv="1">http://www.mozilla.org/security/announce/2014/mfsa2014-03.html</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.html" source="SUSE">openSUSE-SU-2014:0419</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00010.html" source="SUSE">SUSE-SU-2014:0248</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00004.html" source="SUSE">openSUSE-SU-2014:0212</ref>
    </refs>
    <vuln_soft>
      <prod vendor="mozilla" name="firefox">
        <vers num="0.1"/>
        <vers num="0.10"/>
        <vers num="0.10.1"/>
        <vers num="0.2"/>
        <vers num="0.3"/>
        <vers num="0.4"/>
        <vers num="0.5"/>
        <vers num="0.6"/>
        <vers num="0.6.1"/>
        <vers num="0.7"/>
        <vers num="0.7.1"/>
        <vers num="0.8"/>
        <vers num="0.9" edition="rc"/>
        <vers num="0.9.1"/>
        <vers num="0.9.2"/>
        <vers num="0.9.3"/>
        <vers num="1.0" edition="preview_release"/>
        <vers num="1.0.1"/>
        <vers num="1.0.2"/>
        <vers num="1.0.3"/>
        <vers num="1.0.4"/>
        <vers num="1.0.5"/>
        <vers num="1.0.6"/>
        <vers num="1.0.7"/>
        <vers num="1.0.8"/>
        <vers num="1.5" edition="beta1"/>
        <vers num="1.5" edition="beta2"/>
        <vers num="1.5.0.1"/>
        <vers num="1.5.0.10"/>
        <vers num="1.5.0.11"/>
        <vers num="1.5.0.12"/>
        <vers num="1.5.0.2"/>
        <vers num="1.5.0.3"/>
        <vers num="1.5.0.4"/>
        <vers num="1.5.0.5"/>
        <vers num="1.5.0.6"/>
        <vers num="1.5.0.7"/>
        <vers num="1.5.0.8"/>
        <vers num="1.5.0.9"/>
        <vers num="1.5.1"/>
        <vers num="1.5.2"/>
        <vers num="1.5.3"/>
        <vers num="1.5.4"/>
        <vers num="1.5.5"/>
        <vers num="1.5.6"/>
        <vers num="1.5.7"/>
        <vers num="1.5.8"/>
        <vers num="10.0"/>
        <vers num="10.0.1"/>
        <vers num="10.0.10"/>
        <vers num="10.0.11"/>
        <vers num="10.0.12"/>
        <vers num="10.0.2"/>
        <vers num="10.0.3"/>
        <vers num="10.0.4"/>
        <vers num="10.0.5"/>
        <vers num="10.0.6"/>
        <vers num="10.0.7"/>
        <vers num="10.0.8"/>
        <vers num="10.0.9"/>
        <vers num="11.0"/>
        <vers num="12.0" edition="beta6"/>
        <vers num="13.0"/>
        <vers num="13.0.1"/>
        <vers num="14.0"/>
        <vers num="14.0.1"/>
        <vers num="15.0"/>
        <vers num="15.0.1"/>
        <vers num="16.0"/>
        <vers num="16.0.1"/>
        <vers num="16.0.2"/>
        <vers num="17.0.10"/>
        <vers num="17.0.11"/>
        <vers num="17.0.2"/>
        <vers num="17.0.3"/>
        <vers num="17.0.4"/>
        <vers num="17.0.5"/>
        <vers num="17.0.6"/>
        <vers num="17.0.7"/>
        <vers num="17.0.8"/>
        <vers num="17.0.9"/>
        <vers num="18.0"/>
        <vers num="18.0.1"/>
        <vers num="18.0.2"/>
        <vers num="19.0"/>
        <vers num="19.0.1"/>
        <vers num="19.0.2"/>
        <vers num="2.0"/>
        <vers num="2.0.0.1"/>
        <vers num="2.0.0.10"/>
        <vers num="2.0.0.11"/>
        <vers num="2.0.0.12"/>
        <vers num="2.0.0.13"/>
        <vers num="2.0.0.14"/>
        <vers num="2.0.0.15"/>
        <vers num="2.0.0.16"/>
        <vers num="2.0.0.17"/>
        <vers num="2.0.0.18"/>
        <vers num="2.0.0.19"/>
        <vers num="2.0.0.2"/>
        <vers num="2.0.0.20"/>
        <vers num="2.0.0.3"/>
        <vers num="2.0.0.4"/>
        <vers num="2.0.0.5"/>
        <vers num="2.0.0.6"/>
        <vers num="2.0.0.7"/>
        <vers num="2.0.0.8"/>
        <vers num="2.0.0.9"/>
        <vers num="20.0"/>
        <vers num="20.0.1"/>
        <vers num="21.0"/>
        <vers num="23.0"/>
        <vers num="23.0.1"/>
        <vers num="24.0"/>
        <vers num="24.1"/>
        <vers num="24.1.1"/>
        <vers num="25.0"/>
        <vers num="25.0.1"/>
        <vers prev="1" num="26.0"/>
        <vers num="3.0"/>
        <vers num="3.0.1"/>
        <vers num="3.0.10"/>
        <vers num="3.0.11"/>
        <vers num="3.0.12"/>
        <vers num="3.0.13"/>
        <vers num="3.0.14"/>
        <vers num="3.0.15"/>
        <vers num="3.0.16"/>
        <vers num="3.0.17"/>
        <vers num="3.0.18"/>
        <vers num="3.0.19"/>
        <vers num="3.0.2"/>
        <vers num="3.0.3"/>
        <vers num="3.0.4"/>
        <vers num="3.0.5"/>
        <vers num="3.0.6"/>
        <vers num="3.0.7"/>
        <vers num="3.0.8"/>
        <vers num="3.0.9"/>
        <vers num="3.5"/>
        <vers num="3.5.1"/>
        <vers num="3.5.10"/>
        <vers num="3.5.11"/>
        <vers num="3.5.12"/>
        <vers num="3.5.13"/>
        <vers num="3.5.14"/>
        <vers num="3.5.15"/>
        <vers num="3.5.16"/>
        <vers num="3.5.17"/>
        <vers num="3.5.18"/>
        <vers num="3.5.19"/>
        <vers num="3.5.2"/>
        <vers num="3.5.3"/>
        <vers num="3.5.4"/>
        <vers num="3.5.5"/>
        <vers num="3.5.6"/>
        <vers num="3.5.7"/>
        <vers num="3.5.8"/>
        <vers num="3.5.9"/>
        <vers num="3.6"/>
        <vers num="3.6.10"/>
        <vers num="3.6.11"/>
        <vers num="3.6.12"/>
        <vers num="3.6.13"/>
        <vers num="3.6.14"/>
        <vers num="3.6.15"/>
        <vers num="3.6.16"/>
        <vers num="3.6.17"/>
        <vers num="3.6.18"/>
        <vers num="3.6.19"/>
        <vers num="3.6.2"/>
        <vers num="3.6.20"/>
        <vers num="3.6.21"/>
        <vers num="3.6.22"/>
        <vers num="3.6.23"/>
        <vers num="3.6.24"/>
        <vers num="3.6.25"/>
        <vers num="3.6.26"/>
        <vers num="3.6.27"/>
        <vers num="3.6.28"/>
        <vers num="3.6.3"/>
        <vers num="3.6.4"/>
        <vers num="3.6.6"/>
        <vers num="3.6.7"/>
        <vers num="3.6.8"/>
        <vers num="3.6.9"/>
        <vers num="4.0" edition="beta1"/>
        <vers num="4.0" edition="beta10"/>
        <vers num="4.0" edition="beta11"/>
        <vers num="4.0" edition="beta12"/>
        <vers num="4.0" edition="beta2"/>
        <vers num="4.0" edition="beta3"/>
        <vers num="4.0" edition="beta4"/>
        <vers num="4.0" edition="beta5"/>
        <vers num="4.0" edition="beta6"/>
        <vers num="4.0" edition="beta7"/>
        <vers num="4.0" edition="beta8"/>
        <vers num="4.0" edition="beta9"/>
        <vers num="4.0.1"/>
        <vers num="5.0"/>
        <vers num="5.0.1"/>
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers num="6.0.2"/>
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="8.0"/>
        <vers num="8.0.1"/>
        <vers num="9.0"/>
        <vers num="9.0.1"/>
      </prod>
      <prod vendor="mozilla" name="seamonkey">
        <vers num="2.0" edition="alpha_1"/>
        <vers num="2.0" edition="alpha_2"/>
        <vers num="2.0" edition="alpha_3"/>
        <vers num="2.0" edition="beta_1"/>
        <vers num="2.0" edition="beta_2"/>
        <vers num="2.0" edition="rc1"/>
        <vers num="2.0" edition="rc2"/>
        <vers num="2.0.1"/>
        <vers num="2.0.10"/>
        <vers num="2.0.11"/>
        <vers num="2.0.12"/>
        <vers num="2.0.13"/>
        <vers num="2.0.14"/>
        <vers num="2.0.2"/>
        <vers num="2.0.3"/>
        <vers num="2.0.4"/>
        <vers num="2.0.5"/>
        <vers num="2.0.6"/>
        <vers num="2.0.7"/>
        <vers num="2.0.8"/>
        <vers num="2.0.9"/>
        <vers num="2.1" edition="alpha1"/>
        <vers num="2.1" edition="alpha2"/>
        <vers num="2.1" edition="alpha3"/>
        <vers num="2.1" edition="beta1"/>
        <vers num="2.1" edition="beta2"/>
        <vers num="2.1" edition="beta3"/>
        <vers num="2.1" edition="rc1"/>
        <vers num="2.1" edition="rc2"/>
        <vers num="2.10" edition="beta1"/>
        <vers num="2.10" edition="beta2"/>
        <vers num="2.10" edition="beta3"/>
        <vers num="2.10.1"/>
        <vers num="2.11" edition="beta1"/>
        <vers num="2.11" edition="beta2"/>
        <vers num="2.11" edition="beta3"/>
        <vers num="2.11" edition="beta4"/>
        <vers num="2.11" edition="beta5"/>
        <vers num="2.11" edition="beta6"/>
        <vers num="2.12" edition="beta1"/>
        <vers num="2.12" edition="beta2"/>
        <vers num="2.12" edition="beta3"/>
        <vers num="2.12" edition="beta4"/>
        <vers num="2.12" edition="beta5"/>
        <vers num="2.12" edition="beta6"/>
        <vers num="2.12.1"/>
        <vers num="2.13" edition="beta1"/>
        <vers num="2.13" edition="beta2"/>
        <vers num="2.13" edition="beta3"/>
        <vers num="2.13" edition="beta4"/>
        <vers num="2.13" edition="beta5"/>
        <vers num="2.13" edition="beta6"/>
        <vers num="2.13.1"/>
        <vers num="2.13.2"/>
        <vers num="2.14" edition="beta1"/>
        <vers num="2.14" edition="beta2"/>
        <vers num="2.14" edition="beta3"/>
        <vers num="2.14" edition="beta4"/>
        <vers num="2.14" edition="beta5"/>
        <vers num="2.15" edition="beta1"/>
        <vers num="2.15" edition="beta2"/>
        <vers num="2.15" edition="beta3"/>
        <vers num="2.15" edition="beta4"/>
        <vers num="2.15" edition="beta5"/>
        <vers num="2.15" edition="beta6"/>
        <vers num="2.15.1"/>
        <vers num="2.15.2"/>
        <vers num="2.16" edition="beta1"/>
        <vers num="2.16" edition="beta2"/>
        <vers num="2.16" edition="beta3"/>
        <vers num="2.16" edition="beta4"/>
        <vers num="2.16" edition="beta5"/>
        <vers num="2.16.1"/>
        <vers num="2.16.2"/>
        <vers num="2.17" edition="beta1"/>
        <vers num="2.17" edition="beta2"/>
        <vers num="2.17" edition="beta3"/>
        <vers num="2.17" edition="beta4"/>
        <vers num="2.17.1"/>
        <vers num="2.18" edition="beta1"/>
        <vers num="2.18" edition="beta2"/>
        <vers num="2.18" edition="beta3"/>
        <vers num="2.18" edition="beta4"/>
        <vers num="2.19" edition="beta1"/>
        <vers num="2.19" edition="beta2"/>
        <vers num="2.2" edition="beta1"/>
        <vers num="2.2" edition="beta2"/>
        <vers num="2.2" edition="beta3"/>
        <vers num="2.20" edition="beta1"/>
        <vers num="2.20" edition="beta2"/>
        <vers num="2.20" edition="beta3"/>
        <vers num="2.21" edition="beta1"/>
        <vers num="2.21" edition="beta2"/>
        <vers num="2.22" edition="beta1"/>
        <vers num="2.22" edition="beta2"/>
        <vers num="2.22.1"/>
        <vers num="2.23" edition="beta1"/>
        <vers num="2.23" edition="beta2"/>
        <vers prev="1" num="2.24" edition="beta1"/>
        <vers num="2.3" edition="beta1"/>
        <vers num="2.3" edition="beta2"/>
        <vers num="2.3" edition="beta3"/>
        <vers num="2.3.1"/>
        <vers num="2.3.2"/>
        <vers num="2.3.3"/>
        <vers num="2.4" edition="beta1"/>
        <vers num="2.4" edition="beta2"/>
        <vers num="2.4" edition="beta3"/>
        <vers num="2.4.1"/>
        <vers num="2.5" edition="beta1"/>
        <vers num="2.5" edition="beta2"/>
        <vers num="2.5" edition="beta3"/>
        <vers num="2.5" edition="beta4"/>
        <vers num="2.6" edition="beta1"/>
        <vers num="2.6" edition="beta2"/>
        <vers num="2.6" edition="beta3"/>
        <vers num="2.6" edition="beta4"/>
        <vers num="2.6.1"/>
        <vers num="2.7" edition="beta1"/>
        <vers num="2.7" edition="beta2"/>
        <vers num="2.7" edition="beta3"/>
        <vers num="2.7" edition="beta4"/>
        <vers num="2.7" edition="beta5"/>
        <vers num="2.7.1"/>
        <vers num="2.7.2"/>
        <vers num="2.8" edition="beta1"/>
        <vers num="2.8" edition="beta2"/>
        <vers num="2.8" edition="beta3"/>
        <vers num="2.8" edition="beta4"/>
        <vers num="2.8" edition="beta5"/>
        <vers num="2.8" edition="beta6"/>
        <vers num="2.9" edition="beta1"/>
        <vers num="2.9" edition="beta2"/>
        <vers num="2.9" edition="beta3"/>
        <vers num="2.9" edition="beta4"/>
        <vers num="2.9.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1481" published="2014-02-06" name="CVE-2014-1481" modified="2014-04-01" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:P/A:N)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 allow remote attackers to bypass intended restrictions on window objects by leveraging inconsistency in native getter methods across different JavaScript engines.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=936056" source="CONFIRM" adv="1">https://bugzilla.mozilla.org/show_bug.cgi?id=936056</ref>
      <ref url="https://8pecxstudios.com/?page_id=44080" source="CONFIRM">https://8pecxstudios.com/?page_id=44080</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2119-1" source="UBUNTU">USN-2119-1</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2102-2" source="UBUNTU">USN-2102-2</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2102-1" source="UBUNTU">USN-2102-1</ref>
      <ref url="http://www.mozilla.org/security/announce/2014/mfsa2014-13.html" source="CONFIRM" adv="1">http://www.mozilla.org/security/announce/2014/mfsa2014-13.html</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2858" source="DEBIAN">DSA-2858</ref>
      <ref url="http://secunia.com/advisories/56706" source="SECUNIA">56706</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0133.html" source="REDHAT">RHSA-2014:0133</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0132.html" source="REDHAT">RHSA-2014:0132</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.html" source="SUSE">openSUSE-SU-2014:0419</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00010.html" source="SUSE">SUSE-SU-2014:0248</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00005.html" source="SUSE">openSUSE-SU-2014:0213</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00004.html" source="SUSE">openSUSE-SU-2014:0212</ref>
      <ref url="http://lists.fedoraproject.org/pipermail/package-announce/2014-February/129218.html" source="FEDORA">FEDORA-2014-2083</ref>
      <ref url="http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127966.html" source="FEDORA">FEDORA-2014-2041</ref>
    </refs>
    <vuln_soft>
      <prod vendor="mozilla" name="firefox">
        <vers num="0.1"/>
        <vers num="0.10"/>
        <vers num="0.10.1"/>
        <vers num="0.2"/>
        <vers num="0.3"/>
        <vers num="0.4"/>
        <vers num="0.5"/>
        <vers num="0.6"/>
        <vers num="0.6.1"/>
        <vers num="0.7"/>
        <vers num="0.7.1"/>
        <vers num="0.8"/>
        <vers num="0.9" edition="rc"/>
        <vers num="0.9.1"/>
        <vers num="0.9.2"/>
        <vers num="0.9.3"/>
        <vers num="1.0" edition="preview_release"/>
        <vers num="1.0.1"/>
        <vers num="1.0.2"/>
        <vers num="1.0.3"/>
        <vers num="1.0.4"/>
        <vers num="1.0.5"/>
        <vers num="1.0.6"/>
        <vers num="1.0.7"/>
        <vers num="1.0.8"/>
        <vers num="1.5" edition="beta1"/>
        <vers num="1.5" edition="beta2"/>
        <vers num="1.5.0.1"/>
        <vers num="1.5.0.10"/>
        <vers num="1.5.0.11"/>
        <vers num="1.5.0.12"/>
        <vers num="1.5.0.2"/>
        <vers num="1.5.0.3"/>
        <vers num="1.5.0.4"/>
        <vers num="1.5.0.5"/>
        <vers num="1.5.0.6"/>
        <vers num="1.5.0.7"/>
        <vers num="1.5.0.8"/>
        <vers num="1.5.0.9"/>
        <vers num="1.5.1"/>
        <vers num="1.5.2"/>
        <vers num="1.5.3"/>
        <vers num="1.5.4"/>
        <vers num="1.5.5"/>
        <vers num="1.5.6"/>
        <vers num="1.5.7"/>
        <vers num="1.5.8"/>
        <vers num="10.0"/>
        <vers num="10.0.1"/>
        <vers num="10.0.10"/>
        <vers num="10.0.11"/>
        <vers num="10.0.12"/>
        <vers num="10.0.2"/>
        <vers num="10.0.3"/>
        <vers num="10.0.4"/>
        <vers num="10.0.5"/>
        <vers num="10.0.6"/>
        <vers num="10.0.7"/>
        <vers num="10.0.8"/>
        <vers num="10.0.9"/>
        <vers num="11.0"/>
        <vers num="12.0" edition="beta6"/>
        <vers num="13.0"/>
        <vers num="13.0.1"/>
        <vers num="14.0"/>
        <vers num="14.0.1"/>
        <vers num="15.0"/>
        <vers num="15.0.1"/>
        <vers num="16.0"/>
        <vers num="16.0.1"/>
        <vers num="16.0.2"/>
        <vers num="17.0.10"/>
        <vers num="17.0.11"/>
        <vers num="17.0.2"/>
        <vers num="17.0.3"/>
        <vers num="17.0.4"/>
        <vers num="17.0.5"/>
        <vers num="17.0.6"/>
        <vers num="17.0.7"/>
        <vers num="17.0.8"/>
        <vers num="17.0.9"/>
        <vers num="18.0"/>
        <vers num="18.0.1"/>
        <vers num="18.0.2"/>
        <vers num="19.0"/>
        <vers num="19.0.1"/>
        <vers num="19.0.2"/>
        <vers num="2.0"/>
        <vers num="2.0.0.1"/>
        <vers num="2.0.0.10"/>
        <vers num="2.0.0.11"/>
        <vers num="2.0.0.12"/>
        <vers num="2.0.0.13"/>
        <vers num="2.0.0.14"/>
        <vers num="2.0.0.15"/>
        <vers num="2.0.0.16"/>
        <vers num="2.0.0.17"/>
        <vers num="2.0.0.18"/>
        <vers num="2.0.0.19"/>
        <vers num="2.0.0.2"/>
        <vers num="2.0.0.20"/>
        <vers num="2.0.0.3"/>
        <vers num="2.0.0.4"/>
        <vers num="2.0.0.5"/>
        <vers num="2.0.0.6"/>
        <vers num="2.0.0.7"/>
        <vers num="2.0.0.8"/>
        <vers num="2.0.0.9"/>
        <vers num="20.0"/>
        <vers num="20.0.1"/>
        <vers num="21.0"/>
        <vers num="23.0"/>
        <vers num="23.0.1"/>
        <vers num="24.0"/>
        <vers num="24.1"/>
        <vers num="24.1.1"/>
        <vers num="25.0"/>
        <vers num="25.0.1"/>
        <vers prev="1" num="26.0"/>
        <vers num="3.0"/>
        <vers num="3.0.1"/>
        <vers num="3.0.10"/>
        <vers num="3.0.11"/>
        <vers num="3.0.12"/>
        <vers num="3.0.13"/>
        <vers num="3.0.14"/>
        <vers num="3.0.15"/>
        <vers num="3.0.16"/>
        <vers num="3.0.17"/>
        <vers num="3.0.18"/>
        <vers num="3.0.19"/>
        <vers num="3.0.2"/>
        <vers num="3.0.3"/>
        <vers num="3.0.4"/>
        <vers num="3.0.5"/>
        <vers num="3.0.6"/>
        <vers num="3.0.7"/>
        <vers num="3.0.8"/>
        <vers num="3.0.9"/>
        <vers num="3.5"/>
        <vers num="3.5.1"/>
        <vers num="3.5.10"/>
        <vers num="3.5.11"/>
        <vers num="3.5.12"/>
        <vers num="3.5.13"/>
        <vers num="3.5.14"/>
        <vers num="3.5.15"/>
        <vers num="3.5.16"/>
        <vers num="3.5.17"/>
        <vers num="3.5.18"/>
        <vers num="3.5.19"/>
        <vers num="3.5.2"/>
        <vers num="3.5.3"/>
        <vers num="3.5.4"/>
        <vers num="3.5.5"/>
        <vers num="3.5.6"/>
        <vers num="3.5.7"/>
        <vers num="3.5.8"/>
        <vers num="3.5.9"/>
        <vers num="3.6"/>
        <vers num="3.6.10"/>
        <vers num="3.6.11"/>
        <vers num="3.6.12"/>
        <vers num="3.6.13"/>
        <vers num="3.6.14"/>
        <vers num="3.6.15"/>
        <vers num="3.6.16"/>
        <vers num="3.6.17"/>
        <vers num="3.6.18"/>
        <vers num="3.6.19"/>
        <vers num="3.6.2"/>
        <vers num="3.6.20"/>
        <vers num="3.6.21"/>
        <vers num="3.6.22"/>
        <vers num="3.6.23"/>
        <vers num="3.6.24"/>
        <vers num="3.6.25"/>
        <vers num="3.6.26"/>
        <vers num="3.6.27"/>
        <vers num="3.6.28"/>
        <vers num="3.6.3"/>
        <vers num="3.6.4"/>
        <vers num="3.6.6"/>
        <vers num="3.6.7"/>
        <vers num="3.6.8"/>
        <vers num="3.6.9"/>
        <vers num="4.0" edition="beta1"/>
        <vers num="4.0" edition="beta10"/>
        <vers num="4.0" edition="beta11"/>
        <vers num="4.0" edition="beta12"/>
        <vers num="4.0" edition="beta2"/>
        <vers num="4.0" edition="beta3"/>
        <vers num="4.0" edition="beta4"/>
        <vers num="4.0" edition="beta5"/>
        <vers num="4.0" edition="beta6"/>
        <vers num="4.0" edition="beta7"/>
        <vers num="4.0" edition="beta8"/>
        <vers num="4.0" edition="beta9"/>
        <vers num="4.0.1"/>
        <vers num="5.0"/>
        <vers num="5.0.1"/>
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers num="6.0.2"/>
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="8.0"/>
        <vers num="8.0.1"/>
        <vers num="9.0"/>
        <vers num="9.0.1"/>
      </prod>
      <prod vendor="mozilla" name="firefox_esr">
        <vers num="24.0"/>
        <vers num="24.0.1"/>
        <vers num="24.0.2"/>
        <vers num="24.1.0"/>
        <vers num="24.1.1"/>
        <vers num="24.2"/>
      </prod>
      <prod vendor="mozilla" name="seamonkey">
        <vers num="2.0" edition="alpha_1"/>
        <vers num="2.0" edition="alpha_2"/>
        <vers num="2.0" edition="alpha_3"/>
        <vers num="2.0" edition="beta_1"/>
        <vers num="2.0" edition="beta_2"/>
        <vers num="2.0" edition="rc1"/>
        <vers num="2.0" edition="rc2"/>
        <vers num="2.0.1"/>
        <vers num="2.0.10"/>
        <vers num="2.0.11"/>
        <vers num="2.0.12"/>
        <vers num="2.0.13"/>
        <vers num="2.0.14"/>
        <vers num="2.0.2"/>
        <vers num="2.0.3"/>
        <vers num="2.0.4"/>
        <vers num="2.0.5"/>
        <vers num="2.0.6"/>
        <vers num="2.0.7"/>
        <vers num="2.0.8"/>
        <vers num="2.0.9"/>
        <vers num="2.1" edition="alpha1"/>
        <vers num="2.1" edition="alpha2"/>
        <vers num="2.1" edition="alpha3"/>
        <vers num="2.1" edition="beta1"/>
        <vers num="2.1" edition="beta2"/>
        <vers num="2.1" edition="beta3"/>
        <vers num="2.1" edition="rc1"/>
        <vers num="2.1" edition="rc2"/>
        <vers num="2.10" edition="beta1"/>
        <vers num="2.10" edition="beta2"/>
        <vers num="2.10" edition="beta3"/>
        <vers num="2.10.1"/>
        <vers num="2.11" edition="beta1"/>
        <vers num="2.11" edition="beta2"/>
        <vers num="2.11" edition="beta3"/>
        <vers num="2.11" edition="beta4"/>
        <vers num="2.11" edition="beta5"/>
        <vers num="2.11" edition="beta6"/>
        <vers num="2.12" edition="beta1"/>
        <vers num="2.12" edition="beta2"/>
        <vers num="2.12" edition="beta3"/>
        <vers num="2.12" edition="beta4"/>
        <vers num="2.12" edition="beta5"/>
        <vers num="2.12" edition="beta6"/>
        <vers num="2.12.1"/>
        <vers num="2.13" edition="beta1"/>
        <vers num="2.13" edition="beta2"/>
        <vers num="2.13" edition="beta3"/>
        <vers num="2.13" edition="beta4"/>
        <vers num="2.13" edition="beta5"/>
        <vers num="2.13" edition="beta6"/>
        <vers num="2.13.1"/>
        <vers num="2.13.2"/>
        <vers num="2.14" edition="beta1"/>
        <vers num="2.14" edition="beta2"/>
        <vers num="2.14" edition="beta3"/>
        <vers num="2.14" edition="beta4"/>
        <vers num="2.14" edition="beta5"/>
        <vers num="2.15" edition="beta1"/>
        <vers num="2.15" edition="beta2"/>
        <vers num="2.15" edition="beta3"/>
        <vers num="2.15" edition="beta4"/>
        <vers num="2.15" edition="beta5"/>
        <vers num="2.15" edition="beta6"/>
        <vers num="2.15.1"/>
        <vers num="2.15.2"/>
        <vers num="2.16" edition="beta1"/>
        <vers num="2.16" edition="beta2"/>
        <vers num="2.16" edition="beta3"/>
        <vers num="2.16" edition="beta4"/>
        <vers num="2.16" edition="beta5"/>
        <vers num="2.16.1"/>
        <vers num="2.16.2"/>
        <vers num="2.17" edition="beta1"/>
        <vers num="2.17" edition="beta2"/>
        <vers num="2.17" edition="beta3"/>
        <vers num="2.17" edition="beta4"/>
        <vers num="2.17.1"/>
        <vers num="2.18" edition="beta1"/>
        <vers num="2.18" edition="beta2"/>
        <vers num="2.18" edition="beta3"/>
        <vers num="2.18" edition="beta4"/>
        <vers num="2.19" edition="beta1"/>
        <vers num="2.19" edition="beta2"/>
        <vers num="2.2" edition="beta1"/>
        <vers num="2.2" edition="beta2"/>
        <vers num="2.2" edition="beta3"/>
        <vers num="2.20" edition="beta1"/>
        <vers num="2.20" edition="beta2"/>
        <vers num="2.20" edition="beta3"/>
        <vers num="2.21" edition="beta1"/>
        <vers num="2.21" edition="beta2"/>
        <vers num="2.22" edition="beta1"/>
        <vers num="2.22" edition="beta2"/>
        <vers num="2.22.1"/>
        <vers num="2.23" edition="beta1"/>
        <vers num="2.23" edition="beta2"/>
        <vers prev="1" num="2.24" edition="beta1"/>
        <vers num="2.3" edition="beta1"/>
        <vers num="2.3" edition="beta2"/>
        <vers num="2.3" edition="beta3"/>
        <vers num="2.3.1"/>
        <vers num="2.3.2"/>
        <vers num="2.3.3"/>
        <vers num="2.4" edition="beta1"/>
        <vers num="2.4" edition="beta2"/>
        <vers num="2.4" edition="beta3"/>
        <vers num="2.4.1"/>
        <vers num="2.5" edition="beta1"/>
        <vers num="2.5" edition="beta2"/>
        <vers num="2.5" edition="beta3"/>
        <vers num="2.5" edition="beta4"/>
        <vers num="2.6" edition="beta1"/>
        <vers num="2.6" edition="beta2"/>
        <vers num="2.6" edition="beta3"/>
        <vers num="2.6" edition="beta4"/>
        <vers num="2.6.1"/>
        <vers num="2.7" edition="beta1"/>
        <vers num="2.7" edition="beta2"/>
        <vers num="2.7" edition="beta3"/>
        <vers num="2.7" edition="beta4"/>
        <vers num="2.7" edition="beta5"/>
        <vers num="2.7.1"/>
        <vers num="2.7.2"/>
        <vers num="2.8" edition="beta1"/>
        <vers num="2.8" edition="beta2"/>
        <vers num="2.8" edition="beta3"/>
        <vers num="2.8" edition="beta4"/>
        <vers num="2.8" edition="beta5"/>
        <vers num="2.8" edition="beta6"/>
        <vers num="2.9" edition="beta1"/>
        <vers num="2.9" edition="beta2"/>
        <vers num="2.9" edition="beta3"/>
        <vers num="2.9" edition="beta4"/>
        <vers num="2.9.1"/>
      </prod>
      <prod vendor="mozilla" name="thunderbird">
        <vers num="0.1"/>
        <vers num="0.2"/>
        <vers num="0.3"/>
        <vers num="0.4"/>
        <vers num="0.5"/>
        <vers num="0.6"/>
        <vers num="0.7"/>
        <vers num="0.7.1"/>
        <vers num="0.7.2"/>
        <vers num="0.7.3"/>
        <vers num="0.8"/>
        <vers num="0.9"/>
        <vers num="1.0"/>
        <vers num="1.0.1"/>
        <vers num="1.0.2"/>
        <vers num="1.0.3"/>
        <vers num="1.0.4"/>
        <vers num="1.0.5" edition="beta"/>
        <vers num="1.0.6"/>
        <vers num="1.0.7"/>
        <vers num="1.0.8"/>
        <vers num="1.5" edition="beta2"/>
        <vers num="1.5.0.1"/>
        <vers num="1.5.0.10"/>
        <vers num="1.5.0.11"/>
        <vers num="1.5.0.12"/>
        <vers num="1.5.0.13"/>
        <vers num="1.5.0.14"/>
        <vers num="1.5.0.2"/>
        <vers num="1.5.0.3"/>
        <vers num="1.5.0.4"/>
        <vers num="1.5.0.5"/>
        <vers num="1.5.0.6"/>
        <vers num="1.5.0.7"/>
        <vers num="1.5.0.8"/>
        <vers num="1.5.0.9"/>
        <vers num="1.5.1"/>
        <vers num="1.5.2"/>
        <vers num="1.7.1"/>
        <vers num="1.7.3"/>
        <vers num="10.0"/>
        <vers num="10.0.1"/>
        <vers num="10.0.2"/>
        <vers num="10.0.3"/>
        <vers num="10.0.4"/>
        <vers num="11.0"/>
        <vers num="11.0.1"/>
        <vers num="12.0"/>
        <vers num="12.0.1"/>
        <vers num="13.0"/>
        <vers num="13.0.1"/>
        <vers num="14.0"/>
        <vers num="15.0"/>
        <vers num="15.0.1"/>
        <vers num="16.0"/>
        <vers num="16.0.1"/>
        <vers num="16.0.2"/>
        <vers num="17.0"/>
        <vers num="17.0.1"/>
        <vers num="17.0.2"/>
        <vers num="17.0.3"/>
        <vers num="17.0.4"/>
        <vers num="17.0.5"/>
        <vers num="17.0.6"/>
        <vers num="17.0.7"/>
        <vers num="17.0.8"/>
        <vers num="2.0"/>
        <vers num="2.0.0.0"/>
        <vers num="2.0.0.1"/>
        <vers num="2.0.0.11"/>
        <vers num="2.0.0.12"/>
        <vers num="2.0.0.13"/>
        <vers num="2.0.0.14"/>
        <vers num="2.0.0.15"/>
        <vers num="2.0.0.16"/>
        <vers num="2.0.0.17"/>
        <vers num="2.0.0.18"/>
        <vers num="2.0.0.19"/>
        <vers num="2.0.0.2"/>
        <vers num="2.0.0.20"/>
        <vers num="2.0.0.21"/>
        <vers num="2.0.0.22"/>
        <vers num="2.0.0.23"/>
        <vers num="2.0.0.3"/>
        <vers num="2.0.0.4"/>
        <vers num="2.0.0.5"/>
        <vers num="2.0.0.6"/>
        <vers num="2.0.0.7"/>
        <vers num="2.0.0.8"/>
        <vers num="2.0.0.9"/>
        <vers num="24.0"/>
        <vers num="24.0.1"/>
        <vers num="24.1"/>
        <vers num="24.1.1"/>
        <vers prev="1" num="24.2"/>
        <vers num="3.0"/>
        <vers num="3.0.1"/>
        <vers num="3.0.10"/>
        <vers num="3.0.11"/>
        <vers num="3.0.2"/>
        <vers num="3.0.3"/>
        <vers num="3.0.4"/>
        <vers num="3.0.5"/>
        <vers num="3.0.6"/>
        <vers num="3.0.7"/>
        <vers num="3.0.8"/>
        <vers num="3.0.9"/>
        <vers num="3.1"/>
        <vers num="3.1.1"/>
        <vers num="3.1.10"/>
        <vers num="3.1.11"/>
        <vers num="3.1.12"/>
        <vers num="3.1.13"/>
        <vers num="3.1.14"/>
        <vers num="3.1.15"/>
        <vers num="3.1.16"/>
        <vers num="3.1.17"/>
        <vers num="3.1.2"/>
        <vers num="3.1.3"/>
        <vers num="3.1.4"/>
        <vers num="3.1.5"/>
        <vers num="3.1.6"/>
        <vers num="3.1.7"/>
        <vers num="3.1.8"/>
        <vers num="3.1.9"/>
        <vers num="5.0"/>
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers num="6.0.2"/>
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="8.0"/>
        <vers num="9.0"/>
        <vers num="9.0.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1482" published="2014-02-06" name="CVE-2014-1482" modified="2014-04-01" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:C/I:C/A:C)" CVSS_score="10.0" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="10.0" CVSS_base_score="10.0">
    <desc>
      <descript source="cve">RasterImage.cpp in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 does not prevent access to discarded data, which allows remote attackers to execute arbitrary code or cause a denial of service (incorrect write operations) via crafted image data, as demonstrated by Goo Create.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=943803" source="CONFIRM" adv="1">https://bugzilla.mozilla.org/show_bug.cgi?id=943803</ref>
      <ref url="https://8pecxstudios.com/?page_id=44080" source="CONFIRM">https://8pecxstudios.com/?page_id=44080</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2119-1" source="UBUNTU">USN-2119-1</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2102-2" source="UBUNTU">USN-2102-2</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2102-1" source="UBUNTU">USN-2102-1</ref>
      <ref url="http://www.mozilla.org/security/announce/2014/mfsa2014-04.html" source="CONFIRM" adv="1">http://www.mozilla.org/security/announce/2014/mfsa2014-04.html</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2858" source="DEBIAN">DSA-2858</ref>
      <ref url="http://secunia.com/advisories/56706" source="SECUNIA">56706</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0133.html" source="REDHAT">RHSA-2014:0133</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0132.html" source="REDHAT">RHSA-2014:0132</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.html" source="SUSE">openSUSE-SU-2014:0419</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00010.html" source="SUSE">SUSE-SU-2014:0248</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00005.html" source="SUSE">openSUSE-SU-2014:0213</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00004.html" source="SUSE">openSUSE-SU-2014:0212</ref>
      <ref url="http://lists.fedoraproject.org/pipermail/package-announce/2014-February/129218.html" source="FEDORA">FEDORA-2014-2083</ref>
      <ref url="http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127966.html" source="FEDORA">FEDORA-2014-2041</ref>
    </refs>
    <vuln_soft>
      <prod vendor="mozilla" name="firefox">
        <vers num="0.1"/>
        <vers num="0.10"/>
        <vers num="0.10.1"/>
        <vers num="0.2"/>
        <vers num="0.3"/>
        <vers num="0.4"/>
        <vers num="0.5"/>
        <vers num="0.6"/>
        <vers num="0.6.1"/>
        <vers num="0.7"/>
        <vers num="0.7.1"/>
        <vers num="0.8"/>
        <vers num="0.9" edition="rc"/>
        <vers num="0.9.1"/>
        <vers num="0.9.2"/>
        <vers num="0.9.3"/>
        <vers num="1.0" edition="preview_release"/>
        <vers num="1.0.1"/>
        <vers num="1.0.2"/>
        <vers num="1.0.3"/>
        <vers num="1.0.4"/>
        <vers num="1.0.5"/>
        <vers num="1.0.6"/>
        <vers num="1.0.7"/>
        <vers num="1.0.8"/>
        <vers num="1.5" edition="beta1"/>
        <vers num="1.5" edition="beta2"/>
        <vers num="1.5.0.1"/>
        <vers num="1.5.0.10"/>
        <vers num="1.5.0.11"/>
        <vers num="1.5.0.12"/>
        <vers num="1.5.0.2"/>
        <vers num="1.5.0.3"/>
        <vers num="1.5.0.4"/>
        <vers num="1.5.0.5"/>
        <vers num="1.5.0.6"/>
        <vers num="1.5.0.7"/>
        <vers num="1.5.0.8"/>
        <vers num="1.5.0.9"/>
        <vers num="1.5.1"/>
        <vers num="1.5.2"/>
        <vers num="1.5.3"/>
        <vers num="1.5.4"/>
        <vers num="1.5.5"/>
        <vers num="1.5.6"/>
        <vers num="1.5.7"/>
        <vers num="1.5.8"/>
        <vers num="10.0"/>
        <vers num="10.0.1"/>
        <vers num="10.0.10"/>
        <vers num="10.0.11"/>
        <vers num="10.0.12"/>
        <vers num="10.0.2"/>
        <vers num="10.0.3"/>
        <vers num="10.0.4"/>
        <vers num="10.0.5"/>
        <vers num="10.0.6"/>
        <vers num="10.0.7"/>
        <vers num="10.0.8"/>
        <vers num="10.0.9"/>
        <vers num="11.0"/>
        <vers num="12.0" edition="beta6"/>
        <vers num="13.0"/>
        <vers num="13.0.1"/>
        <vers num="14.0"/>
        <vers num="14.0.1"/>
        <vers num="15.0"/>
        <vers num="15.0.1"/>
        <vers num="16.0"/>
        <vers num="16.0.1"/>
        <vers num="16.0.2"/>
        <vers num="17.0.10"/>
        <vers num="17.0.11"/>
        <vers num="17.0.2"/>
        <vers num="17.0.3"/>
        <vers num="17.0.4"/>
        <vers num="17.0.5"/>
        <vers num="17.0.6"/>
        <vers num="17.0.7"/>
        <vers num="17.0.8"/>
        <vers num="17.0.9"/>
        <vers num="18.0"/>
        <vers num="18.0.1"/>
        <vers num="18.0.2"/>
        <vers num="19.0"/>
        <vers num="19.0.1"/>
        <vers num="19.0.2"/>
        <vers num="2.0"/>
        <vers num="2.0.0.1"/>
        <vers num="2.0.0.10"/>
        <vers num="2.0.0.11"/>
        <vers num="2.0.0.12"/>
        <vers num="2.0.0.13"/>
        <vers num="2.0.0.14"/>
        <vers num="2.0.0.15"/>
        <vers num="2.0.0.16"/>
        <vers num="2.0.0.17"/>
        <vers num="2.0.0.18"/>
        <vers num="2.0.0.19"/>
        <vers num="2.0.0.2"/>
        <vers num="2.0.0.20"/>
        <vers num="2.0.0.3"/>
        <vers num="2.0.0.4"/>
        <vers num="2.0.0.5"/>
        <vers num="2.0.0.6"/>
        <vers num="2.0.0.7"/>
        <vers num="2.0.0.8"/>
        <vers num="2.0.0.9"/>
        <vers num="20.0"/>
        <vers num="20.0.1"/>
        <vers num="21.0"/>
        <vers num="23.0"/>
        <vers num="23.0.1"/>
        <vers num="24.0"/>
        <vers num="24.1"/>
        <vers num="24.1.1"/>
        <vers num="25.0"/>
        <vers num="25.0.1"/>
        <vers prev="1" num="26.0"/>
        <vers num="3.0"/>
        <vers num="3.0.1"/>
        <vers num="3.0.10"/>
        <vers num="3.0.11"/>
        <vers num="3.0.12"/>
        <vers num="3.0.13"/>
        <vers num="3.0.14"/>
        <vers num="3.0.15"/>
        <vers num="3.0.16"/>
        <vers num="3.0.17"/>
        <vers num="3.0.18"/>
        <vers num="3.0.19"/>
        <vers num="3.0.2"/>
        <vers num="3.0.3"/>
        <vers num="3.0.4"/>
        <vers num="3.0.5"/>
        <vers num="3.0.6"/>
        <vers num="3.0.7"/>
        <vers num="3.0.8"/>
        <vers num="3.0.9"/>
        <vers num="3.5"/>
        <vers num="3.5.1"/>
        <vers num="3.5.10"/>
        <vers num="3.5.11"/>
        <vers num="3.5.12"/>
        <vers num="3.5.13"/>
        <vers num="3.5.14"/>
        <vers num="3.5.15"/>
        <vers num="3.5.16"/>
        <vers num="3.5.17"/>
        <vers num="3.5.18"/>
        <vers num="3.5.19"/>
        <vers num="3.5.2"/>
        <vers num="3.5.3"/>
        <vers num="3.5.4"/>
        <vers num="3.5.5"/>
        <vers num="3.5.6"/>
        <vers num="3.5.7"/>
        <vers num="3.5.8"/>
        <vers num="3.5.9"/>
        <vers num="3.6"/>
        <vers num="3.6.10"/>
        <vers num="3.6.11"/>
        <vers num="3.6.12"/>
        <vers num="3.6.13"/>
        <vers num="3.6.14"/>
        <vers num="3.6.15"/>
        <vers num="3.6.16"/>
        <vers num="3.6.17"/>
        <vers num="3.6.18"/>
        <vers num="3.6.19"/>
        <vers num="3.6.2"/>
        <vers num="3.6.20"/>
        <vers num="3.6.21"/>
        <vers num="3.6.22"/>
        <vers num="3.6.23"/>
        <vers num="3.6.24"/>
        <vers num="3.6.25"/>
        <vers num="3.6.26"/>
        <vers num="3.6.27"/>
        <vers num="3.6.28"/>
        <vers num="3.6.3"/>
        <vers num="3.6.4"/>
        <vers num="3.6.6"/>
        <vers num="3.6.7"/>
        <vers num="3.6.8"/>
        <vers num="3.6.9"/>
        <vers num="4.0" edition="beta1"/>
        <vers num="4.0" edition="beta10"/>
        <vers num="4.0" edition="beta11"/>
        <vers num="4.0" edition="beta12"/>
        <vers num="4.0" edition="beta2"/>
        <vers num="4.0" edition="beta3"/>
        <vers num="4.0" edition="beta4"/>
        <vers num="4.0" edition="beta5"/>
        <vers num="4.0" edition="beta6"/>
        <vers num="4.0" edition="beta7"/>
        <vers num="4.0" edition="beta8"/>
        <vers num="4.0" edition="beta9"/>
        <vers num="4.0.1"/>
        <vers num="5.0"/>
        <vers num="5.0.1"/>
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers num="6.0.2"/>
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="8.0"/>
        <vers num="8.0.1"/>
        <vers num="9.0"/>
        <vers num="9.0.1"/>
      </prod>
      <prod vendor="mozilla" name="firefox_esr">
        <vers num="24.0"/>
        <vers num="24.0.1"/>
        <vers num="24.0.2"/>
        <vers num="24.1.0"/>
        <vers num="24.1.1"/>
        <vers num="24.2"/>
      </prod>
      <prod vendor="mozilla" name="seamonkey">
        <vers num="2.0" edition="alpha_1"/>
        <vers num="2.0" edition="alpha_2"/>
        <vers num="2.0" edition="alpha_3"/>
        <vers num="2.0" edition="beta_1"/>
        <vers num="2.0" edition="beta_2"/>
        <vers num="2.0" edition="rc1"/>
        <vers num="2.0" edition="rc2"/>
        <vers num="2.0.1"/>
        <vers num="2.0.10"/>
        <vers num="2.0.11"/>
        <vers num="2.0.12"/>
        <vers num="2.0.13"/>
        <vers num="2.0.14"/>
        <vers num="2.0.2"/>
        <vers num="2.0.3"/>
        <vers num="2.0.4"/>
        <vers num="2.0.5"/>
        <vers num="2.0.6"/>
        <vers num="2.0.7"/>
        <vers num="2.0.8"/>
        <vers num="2.0.9"/>
        <vers num="2.1" edition="alpha1"/>
        <vers num="2.1" edition="alpha2"/>
        <vers num="2.1" edition="alpha3"/>
        <vers num="2.1" edition="beta1"/>
        <vers num="2.1" edition="beta2"/>
        <vers num="2.1" edition="beta3"/>
        <vers num="2.1" edition="rc1"/>
        <vers num="2.1" edition="rc2"/>
        <vers num="2.10" edition="beta1"/>
        <vers num="2.10" edition="beta2"/>
        <vers num="2.10" edition="beta3"/>
        <vers num="2.10.1"/>
        <vers num="2.11" edition="beta1"/>
        <vers num="2.11" edition="beta2"/>
        <vers num="2.11" edition="beta3"/>
        <vers num="2.11" edition="beta4"/>
        <vers num="2.11" edition="beta5"/>
        <vers num="2.11" edition="beta6"/>
        <vers num="2.12" edition="beta1"/>
        <vers num="2.12" edition="beta2"/>
        <vers num="2.12" edition="beta3"/>
        <vers num="2.12" edition="beta4"/>
        <vers num="2.12" edition="beta5"/>
        <vers num="2.12" edition="beta6"/>
        <vers num="2.12.1"/>
        <vers num="2.13" edition="beta1"/>
        <vers num="2.13" edition="beta2"/>
        <vers num="2.13" edition="beta3"/>
        <vers num="2.13" edition="beta4"/>
        <vers num="2.13" edition="beta5"/>
        <vers num="2.13" edition="beta6"/>
        <vers num="2.13.1"/>
        <vers num="2.13.2"/>
        <vers num="2.14" edition="beta1"/>
        <vers num="2.14" edition="beta2"/>
        <vers num="2.14" edition="beta3"/>
        <vers num="2.14" edition="beta4"/>
        <vers num="2.14" edition="beta5"/>
        <vers num="2.15" edition="beta1"/>
        <vers num="2.15" edition="beta2"/>
        <vers num="2.15" edition="beta3"/>
        <vers num="2.15" edition="beta4"/>
        <vers num="2.15" edition="beta5"/>
        <vers num="2.15" edition="beta6"/>
        <vers num="2.15.1"/>
        <vers num="2.15.2"/>
        <vers num="2.16" edition="beta1"/>
        <vers num="2.16" edition="beta2"/>
        <vers num="2.16" edition="beta3"/>
        <vers num="2.16" edition="beta4"/>
        <vers num="2.16" edition="beta5"/>
        <vers num="2.16.1"/>
        <vers num="2.16.2"/>
        <vers num="2.17" edition="beta1"/>
        <vers num="2.17" edition="beta2"/>
        <vers num="2.17" edition="beta3"/>
        <vers num="2.17" edition="beta4"/>
        <vers num="2.17.1"/>
        <vers num="2.18" edition="beta1"/>
        <vers num="2.18" edition="beta2"/>
        <vers num="2.18" edition="beta3"/>
        <vers num="2.18" edition="beta4"/>
        <vers num="2.19" edition="beta1"/>
        <vers num="2.19" edition="beta2"/>
        <vers num="2.2" edition="beta1"/>
        <vers num="2.2" edition="beta2"/>
        <vers num="2.2" edition="beta3"/>
        <vers num="2.20" edition="beta1"/>
        <vers num="2.20" edition="beta2"/>
        <vers num="2.20" edition="beta3"/>
        <vers num="2.21" edition="beta1"/>
        <vers num="2.21" edition="beta2"/>
        <vers num="2.22" edition="beta1"/>
        <vers num="2.22" edition="beta2"/>
        <vers num="2.22.1"/>
        <vers num="2.23" edition="beta1"/>
        <vers num="2.23" edition="beta2"/>
        <vers prev="1" num="2.24" edition="beta1"/>
        <vers num="2.3" edition="beta1"/>
        <vers num="2.3" edition="beta2"/>
        <vers num="2.3" edition="beta3"/>
        <vers num="2.3.1"/>
        <vers num="2.3.2"/>
        <vers num="2.3.3"/>
        <vers num="2.4" edition="beta1"/>
        <vers num="2.4" edition="beta2"/>
        <vers num="2.4" edition="beta3"/>
        <vers num="2.4.1"/>
        <vers num="2.5" edition="beta1"/>
        <vers num="2.5" edition="beta2"/>
        <vers num="2.5" edition="beta3"/>
        <vers num="2.5" edition="beta4"/>
        <vers num="2.6" edition="beta1"/>
        <vers num="2.6" edition="beta2"/>
        <vers num="2.6" edition="beta3"/>
        <vers num="2.6" edition="beta4"/>
        <vers num="2.6.1"/>
        <vers num="2.7" edition="beta1"/>
        <vers num="2.7" edition="beta2"/>
        <vers num="2.7" edition="beta3"/>
        <vers num="2.7" edition="beta4"/>
        <vers num="2.7" edition="beta5"/>
        <vers num="2.7.1"/>
        <vers num="2.7.2"/>
        <vers num="2.8" edition="beta1"/>
        <vers num="2.8" edition="beta2"/>
        <vers num="2.8" edition="beta3"/>
        <vers num="2.8" edition="beta4"/>
        <vers num="2.8" edition="beta5"/>
        <vers num="2.8" edition="beta6"/>
        <vers num="2.9" edition="beta1"/>
        <vers num="2.9" edition="beta2"/>
        <vers num="2.9" edition="beta3"/>
        <vers num="2.9" edition="beta4"/>
        <vers num="2.9.1"/>
      </prod>
      <prod vendor="mozilla" name="thunderbird">
        <vers num="0.1"/>
        <vers num="0.2"/>
        <vers num="0.3"/>
        <vers num="0.4"/>
        <vers num="0.5"/>
        <vers num="0.6"/>
        <vers num="0.7"/>
        <vers num="0.7.1"/>
        <vers num="0.7.2"/>
        <vers num="0.7.3"/>
        <vers num="0.8"/>
        <vers num="0.9"/>
        <vers num="1.0"/>
        <vers num="1.0.1"/>
        <vers num="1.0.2"/>
        <vers num="1.0.3"/>
        <vers num="1.0.4"/>
        <vers num="1.0.5" edition="beta"/>
        <vers num="1.0.6"/>
        <vers num="1.0.7"/>
        <vers num="1.0.8"/>
        <vers num="1.5" edition="beta2"/>
        <vers num="1.5.0.1"/>
        <vers num="1.5.0.10"/>
        <vers num="1.5.0.11"/>
        <vers num="1.5.0.12"/>
        <vers num="1.5.0.13"/>
        <vers num="1.5.0.14"/>
        <vers num="1.5.0.2"/>
        <vers num="1.5.0.3"/>
        <vers num="1.5.0.4"/>
        <vers num="1.5.0.5"/>
        <vers num="1.5.0.6"/>
        <vers num="1.5.0.7"/>
        <vers num="1.5.0.8"/>
        <vers num="1.5.0.9"/>
        <vers num="1.5.1"/>
        <vers num="1.5.2"/>
        <vers num="1.7.1"/>
        <vers num="1.7.3"/>
        <vers num="10.0"/>
        <vers num="10.0.1"/>
        <vers num="10.0.2"/>
        <vers num="10.0.3"/>
        <vers num="10.0.4"/>
        <vers num="11.0"/>
        <vers num="11.0.1"/>
        <vers num="12.0"/>
        <vers num="12.0.1"/>
        <vers num="13.0"/>
        <vers num="13.0.1"/>
        <vers num="14.0"/>
        <vers num="15.0"/>
        <vers num="15.0.1"/>
        <vers num="16.0"/>
        <vers num="16.0.1"/>
        <vers num="16.0.2"/>
        <vers num="17.0"/>
        <vers num="17.0.1"/>
        <vers num="17.0.2"/>
        <vers num="17.0.3"/>
        <vers num="17.0.4"/>
        <vers num="17.0.5"/>
        <vers num="17.0.6"/>
        <vers num="17.0.7"/>
        <vers num="17.0.8"/>
        <vers num="2.0"/>
        <vers num="2.0.0.0"/>
        <vers num="2.0.0.1"/>
        <vers num="2.0.0.11"/>
        <vers num="2.0.0.12"/>
        <vers num="2.0.0.13"/>
        <vers num="2.0.0.14"/>
        <vers num="2.0.0.15"/>
        <vers num="2.0.0.16"/>
        <vers num="2.0.0.17"/>
        <vers num="2.0.0.18"/>
        <vers num="2.0.0.19"/>
        <vers num="2.0.0.2"/>
        <vers num="2.0.0.20"/>
        <vers num="2.0.0.21"/>
        <vers num="2.0.0.22"/>
        <vers num="2.0.0.23"/>
        <vers num="2.0.0.3"/>
        <vers num="2.0.0.4"/>
        <vers num="2.0.0.5"/>
        <vers num="2.0.0.6"/>
        <vers num="2.0.0.7"/>
        <vers num="2.0.0.8"/>
        <vers num="2.0.0.9"/>
        <vers num="24.0"/>
        <vers num="24.0.1"/>
        <vers num="24.1"/>
        <vers num="24.1.1"/>
        <vers prev="1" num="24.2"/>
        <vers num="3.0"/>
        <vers num="3.0.1"/>
        <vers num="3.0.10"/>
        <vers num="3.0.11"/>
        <vers num="3.0.2"/>
        <vers num="3.0.3"/>
        <vers num="3.0.4"/>
        <vers num="3.0.5"/>
        <vers num="3.0.6"/>
        <vers num="3.0.7"/>
        <vers num="3.0.8"/>
        <vers num="3.0.9"/>
        <vers num="3.1"/>
        <vers num="3.1.1"/>
        <vers num="3.1.10"/>
        <vers num="3.1.11"/>
        <vers num="3.1.12"/>
        <vers num="3.1.13"/>
        <vers num="3.1.14"/>
        <vers num="3.1.15"/>
        <vers num="3.1.16"/>
        <vers num="3.1.17"/>
        <vers num="3.1.2"/>
        <vers num="3.1.3"/>
        <vers num="3.1.4"/>
        <vers num="3.1.5"/>
        <vers num="3.1.6"/>
        <vers num="3.1.7"/>
        <vers num="3.1.8"/>
        <vers num="3.1.9"/>
        <vers num="5.0"/>
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers num="6.0.2"/>
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="8.0"/>
        <vers num="9.0"/>
        <vers num="9.0.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1483" published="2014-02-06" name="CVE-2014-1483" modified="2014-04-01" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:N/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Mozilla Firefox before 27.0 and SeaMonkey before 2.24 allow remote attackers to bypass the Same Origin Policy and obtain sensitive information by using an IFRAME element in conjunction with certain timing measurements involving the document.caretPositionFromPoint and document.elementFromPoint functions.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=950427" source="CONFIRM" adv="1">https://bugzilla.mozilla.org/show_bug.cgi?id=950427</ref>
      <ref url="https://8pecxstudios.com/?page_id=44080" source="CONFIRM">https://8pecxstudios.com/?page_id=44080</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2102-2" source="UBUNTU">USN-2102-2</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2102-1" source="UBUNTU">USN-2102-1</ref>
      <ref url="http://www.mozilla.org/security/announce/2014/mfsa2014-05.html" source="CONFIRM" adv="1">http://www.mozilla.org/security/announce/2014/mfsa2014-05.html</ref>
      <ref url="http://secunia.com/advisories/56706" source="SECUNIA">56706</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.html" source="SUSE">openSUSE-SU-2014:0419</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00010.html" source="SUSE">SUSE-SU-2014:0248</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00004.html" source="SUSE">openSUSE-SU-2014:0212</ref>
    </refs>
    <vuln_soft>
      <prod vendor="mozilla" name="firefox">
        <vers num="0.1"/>
        <vers num="0.10"/>
        <vers num="0.10.1"/>
        <vers num="0.2"/>
        <vers num="0.3"/>
        <vers num="0.4"/>
        <vers num="0.5"/>
        <vers num="0.6"/>
        <vers num="0.6.1"/>
        <vers num="0.7"/>
        <vers num="0.7.1"/>
        <vers num="0.8"/>
        <vers num="0.9" edition="rc"/>
        <vers num="0.9.1"/>
        <vers num="0.9.2"/>
        <vers num="0.9.3"/>
        <vers num="1.0" edition="preview_release"/>
        <vers num="1.0.1"/>
        <vers num="1.0.2"/>
        <vers num="1.0.3"/>
        <vers num="1.0.4"/>
        <vers num="1.0.5"/>
        <vers num="1.0.6"/>
        <vers num="1.0.7"/>
        <vers num="1.0.8"/>
        <vers num="1.5" edition="beta1"/>
        <vers num="1.5" edition="beta2"/>
        <vers num="1.5.0.1"/>
        <vers num="1.5.0.10"/>
        <vers num="1.5.0.11"/>
        <vers num="1.5.0.12"/>
        <vers num="1.5.0.2"/>
        <vers num="1.5.0.3"/>
        <vers num="1.5.0.4"/>
        <vers num="1.5.0.5"/>
        <vers num="1.5.0.6"/>
        <vers num="1.5.0.7"/>
        <vers num="1.5.0.8"/>
        <vers num="1.5.0.9"/>
        <vers num="1.5.1"/>
        <vers num="1.5.2"/>
        <vers num="1.5.3"/>
        <vers num="1.5.4"/>
        <vers num="1.5.5"/>
        <vers num="1.5.6"/>
        <vers num="1.5.7"/>
        <vers num="1.5.8"/>
        <vers num="10.0"/>
        <vers num="10.0.1"/>
        <vers num="10.0.10"/>
        <vers num="10.0.11"/>
        <vers num="10.0.12"/>
        <vers num="10.0.2"/>
        <vers num="10.0.3"/>
        <vers num="10.0.4"/>
        <vers num="10.0.5"/>
        <vers num="10.0.6"/>
        <vers num="10.0.7"/>
        <vers num="10.0.8"/>
        <vers num="10.0.9"/>
        <vers num="11.0"/>
        <vers num="12.0" edition="beta6"/>
        <vers num="13.0"/>
        <vers num="13.0.1"/>
        <vers num="14.0"/>
        <vers num="14.0.1"/>
        <vers num="15.0"/>
        <vers num="15.0.1"/>
        <vers num="16.0"/>
        <vers num="16.0.1"/>
        <vers num="16.0.2"/>
        <vers num="17.0.10"/>
        <vers num="17.0.11"/>
        <vers num="17.0.2"/>
        <vers num="17.0.3"/>
        <vers num="17.0.4"/>
        <vers num="17.0.5"/>
        <vers num="17.0.6"/>
        <vers num="17.0.7"/>
        <vers num="17.0.8"/>
        <vers num="17.0.9"/>
        <vers num="18.0"/>
        <vers num="18.0.1"/>
        <vers num="18.0.2"/>
        <vers num="19.0"/>
        <vers num="19.0.1"/>
        <vers num="19.0.2"/>
        <vers num="2.0"/>
        <vers num="2.0.0.1"/>
        <vers num="2.0.0.10"/>
        <vers num="2.0.0.11"/>
        <vers num="2.0.0.12"/>
        <vers num="2.0.0.13"/>
        <vers num="2.0.0.14"/>
        <vers num="2.0.0.15"/>
        <vers num="2.0.0.16"/>
        <vers num="2.0.0.17"/>
        <vers num="2.0.0.18"/>
        <vers num="2.0.0.19"/>
        <vers num="2.0.0.2"/>
        <vers num="2.0.0.20"/>
        <vers num="2.0.0.3"/>
        <vers num="2.0.0.4"/>
        <vers num="2.0.0.5"/>
        <vers num="2.0.0.6"/>
        <vers num="2.0.0.7"/>
        <vers num="2.0.0.8"/>
        <vers num="2.0.0.9"/>
        <vers num="20.0"/>
        <vers num="20.0.1"/>
        <vers num="21.0"/>
        <vers num="23.0"/>
        <vers num="23.0.1"/>
        <vers num="24.0"/>
        <vers num="24.1"/>
        <vers num="24.1.1"/>
        <vers num="25.0"/>
        <vers num="25.0.1"/>
        <vers prev="1" num="26.0"/>
        <vers num="3.0"/>
        <vers num="3.0.1"/>
        <vers num="3.0.10"/>
        <vers num="3.0.11"/>
        <vers num="3.0.12"/>
        <vers num="3.0.13"/>
        <vers num="3.0.14"/>
        <vers num="3.0.15"/>
        <vers num="3.0.16"/>
        <vers num="3.0.17"/>
        <vers num="3.0.18"/>
        <vers num="3.0.19"/>
        <vers num="3.0.2"/>
        <vers num="3.0.3"/>
        <vers num="3.0.4"/>
        <vers num="3.0.5"/>
        <vers num="3.0.6"/>
        <vers num="3.0.7"/>
        <vers num="3.0.8"/>
        <vers num="3.0.9"/>
        <vers num="3.5"/>
        <vers num="3.5.1"/>
        <vers num="3.5.10"/>
        <vers num="3.5.11"/>
        <vers num="3.5.12"/>
        <vers num="3.5.13"/>
        <vers num="3.5.14"/>
        <vers num="3.5.15"/>
        <vers num="3.5.16"/>
        <vers num="3.5.17"/>
        <vers num="3.5.18"/>
        <vers num="3.5.19"/>
        <vers num="3.5.2"/>
        <vers num="3.5.3"/>
        <vers num="3.5.4"/>
        <vers num="3.5.5"/>
        <vers num="3.5.6"/>
        <vers num="3.5.7"/>
        <vers num="3.5.8"/>
        <vers num="3.5.9"/>
        <vers num="3.6"/>
        <vers num="3.6.10"/>
        <vers num="3.6.11"/>
        <vers num="3.6.12"/>
        <vers num="3.6.13"/>
        <vers num="3.6.14"/>
        <vers num="3.6.15"/>
        <vers num="3.6.16"/>
        <vers num="3.6.17"/>
        <vers num="3.6.18"/>
        <vers num="3.6.19"/>
        <vers num="3.6.2"/>
        <vers num="3.6.20"/>
        <vers num="3.6.21"/>
        <vers num="3.6.22"/>
        <vers num="3.6.23"/>
        <vers num="3.6.24"/>
        <vers num="3.6.25"/>
        <vers num="3.6.26"/>
        <vers num="3.6.27"/>
        <vers num="3.6.28"/>
        <vers num="3.6.3"/>
        <vers num="3.6.4"/>
        <vers num="3.6.6"/>
        <vers num="3.6.7"/>
        <vers num="3.6.8"/>
        <vers num="3.6.9"/>
        <vers num="4.0" edition="beta1"/>
        <vers num="4.0" edition="beta10"/>
        <vers num="4.0" edition="beta11"/>
        <vers num="4.0" edition="beta12"/>
        <vers num="4.0" edition="beta2"/>
        <vers num="4.0" edition="beta3"/>
        <vers num="4.0" edition="beta4"/>
        <vers num="4.0" edition="beta5"/>
        <vers num="4.0" edition="beta6"/>
        <vers num="4.0" edition="beta7"/>
        <vers num="4.0" edition="beta8"/>
        <vers num="4.0" edition="beta9"/>
        <vers num="4.0.1"/>
        <vers num="5.0"/>
        <vers num="5.0.1"/>
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers num="6.0.2"/>
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="8.0"/>
        <vers num="8.0.1"/>
        <vers num="9.0"/>
        <vers num="9.0.1"/>
      </prod>
      <prod vendor="mozilla" name="seamonkey">
        <vers num="2.0" edition="alpha_1"/>
        <vers num="2.0" edition="alpha_2"/>
        <vers num="2.0" edition="alpha_3"/>
        <vers num="2.0" edition="beta_1"/>
        <vers num="2.0" edition="beta_2"/>
        <vers num="2.0" edition="rc1"/>
        <vers num="2.0" edition="rc2"/>
        <vers num="2.0.1"/>
        <vers num="2.0.10"/>
        <vers num="2.0.11"/>
        <vers num="2.0.12"/>
        <vers num="2.0.13"/>
        <vers num="2.0.14"/>
        <vers num="2.0.2"/>
        <vers num="2.0.3"/>
        <vers num="2.0.4"/>
        <vers num="2.0.5"/>
        <vers num="2.0.6"/>
        <vers num="2.0.7"/>
        <vers num="2.0.8"/>
        <vers num="2.0.9"/>
        <vers num="2.1" edition="alpha1"/>
        <vers num="2.1" edition="alpha2"/>
        <vers num="2.1" edition="alpha3"/>
        <vers num="2.1" edition="beta1"/>
        <vers num="2.1" edition="beta2"/>
        <vers num="2.1" edition="beta3"/>
        <vers num="2.1" edition="rc1"/>
        <vers num="2.1" edition="rc2"/>
        <vers num="2.10" edition="beta1"/>
        <vers num="2.10" edition="beta2"/>
        <vers num="2.10" edition="beta3"/>
        <vers num="2.10.1"/>
        <vers num="2.11" edition="beta1"/>
        <vers num="2.11" edition="beta2"/>
        <vers num="2.11" edition="beta3"/>
        <vers num="2.11" edition="beta4"/>
        <vers num="2.11" edition="beta5"/>
        <vers num="2.11" edition="beta6"/>
        <vers num="2.12" edition="beta1"/>
        <vers num="2.12" edition="beta2"/>
        <vers num="2.12" edition="beta3"/>
        <vers num="2.12" edition="beta4"/>
        <vers num="2.12" edition="beta5"/>
        <vers num="2.12" edition="beta6"/>
        <vers num="2.12.1"/>
        <vers num="2.13" edition="beta1"/>
        <vers num="2.13" edition="beta2"/>
        <vers num="2.13" edition="beta3"/>
        <vers num="2.13" edition="beta4"/>
        <vers num="2.13" edition="beta5"/>
        <vers num="2.13" edition="beta6"/>
        <vers num="2.13.1"/>
        <vers num="2.13.2"/>
        <vers num="2.14" edition="beta1"/>
        <vers num="2.14" edition="beta2"/>
        <vers num="2.14" edition="beta3"/>
        <vers num="2.14" edition="beta4"/>
        <vers num="2.14" edition="beta5"/>
        <vers num="2.15" edition="beta1"/>
        <vers num="2.15" edition="beta2"/>
        <vers num="2.15" edition="beta3"/>
        <vers num="2.15" edition="beta4"/>
        <vers num="2.15" edition="beta5"/>
        <vers num="2.15" edition="beta6"/>
        <vers num="2.15.1"/>
        <vers num="2.15.2"/>
        <vers num="2.16" edition="beta1"/>
        <vers num="2.16" edition="beta2"/>
        <vers num="2.16" edition="beta3"/>
        <vers num="2.16" edition="beta4"/>
        <vers num="2.16" edition="beta5"/>
        <vers num="2.16.1"/>
        <vers num="2.16.2"/>
        <vers num="2.17" edition="beta1"/>
        <vers num="2.17" edition="beta2"/>
        <vers num="2.17" edition="beta3"/>
        <vers num="2.17" edition="beta4"/>
        <vers num="2.17.1"/>
        <vers num="2.18" edition="beta1"/>
        <vers num="2.18" edition="beta2"/>
        <vers num="2.18" edition="beta3"/>
        <vers num="2.18" edition="beta4"/>
        <vers num="2.19" edition="beta1"/>
        <vers num="2.19" edition="beta2"/>
        <vers num="2.2" edition="beta1"/>
        <vers num="2.2" edition="beta2"/>
        <vers num="2.2" edition="beta3"/>
        <vers num="2.20" edition="beta1"/>
        <vers num="2.20" edition="beta2"/>
        <vers num="2.20" edition="beta3"/>
        <vers num="2.21" edition="beta1"/>
        <vers num="2.21" edition="beta2"/>
        <vers num="2.22" edition="beta1"/>
        <vers num="2.22" edition="beta2"/>
        <vers num="2.22.1"/>
        <vers num="2.23" edition="beta1"/>
        <vers num="2.23" edition="beta2"/>
        <vers prev="1" num="2.24" edition="beta1"/>
        <vers num="2.3" edition="beta1"/>
        <vers num="2.3" edition="beta2"/>
        <vers num="2.3" edition="beta3"/>
        <vers num="2.3.1"/>
        <vers num="2.3.2"/>
        <vers num="2.3.3"/>
        <vers num="2.4" edition="beta1"/>
        <vers num="2.4" edition="beta2"/>
        <vers num="2.4" edition="beta3"/>
        <vers num="2.4.1"/>
        <vers num="2.5" edition="beta1"/>
        <vers num="2.5" edition="beta2"/>
        <vers num="2.5" edition="beta3"/>
        <vers num="2.5" edition="beta4"/>
        <vers num="2.6" edition="beta1"/>
        <vers num="2.6" edition="beta2"/>
        <vers num="2.6" edition="beta3"/>
        <vers num="2.6" edition="beta4"/>
        <vers num="2.6.1"/>
        <vers num="2.7" edition="beta1"/>
        <vers num="2.7" edition="beta2"/>
        <vers num="2.7" edition="beta3"/>
        <vers num="2.7" edition="beta4"/>
        <vers num="2.7" edition="beta5"/>
        <vers num="2.7.1"/>
        <vers num="2.7.2"/>
        <vers num="2.8" edition="beta1"/>
        <vers num="2.8" edition="beta2"/>
        <vers num="2.8" edition="beta3"/>
        <vers num="2.8" edition="beta4"/>
        <vers num="2.8" edition="beta5"/>
        <vers num="2.8" edition="beta6"/>
        <vers num="2.9" edition="beta1"/>
        <vers num="2.9" edition="beta2"/>
        <vers num="2.9" edition="beta3"/>
        <vers num="2.9" edition="beta4"/>
        <vers num="2.9.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1484" published="2014-02-06" name="CVE-2014-1484" modified="2014-04-01" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:N/A:N)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">Mozilla Firefox before 27.0 on Android 4.2 and earlier creates system-log entries containing profile paths, which allows attackers to obtain sensitive information via a crafted application.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=953993" source="CONFIRM" adv="1">https://bugzilla.mozilla.org/show_bug.cgi?id=953993</ref>
      <ref url="http://www.mozilla.org/security/announce/2014/mfsa2014-06.html" source="CONFIRM" adv="1">http://www.mozilla.org/security/announce/2014/mfsa2014-06.html</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00010.html" source="SUSE">SUSE-SU-2014:0248</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00004.html" source="SUSE">openSUSE-SU-2014:0212</ref>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-03/0153.html" source="BUGTRAQ">20140326 Firefox for Android Profile Directory Derandomization and Data Exfiltration (CVE-2014-1484, CVE-2014-1506, CVE-2014-1515, CVE-2014-1516)</ref>
    </refs>
    <vuln_soft>
      <prod vendor="mozilla" name="firefox">
        <vers num="0.1"/>
        <vers num="0.10"/>
        <vers num="0.10.1"/>
        <vers num="0.2"/>
        <vers num="0.3"/>
        <vers num="0.4"/>
        <vers num="0.5"/>
        <vers num="0.6"/>
        <vers num="0.6.1"/>
        <vers num="0.7"/>
        <vers num="0.7.1"/>
        <vers num="0.8"/>
        <vers num="0.9" edition="rc"/>
        <vers num="0.9.1"/>
        <vers num="0.9.2"/>
        <vers num="0.9.3"/>
        <vers num="1.0" edition="preview_release"/>
        <vers num="1.0.1"/>
        <vers num="1.0.2"/>
        <vers num="1.0.3"/>
        <vers num="1.0.4"/>
        <vers num="1.0.5"/>
        <vers num="1.0.6"/>
        <vers num="1.0.7"/>
        <vers num="1.0.8"/>
        <vers num="1.5" edition="beta1"/>
        <vers num="1.5" edition="beta2"/>
        <vers num="1.5.0.1"/>
        <vers num="1.5.0.10"/>
        <vers num="1.5.0.11"/>
        <vers num="1.5.0.12"/>
        <vers num="1.5.0.2"/>
        <vers num="1.5.0.3"/>
        <vers num="1.5.0.4"/>
        <vers num="1.5.0.5"/>
        <vers num="1.5.0.6"/>
        <vers num="1.5.0.7"/>
        <vers num="1.5.0.8"/>
        <vers num="1.5.0.9"/>
        <vers num="1.5.1"/>
        <vers num="1.5.2"/>
        <vers num="1.5.3"/>
        <vers num="1.5.4"/>
        <vers num="1.5.5"/>
        <vers num="1.5.6"/>
        <vers num="1.5.7"/>
        <vers num="1.5.8"/>
        <vers num="10.0"/>
        <vers num="10.0.1"/>
        <vers num="10.0.10"/>
        <vers num="10.0.11"/>
        <vers num="10.0.12"/>
        <vers num="10.0.2"/>
        <vers num="10.0.3"/>
        <vers num="10.0.4"/>
        <vers num="10.0.5"/>
        <vers num="10.0.6"/>
        <vers num="10.0.7"/>
        <vers num="10.0.8"/>
        <vers num="10.0.9"/>
        <vers num="11.0"/>
        <vers num="12.0" edition="beta6"/>
        <vers num="13.0"/>
        <vers num="13.0.1"/>
        <vers num="14.0"/>
        <vers num="14.0.1"/>
        <vers num="15.0"/>
        <vers num="15.0.1"/>
        <vers num="16.0"/>
        <vers num="16.0.1"/>
        <vers num="16.0.2"/>
        <vers num="17.0.10"/>
        <vers num="17.0.11"/>
        <vers num="17.0.2"/>
        <vers num="17.0.3"/>
        <vers num="17.0.4"/>
        <vers num="17.0.5"/>
        <vers num="17.0.6"/>
        <vers num="17.0.7"/>
        <vers num="17.0.8"/>
        <vers num="17.0.9"/>
        <vers num="18.0"/>
        <vers num="18.0.1"/>
        <vers num="18.0.2"/>
        <vers num="19.0"/>
        <vers num="19.0.1"/>
        <vers num="19.0.2"/>
        <vers num="2.0"/>
        <vers num="2.0.0.1"/>
        <vers num="2.0.0.10"/>
        <vers num="2.0.0.11"/>
        <vers num="2.0.0.12"/>
        <vers num="2.0.0.13"/>
        <vers num="2.0.0.14"/>
        <vers num="2.0.0.15"/>
        <vers num="2.0.0.16"/>
        <vers num="2.0.0.17"/>
        <vers num="2.0.0.18"/>
        <vers num="2.0.0.19"/>
        <vers num="2.0.0.2"/>
        <vers num="2.0.0.20"/>
        <vers num="2.0.0.3"/>
        <vers num="2.0.0.4"/>
        <vers num="2.0.0.5"/>
        <vers num="2.0.0.6"/>
        <vers num="2.0.0.7"/>
        <vers num="2.0.0.8"/>
        <vers num="2.0.0.9"/>
        <vers num="20.0"/>
        <vers num="20.0.1"/>
        <vers num="21.0"/>
        <vers num="23.0"/>
        <vers num="23.0.1"/>
        <vers num="24.0"/>
        <vers num="24.1"/>
        <vers num="24.1.1"/>
        <vers num="25.0"/>
        <vers num="25.0.1"/>
        <vers prev="1" num="26.0"/>
        <vers num="3.0"/>
        <vers num="3.0.1"/>
        <vers num="3.0.10"/>
        <vers num="3.0.11"/>
        <vers num="3.0.12"/>
        <vers num="3.0.13"/>
        <vers num="3.0.14"/>
        <vers num="3.0.15"/>
        <vers num="3.0.16"/>
        <vers num="3.0.17"/>
        <vers num="3.0.18"/>
        <vers num="3.0.19"/>
        <vers num="3.0.2"/>
        <vers num="3.0.3"/>
        <vers num="3.0.4"/>
        <vers num="3.0.5"/>
        <vers num="3.0.6"/>
        <vers num="3.0.7"/>
        <vers num="3.0.8"/>
        <vers num="3.0.9"/>
        <vers num="3.5"/>
        <vers num="3.5.1"/>
        <vers num="3.5.10"/>
        <vers num="3.5.11"/>
        <vers num="3.5.12"/>
        <vers num="3.5.13"/>
        <vers num="3.5.14"/>
        <vers num="3.5.15"/>
        <vers num="3.5.16"/>
        <vers num="3.5.17"/>
        <vers num="3.5.18"/>
        <vers num="3.5.19"/>
        <vers num="3.5.2"/>
        <vers num="3.5.3"/>
        <vers num="3.5.4"/>
        <vers num="3.5.5"/>
        <vers num="3.5.6"/>
        <vers num="3.5.7"/>
        <vers num="3.5.8"/>
        <vers num="3.5.9"/>
        <vers num="3.6"/>
        <vers num="3.6.10"/>
        <vers num="3.6.11"/>
        <vers num="3.6.12"/>
        <vers num="3.6.13"/>
        <vers num="3.6.14"/>
        <vers num="3.6.15"/>
        <vers num="3.6.16"/>
        <vers num="3.6.17"/>
        <vers num="3.6.18"/>
        <vers num="3.6.19"/>
        <vers num="3.6.2"/>
        <vers num="3.6.20"/>
        <vers num="3.6.21"/>
        <vers num="3.6.22"/>
        <vers num="3.6.23"/>
        <vers num="3.6.24"/>
        <vers num="3.6.25"/>
        <vers num="3.6.26"/>
        <vers num="3.6.27"/>
        <vers num="3.6.28"/>
        <vers num="3.6.3"/>
        <vers num="3.6.4"/>
        <vers num="3.6.6"/>
        <vers num="3.6.7"/>
        <vers num="3.6.8"/>
        <vers num="3.6.9"/>
        <vers num="4.0" edition="beta1"/>
        <vers num="4.0" edition="beta10"/>
        <vers num="4.0" edition="beta11"/>
        <vers num="4.0" edition="beta12"/>
        <vers num="4.0" edition="beta2"/>
        <vers num="4.0" edition="beta3"/>
        <vers num="4.0" edition="beta4"/>
        <vers num="4.0" edition="beta5"/>
        <vers num="4.0" edition="beta6"/>
        <vers num="4.0" edition="beta7"/>
        <vers num="4.0" edition="beta8"/>
        <vers num="4.0" edition="beta9"/>
        <vers num="4.0.1"/>
        <vers num="5.0"/>
        <vers num="5.0.1"/>
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers num="6.0.2"/>
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="8.0"/>
        <vers num="8.0.1"/>
        <vers num="9.0"/>
        <vers num="9.0.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1485" published="2014-02-06" name="CVE-2014-1485" modified="2014-04-01" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">The Content Security Policy (CSP) implementation in Mozilla Firefox before 27.0 and SeaMonkey before 2.24 operates on XSLT stylesheets according to style-src directives instead of script-src directives, which might allow remote attackers to execute arbitrary XSLT code by leveraging insufficient style-src restrictions.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=910139" source="CONFIRM" adv="1">https://bugzilla.mozilla.org/show_bug.cgi?id=910139</ref>
      <ref url="https://8pecxstudios.com/?page_id=44080" source="CONFIRM">https://8pecxstudios.com/?page_id=44080</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2102-2" source="UBUNTU">USN-2102-2</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2102-1" source="UBUNTU">USN-2102-1</ref>
      <ref url="http://www.mozilla.org/security/announce/2014/mfsa2014-07.html" source="CONFIRM" adv="1">http://www.mozilla.org/security/announce/2014/mfsa2014-07.html</ref>
      <ref url="http://secunia.com/advisories/56706" source="SECUNIA">56706</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.html" source="SUSE">openSUSE-SU-2014:0419</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00010.html" source="SUSE">SUSE-SU-2014:0248</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00004.html" source="SUSE">openSUSE-SU-2014:0212</ref>
    </refs>
    <vuln_soft>
      <prod vendor="mozilla" name="firefox">
        <vers num="0.1"/>
        <vers num="0.10"/>
        <vers num="0.10.1"/>
        <vers num="0.2"/>
        <vers num="0.3"/>
        <vers num="0.4"/>
        <vers num="0.5"/>
        <vers num="0.6"/>
        <vers num="0.6.1"/>
        <vers num="0.7"/>
        <vers num="0.7.1"/>
        <vers num="0.8"/>
        <vers num="0.9" edition="rc"/>
        <vers num="0.9.1"/>
        <vers num="0.9.2"/>
        <vers num="0.9.3"/>
        <vers num="1.0" edition="preview_release"/>
        <vers num="1.0.1"/>
        <vers num="1.0.2"/>
        <vers num="1.0.3"/>
        <vers num="1.0.4"/>
        <vers num="1.0.5"/>
        <vers num="1.0.6"/>
        <vers num="1.0.7"/>
        <vers num="1.0.8"/>
        <vers num="1.5" edition="beta1"/>
        <vers num="1.5" edition="beta2"/>
        <vers num="1.5.0.1"/>
        <vers num="1.5.0.10"/>
        <vers num="1.5.0.11"/>
        <vers num="1.5.0.12"/>
        <vers num="1.5.0.2"/>
        <vers num="1.5.0.3"/>
        <vers num="1.5.0.4"/>
        <vers num="1.5.0.5"/>
        <vers num="1.5.0.6"/>
        <vers num="1.5.0.7"/>
        <vers num="1.5.0.8"/>
        <vers num="1.5.0.9"/>
        <vers num="1.5.1"/>
        <vers num="1.5.2"/>
        <vers num="1.5.3"/>
        <vers num="1.5.4"/>
        <vers num="1.5.5"/>
        <vers num="1.5.6"/>
        <vers num="1.5.7"/>
        <vers num="1.5.8"/>
        <vers num="10.0"/>
        <vers num="10.0.1"/>
        <vers num="10.0.10"/>
        <vers num="10.0.11"/>
        <vers num="10.0.12"/>
        <vers num="10.0.2"/>
        <vers num="10.0.3"/>
        <vers num="10.0.4"/>
        <vers num="10.0.5"/>
        <vers num="10.0.6"/>
        <vers num="10.0.7"/>
        <vers num="10.0.8"/>
        <vers num="10.0.9"/>
        <vers num="11.0"/>
        <vers num="12.0" edition="beta6"/>
        <vers num="13.0"/>
        <vers num="13.0.1"/>
        <vers num="14.0"/>
        <vers num="14.0.1"/>
        <vers num="15.0"/>
        <vers num="15.0.1"/>
        <vers num="16.0"/>
        <vers num="16.0.1"/>
        <vers num="16.0.2"/>
        <vers num="17.0.10"/>
        <vers num="17.0.11"/>
        <vers num="17.0.2"/>
        <vers num="17.0.3"/>
        <vers num="17.0.4"/>
        <vers num="17.0.5"/>
        <vers num="17.0.6"/>
        <vers num="17.0.7"/>
        <vers num="17.0.8"/>
        <vers num="17.0.9"/>
        <vers num="18.0"/>
        <vers num="18.0.1"/>
        <vers num="18.0.2"/>
        <vers num="19.0"/>
        <vers num="19.0.1"/>
        <vers num="19.0.2"/>
        <vers num="2.0"/>
        <vers num="2.0.0.1"/>
        <vers num="2.0.0.10"/>
        <vers num="2.0.0.11"/>
        <vers num="2.0.0.12"/>
        <vers num="2.0.0.13"/>
        <vers num="2.0.0.14"/>
        <vers num="2.0.0.15"/>
        <vers num="2.0.0.16"/>
        <vers num="2.0.0.17"/>
        <vers num="2.0.0.18"/>
        <vers num="2.0.0.19"/>
        <vers num="2.0.0.2"/>
        <vers num="2.0.0.20"/>
        <vers num="2.0.0.3"/>
        <vers num="2.0.0.4"/>
        <vers num="2.0.0.5"/>
        <vers num="2.0.0.6"/>
        <vers num="2.0.0.7"/>
        <vers num="2.0.0.8"/>
        <vers num="2.0.0.9"/>
        <vers num="20.0"/>
        <vers num="20.0.1"/>
        <vers num="21.0"/>
        <vers num="23.0"/>
        <vers num="23.0.1"/>
        <vers num="24.0"/>
        <vers num="24.1"/>
        <vers num="24.1.1"/>
        <vers num="25.0"/>
        <vers num="25.0.1"/>
        <vers prev="1" num="26.0"/>
        <vers num="3.0"/>
        <vers num="3.0.1"/>
        <vers num="3.0.10"/>
        <vers num="3.0.11"/>
        <vers num="3.0.12"/>
        <vers num="3.0.13"/>
        <vers num="3.0.14"/>
        <vers num="3.0.15"/>
        <vers num="3.0.16"/>
        <vers num="3.0.17"/>
        <vers num="3.0.18"/>
        <vers num="3.0.19"/>
        <vers num="3.0.2"/>
        <vers num="3.0.3"/>
        <vers num="3.0.4"/>
        <vers num="3.0.5"/>
        <vers num="3.0.6"/>
        <vers num="3.0.7"/>
        <vers num="3.0.8"/>
        <vers num="3.0.9"/>
        <vers num="3.5"/>
        <vers num="3.5.1"/>
        <vers num="3.5.10"/>
        <vers num="3.5.11"/>
        <vers num="3.5.12"/>
        <vers num="3.5.13"/>
        <vers num="3.5.14"/>
        <vers num="3.5.15"/>
        <vers num="3.5.16"/>
        <vers num="3.5.17"/>
        <vers num="3.5.18"/>
        <vers num="3.5.19"/>
        <vers num="3.5.2"/>
        <vers num="3.5.3"/>
        <vers num="3.5.4"/>
        <vers num="3.5.5"/>
        <vers num="3.5.6"/>
        <vers num="3.5.7"/>
        <vers num="3.5.8"/>
        <vers num="3.5.9"/>
        <vers num="3.6"/>
        <vers num="3.6.10"/>
        <vers num="3.6.11"/>
        <vers num="3.6.12"/>
        <vers num="3.6.13"/>
        <vers num="3.6.14"/>
        <vers num="3.6.15"/>
        <vers num="3.6.16"/>
        <vers num="3.6.17"/>
        <vers num="3.6.18"/>
        <vers num="3.6.19"/>
        <vers num="3.6.2"/>
        <vers num="3.6.20"/>
        <vers num="3.6.21"/>
        <vers num="3.6.22"/>
        <vers num="3.6.23"/>
        <vers num="3.6.24"/>
        <vers num="3.6.25"/>
        <vers num="3.6.26"/>
        <vers num="3.6.27"/>
        <vers num="3.6.28"/>
        <vers num="3.6.3"/>
        <vers num="3.6.4"/>
        <vers num="3.6.6"/>
        <vers num="3.6.7"/>
        <vers num="3.6.8"/>
        <vers num="3.6.9"/>
        <vers num="4.0" edition="beta1"/>
        <vers num="4.0" edition="beta10"/>
        <vers num="4.0" edition="beta11"/>
        <vers num="4.0" edition="beta12"/>
        <vers num="4.0" edition="beta2"/>
        <vers num="4.0" edition="beta3"/>
        <vers num="4.0" edition="beta4"/>
        <vers num="4.0" edition="beta5"/>
        <vers num="4.0" edition="beta6"/>
        <vers num="4.0" edition="beta7"/>
        <vers num="4.0" edition="beta8"/>
        <vers num="4.0" edition="beta9"/>
        <vers num="4.0.1"/>
        <vers num="5.0"/>
        <vers num="5.0.1"/>
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers num="6.0.2"/>
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="8.0"/>
        <vers num="8.0.1"/>
        <vers num="9.0"/>
        <vers num="9.0.1"/>
      </prod>
      <prod vendor="mozilla" name="seamonkey">
        <vers num="2.0" edition="alpha_1"/>
        <vers num="2.0" edition="alpha_2"/>
        <vers num="2.0" edition="alpha_3"/>
        <vers num="2.0" edition="beta_1"/>
        <vers num="2.0" edition="beta_2"/>
        <vers num="2.0" edition="rc1"/>
        <vers num="2.0" edition="rc2"/>
        <vers num="2.0.1"/>
        <vers num="2.0.10"/>
        <vers num="2.0.11"/>
        <vers num="2.0.12"/>
        <vers num="2.0.13"/>
        <vers num="2.0.14"/>
        <vers num="2.0.2"/>
        <vers num="2.0.3"/>
        <vers num="2.0.4"/>
        <vers num="2.0.5"/>
        <vers num="2.0.6"/>
        <vers num="2.0.7"/>
        <vers num="2.0.8"/>
        <vers num="2.0.9"/>
        <vers num="2.1" edition="alpha1"/>
        <vers num="2.1" edition="alpha2"/>
        <vers num="2.1" edition="alpha3"/>
        <vers num="2.1" edition="beta1"/>
        <vers num="2.1" edition="beta2"/>
        <vers num="2.1" edition="beta3"/>
        <vers num="2.1" edition="rc1"/>
        <vers num="2.1" edition="rc2"/>
        <vers num="2.10" edition="beta1"/>
        <vers num="2.10" edition="beta2"/>
        <vers num="2.10" edition="beta3"/>
        <vers num="2.10.1"/>
        <vers num="2.11" edition="beta1"/>
        <vers num="2.11" edition="beta2"/>
        <vers num="2.11" edition="beta3"/>
        <vers num="2.11" edition="beta4"/>
        <vers num="2.11" edition="beta5"/>
        <vers num="2.11" edition="beta6"/>
        <vers num="2.12" edition="beta1"/>
        <vers num="2.12" edition="beta2"/>
        <vers num="2.12" edition="beta3"/>
        <vers num="2.12" edition="beta4"/>
        <vers num="2.12" edition="beta5"/>
        <vers num="2.12" edition="beta6"/>
        <vers num="2.12.1"/>
        <vers num="2.13" edition="beta1"/>
        <vers num="2.13" edition="beta2"/>
        <vers num="2.13" edition="beta3"/>
        <vers num="2.13" edition="beta4"/>
        <vers num="2.13" edition="beta5"/>
        <vers num="2.13" edition="beta6"/>
        <vers num="2.13.1"/>
        <vers num="2.13.2"/>
        <vers num="2.14" edition="beta1"/>
        <vers num="2.14" edition="beta2"/>
        <vers num="2.14" edition="beta3"/>
        <vers num="2.14" edition="beta4"/>
        <vers num="2.14" edition="beta5"/>
        <vers num="2.15" edition="beta1"/>
        <vers num="2.15" edition="beta2"/>
        <vers num="2.15" edition="beta3"/>
        <vers num="2.15" edition="beta4"/>
        <vers num="2.15" edition="beta5"/>
        <vers num="2.15" edition="beta6"/>
        <vers num="2.15.1"/>
        <vers num="2.15.2"/>
        <vers num="2.16" edition="beta1"/>
        <vers num="2.16" edition="beta2"/>
        <vers num="2.16" edition="beta3"/>
        <vers num="2.16" edition="beta4"/>
        <vers num="2.16" edition="beta5"/>
        <vers num="2.16.1"/>
        <vers num="2.16.2"/>
        <vers num="2.17" edition="beta1"/>
        <vers num="2.17" edition="beta2"/>
        <vers num="2.17" edition="beta3"/>
        <vers num="2.17" edition="beta4"/>
        <vers num="2.17.1"/>
        <vers num="2.18" edition="beta1"/>
        <vers num="2.18" edition="beta2"/>
        <vers num="2.18" edition="beta3"/>
        <vers num="2.18" edition="beta4"/>
        <vers num="2.19" edition="beta1"/>
        <vers num="2.19" edition="beta2"/>
        <vers num="2.2" edition="beta1"/>
        <vers num="2.2" edition="beta2"/>
        <vers num="2.2" edition="beta3"/>
        <vers num="2.20" edition="beta1"/>
        <vers num="2.20" edition="beta2"/>
        <vers num="2.20" edition="beta3"/>
        <vers num="2.21" edition="beta1"/>
        <vers num="2.21" edition="beta2"/>
        <vers num="2.22" edition="beta1"/>
        <vers num="2.22" edition="beta2"/>
        <vers num="2.22.1"/>
        <vers num="2.23" edition="beta1"/>
        <vers num="2.23" edition="beta2"/>
        <vers prev="1" num="2.24" edition="beta1"/>
        <vers num="2.3" edition="beta1"/>
        <vers num="2.3" edition="beta2"/>
        <vers num="2.3" edition="beta3"/>
        <vers num="2.3.1"/>
        <vers num="2.3.2"/>
        <vers num="2.3.3"/>
        <vers num="2.4" edition="beta1"/>
        <vers num="2.4" edition="beta2"/>
        <vers num="2.4" edition="beta3"/>
        <vers num="2.4.1"/>
        <vers num="2.5" edition="beta1"/>
        <vers num="2.5" edition="beta2"/>
        <vers num="2.5" edition="beta3"/>
        <vers num="2.5" edition="beta4"/>
        <vers num="2.6" edition="beta1"/>
        <vers num="2.6" edition="beta2"/>
        <vers num="2.6" edition="beta3"/>
        <vers num="2.6" edition="beta4"/>
        <vers num="2.6.1"/>
        <vers num="2.7" edition="beta1"/>
        <vers num="2.7" edition="beta2"/>
        <vers num="2.7" edition="beta3"/>
        <vers num="2.7" edition="beta4"/>
        <vers num="2.7" edition="beta5"/>
        <vers num="2.7.1"/>
        <vers num="2.7.2"/>
        <vers num="2.8" edition="beta1"/>
        <vers num="2.8" edition="beta2"/>
        <vers num="2.8" edition="beta3"/>
        <vers num="2.8" edition="beta4"/>
        <vers num="2.8" edition="beta5"/>
        <vers num="2.8" edition="beta6"/>
        <vers num="2.9" edition="beta1"/>
        <vers num="2.9" edition="beta2"/>
        <vers num="2.9" edition="beta3"/>
        <vers num="2.9" edition="beta4"/>
        <vers num="2.9.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1486" published="2014-02-06" name="CVE-2014-1486" modified="2014-04-01" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:C/I:C/A:C)" CVSS_score="10.0" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="10.0" CVSS_base_score="10.0">
    <desc>
      <descript source="cve">Use-after-free vulnerability in the imgRequestProxy function in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 allows remote attackers to execute arbitrary code via vectors involving unspecified Content-Type values for image data.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=942164" source="CONFIRM" adv="1">https://bugzilla.mozilla.org/show_bug.cgi?id=942164</ref>
      <ref url="https://8pecxstudios.com/?page_id=44080" source="CONFIRM">https://8pecxstudios.com/?page_id=44080</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2119-1" source="UBUNTU">USN-2119-1</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2102-2" source="UBUNTU">USN-2102-2</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2102-1" source="UBUNTU">USN-2102-1</ref>
      <ref url="http://www.mozilla.org/security/announce/2014/mfsa2014-08.html" source="CONFIRM" adv="1">http://www.mozilla.org/security/announce/2014/mfsa2014-08.html</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2858" source="DEBIAN">DSA-2858</ref>
      <ref url="http://secunia.com/advisories/56706" source="SECUNIA">56706</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0133.html" source="REDHAT">RHSA-2014:0133</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0132.html" source="REDHAT">RHSA-2014:0132</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.html" source="SUSE">openSUSE-SU-2014:0419</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00010.html" source="SUSE">SUSE-SU-2014:0248</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00005.html" source="SUSE">openSUSE-SU-2014:0213</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00004.html" source="SUSE">openSUSE-SU-2014:0212</ref>
      <ref url="http://lists.fedoraproject.org/pipermail/package-announce/2014-February/129218.html" source="FEDORA">FEDORA-2014-2083</ref>
      <ref url="http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127966.html" source="FEDORA">FEDORA-2014-2041</ref>
    </refs>
    <vuln_soft>
      <prod vendor="mozilla" name="firefox">
        <vers num="0.1"/>
        <vers num="0.10"/>
        <vers num="0.10.1"/>
        <vers num="0.2"/>
        <vers num="0.3"/>
        <vers num="0.4"/>
        <vers num="0.5"/>
        <vers num="0.6"/>
        <vers num="0.6.1"/>
        <vers num="0.7"/>
        <vers num="0.7.1"/>
        <vers num="0.8"/>
        <vers num="0.9" edition="rc"/>
        <vers num="0.9.1"/>
        <vers num="0.9.2"/>
        <vers num="0.9.3"/>
        <vers num="1.0" edition="preview_release"/>
        <vers num="1.0.1"/>
        <vers num="1.0.2"/>
        <vers num="1.0.3"/>
        <vers num="1.0.4"/>
        <vers num="1.0.5"/>
        <vers num="1.0.6"/>
        <vers num="1.0.7"/>
        <vers num="1.0.8"/>
        <vers num="1.5" edition="beta1"/>
        <vers num="1.5" edition="beta2"/>
        <vers num="1.5.0.1"/>
        <vers num="1.5.0.10"/>
        <vers num="1.5.0.11"/>
        <vers num="1.5.0.12"/>
        <vers num="1.5.0.2"/>
        <vers num="1.5.0.3"/>
        <vers num="1.5.0.4"/>
        <vers num="1.5.0.5"/>
        <vers num="1.5.0.6"/>
        <vers num="1.5.0.7"/>
        <vers num="1.5.0.8"/>
        <vers num="1.5.0.9"/>
        <vers num="1.5.1"/>
        <vers num="1.5.2"/>
        <vers num="1.5.3"/>
        <vers num="1.5.4"/>
        <vers num="1.5.5"/>
        <vers num="1.5.6"/>
        <vers num="1.5.7"/>
        <vers num="1.5.8"/>
        <vers num="10.0"/>
        <vers num="10.0.1"/>
        <vers num="10.0.10"/>
        <vers num="10.0.11"/>
        <vers num="10.0.12"/>
        <vers num="10.0.2"/>
        <vers num="10.0.3"/>
        <vers num="10.0.4"/>
        <vers num="10.0.5"/>
        <vers num="10.0.6"/>
        <vers num="10.0.7"/>
        <vers num="10.0.8"/>
        <vers num="10.0.9"/>
        <vers num="11.0"/>
        <vers num="12.0" edition="beta6"/>
        <vers num="13.0"/>
        <vers num="13.0.1"/>
        <vers num="14.0"/>
        <vers num="14.0.1"/>
        <vers num="15.0"/>
        <vers num="15.0.1"/>
        <vers num="16.0"/>
        <vers num="16.0.1"/>
        <vers num="16.0.2"/>
        <vers num="17.0.10"/>
        <vers num="17.0.11"/>
        <vers num="17.0.2"/>
        <vers num="17.0.3"/>
        <vers num="17.0.4"/>
        <vers num="17.0.5"/>
        <vers num="17.0.6"/>
        <vers num="17.0.7"/>
        <vers num="17.0.8"/>
        <vers num="17.0.9"/>
        <vers num="18.0"/>
        <vers num="18.0.1"/>
        <vers num="18.0.2"/>
        <vers num="19.0"/>
        <vers num="19.0.1"/>
        <vers num="19.0.2"/>
        <vers num="2.0"/>
        <vers num="2.0.0.1"/>
        <vers num="2.0.0.10"/>
        <vers num="2.0.0.11"/>
        <vers num="2.0.0.12"/>
        <vers num="2.0.0.13"/>
        <vers num="2.0.0.14"/>
        <vers num="2.0.0.15"/>
        <vers num="2.0.0.16"/>
        <vers num="2.0.0.17"/>
        <vers num="2.0.0.18"/>
        <vers num="2.0.0.19"/>
        <vers num="2.0.0.2"/>
        <vers num="2.0.0.20"/>
        <vers num="2.0.0.3"/>
        <vers num="2.0.0.4"/>
        <vers num="2.0.0.5"/>
        <vers num="2.0.0.6"/>
        <vers num="2.0.0.7"/>
        <vers num="2.0.0.8"/>
        <vers num="2.0.0.9"/>
        <vers num="20.0"/>
        <vers num="20.0.1"/>
        <vers num="21.0"/>
        <vers num="23.0"/>
        <vers num="23.0.1"/>
        <vers num="24.0"/>
        <vers num="24.1"/>
        <vers num="24.1.1"/>
        <vers num="25.0"/>
        <vers num="25.0.1"/>
        <vers prev="1" num="26.0"/>
        <vers num="3.0"/>
        <vers num="3.0.1"/>
        <vers num="3.0.10"/>
        <vers num="3.0.11"/>
        <vers num="3.0.12"/>
        <vers num="3.0.13"/>
        <vers num="3.0.14"/>
        <vers num="3.0.15"/>
        <vers num="3.0.16"/>
        <vers num="3.0.17"/>
        <vers num="3.0.18"/>
        <vers num="3.0.19"/>
        <vers num="3.0.2"/>
        <vers num="3.0.3"/>
        <vers num="3.0.4"/>
        <vers num="3.0.5"/>
        <vers num="3.0.6"/>
        <vers num="3.0.7"/>
        <vers num="3.0.8"/>
        <vers num="3.0.9"/>
        <vers num="3.5"/>
        <vers num="3.5.1"/>
        <vers num="3.5.10"/>
        <vers num="3.5.11"/>
        <vers num="3.5.12"/>
        <vers num="3.5.13"/>
        <vers num="3.5.14"/>
        <vers num="3.5.15"/>
        <vers num="3.5.16"/>
        <vers num="3.5.17"/>
        <vers num="3.5.18"/>
        <vers num="3.5.19"/>
        <vers num="3.5.2"/>
        <vers num="3.5.3"/>
        <vers num="3.5.4"/>
        <vers num="3.5.5"/>
        <vers num="3.5.6"/>
        <vers num="3.5.7"/>
        <vers num="3.5.8"/>
        <vers num="3.5.9"/>
        <vers num="3.6"/>
        <vers num="3.6.10"/>
        <vers num="3.6.11"/>
        <vers num="3.6.12"/>
        <vers num="3.6.13"/>
        <vers num="3.6.14"/>
        <vers num="3.6.15"/>
        <vers num="3.6.16"/>
        <vers num="3.6.17"/>
        <vers num="3.6.18"/>
        <vers num="3.6.19"/>
        <vers num="3.6.2"/>
        <vers num="3.6.20"/>
        <vers num="3.6.21"/>
        <vers num="3.6.22"/>
        <vers num="3.6.23"/>
        <vers num="3.6.24"/>
        <vers num="3.6.25"/>
        <vers num="3.6.26"/>
        <vers num="3.6.27"/>
        <vers num="3.6.28"/>
        <vers num="3.6.3"/>
        <vers num="3.6.4"/>
        <vers num="3.6.6"/>
        <vers num="3.6.7"/>
        <vers num="3.6.8"/>
        <vers num="3.6.9"/>
        <vers num="4.0" edition="beta1"/>
        <vers num="4.0" edition="beta10"/>
        <vers num="4.0" edition="beta11"/>
        <vers num="4.0" edition="beta12"/>
        <vers num="4.0" edition="beta2"/>
        <vers num="4.0" edition="beta3"/>
        <vers num="4.0" edition="beta4"/>
        <vers num="4.0" edition="beta5"/>
        <vers num="4.0" edition="beta6"/>
        <vers num="4.0" edition="beta7"/>
        <vers num="4.0" edition="beta8"/>
        <vers num="4.0" edition="beta9"/>
        <vers num="4.0.1"/>
        <vers num="5.0"/>
        <vers num="5.0.1"/>
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers num="6.0.2"/>
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="8.0"/>
        <vers num="8.0.1"/>
        <vers num="9.0"/>
        <vers num="9.0.1"/>
      </prod>
      <prod vendor="mozilla" name="firefox_esr">
        <vers num="24.0"/>
        <vers num="24.0.1"/>
        <vers num="24.0.2"/>
        <vers num="24.1.0"/>
        <vers num="24.1.1"/>
        <vers num="24.2"/>
      </prod>
      <prod vendor="mozilla" name="seamonkey">
        <vers num="2.0" edition="alpha_1"/>
        <vers num="2.0" edition="alpha_2"/>
        <vers num="2.0" edition="alpha_3"/>
        <vers num="2.0" edition="beta_1"/>
        <vers num="2.0" edition="beta_2"/>
        <vers num="2.0" edition="rc1"/>
        <vers num="2.0" edition="rc2"/>
        <vers num="2.0.1"/>
        <vers num="2.0.10"/>
        <vers num="2.0.11"/>
        <vers num="2.0.12"/>
        <vers num="2.0.13"/>
        <vers num="2.0.14"/>
        <vers num="2.0.2"/>
        <vers num="2.0.3"/>
        <vers num="2.0.4"/>
        <vers num="2.0.5"/>
        <vers num="2.0.6"/>
        <vers num="2.0.7"/>
        <vers num="2.0.8"/>
        <vers num="2.0.9"/>
        <vers num="2.1" edition="alpha1"/>
        <vers num="2.1" edition="alpha2"/>
        <vers num="2.1" edition="alpha3"/>
        <vers num="2.1" edition="beta1"/>
        <vers num="2.1" edition="beta2"/>
        <vers num="2.1" edition="beta3"/>
        <vers num="2.1" edition="rc1"/>
        <vers num="2.1" edition="rc2"/>
        <vers num="2.10" edition="beta1"/>
        <vers num="2.10" edition="beta2"/>
        <vers num="2.10" edition="beta3"/>
        <vers num="2.10.1"/>
        <vers num="2.11" edition="beta1"/>
        <vers num="2.11" edition="beta2"/>
        <vers num="2.11" edition="beta3"/>
        <vers num="2.11" edition="beta4"/>
        <vers num="2.11" edition="beta5"/>
        <vers num="2.11" edition="beta6"/>
        <vers num="2.12" edition="beta1"/>
        <vers num="2.12" edition="beta2"/>
        <vers num="2.12" edition="beta3"/>
        <vers num="2.12" edition="beta4"/>
        <vers num="2.12" edition="beta5"/>
        <vers num="2.12" edition="beta6"/>
        <vers num="2.12.1"/>
        <vers num="2.13" edition="beta1"/>
        <vers num="2.13" edition="beta2"/>
        <vers num="2.13" edition="beta3"/>
        <vers num="2.13" edition="beta4"/>
        <vers num="2.13" edition="beta5"/>
        <vers num="2.13" edition="beta6"/>
        <vers num="2.13.1"/>
        <vers num="2.13.2"/>
        <vers num="2.14" edition="beta1"/>
        <vers num="2.14" edition="beta2"/>
        <vers num="2.14" edition="beta3"/>
        <vers num="2.14" edition="beta4"/>
        <vers num="2.14" edition="beta5"/>
        <vers num="2.15" edition="beta1"/>
        <vers num="2.15" edition="beta2"/>
        <vers num="2.15" edition="beta3"/>
        <vers num="2.15" edition="beta4"/>
        <vers num="2.15" edition="beta5"/>
        <vers num="2.15" edition="beta6"/>
        <vers num="2.15.1"/>
        <vers num="2.15.2"/>
        <vers num="2.16" edition="beta1"/>
        <vers num="2.16" edition="beta2"/>
        <vers num="2.16" edition="beta3"/>
        <vers num="2.16" edition="beta4"/>
        <vers num="2.16" edition="beta5"/>
        <vers num="2.16.1"/>
        <vers num="2.16.2"/>
        <vers num="2.17" edition="beta1"/>
        <vers num="2.17" edition="beta2"/>
        <vers num="2.17" edition="beta3"/>
        <vers num="2.17" edition="beta4"/>
        <vers num="2.17.1"/>
        <vers num="2.18" edition="beta1"/>
        <vers num="2.18" edition="beta2"/>
        <vers num="2.18" edition="beta3"/>
        <vers num="2.18" edition="beta4"/>
        <vers num="2.19" edition="beta1"/>
        <vers num="2.19" edition="beta2"/>
        <vers num="2.2" edition="beta1"/>
        <vers num="2.2" edition="beta2"/>
        <vers num="2.2" edition="beta3"/>
        <vers num="2.20" edition="beta1"/>
        <vers num="2.20" edition="beta2"/>
        <vers num="2.20" edition="beta3"/>
        <vers num="2.21" edition="beta1"/>
        <vers num="2.21" edition="beta2"/>
        <vers num="2.22" edition="beta1"/>
        <vers num="2.22" edition="beta2"/>
        <vers num="2.22.1"/>
        <vers num="2.23" edition="beta1"/>
        <vers num="2.23" edition="beta2"/>
        <vers prev="1" num="2.24" edition="beta1"/>
        <vers num="2.3" edition="beta1"/>
        <vers num="2.3" edition="beta2"/>
        <vers num="2.3" edition="beta3"/>
        <vers num="2.3.1"/>
        <vers num="2.3.2"/>
        <vers num="2.3.3"/>
        <vers num="2.4" edition="beta1"/>
        <vers num="2.4" edition="beta2"/>
        <vers num="2.4" edition="beta3"/>
        <vers num="2.4.1"/>
        <vers num="2.5" edition="beta1"/>
        <vers num="2.5" edition="beta2"/>
        <vers num="2.5" edition="beta3"/>
        <vers num="2.5" edition="beta4"/>
        <vers num="2.6" edition="beta1"/>
        <vers num="2.6" edition="beta2"/>
        <vers num="2.6" edition="beta3"/>
        <vers num="2.6" edition="beta4"/>
        <vers num="2.6.1"/>
        <vers num="2.7" edition="beta1"/>
        <vers num="2.7" edition="beta2"/>
        <vers num="2.7" edition="beta3"/>
        <vers num="2.7" edition="beta4"/>
        <vers num="2.7" edition="beta5"/>
        <vers num="2.7.1"/>
        <vers num="2.7.2"/>
        <vers num="2.8" edition="beta1"/>
        <vers num="2.8" edition="beta2"/>
        <vers num="2.8" edition="beta3"/>
        <vers num="2.8" edition="beta4"/>
        <vers num="2.8" edition="beta5"/>
        <vers num="2.8" edition="beta6"/>
        <vers num="2.9" edition="beta1"/>
        <vers num="2.9" edition="beta2"/>
        <vers num="2.9" edition="beta3"/>
        <vers num="2.9" edition="beta4"/>
        <vers num="2.9.1"/>
      </prod>
      <prod vendor="mozilla" name="thunderbird">
        <vers num="0.1"/>
        <vers num="0.2"/>
        <vers num="0.3"/>
        <vers num="0.4"/>
        <vers num="0.5"/>
        <vers num="0.6"/>
        <vers num="0.7"/>
        <vers num="0.7.1"/>
        <vers num="0.7.2"/>
        <vers num="0.7.3"/>
        <vers num="0.8"/>
        <vers num="0.9"/>
        <vers num="1.0"/>
        <vers num="1.0.1"/>
        <vers num="1.0.2"/>
        <vers num="1.0.3"/>
        <vers num="1.0.4"/>
        <vers num="1.0.5" edition="beta"/>
        <vers num="1.0.6"/>
        <vers num="1.0.7"/>
        <vers num="1.0.8"/>
        <vers num="1.5" edition="beta2"/>
        <vers num="1.5.0.1"/>
        <vers num="1.5.0.10"/>
        <vers num="1.5.0.11"/>
        <vers num="1.5.0.12"/>
        <vers num="1.5.0.13"/>
        <vers num="1.5.0.14"/>
        <vers num="1.5.0.2"/>
        <vers num="1.5.0.3"/>
        <vers num="1.5.0.4"/>
        <vers num="1.5.0.5"/>
        <vers num="1.5.0.6"/>
        <vers num="1.5.0.7"/>
        <vers num="1.5.0.8"/>
        <vers num="1.5.0.9"/>
        <vers num="1.5.1"/>
        <vers num="1.5.2"/>
        <vers num="1.7.1"/>
        <vers num="1.7.3"/>
        <vers num="10.0"/>
        <vers num="10.0.1"/>
        <vers num="10.0.2"/>
        <vers num="10.0.3"/>
        <vers num="10.0.4"/>
        <vers num="11.0"/>
        <vers num="11.0.1"/>
        <vers num="12.0"/>
        <vers num="12.0.1"/>
        <vers num="13.0"/>
        <vers num="13.0.1"/>
        <vers num="14.0"/>
        <vers num="15.0"/>
        <vers num="15.0.1"/>
        <vers num="16.0"/>
        <vers num="16.0.1"/>
        <vers num="16.0.2"/>
        <vers num="17.0"/>
        <vers num="17.0.1"/>
        <vers num="17.0.2"/>
        <vers num="17.0.3"/>
        <vers num="17.0.4"/>
        <vers num="17.0.5"/>
        <vers num="17.0.6"/>
        <vers num="17.0.7"/>
        <vers num="17.0.8"/>
        <vers num="2.0"/>
        <vers num="2.0.0.0"/>
        <vers num="2.0.0.1"/>
        <vers num="2.0.0.11"/>
        <vers num="2.0.0.12"/>
        <vers num="2.0.0.13"/>
        <vers num="2.0.0.14"/>
        <vers num="2.0.0.15"/>
        <vers num="2.0.0.16"/>
        <vers num="2.0.0.17"/>
        <vers num="2.0.0.18"/>
        <vers num="2.0.0.19"/>
        <vers num="2.0.0.2"/>
        <vers num="2.0.0.20"/>
        <vers num="2.0.0.21"/>
        <vers num="2.0.0.22"/>
        <vers num="2.0.0.23"/>
        <vers num="2.0.0.3"/>
        <vers num="2.0.0.4"/>
        <vers num="2.0.0.5"/>
        <vers num="2.0.0.6"/>
        <vers num="2.0.0.7"/>
        <vers num="2.0.0.8"/>
        <vers num="2.0.0.9"/>
        <vers num="24.0"/>
        <vers num="24.0.1"/>
        <vers num="24.1"/>
        <vers num="24.1.1"/>
        <vers prev="1" num="24.2"/>
        <vers num="3.0"/>
        <vers num="3.0.1"/>
        <vers num="3.0.10"/>
        <vers num="3.0.11"/>
        <vers num="3.0.2"/>
        <vers num="3.0.3"/>
        <vers num="3.0.4"/>
        <vers num="3.0.5"/>
        <vers num="3.0.6"/>
        <vers num="3.0.7"/>
        <vers num="3.0.8"/>
        <vers num="3.0.9"/>
        <vers num="3.1"/>
        <vers num="3.1.1"/>
        <vers num="3.1.10"/>
        <vers num="3.1.11"/>
        <vers num="3.1.12"/>
        <vers num="3.1.13"/>
        <vers num="3.1.14"/>
        <vers num="3.1.15"/>
        <vers num="3.1.16"/>
        <vers num="3.1.17"/>
        <vers num="3.1.2"/>
        <vers num="3.1.3"/>
        <vers num="3.1.4"/>
        <vers num="3.1.5"/>
        <vers num="3.1.6"/>
        <vers num="3.1.7"/>
        <vers num="3.1.8"/>
        <vers num="3.1.9"/>
        <vers num="5.0"/>
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers num="6.0.2"/>
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="8.0"/>
        <vers num="9.0"/>
        <vers num="9.0.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1487" published="2014-02-06" name="CVE-2014-1487" modified="2014-04-01" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:N/A:N)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">The Web workers implementation in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 allows remote attackers to bypass the Same Origin Policy and obtain sensitive authentication information via vectors involving error messages.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=947592" source="CONFIRM" adv="1">https://bugzilla.mozilla.org/show_bug.cgi?id=947592</ref>
      <ref url="https://8pecxstudios.com/?page_id=44080" source="CONFIRM">https://8pecxstudios.com/?page_id=44080</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2119-1" source="UBUNTU">USN-2119-1</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2102-2" source="UBUNTU">USN-2102-2</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2102-1" source="UBUNTU">USN-2102-1</ref>
      <ref url="http://www.mozilla.org/security/announce/2014/mfsa2014-09.html" source="CONFIRM" adv="1">http://www.mozilla.org/security/announce/2014/mfsa2014-09.html</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2858" source="DEBIAN">DSA-2858</ref>
      <ref url="http://secunia.com/advisories/56706" source="SECUNIA">56706</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0133.html" source="REDHAT">RHSA-2014:0133</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0132.html" source="REDHAT">RHSA-2014:0132</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.html" source="SUSE">openSUSE-SU-2014:0419</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00010.html" source="SUSE">SUSE-SU-2014:0248</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00005.html" source="SUSE">openSUSE-SU-2014:0213</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00004.html" source="SUSE">openSUSE-SU-2014:0212</ref>
      <ref url="http://lists.fedoraproject.org/pipermail/package-announce/2014-February/129218.html" source="FEDORA">FEDORA-2014-2083</ref>
      <ref url="http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127966.html" source="FEDORA">FEDORA-2014-2041</ref>
    </refs>
    <vuln_soft>
      <prod vendor="mozilla" name="firefox">
        <vers num="0.1"/>
        <vers num="0.10"/>
        <vers num="0.10.1"/>
        <vers num="0.2"/>
        <vers num="0.3"/>
        <vers num="0.4"/>
        <vers num="0.5"/>
        <vers num="0.6"/>
        <vers num="0.6.1"/>
        <vers num="0.7"/>
        <vers num="0.7.1"/>
        <vers num="0.8"/>
        <vers num="0.9" edition="rc"/>
        <vers num="0.9.1"/>
        <vers num="0.9.2"/>
        <vers num="0.9.3"/>
        <vers num="1.0" edition="preview_release"/>
        <vers num="1.0.1"/>
        <vers num="1.0.2"/>
        <vers num="1.0.3"/>
        <vers num="1.0.4"/>
        <vers num="1.0.5"/>
        <vers num="1.0.6"/>
        <vers num="1.0.7"/>
        <vers num="1.0.8"/>
        <vers num="1.5" edition="beta1"/>
        <vers num="1.5" edition="beta2"/>
        <vers num="1.5.0.1"/>
        <vers num="1.5.0.10"/>
        <vers num="1.5.0.11"/>
        <vers num="1.5.0.12"/>
        <vers num="1.5.0.2"/>
        <vers num="1.5.0.3"/>
        <vers num="1.5.0.4"/>
        <vers num="1.5.0.5"/>
        <vers num="1.5.0.6"/>
        <vers num="1.5.0.7"/>
        <vers num="1.5.0.8"/>
        <vers num="1.5.0.9"/>
        <vers num="1.5.1"/>
        <vers num="1.5.2"/>
        <vers num="1.5.3"/>
        <vers num="1.5.4"/>
        <vers num="1.5.5"/>
        <vers num="1.5.6"/>
        <vers num="1.5.7"/>
        <vers num="1.5.8"/>
        <vers num="10.0"/>
        <vers num="10.0.1"/>
        <vers num="10.0.10"/>
        <vers num="10.0.11"/>
        <vers num="10.0.12"/>
        <vers num="10.0.2"/>
        <vers num="10.0.3"/>
        <vers num="10.0.4"/>
        <vers num="10.0.5"/>
        <vers num="10.0.6"/>
        <vers num="10.0.7"/>
        <vers num="10.0.8"/>
        <vers num="10.0.9"/>
        <vers num="11.0"/>
        <vers num="12.0" edition="beta6"/>
        <vers num="13.0"/>
        <vers num="13.0.1"/>
        <vers num="14.0"/>
        <vers num="14.0.1"/>
        <vers num="15.0"/>
        <vers num="15.0.1"/>
        <vers num="16.0"/>
        <vers num="16.0.1"/>
        <vers num="16.0.2"/>
        <vers num="17.0.10"/>
        <vers num="17.0.11"/>
        <vers num="17.0.2"/>
        <vers num="17.0.3"/>
        <vers num="17.0.4"/>
        <vers num="17.0.5"/>
        <vers num="17.0.6"/>
        <vers num="17.0.7"/>
        <vers num="17.0.8"/>
        <vers num="17.0.9"/>
        <vers num="18.0"/>
        <vers num="18.0.1"/>
        <vers num="18.0.2"/>
        <vers num="19.0"/>
        <vers num="19.0.1"/>
        <vers num="19.0.2"/>
        <vers num="2.0"/>
        <vers num="2.0.0.1"/>
        <vers num="2.0.0.10"/>
        <vers num="2.0.0.11"/>
        <vers num="2.0.0.12"/>
        <vers num="2.0.0.13"/>
        <vers num="2.0.0.14"/>
        <vers num="2.0.0.15"/>
        <vers num="2.0.0.16"/>
        <vers num="2.0.0.17"/>
        <vers num="2.0.0.18"/>
        <vers num="2.0.0.19"/>
        <vers num="2.0.0.2"/>
        <vers num="2.0.0.20"/>
        <vers num="2.0.0.3"/>
        <vers num="2.0.0.4"/>
        <vers num="2.0.0.5"/>
        <vers num="2.0.0.6"/>
        <vers num="2.0.0.7"/>
        <vers num="2.0.0.8"/>
        <vers num="2.0.0.9"/>
        <vers num="20.0"/>
        <vers num="20.0.1"/>
        <vers num="21.0"/>
        <vers num="23.0"/>
        <vers num="23.0.1"/>
        <vers num="24.0"/>
        <vers num="24.1"/>
        <vers num="24.1.1"/>
        <vers num="25.0"/>
        <vers num="25.0.1"/>
        <vers prev="1" num="26.0"/>
        <vers num="3.0"/>
        <vers num="3.0.1"/>
        <vers num="3.0.10"/>
        <vers num="3.0.11"/>
        <vers num="3.0.12"/>
        <vers num="3.0.13"/>
        <vers num="3.0.14"/>
        <vers num="3.0.15"/>
        <vers num="3.0.16"/>
        <vers num="3.0.17"/>
        <vers num="3.0.18"/>
        <vers num="3.0.19"/>
        <vers num="3.0.2"/>
        <vers num="3.0.3"/>
        <vers num="3.0.4"/>
        <vers num="3.0.5"/>
        <vers num="3.0.6"/>
        <vers num="3.0.7"/>
        <vers num="3.0.8"/>
        <vers num="3.0.9"/>
        <vers num="3.5"/>
        <vers num="3.5.1"/>
        <vers num="3.5.10"/>
        <vers num="3.5.11"/>
        <vers num="3.5.12"/>
        <vers num="3.5.13"/>
        <vers num="3.5.14"/>
        <vers num="3.5.15"/>
        <vers num="3.5.16"/>
        <vers num="3.5.17"/>
        <vers num="3.5.18"/>
        <vers num="3.5.19"/>
        <vers num="3.5.2"/>
        <vers num="3.5.3"/>
        <vers num="3.5.4"/>
        <vers num="3.5.5"/>
        <vers num="3.5.6"/>
        <vers num="3.5.7"/>
        <vers num="3.5.8"/>
        <vers num="3.5.9"/>
        <vers num="3.6"/>
        <vers num="3.6.10"/>
        <vers num="3.6.11"/>
        <vers num="3.6.12"/>
        <vers num="3.6.13"/>
        <vers num="3.6.14"/>
        <vers num="3.6.15"/>
        <vers num="3.6.16"/>
        <vers num="3.6.17"/>
        <vers num="3.6.18"/>
        <vers num="3.6.19"/>
        <vers num="3.6.2"/>
        <vers num="3.6.20"/>
        <vers num="3.6.21"/>
        <vers num="3.6.22"/>
        <vers num="3.6.23"/>
        <vers num="3.6.24"/>
        <vers num="3.6.25"/>
        <vers num="3.6.26"/>
        <vers num="3.6.27"/>
        <vers num="3.6.28"/>
        <vers num="3.6.3"/>
        <vers num="3.6.4"/>
        <vers num="3.6.6"/>
        <vers num="3.6.7"/>
        <vers num="3.6.8"/>
        <vers num="3.6.9"/>
        <vers num="4.0" edition="beta1"/>
        <vers num="4.0" edition="beta10"/>
        <vers num="4.0" edition="beta11"/>
        <vers num="4.0" edition="beta12"/>
        <vers num="4.0" edition="beta2"/>
        <vers num="4.0" edition="beta3"/>
        <vers num="4.0" edition="beta4"/>
        <vers num="4.0" edition="beta5"/>
        <vers num="4.0" edition="beta6"/>
        <vers num="4.0" edition="beta7"/>
        <vers num="4.0" edition="beta8"/>
        <vers num="4.0" edition="beta9"/>
        <vers num="4.0.1"/>
        <vers num="5.0"/>
        <vers num="5.0.1"/>
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers num="6.0.2"/>
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="8.0"/>
        <vers num="8.0.1"/>
        <vers num="9.0"/>
        <vers num="9.0.1"/>
      </prod>
      <prod vendor="mozilla" name="firefox_esr">
        <vers num="24.0"/>
        <vers num="24.0.1"/>
        <vers num="24.0.2"/>
        <vers num="24.1.0"/>
        <vers num="24.1.1"/>
        <vers num="24.2"/>
      </prod>
      <prod vendor="mozilla" name="seamonkey">
        <vers num="2.0" edition="alpha_1"/>
        <vers num="2.0" edition="alpha_2"/>
        <vers num="2.0" edition="alpha_3"/>
        <vers num="2.0" edition="beta_1"/>
        <vers num="2.0" edition="beta_2"/>
        <vers num="2.0" edition="rc1"/>
        <vers num="2.0" edition="rc2"/>
        <vers num="2.0.1"/>
        <vers num="2.0.10"/>
        <vers num="2.0.11"/>
        <vers num="2.0.12"/>
        <vers num="2.0.13"/>
        <vers num="2.0.14"/>
        <vers num="2.0.2"/>
        <vers num="2.0.3"/>
        <vers num="2.0.4"/>
        <vers num="2.0.5"/>
        <vers num="2.0.6"/>
        <vers num="2.0.7"/>
        <vers num="2.0.8"/>
        <vers num="2.0.9"/>
        <vers num="2.1" edition="alpha1"/>
        <vers num="2.1" edition="alpha2"/>
        <vers num="2.1" edition="alpha3"/>
        <vers num="2.1" edition="beta1"/>
        <vers num="2.1" edition="beta2"/>
        <vers num="2.1" edition="beta3"/>
        <vers num="2.1" edition="rc1"/>
        <vers num="2.1" edition="rc2"/>
        <vers num="2.10" edition="beta1"/>
        <vers num="2.10" edition="beta2"/>
        <vers num="2.10" edition="beta3"/>
        <vers num="2.10.1"/>
        <vers num="2.11" edition="beta1"/>
        <vers num="2.11" edition="beta2"/>
        <vers num="2.11" edition="beta3"/>
        <vers num="2.11" edition="beta4"/>
        <vers num="2.11" edition="beta5"/>
        <vers num="2.11" edition="beta6"/>
        <vers num="2.12" edition="beta1"/>
        <vers num="2.12" edition="beta2"/>
        <vers num="2.12" edition="beta3"/>
        <vers num="2.12" edition="beta4"/>
        <vers num="2.12" edition="beta5"/>
        <vers num="2.12" edition="beta6"/>
        <vers num="2.12.1"/>
        <vers num="2.13" edition="beta1"/>
        <vers num="2.13" edition="beta2"/>
        <vers num="2.13" edition="beta3"/>
        <vers num="2.13" edition="beta4"/>
        <vers num="2.13" edition="beta5"/>
        <vers num="2.13" edition="beta6"/>
        <vers num="2.13.1"/>
        <vers num="2.13.2"/>
        <vers num="2.14" edition="beta1"/>
        <vers num="2.14" edition="beta2"/>
        <vers num="2.14" edition="beta3"/>
        <vers num="2.14" edition="beta4"/>
        <vers num="2.14" edition="beta5"/>
        <vers num="2.15" edition="beta1"/>
        <vers num="2.15" edition="beta2"/>
        <vers num="2.15" edition="beta3"/>
        <vers num="2.15" edition="beta4"/>
        <vers num="2.15" edition="beta5"/>
        <vers num="2.15" edition="beta6"/>
        <vers num="2.15.1"/>
        <vers num="2.15.2"/>
        <vers num="2.16" edition="beta1"/>
        <vers num="2.16" edition="beta2"/>
        <vers num="2.16" edition="beta3"/>
        <vers num="2.16" edition="beta4"/>
        <vers num="2.16" edition="beta5"/>
        <vers num="2.16.1"/>
        <vers num="2.16.2"/>
        <vers num="2.17" edition="beta1"/>
        <vers num="2.17" edition="beta2"/>
        <vers num="2.17" edition="beta3"/>
        <vers num="2.17" edition="beta4"/>
        <vers num="2.17.1"/>
        <vers num="2.18" edition="beta1"/>
        <vers num="2.18" edition="beta2"/>
        <vers num="2.18" edition="beta3"/>
        <vers num="2.18" edition="beta4"/>
        <vers num="2.19" edition="beta1"/>
        <vers num="2.19" edition="beta2"/>
        <vers num="2.2" edition="beta1"/>
        <vers num="2.2" edition="beta2"/>
        <vers num="2.2" edition="beta3"/>
        <vers num="2.20" edition="beta1"/>
        <vers num="2.20" edition="beta2"/>
        <vers num="2.20" edition="beta3"/>
        <vers num="2.21" edition="beta1"/>
        <vers num="2.21" edition="beta2"/>
        <vers num="2.22" edition="beta1"/>
        <vers num="2.22" edition="beta2"/>
        <vers num="2.22.1"/>
        <vers num="2.23" edition="beta1"/>
        <vers num="2.23" edition="beta2"/>
        <vers prev="1" num="2.24" edition="beta1"/>
        <vers num="2.3" edition="beta1"/>
        <vers num="2.3" edition="beta2"/>
        <vers num="2.3" edition="beta3"/>
        <vers num="2.3.1"/>
        <vers num="2.3.2"/>
        <vers num="2.3.3"/>
        <vers num="2.4" edition="beta1"/>
        <vers num="2.4" edition="beta2"/>
        <vers num="2.4" edition="beta3"/>
        <vers num="2.4.1"/>
        <vers num="2.5" edition="beta1"/>
        <vers num="2.5" edition="beta2"/>
        <vers num="2.5" edition="beta3"/>
        <vers num="2.5" edition="beta4"/>
        <vers num="2.6" edition="beta1"/>
        <vers num="2.6" edition="beta2"/>
        <vers num="2.6" edition="beta3"/>
        <vers num="2.6" edition="beta4"/>
        <vers num="2.6.1"/>
        <vers num="2.7" edition="beta1"/>
        <vers num="2.7" edition="beta2"/>
        <vers num="2.7" edition="beta3"/>
        <vers num="2.7" edition="beta4"/>
        <vers num="2.7" edition="beta5"/>
        <vers num="2.7.1"/>
        <vers num="2.7.2"/>
        <vers num="2.8" edition="beta1"/>
        <vers num="2.8" edition="beta2"/>
        <vers num="2.8" edition="beta3"/>
        <vers num="2.8" edition="beta4"/>
        <vers num="2.8" edition="beta5"/>
        <vers num="2.8" edition="beta6"/>
        <vers num="2.9" edition="beta1"/>
        <vers num="2.9" edition="beta2"/>
        <vers num="2.9" edition="beta3"/>
        <vers num="2.9" edition="beta4"/>
        <vers num="2.9.1"/>
      </prod>
      <prod vendor="mozilla" name="thunderbird">
        <vers num="0.1"/>
        <vers num="0.2"/>
        <vers num="0.3"/>
        <vers num="0.4"/>
        <vers num="0.5"/>
        <vers num="0.6"/>
        <vers num="0.7"/>
        <vers num="0.7.1"/>
        <vers num="0.7.2"/>
        <vers num="0.7.3"/>
        <vers num="0.8"/>
        <vers num="0.9"/>
        <vers num="1.0"/>
        <vers num="1.0.1"/>
        <vers num="1.0.2"/>
        <vers num="1.0.3"/>
        <vers num="1.0.4"/>
        <vers num="1.0.5" edition="beta"/>
        <vers num="1.0.6"/>
        <vers num="1.0.7"/>
        <vers num="1.0.8"/>
        <vers num="1.5" edition="beta2"/>
        <vers num="1.5.0.1"/>
        <vers num="1.5.0.10"/>
        <vers num="1.5.0.11"/>
        <vers num="1.5.0.12"/>
        <vers num="1.5.0.13"/>
        <vers num="1.5.0.14"/>
        <vers num="1.5.0.2"/>
        <vers num="1.5.0.3"/>
        <vers num="1.5.0.4"/>
        <vers num="1.5.0.5"/>
        <vers num="1.5.0.6"/>
        <vers num="1.5.0.7"/>
        <vers num="1.5.0.8"/>
        <vers num="1.5.0.9"/>
        <vers num="1.5.1"/>
        <vers num="1.5.2"/>
        <vers num="1.7.1"/>
        <vers num="1.7.3"/>
        <vers num="10.0"/>
        <vers num="10.0.1"/>
        <vers num="10.0.2"/>
        <vers num="10.0.3"/>
        <vers num="10.0.4"/>
        <vers num="11.0"/>
        <vers num="11.0.1"/>
        <vers num="12.0"/>
        <vers num="12.0.1"/>
        <vers num="13.0"/>
        <vers num="13.0.1"/>
        <vers num="14.0"/>
        <vers num="15.0"/>
        <vers num="15.0.1"/>
        <vers num="16.0"/>
        <vers num="16.0.1"/>
        <vers num="16.0.2"/>
        <vers num="17.0"/>
        <vers num="17.0.1"/>
        <vers num="17.0.2"/>
        <vers num="17.0.3"/>
        <vers num="17.0.4"/>
        <vers num="17.0.5"/>
        <vers num="17.0.6"/>
        <vers num="17.0.7"/>
        <vers num="17.0.8"/>
        <vers num="2.0"/>
        <vers num="2.0.0.0"/>
        <vers num="2.0.0.1"/>
        <vers num="2.0.0.11"/>
        <vers num="2.0.0.12"/>
        <vers num="2.0.0.13"/>
        <vers num="2.0.0.14"/>
        <vers num="2.0.0.15"/>
        <vers num="2.0.0.16"/>
        <vers num="2.0.0.17"/>
        <vers num="2.0.0.18"/>
        <vers num="2.0.0.19"/>
        <vers num="2.0.0.2"/>
        <vers num="2.0.0.20"/>
        <vers num="2.0.0.21"/>
        <vers num="2.0.0.22"/>
        <vers num="2.0.0.23"/>
        <vers num="2.0.0.3"/>
        <vers num="2.0.0.4"/>
        <vers num="2.0.0.5"/>
        <vers num="2.0.0.6"/>
        <vers num="2.0.0.7"/>
        <vers num="2.0.0.8"/>
        <vers num="2.0.0.9"/>
        <vers num="24.0"/>
        <vers num="24.0.1"/>
        <vers num="24.1"/>
        <vers num="24.1.1"/>
        <vers prev="1" num="24.2"/>
        <vers num="3.0"/>
        <vers num="3.0.1"/>
        <vers num="3.0.10"/>
        <vers num="3.0.11"/>
        <vers num="3.0.2"/>
        <vers num="3.0.3"/>
        <vers num="3.0.4"/>
        <vers num="3.0.5"/>
        <vers num="3.0.6"/>
        <vers num="3.0.7"/>
        <vers num="3.0.8"/>
        <vers num="3.0.9"/>
        <vers num="3.1"/>
        <vers num="3.1.1"/>
        <vers num="3.1.10"/>
        <vers num="3.1.11"/>
        <vers num="3.1.12"/>
        <vers num="3.1.13"/>
        <vers num="3.1.14"/>
        <vers num="3.1.15"/>
        <vers num="3.1.16"/>
        <vers num="3.1.17"/>
        <vers num="3.1.2"/>
        <vers num="3.1.3"/>
        <vers num="3.1.4"/>
        <vers num="3.1.5"/>
        <vers num="3.1.6"/>
        <vers num="3.1.7"/>
        <vers num="3.1.8"/>
        <vers num="3.1.9"/>
        <vers num="5.0"/>
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers num="6.0.2"/>
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="8.0"/>
        <vers num="9.0"/>
        <vers num="9.0.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1488" published="2014-02-06" name="CVE-2014-1488" modified="2014-04-01" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:C/I:C/A:C)" CVSS_score="10.0" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="10.0" CVSS_base_score="10.0">
    <desc>
      <descript source="cve">The Web workers implementation in Mozilla Firefox before 27.0 and SeaMonkey before 2.24 allows remote attackers to execute arbitrary code via vectors involving termination of a worker process that has performed a cross-thread object-passing operation in conjunction with use of asm.js.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=950604" source="CONFIRM" adv="1">https://bugzilla.mozilla.org/show_bug.cgi?id=950604</ref>
      <ref url="https://8pecxstudios.com/?page_id=44080" source="CONFIRM">https://8pecxstudios.com/?page_id=44080</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2102-2" source="UBUNTU">USN-2102-2</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2102-1" source="UBUNTU">USN-2102-1</ref>
      <ref url="http://www.mozilla.org/security/announce/2014/mfsa2014-11.html" source="CONFIRM" adv="1">http://www.mozilla.org/security/announce/2014/mfsa2014-11.html</ref>
      <ref url="http://secunia.com/advisories/56706" source="SECUNIA">56706</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.html" source="SUSE">openSUSE-SU-2014:0419</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00010.html" source="SUSE">SUSE-SU-2014:0248</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00004.html" source="SUSE">openSUSE-SU-2014:0212</ref>
    </refs>
    <vuln_soft>
      <prod vendor="mozilla" name="firefox">
        <vers num="0.1"/>
        <vers num="0.10"/>
        <vers num="0.10.1"/>
        <vers num="0.2"/>
        <vers num="0.3"/>
        <vers num="0.4"/>
        <vers num="0.5"/>
        <vers num="0.6"/>
        <vers num="0.6.1"/>
        <vers num="0.7"/>
        <vers num="0.7.1"/>
        <vers num="0.8"/>
        <vers num="0.9" edition="rc"/>
        <vers num="0.9.1"/>
        <vers num="0.9.2"/>
        <vers num="0.9.3"/>
        <vers num="1.0" edition="preview_release"/>
        <vers num="1.0.1"/>
        <vers num="1.0.2"/>
        <vers num="1.0.3"/>
        <vers num="1.0.4"/>
        <vers num="1.0.5"/>
        <vers num="1.0.6"/>
        <vers num="1.0.7"/>
        <vers num="1.0.8"/>
        <vers num="1.5" edition="beta1"/>
        <vers num="1.5" edition="beta2"/>
        <vers num="1.5.0.1"/>
        <vers num="1.5.0.10"/>
        <vers num="1.5.0.11"/>
        <vers num="1.5.0.12"/>
        <vers num="1.5.0.2"/>
        <vers num="1.5.0.3"/>
        <vers num="1.5.0.4"/>
        <vers num="1.5.0.5"/>
        <vers num="1.5.0.6"/>
        <vers num="1.5.0.7"/>
        <vers num="1.5.0.8"/>
        <vers num="1.5.0.9"/>
        <vers num="1.5.1"/>
        <vers num="1.5.2"/>
        <vers num="1.5.3"/>
        <vers num="1.5.4"/>
        <vers num="1.5.5"/>
        <vers num="1.5.6"/>
        <vers num="1.5.7"/>
        <vers num="1.5.8"/>
        <vers num="10.0"/>
        <vers num="10.0.1"/>
        <vers num="10.0.10"/>
        <vers num="10.0.11"/>
        <vers num="10.0.12"/>
        <vers num="10.0.2"/>
        <vers num="10.0.3"/>
        <vers num="10.0.4"/>
        <vers num="10.0.5"/>
        <vers num="10.0.6"/>
        <vers num="10.0.7"/>
        <vers num="10.0.8"/>
        <vers num="10.0.9"/>
        <vers num="11.0"/>
        <vers num="12.0" edition="beta6"/>
        <vers num="13.0"/>
        <vers num="13.0.1"/>
        <vers num="14.0"/>
        <vers num="14.0.1"/>
        <vers num="15.0"/>
        <vers num="15.0.1"/>
        <vers num="16.0"/>
        <vers num="16.0.1"/>
        <vers num="16.0.2"/>
        <vers num="17.0.10"/>
        <vers num="17.0.11"/>
        <vers num="17.0.2"/>
        <vers num="17.0.3"/>
        <vers num="17.0.4"/>
        <vers num="17.0.5"/>
        <vers num="17.0.6"/>
        <vers num="17.0.7"/>
        <vers num="17.0.8"/>
        <vers num="17.0.9"/>
        <vers num="18.0"/>
        <vers num="18.0.1"/>
        <vers num="18.0.2"/>
        <vers num="19.0"/>
        <vers num="19.0.1"/>
        <vers num="19.0.2"/>
        <vers num="2.0"/>
        <vers num="2.0.0.1"/>
        <vers num="2.0.0.10"/>
        <vers num="2.0.0.11"/>
        <vers num="2.0.0.12"/>
        <vers num="2.0.0.13"/>
        <vers num="2.0.0.14"/>
        <vers num="2.0.0.15"/>
        <vers num="2.0.0.16"/>
        <vers num="2.0.0.17"/>
        <vers num="2.0.0.18"/>
        <vers num="2.0.0.19"/>
        <vers num="2.0.0.2"/>
        <vers num="2.0.0.20"/>
        <vers num="2.0.0.3"/>
        <vers num="2.0.0.4"/>
        <vers num="2.0.0.5"/>
        <vers num="2.0.0.6"/>
        <vers num="2.0.0.7"/>
        <vers num="2.0.0.8"/>
        <vers num="2.0.0.9"/>
        <vers num="20.0"/>
        <vers num="20.0.1"/>
        <vers num="21.0"/>
        <vers num="23.0"/>
        <vers num="23.0.1"/>
        <vers num="24.0"/>
        <vers num="24.1"/>
        <vers num="24.1.1"/>
        <vers num="25.0"/>
        <vers num="25.0.1"/>
        <vers prev="1" num="26.0"/>
        <vers num="3.0"/>
        <vers num="3.0.1"/>
        <vers num="3.0.10"/>
        <vers num="3.0.11"/>
        <vers num="3.0.12"/>
        <vers num="3.0.13"/>
        <vers num="3.0.14"/>
        <vers num="3.0.15"/>
        <vers num="3.0.16"/>
        <vers num="3.0.17"/>
        <vers num="3.0.18"/>
        <vers num="3.0.19"/>
        <vers num="3.0.2"/>
        <vers num="3.0.3"/>
        <vers num="3.0.4"/>
        <vers num="3.0.5"/>
        <vers num="3.0.6"/>
        <vers num="3.0.7"/>
        <vers num="3.0.8"/>
        <vers num="3.0.9"/>
        <vers num="3.5"/>
        <vers num="3.5.1"/>
        <vers num="3.5.10"/>
        <vers num="3.5.11"/>
        <vers num="3.5.12"/>
        <vers num="3.5.13"/>
        <vers num="3.5.14"/>
        <vers num="3.5.15"/>
        <vers num="3.5.16"/>
        <vers num="3.5.17"/>
        <vers num="3.5.18"/>
        <vers num="3.5.19"/>
        <vers num="3.5.2"/>
        <vers num="3.5.3"/>
        <vers num="3.5.4"/>
        <vers num="3.5.5"/>
        <vers num="3.5.6"/>
        <vers num="3.5.7"/>
        <vers num="3.5.8"/>
        <vers num="3.5.9"/>
        <vers num="3.6"/>
        <vers num="3.6.10"/>
        <vers num="3.6.11"/>
        <vers num="3.6.12"/>
        <vers num="3.6.13"/>
        <vers num="3.6.14"/>
        <vers num="3.6.15"/>
        <vers num="3.6.16"/>
        <vers num="3.6.17"/>
        <vers num="3.6.18"/>
        <vers num="3.6.19"/>
        <vers num="3.6.2"/>
        <vers num="3.6.20"/>
        <vers num="3.6.21"/>
        <vers num="3.6.22"/>
        <vers num="3.6.23"/>
        <vers num="3.6.24"/>
        <vers num="3.6.25"/>
        <vers num="3.6.26"/>
        <vers num="3.6.27"/>
        <vers num="3.6.28"/>
        <vers num="3.6.3"/>
        <vers num="3.6.4"/>
        <vers num="3.6.6"/>
        <vers num="3.6.7"/>
        <vers num="3.6.8"/>
        <vers num="3.6.9"/>
        <vers num="4.0" edition="beta1"/>
        <vers num="4.0" edition="beta10"/>
        <vers num="4.0" edition="beta11"/>
        <vers num="4.0" edition="beta12"/>
        <vers num="4.0" edition="beta2"/>
        <vers num="4.0" edition="beta3"/>
        <vers num="4.0" edition="beta4"/>
        <vers num="4.0" edition="beta5"/>
        <vers num="4.0" edition="beta6"/>
        <vers num="4.0" edition="beta7"/>
        <vers num="4.0" edition="beta8"/>
        <vers num="4.0" edition="beta9"/>
        <vers num="4.0.1"/>
        <vers num="5.0"/>
        <vers num="5.0.1"/>
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers num="6.0.2"/>
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="8.0"/>
        <vers num="8.0.1"/>
        <vers num="9.0"/>
        <vers num="9.0.1"/>
      </prod>
      <prod vendor="mozilla" name="seamonkey">
        <vers num="2.0" edition="alpha_1"/>
        <vers num="2.0" edition="alpha_2"/>
        <vers num="2.0" edition="alpha_3"/>
        <vers num="2.0" edition="beta_1"/>
        <vers num="2.0" edition="beta_2"/>
        <vers num="2.0" edition="rc1"/>
        <vers num="2.0" edition="rc2"/>
        <vers num="2.0.1"/>
        <vers num="2.0.10"/>
        <vers num="2.0.11"/>
        <vers num="2.0.12"/>
        <vers num="2.0.13"/>
        <vers num="2.0.14"/>
        <vers num="2.0.2"/>
        <vers num="2.0.3"/>
        <vers num="2.0.4"/>
        <vers num="2.0.5"/>
        <vers num="2.0.6"/>
        <vers num="2.0.7"/>
        <vers num="2.0.8"/>
        <vers num="2.0.9"/>
        <vers num="2.1" edition="alpha1"/>
        <vers num="2.1" edition="alpha2"/>
        <vers num="2.1" edition="alpha3"/>
        <vers num="2.1" edition="beta1"/>
        <vers num="2.1" edition="beta2"/>
        <vers num="2.1" edition="beta3"/>
        <vers num="2.1" edition="rc1"/>
        <vers num="2.1" edition="rc2"/>
        <vers num="2.10" edition="beta1"/>
        <vers num="2.10" edition="beta2"/>
        <vers num="2.10" edition="beta3"/>
        <vers num="2.10.1"/>
        <vers num="2.11" edition="beta1"/>
        <vers num="2.11" edition="beta2"/>
        <vers num="2.11" edition="beta3"/>
        <vers num="2.11" edition="beta4"/>
        <vers num="2.11" edition="beta5"/>
        <vers num="2.11" edition="beta6"/>
        <vers num="2.12" edition="beta1"/>
        <vers num="2.12" edition="beta2"/>
        <vers num="2.12" edition="beta3"/>
        <vers num="2.12" edition="beta4"/>
        <vers num="2.12" edition="beta5"/>
        <vers num="2.12" edition="beta6"/>
        <vers num="2.12.1"/>
        <vers num="2.13" edition="beta1"/>
        <vers num="2.13" edition="beta2"/>
        <vers num="2.13" edition="beta3"/>
        <vers num="2.13" edition="beta4"/>
        <vers num="2.13" edition="beta5"/>
        <vers num="2.13" edition="beta6"/>
        <vers num="2.13.1"/>
        <vers num="2.13.2"/>
        <vers num="2.14" edition="beta1"/>
        <vers num="2.14" edition="beta2"/>
        <vers num="2.14" edition="beta3"/>
        <vers num="2.14" edition="beta4"/>
        <vers num="2.14" edition="beta5"/>
        <vers num="2.15" edition="beta1"/>
        <vers num="2.15" edition="beta2"/>
        <vers num="2.15" edition="beta3"/>
        <vers num="2.15" edition="beta4"/>
        <vers num="2.15" edition="beta5"/>
        <vers num="2.15" edition="beta6"/>
        <vers num="2.15.1"/>
        <vers num="2.15.2"/>
        <vers num="2.16" edition="beta1"/>
        <vers num="2.16" edition="beta2"/>
        <vers num="2.16" edition="beta3"/>
        <vers num="2.16" edition="beta4"/>
        <vers num="2.16" edition="beta5"/>
        <vers num="2.16.1"/>
        <vers num="2.16.2"/>
        <vers num="2.17" edition="beta1"/>
        <vers num="2.17" edition="beta2"/>
        <vers num="2.17" edition="beta3"/>
        <vers num="2.17" edition="beta4"/>
        <vers num="2.17.1"/>
        <vers num="2.18" edition="beta1"/>
        <vers num="2.18" edition="beta2"/>
        <vers num="2.18" edition="beta3"/>
        <vers num="2.18" edition="beta4"/>
        <vers num="2.19" edition="beta1"/>
        <vers num="2.19" edition="beta2"/>
        <vers num="2.2" edition="beta1"/>
        <vers num="2.2" edition="beta2"/>
        <vers num="2.2" edition="beta3"/>
        <vers num="2.20" edition="beta1"/>
        <vers num="2.20" edition="beta2"/>
        <vers num="2.20" edition="beta3"/>
        <vers num="2.21" edition="beta1"/>
        <vers num="2.21" edition="beta2"/>
        <vers num="2.22" edition="beta1"/>
        <vers num="2.22" edition="beta2"/>
        <vers num="2.22.1"/>
        <vers num="2.23" edition="beta1"/>
        <vers num="2.23" edition="beta2"/>
        <vers prev="1" num="2.24" edition="beta1"/>
        <vers num="2.3" edition="beta1"/>
        <vers num="2.3" edition="beta2"/>
        <vers num="2.3" edition="beta3"/>
        <vers num="2.3.1"/>
        <vers num="2.3.2"/>
        <vers num="2.3.3"/>
        <vers num="2.4" edition="beta1"/>
        <vers num="2.4" edition="beta2"/>
        <vers num="2.4" edition="beta3"/>
        <vers num="2.4.1"/>
        <vers num="2.5" edition="beta1"/>
        <vers num="2.5" edition="beta2"/>
        <vers num="2.5" edition="beta3"/>
        <vers num="2.5" edition="beta4"/>
        <vers num="2.6" edition="beta1"/>
        <vers num="2.6" edition="beta2"/>
        <vers num="2.6" edition="beta3"/>
        <vers num="2.6" edition="beta4"/>
        <vers num="2.6.1"/>
        <vers num="2.7" edition="beta1"/>
        <vers num="2.7" edition="beta2"/>
        <vers num="2.7" edition="beta3"/>
        <vers num="2.7" edition="beta4"/>
        <vers num="2.7" edition="beta5"/>
        <vers num="2.7.1"/>
        <vers num="2.7.2"/>
        <vers num="2.8" edition="beta1"/>
        <vers num="2.8" edition="beta2"/>
        <vers num="2.8" edition="beta3"/>
        <vers num="2.8" edition="beta4"/>
        <vers num="2.8" edition="beta5"/>
        <vers num="2.8" edition="beta6"/>
        <vers num="2.9" edition="beta1"/>
        <vers num="2.9" edition="beta2"/>
        <vers num="2.9" edition="beta3"/>
        <vers num="2.9" edition="beta4"/>
        <vers num="2.9.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1489" published="2014-02-06" name="CVE-2014-1489" modified="2014-03-05" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:N/A:P)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Mozilla Firefox before 27.0 does not properly restrict access to about:home buttons by script on other pages, which allows user-assisted remote attackers to cause a denial of service (session restore) via a crafted web site.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=959531" source="CONFIRM" adv="1">https://bugzilla.mozilla.org/show_bug.cgi?id=959531</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2102-2" source="UBUNTU">USN-2102-2</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2102-1" source="UBUNTU">USN-2102-1</ref>
      <ref url="http://www.mozilla.org/security/announce/2014/mfsa2014-10.html" source="CONFIRM" adv="1">http://www.mozilla.org/security/announce/2014/mfsa2014-10.html</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00010.html" source="SUSE">SUSE-SU-2014:0248</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00004.html" source="SUSE">openSUSE-SU-2014:0212</ref>
    </refs>
    <vuln_soft>
      <prod vendor="mozilla" name="firefox">
        <vers num="0.1"/>
        <vers num="0.10"/>
        <vers num="0.10.1"/>
        <vers num="0.2"/>
        <vers num="0.3"/>
        <vers num="0.4"/>
        <vers num="0.5"/>
        <vers num="0.6"/>
        <vers num="0.6.1"/>
        <vers num="0.7"/>
        <vers num="0.7.1"/>
        <vers num="0.8"/>
        <vers num="0.9" edition="rc"/>
        <vers num="0.9.1"/>
        <vers num="0.9.2"/>
        <vers num="0.9.3"/>
        <vers num="1.0" edition="preview_release"/>
        <vers num="1.0.1"/>
        <vers num="1.0.2"/>
        <vers num="1.0.3"/>
        <vers num="1.0.4"/>
        <vers num="1.0.5"/>
        <vers num="1.0.6"/>
        <vers num="1.0.7"/>
        <vers num="1.0.8"/>
        <vers num="1.5" edition="beta1"/>
        <vers num="1.5" edition="beta2"/>
        <vers num="1.5.0.1"/>
        <vers num="1.5.0.10"/>
        <vers num="1.5.0.11"/>
        <vers num="1.5.0.12"/>
        <vers num="1.5.0.2"/>
        <vers num="1.5.0.3"/>
        <vers num="1.5.0.4"/>
        <vers num="1.5.0.5"/>
        <vers num="1.5.0.6"/>
        <vers num="1.5.0.7"/>
        <vers num="1.5.0.8"/>
        <vers num="1.5.0.9"/>
        <vers num="1.5.1"/>
        <vers num="1.5.2"/>
        <vers num="1.5.3"/>
        <vers num="1.5.4"/>
        <vers num="1.5.5"/>
        <vers num="1.5.6"/>
        <vers num="1.5.7"/>
        <vers num="1.5.8"/>
        <vers num="10.0"/>
        <vers num="10.0.1"/>
        <vers num="10.0.10"/>
        <vers num="10.0.11"/>
        <vers num="10.0.12"/>
        <vers num="10.0.2"/>
        <vers num="10.0.3"/>
        <vers num="10.0.4"/>
        <vers num="10.0.5"/>
        <vers num="10.0.6"/>
        <vers num="10.0.7"/>
        <vers num="10.0.8"/>
        <vers num="10.0.9"/>
        <vers num="11.0"/>
        <vers num="12.0" edition="beta6"/>
        <vers num="13.0"/>
        <vers num="13.0.1"/>
        <vers num="14.0"/>
        <vers num="14.0.1"/>
        <vers num="15.0"/>
        <vers num="15.0.1"/>
        <vers num="16.0"/>
        <vers num="16.0.1"/>
        <vers num="16.0.2"/>
        <vers num="17.0.10"/>
        <vers num="17.0.11"/>
        <vers num="17.0.2"/>
        <vers num="17.0.3"/>
        <vers num="17.0.4"/>
        <vers num="17.0.5"/>
        <vers num="17.0.6"/>
        <vers num="17.0.7"/>
        <vers num="17.0.8"/>
        <vers num="17.0.9"/>
        <vers num="18.0"/>
        <vers num="18.0.1"/>
        <vers num="18.0.2"/>
        <vers num="19.0"/>
        <vers num="19.0.1"/>
        <vers num="19.0.2"/>
        <vers num="2.0"/>
        <vers num="2.0.0.1"/>
        <vers num="2.0.0.10"/>
        <vers num="2.0.0.11"/>
        <vers num="2.0.0.12"/>
        <vers num="2.0.0.13"/>
        <vers num="2.0.0.14"/>
        <vers num="2.0.0.15"/>
        <vers num="2.0.0.16"/>
        <vers num="2.0.0.17"/>
        <vers num="2.0.0.18"/>
        <vers num="2.0.0.19"/>
        <vers num="2.0.0.2"/>
        <vers num="2.0.0.20"/>
        <vers num="2.0.0.3"/>
        <vers num="2.0.0.4"/>
        <vers num="2.0.0.5"/>
        <vers num="2.0.0.6"/>
        <vers num="2.0.0.7"/>
        <vers num="2.0.0.8"/>
        <vers num="2.0.0.9"/>
        <vers num="20.0"/>
        <vers num="20.0.1"/>
        <vers num="21.0"/>
        <vers num="23.0"/>
        <vers num="23.0.1"/>
        <vers num="24.0"/>
        <vers num="24.1"/>
        <vers num="24.1.1"/>
        <vers num="25.0"/>
        <vers num="25.0.1"/>
        <vers prev="1" num="26.0"/>
        <vers num="3.0"/>
        <vers num="3.0.1"/>
        <vers num="3.0.10"/>
        <vers num="3.0.11"/>
        <vers num="3.0.12"/>
        <vers num="3.0.13"/>
        <vers num="3.0.14"/>
        <vers num="3.0.15"/>
        <vers num="3.0.16"/>
        <vers num="3.0.17"/>
        <vers num="3.0.18"/>
        <vers num="3.0.19"/>
        <vers num="3.0.2"/>
        <vers num="3.0.3"/>
        <vers num="3.0.4"/>
        <vers num="3.0.5"/>
        <vers num="3.0.6"/>
        <vers num="3.0.7"/>
        <vers num="3.0.8"/>
        <vers num="3.0.9"/>
        <vers num="3.5"/>
        <vers num="3.5.1"/>
        <vers num="3.5.10"/>
        <vers num="3.5.11"/>
        <vers num="3.5.12"/>
        <vers num="3.5.13"/>
        <vers num="3.5.14"/>
        <vers num="3.5.15"/>
        <vers num="3.5.16"/>
        <vers num="3.5.17"/>
        <vers num="3.5.18"/>
        <vers num="3.5.19"/>
        <vers num="3.5.2"/>
        <vers num="3.5.3"/>
        <vers num="3.5.4"/>
        <vers num="3.5.5"/>
        <vers num="3.5.6"/>
        <vers num="3.5.7"/>
        <vers num="3.5.8"/>
        <vers num="3.5.9"/>
        <vers num="3.6"/>
        <vers num="3.6.10"/>
        <vers num="3.6.11"/>
        <vers num="3.6.12"/>
        <vers num="3.6.13"/>
        <vers num="3.6.14"/>
        <vers num="3.6.15"/>
        <vers num="3.6.16"/>
        <vers num="3.6.17"/>
        <vers num="3.6.18"/>
        <vers num="3.6.19"/>
        <vers num="3.6.2"/>
        <vers num="3.6.20"/>
        <vers num="3.6.21"/>
        <vers num="3.6.22"/>
        <vers num="3.6.23"/>
        <vers num="3.6.24"/>
        <vers num="3.6.25"/>
        <vers num="3.6.26"/>
        <vers num="3.6.27"/>
        <vers num="3.6.28"/>
        <vers num="3.6.3"/>
        <vers num="3.6.4"/>
        <vers num="3.6.6"/>
        <vers num="3.6.7"/>
        <vers num="3.6.8"/>
        <vers num="3.6.9"/>
        <vers num="4.0" edition="beta1"/>
        <vers num="4.0" edition="beta10"/>
        <vers num="4.0" edition="beta11"/>
        <vers num="4.0" edition="beta12"/>
        <vers num="4.0" edition="beta2"/>
        <vers num="4.0" edition="beta3"/>
        <vers num="4.0" edition="beta4"/>
        <vers num="4.0" edition="beta5"/>
        <vers num="4.0" edition="beta6"/>
        <vers num="4.0" edition="beta7"/>
        <vers num="4.0" edition="beta8"/>
        <vers num="4.0" edition="beta9"/>
        <vers num="4.0.1"/>
        <vers num="5.0"/>
        <vers num="5.0.1"/>
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers num="6.0.2"/>
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="8.0"/>
        <vers num="8.0.1"/>
        <vers num="9.0"/>
        <vers num="9.0.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1490" published="2014-02-06" name="CVE-2014-1490" modified="2014-04-01" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:P)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">Race condition in libssl in Mozilla Network Security Services (NSS) before 3.15.4, as used in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, SeaMonkey before 2.24, and other products, allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via vectors involving a resumption handshake that triggers incorrect replacement of a session ticket.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=930874" source="CONFIRM" adv="1">https://bugzilla.mozilla.org/show_bug.cgi?id=930874</ref>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=930857" source="CONFIRM" adv="1">https://bugzilla.mozilla.org/show_bug.cgi?id=930857</ref>
      <ref url="https://8pecxstudios.com/?page_id=44080" source="CONFIRM">https://8pecxstudios.com/?page_id=44080</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2119-1" source="UBUNTU">USN-2119-1</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2102-2" source="UBUNTU">USN-2102-2</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2102-1" source="UBUNTU">USN-2102-1</ref>
      <ref url="http://www.mozilla.org/security/announce/2014/mfsa2014-12.html" source="CONFIRM" adv="1">http://www.mozilla.org/security/announce/2014/mfsa2014-12.html</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2858" source="DEBIAN">DSA-2858</ref>
      <ref url="http://secunia.com/advisories/56706" source="SECUNIA">56706</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.html" source="SUSE">openSUSE-SU-2014:0419</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00010.html" source="SUSE">SUSE-SU-2014:0248</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00005.html" source="SUSE">openSUSE-SU-2014:0213</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00004.html" source="SUSE">openSUSE-SU-2014:0212</ref>
      <ref url="http://lists.fedoraproject.org/pipermail/package-announce/2014-February/129218.html" source="FEDORA">FEDORA-2014-2083</ref>
      <ref url="http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127966.html" source="FEDORA">FEDORA-2014-2041</ref>
    </refs>
    <vuln_soft>
      <prod vendor="mozilla" name="firefox">
        <vers num="0.1"/>
        <vers num="0.10"/>
        <vers num="0.10.1"/>
        <vers num="0.2"/>
        <vers num="0.3"/>
        <vers num="0.4"/>
        <vers num="0.5"/>
        <vers num="0.6"/>
        <vers num="0.6.1"/>
        <vers num="0.7"/>
        <vers num="0.7.1"/>
        <vers num="0.8"/>
        <vers num="0.9" edition="rc"/>
        <vers num="0.9.1"/>
        <vers num="0.9.2"/>
        <vers num="0.9.3"/>
        <vers num="1.0" edition="preview_release"/>
        <vers num="1.0.1"/>
        <vers num="1.0.2"/>
        <vers num="1.0.3"/>
        <vers num="1.0.4"/>
        <vers num="1.0.5"/>
        <vers num="1.0.6"/>
        <vers num="1.0.7"/>
        <vers num="1.0.8"/>
        <vers num="1.5" edition="beta1"/>
        <vers num="1.5" edition="beta2"/>
        <vers num="1.5.0.1"/>
        <vers num="1.5.0.10"/>
        <vers num="1.5.0.11"/>
        <vers num="1.5.0.12"/>
        <vers num="1.5.0.2"/>
        <vers num="1.5.0.3"/>
        <vers num="1.5.0.4"/>
        <vers num="1.5.0.5"/>
        <vers num="1.5.0.6"/>
        <vers num="1.5.0.7"/>
        <vers num="1.5.0.8"/>
        <vers num="1.5.0.9"/>
        <vers num="1.5.1"/>
        <vers num="1.5.2"/>
        <vers num="1.5.3"/>
        <vers num="1.5.4"/>
        <vers num="1.5.5"/>
        <vers num="1.5.6"/>
        <vers num="1.5.7"/>
        <vers num="1.5.8"/>
        <vers num="10.0"/>
        <vers num="10.0.1"/>
        <vers num="10.0.10"/>
        <vers num="10.0.11"/>
        <vers num="10.0.12"/>
        <vers num="10.0.2"/>
        <vers num="10.0.3"/>
        <vers num="10.0.4"/>
        <vers num="10.0.5"/>
        <vers num="10.0.6"/>
        <vers num="10.0.7"/>
        <vers num="10.0.8"/>
        <vers num="10.0.9"/>
        <vers num="11.0"/>
        <vers num="12.0" edition="beta6"/>
        <vers num="13.0"/>
        <vers num="13.0.1"/>
        <vers num="14.0"/>
        <vers num="14.0.1"/>
        <vers num="15.0"/>
        <vers num="15.0.1"/>
        <vers num="16.0"/>
        <vers num="16.0.1"/>
        <vers num="16.0.2"/>
        <vers num="17.0.10"/>
        <vers num="17.0.11"/>
        <vers num="17.0.2"/>
        <vers num="17.0.3"/>
        <vers num="17.0.4"/>
        <vers num="17.0.5"/>
        <vers num="17.0.6"/>
        <vers num="17.0.7"/>
        <vers num="17.0.8"/>
        <vers num="17.0.9"/>
        <vers num="18.0"/>
        <vers num="18.0.1"/>
        <vers num="18.0.2"/>
        <vers num="19.0"/>
        <vers num="19.0.1"/>
        <vers num="19.0.2"/>
        <vers num="2.0"/>
        <vers num="2.0.0.1"/>
        <vers num="2.0.0.10"/>
        <vers num="2.0.0.11"/>
        <vers num="2.0.0.12"/>
        <vers num="2.0.0.13"/>
        <vers num="2.0.0.14"/>
        <vers num="2.0.0.15"/>
        <vers num="2.0.0.16"/>
        <vers num="2.0.0.17"/>
        <vers num="2.0.0.18"/>
        <vers num="2.0.0.19"/>
        <vers num="2.0.0.2"/>
        <vers num="2.0.0.20"/>
        <vers num="2.0.0.3"/>
        <vers num="2.0.0.4"/>
        <vers num="2.0.0.5"/>
        <vers num="2.0.0.6"/>
        <vers num="2.0.0.7"/>
        <vers num="2.0.0.8"/>
        <vers num="2.0.0.9"/>
        <vers num="20.0"/>
        <vers num="20.0.1"/>
        <vers num="21.0"/>
        <vers num="23.0"/>
        <vers num="23.0.1"/>
        <vers num="24.0"/>
        <vers num="24.1"/>
        <vers num="24.1.1"/>
        <vers num="25.0"/>
        <vers num="25.0.1"/>
        <vers prev="1" num="26.0"/>
        <vers num="3.0"/>
        <vers num="3.0.1"/>
        <vers num="3.0.10"/>
        <vers num="3.0.11"/>
        <vers num="3.0.12"/>
        <vers num="3.0.13"/>
        <vers num="3.0.14"/>
        <vers num="3.0.15"/>
        <vers num="3.0.16"/>
        <vers num="3.0.17"/>
        <vers num="3.0.18"/>
        <vers num="3.0.19"/>
        <vers num="3.0.2"/>
        <vers num="3.0.3"/>
        <vers num="3.0.4"/>
        <vers num="3.0.5"/>
        <vers num="3.0.6"/>
        <vers num="3.0.7"/>
        <vers num="3.0.8"/>
        <vers num="3.0.9"/>
        <vers num="3.5"/>
        <vers num="3.5.1"/>
        <vers num="3.5.10"/>
        <vers num="3.5.11"/>
        <vers num="3.5.12"/>
        <vers num="3.5.13"/>
        <vers num="3.5.14"/>
        <vers num="3.5.15"/>
        <vers num="3.5.16"/>
        <vers num="3.5.17"/>
        <vers num="3.5.18"/>
        <vers num="3.5.19"/>
        <vers num="3.5.2"/>
        <vers num="3.5.3"/>
        <vers num="3.5.4"/>
        <vers num="3.5.5"/>
        <vers num="3.5.6"/>
        <vers num="3.5.7"/>
        <vers num="3.5.8"/>
        <vers num="3.5.9"/>
        <vers num="3.6"/>
        <vers num="3.6.10"/>
        <vers num="3.6.11"/>
        <vers num="3.6.12"/>
        <vers num="3.6.13"/>
        <vers num="3.6.14"/>
        <vers num="3.6.15"/>
        <vers num="3.6.16"/>
        <vers num="3.6.17"/>
        <vers num="3.6.18"/>
        <vers num="3.6.19"/>
        <vers num="3.6.2"/>
        <vers num="3.6.20"/>
        <vers num="3.6.21"/>
        <vers num="3.6.22"/>
        <vers num="3.6.23"/>
        <vers num="3.6.24"/>
        <vers num="3.6.25"/>
        <vers num="3.6.26"/>
        <vers num="3.6.27"/>
        <vers num="3.6.28"/>
        <vers num="3.6.3"/>
        <vers num="3.6.4"/>
        <vers num="3.6.6"/>
        <vers num="3.6.7"/>
        <vers num="3.6.8"/>
        <vers num="3.6.9"/>
        <vers num="4.0" edition="beta1"/>
        <vers num="4.0" edition="beta10"/>
        <vers num="4.0" edition="beta11"/>
        <vers num="4.0" edition="beta12"/>
        <vers num="4.0" edition="beta2"/>
        <vers num="4.0" edition="beta3"/>
        <vers num="4.0" edition="beta4"/>
        <vers num="4.0" edition="beta5"/>
        <vers num="4.0" edition="beta6"/>
        <vers num="4.0" edition="beta7"/>
        <vers num="4.0" edition="beta8"/>
        <vers num="4.0" edition="beta9"/>
        <vers num="4.0.1"/>
        <vers num="5.0"/>
        <vers num="5.0.1"/>
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers num="6.0.2"/>
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="8.0"/>
        <vers num="8.0.1"/>
        <vers num="9.0"/>
        <vers num="9.0.1"/>
      </prod>
      <prod vendor="mozilla" name="firefox_esr">
        <vers num="24.0"/>
        <vers num="24.0.1"/>
        <vers num="24.0.2"/>
        <vers num="24.1.0"/>
        <vers num="24.1.1"/>
        <vers num="24.2"/>
      </prod>
      <prod vendor="mozilla" name="network_security_services">
        <vers num="3.11.2"/>
        <vers num="3.11.3"/>
        <vers num="3.11.4"/>
        <vers num="3.11.5"/>
        <vers num="3.12"/>
        <vers num="3.12.1"/>
        <vers num="3.12.10"/>
        <vers num="3.12.11"/>
        <vers num="3.12.2"/>
        <vers num="3.12.3"/>
        <vers num="3.12.3.1"/>
        <vers num="3.12.3.2"/>
        <vers num="3.12.4"/>
        <vers num="3.12.5"/>
        <vers num="3.12.6"/>
        <vers num="3.12.7"/>
        <vers num="3.12.8"/>
        <vers num="3.12.9"/>
        <vers num="3.14"/>
        <vers num="3.14.1"/>
        <vers num="3.14.2"/>
        <vers num="3.14.3"/>
        <vers num="3.14.4"/>
        <vers num="3.14.5"/>
        <vers num="3.15"/>
        <vers num="3.15.1"/>
        <vers num="3.15.2"/>
        <vers num="3.15.3"/>
        <vers num="3.2"/>
        <vers num="3.2.1"/>
        <vers num="3.3"/>
        <vers num="3.3.1"/>
        <vers num="3.3.2"/>
        <vers num="3.4"/>
        <vers num="3.4.1"/>
        <vers num="3.4.2"/>
        <vers num="3.5"/>
        <vers num="3.6"/>
        <vers num="3.6.1"/>
        <vers num="3.7"/>
        <vers num="3.7.1"/>
        <vers num="3.7.2"/>
        <vers num="3.7.3"/>
        <vers num="3.7.5"/>
        <vers num="3.7.7"/>
        <vers num="3.8"/>
        <vers num="3.9"/>
      </prod>
      <prod vendor="mozilla" name="seamonkey">
        <vers num="2.0" edition="alpha_1"/>
        <vers num="2.0" edition="alpha_2"/>
        <vers num="2.0" edition="alpha_3"/>
        <vers num="2.0" edition="beta_1"/>
        <vers num="2.0" edition="beta_2"/>
        <vers num="2.0" edition="rc1"/>
        <vers num="2.0" edition="rc2"/>
        <vers num="2.0.1"/>
        <vers num="2.0.10"/>
        <vers num="2.0.11"/>
        <vers num="2.0.12"/>
        <vers num="2.0.13"/>
        <vers num="2.0.14"/>
        <vers num="2.0.2"/>
        <vers num="2.0.3"/>
        <vers num="2.0.4"/>
        <vers num="2.0.5"/>
        <vers num="2.0.6"/>
        <vers num="2.0.7"/>
        <vers num="2.0.8"/>
        <vers num="2.0.9"/>
        <vers num="2.1" edition="alpha1"/>
        <vers num="2.1" edition="alpha2"/>
        <vers num="2.1" edition="alpha3"/>
        <vers num="2.1" edition="beta1"/>
        <vers num="2.1" edition="beta2"/>
        <vers num="2.1" edition="beta3"/>
        <vers num="2.1" edition="rc1"/>
        <vers num="2.1" edition="rc2"/>
        <vers num="2.10" edition="beta1"/>
        <vers num="2.10" edition="beta2"/>
        <vers num="2.10" edition="beta3"/>
        <vers num="2.10.1"/>
        <vers num="2.11" edition="beta1"/>
        <vers num="2.11" edition="beta2"/>
        <vers num="2.11" edition="beta3"/>
        <vers num="2.11" edition="beta4"/>
        <vers num="2.11" edition="beta5"/>
        <vers num="2.11" edition="beta6"/>
        <vers num="2.12" edition="beta1"/>
        <vers num="2.12" edition="beta2"/>
        <vers num="2.12" edition="beta3"/>
        <vers num="2.12" edition="beta4"/>
        <vers num="2.12" edition="beta5"/>
        <vers num="2.12" edition="beta6"/>
        <vers num="2.12.1"/>
        <vers num="2.13" edition="beta1"/>
        <vers num="2.13" edition="beta2"/>
        <vers num="2.13" edition="beta3"/>
        <vers num="2.13" edition="beta4"/>
        <vers num="2.13" edition="beta5"/>
        <vers num="2.13" edition="beta6"/>
        <vers num="2.13.1"/>
        <vers num="2.13.2"/>
        <vers num="2.14" edition="beta1"/>
        <vers num="2.14" edition="beta2"/>
        <vers num="2.14" edition="beta3"/>
        <vers num="2.14" edition="beta4"/>
        <vers num="2.14" edition="beta5"/>
        <vers num="2.15" edition="beta1"/>
        <vers num="2.15" edition="beta2"/>
        <vers num="2.15" edition="beta3"/>
        <vers num="2.15" edition="beta4"/>
        <vers num="2.15" edition="beta5"/>
        <vers num="2.15" edition="beta6"/>
        <vers num="2.15.1"/>
        <vers num="2.15.2"/>
        <vers num="2.16" edition="beta1"/>
        <vers num="2.16" edition="beta2"/>
        <vers num="2.16" edition="beta3"/>
        <vers num="2.16" edition="beta4"/>
        <vers num="2.16" edition="beta5"/>
        <vers num="2.16.1"/>
        <vers num="2.16.2"/>
        <vers num="2.17" edition="beta1"/>
        <vers num="2.17" edition="beta2"/>
        <vers num="2.17" edition="beta3"/>
        <vers num="2.17" edition="beta4"/>
        <vers num="2.17.1"/>
        <vers num="2.18" edition="beta1"/>
        <vers num="2.18" edition="beta2"/>
        <vers num="2.18" edition="beta3"/>
        <vers num="2.18" edition="beta4"/>
        <vers num="2.19" edition="beta1"/>
        <vers num="2.19" edition="beta2"/>
        <vers num="2.2" edition="beta1"/>
        <vers num="2.2" edition="beta2"/>
        <vers num="2.2" edition="beta3"/>
        <vers num="2.20" edition="beta1"/>
        <vers num="2.20" edition="beta2"/>
        <vers num="2.20" edition="beta3"/>
        <vers num="2.21" edition="beta1"/>
        <vers num="2.21" edition="beta2"/>
        <vers num="2.22" edition="beta1"/>
        <vers num="2.22" edition="beta2"/>
        <vers num="2.22.1"/>
        <vers num="2.23" edition="beta1"/>
        <vers num="2.23" edition="beta2"/>
        <vers prev="1" num="2.24" edition="beta1"/>
        <vers num="2.3" edition="beta1"/>
        <vers num="2.3" edition="beta2"/>
        <vers num="2.3" edition="beta3"/>
        <vers num="2.3.1"/>
        <vers num="2.3.2"/>
        <vers num="2.3.3"/>
        <vers num="2.4" edition="beta1"/>
        <vers num="2.4" edition="beta2"/>
        <vers num="2.4" edition="beta3"/>
        <vers num="2.4.1"/>
        <vers num="2.5" edition="beta1"/>
        <vers num="2.5" edition="beta2"/>
        <vers num="2.5" edition="beta3"/>
        <vers num="2.5" edition="beta4"/>
        <vers num="2.6" edition="beta1"/>
        <vers num="2.6" edition="beta2"/>
        <vers num="2.6" edition="beta3"/>
        <vers num="2.6" edition="beta4"/>
        <vers num="2.6.1"/>
        <vers num="2.7" edition="beta1"/>
        <vers num="2.7" edition="beta2"/>
        <vers num="2.7" edition="beta3"/>
        <vers num="2.7" edition="beta4"/>
        <vers num="2.7" edition="beta5"/>
        <vers num="2.7.1"/>
        <vers num="2.7.2"/>
        <vers num="2.8" edition="beta1"/>
        <vers num="2.8" edition="beta2"/>
        <vers num="2.8" edition="beta3"/>
        <vers num="2.8" edition="beta4"/>
        <vers num="2.8" edition="beta5"/>
        <vers num="2.8" edition="beta6"/>
        <vers num="2.9" edition="beta1"/>
        <vers num="2.9" edition="beta2"/>
        <vers num="2.9" edition="beta3"/>
        <vers num="2.9" edition="beta4"/>
        <vers num="2.9.1"/>
      </prod>
      <prod vendor="mozilla" name="thunderbird">
        <vers num="0.1"/>
        <vers num="0.2"/>
        <vers num="0.3"/>
        <vers num="0.4"/>
        <vers num="0.5"/>
        <vers num="0.6"/>
        <vers num="0.7"/>
        <vers num="0.7.1"/>
        <vers num="0.7.2"/>
        <vers num="0.7.3"/>
        <vers num="0.8"/>
        <vers num="0.9"/>
        <vers num="1.0"/>
        <vers num="1.0.1"/>
        <vers num="1.0.2"/>
        <vers num="1.0.3"/>
        <vers num="1.0.4"/>
        <vers num="1.0.5" edition="beta"/>
        <vers num="1.0.6"/>
        <vers num="1.0.7"/>
        <vers num="1.0.8"/>
        <vers num="1.5" edition="beta2"/>
        <vers num="1.5.0.1"/>
        <vers num="1.5.0.10"/>
        <vers num="1.5.0.11"/>
        <vers num="1.5.0.12"/>
        <vers num="1.5.0.13"/>
        <vers num="1.5.0.14"/>
        <vers num="1.5.0.2"/>
        <vers num="1.5.0.3"/>
        <vers num="1.5.0.4"/>
        <vers num="1.5.0.5"/>
        <vers num="1.5.0.6"/>
        <vers num="1.5.0.7"/>
        <vers num="1.5.0.8"/>
        <vers num="1.5.0.9"/>
        <vers num="1.5.1"/>
        <vers num="1.5.2"/>
        <vers num="1.7.1"/>
        <vers num="1.7.3"/>
        <vers num="10.0"/>
        <vers num="10.0.1"/>
        <vers num="10.0.2"/>
        <vers num="10.0.3"/>
        <vers num="10.0.4"/>
        <vers num="11.0"/>
        <vers num="11.0.1"/>
        <vers num="12.0"/>
        <vers num="12.0.1"/>
        <vers num="13.0"/>
        <vers num="13.0.1"/>
        <vers num="14.0"/>
        <vers num="15.0"/>
        <vers num="15.0.1"/>
        <vers num="16.0"/>
        <vers num="16.0.1"/>
        <vers num="16.0.2"/>
        <vers num="17.0"/>
        <vers num="17.0.1"/>
        <vers num="17.0.2"/>
        <vers num="17.0.3"/>
        <vers num="17.0.4"/>
        <vers num="17.0.5"/>
        <vers num="17.0.6"/>
        <vers num="17.0.7"/>
        <vers num="17.0.8"/>
        <vers num="2.0"/>
        <vers num="2.0.0.0"/>
        <vers num="2.0.0.1"/>
        <vers num="2.0.0.11"/>
        <vers num="2.0.0.12"/>
        <vers num="2.0.0.13"/>
        <vers num="2.0.0.14"/>
        <vers num="2.0.0.15"/>
        <vers num="2.0.0.16"/>
        <vers num="2.0.0.17"/>
        <vers num="2.0.0.18"/>
        <vers num="2.0.0.19"/>
        <vers num="2.0.0.2"/>
        <vers num="2.0.0.20"/>
        <vers num="2.0.0.21"/>
        <vers num="2.0.0.22"/>
        <vers num="2.0.0.23"/>
        <vers num="2.0.0.3"/>
        <vers num="2.0.0.4"/>
        <vers num="2.0.0.5"/>
        <vers num="2.0.0.6"/>
        <vers num="2.0.0.7"/>
        <vers num="2.0.0.8"/>
        <vers num="2.0.0.9"/>
        <vers num="24.0"/>
        <vers num="24.0.1"/>
        <vers num="24.1"/>
        <vers num="24.1.1"/>
        <vers prev="1" num="24.2"/>
        <vers num="3.0"/>
        <vers num="3.0.1"/>
        <vers num="3.0.10"/>
        <vers num="3.0.11"/>
        <vers num="3.0.2"/>
        <vers num="3.0.3"/>
        <vers num="3.0.4"/>
        <vers num="3.0.5"/>
        <vers num="3.0.6"/>
        <vers num="3.0.7"/>
        <vers num="3.0.8"/>
        <vers num="3.0.9"/>
        <vers num="3.1"/>
        <vers num="3.1.1"/>
        <vers num="3.1.10"/>
        <vers num="3.1.11"/>
        <vers num="3.1.12"/>
        <vers num="3.1.13"/>
        <vers num="3.1.14"/>
        <vers num="3.1.15"/>
        <vers num="3.1.16"/>
        <vers num="3.1.17"/>
        <vers num="3.1.2"/>
        <vers num="3.1.3"/>
        <vers num="3.1.4"/>
        <vers num="3.1.5"/>
        <vers num="3.1.6"/>
        <vers num="3.1.7"/>
        <vers num="3.1.8"/>
        <vers num="3.1.9"/>
        <vers num="5.0"/>
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers num="6.0.2"/>
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="8.0"/>
        <vers num="9.0"/>
        <vers num="9.0.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1491" published="2014-02-06" name="CVE-2014-1491" modified="2014-04-01" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:P/A:N)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">Mozilla Network Security Services (NSS) before 3.15.4, as used in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, SeaMonkey before 2.24, and other products, does not properly restrict public values in Diffie-Hellman key exchanges, which makes it easier for remote attackers to bypass cryptographic protection mechanisms in ticket handling by leveraging use of a certain value.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=934545" source="CONFIRM" adv="1">https://bugzilla.mozilla.org/show_bug.cgi?id=934545</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2119-1" source="UBUNTU">USN-2119-1</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2102-2" source="UBUNTU">USN-2102-2</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2102-1" source="UBUNTU">USN-2102-1</ref>
      <ref url="http://www.mozilla.org/security/announce/2014/mfsa2014-12.html" source="CONFIRM" adv="1">http://www.mozilla.org/security/announce/2014/mfsa2014-12.html</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2858" source="DEBIAN">DSA-2858</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.html" source="SUSE">openSUSE-SU-2014:0419</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00010.html" source="SUSE">SUSE-SU-2014:0248</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00005.html" source="SUSE">openSUSE-SU-2014:0213</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00004.html" source="SUSE">openSUSE-SU-2014:0212</ref>
      <ref url="http://lists.fedoraproject.org/pipermail/package-announce/2014-February/129218.html" source="FEDORA">FEDORA-2014-2083</ref>
      <ref url="http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127966.html" source="FEDORA">FEDORA-2014-2041</ref>
    </refs>
    <vuln_soft>
      <prod vendor="mozilla" name="firefox">
        <vers num="0.1"/>
        <vers num="0.10"/>
        <vers num="0.10.1"/>
        <vers num="0.2"/>
        <vers num="0.3"/>
        <vers num="0.4"/>
        <vers num="0.5"/>
        <vers num="0.6"/>
        <vers num="0.6.1"/>
        <vers num="0.7"/>
        <vers num="0.7.1"/>
        <vers num="0.8"/>
        <vers num="0.9" edition="rc"/>
        <vers num="0.9.1"/>
        <vers num="0.9.2"/>
        <vers num="0.9.3"/>
        <vers num="1.0" edition="preview_release"/>
        <vers num="1.0.1"/>
        <vers num="1.0.2"/>
        <vers num="1.0.3"/>
        <vers num="1.0.4"/>
        <vers num="1.0.5"/>
        <vers num="1.0.6"/>
        <vers num="1.0.7"/>
        <vers num="1.0.8"/>
        <vers num="1.5" edition="beta1"/>
        <vers num="1.5" edition="beta2"/>
        <vers num="1.5.0.1"/>
        <vers num="1.5.0.10"/>
        <vers num="1.5.0.11"/>
        <vers num="1.5.0.12"/>
        <vers num="1.5.0.2"/>
        <vers num="1.5.0.3"/>
        <vers num="1.5.0.4"/>
        <vers num="1.5.0.5"/>
        <vers num="1.5.0.6"/>
        <vers num="1.5.0.7"/>
        <vers num="1.5.0.8"/>
        <vers num="1.5.0.9"/>
        <vers num="1.5.1"/>
        <vers num="1.5.2"/>
        <vers num="1.5.3"/>
        <vers num="1.5.4"/>
        <vers num="1.5.5"/>
        <vers num="1.5.6"/>
        <vers num="1.5.7"/>
        <vers num="1.5.8"/>
        <vers num="10.0"/>
        <vers num="10.0.1"/>
        <vers num="10.0.10"/>
        <vers num="10.0.11"/>
        <vers num="10.0.12"/>
        <vers num="10.0.2"/>
        <vers num="10.0.3"/>
        <vers num="10.0.4"/>
        <vers num="10.0.5"/>
        <vers num="10.0.6"/>
        <vers num="10.0.7"/>
        <vers num="10.0.8"/>
        <vers num="10.0.9"/>
        <vers num="11.0"/>
        <vers num="12.0" edition="beta6"/>
        <vers num="13.0"/>
        <vers num="13.0.1"/>
        <vers num="14.0"/>
        <vers num="14.0.1"/>
        <vers num="15.0"/>
        <vers num="15.0.1"/>
        <vers num="16.0"/>
        <vers num="16.0.1"/>
        <vers num="16.0.2"/>
        <vers num="17.0.10"/>
        <vers num="17.0.11"/>
        <vers num="17.0.2"/>
        <vers num="17.0.3"/>
        <vers num="17.0.4"/>
        <vers num="17.0.5"/>
        <vers num="17.0.6"/>
        <vers num="17.0.7"/>
        <vers num="17.0.8"/>
        <vers num="17.0.9"/>
        <vers num="18.0"/>
        <vers num="18.0.1"/>
        <vers num="18.0.2"/>
        <vers num="19.0"/>
        <vers num="19.0.1"/>
        <vers num="19.0.2"/>
        <vers num="2.0"/>
        <vers num="2.0.0.1"/>
        <vers num="2.0.0.10"/>
        <vers num="2.0.0.11"/>
        <vers num="2.0.0.12"/>
        <vers num="2.0.0.13"/>
        <vers num="2.0.0.14"/>
        <vers num="2.0.0.15"/>
        <vers num="2.0.0.16"/>
        <vers num="2.0.0.17"/>
        <vers num="2.0.0.18"/>
        <vers num="2.0.0.19"/>
        <vers num="2.0.0.2"/>
        <vers num="2.0.0.20"/>
        <vers num="2.0.0.3"/>
        <vers num="2.0.0.4"/>
        <vers num="2.0.0.5"/>
        <vers num="2.0.0.6"/>
        <vers num="2.0.0.7"/>
        <vers num="2.0.0.8"/>
        <vers num="2.0.0.9"/>
        <vers num="20.0"/>
        <vers num="20.0.1"/>
        <vers num="21.0"/>
        <vers num="23.0"/>
        <vers num="23.0.1"/>
        <vers num="24.0"/>
        <vers num="24.1"/>
        <vers num="24.1.1"/>
        <vers num="25.0"/>
        <vers num="25.0.1"/>
        <vers prev="1" num="26.0"/>
        <vers num="3.0"/>
        <vers num="3.0.1"/>
        <vers num="3.0.10"/>
        <vers num="3.0.11"/>
        <vers num="3.0.12"/>
        <vers num="3.0.13"/>
        <vers num="3.0.14"/>
        <vers num="3.0.15"/>
        <vers num="3.0.16"/>
        <vers num="3.0.17"/>
        <vers num="3.0.18"/>
        <vers num="3.0.19"/>
        <vers num="3.0.2"/>
        <vers num="3.0.3"/>
        <vers num="3.0.4"/>
        <vers num="3.0.5"/>
        <vers num="3.0.6"/>
        <vers num="3.0.7"/>
        <vers num="3.0.8"/>
        <vers num="3.0.9"/>
        <vers num="3.5"/>
        <vers num="3.5.1"/>
        <vers num="3.5.10"/>
        <vers num="3.5.11"/>
        <vers num="3.5.12"/>
        <vers num="3.5.13"/>
        <vers num="3.5.14"/>
        <vers num="3.5.15"/>
        <vers num="3.5.16"/>
        <vers num="3.5.17"/>
        <vers num="3.5.18"/>
        <vers num="3.5.19"/>
        <vers num="3.5.2"/>
        <vers num="3.5.3"/>
        <vers num="3.5.4"/>
        <vers num="3.5.5"/>
        <vers num="3.5.6"/>
        <vers num="3.5.7"/>
        <vers num="3.5.8"/>
        <vers num="3.5.9"/>
        <vers num="3.6"/>
        <vers num="3.6.10"/>
        <vers num="3.6.11"/>
        <vers num="3.6.12"/>
        <vers num="3.6.13"/>
        <vers num="3.6.14"/>
        <vers num="3.6.15"/>
        <vers num="3.6.16"/>
        <vers num="3.6.17"/>
        <vers num="3.6.18"/>
        <vers num="3.6.19"/>
        <vers num="3.6.2"/>
        <vers num="3.6.20"/>
        <vers num="3.6.21"/>
        <vers num="3.6.22"/>
        <vers num="3.6.23"/>
        <vers num="3.6.24"/>
        <vers num="3.6.25"/>
        <vers num="3.6.26"/>
        <vers num="3.6.27"/>
        <vers num="3.6.28"/>
        <vers num="3.6.3"/>
        <vers num="3.6.4"/>
        <vers num="3.6.6"/>
        <vers num="3.6.7"/>
        <vers num="3.6.8"/>
        <vers num="3.6.9"/>
        <vers num="4.0" edition="beta1"/>
        <vers num="4.0" edition="beta10"/>
        <vers num="4.0" edition="beta11"/>
        <vers num="4.0" edition="beta12"/>
        <vers num="4.0" edition="beta2"/>
        <vers num="4.0" edition="beta3"/>
        <vers num="4.0" edition="beta4"/>
        <vers num="4.0" edition="beta5"/>
        <vers num="4.0" edition="beta6"/>
        <vers num="4.0" edition="beta7"/>
        <vers num="4.0" edition="beta8"/>
        <vers num="4.0" edition="beta9"/>
        <vers num="4.0.1"/>
        <vers num="5.0"/>
        <vers num="5.0.1"/>
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers num="6.0.2"/>
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="8.0"/>
        <vers num="8.0.1"/>
        <vers num="9.0"/>
        <vers num="9.0.1"/>
      </prod>
      <prod vendor="mozilla" name="firefox_esr">
        <vers num="24.0"/>
        <vers num="24.0.1"/>
        <vers num="24.0.2"/>
        <vers num="24.1.0"/>
        <vers num="24.1.1"/>
        <vers num="24.2"/>
      </prod>
      <prod vendor="mozilla" name="network_security_services">
        <vers num="3.11.2"/>
        <vers num="3.11.3"/>
        <vers num="3.11.4"/>
        <vers num="3.11.5"/>
        <vers num="3.12"/>
        <vers num="3.12.1"/>
        <vers num="3.12.10"/>
        <vers num="3.12.11"/>
        <vers num="3.12.2"/>
        <vers num="3.12.3"/>
        <vers num="3.12.3.1"/>
        <vers num="3.12.3.2"/>
        <vers num="3.12.4"/>
        <vers num="3.12.5"/>
        <vers num="3.12.6"/>
        <vers num="3.12.7"/>
        <vers num="3.12.8"/>
        <vers num="3.12.9"/>
        <vers num="3.14"/>
        <vers num="3.14.1"/>
        <vers num="3.14.2"/>
        <vers num="3.14.3"/>
        <vers num="3.14.4"/>
        <vers num="3.14.5"/>
        <vers num="3.15"/>
        <vers num="3.15.1"/>
        <vers num="3.15.2"/>
        <vers num="3.15.3"/>
        <vers num="3.2"/>
        <vers num="3.2.1"/>
        <vers num="3.3"/>
        <vers num="3.3.1"/>
        <vers num="3.3.2"/>
        <vers num="3.4"/>
        <vers num="3.4.1"/>
        <vers num="3.4.2"/>
        <vers num="3.5"/>
        <vers num="3.6"/>
        <vers num="3.6.1"/>
        <vers num="3.7"/>
        <vers num="3.7.1"/>
        <vers num="3.7.2"/>
        <vers num="3.7.3"/>
        <vers num="3.7.5"/>
        <vers num="3.7.7"/>
        <vers num="3.8"/>
        <vers num="3.9"/>
      </prod>
      <prod vendor="mozilla" name="seamonkey">
        <vers num="2.0" edition="alpha_1"/>
        <vers num="2.0" edition="alpha_2"/>
        <vers num="2.0" edition="alpha_3"/>
        <vers num="2.0" edition="beta_1"/>
        <vers num="2.0" edition="beta_2"/>
        <vers num="2.0" edition="rc1"/>
        <vers num="2.0" edition="rc2"/>
        <vers num="2.0.1"/>
        <vers num="2.0.10"/>
        <vers num="2.0.11"/>
        <vers num="2.0.12"/>
        <vers num="2.0.13"/>
        <vers num="2.0.14"/>
        <vers num="2.0.2"/>
        <vers num="2.0.3"/>
        <vers num="2.0.4"/>
        <vers num="2.0.5"/>
        <vers num="2.0.6"/>
        <vers num="2.0.7"/>
        <vers num="2.0.8"/>
        <vers num="2.0.9"/>
        <vers num="2.1" edition="alpha1"/>
        <vers num="2.1" edition="alpha2"/>
        <vers num="2.1" edition="alpha3"/>
        <vers num="2.1" edition="beta1"/>
        <vers num="2.1" edition="beta2"/>
        <vers num="2.1" edition="beta3"/>
        <vers num="2.1" edition="rc1"/>
        <vers num="2.1" edition="rc2"/>
        <vers num="2.10" edition="beta1"/>
        <vers num="2.10" edition="beta2"/>
        <vers num="2.10" edition="beta3"/>
        <vers num="2.10.1"/>
        <vers num="2.11" edition="beta1"/>
        <vers num="2.11" edition="beta2"/>
        <vers num="2.11" edition="beta3"/>
        <vers num="2.11" edition="beta4"/>
        <vers num="2.11" edition="beta5"/>
        <vers num="2.11" edition="beta6"/>
        <vers num="2.12" edition="beta1"/>
        <vers num="2.12" edition="beta2"/>
        <vers num="2.12" edition="beta3"/>
        <vers num="2.12" edition="beta4"/>
        <vers num="2.12" edition="beta5"/>
        <vers num="2.12" edition="beta6"/>
        <vers num="2.12.1"/>
        <vers num="2.13" edition="beta1"/>
        <vers num="2.13" edition="beta2"/>
        <vers num="2.13" edition="beta3"/>
        <vers num="2.13" edition="beta4"/>
        <vers num="2.13" edition="beta5"/>
        <vers num="2.13" edition="beta6"/>
        <vers num="2.13.1"/>
        <vers num="2.13.2"/>
        <vers num="2.14" edition="beta1"/>
        <vers num="2.14" edition="beta2"/>
        <vers num="2.14" edition="beta3"/>
        <vers num="2.14" edition="beta4"/>
        <vers num="2.14" edition="beta5"/>
        <vers num="2.15" edition="beta1"/>
        <vers num="2.15" edition="beta2"/>
        <vers num="2.15" edition="beta3"/>
        <vers num="2.15" edition="beta4"/>
        <vers num="2.15" edition="beta5"/>
        <vers num="2.15" edition="beta6"/>
        <vers num="2.15.1"/>
        <vers num="2.15.2"/>
        <vers num="2.16" edition="beta1"/>
        <vers num="2.16" edition="beta2"/>
        <vers num="2.16" edition="beta3"/>
        <vers num="2.16" edition="beta4"/>
        <vers num="2.16" edition="beta5"/>
        <vers num="2.16.1"/>
        <vers num="2.16.2"/>
        <vers num="2.17" edition="beta1"/>
        <vers num="2.17" edition="beta2"/>
        <vers num="2.17" edition="beta3"/>
        <vers num="2.17" edition="beta4"/>
        <vers num="2.17.1"/>
        <vers num="2.18" edition="beta1"/>
        <vers num="2.18" edition="beta2"/>
        <vers num="2.18" edition="beta3"/>
        <vers num="2.18" edition="beta4"/>
        <vers num="2.19" edition="beta1"/>
        <vers num="2.19" edition="beta2"/>
        <vers num="2.2" edition="beta1"/>
        <vers num="2.2" edition="beta2"/>
        <vers num="2.2" edition="beta3"/>
        <vers num="2.20" edition="beta1"/>
        <vers num="2.20" edition="beta2"/>
        <vers num="2.20" edition="beta3"/>
        <vers num="2.21" edition="beta1"/>
        <vers num="2.21" edition="beta2"/>
        <vers num="2.22" edition="beta1"/>
        <vers num="2.22" edition="beta2"/>
        <vers num="2.22.1"/>
        <vers num="2.23" edition="beta1"/>
        <vers num="2.23" edition="beta2"/>
        <vers prev="1" num="2.24" edition="beta1"/>
        <vers num="2.3" edition="beta1"/>
        <vers num="2.3" edition="beta2"/>
        <vers num="2.3" edition="beta3"/>
        <vers num="2.3.1"/>
        <vers num="2.3.2"/>
        <vers num="2.3.3"/>
        <vers num="2.4" edition="beta1"/>
        <vers num="2.4" edition="beta2"/>
        <vers num="2.4" edition="beta3"/>
        <vers num="2.4.1"/>
        <vers num="2.5" edition="beta1"/>
        <vers num="2.5" edition="beta2"/>
        <vers num="2.5" edition="beta3"/>
        <vers num="2.5" edition="beta4"/>
        <vers num="2.6" edition="beta1"/>
        <vers num="2.6" edition="beta2"/>
        <vers num="2.6" edition="beta3"/>
        <vers num="2.6" edition="beta4"/>
        <vers num="2.6.1"/>
        <vers num="2.7" edition="beta1"/>
        <vers num="2.7" edition="beta2"/>
        <vers num="2.7" edition="beta3"/>
        <vers num="2.7" edition="beta4"/>
        <vers num="2.7" edition="beta5"/>
        <vers num="2.7.1"/>
        <vers num="2.7.2"/>
        <vers num="2.8" edition="beta1"/>
        <vers num="2.8" edition="beta2"/>
        <vers num="2.8" edition="beta3"/>
        <vers num="2.8" edition="beta4"/>
        <vers num="2.8" edition="beta5"/>
        <vers num="2.8" edition="beta6"/>
        <vers num="2.9" edition="beta1"/>
        <vers num="2.9" edition="beta2"/>
        <vers num="2.9" edition="beta3"/>
        <vers num="2.9" edition="beta4"/>
        <vers num="2.9.1"/>
      </prod>
      <prod vendor="mozilla" name="thunderbird">
        <vers num="0.1"/>
        <vers num="0.2"/>
        <vers num="0.3"/>
        <vers num="0.4"/>
        <vers num="0.5"/>
        <vers num="0.6"/>
        <vers num="0.7"/>
        <vers num="0.7.1"/>
        <vers num="0.7.2"/>
        <vers num="0.7.3"/>
        <vers num="0.8"/>
        <vers num="0.9"/>
        <vers num="1.0"/>
        <vers num="1.0.1"/>
        <vers num="1.0.2"/>
        <vers num="1.0.3"/>
        <vers num="1.0.4"/>
        <vers num="1.0.5" edition="beta"/>
        <vers num="1.0.6"/>
        <vers num="1.0.7"/>
        <vers num="1.0.8"/>
        <vers num="1.5" edition="beta2"/>
        <vers num="1.5.0.1"/>
        <vers num="1.5.0.10"/>
        <vers num="1.5.0.11"/>
        <vers num="1.5.0.12"/>
        <vers num="1.5.0.13"/>
        <vers num="1.5.0.14"/>
        <vers num="1.5.0.2"/>
        <vers num="1.5.0.3"/>
        <vers num="1.5.0.4"/>
        <vers num="1.5.0.5"/>
        <vers num="1.5.0.6"/>
        <vers num="1.5.0.7"/>
        <vers num="1.5.0.8"/>
        <vers num="1.5.0.9"/>
        <vers num="1.5.1"/>
        <vers num="1.5.2"/>
        <vers num="1.7.1"/>
        <vers num="1.7.3"/>
        <vers num="10.0"/>
        <vers num="10.0.1"/>
        <vers num="10.0.2"/>
        <vers num="10.0.3"/>
        <vers num="10.0.4"/>
        <vers num="11.0"/>
        <vers num="11.0.1"/>
        <vers num="12.0"/>
        <vers num="12.0.1"/>
        <vers num="13.0"/>
        <vers num="13.0.1"/>
        <vers num="14.0"/>
        <vers num="15.0"/>
        <vers num="15.0.1"/>
        <vers num="16.0"/>
        <vers num="16.0.1"/>
        <vers num="16.0.2"/>
        <vers num="17.0"/>
        <vers num="17.0.1"/>
        <vers num="17.0.2"/>
        <vers num="17.0.3"/>
        <vers num="17.0.4"/>
        <vers num="17.0.5"/>
        <vers num="17.0.6"/>
        <vers num="17.0.7"/>
        <vers num="17.0.8"/>
        <vers num="2.0"/>
        <vers num="2.0.0.0"/>
        <vers num="2.0.0.1"/>
        <vers num="2.0.0.11"/>
        <vers num="2.0.0.12"/>
        <vers num="2.0.0.13"/>
        <vers num="2.0.0.14"/>
        <vers num="2.0.0.15"/>
        <vers num="2.0.0.16"/>
        <vers num="2.0.0.17"/>
        <vers num="2.0.0.18"/>
        <vers num="2.0.0.19"/>
        <vers num="2.0.0.2"/>
        <vers num="2.0.0.20"/>
        <vers num="2.0.0.21"/>
        <vers num="2.0.0.22"/>
        <vers num="2.0.0.23"/>
        <vers num="2.0.0.3"/>
        <vers num="2.0.0.4"/>
        <vers num="2.0.0.5"/>
        <vers num="2.0.0.6"/>
        <vers num="2.0.0.7"/>
        <vers num="2.0.0.8"/>
        <vers num="2.0.0.9"/>
        <vers num="24.0"/>
        <vers num="24.0.1"/>
        <vers num="24.1"/>
        <vers num="24.1.1"/>
        <vers prev="1" num="24.2"/>
        <vers num="3.0"/>
        <vers num="3.0.1"/>
        <vers num="3.0.10"/>
        <vers num="3.0.11"/>
        <vers num="3.0.2"/>
        <vers num="3.0.3"/>
        <vers num="3.0.4"/>
        <vers num="3.0.5"/>
        <vers num="3.0.6"/>
        <vers num="3.0.7"/>
        <vers num="3.0.8"/>
        <vers num="3.0.9"/>
        <vers num="3.1"/>
        <vers num="3.1.1"/>
        <vers num="3.1.10"/>
        <vers num="3.1.11"/>
        <vers num="3.1.12"/>
        <vers num="3.1.13"/>
        <vers num="3.1.14"/>
        <vers num="3.1.15"/>
        <vers num="3.1.16"/>
        <vers num="3.1.17"/>
        <vers num="3.1.2"/>
        <vers num="3.1.3"/>
        <vers num="3.1.4"/>
        <vers num="3.1.5"/>
        <vers num="3.1.6"/>
        <vers num="3.1.7"/>
        <vers num="3.1.8"/>
        <vers num="3.1.9"/>
        <vers num="5.0"/>
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers num="6.0.2"/>
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="8.0"/>
        <vers num="9.0"/>
        <vers num="9.0.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1492" published="2014-03-25" name="CVE-2014-1492" modified="2014-04-19" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">The cert_TestHostName function in lib/certdb/certdb.c in the certificate-checking implementation in Mozilla Network Security Services (NSS) before 3.16 accepts a wildcard character that is embedded in an internationalized domain name's U-label, which might allow man-in-the-middle attackers to spoof SSL servers via a crafted certificate.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://hg.mozilla.org/projects/nss/rev/709d4e597979" source="CONFIRM" patch="1">https://hg.mozilla.org/projects/nss/rev/709d4e597979</ref>
      <ref url="https://developer.mozilla.org/en-US/docs/NSS/NSS_3.16_release_notes" source="CONFIRM">https://developer.mozilla.org/en-US/docs/NSS/NSS_3.16_release_notes</ref>
      <ref url="https://bugzilla.redhat.com/show_bug.cgi?id=1079851" source="CONFIRM">https://bugzilla.redhat.com/show_bug.cgi?id=1079851</ref>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=903885" source="CONFIRM">https://bugzilla.mozilla.org/show_bug.cgi?id=903885</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2159-1" source="UBUNTU">USN-2159-1</ref>
    </refs>
    <vuln_soft>
      <prod vendor="mozilla" name="network_security_services">
        <vers num="3.11.2"/>
        <vers num="3.11.3"/>
        <vers num="3.11.4"/>
        <vers num="3.11.5"/>
        <vers num="3.12"/>
        <vers num="3.12.1"/>
        <vers num="3.12.10"/>
        <vers num="3.12.11"/>
        <vers num="3.12.2"/>
        <vers num="3.12.3"/>
        <vers num="3.12.3.1"/>
        <vers num="3.12.3.2"/>
        <vers num="3.12.4"/>
        <vers num="3.12.5"/>
        <vers num="3.12.6"/>
        <vers num="3.12.7"/>
        <vers num="3.12.8"/>
        <vers num="3.12.9"/>
        <vers num="3.14"/>
        <vers num="3.14.1"/>
        <vers num="3.14.2"/>
        <vers num="3.14.3"/>
        <vers num="3.14.4"/>
        <vers num="3.14.5"/>
        <vers num="3.15"/>
        <vers num="3.15.1"/>
        <vers num="3.15.2"/>
        <vers num="3.15.3"/>
        <vers num="3.15.3.1"/>
        <vers num="3.15.4"/>
        <vers prev="1" num="3.15.5"/>
        <vers num="3.2"/>
        <vers num="3.2.1"/>
        <vers num="3.3"/>
        <vers num="3.3.1"/>
        <vers num="3.3.2"/>
        <vers num="3.4"/>
        <vers num="3.4.1"/>
        <vers num="3.4.2"/>
        <vers num="3.5"/>
        <vers num="3.6"/>
        <vers num="3.6.1"/>
        <vers num="3.7"/>
        <vers num="3.7.1"/>
        <vers num="3.7.2"/>
        <vers num="3.7.3"/>
        <vers num="3.7.5"/>
        <vers num="3.7.7"/>
        <vers num="3.8"/>
        <vers num="3.9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1493" published="2014-03-19" name="CVE-2014-1493" modified="2014-04-01" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=977538" source="CONFIRM">https://bugzilla.mozilla.org/show_bug.cgi?id=977538</ref>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=967341" source="CONFIRM">https://bugzilla.mozilla.org/show_bug.cgi?id=967341</ref>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=965982" source="CONFIRM">https://bugzilla.mozilla.org/show_bug.cgi?id=965982</ref>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=963974" source="CONFIRM">https://bugzilla.mozilla.org/show_bug.cgi?id=963974</ref>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=960145" source="CONFIRM">https://bugzilla.mozilla.org/show_bug.cgi?id=960145</ref>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=958867" source="CONFIRM">https://bugzilla.mozilla.org/show_bug.cgi?id=958867</ref>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=896268" source="CONFIRM">https://bugzilla.mozilla.org/show_bug.cgi?id=896268</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2151-1" source="UBUNTU">USN-2151-1</ref>
      <ref url="http://www.mozilla.org/security/announce/2014/mfsa2014-15.html" source="CONFIRM" adv="1">http://www.mozilla.org/security/announce/2014/mfsa2014-15.html</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2881" source="DEBIAN">DSA-2881</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0316.html" source="REDHAT">RHSA-2014:0316</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0310.html" source="REDHAT">RHSA-2014:0310</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00022.html" source="SUSE">openSUSE-SU-2014:0448</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.html" source="SUSE">openSUSE-SU-2014:0419</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00016.html" source="SUSE">SUSE-SU-2014:0418</ref>
    </refs>
    <vuln_soft>
      <prod vendor="mozilla" name="firefox">
        <vers num="0.1"/>
        <vers num="0.10"/>
        <vers num="0.10.1"/>
        <vers num="0.2"/>
        <vers num="0.3"/>
        <vers num="0.4"/>
        <vers num="0.5"/>
        <vers num="0.6"/>
        <vers num="0.6.1"/>
        <vers num="0.7"/>
        <vers num="0.7.1"/>
        <vers num="0.8"/>
        <vers num="0.9" edition="rc"/>
        <vers num="0.9.1"/>
        <vers num="0.9.2"/>
        <vers num="0.9.3"/>
        <vers num="1.0" edition="preview_release"/>
        <vers num="1.0.1"/>
        <vers num="1.0.2"/>
        <vers num="1.0.3"/>
        <vers num="1.0.4"/>
        <vers num="1.0.5"/>
        <vers num="1.0.6"/>
        <vers num="1.0.7"/>
        <vers num="1.0.8"/>
        <vers num="1.5" edition="beta1"/>
        <vers num="1.5" edition="beta2"/>
        <vers num="1.5.0.1"/>
        <vers num="1.5.0.10"/>
        <vers num="1.5.0.11"/>
        <vers num="1.5.0.12"/>
        <vers num="1.5.0.2"/>
        <vers num="1.5.0.3"/>
        <vers num="1.5.0.4"/>
        <vers num="1.5.0.5"/>
        <vers num="1.5.0.6"/>
        <vers num="1.5.0.7"/>
        <vers num="1.5.0.8"/>
        <vers num="1.5.0.9"/>
        <vers num="1.5.1"/>
        <vers num="1.5.2"/>
        <vers num="1.5.3"/>
        <vers num="1.5.4"/>
        <vers num="1.5.5"/>
        <vers num="1.5.6"/>
        <vers num="1.5.7"/>
        <vers num="1.5.8"/>
        <vers num="10.0"/>
        <vers num="10.0.1"/>
        <vers num="10.0.10"/>
        <vers num="10.0.11"/>
        <vers num="10.0.12"/>
        <vers num="10.0.2"/>
        <vers num="10.0.3"/>
        <vers num="10.0.4"/>
        <vers num="10.0.5"/>
        <vers num="10.0.6"/>
        <vers num="10.0.7"/>
        <vers num="10.0.8"/>
        <vers num="10.0.9"/>
        <vers num="11.0"/>
        <vers num="12.0" edition="beta6"/>
        <vers num="13.0"/>
        <vers num="13.0.1"/>
        <vers num="14.0"/>
        <vers num="14.0.1"/>
        <vers num="15.0"/>
        <vers num="15.0.1"/>
        <vers num="16.0"/>
        <vers num="16.0.1"/>
        <vers num="16.0.2"/>
        <vers num="17.0.10"/>
        <vers num="17.0.11"/>
        <vers num="17.0.2"/>
        <vers num="17.0.3"/>
        <vers num="17.0.4"/>
        <vers num="17.0.5"/>
        <vers num="17.0.6"/>
        <vers num="17.0.7"/>
        <vers num="17.0.8"/>
        <vers num="17.0.9"/>
        <vers num="18.0"/>
        <vers num="18.0.1"/>
        <vers num="18.0.2"/>
        <vers num="19.0"/>
        <vers num="19.0.1"/>
        <vers num="19.0.2"/>
        <vers num="2.0"/>
        <vers num="2.0.0.1"/>
        <vers num="2.0.0.10"/>
        <vers num="2.0.0.11"/>
        <vers num="2.0.0.12"/>
        <vers num="2.0.0.13"/>
        <vers num="2.0.0.14"/>
        <vers num="2.0.0.15"/>
        <vers num="2.0.0.16"/>
        <vers num="2.0.0.17"/>
        <vers num="2.0.0.18"/>
        <vers num="2.0.0.19"/>
        <vers num="2.0.0.2"/>
        <vers num="2.0.0.20"/>
        <vers num="2.0.0.3"/>
        <vers num="2.0.0.4"/>
        <vers num="2.0.0.5"/>
        <vers num="2.0.0.6"/>
        <vers num="2.0.0.7"/>
        <vers num="2.0.0.8"/>
        <vers num="2.0.0.9"/>
        <vers num="20.0"/>
        <vers num="20.0.1"/>
        <vers num="21.0"/>
        <vers num="23.0"/>
        <vers num="23.0.1"/>
        <vers num="24.0"/>
        <vers num="24.1"/>
        <vers num="24.1.1"/>
        <vers num="25.0"/>
        <vers num="25.0.1"/>
        <vers num="26.0"/>
        <vers num="27.0"/>
        <vers prev="1" num="27.0.1"/>
        <vers num="3.0"/>
        <vers num="3.0.1"/>
        <vers num="3.0.10"/>
        <vers num="3.0.11"/>
        <vers num="3.0.12"/>
        <vers num="3.0.13"/>
        <vers num="3.0.14"/>
        <vers num="3.0.15"/>
        <vers num="3.0.16"/>
        <vers num="3.0.17"/>
        <vers num="3.0.18"/>
        <vers num="3.0.19"/>
        <vers num="3.0.2"/>
        <vers num="3.0.3"/>
        <vers num="3.0.4"/>
        <vers num="3.0.5"/>
        <vers num="3.0.6"/>
        <vers num="3.0.7"/>
        <vers num="3.0.8"/>
        <vers num="3.0.9"/>
        <vers num="3.5"/>
        <vers num="3.5.1"/>
        <vers num="3.5.10"/>
        <vers num="3.5.11"/>
        <vers num="3.5.12"/>
        <vers num="3.5.13"/>
        <vers num="3.5.14"/>
        <vers num="3.5.15"/>
        <vers num="3.5.16"/>
        <vers num="3.5.17"/>
        <vers num="3.5.18"/>
        <vers num="3.5.19"/>
        <vers num="3.5.2"/>
        <vers num="3.5.3"/>
        <vers num="3.5.4"/>
        <vers num="3.5.5"/>
        <vers num="3.5.6"/>
        <vers num="3.5.7"/>
        <vers num="3.5.8"/>
        <vers num="3.5.9"/>
        <vers num="3.6"/>
        <vers num="3.6.10"/>
        <vers num="3.6.11"/>
        <vers num="3.6.12"/>
        <vers num="3.6.13"/>
        <vers num="3.6.14"/>
        <vers num="3.6.15"/>
        <vers num="3.6.16"/>
        <vers num="3.6.17"/>
        <vers num="3.6.18"/>
        <vers num="3.6.19"/>
        <vers num="3.6.2"/>
        <vers num="3.6.20"/>
        <vers num="3.6.21"/>
        <vers num="3.6.22"/>
        <vers num="3.6.23"/>
        <vers num="3.6.24"/>
        <vers num="3.6.25"/>
        <vers num="3.6.26"/>
        <vers num="3.6.27"/>
        <vers num="3.6.28"/>
        <vers num="3.6.3"/>
        <vers num="3.6.4"/>
        <vers num="3.6.6"/>
        <vers num="3.6.7"/>
        <vers num="3.6.8"/>
        <vers num="3.6.9"/>
        <vers num="4.0" edition="beta1"/>
        <vers num="4.0" edition="beta10"/>
        <vers num="4.0" edition="beta11"/>
        <vers num="4.0" edition="beta12"/>
        <vers num="4.0" edition="beta2"/>
        <vers num="4.0" edition="beta3"/>
        <vers num="4.0" edition="beta4"/>
        <vers num="4.0" edition="beta5"/>
        <vers num="4.0" edition="beta6"/>
        <vers num="4.0" edition="beta7"/>
        <vers num="4.0" edition="beta8"/>
        <vers num="4.0" edition="beta9"/>
        <vers num="4.0.1"/>
        <vers num="5.0"/>
        <vers num="5.0.1"/>
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers num="6.0.2"/>
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="8.0"/>
        <vers num="8.0.1"/>
        <vers num="9.0"/>
        <vers num="9.0.1"/>
      </prod>
      <prod vendor="mozilla" name="firefox_esr">
        <vers num="24.0"/>
        <vers num="24.0.1"/>
        <vers num="24.0.2"/>
        <vers num="24.1.0"/>
        <vers num="24.1.1"/>
        <vers num="24.2"/>
        <vers num="24.3"/>
      </prod>
      <prod vendor="mozilla" name="seamonkey">
        <vers num="2.0" edition="alpha_1"/>
        <vers num="2.0" edition="alpha_2"/>
        <vers num="2.0" edition="alpha_3"/>
        <vers num="2.0" edition="beta_1"/>
        <vers num="2.0" edition="beta_2"/>
        <vers num="2.0" edition="rc1"/>
        <vers num="2.0" edition="rc2"/>
        <vers num="2.0.1"/>
        <vers num="2.0.10"/>
        <vers num="2.0.11"/>
        <vers num="2.0.12"/>
        <vers num="2.0.13"/>
        <vers num="2.0.14"/>
        <vers num="2.0.2"/>
        <vers num="2.0.3"/>
        <vers num="2.0.4"/>
        <vers num="2.0.5"/>
        <vers num="2.0.6"/>
        <vers num="2.0.7"/>
        <vers num="2.0.8"/>
        <vers num="2.0.9"/>
        <vers num="2.1" edition="alpha1"/>
        <vers num="2.1" edition="alpha2"/>
        <vers num="2.1" edition="alpha3"/>
        <vers num="2.1" edition="beta1"/>
        <vers num="2.1" edition="beta2"/>
        <vers num="2.1" edition="beta3"/>
        <vers num="2.1" edition="rc1"/>
        <vers num="2.1" edition="rc2"/>
        <vers num="2.10" edition="beta1"/>
        <vers num="2.10" edition="beta2"/>
        <vers num="2.10" edition="beta3"/>
        <vers num="2.10.1"/>
        <vers num="2.11" edition="beta1"/>
        <vers num="2.11" edition="beta2"/>
        <vers num="2.11" edition="beta3"/>
        <vers num="2.11" edition="beta4"/>
        <vers num="2.11" edition="beta5"/>
        <vers num="2.11" edition="beta6"/>
        <vers num="2.12" edition="beta1"/>
        <vers num="2.12" edition="beta2"/>
        <vers num="2.12" edition="beta3"/>
        <vers num="2.12" edition="beta4"/>
        <vers num="2.12" edition="beta5"/>
        <vers num="2.12" edition="beta6"/>
        <vers num="2.12.1"/>
        <vers num="2.13" edition="beta1"/>
        <vers num="2.13" edition="beta2"/>
        <vers num="2.13" edition="beta3"/>
        <vers num="2.13" edition="beta4"/>
        <vers num="2.13" edition="beta5"/>
        <vers num="2.13" edition="beta6"/>
        <vers num="2.13.1"/>
        <vers num="2.13.2"/>
        <vers num="2.14" edition="beta1"/>
        <vers num="2.14" edition="beta2"/>
        <vers num="2.14" edition="beta3"/>
        <vers num="2.14" edition="beta4"/>
        <vers num="2.14" edition="beta5"/>
        <vers num="2.15" edition="beta1"/>
        <vers num="2.15" edition="beta2"/>
        <vers num="2.15" edition="beta3"/>
        <vers num="2.15" edition="beta4"/>
        <vers num="2.15" edition="beta5"/>
        <vers num="2.15" edition="beta6"/>
        <vers num="2.15.1"/>
        <vers num="2.15.2"/>
        <vers num="2.16" edition="beta1"/>
        <vers num="2.16" edition="beta2"/>
        <vers num="2.16" edition="beta3"/>
        <vers num="2.16" edition="beta4"/>
        <vers num="2.16" edition="beta5"/>
        <vers num="2.16.1"/>
        <vers num="2.16.2"/>
        <vers num="2.17" edition="beta1"/>
        <vers num="2.17" edition="beta2"/>
        <vers num="2.17" edition="beta3"/>
        <vers num="2.17" edition="beta4"/>
        <vers num="2.17.1"/>
        <vers num="2.18" edition="beta1"/>
        <vers num="2.18" edition="beta2"/>
        <vers num="2.18" edition="beta3"/>
        <vers num="2.18" edition="beta4"/>
        <vers num="2.19" edition="beta1"/>
        <vers num="2.19" edition="beta2"/>
        <vers num="2.2" edition="beta1"/>
        <vers num="2.2" edition="beta2"/>
        <vers num="2.2" edition="beta3"/>
        <vers num="2.20" edition="beta1"/>
        <vers num="2.20" edition="beta2"/>
        <vers num="2.20" edition="beta3"/>
        <vers num="2.21" edition="beta1"/>
        <vers num="2.21" edition="beta2"/>
        <vers num="2.22" edition="beta1"/>
        <vers num="2.22" edition="beta2"/>
        <vers num="2.22.1"/>
        <vers num="2.23" edition="beta1"/>
        <vers num="2.23" edition="beta2"/>
        <vers num="2.24" edition="beta1"/>
        <vers prev="1" num="2.25" edition="beta1"/>
        <vers prev="1" num="2.25" edition="beta2"/>
        <vers num="2.3" edition="beta1"/>
        <vers num="2.3" edition="beta2"/>
        <vers num="2.3" edition="beta3"/>
        <vers num="2.3.1"/>
        <vers num="2.3.2"/>
        <vers num="2.3.3"/>
        <vers num="2.4" edition="beta1"/>
        <vers num="2.4" edition="beta2"/>
        <vers num="2.4" edition="beta3"/>
        <vers num="2.4.1"/>
        <vers num="2.5" edition="beta1"/>
        <vers num="2.5" edition="beta2"/>
        <vers num="2.5" edition="beta3"/>
        <vers num="2.5" edition="beta4"/>
        <vers num="2.6" edition="beta1"/>
        <vers num="2.6" edition="beta2"/>
        <vers num="2.6" edition="beta3"/>
        <vers num="2.6" edition="beta4"/>
        <vers num="2.6.1"/>
        <vers num="2.7" edition="beta1"/>
        <vers num="2.7" edition="beta2"/>
        <vers num="2.7" edition="beta3"/>
        <vers num="2.7" edition="beta4"/>
        <vers num="2.7" edition="beta5"/>
        <vers num="2.7.1"/>
        <vers num="2.7.2"/>
        <vers num="2.8" edition="beta1"/>
        <vers num="2.8" edition="beta2"/>
        <vers num="2.8" edition="beta3"/>
        <vers num="2.8" edition="beta4"/>
        <vers num="2.8" edition="beta5"/>
        <vers num="2.8" edition="beta6"/>
        <vers num="2.9" edition="beta1"/>
        <vers num="2.9" edition="beta2"/>
        <vers num="2.9" edition="beta3"/>
        <vers num="2.9" edition="beta4"/>
        <vers num="2.9.1"/>
      </prod>
      <prod vendor="mozilla" name="thunderbird">
        <vers num="0.1"/>
        <vers num="0.2"/>
        <vers num="0.3"/>
        <vers num="0.4"/>
        <vers num="0.5"/>
        <vers num="0.6"/>
        <vers num="0.7"/>
        <vers num="0.7.1"/>
        <vers num="0.7.2"/>
        <vers num="0.7.3"/>
        <vers num="0.8"/>
        <vers num="0.9"/>
        <vers num="1.0"/>
        <vers num="1.0.1"/>
        <vers num="1.0.2"/>
        <vers num="1.0.3"/>
        <vers num="1.0.4"/>
        <vers num="1.0.5" edition="beta"/>
        <vers num="1.0.6"/>
        <vers num="1.0.7"/>
        <vers num="1.0.8"/>
        <vers num="1.5" edition="beta2"/>
        <vers num="1.5.0.1"/>
        <vers num="1.5.0.10"/>
        <vers num="1.5.0.11"/>
        <vers num="1.5.0.12"/>
        <vers num="1.5.0.13"/>
        <vers num="1.5.0.14"/>
        <vers num="1.5.0.2"/>
        <vers num="1.5.0.3"/>
        <vers num="1.5.0.4"/>
        <vers num="1.5.0.5"/>
        <vers num="1.5.0.6"/>
        <vers num="1.5.0.7"/>
        <vers num="1.5.0.8"/>
        <vers num="1.5.0.9"/>
        <vers num="1.5.1"/>
        <vers num="1.5.2"/>
        <vers num="1.7.1"/>
        <vers num="1.7.3"/>
        <vers num="10.0"/>
        <vers num="10.0.1"/>
        <vers num="10.0.2"/>
        <vers num="10.0.3"/>
        <vers num="10.0.4"/>
        <vers num="11.0"/>
        <vers num="11.0.1"/>
        <vers num="12.0"/>
        <vers num="12.0.1"/>
        <vers num="13.0"/>
        <vers num="13.0.1"/>
        <vers num="14.0"/>
        <vers num="15.0"/>
        <vers num="15.0.1"/>
        <vers num="16.0"/>
        <vers num="16.0.1"/>
        <vers num="16.0.2"/>
        <vers num="17.0"/>
        <vers num="17.0.1"/>
        <vers num="17.0.2"/>
        <vers num="17.0.3"/>
        <vers num="17.0.4"/>
        <vers num="17.0.5"/>
        <vers num="17.0.6"/>
        <vers num="17.0.7"/>
        <vers num="17.0.8"/>
        <vers num="2.0"/>
        <vers num="2.0.0.0"/>
        <vers num="2.0.0.1"/>
        <vers num="2.0.0.11"/>
        <vers num="2.0.0.12"/>
        <vers num="2.0.0.13"/>
        <vers num="2.0.0.14"/>
        <vers num="2.0.0.15"/>
        <vers num="2.0.0.16"/>
        <vers num="2.0.0.17"/>
        <vers num="2.0.0.18"/>
        <vers num="2.0.0.19"/>
        <vers num="2.0.0.2"/>
        <vers num="2.0.0.20"/>
        <vers num="2.0.0.21"/>
        <vers num="2.0.0.22"/>
        <vers num="2.0.0.23"/>
        <vers num="2.0.0.3"/>
        <vers num="2.0.0.4"/>
        <vers num="2.0.0.5"/>
        <vers num="2.0.0.6"/>
        <vers num="2.0.0.7"/>
        <vers num="2.0.0.8"/>
        <vers num="2.0.0.9"/>
        <vers num="24.0"/>
        <vers num="24.0.1"/>
        <vers num="24.1"/>
        <vers num="24.1.1"/>
        <vers num="24.2"/>
        <vers prev="1" num="24.3"/>
        <vers num="3.0"/>
        <vers num="3.0.1"/>
        <vers num="3.0.10"/>
        <vers num="3.0.11"/>
        <vers num="3.0.2"/>
        <vers num="3.0.3"/>
        <vers num="3.0.4"/>
        <vers num="3.0.5"/>
        <vers num="3.0.6"/>
        <vers num="3.0.7"/>
        <vers num="3.0.8"/>
        <vers num="3.0.9"/>
        <vers num="3.1"/>
        <vers num="3.1.1"/>
        <vers num="3.1.10"/>
        <vers num="3.1.11"/>
        <vers num="3.1.12"/>
        <vers num="3.1.13"/>
        <vers num="3.1.14"/>
        <vers num="3.1.15"/>
        <vers num="3.1.16"/>
        <vers num="3.1.17"/>
        <vers num="3.1.2"/>
        <vers num="3.1.3"/>
        <vers num="3.1.4"/>
        <vers num="3.1.5"/>
        <vers num="3.1.6"/>
        <vers num="3.1.7"/>
        <vers num="3.1.8"/>
        <vers num="3.1.9"/>
        <vers num="5.0"/>
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers num="6.0.2"/>
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="8.0"/>
        <vers num="9.0"/>
        <vers num="9.0.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1494" published="2014-03-19" name="CVE-2014-1494" modified="2014-04-01" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 28.0 and SeaMonkey before 2.25 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=964462" source="CONFIRM">https://bugzilla.mozilla.org/show_bug.cgi?id=964462</ref>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=949843" source="CONFIRM">https://bugzilla.mozilla.org/show_bug.cgi?id=949843</ref>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=938626" source="CONFIRM">https://bugzilla.mozilla.org/show_bug.cgi?id=938626</ref>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=938615" source="CONFIRM">https://bugzilla.mozilla.org/show_bug.cgi?id=938615</ref>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=933219" source="CONFIRM">https://bugzilla.mozilla.org/show_bug.cgi?id=933219</ref>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=932496" source="CONFIRM">https://bugzilla.mozilla.org/show_bug.cgi?id=932496</ref>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=927579" source="CONFIRM">https://bugzilla.mozilla.org/show_bug.cgi?id=927579</ref>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=909586" source="CONFIRM">https://bugzilla.mozilla.org/show_bug.cgi?id=909586</ref>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=627295" source="CONFIRM">https://bugzilla.mozilla.org/show_bug.cgi?id=627295</ref>
      <ref url="http://www.mozilla.org/security/announce/2014/mfsa2014-15.html" source="CONFIRM" adv="1">http://www.mozilla.org/security/announce/2014/mfsa2014-15.html</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00022.html" source="SUSE">openSUSE-SU-2014:0448</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.html" source="SUSE">openSUSE-SU-2014:0419</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00016.html" source="SUSE">SUSE-SU-2014:0418</ref>
    </refs>
    <vuln_soft>
      <prod vendor="mozilla" name="firefox">
        <vers num="0.1"/>
        <vers num="0.10"/>
        <vers num="0.10.1"/>
        <vers num="0.2"/>
        <vers num="0.3"/>
        <vers num="0.4"/>
        <vers num="0.5"/>
        <vers num="0.6"/>
        <vers num="0.6.1"/>
        <vers num="0.7"/>
        <vers num="0.7.1"/>
        <vers num="0.8"/>
        <vers num="0.9" edition="rc"/>
        <vers num="0.9.1"/>
        <vers num="0.9.2"/>
        <vers num="0.9.3"/>
        <vers num="1.0" edition="preview_release"/>
        <vers num="1.0.1"/>
        <vers num="1.0.2"/>
        <vers num="1.0.3"/>
        <vers num="1.0.4"/>
        <vers num="1.0.5"/>
        <vers num="1.0.6"/>
        <vers num="1.0.7"/>
        <vers num="1.0.8"/>
        <vers num="1.5" edition="beta1"/>
        <vers num="1.5" edition="beta2"/>
        <vers num="1.5.0.1"/>
        <vers num="1.5.0.10"/>
        <vers num="1.5.0.11"/>
        <vers num="1.5.0.12"/>
        <vers num="1.5.0.2"/>
        <vers num="1.5.0.3"/>
        <vers num="1.5.0.4"/>
        <vers num="1.5.0.5"/>
        <vers num="1.5.0.6"/>
        <vers num="1.5.0.7"/>
        <vers num="1.5.0.8"/>
        <vers num="1.5.0.9"/>
        <vers num="1.5.1"/>
        <vers num="1.5.2"/>
        <vers num="1.5.3"/>
        <vers num="1.5.4"/>
        <vers num="1.5.5"/>
        <vers num="1.5.6"/>
        <vers num="1.5.7"/>
        <vers num="1.5.8"/>
        <vers num="10.0"/>
        <vers num="10.0.1"/>
        <vers num="10.0.10"/>
        <vers num="10.0.11"/>
        <vers num="10.0.12"/>
        <vers num="10.0.2"/>
        <vers num="10.0.3"/>
        <vers num="10.0.4"/>
        <vers num="10.0.5"/>
        <vers num="10.0.6"/>
        <vers num="10.0.7"/>
        <vers num="10.0.8"/>
        <vers num="10.0.9"/>
        <vers num="11.0"/>
        <vers num="12.0" edition="beta6"/>
        <vers num="13.0"/>
        <vers num="13.0.1"/>
        <vers num="14.0"/>
        <vers num="14.0.1"/>
        <vers num="15.0"/>
        <vers num="15.0.1"/>
        <vers num="16.0"/>
        <vers num="16.0.1"/>
        <vers num="16.0.2"/>
        <vers num="17.0.10"/>
        <vers num="17.0.11"/>
        <vers num="17.0.2"/>
        <vers num="17.0.3"/>
        <vers num="17.0.4"/>
        <vers num="17.0.5"/>
        <vers num="17.0.6"/>
        <vers num="17.0.7"/>
        <vers num="17.0.8"/>
        <vers num="17.0.9"/>
        <vers num="18.0"/>
        <vers num="18.0.1"/>
        <vers num="18.0.2"/>
        <vers num="19.0"/>
        <vers num="19.0.1"/>
        <vers num="19.0.2"/>
        <vers num="2.0"/>
        <vers num="2.0.0.1"/>
        <vers num="2.0.0.10"/>
        <vers num="2.0.0.11"/>
        <vers num="2.0.0.12"/>
        <vers num="2.0.0.13"/>
        <vers num="2.0.0.14"/>
        <vers num="2.0.0.15"/>
        <vers num="2.0.0.16"/>
        <vers num="2.0.0.17"/>
        <vers num="2.0.0.18"/>
        <vers num="2.0.0.19"/>
        <vers num="2.0.0.2"/>
        <vers num="2.0.0.20"/>
        <vers num="2.0.0.3"/>
        <vers num="2.0.0.4"/>
        <vers num="2.0.0.5"/>
        <vers num="2.0.0.6"/>
        <vers num="2.0.0.7"/>
        <vers num="2.0.0.8"/>
        <vers num="2.0.0.9"/>
        <vers num="20.0"/>
        <vers num="20.0.1"/>
        <vers num="21.0"/>
        <vers num="23.0"/>
        <vers num="23.0.1"/>
        <vers num="24.0"/>
        <vers num="24.1"/>
        <vers num="24.1.1"/>
        <vers num="25.0"/>
        <vers num="25.0.1"/>
        <vers num="26.0"/>
        <vers num="27.0"/>
        <vers prev="1" num="27.0.1"/>
        <vers num="3.0"/>
        <vers num="3.0.1"/>
        <vers num="3.0.10"/>
        <vers num="3.0.11"/>
        <vers num="3.0.12"/>
        <vers num="3.0.13"/>
        <vers num="3.0.14"/>
        <vers num="3.0.15"/>
        <vers num="3.0.16"/>
        <vers num="3.0.17"/>
        <vers num="3.0.18"/>
        <vers num="3.0.19"/>
        <vers num="3.0.2"/>
        <vers num="3.0.3"/>
        <vers num="3.0.4"/>
        <vers num="3.0.5"/>
        <vers num="3.0.6"/>
        <vers num="3.0.7"/>
        <vers num="3.0.8"/>
        <vers num="3.0.9"/>
        <vers num="3.5"/>
        <vers num="3.5.1"/>
        <vers num="3.5.10"/>
        <vers num="3.5.11"/>
        <vers num="3.5.12"/>
        <vers num="3.5.13"/>
        <vers num="3.5.14"/>
        <vers num="3.5.15"/>
        <vers num="3.5.16"/>
        <vers num="3.5.17"/>
        <vers num="3.5.18"/>
        <vers num="3.5.19"/>
        <vers num="3.5.2"/>
        <vers num="3.5.3"/>
        <vers num="3.5.4"/>
        <vers num="3.5.5"/>
        <vers num="3.5.6"/>
        <vers num="3.5.7"/>
        <vers num="3.5.8"/>
        <vers num="3.5.9"/>
        <vers num="3.6"/>
        <vers num="3.6.10"/>
        <vers num="3.6.11"/>
        <vers num="3.6.12"/>
        <vers num="3.6.13"/>
        <vers num="3.6.14"/>
        <vers num="3.6.15"/>
        <vers num="3.6.16"/>
        <vers num="3.6.17"/>
        <vers num="3.6.18"/>
        <vers num="3.6.19"/>
        <vers num="3.6.2"/>
        <vers num="3.6.20"/>
        <vers num="3.6.21"/>
        <vers num="3.6.22"/>
        <vers num="3.6.23"/>
        <vers num="3.6.24"/>
        <vers num="3.6.25"/>
        <vers num="3.6.26"/>
        <vers num="3.6.27"/>
        <vers num="3.6.28"/>
        <vers num="3.6.3"/>
        <vers num="3.6.4"/>
        <vers num="3.6.6"/>
        <vers num="3.6.7"/>
        <vers num="3.6.8"/>
        <vers num="3.6.9"/>
        <vers num="4.0" edition="beta1"/>
        <vers num="4.0" edition="beta10"/>
        <vers num="4.0" edition="beta11"/>
        <vers num="4.0" edition="beta12"/>
        <vers num="4.0" edition="beta2"/>
        <vers num="4.0" edition="beta3"/>
        <vers num="4.0" edition="beta4"/>
        <vers num="4.0" edition="beta5"/>
        <vers num="4.0" edition="beta6"/>
        <vers num="4.0" edition="beta7"/>
        <vers num="4.0" edition="beta8"/>
        <vers num="4.0" edition="beta9"/>
        <vers num="4.0.1"/>
        <vers num="5.0"/>
        <vers num="5.0.1"/>
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers num="6.0.2"/>
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="8.0"/>
        <vers num="8.0.1"/>
        <vers num="9.0"/>
        <vers num="9.0.1"/>
      </prod>
      <prod vendor="mozilla" name="seamonkey">
        <vers num="2.0" edition="alpha_1"/>
        <vers num="2.0" edition="alpha_2"/>
        <vers num="2.0" edition="alpha_3"/>
        <vers num="2.0" edition="beta_1"/>
        <vers num="2.0" edition="beta_2"/>
        <vers num="2.0" edition="rc1"/>
        <vers num="2.0" edition="rc2"/>
        <vers num="2.0.1"/>
        <vers num="2.0.10"/>
        <vers num="2.0.11"/>
        <vers num="2.0.12"/>
        <vers num="2.0.13"/>
        <vers num="2.0.14"/>
        <vers num="2.0.2"/>
        <vers num="2.0.3"/>
        <vers num="2.0.4"/>
        <vers num="2.0.5"/>
        <vers num="2.0.6"/>
        <vers num="2.0.7"/>
        <vers num="2.0.8"/>
        <vers num="2.0.9"/>
        <vers num="2.1" edition="alpha1"/>
        <vers num="2.1" edition="alpha2"/>
        <vers num="2.1" edition="alpha3"/>
        <vers num="2.1" edition="beta1"/>
        <vers num="2.1" edition="beta2"/>
        <vers num="2.1" edition="beta3"/>
        <vers num="2.1" edition="rc1"/>
        <vers num="2.1" edition="rc2"/>
        <vers num="2.10" edition="beta1"/>
        <vers num="2.10" edition="beta2"/>
        <vers num="2.10" edition="beta3"/>
        <vers num="2.10.1"/>
        <vers num="2.11" edition="beta1"/>
        <vers num="2.11" edition="beta2"/>
        <vers num="2.11" edition="beta3"/>
        <vers num="2.11" edition="beta4"/>
        <vers num="2.11" edition="beta5"/>
        <vers num="2.11" edition="beta6"/>
        <vers num="2.12" edition="beta1"/>
        <vers num="2.12" edition="beta2"/>
        <vers num="2.12" edition="beta3"/>
        <vers num="2.12" edition="beta4"/>
        <vers num="2.12" edition="beta5"/>
        <vers num="2.12" edition="beta6"/>
        <vers num="2.12.1"/>
        <vers num="2.13" edition="beta1"/>
        <vers num="2.13" edition="beta2"/>
        <vers num="2.13" edition="beta3"/>
        <vers num="2.13" edition="beta4"/>
        <vers num="2.13" edition="beta5"/>
        <vers num="2.13" edition="beta6"/>
        <vers num="2.13.1"/>
        <vers num="2.13.2"/>
        <vers num="2.14" edition="beta1"/>
        <vers num="2.14" edition="beta2"/>
        <vers num="2.14" edition="beta3"/>
        <vers num="2.14" edition="beta4"/>
        <vers num="2.14" edition="beta5"/>
        <vers num="2.15" edition="beta1"/>
        <vers num="2.15" edition="beta2"/>
        <vers num="2.15" edition="beta3"/>
        <vers num="2.15" edition="beta4"/>
        <vers num="2.15" edition="beta5"/>
        <vers num="2.15" edition="beta6"/>
        <vers num="2.15.1"/>
        <vers num="2.15.2"/>
        <vers num="2.16" edition="beta1"/>
        <vers num="2.16" edition="beta2"/>
        <vers num="2.16" edition="beta3"/>
        <vers num="2.16" edition="beta4"/>
        <vers num="2.16" edition="beta5"/>
        <vers num="2.16.1"/>
        <vers num="2.16.2"/>
        <vers num="2.17" edition="beta1"/>
        <vers num="2.17" edition="beta2"/>
        <vers num="2.17" edition="beta3"/>
        <vers num="2.17" edition="beta4"/>
        <vers num="2.17.1"/>
        <vers num="2.18" edition="beta1"/>
        <vers num="2.18" edition="beta2"/>
        <vers num="2.18" edition="beta3"/>
        <vers num="2.18" edition="beta4"/>
        <vers num="2.19" edition="beta1"/>
        <vers num="2.19" edition="beta2"/>
        <vers num="2.2" edition="beta1"/>
        <vers num="2.2" edition="beta2"/>
        <vers num="2.2" edition="beta3"/>
        <vers num="2.20" edition="beta1"/>
        <vers num="2.20" edition="beta2"/>
        <vers num="2.20" edition="beta3"/>
        <vers num="2.21" edition="beta1"/>
        <vers num="2.21" edition="beta2"/>
        <vers num="2.22" edition="beta1"/>
        <vers num="2.22" edition="beta2"/>
        <vers num="2.22.1"/>
        <vers num="2.23" edition="beta1"/>
        <vers num="2.23" edition="beta2"/>
        <vers num="2.24" edition="beta1"/>
        <vers prev="1" num="2.25" edition="beta1"/>
        <vers prev="1" num="2.25" edition="beta2"/>
        <vers num="2.3" edition="beta1"/>
        <vers num="2.3" edition="beta2"/>
        <vers num="2.3" edition="beta3"/>
        <vers num="2.3.1"/>
        <vers num="2.3.2"/>
        <vers num="2.3.3"/>
        <vers num="2.4" edition="beta1"/>
        <vers num="2.4" edition="beta2"/>
        <vers num="2.4" edition="beta3"/>
        <vers num="2.4.1"/>
        <vers num="2.5" edition="beta1"/>
        <vers num="2.5" edition="beta2"/>
        <vers num="2.5" edition="beta3"/>
        <vers num="2.5" edition="beta4"/>
        <vers num="2.6" edition="beta1"/>
        <vers num="2.6" edition="beta2"/>
        <vers num="2.6" edition="beta3"/>
        <vers num="2.6" edition="beta4"/>
        <vers num="2.6.1"/>
        <vers num="2.7" edition="beta1"/>
        <vers num="2.7" edition="beta2"/>
        <vers num="2.7" edition="beta3"/>
        <vers num="2.7" edition="beta4"/>
        <vers num="2.7" edition="beta5"/>
        <vers num="2.7.1"/>
        <vers num="2.7.2"/>
        <vers num="2.8" edition="beta1"/>
        <vers num="2.8" edition="beta2"/>
        <vers num="2.8" edition="beta3"/>
        <vers num="2.8" edition="beta4"/>
        <vers num="2.8" edition="beta5"/>
        <vers num="2.8" edition="beta6"/>
        <vers num="2.9" edition="beta1"/>
        <vers num="2.9" edition="beta2"/>
        <vers num="2.9" edition="beta3"/>
        <vers num="2.9" edition="beta4"/>
        <vers num="2.9.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1496" published="2014-03-19" name="CVE-2014-1496" modified="2014-04-01" CVSS_version="2.0" CVSS_vector="(AV:L/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="6.9" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="3.4" CVSS_base_score="6.9">
    <desc>
      <descript source="cve">Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 might allow local users to gain privileges by modifying the extracted Mar contents during an update.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=925747" source="CONFIRM">https://bugzilla.mozilla.org/show_bug.cgi?id=925747</ref>
      <ref url="http://www.mozilla.org/security/announce/2014/mfsa2014-16.html" source="CONFIRM" adv="1">http://www.mozilla.org/security/announce/2014/mfsa2014-16.html</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00016.html" source="SUSE">SUSE-SU-2014:0418</ref>
    </refs>
    <vuln_soft>
      <prod vendor="mozilla" name="firefox">
        <vers num="0.1"/>
        <vers num="0.10"/>
        <vers num="0.10.1"/>
        <vers num="0.2"/>
        <vers num="0.3"/>
        <vers num="0.4"/>
        <vers num="0.5"/>
        <vers num="0.6"/>
        <vers num="0.6.1"/>
        <vers num="0.7"/>
        <vers num="0.7.1"/>
        <vers num="0.8"/>
        <vers num="0.9" edition="rc"/>
        <vers num="0.9.1"/>
        <vers num="0.9.2"/>
        <vers num="0.9.3"/>
        <vers num="1.0" edition="preview_release"/>
        <vers num="1.0.1"/>
        <vers num="1.0.2"/>
        <vers num="1.0.3"/>
        <vers num="1.0.4"/>
        <vers num="1.0.5"/>
        <vers num="1.0.6"/>
        <vers num="1.0.7"/>
        <vers num="1.0.8"/>
        <vers num="1.5" edition="beta1"/>
        <vers num="1.5" edition="beta2"/>
        <vers num="1.5.0.1"/>
        <vers num="1.5.0.10"/>
        <vers num="1.5.0.11"/>
        <vers num="1.5.0.12"/>
        <vers num="1.5.0.2"/>
        <vers num="1.5.0.3"/>
        <vers num="1.5.0.4"/>
        <vers num="1.5.0.5"/>
        <vers num="1.5.0.6"/>
        <vers num="1.5.0.7"/>
        <vers num="1.5.0.8"/>
        <vers num="1.5.0.9"/>
        <vers num="1.5.1"/>
        <vers num="1.5.2"/>
        <vers num="1.5.3"/>
        <vers num="1.5.4"/>
        <vers num="1.5.5"/>
        <vers num="1.5.6"/>
        <vers num="1.5.7"/>
        <vers num="1.5.8"/>
        <vers num="10.0"/>
        <vers num="10.0.1"/>
        <vers num="10.0.10"/>
        <vers num="10.0.11"/>
        <vers num="10.0.12"/>
        <vers num="10.0.2"/>
        <vers num="10.0.3"/>
        <vers num="10.0.4"/>
        <vers num="10.0.5"/>
        <vers num="10.0.6"/>
        <vers num="10.0.7"/>
        <vers num="10.0.8"/>
        <vers num="10.0.9"/>
        <vers num="11.0"/>
        <vers num="12.0" edition="beta6"/>
        <vers num="13.0"/>
        <vers num="13.0.1"/>
        <vers num="14.0"/>
        <vers num="14.0.1"/>
        <vers num="15.0"/>
        <vers num="15.0.1"/>
        <vers num="16.0"/>
        <vers num="16.0.1"/>
        <vers num="16.0.2"/>
        <vers num="17.0.10"/>
        <vers num="17.0.11"/>
        <vers num="17.0.2"/>
        <vers num="17.0.3"/>
        <vers num="17.0.4"/>
        <vers num="17.0.5"/>
        <vers num="17.0.6"/>
        <vers num="17.0.7"/>
        <vers num="17.0.8"/>
        <vers num="17.0.9"/>
        <vers num="18.0"/>
        <vers num="18.0.1"/>
        <vers num="18.0.2"/>
        <vers num="19.0"/>
        <vers num="19.0.1"/>
        <vers num="19.0.2"/>
        <vers num="2.0"/>
        <vers num="2.0.0.1"/>
        <vers num="2.0.0.10"/>
        <vers num="2.0.0.11"/>
        <vers num="2.0.0.12"/>
        <vers num="2.0.0.13"/>
        <vers num="2.0.0.14"/>
        <vers num="2.0.0.15"/>
        <vers num="2.0.0.16"/>
        <vers num="2.0.0.17"/>
        <vers num="2.0.0.18"/>
        <vers num="2.0.0.19"/>
        <vers num="2.0.0.2"/>
        <vers num="2.0.0.20"/>
        <vers num="2.0.0.3"/>
        <vers num="2.0.0.4"/>
        <vers num="2.0.0.5"/>
        <vers num="2.0.0.6"/>
        <vers num="2.0.0.7"/>
        <vers num="2.0.0.8"/>
        <vers num="2.0.0.9"/>
        <vers num="20.0"/>
        <vers num="20.0.1"/>
        <vers num="21.0"/>
        <vers num="23.0"/>
        <vers num="23.0.1"/>
        <vers num="24.0"/>
        <vers num="24.1"/>
        <vers num="24.1.1"/>
        <vers num="25.0"/>
        <vers num="25.0.1"/>
        <vers num="26.0"/>
        <vers num="27.0"/>
        <vers prev="1" num="27.0.1"/>
        <vers num="3.0"/>
        <vers num="3.0.1"/>
        <vers num="3.0.10"/>
        <vers num="3.0.11"/>
        <vers num="3.0.12"/>
        <vers num="3.0.13"/>
        <vers num="3.0.14"/>
        <vers num="3.0.15"/>
        <vers num="3.0.16"/>
        <vers num="3.0.17"/>
        <vers num="3.0.18"/>
        <vers num="3.0.19"/>
        <vers num="3.0.2"/>
        <vers num="3.0.3"/>
        <vers num="3.0.4"/>
        <vers num="3.0.5"/>
        <vers num="3.0.6"/>
        <vers num="3.0.7"/>
        <vers num="3.0.8"/>
        <vers num="3.0.9"/>
        <vers num="3.5"/>
        <vers num="3.5.1"/>
        <vers num="3.5.10"/>
        <vers num="3.5.11"/>
        <vers num="3.5.12"/>
        <vers num="3.5.13"/>
        <vers num="3.5.14"/>
        <vers num="3.5.15"/>
        <vers num="3.5.16"/>
        <vers num="3.5.17"/>
        <vers num="3.5.18"/>
        <vers num="3.5.19"/>
        <vers num="3.5.2"/>
        <vers num="3.5.3"/>
        <vers num="3.5.4"/>
        <vers num="3.5.5"/>
        <vers num="3.5.6"/>
        <vers num="3.5.7"/>
        <vers num="3.5.8"/>
        <vers num="3.5.9"/>
        <vers num="3.6"/>
        <vers num="3.6.10"/>
        <vers num="3.6.11"/>
        <vers num="3.6.12"/>
        <vers num="3.6.13"/>
        <vers num="3.6.14"/>
        <vers num="3.6.15"/>
        <vers num="3.6.16"/>
        <vers num="3.6.17"/>
        <vers num="3.6.18"/>
        <vers num="3.6.19"/>
        <vers num="3.6.2"/>
        <vers num="3.6.20"/>
        <vers num="3.6.21"/>
        <vers num="3.6.22"/>
        <vers num="3.6.23"/>
        <vers num="3.6.24"/>
        <vers num="3.6.25"/>
        <vers num="3.6.26"/>
        <vers num="3.6.27"/>
        <vers num="3.6.28"/>
        <vers num="3.6.3"/>
        <vers num="3.6.4"/>
        <vers num="3.6.6"/>
        <vers num="3.6.7"/>
        <vers num="3.6.8"/>
        <vers num="3.6.9"/>
        <vers num="4.0" edition="beta1"/>
        <vers num="4.0" edition="beta10"/>
        <vers num="4.0" edition="beta11"/>
        <vers num="4.0" edition="beta12"/>
        <vers num="4.0" edition="beta2"/>
        <vers num="4.0" edition="beta3"/>
        <vers num="4.0" edition="beta4"/>
        <vers num="4.0" edition="beta5"/>
        <vers num="4.0" edition="beta6"/>
        <vers num="4.0" edition="beta7"/>
        <vers num="4.0" edition="beta8"/>
        <vers num="4.0" edition="beta9"/>
        <vers num="4.0.1"/>
        <vers num="5.0"/>
        <vers num="5.0.1"/>
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers num="6.0.2"/>
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="8.0"/>
        <vers num="8.0.1"/>
        <vers num="9.0"/>
        <vers num="9.0.1"/>
      </prod>
      <prod vendor="mozilla" name="firefox_esr">
        <vers num="24.0"/>
        <vers num="24.0.1"/>
        <vers num="24.0.2"/>
        <vers num="24.1.0"/>
        <vers num="24.1.1"/>
        <vers num="24.2"/>
        <vers num="24.3"/>
      </prod>
      <prod vendor="mozilla" name="seamonkey">
        <vers num="2.0" edition="alpha_1"/>
        <vers num="2.0" edition="alpha_2"/>
        <vers num="2.0" edition="alpha_3"/>
        <vers num="2.0" edition="beta_1"/>
        <vers num="2.0" edition="beta_2"/>
        <vers num="2.0" edition="rc1"/>
        <vers num="2.0" edition="rc2"/>
        <vers num="2.0.1"/>
        <vers num="2.0.10"/>
        <vers num="2.0.11"/>
        <vers num="2.0.12"/>
        <vers num="2.0.13"/>
        <vers num="2.0.14"/>
        <vers num="2.0.2"/>
        <vers num="2.0.3"/>
        <vers num="2.0.4"/>
        <vers num="2.0.5"/>
        <vers num="2.0.6"/>
        <vers num="2.0.7"/>
        <vers num="2.0.8"/>
        <vers num="2.0.9"/>
        <vers num="2.1" edition="alpha1"/>
        <vers num="2.1" edition="alpha2"/>
        <vers num="2.1" edition="alpha3"/>
        <vers num="2.1" edition="beta1"/>
        <vers num="2.1" edition="beta2"/>
        <vers num="2.1" edition="beta3"/>
        <vers num="2.1" edition="rc1"/>
        <vers num="2.1" edition="rc2"/>
        <vers num="2.10" edition="beta1"/>
        <vers num="2.10" edition="beta2"/>
        <vers num="2.10" edition="beta3"/>
        <vers num="2.10.1"/>
        <vers num="2.11" edition="beta1"/>
        <vers num="2.11" edition="beta2"/>
        <vers num="2.11" edition="beta3"/>
        <vers num="2.11" edition="beta4"/>
        <vers num="2.11" edition="beta5"/>
        <vers num="2.11" edition="beta6"/>
        <vers num="2.12" edition="beta1"/>
        <vers num="2.12" edition="beta2"/>
        <vers num="2.12" edition="beta3"/>
        <vers num="2.12" edition="beta4"/>
        <vers num="2.12" edition="beta5"/>
        <vers num="2.12" edition="beta6"/>
        <vers num="2.12.1"/>
        <vers num="2.13" edition="beta1"/>
        <vers num="2.13" edition="beta2"/>
        <vers num="2.13" edition="beta3"/>
        <vers num="2.13" edition="beta4"/>
        <vers num="2.13" edition="beta5"/>
        <vers num="2.13" edition="beta6"/>
        <vers num="2.13.1"/>
        <vers num="2.13.2"/>
        <vers num="2.14" edition="beta1"/>
        <vers num="2.14" edition="beta2"/>
        <vers num="2.14" edition="beta3"/>
        <vers num="2.14" edition="beta4"/>
        <vers num="2.14" edition="beta5"/>
        <vers num="2.15" edition="beta1"/>
        <vers num="2.15" edition="beta2"/>
        <vers num="2.15" edition="beta3"/>
        <vers num="2.15" edition="beta4"/>
        <vers num="2.15" edition="beta5"/>
        <vers num="2.15" edition="beta6"/>
        <vers num="2.15.1"/>
        <vers num="2.15.2"/>
        <vers num="2.16" edition="beta1"/>
        <vers num="2.16" edition="beta2"/>
        <vers num="2.16" edition="beta3"/>
        <vers num="2.16" edition="beta4"/>
        <vers num="2.16" edition="beta5"/>
        <vers num="2.16.1"/>
        <vers num="2.16.2"/>
        <vers num="2.17" edition="beta1"/>
        <vers num="2.17" edition="beta2"/>
        <vers num="2.17" edition="beta3"/>
        <vers num="2.17" edition="beta4"/>
        <vers num="2.17.1"/>
        <vers num="2.18" edition="beta1"/>
        <vers num="2.18" edition="beta2"/>
        <vers num="2.18" edition="beta3"/>
        <vers num="2.18" edition="beta4"/>
        <vers num="2.19" edition="beta1"/>
        <vers num="2.19" edition="beta2"/>
        <vers num="2.2" edition="beta1"/>
        <vers num="2.2" edition="beta2"/>
        <vers num="2.2" edition="beta3"/>
        <vers num="2.20" edition="beta1"/>
        <vers num="2.20" edition="beta2"/>
        <vers num="2.20" edition="beta3"/>
        <vers num="2.21" edition="beta1"/>
        <vers num="2.21" edition="beta2"/>
        <vers num="2.22" edition="beta1"/>
        <vers num="2.22" edition="beta2"/>
        <vers num="2.22.1"/>
        <vers num="2.23" edition="beta1"/>
        <vers num="2.23" edition="beta2"/>
        <vers num="2.24" edition="beta1"/>
        <vers prev="1" num="2.25" edition="beta1"/>
        <vers prev="1" num="2.25" edition="beta2"/>
        <vers num="2.3" edition="beta1"/>
        <vers num="2.3" edition="beta2"/>
        <vers num="2.3" edition="beta3"/>
        <vers num="2.3.1"/>
        <vers num="2.3.2"/>
        <vers num="2.3.3"/>
        <vers num="2.4" edition="beta1"/>
        <vers num="2.4" edition="beta2"/>
        <vers num="2.4" edition="beta3"/>
        <vers num="2.4.1"/>
        <vers num="2.5" edition="beta1"/>
        <vers num="2.5" edition="beta2"/>
        <vers num="2.5" edition="beta3"/>
        <vers num="2.5" edition="beta4"/>
        <vers num="2.6" edition="beta1"/>
        <vers num="2.6" edition="beta2"/>
        <vers num="2.6" edition="beta3"/>
        <vers num="2.6" edition="beta4"/>
        <vers num="2.6.1"/>
        <vers num="2.7" edition="beta1"/>
        <vers num="2.7" edition="beta2"/>
        <vers num="2.7" edition="beta3"/>
        <vers num="2.7" edition="beta4"/>
        <vers num="2.7" edition="beta5"/>
        <vers num="2.7.1"/>
        <vers num="2.7.2"/>
        <vers num="2.8" edition="beta1"/>
        <vers num="2.8" edition="beta2"/>
        <vers num="2.8" edition="beta3"/>
        <vers num="2.8" edition="beta4"/>
        <vers num="2.8" edition="beta5"/>
        <vers num="2.8" edition="beta6"/>
        <vers num="2.9" edition="beta1"/>
        <vers num="2.9" edition="beta2"/>
        <vers num="2.9" edition="beta3"/>
        <vers num="2.9" edition="beta4"/>
        <vers num="2.9.1"/>
      </prod>
      <prod vendor="mozilla" name="thunderbird">
        <vers num="0.1"/>
        <vers num="0.2"/>
        <vers num="0.3"/>
        <vers num="0.4"/>
        <vers num="0.5"/>
        <vers num="0.6"/>
        <vers num="0.7"/>
        <vers num="0.7.1"/>
        <vers num="0.7.2"/>
        <vers num="0.7.3"/>
        <vers num="0.8"/>
        <vers num="0.9"/>
        <vers num="1.0"/>
        <vers num="1.0.1"/>
        <vers num="1.0.2"/>
        <vers num="1.0.3"/>
        <vers num="1.0.4"/>
        <vers num="1.0.5" edition="beta"/>
        <vers num="1.0.6"/>
        <vers num="1.0.7"/>
        <vers num="1.0.8"/>
        <vers num="1.5" edition="beta2"/>
        <vers num="1.5.0.1"/>
        <vers num="1.5.0.10"/>
        <vers num="1.5.0.11"/>
        <vers num="1.5.0.12"/>
        <vers num="1.5.0.13"/>
        <vers num="1.5.0.14"/>
        <vers num="1.5.0.2"/>
        <vers num="1.5.0.3"/>
        <vers num="1.5.0.4"/>
        <vers num="1.5.0.5"/>
        <vers num="1.5.0.6"/>
        <vers num="1.5.0.7"/>
        <vers num="1.5.0.8"/>
        <vers num="1.5.0.9"/>
        <vers num="1.5.1"/>
        <vers num="1.5.2"/>
        <vers num="1.7.1"/>
        <vers num="1.7.3"/>
        <vers num="10.0"/>
        <vers num="10.0.1"/>
        <vers num="10.0.2"/>
        <vers num="10.0.3"/>
        <vers num="10.0.4"/>
        <vers num="11.0"/>
        <vers num="11.0.1"/>
        <vers num="12.0"/>
        <vers num="12.0.1"/>
        <vers num="13.0"/>
        <vers num="13.0.1"/>
        <vers num="14.0"/>
        <vers num="15.0"/>
        <vers num="15.0.1"/>
        <vers num="16.0"/>
        <vers num="16.0.1"/>
        <vers num="16.0.2"/>
        <vers num="17.0"/>
        <vers num="17.0.1"/>
        <vers num="17.0.2"/>
        <vers num="17.0.3"/>
        <vers num="17.0.4"/>
        <vers num="17.0.5"/>
        <vers num="17.0.6"/>
        <vers num="17.0.7"/>
        <vers num="17.0.8"/>
        <vers num="2.0"/>
        <vers num="2.0.0.0"/>
        <vers num="2.0.0.1"/>
        <vers num="2.0.0.11"/>
        <vers num="2.0.0.12"/>
        <vers num="2.0.0.13"/>
        <vers num="2.0.0.14"/>
        <vers num="2.0.0.15"/>
        <vers num="2.0.0.16"/>
        <vers num="2.0.0.17"/>
        <vers num="2.0.0.18"/>
        <vers num="2.0.0.19"/>
        <vers num="2.0.0.2"/>
        <vers num="2.0.0.20"/>
        <vers num="2.0.0.21"/>
        <vers num="2.0.0.22"/>
        <vers num="2.0.0.23"/>
        <vers num="2.0.0.3"/>
        <vers num="2.0.0.4"/>
        <vers num="2.0.0.5"/>
        <vers num="2.0.0.6"/>
        <vers num="2.0.0.7"/>
        <vers num="2.0.0.8"/>
        <vers num="2.0.0.9"/>
        <vers num="24.0"/>
        <vers num="24.0.1"/>
        <vers num="24.1"/>
        <vers num="24.1.1"/>
        <vers num="24.2"/>
        <vers prev="1" num="24.3"/>
        <vers num="3.0"/>
        <vers num="3.0.1"/>
        <vers num="3.0.10"/>
        <vers num="3.0.11"/>
        <vers num="3.0.2"/>
        <vers num="3.0.3"/>
        <vers num="3.0.4"/>
        <vers num="3.0.5"/>
        <vers num="3.0.6"/>
        <vers num="3.0.7"/>
        <vers num="3.0.8"/>
        <vers num="3.0.9"/>
        <vers num="3.1"/>
        <vers num="3.1.1"/>
        <vers num="3.1.10"/>
        <vers num="3.1.11"/>
        <vers num="3.1.12"/>
        <vers num="3.1.13"/>
        <vers num="3.1.14"/>
        <vers num="3.1.15"/>
        <vers num="3.1.16"/>
        <vers num="3.1.17"/>
        <vers num="3.1.2"/>
        <vers num="3.1.3"/>
        <vers num="3.1.4"/>
        <vers num="3.1.5"/>
        <vers num="3.1.6"/>
        <vers num="3.1.7"/>
        <vers num="3.1.8"/>
        <vers num="3.1.9"/>
        <vers num="5.0"/>
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers num="6.0.2"/>
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="8.0"/>
        <vers num="9.0"/>
        <vers num="9.0.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1497" published="2014-03-19" name="CVE-2014-1497" modified="2014-04-01" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:P)" CVSS_score="6.8" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.6" CVSS_base_score="6.8">
    <desc>
      <descript source="cve">The mozilla::WaveReader::DecodeAudioData function in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to obtain sensitive information from process heap memory, cause a denial of service (out-of-bounds read and application crash), or possibly have unspecified other impact via a crafted WAV file.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=966311" source="CONFIRM">https://bugzilla.mozilla.org/show_bug.cgi?id=966311</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2151-1" source="UBUNTU">USN-2151-1</ref>
      <ref url="http://www.mozilla.org/security/announce/2014/mfsa2014-17.html" source="CONFIRM" adv="1">http://www.mozilla.org/security/announce/2014/mfsa2014-17.html</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2881" source="DEBIAN">DSA-2881</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0316.html" source="REDHAT">RHSA-2014:0316</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0310.html" source="REDHAT">RHSA-2014:0310</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00022.html" source="SUSE">openSUSE-SU-2014:0448</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.html" source="SUSE">openSUSE-SU-2014:0419</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00016.html" source="SUSE">SUSE-SU-2014:0418</ref>
    </refs>
    <vuln_soft>
      <prod vendor="mozilla" name="firefox">
        <vers num="0.1"/>
        <vers num="0.10"/>
        <vers num="0.10.1"/>
        <vers num="0.2"/>
        <vers num="0.3"/>
        <vers num="0.4"/>
        <vers num="0.5"/>
        <vers num="0.6"/>
        <vers num="0.6.1"/>
        <vers num="0.7"/>
        <vers num="0.7.1"/>
        <vers num="0.8"/>
        <vers num="0.9" edition="rc"/>
        <vers num="0.9.1"/>
        <vers num="0.9.2"/>
        <vers num="0.9.3"/>
        <vers num="1.0" edition="preview_release"/>
        <vers num="1.0.1"/>
        <vers num="1.0.2"/>
        <vers num="1.0.3"/>
        <vers num="1.0.4"/>
        <vers num="1.0.5"/>
        <vers num="1.0.6"/>
        <vers num="1.0.7"/>
        <vers num="1.0.8"/>
        <vers num="1.5" edition="beta1"/>
        <vers num="1.5" edition="beta2"/>
        <vers num="1.5.0.1"/>
        <vers num="1.5.0.10"/>
        <vers num="1.5.0.11"/>
        <vers num="1.5.0.12"/>
        <vers num="1.5.0.2"/>
        <vers num="1.5.0.3"/>
        <vers num="1.5.0.4"/>
        <vers num="1.5.0.5"/>
        <vers num="1.5.0.6"/>
        <vers num="1.5.0.7"/>
        <vers num="1.5.0.8"/>
        <vers num="1.5.0.9"/>
        <vers num="1.5.1"/>
        <vers num="1.5.2"/>
        <vers num="1.5.3"/>
        <vers num="1.5.4"/>
        <vers num="1.5.5"/>
        <vers num="1.5.6"/>
        <vers num="1.5.7"/>
        <vers num="1.5.8"/>
        <vers num="10.0"/>
        <vers num="10.0.1"/>
        <vers num="10.0.10"/>
        <vers num="10.0.11"/>
        <vers num="10.0.12"/>
        <vers num="10.0.2"/>
        <vers num="10.0.3"/>
        <vers num="10.0.4"/>
        <vers num="10.0.5"/>
        <vers num="10.0.6"/>
        <vers num="10.0.7"/>
        <vers num="10.0.8"/>
        <vers num="10.0.9"/>
        <vers num="11.0"/>
        <vers num="12.0" edition="beta6"/>
        <vers num="13.0"/>
        <vers num="13.0.1"/>
        <vers num="14.0"/>
        <vers num="14.0.1"/>
        <vers num="15.0"/>
        <vers num="15.0.1"/>
        <vers num="16.0"/>
        <vers num="16.0.1"/>
        <vers num="16.0.2"/>
        <vers num="17.0.10"/>
        <vers num="17.0.11"/>
        <vers num="17.0.2"/>
        <vers num="17.0.3"/>
        <vers num="17.0.4"/>
        <vers num="17.0.5"/>
        <vers num="17.0.6"/>
        <vers num="17.0.7"/>
        <vers num="17.0.8"/>
        <vers num="17.0.9"/>
        <vers num="18.0"/>
        <vers num="18.0.1"/>
        <vers num="18.0.2"/>
        <vers num="19.0"/>
        <vers num="19.0.1"/>
        <vers num="19.0.2"/>
        <vers num="2.0"/>
        <vers num="2.0.0.1"/>
        <vers num="2.0.0.10"/>
        <vers num="2.0.0.11"/>
        <vers num="2.0.0.12"/>
        <vers num="2.0.0.13"/>
        <vers num="2.0.0.14"/>
        <vers num="2.0.0.15"/>
        <vers num="2.0.0.16"/>
        <vers num="2.0.0.17"/>
        <vers num="2.0.0.18"/>
        <vers num="2.0.0.19"/>
        <vers num="2.0.0.2"/>
        <vers num="2.0.0.20"/>
        <vers num="2.0.0.3"/>
        <vers num="2.0.0.4"/>
        <vers num="2.0.0.5"/>
        <vers num="2.0.0.6"/>
        <vers num="2.0.0.7"/>
        <vers num="2.0.0.8"/>
        <vers num="2.0.0.9"/>
        <vers num="20.0"/>
        <vers num="20.0.1"/>
        <vers num="21.0"/>
        <vers num="23.0"/>
        <vers num="23.0.1"/>
        <vers num="24.0"/>
        <vers num="24.1"/>
        <vers num="24.1.1"/>
        <vers num="25.0"/>
        <vers num="25.0.1"/>
        <vers num="26.0"/>
        <vers num="27.0"/>
        <vers prev="1" num="27.0.1"/>
        <vers num="3.0"/>
        <vers num="3.0.1"/>
        <vers num="3.0.10"/>
        <vers num="3.0.11"/>
        <vers num="3.0.12"/>
        <vers num="3.0.13"/>
        <vers num="3.0.14"/>
        <vers num="3.0.15"/>
        <vers num="3.0.16"/>
        <vers num="3.0.17"/>
        <vers num="3.0.18"/>
        <vers num="3.0.19"/>
        <vers num="3.0.2"/>
        <vers num="3.0.3"/>
        <vers num="3.0.4"/>
        <vers num="3.0.5"/>
        <vers num="3.0.6"/>
        <vers num="3.0.7"/>
        <vers num="3.0.8"/>
        <vers num="3.0.9"/>
        <vers num="3.5"/>
        <vers num="3.5.1"/>
        <vers num="3.5.10"/>
        <vers num="3.5.11"/>
        <vers num="3.5.12"/>
        <vers num="3.5.13"/>
        <vers num="3.5.14"/>
        <vers num="3.5.15"/>
        <vers num="3.5.16"/>
        <vers num="3.5.17"/>
        <vers num="3.5.18"/>
        <vers num="3.5.19"/>
        <vers num="3.5.2"/>
        <vers num="3.5.3"/>
        <vers num="3.5.4"/>
        <vers num="3.5.5"/>
        <vers num="3.5.6"/>
        <vers num="3.5.7"/>
        <vers num="3.5.8"/>
        <vers num="3.5.9"/>
        <vers num="3.6"/>
        <vers num="3.6.10"/>
        <vers num="3.6.11"/>
        <vers num="3.6.12"/>
        <vers num="3.6.13"/>
        <vers num="3.6.14"/>
        <vers num="3.6.15"/>
        <vers num="3.6.16"/>
        <vers num="3.6.17"/>
        <vers num="3.6.18"/>
        <vers num="3.6.19"/>
        <vers num="3.6.2"/>
        <vers num="3.6.20"/>
        <vers num="3.6.21"/>
        <vers num="3.6.22"/>
        <vers num="3.6.23"/>
        <vers num="3.6.24"/>
        <vers num="3.6.25"/>
        <vers num="3.6.26"/>
        <vers num="3.6.27"/>
        <vers num="3.6.28"/>
        <vers num="3.6.3"/>
        <vers num="3.6.4"/>
        <vers num="3.6.6"/>
        <vers num="3.6.7"/>
        <vers num="3.6.8"/>
        <vers num="3.6.9"/>
        <vers num="4.0" edition="beta1"/>
        <vers num="4.0" edition="beta10"/>
        <vers num="4.0" edition="beta11"/>
        <vers num="4.0" edition="beta12"/>
        <vers num="4.0" edition="beta2"/>
        <vers num="4.0" edition="beta3"/>
        <vers num="4.0" edition="beta4"/>
        <vers num="4.0" edition="beta5"/>
        <vers num="4.0" edition="beta6"/>
        <vers num="4.0" edition="beta7"/>
        <vers num="4.0" edition="beta8"/>
        <vers num="4.0" edition="beta9"/>
        <vers num="4.0.1"/>
        <vers num="5.0"/>
        <vers num="5.0.1"/>
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers num="6.0.2"/>
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="8.0"/>
        <vers num="8.0.1"/>
        <vers num="9.0"/>
        <vers num="9.0.1"/>
      </prod>
      <prod vendor="mozilla" name="firefox_esr">
        <vers num="24.0"/>
        <vers num="24.0.1"/>
        <vers num="24.0.2"/>
        <vers num="24.1.0"/>
        <vers num="24.1.1"/>
        <vers num="24.2"/>
        <vers num="24.3"/>
      </prod>
      <prod vendor="mozilla" name="seamonkey">
        <vers num="2.0" edition="alpha_1"/>
        <vers num="2.0" edition="alpha_2"/>
        <vers num="2.0" edition="alpha_3"/>
        <vers num="2.0" edition="beta_1"/>
        <vers num="2.0" edition="beta_2"/>
        <vers num="2.0" edition="rc1"/>
        <vers num="2.0" edition="rc2"/>
        <vers num="2.0.1"/>
        <vers num="2.0.10"/>
        <vers num="2.0.11"/>
        <vers num="2.0.12"/>
        <vers num="2.0.13"/>
        <vers num="2.0.14"/>
        <vers num="2.0.2"/>
        <vers num="2.0.3"/>
        <vers num="2.0.4"/>
        <vers num="2.0.5"/>
        <vers num="2.0.6"/>
        <vers num="2.0.7"/>
        <vers num="2.0.8"/>
        <vers num="2.0.9"/>
        <vers num="2.1" edition="alpha1"/>
        <vers num="2.1" edition="alpha2"/>
        <vers num="2.1" edition="alpha3"/>
        <vers num="2.1" edition="beta1"/>
        <vers num="2.1" edition="beta2"/>
        <vers num="2.1" edition="beta3"/>
        <vers num="2.1" edition="rc1"/>
        <vers num="2.1" edition="rc2"/>
        <vers num="2.10" edition="beta1"/>
        <vers num="2.10" edition="beta2"/>
        <vers num="2.10" edition="beta3"/>
        <vers num="2.10.1"/>
        <vers num="2.11" edition="beta1"/>
        <vers num="2.11" edition="beta2"/>
        <vers num="2.11" edition="beta3"/>
        <vers num="2.11" edition="beta4"/>
        <vers num="2.11" edition="beta5"/>
        <vers num="2.11" edition="beta6"/>
        <vers num="2.12" edition="beta1"/>
        <vers num="2.12" edition="beta2"/>
        <vers num="2.12" edition="beta3"/>
        <vers num="2.12" edition="beta4"/>
        <vers num="2.12" edition="beta5"/>
        <vers num="2.12" edition="beta6"/>
        <vers num="2.12.1"/>
        <vers num="2.13" edition="beta1"/>
        <vers num="2.13" edition="beta2"/>
        <vers num="2.13" edition="beta3"/>
        <vers num="2.13" edition="beta4"/>
        <vers num="2.13" edition="beta5"/>
        <vers num="2.13" edition="beta6"/>
        <vers num="2.13.1"/>
        <vers num="2.13.2"/>
        <vers num="2.14" edition="beta1"/>
        <vers num="2.14" edition="beta2"/>
        <vers num="2.14" edition="beta3"/>
        <vers num="2.14" edition="beta4"/>
        <vers num="2.14" edition="beta5"/>
        <vers num="2.15" edition="beta1"/>
        <vers num="2.15" edition="beta2"/>
        <vers num="2.15" edition="beta3"/>
        <vers num="2.15" edition="beta4"/>
        <vers num="2.15" edition="beta5"/>
        <vers num="2.15" edition="beta6"/>
        <vers num="2.15.1"/>
        <vers num="2.15.2"/>
        <vers num="2.16" edition="beta1"/>
        <vers num="2.16" edition="beta2"/>
        <vers num="2.16" edition="beta3"/>
        <vers num="2.16" edition="beta4"/>
        <vers num="2.16" edition="beta5"/>
        <vers num="2.16.1"/>
        <vers num="2.16.2"/>
        <vers num="2.17" edition="beta1"/>
        <vers num="2.17" edition="beta2"/>
        <vers num="2.17" edition="beta3"/>
        <vers num="2.17" edition="beta4"/>
        <vers num="2.17.1"/>
        <vers num="2.18" edition="beta1"/>
        <vers num="2.18" edition="beta2"/>
        <vers num="2.18" edition="beta3"/>
        <vers num="2.18" edition="beta4"/>
        <vers num="2.19" edition="beta1"/>
        <vers num="2.19" edition="beta2"/>
        <vers num="2.2" edition="beta1"/>
        <vers num="2.2" edition="beta2"/>
        <vers num="2.2" edition="beta3"/>
        <vers num="2.20" edition="beta1"/>
        <vers num="2.20" edition="beta2"/>
        <vers num="2.20" edition="beta3"/>
        <vers num="2.21" edition="beta1"/>
        <vers num="2.21" edition="beta2"/>
        <vers num="2.22" edition="beta1"/>
        <vers num="2.22" edition="beta2"/>
        <vers num="2.22.1"/>
        <vers num="2.23" edition="beta1"/>
        <vers num="2.23" edition="beta2"/>
        <vers num="2.24" edition="beta1"/>
        <vers prev="1" num="2.25" edition="beta1"/>
        <vers prev="1" num="2.25" edition="beta2"/>
        <vers num="2.3" edition="beta1"/>
        <vers num="2.3" edition="beta2"/>
        <vers num="2.3" edition="beta3"/>
        <vers num="2.3.1"/>
        <vers num="2.3.2"/>
        <vers num="2.3.3"/>
        <vers num="2.4" edition="beta1"/>
        <vers num="2.4" edition="beta2"/>
        <vers num="2.4" edition="beta3"/>
        <vers num="2.4.1"/>
        <vers num="2.5" edition="beta1"/>
        <vers num="2.5" edition="beta2"/>
        <vers num="2.5" edition="beta3"/>
        <vers num="2.5" edition="beta4"/>
        <vers num="2.6" edition="beta1"/>
        <vers num="2.6" edition="beta2"/>
        <vers num="2.6" edition="beta3"/>
        <vers num="2.6" edition="beta4"/>
        <vers num="2.6.1"/>
        <vers num="2.7" edition="beta1"/>
        <vers num="2.7" edition="beta2"/>
        <vers num="2.7" edition="beta3"/>
        <vers num="2.7" edition="beta4"/>
        <vers num="2.7" edition="beta5"/>
        <vers num="2.7.1"/>
        <vers num="2.7.2"/>
        <vers num="2.8" edition="beta1"/>
        <vers num="2.8" edition="beta2"/>
        <vers num="2.8" edition="beta3"/>
        <vers num="2.8" edition="beta4"/>
        <vers num="2.8" edition="beta5"/>
        <vers num="2.8" edition="beta6"/>
        <vers num="2.9" edition="beta1"/>
        <vers num="2.9" edition="beta2"/>
        <vers num="2.9" edition="beta3"/>
        <vers num="2.9" edition="beta4"/>
        <vers num="2.9.1"/>
      </prod>
      <prod vendor="mozilla" name="thunderbird">
        <vers num="0.1"/>
        <vers num="0.2"/>
        <vers num="0.3"/>
        <vers num="0.4"/>
        <vers num="0.5"/>
        <vers num="0.6"/>
        <vers num="0.7"/>
        <vers num="0.7.1"/>
        <vers num="0.7.2"/>
        <vers num="0.7.3"/>
        <vers num="0.8"/>
        <vers num="0.9"/>
        <vers num="1.0"/>
        <vers num="1.0.1"/>
        <vers num="1.0.2"/>
        <vers num="1.0.3"/>
        <vers num="1.0.4"/>
        <vers num="1.0.5" edition="beta"/>
        <vers num="1.0.6"/>
        <vers num="1.0.7"/>
        <vers num="1.0.8"/>
        <vers num="1.5" edition="beta2"/>
        <vers num="1.5.0.1"/>
        <vers num="1.5.0.10"/>
        <vers num="1.5.0.11"/>
        <vers num="1.5.0.12"/>
        <vers num="1.5.0.13"/>
        <vers num="1.5.0.14"/>
        <vers num="1.5.0.2"/>
        <vers num="1.5.0.3"/>
        <vers num="1.5.0.4"/>
        <vers num="1.5.0.5"/>
        <vers num="1.5.0.6"/>
        <vers num="1.5.0.7"/>
        <vers num="1.5.0.8"/>
        <vers num="1.5.0.9"/>
        <vers num="1.5.1"/>
        <vers num="1.5.2"/>
        <vers num="1.7.1"/>
        <vers num="1.7.3"/>
        <vers num="10.0"/>
        <vers num="10.0.1"/>
        <vers num="10.0.2"/>
        <vers num="10.0.3"/>
        <vers num="10.0.4"/>
        <vers num="11.0"/>
        <vers num="11.0.1"/>
        <vers num="12.0"/>
        <vers num="12.0.1"/>
        <vers num="13.0"/>
        <vers num="13.0.1"/>
        <vers num="14.0"/>
        <vers num="15.0"/>
        <vers num="15.0.1"/>
        <vers num="16.0"/>
        <vers num="16.0.1"/>
        <vers num="16.0.2"/>
        <vers num="17.0"/>
        <vers num="17.0.1"/>
        <vers num="17.0.2"/>
        <vers num="17.0.3"/>
        <vers num="17.0.4"/>
        <vers num="17.0.5"/>
        <vers num="17.0.6"/>
        <vers num="17.0.7"/>
        <vers num="17.0.8"/>
        <vers num="2.0"/>
        <vers num="2.0.0.0"/>
        <vers num="2.0.0.1"/>
        <vers num="2.0.0.11"/>
        <vers num="2.0.0.12"/>
        <vers num="2.0.0.13"/>
        <vers num="2.0.0.14"/>
        <vers num="2.0.0.15"/>
        <vers num="2.0.0.16"/>
        <vers num="2.0.0.17"/>
        <vers num="2.0.0.18"/>
        <vers num="2.0.0.19"/>
        <vers num="2.0.0.2"/>
        <vers num="2.0.0.20"/>
        <vers num="2.0.0.21"/>
        <vers num="2.0.0.22"/>
        <vers num="2.0.0.23"/>
        <vers num="2.0.0.3"/>
        <vers num="2.0.0.4"/>
        <vers num="2.0.0.5"/>
        <vers num="2.0.0.6"/>
        <vers num="2.0.0.7"/>
        <vers num="2.0.0.8"/>
        <vers num="2.0.0.9"/>
        <vers num="24.0"/>
        <vers num="24.0.1"/>
        <vers num="24.1"/>
        <vers num="24.1.1"/>
        <vers num="24.2"/>
        <vers prev="1" num="24.3"/>
        <vers num="3.0"/>
        <vers num="3.0.1"/>
        <vers num="3.0.10"/>
        <vers num="3.0.11"/>
        <vers num="3.0.2"/>
        <vers num="3.0.3"/>
        <vers num="3.0.4"/>
        <vers num="3.0.5"/>
        <vers num="3.0.6"/>
        <vers num="3.0.7"/>
        <vers num="3.0.8"/>
        <vers num="3.0.9"/>
        <vers num="3.1"/>
        <vers num="3.1.1"/>
        <vers num="3.1.10"/>
        <vers num="3.1.11"/>
        <vers num="3.1.12"/>
        <vers num="3.1.13"/>
        <vers num="3.1.14"/>
        <vers num="3.1.15"/>
        <vers num="3.1.16"/>
        <vers num="3.1.17"/>
        <vers num="3.1.2"/>
        <vers num="3.1.3"/>
        <vers num="3.1.4"/>
        <vers num="3.1.5"/>
        <vers num="3.1.6"/>
        <vers num="3.1.7"/>
        <vers num="3.1.8"/>
        <vers num="3.1.9"/>
        <vers num="5.0"/>
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers num="6.0.2"/>
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="8.0"/>
        <vers num="9.0"/>
        <vers num="9.0.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1498" published="2014-03-19" name="CVE-2014-1498" modified="2014-04-01" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:P)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">The crypto.generateCRMFRequest method in Mozilla Firefox before 28.0 and SeaMonkey before 2.25 does not properly validate a certain key type, which allows remote attackers to cause a denial of service (application crash) via vectors that trigger generation of a key that supports the Elliptic Curve ec-dual-use algorithm.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=935618" source="CONFIRM">https://bugzilla.mozilla.org/show_bug.cgi?id=935618</ref>
      <ref url="http://www.mozilla.org/security/announce/2014/mfsa2014-18.html" source="CONFIRM" adv="1">http://www.mozilla.org/security/announce/2014/mfsa2014-18.html</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00022.html" source="SUSE">openSUSE-SU-2014:0448</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.html" source="SUSE">openSUSE-SU-2014:0419</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00016.html" source="SUSE">SUSE-SU-2014:0418</ref>
    </refs>
    <vuln_soft>
      <prod vendor="mozilla" name="firefox">
        <vers num="0.1"/>
        <vers num="0.10"/>
        <vers num="0.10.1"/>
        <vers num="0.2"/>
        <vers num="0.3"/>
        <vers num="0.4"/>
        <vers num="0.5"/>
        <vers num="0.6"/>
        <vers num="0.6.1"/>
        <vers num="0.7"/>
        <vers num="0.7.1"/>
        <vers num="0.8"/>
        <vers num="0.9" edition="rc"/>
        <vers num="0.9.1"/>
        <vers num="0.9.2"/>
        <vers num="0.9.3"/>
        <vers num="1.0" edition="preview_release"/>
        <vers num="1.0.1"/>
        <vers num="1.0.2"/>
        <vers num="1.0.3"/>
        <vers num="1.0.4"/>
        <vers num="1.0.5"/>
        <vers num="1.0.6"/>
        <vers num="1.0.7"/>
        <vers num="1.0.8"/>
        <vers num="1.5" edition="beta1"/>
        <vers num="1.5" edition="beta2"/>
        <vers num="1.5.0.1"/>
        <vers num="1.5.0.10"/>
        <vers num="1.5.0.11"/>
        <vers num="1.5.0.12"/>
        <vers num="1.5.0.2"/>
        <vers num="1.5.0.3"/>
        <vers num="1.5.0.4"/>
        <vers num="1.5.0.5"/>
        <vers num="1.5.0.6"/>
        <vers num="1.5.0.7"/>
        <vers num="1.5.0.8"/>
        <vers num="1.5.0.9"/>
        <vers num="1.5.1"/>
        <vers num="1.5.2"/>
        <vers num="1.5.3"/>
        <vers num="1.5.4"/>
        <vers num="1.5.5"/>
        <vers num="1.5.6"/>
        <vers num="1.5.7"/>
        <vers num="1.5.8"/>
        <vers num="10.0"/>
        <vers num="10.0.1"/>
        <vers num="10.0.10"/>
        <vers num="10.0.11"/>
        <vers num="10.0.12"/>
        <vers num="10.0.2"/>
        <vers num="10.0.3"/>
        <vers num="10.0.4"/>
        <vers num="10.0.5"/>
        <vers num="10.0.6"/>
        <vers num="10.0.7"/>
        <vers num="10.0.8"/>
        <vers num="10.0.9"/>
        <vers num="11.0"/>
        <vers num="12.0" edition="beta6"/>
        <vers num="13.0"/>
        <vers num="13.0.1"/>
        <vers num="14.0"/>
        <vers num="14.0.1"/>
        <vers num="15.0"/>
        <vers num="15.0.1"/>
        <vers num="16.0"/>
        <vers num="16.0.1"/>
        <vers num="16.0.2"/>
        <vers num="17.0.10"/>
        <vers num="17.0.11"/>
        <vers num="17.0.2"/>
        <vers num="17.0.3"/>
        <vers num="17.0.4"/>
        <vers num="17.0.5"/>
        <vers num="17.0.6"/>
        <vers num="17.0.7"/>
        <vers num="17.0.8"/>
        <vers num="17.0.9"/>
        <vers num="18.0"/>
        <vers num="18.0.1"/>
        <vers num="18.0.2"/>
        <vers num="19.0"/>
        <vers num="19.0.1"/>
        <vers num="19.0.2"/>
        <vers num="2.0"/>
        <vers num="2.0.0.1"/>
        <vers num="2.0.0.10"/>
        <vers num="2.0.0.11"/>
        <vers num="2.0.0.12"/>
        <vers num="2.0.0.13"/>
        <vers num="2.0.0.14"/>
        <vers num="2.0.0.15"/>
        <vers num="2.0.0.16"/>
        <vers num="2.0.0.17"/>
        <vers num="2.0.0.18"/>
        <vers num="2.0.0.19"/>
        <vers num="2.0.0.2"/>
        <vers num="2.0.0.20"/>
        <vers num="2.0.0.3"/>
        <vers num="2.0.0.4"/>
        <vers num="2.0.0.5"/>
        <vers num="2.0.0.6"/>
        <vers num="2.0.0.7"/>
        <vers num="2.0.0.8"/>
        <vers num="2.0.0.9"/>
        <vers num="20.0"/>
        <vers num="20.0.1"/>
        <vers num="21.0"/>
        <vers num="23.0"/>
        <vers num="23.0.1"/>
        <vers num="24.0"/>
        <vers num="24.1"/>
        <vers num="24.1.1"/>
        <vers num="25.0"/>
        <vers num="25.0.1"/>
        <vers num="26.0"/>
        <vers num="27.0"/>
        <vers prev="1" num="27.0.1"/>
        <vers num="3.0"/>
        <vers num="3.0.1"/>
        <vers num="3.0.10"/>
        <vers num="3.0.11"/>
        <vers num="3.0.12"/>
        <vers num="3.0.13"/>
        <vers num="3.0.14"/>
        <vers num="3.0.15"/>
        <vers num="3.0.16"/>
        <vers num="3.0.17"/>
        <vers num="3.0.18"/>
        <vers num="3.0.19"/>
        <vers num="3.0.2"/>
        <vers num="3.0.3"/>
        <vers num="3.0.4"/>
        <vers num="3.0.5"/>
        <vers num="3.0.6"/>
        <vers num="3.0.7"/>
        <vers num="3.0.8"/>
        <vers num="3.0.9"/>
        <vers num="3.5"/>
        <vers num="3.5.1"/>
        <vers num="3.5.10"/>
        <vers num="3.5.11"/>
        <vers num="3.5.12"/>
        <vers num="3.5.13"/>
        <vers num="3.5.14"/>
        <vers num="3.5.15"/>
        <vers num="3.5.16"/>
        <vers num="3.5.17"/>
        <vers num="3.5.18"/>
        <vers num="3.5.19"/>
        <vers num="3.5.2"/>
        <vers num="3.5.3"/>
        <vers num="3.5.4"/>
        <vers num="3.5.5"/>
        <vers num="3.5.6"/>
        <vers num="3.5.7"/>
        <vers num="3.5.8"/>
        <vers num="3.5.9"/>
        <vers num="3.6"/>
        <vers num="3.6.10"/>
        <vers num="3.6.11"/>
        <vers num="3.6.12"/>
        <vers num="3.6.13"/>
        <vers num="3.6.14"/>
        <vers num="3.6.15"/>
        <vers num="3.6.16"/>
        <vers num="3.6.17"/>
        <vers num="3.6.18"/>
        <vers num="3.6.19"/>
        <vers num="3.6.2"/>
        <vers num="3.6.20"/>
        <vers num="3.6.21"/>
        <vers num="3.6.22"/>
        <vers num="3.6.23"/>
        <vers num="3.6.24"/>
        <vers num="3.6.25"/>
        <vers num="3.6.26"/>
        <vers num="3.6.27"/>
        <vers num="3.6.28"/>
        <vers num="3.6.3"/>
        <vers num="3.6.4"/>
        <vers num="3.6.6"/>
        <vers num="3.6.7"/>
        <vers num="3.6.8"/>
        <vers num="3.6.9"/>
        <vers num="4.0" edition="beta1"/>
        <vers num="4.0" edition="beta10"/>
        <vers num="4.0" edition="beta11"/>
        <vers num="4.0" edition="beta12"/>
        <vers num="4.0" edition="beta2"/>
        <vers num="4.0" edition="beta3"/>
        <vers num="4.0" edition="beta4"/>
        <vers num="4.0" edition="beta5"/>
        <vers num="4.0" edition="beta6"/>
        <vers num="4.0" edition="beta7"/>
        <vers num="4.0" edition="beta8"/>
        <vers num="4.0" edition="beta9"/>
        <vers num="4.0.1"/>
        <vers num="5.0"/>
        <vers num="5.0.1"/>
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers num="6.0.2"/>
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="8.0"/>
        <vers num="8.0.1"/>
        <vers num="9.0"/>
        <vers num="9.0.1"/>
      </prod>
      <prod vendor="mozilla" name="seamonkey">
        <vers num="2.0" edition="alpha_1"/>
        <vers num="2.0" edition="alpha_2"/>
        <vers num="2.0" edition="alpha_3"/>
        <vers num="2.0" edition="beta_1"/>
        <vers num="2.0" edition="beta_2"/>
        <vers num="2.0" edition="rc1"/>
        <vers num="2.0" edition="rc2"/>
        <vers num="2.0.1"/>
        <vers num="2.0.10"/>
        <vers num="2.0.11"/>
        <vers num="2.0.12"/>
        <vers num="2.0.13"/>
        <vers num="2.0.14"/>
        <vers num="2.0.2"/>
        <vers num="2.0.3"/>
        <vers num="2.0.4"/>
        <vers num="2.0.5"/>
        <vers num="2.0.6"/>
        <vers num="2.0.7"/>
        <vers num="2.0.8"/>
        <vers num="2.0.9"/>
        <vers num="2.1" edition="alpha1"/>
        <vers num="2.1" edition="alpha2"/>
        <vers num="2.1" edition="alpha3"/>
        <vers num="2.1" edition="beta1"/>
        <vers num="2.1" edition="beta2"/>
        <vers num="2.1" edition="beta3"/>
        <vers num="2.1" edition="rc1"/>
        <vers num="2.1" edition="rc2"/>
        <vers num="2.10" edition="beta1"/>
        <vers num="2.10" edition="beta2"/>
        <vers num="2.10" edition="beta3"/>
        <vers num="2.10.1"/>
        <vers num="2.11" edition="beta1"/>
        <vers num="2.11" edition="beta2"/>
        <vers num="2.11" edition="beta3"/>
        <vers num="2.11" edition="beta4"/>
        <vers num="2.11" edition="beta5"/>
        <vers num="2.11" edition="beta6"/>
        <vers num="2.12" edition="beta1"/>
        <vers num="2.12" edition="beta2"/>
        <vers num="2.12" edition="beta3"/>
        <vers num="2.12" edition="beta4"/>
        <vers num="2.12" edition="beta5"/>
        <vers num="2.12" edition="beta6"/>
        <vers num="2.12.1"/>
        <vers num="2.13" edition="beta1"/>
        <vers num="2.13" edition="beta2"/>
        <vers num="2.13" edition="beta3"/>
        <vers num="2.13" edition="beta4"/>
        <vers num="2.13" edition="beta5"/>
        <vers num="2.13" edition="beta6"/>
        <vers num="2.13.1"/>
        <vers num="2.13.2"/>
        <vers num="2.14" edition="beta1"/>
        <vers num="2.14" edition="beta2"/>
        <vers num="2.14" edition="beta3"/>
        <vers num="2.14" edition="beta4"/>
        <vers num="2.14" edition="beta5"/>
        <vers num="2.15" edition="beta1"/>
        <vers num="2.15" edition="beta2"/>
        <vers num="2.15" edition="beta3"/>
        <vers num="2.15" edition="beta4"/>
        <vers num="2.15" edition="beta5"/>
        <vers num="2.15" edition="beta6"/>
        <vers num="2.15.1"/>
        <vers num="2.15.2"/>
        <vers num="2.16" edition="beta1"/>
        <vers num="2.16" edition="beta2"/>
        <vers num="2.16" edition="beta3"/>
        <vers num="2.16" edition="beta4"/>
        <vers num="2.16" edition="beta5"/>
        <vers num="2.16.1"/>
        <vers num="2.16.2"/>
        <vers num="2.17" edition="beta1"/>
        <vers num="2.17" edition="beta2"/>
        <vers num="2.17" edition="beta3"/>
        <vers num="2.17" edition="beta4"/>
        <vers num="2.17.1"/>
        <vers num="2.18" edition="beta1"/>
        <vers num="2.18" edition="beta2"/>
        <vers num="2.18" edition="beta3"/>
        <vers num="2.18" edition="beta4"/>
        <vers num="2.19" edition="beta1"/>
        <vers num="2.19" edition="beta2"/>
        <vers num="2.2" edition="beta1"/>
        <vers num="2.2" edition="beta2"/>
        <vers num="2.2" edition="beta3"/>
        <vers num="2.20" edition="beta1"/>
        <vers num="2.20" edition="beta2"/>
        <vers num="2.20" edition="beta3"/>
        <vers num="2.21" edition="beta1"/>
        <vers num="2.21" edition="beta2"/>
        <vers num="2.22" edition="beta1"/>
        <vers num="2.22" edition="beta2"/>
        <vers num="2.22.1"/>
        <vers num="2.23" edition="beta1"/>
        <vers num="2.23" edition="beta2"/>
        <vers num="2.24" edition="beta1"/>
        <vers prev="1" num="2.25" edition="beta1"/>
        <vers prev="1" num="2.25" edition="beta2"/>
        <vers num="2.3" edition="beta1"/>
        <vers num="2.3" edition="beta2"/>
        <vers num="2.3" edition="beta3"/>
        <vers num="2.3.1"/>
        <vers num="2.3.2"/>
        <vers num="2.3.3"/>
        <vers num="2.4" edition="beta1"/>
        <vers num="2.4" edition="beta2"/>
        <vers num="2.4" edition="beta3"/>
        <vers num="2.4.1"/>
        <vers num="2.5" edition="beta1"/>
        <vers num="2.5" edition="beta2"/>
        <vers num="2.5" edition="beta3"/>
        <vers num="2.5" edition="beta4"/>
        <vers num="2.6" edition="beta1"/>
        <vers num="2.6" edition="beta2"/>
        <vers num="2.6" edition="beta3"/>
        <vers num="2.6" edition="beta4"/>
        <vers num="2.6.1"/>
        <vers num="2.7" edition="beta1"/>
        <vers num="2.7" edition="beta2"/>
        <vers num="2.7" edition="beta3"/>
        <vers num="2.7" edition="beta4"/>
        <vers num="2.7" edition="beta5"/>
        <vers num="2.7.1"/>
        <vers num="2.7.2"/>
        <vers num="2.8" edition="beta1"/>
        <vers num="2.8" edition="beta2"/>
        <vers num="2.8" edition="beta3"/>
        <vers num="2.8" edition="beta4"/>
        <vers num="2.8" edition="beta5"/>
        <vers num="2.8" edition="beta6"/>
        <vers num="2.9" edition="beta1"/>
        <vers num="2.9" edition="beta2"/>
        <vers num="2.9" edition="beta3"/>
        <vers num="2.9" edition="beta4"/>
        <vers num="2.9.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1499" published="2014-03-19" name="CVE-2014-1499" modified="2014-04-01" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:N)" CVSS_score="5.8" CVSS_impact_subscore="4.9" CVSS_exploit_subscore="8.6" CVSS_base_score="5.8">
    <desc>
      <descript source="cve">Mozilla Firefox before 28.0 and SeaMonkey before 2.25 allow remote attackers to spoof the domain name in the WebRTC (1) camera or (2) microphone permission prompt by triggering navigation at a certain time during generation of this prompt.</descript>
    </desc>
    <loss_types>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=961512" source="CONFIRM">https://bugzilla.mozilla.org/show_bug.cgi?id=961512</ref>
      <ref url="http://www.mozilla.org/security/announce/2014/mfsa2014-19.html" source="CONFIRM" adv="1">http://www.mozilla.org/security/announce/2014/mfsa2014-19.html</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00022.html" source="SUSE">openSUSE-SU-2014:0448</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.html" source="SUSE">openSUSE-SU-2014:0419</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00016.html" source="SUSE">SUSE-SU-2014:0418</ref>
    </refs>
    <vuln_soft>
      <prod vendor="mozilla" name="firefox">
        <vers num="0.1"/>
        <vers num="0.10"/>
        <vers num="0.10.1"/>
        <vers num="0.2"/>
        <vers num="0.3"/>
        <vers num="0.4"/>
        <vers num="0.5"/>
        <vers num="0.6"/>
        <vers num="0.6.1"/>
        <vers num="0.7"/>
        <vers num="0.7.1"/>
        <vers num="0.8"/>
        <vers num="0.9" edition="rc"/>
        <vers num="0.9.1"/>
        <vers num="0.9.2"/>
        <vers num="0.9.3"/>
        <vers num="1.0" edition="preview_release"/>
        <vers num="1.0.1"/>
        <vers num="1.0.2"/>
        <vers num="1.0.3"/>
        <vers num="1.0.4"/>
        <vers num="1.0.5"/>
        <vers num="1.0.6"/>
        <vers num="1.0.7"/>
        <vers num="1.0.8"/>
        <vers num="1.5" edition="beta1"/>
        <vers num="1.5" edition="beta2"/>
        <vers num="1.5.0.1"/>
        <vers num="1.5.0.10"/>
        <vers num="1.5.0.11"/>
        <vers num="1.5.0.12"/>
        <vers num="1.5.0.2"/>
        <vers num="1.5.0.3"/>
        <vers num="1.5.0.4"/>
        <vers num="1.5.0.5"/>
        <vers num="1.5.0.6"/>
        <vers num="1.5.0.7"/>
        <vers num="1.5.0.8"/>
        <vers num="1.5.0.9"/>
        <vers num="1.5.1"/>
        <vers num="1.5.2"/>
        <vers num="1.5.3"/>
        <vers num="1.5.4"/>
        <vers num="1.5.5"/>
        <vers num="1.5.6"/>
        <vers num="1.5.7"/>
        <vers num="1.5.8"/>
        <vers num="10.0"/>
        <vers num="10.0.1"/>
        <vers num="10.0.10"/>
        <vers num="10.0.11"/>
        <vers num="10.0.12"/>
        <vers num="10.0.2"/>
        <vers num="10.0.3"/>
        <vers num="10.0.4"/>
        <vers num="10.0.5"/>
        <vers num="10.0.6"/>
        <vers num="10.0.7"/>
        <vers num="10.0.8"/>
        <vers num="10.0.9"/>
        <vers num="11.0"/>
        <vers num="12.0" edition="beta6"/>
        <vers num="13.0"/>
        <vers num="13.0.1"/>
        <vers num="14.0"/>
        <vers num="14.0.1"/>
        <vers num="15.0"/>
        <vers num="15.0.1"/>
        <vers num="16.0"/>
        <vers num="16.0.1"/>
        <vers num="16.0.2"/>
        <vers num="17.0.10"/>
        <vers num="17.0.11"/>
        <vers num="17.0.2"/>
        <vers num="17.0.3"/>
        <vers num="17.0.4"/>
        <vers num="17.0.5"/>
        <vers num="17.0.6"/>
        <vers num="17.0.7"/>
        <vers num="17.0.8"/>
        <vers num="17.0.9"/>
        <vers num="18.0"/>
        <vers num="18.0.1"/>
        <vers num="18.0.2"/>
        <vers num="19.0"/>
        <vers num="19.0.1"/>
        <vers num="19.0.2"/>
        <vers num="2.0"/>
        <vers num="2.0.0.1"/>
        <vers num="2.0.0.10"/>
        <vers num="2.0.0.11"/>
        <vers num="2.0.0.12"/>
        <vers num="2.0.0.13"/>
        <vers num="2.0.0.14"/>
        <vers num="2.0.0.15"/>
        <vers num="2.0.0.16"/>
        <vers num="2.0.0.17"/>
        <vers num="2.0.0.18"/>
        <vers num="2.0.0.19"/>
        <vers num="2.0.0.2"/>
        <vers num="2.0.0.20"/>
        <vers num="2.0.0.3"/>
        <vers num="2.0.0.4"/>
        <vers num="2.0.0.5"/>
        <vers num="2.0.0.6"/>
        <vers num="2.0.0.7"/>
        <vers num="2.0.0.8"/>
        <vers num="2.0.0.9"/>
        <vers num="20.0"/>
        <vers num="20.0.1"/>
        <vers num="21.0"/>
        <vers num="23.0"/>
        <vers num="23.0.1"/>
        <vers num="24.0"/>
        <vers num="24.1"/>
        <vers num="24.1.1"/>
        <vers num="25.0"/>
        <vers num="25.0.1"/>
        <vers num="26.0"/>
        <vers num="27.0"/>
        <vers prev="1" num="27.0.1"/>
        <vers num="3.0"/>
        <vers num="3.0.1"/>
        <vers num="3.0.10"/>
        <vers num="3.0.11"/>
        <vers num="3.0.12"/>
        <vers num="3.0.13"/>
        <vers num="3.0.14"/>
        <vers num="3.0.15"/>
        <vers num="3.0.16"/>
        <vers num="3.0.17"/>
        <vers num="3.0.18"/>
        <vers num="3.0.19"/>
        <vers num="3.0.2"/>
        <vers num="3.0.3"/>
        <vers num="3.0.4"/>
        <vers num="3.0.5"/>
        <vers num="3.0.6"/>
        <vers num="3.0.7"/>
        <vers num="3.0.8"/>
        <vers num="3.0.9"/>
        <vers num="3.5"/>
        <vers num="3.5.1"/>
        <vers num="3.5.10"/>
        <vers num="3.5.11"/>
        <vers num="3.5.12"/>
        <vers num="3.5.13"/>
        <vers num="3.5.14"/>
        <vers num="3.5.15"/>
        <vers num="3.5.16"/>
        <vers num="3.5.17"/>
        <vers num="3.5.18"/>
        <vers num="3.5.19"/>
        <vers num="3.5.2"/>
        <vers num="3.5.3"/>
        <vers num="3.5.4"/>
        <vers num="3.5.5"/>
        <vers num="3.5.6"/>
        <vers num="3.5.7"/>
        <vers num="3.5.8"/>
        <vers num="3.5.9"/>
        <vers num="3.6"/>
        <vers num="3.6.10"/>
        <vers num="3.6.11"/>
        <vers num="3.6.12"/>
        <vers num="3.6.13"/>
        <vers num="3.6.14"/>
        <vers num="3.6.15"/>
        <vers num="3.6.16"/>
        <vers num="3.6.17"/>
        <vers num="3.6.18"/>
        <vers num="3.6.19"/>
        <vers num="3.6.2"/>
        <vers num="3.6.20"/>
        <vers num="3.6.21"/>
        <vers num="3.6.22"/>
        <vers num="3.6.23"/>
        <vers num="3.6.24"/>
        <vers num="3.6.25"/>
        <vers num="3.6.26"/>
        <vers num="3.6.27"/>
        <vers num="3.6.28"/>
        <vers num="3.6.3"/>
        <vers num="3.6.4"/>
        <vers num="3.6.6"/>
        <vers num="3.6.7"/>
        <vers num="3.6.8"/>
        <vers num="3.6.9"/>
        <vers num="4.0" edition="beta1"/>
        <vers num="4.0" edition="beta10"/>
        <vers num="4.0" edition="beta11"/>
        <vers num="4.0" edition="beta12"/>
        <vers num="4.0" edition="beta2"/>
        <vers num="4.0" edition="beta3"/>
        <vers num="4.0" edition="beta4"/>
        <vers num="4.0" edition="beta5"/>
        <vers num="4.0" edition="beta6"/>
        <vers num="4.0" edition="beta7"/>
        <vers num="4.0" edition="beta8"/>
        <vers num="4.0" edition="beta9"/>
        <vers num="4.0.1"/>
        <vers num="5.0"/>
        <vers num="5.0.1"/>
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers num="6.0.2"/>
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="8.0"/>
        <vers num="8.0.1"/>
        <vers num="9.0"/>
        <vers num="9.0.1"/>
      </prod>
      <prod vendor="mozilla" name="seamonkey">
        <vers num="2.0" edition="alpha_1"/>
        <vers num="2.0" edition="alpha_2"/>
        <vers num="2.0" edition="alpha_3"/>
        <vers num="2.0" edition="beta_1"/>
        <vers num="2.0" edition="beta_2"/>
        <vers num="2.0" edition="rc1"/>
        <vers num="2.0" edition="rc2"/>
        <vers num="2.0.1"/>
        <vers num="2.0.10"/>
        <vers num="2.0.11"/>
        <vers num="2.0.12"/>
        <vers num="2.0.13"/>
        <vers num="2.0.14"/>
        <vers num="2.0.2"/>
        <vers num="2.0.3"/>
        <vers num="2.0.4"/>
        <vers num="2.0.5"/>
        <vers num="2.0.6"/>
        <vers num="2.0.7"/>
        <vers num="2.0.8"/>
        <vers num="2.0.9"/>
        <vers num="2.1" edition="alpha1"/>
        <vers num="2.1" edition="alpha2"/>
        <vers num="2.1" edition="alpha3"/>
        <vers num="2.1" edition="beta1"/>
        <vers num="2.1" edition="beta2"/>
        <vers num="2.1" edition="beta3"/>
        <vers num="2.1" edition="rc1"/>
        <vers num="2.1" edition="rc2"/>
        <vers num="2.10" edition="beta1"/>
        <vers num="2.10" edition="beta2"/>
        <vers num="2.10" edition="beta3"/>
        <vers num="2.10.1"/>
        <vers num="2.11" edition="beta1"/>
        <vers num="2.11" edition="beta2"/>
        <vers num="2.11" edition="beta3"/>
        <vers num="2.11" edition="beta4"/>
        <vers num="2.11" edition="beta5"/>
        <vers num="2.11" edition="beta6"/>
        <vers num="2.12" edition="beta1"/>
        <vers num="2.12" edition="beta2"/>
        <vers num="2.12" edition="beta3"/>
        <vers num="2.12" edition="beta4"/>
        <vers num="2.12" edition="beta5"/>
        <vers num="2.12" edition="beta6"/>
        <vers num="2.12.1"/>
        <vers num="2.13" edition="beta1"/>
        <vers num="2.13" edition="beta2"/>
        <vers num="2.13" edition="beta3"/>
        <vers num="2.13" edition="beta4"/>
        <vers num="2.13" edition="beta5"/>
        <vers num="2.13" edition="beta6"/>
        <vers num="2.13.1"/>
        <vers num="2.13.2"/>
        <vers num="2.14" edition="beta1"/>
        <vers num="2.14" edition="beta2"/>
        <vers num="2.14" edition="beta3"/>
        <vers num="2.14" edition="beta4"/>
        <vers num="2.14" edition="beta5"/>
        <vers num="2.15" edition="beta1"/>
        <vers num="2.15" edition="beta2"/>
        <vers num="2.15" edition="beta3"/>
        <vers num="2.15" edition="beta4"/>
        <vers num="2.15" edition="beta5"/>
        <vers num="2.15" edition="beta6"/>
        <vers num="2.15.1"/>
        <vers num="2.15.2"/>
        <vers num="2.16" edition="beta1"/>
        <vers num="2.16" edition="beta2"/>
        <vers num="2.16" edition="beta3"/>
        <vers num="2.16" edition="beta4"/>
        <vers num="2.16" edition="beta5"/>
        <vers num="2.16.1"/>
        <vers num="2.16.2"/>
        <vers num="2.17" edition="beta1"/>
        <vers num="2.17" edition="beta2"/>
        <vers num="2.17" edition="beta3"/>
        <vers num="2.17" edition="beta4"/>
        <vers num="2.17.1"/>
        <vers num="2.18" edition="beta1"/>
        <vers num="2.18" edition="beta2"/>
        <vers num="2.18" edition="beta3"/>
        <vers num="2.18" edition="beta4"/>
        <vers num="2.19" edition="beta1"/>
        <vers num="2.19" edition="beta2"/>
        <vers num="2.2" edition="beta1"/>
        <vers num="2.2" edition="beta2"/>
        <vers num="2.2" edition="beta3"/>
        <vers num="2.20" edition="beta1"/>
        <vers num="2.20" edition="beta2"/>
        <vers num="2.20" edition="beta3"/>
        <vers num="2.21" edition="beta1"/>
        <vers num="2.21" edition="beta2"/>
        <vers num="2.22" edition="beta1"/>
        <vers num="2.22" edition="beta2"/>
        <vers num="2.22.1"/>
        <vers num="2.23" edition="beta1"/>
        <vers num="2.23" edition="beta2"/>
        <vers num="2.24" edition="beta1"/>
        <vers prev="1" num="2.25" edition="beta1"/>
        <vers prev="1" num="2.25" edition="beta2"/>
        <vers num="2.3" edition="beta1"/>
        <vers num="2.3" edition="beta2"/>
        <vers num="2.3" edition="beta3"/>
        <vers num="2.3.1"/>
        <vers num="2.3.2"/>
        <vers num="2.3.3"/>
        <vers num="2.4" edition="beta1"/>
        <vers num="2.4" edition="beta2"/>
        <vers num="2.4" edition="beta3"/>
        <vers num="2.4.1"/>
        <vers num="2.5" edition="beta1"/>
        <vers num="2.5" edition="beta2"/>
        <vers num="2.5" edition="beta3"/>
        <vers num="2.5" edition="beta4"/>
        <vers num="2.6" edition="beta1"/>
        <vers num="2.6" edition="beta2"/>
        <vers num="2.6" edition="beta3"/>
        <vers num="2.6" edition="beta4"/>
        <vers num="2.6.1"/>
        <vers num="2.7" edition="beta1"/>
        <vers num="2.7" edition="beta2"/>
        <vers num="2.7" edition="beta3"/>
        <vers num="2.7" edition="beta4"/>
        <vers num="2.7" edition="beta5"/>
        <vers num="2.7.1"/>
        <vers num="2.7.2"/>
        <vers num="2.8" edition="beta1"/>
        <vers num="2.8" edition="beta2"/>
        <vers num="2.8" edition="beta3"/>
        <vers num="2.8" edition="beta4"/>
        <vers num="2.8" edition="beta5"/>
        <vers num="2.8" edition="beta6"/>
        <vers num="2.9" edition="beta1"/>
        <vers num="2.9" edition="beta2"/>
        <vers num="2.9" edition="beta3"/>
        <vers num="2.9" edition="beta4"/>
        <vers num="2.9.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1500" published="2014-03-19" name="CVE-2014-1500" modified="2014-04-01" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:P)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">Mozilla Firefox before 28.0 and SeaMonkey before 2.25 allow remote attackers to cause a denial of service (resource consumption and application hang) via onbeforeunload events that trigger background JavaScript execution.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=956524" source="CONFIRM">https://bugzilla.mozilla.org/show_bug.cgi?id=956524</ref>
      <ref url="http://www.mozilla.org/security/announce/2014/mfsa2014-20.html" source="CONFIRM" adv="1">http://www.mozilla.org/security/announce/2014/mfsa2014-20.html</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00022.html" source="SUSE">openSUSE-SU-2014:0448</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.html" source="SUSE">openSUSE-SU-2014:0419</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00016.html" source="SUSE">SUSE-SU-2014:0418</ref>
    </refs>
    <vuln_soft>
      <prod vendor="mozilla" name="firefox">
        <vers num="0.1"/>
        <vers num="0.10"/>
        <vers num="0.10.1"/>
        <vers num="0.2"/>
        <vers num="0.3"/>
        <vers num="0.4"/>
        <vers num="0.5"/>
        <vers num="0.6"/>
        <vers num="0.6.1"/>
        <vers num="0.7"/>
        <vers num="0.7.1"/>
        <vers num="0.8"/>
        <vers num="0.9" edition="rc"/>
        <vers num="0.9.1"/>
        <vers num="0.9.2"/>
        <vers num="0.9.3"/>
        <vers num="1.0" edition="preview_release"/>
        <vers num="1.0.1"/>
        <vers num="1.0.2"/>
        <vers num="1.0.3"/>
        <vers num="1.0.4"/>
        <vers num="1.0.5"/>
        <vers num="1.0.6"/>
        <vers num="1.0.7"/>
        <vers num="1.0.8"/>
        <vers num="1.5" edition="beta1"/>
        <vers num="1.5" edition="beta2"/>
        <vers num="1.5.0.1"/>
        <vers num="1.5.0.10"/>
        <vers num="1.5.0.11"/>
        <vers num="1.5.0.12"/>
        <vers num="1.5.0.2"/>
        <vers num="1.5.0.3"/>
        <vers num="1.5.0.4"/>
        <vers num="1.5.0.5"/>
        <vers num="1.5.0.6"/>
        <vers num="1.5.0.7"/>
        <vers num="1.5.0.8"/>
        <vers num="1.5.0.9"/>
        <vers num="1.5.1"/>
        <vers num="1.5.2"/>
        <vers num="1.5.3"/>
        <vers num="1.5.4"/>
        <vers num="1.5.5"/>
        <vers num="1.5.6"/>
        <vers num="1.5.7"/>
        <vers num="1.5.8"/>
        <vers num="10.0"/>
        <vers num="10.0.1"/>
        <vers num="10.0.10"/>
        <vers num="10.0.11"/>
        <vers num="10.0.12"/>
        <vers num="10.0.2"/>
        <vers num="10.0.3"/>
        <vers num="10.0.4"/>
        <vers num="10.0.5"/>
        <vers num="10.0.6"/>
        <vers num="10.0.7"/>
        <vers num="10.0.8"/>
        <vers num="10.0.9"/>
        <vers num="11.0"/>
        <vers num="12.0" edition="beta6"/>
        <vers num="13.0"/>
        <vers num="13.0.1"/>
        <vers num="14.0"/>
        <vers num="14.0.1"/>
        <vers num="15.0"/>
        <vers num="15.0.1"/>
        <vers num="16.0"/>
        <vers num="16.0.1"/>
        <vers num="16.0.2"/>
        <vers num="17.0.10"/>
        <vers num="17.0.11"/>
        <vers num="17.0.2"/>
        <vers num="17.0.3"/>
        <vers num="17.0.4"/>
        <vers num="17.0.5"/>
        <vers num="17.0.6"/>
        <vers num="17.0.7"/>
        <vers num="17.0.8"/>
        <vers num="17.0.9"/>
        <vers num="18.0"/>
        <vers num="18.0.1"/>
        <vers num="18.0.2"/>
        <vers num="19.0"/>
        <vers num="19.0.1"/>
        <vers num="19.0.2"/>
        <vers num="2.0"/>
        <vers num="2.0.0.1"/>
        <vers num="2.0.0.10"/>
        <vers num="2.0.0.11"/>
        <vers num="2.0.0.12"/>
        <vers num="2.0.0.13"/>
        <vers num="2.0.0.14"/>
        <vers num="2.0.0.15"/>
        <vers num="2.0.0.16"/>
        <vers num="2.0.0.17"/>
        <vers num="2.0.0.18"/>
        <vers num="2.0.0.19"/>
        <vers num="2.0.0.2"/>
        <vers num="2.0.0.20"/>
        <vers num="2.0.0.3"/>
        <vers num="2.0.0.4"/>
        <vers num="2.0.0.5"/>
        <vers num="2.0.0.6"/>
        <vers num="2.0.0.7"/>
        <vers num="2.0.0.8"/>
        <vers num="2.0.0.9"/>
        <vers num="20.0"/>
        <vers num="20.0.1"/>
        <vers num="21.0"/>
        <vers num="23.0"/>
        <vers num="23.0.1"/>
        <vers num="24.0"/>
        <vers num="24.1"/>
        <vers num="24.1.1"/>
        <vers num="25.0"/>
        <vers num="25.0.1"/>
        <vers num="26.0"/>
        <vers num="27.0"/>
        <vers prev="1" num="27.0.1"/>
        <vers num="3.0"/>
        <vers num="3.0.1"/>
        <vers num="3.0.10"/>
        <vers num="3.0.11"/>
        <vers num="3.0.12"/>
        <vers num="3.0.13"/>
        <vers num="3.0.14"/>
        <vers num="3.0.15"/>
        <vers num="3.0.16"/>
        <vers num="3.0.17"/>
        <vers num="3.0.18"/>
        <vers num="3.0.19"/>
        <vers num="3.0.2"/>
        <vers num="3.0.3"/>
        <vers num="3.0.4"/>
        <vers num="3.0.5"/>
        <vers num="3.0.6"/>
        <vers num="3.0.7"/>
        <vers num="3.0.8"/>
        <vers num="3.0.9"/>
        <vers num="3.5"/>
        <vers num="3.5.1"/>
        <vers num="3.5.10"/>
        <vers num="3.5.11"/>
        <vers num="3.5.12"/>
        <vers num="3.5.13"/>
        <vers num="3.5.14"/>
        <vers num="3.5.15"/>
        <vers num="3.5.16"/>
        <vers num="3.5.17"/>
        <vers num="3.5.18"/>
        <vers num="3.5.19"/>
        <vers num="3.5.2"/>
        <vers num="3.5.3"/>
        <vers num="3.5.4"/>
        <vers num="3.5.5"/>
        <vers num="3.5.6"/>
        <vers num="3.5.7"/>
        <vers num="3.5.8"/>
        <vers num="3.5.9"/>
        <vers num="3.6"/>
        <vers num="3.6.10"/>
        <vers num="3.6.11"/>
        <vers num="3.6.12"/>
        <vers num="3.6.13"/>
        <vers num="3.6.14"/>
        <vers num="3.6.15"/>
        <vers num="3.6.16"/>
        <vers num="3.6.17"/>
        <vers num="3.6.18"/>
        <vers num="3.6.19"/>
        <vers num="3.6.2"/>
        <vers num="3.6.20"/>
        <vers num="3.6.21"/>
        <vers num="3.6.22"/>
        <vers num="3.6.23"/>
        <vers num="3.6.24"/>
        <vers num="3.6.25"/>
        <vers num="3.6.26"/>
        <vers num="3.6.27"/>
        <vers num="3.6.28"/>
        <vers num="3.6.3"/>
        <vers num="3.6.4"/>
        <vers num="3.6.6"/>
        <vers num="3.6.7"/>
        <vers num="3.6.8"/>
        <vers num="3.6.9"/>
        <vers num="4.0" edition="beta1"/>
        <vers num="4.0" edition="beta10"/>
        <vers num="4.0" edition="beta11"/>
        <vers num="4.0" edition="beta12"/>
        <vers num="4.0" edition="beta2"/>
        <vers num="4.0" edition="beta3"/>
        <vers num="4.0" edition="beta4"/>
        <vers num="4.0" edition="beta5"/>
        <vers num="4.0" edition="beta6"/>
        <vers num="4.0" edition="beta7"/>
        <vers num="4.0" edition="beta8"/>
        <vers num="4.0" edition="beta9"/>
        <vers num="4.0.1"/>
        <vers num="5.0"/>
        <vers num="5.0.1"/>
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers num="6.0.2"/>
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="8.0"/>
        <vers num="8.0.1"/>
        <vers num="9.0"/>
        <vers num="9.0.1"/>
      </prod>
      <prod vendor="mozilla" name="seamonkey">
        <vers num="2.0" edition="alpha_1"/>
        <vers num="2.0" edition="alpha_2"/>
        <vers num="2.0" edition="alpha_3"/>
        <vers num="2.0" edition="beta_1"/>
        <vers num="2.0" edition="beta_2"/>
        <vers num="2.0" edition="rc1"/>
        <vers num="2.0" edition="rc2"/>
        <vers num="2.0.1"/>
        <vers num="2.0.10"/>
        <vers num="2.0.11"/>
        <vers num="2.0.12"/>
        <vers num="2.0.13"/>
        <vers num="2.0.14"/>
        <vers num="2.0.2"/>
        <vers num="2.0.3"/>
        <vers num="2.0.4"/>
        <vers num="2.0.5"/>
        <vers num="2.0.6"/>
        <vers num="2.0.7"/>
        <vers num="2.0.8"/>
        <vers num="2.0.9"/>
        <vers num="2.1" edition="alpha1"/>
        <vers num="2.1" edition="alpha2"/>
        <vers num="2.1" edition="alpha3"/>
        <vers num="2.1" edition="beta1"/>
        <vers num="2.1" edition="beta2"/>
        <vers num="2.1" edition="beta3"/>
        <vers num="2.1" edition="rc1"/>
        <vers num="2.1" edition="rc2"/>
        <vers num="2.10" edition="beta1"/>
        <vers num="2.10" edition="beta2"/>
        <vers num="2.10" edition="beta3"/>
        <vers num="2.10.1"/>
        <vers num="2.11" edition="beta1"/>
        <vers num="2.11" edition="beta2"/>
        <vers num="2.11" edition="beta3"/>
        <vers num="2.11" edition="beta4"/>
        <vers num="2.11" edition="beta5"/>
        <vers num="2.11" edition="beta6"/>
        <vers num="2.12" edition="beta1"/>
        <vers num="2.12" edition="beta2"/>
        <vers num="2.12" edition="beta3"/>
        <vers num="2.12" edition="beta4"/>
        <vers num="2.12" edition="beta5"/>
        <vers num="2.12" edition="beta6"/>
        <vers num="2.12.1"/>
        <vers num="2.13" edition="beta1"/>
        <vers num="2.13" edition="beta2"/>
        <vers num="2.13" edition="beta3"/>
        <vers num="2.13" edition="beta4"/>
        <vers num="2.13" edition="beta5"/>
        <vers num="2.13" edition="beta6"/>
        <vers num="2.13.1"/>
        <vers num="2.13.2"/>
        <vers num="2.14" edition="beta1"/>
        <vers num="2.14" edition="beta2"/>
        <vers num="2.14" edition="beta3"/>
        <vers num="2.14" edition="beta4"/>
        <vers num="2.14" edition="beta5"/>
        <vers num="2.15" edition="beta1"/>
        <vers num="2.15" edition="beta2"/>
        <vers num="2.15" edition="beta3"/>
        <vers num="2.15" edition="beta4"/>
        <vers num="2.15" edition="beta5"/>
        <vers num="2.15" edition="beta6"/>
        <vers num="2.15.1"/>
        <vers num="2.15.2"/>
        <vers num="2.16" edition="beta1"/>
        <vers num="2.16" edition="beta2"/>
        <vers num="2.16" edition="beta3"/>
        <vers num="2.16" edition="beta4"/>
        <vers num="2.16" edition="beta5"/>
        <vers num="2.16.1"/>
        <vers num="2.16.2"/>
        <vers num="2.17" edition="beta1"/>
        <vers num="2.17" edition="beta2"/>
        <vers num="2.17" edition="beta3"/>
        <vers num="2.17" edition="beta4"/>
        <vers num="2.17.1"/>
        <vers num="2.18" edition="beta1"/>
        <vers num="2.18" edition="beta2"/>
        <vers num="2.18" edition="beta3"/>
        <vers num="2.18" edition="beta4"/>
        <vers num="2.19" edition="beta1"/>
        <vers num="2.19" edition="beta2"/>
        <vers num="2.2" edition="beta1"/>
        <vers num="2.2" edition="beta2"/>
        <vers num="2.2" edition="beta3"/>
        <vers num="2.20" edition="beta1"/>
        <vers num="2.20" edition="beta2"/>
        <vers num="2.20" edition="beta3"/>
        <vers num="2.21" edition="beta1"/>
        <vers num="2.21" edition="beta2"/>
        <vers num="2.22" edition="beta1"/>
        <vers num="2.22" edition="beta2"/>
        <vers num="2.22.1"/>
        <vers num="2.23" edition="beta1"/>
        <vers num="2.23" edition="beta2"/>
        <vers num="2.24" edition="beta1"/>
        <vers prev="1" num="2.25" edition="beta1"/>
        <vers prev="1" num="2.25" edition="beta2"/>
        <vers num="2.3" edition="beta1"/>
        <vers num="2.3" edition="beta2"/>
        <vers num="2.3" edition="beta3"/>
        <vers num="2.3.1"/>
        <vers num="2.3.2"/>
        <vers num="2.3.3"/>
        <vers num="2.4" edition="beta1"/>
        <vers num="2.4" edition="beta2"/>
        <vers num="2.4" edition="beta3"/>
        <vers num="2.4.1"/>
        <vers num="2.5" edition="beta1"/>
        <vers num="2.5" edition="beta2"/>
        <vers num="2.5" edition="beta3"/>
        <vers num="2.5" edition="beta4"/>
        <vers num="2.6" edition="beta1"/>
        <vers num="2.6" edition="beta2"/>
        <vers num="2.6" edition="beta3"/>
        <vers num="2.6" edition="beta4"/>
        <vers num="2.6.1"/>
        <vers num="2.7" edition="beta1"/>
        <vers num="2.7" edition="beta2"/>
        <vers num="2.7" edition="beta3"/>
        <vers num="2.7" edition="beta4"/>
        <vers num="2.7" edition="beta5"/>
        <vers num="2.7.1"/>
        <vers num="2.7.2"/>
        <vers num="2.8" edition="beta1"/>
        <vers num="2.8" edition="beta2"/>
        <vers num="2.8" edition="beta3"/>
        <vers num="2.8" edition="beta4"/>
        <vers num="2.8" edition="beta5"/>
        <vers num="2.8" edition="beta6"/>
        <vers num="2.9" edition="beta1"/>
        <vers num="2.9" edition="beta2"/>
        <vers num="2.9" edition="beta3"/>
        <vers num="2.9" edition="beta4"/>
        <vers num="2.9.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1501" published="2014-03-19" name="CVE-2014-1501" modified="2014-04-01" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:N)" CVSS_score="5.8" CVSS_impact_subscore="4.9" CVSS_exploit_subscore="8.6" CVSS_base_score="5.8">
    <desc>
      <descript source="cve">Mozilla Firefox before 28.0 on Android allows remote attackers to bypass the Same Origin Policy and access arbitrary file: URLs via vectors involving the "Open Link in New Tab" menu selection.</descript>
    </desc>
    <loss_types>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=960135" source="CONFIRM">https://bugzilla.mozilla.org/show_bug.cgi?id=960135</ref>
      <ref url="http://www.mozilla.org/security/announce/2014/mfsa2014-21.html" source="CONFIRM" adv="1">http://www.mozilla.org/security/announce/2014/mfsa2014-21.html</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00016.html" source="SUSE">SUSE-SU-2014:0418</ref>
    </refs>
    <vuln_soft>
      <prod vendor="mozilla" name="firefox">
        <vers num="0.1"/>
        <vers num="0.10"/>
        <vers num="0.10.1"/>
        <vers num="0.2"/>
        <vers num="0.3"/>
        <vers num="0.4"/>
        <vers num="0.5"/>
        <vers num="0.6"/>
        <vers num="0.6.1"/>
        <vers num="0.7"/>
        <vers num="0.7.1"/>
        <vers num="0.8"/>
        <vers num="0.9" edition="rc"/>
        <vers num="0.9.1"/>
        <vers num="0.9.2"/>
        <vers num="0.9.3"/>
        <vers num="1.0" edition="preview_release"/>
        <vers num="1.0.1"/>
        <vers num="1.0.2"/>
        <vers num="1.0.3"/>
        <vers num="1.0.4"/>
        <vers num="1.0.5"/>
        <vers num="1.0.6"/>
        <vers num="1.0.7"/>
        <vers num="1.0.8"/>
        <vers num="1.5" edition="beta1"/>
        <vers num="1.5" edition="beta2"/>
        <vers num="1.5.0.1"/>
        <vers num="1.5.0.10"/>
        <vers num="1.5.0.11"/>
        <vers num="1.5.0.12"/>
        <vers num="1.5.0.2"/>
        <vers num="1.5.0.3"/>
        <vers num="1.5.0.4"/>
        <vers num="1.5.0.5"/>
        <vers num="1.5.0.6"/>
        <vers num="1.5.0.7"/>
        <vers num="1.5.0.8"/>
        <vers num="1.5.0.9"/>
        <vers num="1.5.1"/>
        <vers num="1.5.2"/>
        <vers num="1.5.3"/>
        <vers num="1.5.4"/>
        <vers num="1.5.5"/>
        <vers num="1.5.6"/>
        <vers num="1.5.7"/>
        <vers num="1.5.8"/>
        <vers num="10.0"/>
        <vers num="10.0.1"/>
        <vers num="10.0.10"/>
        <vers num="10.0.11"/>
        <vers num="10.0.12"/>
        <vers num="10.0.2"/>
        <vers num="10.0.3"/>
        <vers num="10.0.4"/>
        <vers num="10.0.5"/>
        <vers num="10.0.6"/>
        <vers num="10.0.7"/>
        <vers num="10.0.8"/>
        <vers num="10.0.9"/>
        <vers num="11.0"/>
        <vers num="12.0" edition="beta6"/>
        <vers num="13.0"/>
        <vers num="13.0.1"/>
        <vers num="14.0"/>
        <vers num="14.0.1"/>
        <vers num="15.0"/>
        <vers num="15.0.1"/>
        <vers num="16.0"/>
        <vers num="16.0.1"/>
        <vers num="16.0.2"/>
        <vers num="17.0.10"/>
        <vers num="17.0.11"/>
        <vers num="17.0.2"/>
        <vers num="17.0.3"/>
        <vers num="17.0.4"/>
        <vers num="17.0.5"/>
        <vers num="17.0.6"/>
        <vers num="17.0.7"/>
        <vers num="17.0.8"/>
        <vers num="17.0.9"/>
        <vers num="18.0"/>
        <vers num="18.0.1"/>
        <vers num="18.0.2"/>
        <vers num="19.0"/>
        <vers num="19.0.1"/>
        <vers num="19.0.2"/>
        <vers num="2.0"/>
        <vers num="2.0.0.1"/>
        <vers num="2.0.0.10"/>
        <vers num="2.0.0.11"/>
        <vers num="2.0.0.12"/>
        <vers num="2.0.0.13"/>
        <vers num="2.0.0.14"/>
        <vers num="2.0.0.15"/>
        <vers num="2.0.0.16"/>
        <vers num="2.0.0.17"/>
        <vers num="2.0.0.18"/>
        <vers num="2.0.0.19"/>
        <vers num="2.0.0.2"/>
        <vers num="2.0.0.20"/>
        <vers num="2.0.0.3"/>
        <vers num="2.0.0.4"/>
        <vers num="2.0.0.5"/>
        <vers num="2.0.0.6"/>
        <vers num="2.0.0.7"/>
        <vers num="2.0.0.8"/>
        <vers num="2.0.0.9"/>
        <vers num="20.0"/>
        <vers num="20.0.1"/>
        <vers num="21.0"/>
        <vers num="23.0"/>
        <vers num="23.0.1"/>
        <vers num="24.0"/>
        <vers num="24.1"/>
        <vers num="24.1.1"/>
        <vers num="25.0"/>
        <vers num="25.0.1"/>
        <vers num="26.0"/>
        <vers num="27.0"/>
        <vers prev="1" num="27.0.1"/>
        <vers num="3.0"/>
        <vers num="3.0.1"/>
        <vers num="3.0.10"/>
        <vers num="3.0.11"/>
        <vers num="3.0.12"/>
        <vers num="3.0.13"/>
        <vers num="3.0.14"/>
        <vers num="3.0.15"/>
        <vers num="3.0.16"/>
        <vers num="3.0.17"/>
        <vers num="3.0.18"/>
        <vers num="3.0.19"/>
        <vers num="3.0.2"/>
        <vers num="3.0.3"/>
        <vers num="3.0.4"/>
        <vers num="3.0.5"/>
        <vers num="3.0.6"/>
        <vers num="3.0.7"/>
        <vers num="3.0.8"/>
        <vers num="3.0.9"/>
        <vers num="3.5"/>
        <vers num="3.5.1"/>
        <vers num="3.5.10"/>
        <vers num="3.5.11"/>
        <vers num="3.5.12"/>
        <vers num="3.5.13"/>
        <vers num="3.5.14"/>
        <vers num="3.5.15"/>
        <vers num="3.5.16"/>
        <vers num="3.5.17"/>
        <vers num="3.5.18"/>
        <vers num="3.5.19"/>
        <vers num="3.5.2"/>
        <vers num="3.5.3"/>
        <vers num="3.5.4"/>
        <vers num="3.5.5"/>
        <vers num="3.5.6"/>
        <vers num="3.5.7"/>
        <vers num="3.5.8"/>
        <vers num="3.5.9"/>
        <vers num="3.6"/>
        <vers num="3.6.10"/>
        <vers num="3.6.11"/>
        <vers num="3.6.12"/>
        <vers num="3.6.13"/>
        <vers num="3.6.14"/>
        <vers num="3.6.15"/>
        <vers num="3.6.16"/>
        <vers num="3.6.17"/>
        <vers num="3.6.18"/>
        <vers num="3.6.19"/>
        <vers num="3.6.2"/>
        <vers num="3.6.20"/>
        <vers num="3.6.21"/>
        <vers num="3.6.22"/>
        <vers num="3.6.23"/>
        <vers num="3.6.24"/>
        <vers num="3.6.25"/>
        <vers num="3.6.26"/>
        <vers num="3.6.27"/>
        <vers num="3.6.28"/>
        <vers num="3.6.3"/>
        <vers num="3.6.4"/>
        <vers num="3.6.6"/>
        <vers num="3.6.7"/>
        <vers num="3.6.8"/>
        <vers num="3.6.9"/>
        <vers num="4.0" edition="beta1"/>
        <vers num="4.0" edition="beta10"/>
        <vers num="4.0" edition="beta11"/>
        <vers num="4.0" edition="beta12"/>
        <vers num="4.0" edition="beta2"/>
        <vers num="4.0" edition="beta3"/>
        <vers num="4.0" edition="beta4"/>
        <vers num="4.0" edition="beta5"/>
        <vers num="4.0" edition="beta6"/>
        <vers num="4.0" edition="beta7"/>
        <vers num="4.0" edition="beta8"/>
        <vers num="4.0" edition="beta9"/>
        <vers num="4.0.1"/>
        <vers num="5.0"/>
        <vers num="5.0.1"/>
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers num="6.0.2"/>
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="8.0"/>
        <vers num="8.0.1"/>
        <vers num="9.0"/>
        <vers num="9.0.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1502" published="2014-03-19" name="CVE-2014-1502" modified="2014-04-01" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:P)" CVSS_score="6.8" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.6" CVSS_base_score="6.8">
    <desc>
      <descript source="cve">The (1) WebGL.compressedTexImage2D and (2) WebGL.compressedTexSubImage2D functions in Mozilla Firefox before 28.0 and SeaMonkey before 2.25 allow remote attackers to bypass the Same Origin Policy and render content in a different domain via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=972622" source="CONFIRM">https://bugzilla.mozilla.org/show_bug.cgi?id=972622</ref>
      <ref url="http://www.mozilla.org/security/announce/2014/mfsa2014-22.html" source="CONFIRM" adv="1">http://www.mozilla.org/security/announce/2014/mfsa2014-22.html</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00022.html" source="SUSE">openSUSE-SU-2014:0448</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.html" source="SUSE">openSUSE-SU-2014:0419</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00016.html" source="SUSE">SUSE-SU-2014:0418</ref>
    </refs>
    <vuln_soft>
      <prod vendor="mozilla" name="firefox">
        <vers num="0.1"/>
        <vers num="0.10"/>
        <vers num="0.10.1"/>
        <vers num="0.2"/>
        <vers num="0.3"/>
        <vers num="0.4"/>
        <vers num="0.5"/>
        <vers num="0.6"/>
        <vers num="0.6.1"/>
        <vers num="0.7"/>
        <vers num="0.7.1"/>
        <vers num="0.8"/>
        <vers num="0.9" edition="rc"/>
        <vers num="0.9.1"/>
        <vers num="0.9.2"/>
        <vers num="0.9.3"/>
        <vers num="1.0" edition="preview_release"/>
        <vers num="1.0.1"/>
        <vers num="1.0.2"/>
        <vers num="1.0.3"/>
        <vers num="1.0.4"/>
        <vers num="1.0.5"/>
        <vers num="1.0.6"/>
        <vers num="1.0.7"/>
        <vers num="1.0.8"/>
        <vers num="1.5" edition="beta1"/>
        <vers num="1.5" edition="beta2"/>
        <vers num="1.5.0.1"/>
        <vers num="1.5.0.10"/>
        <vers num="1.5.0.11"/>
        <vers num="1.5.0.12"/>
        <vers num="1.5.0.2"/>
        <vers num="1.5.0.3"/>
        <vers num="1.5.0.4"/>
        <vers num="1.5.0.5"/>
        <vers num="1.5.0.6"/>
        <vers num="1.5.0.7"/>
        <vers num="1.5.0.8"/>
        <vers num="1.5.0.9"/>
        <vers num="1.5.1"/>
        <vers num="1.5.2"/>
        <vers num="1.5.3"/>
        <vers num="1.5.4"/>
        <vers num="1.5.5"/>
        <vers num="1.5.6"/>
        <vers num="1.5.7"/>
        <vers num="1.5.8"/>
        <vers num="10.0"/>
        <vers num="10.0.1"/>
        <vers num="10.0.10"/>
        <vers num="10.0.11"/>
        <vers num="10.0.12"/>
        <vers num="10.0.2"/>
        <vers num="10.0.3"/>
        <vers num="10.0.4"/>
        <vers num="10.0.5"/>
        <vers num="10.0.6"/>
        <vers num="10.0.7"/>
        <vers num="10.0.8"/>
        <vers num="10.0.9"/>
        <vers num="11.0"/>
        <vers num="12.0" edition="beta6"/>
        <vers num="13.0"/>
        <vers num="13.0.1"/>
        <vers num="14.0"/>
        <vers num="14.0.1"/>
        <vers num="15.0"/>
        <vers num="15.0.1"/>
        <vers num="16.0"/>
        <vers num="16.0.1"/>
        <vers num="16.0.2"/>
        <vers num="17.0.10"/>
        <vers num="17.0.11"/>
        <vers num="17.0.2"/>
        <vers num="17.0.3"/>
        <vers num="17.0.4"/>
        <vers num="17.0.5"/>
        <vers num="17.0.6"/>
        <vers num="17.0.7"/>
        <vers num="17.0.8"/>
        <vers num="17.0.9"/>
        <vers num="18.0"/>
        <vers num="18.0.1"/>
        <vers num="18.0.2"/>
        <vers num="19.0"/>
        <vers num="19.0.1"/>
        <vers num="19.0.2"/>
        <vers num="2.0"/>
        <vers num="2.0.0.1"/>
        <vers num="2.0.0.10"/>
        <vers num="2.0.0.11"/>
        <vers num="2.0.0.12"/>
        <vers num="2.0.0.13"/>
        <vers num="2.0.0.14"/>
        <vers num="2.0.0.15"/>
        <vers num="2.0.0.16"/>
        <vers num="2.0.0.17"/>
        <vers num="2.0.0.18"/>
        <vers num="2.0.0.19"/>
        <vers num="2.0.0.2"/>
        <vers num="2.0.0.20"/>
        <vers num="2.0.0.3"/>
        <vers num="2.0.0.4"/>
        <vers num="2.0.0.5"/>
        <vers num="2.0.0.6"/>
        <vers num="2.0.0.7"/>
        <vers num="2.0.0.8"/>
        <vers num="2.0.0.9"/>
        <vers num="20.0"/>
        <vers num="20.0.1"/>
        <vers num="21.0"/>
        <vers num="23.0"/>
        <vers num="23.0.1"/>
        <vers num="24.0"/>
        <vers num="24.1"/>
        <vers num="24.1.1"/>
        <vers num="25.0"/>
        <vers num="25.0.1"/>
        <vers num="26.0"/>
        <vers num="27.0"/>
        <vers prev="1" num="27.0.1"/>
        <vers num="3.0"/>
        <vers num="3.0.1"/>
        <vers num="3.0.10"/>
        <vers num="3.0.11"/>
        <vers num="3.0.12"/>
        <vers num="3.0.13"/>
        <vers num="3.0.14"/>
        <vers num="3.0.15"/>
        <vers num="3.0.16"/>
        <vers num="3.0.17"/>
        <vers num="3.0.18"/>
        <vers num="3.0.19"/>
        <vers num="3.0.2"/>
        <vers num="3.0.3"/>
        <vers num="3.0.4"/>
        <vers num="3.0.5"/>
        <vers num="3.0.6"/>
        <vers num="3.0.7"/>
        <vers num="3.0.8"/>
        <vers num="3.0.9"/>
        <vers num="3.5"/>
        <vers num="3.5.1"/>
        <vers num="3.5.10"/>
        <vers num="3.5.11"/>
        <vers num="3.5.12"/>
        <vers num="3.5.13"/>
        <vers num="3.5.14"/>
        <vers num="3.5.15"/>
        <vers num="3.5.16"/>
        <vers num="3.5.17"/>
        <vers num="3.5.18"/>
        <vers num="3.5.19"/>
        <vers num="3.5.2"/>
        <vers num="3.5.3"/>
        <vers num="3.5.4"/>
        <vers num="3.5.5"/>
        <vers num="3.5.6"/>
        <vers num="3.5.7"/>
        <vers num="3.5.8"/>
        <vers num="3.5.9"/>
        <vers num="3.6"/>
        <vers num="3.6.10"/>
        <vers num="3.6.11"/>
        <vers num="3.6.12"/>
        <vers num="3.6.13"/>
        <vers num="3.6.14"/>
        <vers num="3.6.15"/>
        <vers num="3.6.16"/>
        <vers num="3.6.17"/>
        <vers num="3.6.18"/>
        <vers num="3.6.19"/>
        <vers num="3.6.2"/>
        <vers num="3.6.20"/>
        <vers num="3.6.21"/>
        <vers num="3.6.22"/>
        <vers num="3.6.23"/>
        <vers num="3.6.24"/>
        <vers num="3.6.25"/>
        <vers num="3.6.26"/>
        <vers num="3.6.27"/>
        <vers num="3.6.28"/>
        <vers num="3.6.3"/>
        <vers num="3.6.4"/>
        <vers num="3.6.6"/>
        <vers num="3.6.7"/>
        <vers num="3.6.8"/>
        <vers num="3.6.9"/>
        <vers num="4.0" edition="beta1"/>
        <vers num="4.0" edition="beta10"/>
        <vers num="4.0" edition="beta11"/>
        <vers num="4.0" edition="beta12"/>
        <vers num="4.0" edition="beta2"/>
        <vers num="4.0" edition="beta3"/>
        <vers num="4.0" edition="beta4"/>
        <vers num="4.0" edition="beta5"/>
        <vers num="4.0" edition="beta6"/>
        <vers num="4.0" edition="beta7"/>
        <vers num="4.0" edition="beta8"/>
        <vers num="4.0" edition="beta9"/>
        <vers num="4.0.1"/>
        <vers num="5.0"/>
        <vers num="5.0.1"/>
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers num="6.0.2"/>
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="8.0"/>
        <vers num="8.0.1"/>
        <vers num="9.0"/>
        <vers num="9.0.1"/>
      </prod>
      <prod vendor="mozilla" name="seamonkey">
        <vers num="2.0" edition="alpha_1"/>
        <vers num="2.0" edition="alpha_2"/>
        <vers num="2.0" edition="alpha_3"/>
        <vers num="2.0" edition="beta_1"/>
        <vers num="2.0" edition="beta_2"/>
        <vers num="2.0" edition="rc1"/>
        <vers num="2.0" edition="rc2"/>
        <vers num="2.0.1"/>
        <vers num="2.0.10"/>
        <vers num="2.0.11"/>
        <vers num="2.0.12"/>
        <vers num="2.0.13"/>
        <vers num="2.0.14"/>
        <vers num="2.0.2"/>
        <vers num="2.0.3"/>
        <vers num="2.0.4"/>
        <vers num="2.0.5"/>
        <vers num="2.0.6"/>
        <vers num="2.0.7"/>
        <vers num="2.0.8"/>
        <vers num="2.0.9"/>
        <vers num="2.1" edition="alpha1"/>
        <vers num="2.1" edition="alpha2"/>
        <vers num="2.1" edition="alpha3"/>
        <vers num="2.1" edition="beta1"/>
        <vers num="2.1" edition="beta2"/>
        <vers num="2.1" edition="beta3"/>
        <vers num="2.1" edition="rc1"/>
        <vers num="2.1" edition="rc2"/>
        <vers num="2.10" edition="beta1"/>
        <vers num="2.10" edition="beta2"/>
        <vers num="2.10" edition="beta3"/>
        <vers num="2.10.1"/>
        <vers num="2.11" edition="beta1"/>
        <vers num="2.11" edition="beta2"/>
        <vers num="2.11" edition="beta3"/>
        <vers num="2.11" edition="beta4"/>
        <vers num="2.11" edition="beta5"/>
        <vers num="2.11" edition="beta6"/>
        <vers num="2.12" edition="beta1"/>
        <vers num="2.12" edition="beta2"/>
        <vers num="2.12" edition="beta3"/>
        <vers num="2.12" edition="beta4"/>
        <vers num="2.12" edition="beta5"/>
        <vers num="2.12" edition="beta6"/>
        <vers num="2.12.1"/>
        <vers num="2.13" edition="beta1"/>
        <vers num="2.13" edition="beta2"/>
        <vers num="2.13" edition="beta3"/>
        <vers num="2.13" edition="beta4"/>
        <vers num="2.13" edition="beta5"/>
        <vers num="2.13" edition="beta6"/>
        <vers num="2.13.1"/>
        <vers num="2.13.2"/>
        <vers num="2.14" edition="beta1"/>
        <vers num="2.14" edition="beta2"/>
        <vers num="2.14" edition="beta3"/>
        <vers num="2.14" edition="beta4"/>
        <vers num="2.14" edition="beta5"/>
        <vers num="2.15" edition="beta1"/>
        <vers num="2.15" edition="beta2"/>
        <vers num="2.15" edition="beta3"/>
        <vers num="2.15" edition="beta4"/>
        <vers num="2.15" edition="beta5"/>
        <vers num="2.15" edition="beta6"/>
        <vers num="2.15.1"/>
        <vers num="2.15.2"/>
        <vers num="2.16" edition="beta1"/>
        <vers num="2.16" edition="beta2"/>
        <vers num="2.16" edition="beta3"/>
        <vers num="2.16" edition="beta4"/>
        <vers num="2.16" edition="beta5"/>
        <vers num="2.16.1"/>
        <vers num="2.16.2"/>
        <vers num="2.17" edition="beta1"/>
        <vers num="2.17" edition="beta2"/>
        <vers num="2.17" edition="beta3"/>
        <vers num="2.17" edition="beta4"/>
        <vers num="2.17.1"/>
        <vers num="2.18" edition="beta1"/>
        <vers num="2.18" edition="beta2"/>
        <vers num="2.18" edition="beta3"/>
        <vers num="2.18" edition="beta4"/>
        <vers num="2.19" edition="beta1"/>
        <vers num="2.19" edition="beta2"/>
        <vers num="2.2" edition="beta1"/>
        <vers num="2.2" edition="beta2"/>
        <vers num="2.2" edition="beta3"/>
        <vers num="2.20" edition="beta1"/>
        <vers num="2.20" edition="beta2"/>
        <vers num="2.20" edition="beta3"/>
        <vers num="2.21" edition="beta1"/>
        <vers num="2.21" edition="beta2"/>
        <vers num="2.22" edition="beta1"/>
        <vers num="2.22" edition="beta2"/>
        <vers num="2.22.1"/>
        <vers num="2.23" edition="beta1"/>
        <vers num="2.23" edition="beta2"/>
        <vers num="2.24" edition="beta1"/>
        <vers prev="1" num="2.25" edition="beta1"/>
        <vers prev="1" num="2.25" edition="beta2"/>
        <vers num="2.3" edition="beta1"/>
        <vers num="2.3" edition="beta2"/>
        <vers num="2.3" edition="beta3"/>
        <vers num="2.3.1"/>
        <vers num="2.3.2"/>
        <vers num="2.3.3"/>
        <vers num="2.4" edition="beta1"/>
        <vers num="2.4" edition="beta2"/>
        <vers num="2.4" edition="beta3"/>
        <vers num="2.4.1"/>
        <vers num="2.5" edition="beta1"/>
        <vers num="2.5" edition="beta2"/>
        <vers num="2.5" edition="beta3"/>
        <vers num="2.5" edition="beta4"/>
        <vers num="2.6" edition="beta1"/>
        <vers num="2.6" edition="beta2"/>
        <vers num="2.6" edition="beta3"/>
        <vers num="2.6" edition="beta4"/>
        <vers num="2.6.1"/>
        <vers num="2.7" edition="beta1"/>
        <vers num="2.7" edition="beta2"/>
        <vers num="2.7" edition="beta3"/>
        <vers num="2.7" edition="beta4"/>
        <vers num="2.7" edition="beta5"/>
        <vers num="2.7.1"/>
        <vers num="2.7.2"/>
        <vers num="2.8" edition="beta1"/>
        <vers num="2.8" edition="beta2"/>
        <vers num="2.8" edition="beta3"/>
        <vers num="2.8" edition="beta4"/>
        <vers num="2.8" edition="beta5"/>
        <vers num="2.8" edition="beta6"/>
        <vers num="2.9" edition="beta1"/>
        <vers num="2.9" edition="beta2"/>
        <vers num="2.9" edition="beta3"/>
        <vers num="2.9" edition="beta4"/>
        <vers num="2.9.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-1504" published="2014-03-19" name="CVE-2014-1504" modified="2014-04-01" CVSS_version="2.0" CVSS_vector="(AV:N/AC:H/Au:N/C:N/I:P/A:N)" CVSS_score="2.6" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="4.9" CVSS_base_score="2.6">
    <desc>
      <descript source="cve">The session-restore feature in Mozilla Firefox before 28.0 and SeaMonkey before 2.25 does not consider the Content Security Policy of a data: URL, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted document that is accessed after a browser restart.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=911547" source="CONFIRM">https://bugzilla.mozilla.org/show_bug.cgi?id=911547</ref>
      <ref url="http://www.mozilla.org/security/announce/2014/mfsa2014-23.html" source="CONFIRM" adv="1">http://www.mozilla.org/security/announce/2014/mfsa2014-23.html</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00022.html" source="SUSE">openSUSE-SU-2014:0448</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.html" source="SUSE">openSUSE-SU-2014:0419</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00016.html" source="SUSE">SUSE-SU-2014:0418</ref>
    </refs>
    <vuln_soft>
      <prod vendor="mozilla" name="firefox">
        <vers num="0.1"/>
        <vers num="0.10"/>
        <vers num="0.10.1"/>
        <vers num="0.2"/>
        <vers num="0.3"/>
        <vers num="0.4"/>
        <vers num="0.5"/>
        <vers num="0.6"/>
        <vers num="0.6.1"/>
        <vers num="0.7"/>
        <vers num="0.7.1"/>
        <vers num="0.8"/>
        <vers num="0.9" edition="rc"/>
        <vers num="0.9.1"/>
        <vers num="0.9.2"/>
        <vers num="0.9.3"/>
        <vers num="1.0" edition="preview_release"/>
        <vers num="1.0.1"/>
        <vers num="1.0.2"/>
        <vers num="1.0.3"/>
        <vers num="1.0.4"/>
        <vers num="1.0.5"/>
        <vers num="1.0.6"/>
        <vers num="1.0.7"/>
        <vers num="1.0.8"/>
        <vers num="1.5" edition="beta1"/>
        <vers num="1.5" edition="beta2"/>
        <vers num="1.5.0.1"/>
        <vers num="1.5.0.10"/>
        <vers num="1.5.0.11"/>
        <vers num="1.5.0.12"/>
        <vers num="1.5.0.2"/>
        <vers num="1.5.0.3"/>
        <vers num="1.5.0.4"/>
        <vers num="1.5.0.5"/>
        <vers num="1.5.0.6"/>
        <vers num="1.5.0.7"/>
        <vers num="1.5.0.8"/>
        <vers num="1.5.0.9"/>
        <vers num="1.5.1"/>
        <vers num="1.5.2"/>
        <vers num="1.5.3"/>
        <vers num="1.5.4"/>
        <vers num="1.5.5"/>
        <vers num="1.5.6"/>
        <vers num="1.5.7"/>
        <vers num="1.5.8"/>
        <vers num="10.0"/>
        <vers num="10.0.1"/>
        <vers num="10.0.10"/>
        <vers num="10.0.11"/>
        <vers num="10.0.12"/>
        <vers num="10.0.2"/>
        <vers num="10.0.3"/>
        <vers num="10.0.4"/>
        <vers num="10.0.5"/>
        <vers num="10.0.6"/>
        <vers num="10.0.7"/>
        <vers num="10.0.8"/>
        <vers num="10.0.9"/>
        <vers num="11.0"/>
        <vers num="12.0" edition="beta6"/>
        <vers num="13.0"/>
        <vers num="13.0.1"/>
        <vers num="14.0"/>
        <vers num="14.0.1"/>
        <vers num="15.0"/>
        <vers num="15.0.1"/>
        <vers num="16.0"/>
        <vers num="16.0.1"/>
        <vers num="16.0.2"/>
        <vers num="17.0.10"/>
        <vers num="17.0.11"/>
        <vers num="17.0.2"/>
        <vers num="17.0.3"/>
        <vers num="17.0.4"/>
        <vers num="17.0.5"/>
        <vers num="17.0.6"/>
        <vers num="17.0.7"/>
        <vers num="17.0.8"/>
        <vers num="17.0.9"/>
        <vers num="18.0"/>
        <vers num="18.0.1"/>
        <vers num="18.0.2"/>
        <vers num="19.0"/>
        <vers num="19.0.1"/>
        <vers num="19.0.2"/>
        <vers num="2.0"/>
        <vers num="2.0.0.1"/>
        <vers num="2.0.0.10"/>
        <vers num="2.0.0.11"/>
        <vers num="2.0.0.12"/>
        <vers num="2.0.0.13"/>
        <vers num="2.0.0.14"/>
        <vers num="2.0.0.15"/>
        <vers num="2.0.0.16"/>
        <vers num="2.0.0.17"/>
        <vers num="2.0.0.18"/>
        <vers num="2.0.0.19"/>
        <vers num="2.0.0.2"/>
        <vers num="2.0.0.20"/>
        <vers num="2.0.0.3"/>
        <vers num="2.0.0.4"/>
        <vers num="2.0.0.5"/>
        <vers num="2.0.0.6"/>
        <vers num="2.0.0.7"/>
        <vers num="2.0.0.8"/>
        <vers num="2.0.0.9"/>
        <vers num="20.0"/>
        <vers num="20.0.1"/>
        <vers num="21.0"/>
        <vers num="23.0"/>
        <vers num="23.0.1"/>
        <vers num="24.0"/>
        <vers num="24.1"/>
        <vers num="24.1.1"/>
        <vers num="25.0"/>
        <vers num="25.0.1"/>
        <vers num="26.0"/>
        <vers num="27.0"/>
        <vers prev="1" num="27.0.1"/>
        <vers num="3.0"/>
        <vers num="3.0.1"/>
        <vers num="3.0.10"/>
        <vers num="3.0.11"/>
        <vers num="3.0.12"/>
        <vers num="3.0.13"/>
        <vers num="3.0.14"/>
        <vers num="3.0.15"/>
        <vers num="3.0.16"/>
        <vers num="3.0.17"/>
        <vers num="3.0.18"/>
        <vers num="3.0.19"/>
        <vers num="3.0.2"/>
        <vers num="3.0.3"/>
        <vers num="3.0.4"/>
        <vers num="3.0.5"/>
        <vers num="3.0.6"/>
        <vers num="3.0.7"/>
        <vers num="3.0.8"/>
        <vers num="3.0.9"/>
        <vers num="3.5"/>
        <vers num="3.5.1"/>
        <vers num="3.5.10"/>
        <vers num="3.5.11"/>
        <vers num="3.5.12"/>
        <vers num="3.5.13"/>
        <vers num="3.5.14"/>
        <vers num="3.5.15"/>
        <vers num="3.5.16"/>
        <vers num="3.5.17"/>
        <vers num="3.5.18"/>
        <vers num="3.5.19"/>
        <vers num="3.5.2"/>
        <vers num="3.5.3"/>
        <vers num="3.5.4"/>
        <vers num="3.5.5"/>
        <vers num="3.5.6"/>
        <vers num="3.5.7"/>
        <vers num="3.5.8"/>
        <vers num="3.5.9"/>
        <vers num="3.6"/>
        <vers num="3.6.10"/>
        <vers num="3.6.11"/>
        <vers num="3.6.12"/>
        <vers num="3.6.13"/>
        <vers num="3.6.14"/>
        <vers num="3.6.15"/>
        <vers num="3.6.16"/>
        <vers num="3.6.17"/>
        <vers num="3.6.18"/>
        <vers num="3.6.19"/>
        <vers num="3.6.2"/>
        <vers num="3.6.20"/>
        <vers num="3.6.21"/>
        <vers num="3.6.22"/>
        <vers num="3.6.23"/>
        <vers num="3.6.24"/>
        <vers num="3.6.25"/>
        <vers num="3.6.26"/>
        <vers num="3.6.27"/>
        <vers num="3.6.28"/>
        <vers num="3.6.3"/>
        <vers num="3.6.4"/>
        <vers num="3.6.6"/>
        <vers num="3.6.7"/>
        <vers num="3.6.8"/>
        <vers num="3.6.9"/>
        <vers num="4.0" edition="beta1"/>
        <vers num="4.0" edition="beta10"/>
        <vers num="4.0" edition="beta11"/>
        <vers num="4.0" edition="beta12"/>
        <vers num="4.0" edition="beta2"/>
        <vers num="4.0" edition="beta3"/>
        <vers num="4.0" edition="beta4"/>
        <vers num="4.0" edition="beta5"/>
        <vers num="4.0" edition="beta6"/>
        <vers num="4.0" edition="beta7"/>
        <vers num="4.0" edition="beta8"/>
        <vers num="4.0" edition="beta9"/>
        <vers num="4.0.1"/>
        <vers num="5.0"/>
        <vers num="5.0.1"/>
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers num="6.0.2"/>
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="8.0"/>
        <vers num="8.0.1"/>
        <vers num="9.0"/>
        <vers num="9.0.1"/>
      </prod>
      <prod vendor="mozilla" name="seamonkey">
        <vers num="2.0" edition="alpha_1"/>
        <vers num="2.0" edition="alpha_2"/>
        <vers num="2.0" edition="alpha_3"/>
        <vers num="2.0" edition="beta_1"/>
        <vers num="2.0" edition="beta_2"/>
        <vers num="2.0" edition="rc1"/>
        <vers num="2.0" edition="rc2"/>
        <vers num="2.0.1"/>
        <vers num="2.0.10"/>
        <vers num="2.0.11"/>
        <vers num="2.0.12"/>
        <vers num="2.0.13"/>
        <vers num="2.0.14"/>
        <vers num="2.0.2"/>
        <vers num="2.0.3"/>
        <vers num="2.0.4"/>
        <vers num="2.0.5"/>
        <vers num="2.0.6"/>
        <vers num="2.0.7"/>
        <vers num="2.0.8"/>
        <vers num="2.0.9"/>
        <vers num="2.1" edition="alpha1"/>
        <vers num="2.1" edition="alpha2"/>
        <vers num="2.1" edition="alpha3"/>
        <vers num="2.1" edition="beta1"/>
        <vers num="2.1" edition="beta2"/>
        <vers num="2.1" edition="beta3"/>
        <vers num="2.1" edition="rc1"/>
        <vers num="2.1" edition="rc2"/>
        <vers num="2.10" edition="beta1"/>
        <vers num="2.10" edition="beta2"/>
        <vers num="2.10" edition="beta3"/>
        <vers num="2.10.1"/>
        <vers num="2.11" edition="beta1"/>
        <vers num="2.11" edition="beta2"/>
        <vers num="2.11" edition="beta3"/>
        <vers num="2.11" edition="beta4"/>
        <vers num="2.11" edition="beta5"/>
        <vers num="2.11" edition="beta6"/>
        <vers num="2.12" edition="beta1"/>
        <vers num="2.12" edition="beta2"/>
        <vers num="2.12" edition="beta3"/>
        <vers num="2.12" edition="beta4"/>
        <vers num="2.12" edition="beta5"/>
        <vers num="2.12" edition="beta6"/>
        <vers num="2.12.1"/>
        <vers num="2.13" edition="beta1"/>
        <vers num="2.13" edition="beta2"/>
        <vers num="2.13" edition="beta3"/>
        <vers num="2.13" edition="beta4"/>
        <vers num="2.13" edition="beta5"/>
        <vers num="2.13" edition="beta6"/>
        <vers num="2.13.1"/>
        <vers num="2.13.2"/>
        <vers num="2.14" edition="beta1"/>
        <vers num="2.14" edition="beta2"/>
        <vers num="2.14" edition="beta3"/>
        <vers num="2.14" edition="beta4"/>
        <vers num="2.14" edition="beta5"/>
        <vers num="2.15" edition="beta1"/>
        <vers num="2.15" edition="beta2"/>
        <vers num="2.15" edition="beta3"/>
        <vers num="2.15" edition="beta4"/>
        <vers num="2.15" edition="beta5"/>
        <vers num="2.15" edition="beta6"/>
        <vers num="2.15.1"/>
        <vers num="2.15.2"/>
        <vers num="2.16" edition="beta1"/>
        <vers num="2.16" edition="beta2"/>
        <vers num="2.16" edition="beta3"/>
        <vers num="2.16" edition="beta4"/>
        <vers num="2.16" edition="beta5"/>
        <vers num="2.16.1"/>
        <vers num="2.16.2"/>
        <vers num="2.17" edition="beta1"/>
        <vers num="2.17" edition="beta2"/>
        <vers num="2.17" edition="beta3"/>
        <vers num="2.17" edition="beta4"/>
        <vers num="2.17.1"/>
        <vers num="2.18" edition="beta1"/>
        <vers num="2.18" edition="beta2"/>
        <vers num="2.18" edition="beta3"/>
        <vers num="2.18" edition="beta4"/>
        <vers num="2.19" edition="beta1"/>
        <vers num="2.19" edition="beta2"/>
        <vers num="2.2" edition="beta1"/>
        <vers num="2.2" edition="beta2"/>
        <vers num="2.2" edition="beta3"/>
        <vers num="2.20" edition="beta1"/>
        <vers num="2.20" edition="beta2"/>
        <vers num="2.20" edition="beta3"/>
        <vers num="2.21" edition="beta1"/>
        <vers num="2.21" edition="beta2"/>
        <vers num="2.22" edition="beta1"/>
        <vers num="2.22" edition="beta2"/>
        <vers num="2.22.1"/>
        <vers num="2.23" edition="beta1"/>
        <vers num="2.23" edition="beta2"/>
        <vers num="2.24" edition="beta1"/>
        <vers prev="1" num="2.25" edition="beta1"/>
        <vers prev="1" num="2.25" edition="beta2"/>
        <vers num="2.3" edition="beta1"/>
        <vers num="2.3" edition="beta2"/>
        <vers num="2.3" edition="beta3"/>
        <vers num="2.3.1"/>
        <vers num="2.3.2"/>
        <vers num="2.3.3"/>
        <vers num="2.4" edition="beta1"/>
        <vers num="2.4" edition="beta2"/>
        <vers num="2.4" edition="beta3"/>
        <vers num="2.4.1"/>
        <vers num="2.5" edition="beta1"/>
        <vers num="2.5" edition="beta2"/>
        <vers num="2.5" edition="beta3"/>
        <vers num="2.5" edition="beta4"/>
        <vers num="2.6" edition="beta1"/>
        <vers num="2.6" edition="beta2"/>
        <vers num="2.6" edition="beta3"/>
        <vers num="2.6" edition="beta4"/>
        <vers num="2.6.1"/>
        <vers num="2.7" edition="beta1"/>
        <vers num="2.7" edition="beta2"/>
        <vers num="2.7" edition="beta3"/>
        <vers num="2.7" edition="beta4"/>
        <vers num="2.7" edition="beta5"/>
        <vers num="2.7.1"/>
        <vers num="2.7.2"/>
        <vers num="2.8" edition="beta1"/>
        <vers num="2.8" edition="beta2"/>
        <vers num="2.8" edition="beta3"/>
        <vers num="2.8" edition="beta4"/>
        <vers num="2.8" edition="beta5"/>
        <vers num="2.8" edition="beta6"/>
        <vers num="2.9" edition="beta1"/>
        <vers num="2.9" edition="beta2"/>
        <vers num="2.9" edition="beta3"/>
        <vers num="2.9" edition="beta4"/>
        <vers num="2.9.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1505" published="2014-03-19" name="CVE-2014-1505" modified="2014-04-01" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:P)" CVSS_score="6.8" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.6" CVSS_base_score="6.8">
    <desc>
      <descript source="cve">The SVG filter implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to obtain sensitive displacement-correlation information, and possibly bypass the Same Origin Policy and read text from a different domain, via a timing attack involving feDisplacementMap elements, a related issue to CVE-2013-1693.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=941887" source="CONFIRM">https://bugzilla.mozilla.org/show_bug.cgi?id=941887</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2151-1" source="UBUNTU">USN-2151-1</ref>
      <ref url="http://www.mozilla.org/security/announce/2014/mfsa2014-28.html" source="CONFIRM" adv="1">http://www.mozilla.org/security/announce/2014/mfsa2014-28.html</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2881" source="DEBIAN">DSA-2881</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0316.html" source="REDHAT">RHSA-2014:0316</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0310.html" source="REDHAT">RHSA-2014:0310</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00022.html" source="SUSE">openSUSE-SU-2014:0448</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.html" source="SUSE">openSUSE-SU-2014:0419</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00016.html" source="SUSE">SUSE-SU-2014:0418</ref>
    </refs>
    <vuln_soft>
      <prod vendor="mozilla" name="firefox">
        <vers num="0.1"/>
        <vers num="0.10"/>
        <vers num="0.10.1"/>
        <vers num="0.2"/>
        <vers num="0.3"/>
        <vers num="0.4"/>
        <vers num="0.5"/>
        <vers num="0.6"/>
        <vers num="0.6.1"/>
        <vers num="0.7"/>
        <vers num="0.7.1"/>
        <vers num="0.8"/>
        <vers num="0.9" edition="rc"/>
        <vers num="0.9.1"/>
        <vers num="0.9.2"/>
        <vers num="0.9.3"/>
        <vers num="1.0" edition="preview_release"/>
        <vers num="1.0.1"/>
        <vers num="1.0.2"/>
        <vers num="1.0.3"/>
        <vers num="1.0.4"/>
        <vers num="1.0.5"/>
        <vers num="1.0.6"/>
        <vers num="1.0.7"/>
        <vers num="1.0.8"/>
        <vers num="1.5" edition="beta1"/>
        <vers num="1.5" edition="beta2"/>
        <vers num="1.5.0.1"/>
        <vers num="1.5.0.10"/>
        <vers num="1.5.0.11"/>
        <vers num="1.5.0.12"/>
        <vers num="1.5.0.2"/>
        <vers num="1.5.0.3"/>
        <vers num="1.5.0.4"/>
        <vers num="1.5.0.5"/>
        <vers num="1.5.0.6"/>
        <vers num="1.5.0.7"/>
        <vers num="1.5.0.8"/>
        <vers num="1.5.0.9"/>
        <vers num="1.5.1"/>
        <vers num="1.5.2"/>
        <vers num="1.5.3"/>
        <vers num="1.5.4"/>
        <vers num="1.5.5"/>
        <vers num="1.5.6"/>
        <vers num="1.5.7"/>
        <vers num="1.5.8"/>
        <vers num="10.0"/>
        <vers num="10.0.1"/>
        <vers num="10.0.10"/>
        <vers num="10.0.11"/>
        <vers num="10.0.12"/>
        <vers num="10.0.2"/>
        <vers num="10.0.3"/>
        <vers num="10.0.4"/>
        <vers num="10.0.5"/>
        <vers num="10.0.6"/>
        <vers num="10.0.7"/>
        <vers num="10.0.8"/>
        <vers num="10.0.9"/>
        <vers num="11.0"/>
        <vers num="12.0" edition="beta6"/>
        <vers num="13.0"/>
        <vers num="13.0.1"/>
        <vers num="14.0"/>
        <vers num="14.0.1"/>
        <vers num="15.0"/>
        <vers num="15.0.1"/>
        <vers num="16.0"/>
        <vers num="16.0.1"/>
        <vers num="16.0.2"/>
        <vers num="17.0.10"/>
        <vers num="17.0.11"/>
        <vers num="17.0.2"/>
        <vers num="17.0.3"/>
        <vers num="17.0.4"/>
        <vers num="17.0.5"/>
        <vers num="17.0.6"/>
        <vers num="17.0.7"/>
        <vers num="17.0.8"/>
        <vers num="17.0.9"/>
        <vers num="18.0"/>
        <vers num="18.0.1"/>
        <vers num="18.0.2"/>
        <vers num="19.0"/>
        <vers num="19.0.1"/>
        <vers num="19.0.2"/>
        <vers num="2.0"/>
        <vers num="2.0.0.1"/>
        <vers num="2.0.0.10"/>
        <vers num="2.0.0.11"/>
        <vers num="2.0.0.12"/>
        <vers num="2.0.0.13"/>
        <vers num="2.0.0.14"/>
        <vers num="2.0.0.15"/>
        <vers num="2.0.0.16"/>
        <vers num="2.0.0.17"/>
        <vers num="2.0.0.18"/>
        <vers num="2.0.0.19"/>
        <vers num="2.0.0.2"/>
        <vers num="2.0.0.20"/>
        <vers num="2.0.0.3"/>
        <vers num="2.0.0.4"/>
        <vers num="2.0.0.5"/>
        <vers num="2.0.0.6"/>
        <vers num="2.0.0.7"/>
        <vers num="2.0.0.8"/>
        <vers num="2.0.0.9"/>
        <vers num="20.0"/>
        <vers num="20.0.1"/>
        <vers num="21.0"/>
        <vers num="23.0"/>
        <vers num="23.0.1"/>
        <vers num="24.0"/>
        <vers num="24.1"/>
        <vers num="24.1.1"/>
        <vers num="25.0"/>
        <vers num="25.0.1"/>
        <vers num="26.0"/>
        <vers num="27.0"/>
        <vers prev="1" num="27.0.1"/>
        <vers num="3.0"/>
        <vers num="3.0.1"/>
        <vers num="3.0.10"/>
        <vers num="3.0.11"/>
        <vers num="3.0.12"/>
        <vers num="3.0.13"/>
        <vers num="3.0.14"/>
        <vers num="3.0.15"/>
        <vers num="3.0.16"/>
        <vers num="3.0.17"/>
        <vers num="3.0.18"/>
        <vers num="3.0.19"/>
        <vers num="3.0.2"/>
        <vers num="3.0.3"/>
        <vers num="3.0.4"/>
        <vers num="3.0.5"/>
        <vers num="3.0.6"/>
        <vers num="3.0.7"/>
        <vers num="3.0.8"/>
        <vers num="3.0.9"/>
        <vers num="3.5"/>
        <vers num="3.5.1"/>
        <vers num="3.5.10"/>
        <vers num="3.5.11"/>
        <vers num="3.5.12"/>
        <vers num="3.5.13"/>
        <vers num="3.5.14"/>
        <vers num="3.5.15"/>
        <vers num="3.5.16"/>
        <vers num="3.5.17"/>
        <vers num="3.5.18"/>
        <vers num="3.5.19"/>
        <vers num="3.5.2"/>
        <vers num="3.5.3"/>
        <vers num="3.5.4"/>
        <vers num="3.5.5"/>
        <vers num="3.5.6"/>
        <vers num="3.5.7"/>
        <vers num="3.5.8"/>
        <vers num="3.5.9"/>
        <vers num="3.6"/>
        <vers num="3.6.10"/>
        <vers num="3.6.11"/>
        <vers num="3.6.12"/>
        <vers num="3.6.13"/>
        <vers num="3.6.14"/>
        <vers num="3.6.15"/>
        <vers num="3.6.16"/>
        <vers num="3.6.17"/>
        <vers num="3.6.18"/>
        <vers num="3.6.19"/>
        <vers num="3.6.2"/>
        <vers num="3.6.20"/>
        <vers num="3.6.21"/>
        <vers num="3.6.22"/>
        <vers num="3.6.23"/>
        <vers num="3.6.24"/>
        <vers num="3.6.25"/>
        <vers num="3.6.26"/>
        <vers num="3.6.27"/>
        <vers num="3.6.28"/>
        <vers num="3.6.3"/>
        <vers num="3.6.4"/>
        <vers num="3.6.6"/>
        <vers num="3.6.7"/>
        <vers num="3.6.8"/>
        <vers num="3.6.9"/>
        <vers num="4.0" edition="beta1"/>
        <vers num="4.0" edition="beta10"/>
        <vers num="4.0" edition="beta11"/>
        <vers num="4.0" edition="beta12"/>
        <vers num="4.0" edition="beta2"/>
        <vers num="4.0" edition="beta3"/>
        <vers num="4.0" edition="beta4"/>
        <vers num="4.0" edition="beta5"/>
        <vers num="4.0" edition="beta6"/>
        <vers num="4.0" edition="beta7"/>
        <vers num="4.0" edition="beta8"/>
        <vers num="4.0" edition="beta9"/>
        <vers num="4.0.1"/>
        <vers num="5.0"/>
        <vers num="5.0.1"/>
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers num="6.0.2"/>
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="8.0"/>
        <vers num="8.0.1"/>
        <vers num="9.0"/>
        <vers num="9.0.1"/>
      </prod>
      <prod vendor="mozilla" name="firefox_esr">
        <vers num="24.0"/>
        <vers num="24.0.1"/>
        <vers num="24.0.2"/>
        <vers num="24.1.0"/>
        <vers num="24.1.1"/>
        <vers num="24.2"/>
        <vers num="24.3"/>
      </prod>
      <prod vendor="mozilla" name="seamonkey">
        <vers num="2.0" edition="alpha_1"/>
        <vers num="2.0" edition="alpha_2"/>
        <vers num="2.0" edition="alpha_3"/>
        <vers num="2.0" edition="beta_1"/>
        <vers num="2.0" edition="beta_2"/>
        <vers num="2.0" edition="rc1"/>
        <vers num="2.0" edition="rc2"/>
        <vers num="2.0.1"/>
        <vers num="2.0.10"/>
        <vers num="2.0.11"/>
        <vers num="2.0.12"/>
        <vers num="2.0.13"/>
        <vers num="2.0.14"/>
        <vers num="2.0.2"/>
        <vers num="2.0.3"/>
        <vers num="2.0.4"/>
        <vers num="2.0.5"/>
        <vers num="2.0.6"/>
        <vers num="2.0.7"/>
        <vers num="2.0.8"/>
        <vers num="2.0.9"/>
        <vers num="2.1" edition="alpha1"/>
        <vers num="2.1" edition="alpha2"/>
        <vers num="2.1" edition="alpha3"/>
        <vers num="2.1" edition="beta1"/>
        <vers num="2.1" edition="beta2"/>
        <vers num="2.1" edition="beta3"/>
        <vers num="2.1" edition="rc1"/>
        <vers num="2.1" edition="rc2"/>
        <vers num="2.10" edition="beta1"/>
        <vers num="2.10" edition="beta2"/>
        <vers num="2.10" edition="beta3"/>
        <vers num="2.10.1"/>
        <vers num="2.11" edition="beta1"/>
        <vers num="2.11" edition="beta2"/>
        <vers num="2.11" edition="beta3"/>
        <vers num="2.11" edition="beta4"/>
        <vers num="2.11" edition="beta5"/>
        <vers num="2.11" edition="beta6"/>
        <vers num="2.12" edition="beta1"/>
        <vers num="2.12" edition="beta2"/>
        <vers num="2.12" edition="beta3"/>
        <vers num="2.12" edition="beta4"/>
        <vers num="2.12" edition="beta5"/>
        <vers num="2.12" edition="beta6"/>
        <vers num="2.12.1"/>
        <vers num="2.13" edition="beta1"/>
        <vers num="2.13" edition="beta2"/>
        <vers num="2.13" edition="beta3"/>
        <vers num="2.13" edition="beta4"/>
        <vers num="2.13" edition="beta5"/>
        <vers num="2.13" edition="beta6"/>
        <vers num="2.13.1"/>
        <vers num="2.13.2"/>
        <vers num="2.14" edition="beta1"/>
        <vers num="2.14" edition="beta2"/>
        <vers num="2.14" edition="beta3"/>
        <vers num="2.14" edition="beta4"/>
        <vers num="2.14" edition="beta5"/>
        <vers num="2.15" edition="beta1"/>
        <vers num="2.15" edition="beta2"/>
        <vers num="2.15" edition="beta3"/>
        <vers num="2.15" edition="beta4"/>
        <vers num="2.15" edition="beta5"/>
        <vers num="2.15" edition="beta6"/>
        <vers num="2.15.1"/>
        <vers num="2.15.2"/>
        <vers num="2.16" edition="beta1"/>
        <vers num="2.16" edition="beta2"/>
        <vers num="2.16" edition="beta3"/>
        <vers num="2.16" edition="beta4"/>
        <vers num="2.16" edition="beta5"/>
        <vers num="2.16.1"/>
        <vers num="2.16.2"/>
        <vers num="2.17" edition="beta1"/>
        <vers num="2.17" edition="beta2"/>
        <vers num="2.17" edition="beta3"/>
        <vers num="2.17" edition="beta4"/>
        <vers num="2.17.1"/>
        <vers num="2.18" edition="beta1"/>
        <vers num="2.18" edition="beta2"/>
        <vers num="2.18" edition="beta3"/>
        <vers num="2.18" edition="beta4"/>
        <vers num="2.19" edition="beta1"/>
        <vers num="2.19" edition="beta2"/>
        <vers num="2.2" edition="beta1"/>
        <vers num="2.2" edition="beta2"/>
        <vers num="2.2" edition="beta3"/>
        <vers num="2.20" edition="beta1"/>
        <vers num="2.20" edition="beta2"/>
        <vers num="2.20" edition="beta3"/>
        <vers num="2.21" edition="beta1"/>
        <vers num="2.21" edition="beta2"/>
        <vers num="2.22" edition="beta1"/>
        <vers num="2.22" edition="beta2"/>
        <vers num="2.22.1"/>
        <vers num="2.23" edition="beta1"/>
        <vers num="2.23" edition="beta2"/>
        <vers num="2.24" edition="beta1"/>
        <vers prev="1" num="2.25" edition="beta1"/>
        <vers prev="1" num="2.25" edition="beta2"/>
        <vers num="2.3" edition="beta1"/>
        <vers num="2.3" edition="beta2"/>
        <vers num="2.3" edition="beta3"/>
        <vers num="2.3.1"/>
        <vers num="2.3.2"/>
        <vers num="2.3.3"/>
        <vers num="2.4" edition="beta1"/>
        <vers num="2.4" edition="beta2"/>
        <vers num="2.4" edition="beta3"/>
        <vers num="2.4.1"/>
        <vers num="2.5" edition="beta1"/>
        <vers num="2.5" edition="beta2"/>
        <vers num="2.5" edition="beta3"/>
        <vers num="2.5" edition="beta4"/>
        <vers num="2.6" edition="beta1"/>
        <vers num="2.6" edition="beta2"/>
        <vers num="2.6" edition="beta3"/>
        <vers num="2.6" edition="beta4"/>
        <vers num="2.6.1"/>
        <vers num="2.7" edition="beta1"/>
        <vers num="2.7" edition="beta2"/>
        <vers num="2.7" edition="beta3"/>
        <vers num="2.7" edition="beta4"/>
        <vers num="2.7" edition="beta5"/>
        <vers num="2.7.1"/>
        <vers num="2.7.2"/>
        <vers num="2.8" edition="beta1"/>
        <vers num="2.8" edition="beta2"/>
        <vers num="2.8" edition="beta3"/>
        <vers num="2.8" edition="beta4"/>
        <vers num="2.8" edition="beta5"/>
        <vers num="2.8" edition="beta6"/>
        <vers num="2.9" edition="beta1"/>
        <vers num="2.9" edition="beta2"/>
        <vers num="2.9" edition="beta3"/>
        <vers num="2.9" edition="beta4"/>
        <vers num="2.9.1"/>
      </prod>
      <prod vendor="mozilla" name="thunderbird">
        <vers num="0.1"/>
        <vers num="0.2"/>
        <vers num="0.3"/>
        <vers num="0.4"/>
        <vers num="0.5"/>
        <vers num="0.6"/>
        <vers num="0.7"/>
        <vers num="0.7.1"/>
        <vers num="0.7.2"/>
        <vers num="0.7.3"/>
        <vers num="0.8"/>
        <vers num="0.9"/>
        <vers num="1.0"/>
        <vers num="1.0.1"/>
        <vers num="1.0.2"/>
        <vers num="1.0.3"/>
        <vers num="1.0.4"/>
        <vers num="1.0.5" edition="beta"/>
        <vers num="1.0.6"/>
        <vers num="1.0.7"/>
        <vers num="1.0.8"/>
        <vers num="1.5" edition="beta2"/>
        <vers num="1.5.0.1"/>
        <vers num="1.5.0.10"/>
        <vers num="1.5.0.11"/>
        <vers num="1.5.0.12"/>
        <vers num="1.5.0.13"/>
        <vers num="1.5.0.14"/>
        <vers num="1.5.0.2"/>
        <vers num="1.5.0.3"/>
        <vers num="1.5.0.4"/>
        <vers num="1.5.0.5"/>
        <vers num="1.5.0.6"/>
        <vers num="1.5.0.7"/>
        <vers num="1.5.0.8"/>
        <vers num="1.5.0.9"/>
        <vers num="1.5.1"/>
        <vers num="1.5.2"/>
        <vers num="1.7.1"/>
        <vers num="1.7.3"/>
        <vers num="10.0"/>
        <vers num="10.0.1"/>
        <vers num="10.0.2"/>
        <vers num="10.0.3"/>
        <vers num="10.0.4"/>
        <vers num="11.0"/>
        <vers num="11.0.1"/>
        <vers num="12.0"/>
        <vers num="12.0.1"/>
        <vers num="13.0"/>
        <vers num="13.0.1"/>
        <vers num="14.0"/>
        <vers num="15.0"/>
        <vers num="15.0.1"/>
        <vers num="16.0"/>
        <vers num="16.0.1"/>
        <vers num="16.0.2"/>
        <vers num="17.0"/>
        <vers num="17.0.1"/>
        <vers num="17.0.2"/>
        <vers num="17.0.3"/>
        <vers num="17.0.4"/>
        <vers num="17.0.5"/>
        <vers num="17.0.6"/>
        <vers num="17.0.7"/>
        <vers num="17.0.8"/>
        <vers num="2.0"/>
        <vers num="2.0.0.0"/>
        <vers num="2.0.0.1"/>
        <vers num="2.0.0.11"/>
        <vers num="2.0.0.12"/>
        <vers num="2.0.0.13"/>
        <vers num="2.0.0.14"/>
        <vers num="2.0.0.15"/>
        <vers num="2.0.0.16"/>
        <vers num="2.0.0.17"/>
        <vers num="2.0.0.18"/>
        <vers num="2.0.0.19"/>
        <vers num="2.0.0.2"/>
        <vers num="2.0.0.20"/>
        <vers num="2.0.0.21"/>
        <vers num="2.0.0.22"/>
        <vers num="2.0.0.23"/>
        <vers num="2.0.0.3"/>
        <vers num="2.0.0.4"/>
        <vers num="2.0.0.5"/>
        <vers num="2.0.0.6"/>
        <vers num="2.0.0.7"/>
        <vers num="2.0.0.8"/>
        <vers num="2.0.0.9"/>
        <vers num="24.0"/>
        <vers num="24.0.1"/>
        <vers num="24.1"/>
        <vers num="24.1.1"/>
        <vers num="24.2"/>
        <vers prev="1" num="24.3"/>
        <vers num="3.0"/>
        <vers num="3.0.1"/>
        <vers num="3.0.10"/>
        <vers num="3.0.11"/>
        <vers num="3.0.2"/>
        <vers num="3.0.3"/>
        <vers num="3.0.4"/>
        <vers num="3.0.5"/>
        <vers num="3.0.6"/>
        <vers num="3.0.7"/>
        <vers num="3.0.8"/>
        <vers num="3.0.9"/>
        <vers num="3.1"/>
        <vers num="3.1.1"/>
        <vers num="3.1.10"/>
        <vers num="3.1.11"/>
        <vers num="3.1.12"/>
        <vers num="3.1.13"/>
        <vers num="3.1.14"/>
        <vers num="3.1.15"/>
        <vers num="3.1.16"/>
        <vers num="3.1.17"/>
        <vers num="3.1.2"/>
        <vers num="3.1.3"/>
        <vers num="3.1.4"/>
        <vers num="3.1.5"/>
        <vers num="3.1.6"/>
        <vers num="3.1.7"/>
        <vers num="3.1.8"/>
        <vers num="3.1.9"/>
        <vers num="5.0"/>
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers num="6.0.2"/>
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="8.0"/>
        <vers num="9.0"/>
        <vers num="9.0.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1506" published="2014-03-19" name="CVE-2014-1506" modified="2014-04-01" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:N/A:P)" CVSS_score="6.4" CVSS_impact_subscore="4.9" CVSS_exploit_subscore="10.0" CVSS_base_score="6.4">
    <desc>
      <descript source="cve">Directory traversal vulnerability in Android Crash Reporter in Mozilla Firefox before 28.0 on Android allows attackers to trigger the transmission of local files to arbitrary servers, or cause a denial of service (application crash), via a crafted application that specifies Android Crash Reporter arguments.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=944374" source="CONFIRM">https://bugzilla.mozilla.org/show_bug.cgi?id=944374</ref>
      <ref url="http://www.mozilla.org/security/announce/2014/mfsa2014-24.html" source="CONFIRM" adv="1">http://www.mozilla.org/security/announce/2014/mfsa2014-24.html</ref>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-03/0153.html" source="BUGTRAQ">20140326 Firefox for Android Profile Directory Derandomization and Data Exfiltration (CVE-2014-1484, CVE-2014-1506, CVE-2014-1515, CVE-2014-1516)</ref>
    </refs>
    <vuln_soft>
      <prod vendor="mozilla" name="firefox">
        <vers num="0.1"/>
        <vers num="0.10"/>
        <vers num="0.10.1"/>
        <vers num="0.2"/>
        <vers num="0.3"/>
        <vers num="0.4"/>
        <vers num="0.5"/>
        <vers num="0.6"/>
        <vers num="0.6.1"/>
        <vers num="0.7"/>
        <vers num="0.7.1"/>
        <vers num="0.8"/>
        <vers num="0.9" edition="rc"/>
        <vers num="0.9.1"/>
        <vers num="0.9.2"/>
        <vers num="0.9.3"/>
        <vers num="1.0" edition="preview_release"/>
        <vers num="1.0.1"/>
        <vers num="1.0.2"/>
        <vers num="1.0.3"/>
        <vers num="1.0.4"/>
        <vers num="1.0.5"/>
        <vers num="1.0.6"/>
        <vers num="1.0.7"/>
        <vers num="1.0.8"/>
        <vers num="1.5" edition="beta1"/>
        <vers num="1.5" edition="beta2"/>
        <vers num="1.5.0.1"/>
        <vers num="1.5.0.10"/>
        <vers num="1.5.0.11"/>
        <vers num="1.5.0.12"/>
        <vers num="1.5.0.2"/>
        <vers num="1.5.0.3"/>
        <vers num="1.5.0.4"/>
        <vers num="1.5.0.5"/>
        <vers num="1.5.0.6"/>
        <vers num="1.5.0.7"/>
        <vers num="1.5.0.8"/>
        <vers num="1.5.0.9"/>
        <vers num="1.5.1"/>
        <vers num="1.5.2"/>
        <vers num="1.5.3"/>
        <vers num="1.5.4"/>
        <vers num="1.5.5"/>
        <vers num="1.5.6"/>
        <vers num="1.5.7"/>
        <vers num="1.5.8"/>
        <vers num="10.0"/>
        <vers num="10.0.1"/>
        <vers num="10.0.10"/>
        <vers num="10.0.11"/>
        <vers num="10.0.12"/>
        <vers num="10.0.2"/>
        <vers num="10.0.3"/>
        <vers num="10.0.4"/>
        <vers num="10.0.5"/>
        <vers num="10.0.6"/>
        <vers num="10.0.7"/>
        <vers num="10.0.8"/>
        <vers num="10.0.9"/>
        <vers num="11.0"/>
        <vers num="12.0" edition="beta6"/>
        <vers num="13.0"/>
        <vers num="13.0.1"/>
        <vers num="14.0"/>
        <vers num="14.0.1"/>
        <vers num="15.0"/>
        <vers num="15.0.1"/>
        <vers num="16.0"/>
        <vers num="16.0.1"/>
        <vers num="16.0.2"/>
        <vers num="17.0.10"/>
        <vers num="17.0.11"/>
        <vers num="17.0.2"/>
        <vers num="17.0.3"/>
        <vers num="17.0.4"/>
        <vers num="17.0.5"/>
        <vers num="17.0.6"/>
        <vers num="17.0.7"/>
        <vers num="17.0.8"/>
        <vers num="17.0.9"/>
        <vers num="18.0"/>
        <vers num="18.0.1"/>
        <vers num="18.0.2"/>
        <vers num="19.0"/>
        <vers num="19.0.1"/>
        <vers num="19.0.2"/>
        <vers num="2.0"/>
        <vers num="2.0.0.1"/>
        <vers num="2.0.0.10"/>
        <vers num="2.0.0.11"/>
        <vers num="2.0.0.12"/>
        <vers num="2.0.0.13"/>
        <vers num="2.0.0.14"/>
        <vers num="2.0.0.15"/>
        <vers num="2.0.0.16"/>
        <vers num="2.0.0.17"/>
        <vers num="2.0.0.18"/>
        <vers num="2.0.0.19"/>
        <vers num="2.0.0.2"/>
        <vers num="2.0.0.20"/>
        <vers num="2.0.0.3"/>
        <vers num="2.0.0.4"/>
        <vers num="2.0.0.5"/>
        <vers num="2.0.0.6"/>
        <vers num="2.0.0.7"/>
        <vers num="2.0.0.8"/>
        <vers num="2.0.0.9"/>
        <vers num="20.0"/>
        <vers num="20.0.1"/>
        <vers num="21.0"/>
        <vers num="23.0"/>
        <vers num="23.0.1"/>
        <vers num="24.0"/>
        <vers num="24.1"/>
        <vers num="24.1.1"/>
        <vers num="25.0"/>
        <vers num="25.0.1"/>
        <vers num="26.0"/>
        <vers num="27.0"/>
        <vers prev="1" num="27.0.1"/>
        <vers num="3.0"/>
        <vers num="3.0.1"/>
        <vers num="3.0.10"/>
        <vers num="3.0.11"/>
        <vers num="3.0.12"/>
        <vers num="3.0.13"/>
        <vers num="3.0.14"/>
        <vers num="3.0.15"/>
        <vers num="3.0.16"/>
        <vers num="3.0.17"/>
        <vers num="3.0.18"/>
        <vers num="3.0.19"/>
        <vers num="3.0.2"/>
        <vers num="3.0.3"/>
        <vers num="3.0.4"/>
        <vers num="3.0.5"/>
        <vers num="3.0.6"/>
        <vers num="3.0.7"/>
        <vers num="3.0.8"/>
        <vers num="3.0.9"/>
        <vers num="3.5"/>
        <vers num="3.5.1"/>
        <vers num="3.5.10"/>
        <vers num="3.5.11"/>
        <vers num="3.5.12"/>
        <vers num="3.5.13"/>
        <vers num="3.5.14"/>
        <vers num="3.5.15"/>
        <vers num="3.5.16"/>
        <vers num="3.5.17"/>
        <vers num="3.5.18"/>
        <vers num="3.5.19"/>
        <vers num="3.5.2"/>
        <vers num="3.5.3"/>
        <vers num="3.5.4"/>
        <vers num="3.5.5"/>
        <vers num="3.5.6"/>
        <vers num="3.5.7"/>
        <vers num="3.5.8"/>
        <vers num="3.5.9"/>
        <vers num="3.6"/>
        <vers num="3.6.10"/>
        <vers num="3.6.11"/>
        <vers num="3.6.12"/>
        <vers num="3.6.13"/>
        <vers num="3.6.14"/>
        <vers num="3.6.15"/>
        <vers num="3.6.16"/>
        <vers num="3.6.17"/>
        <vers num="3.6.18"/>
        <vers num="3.6.19"/>
        <vers num="3.6.2"/>
        <vers num="3.6.20"/>
        <vers num="3.6.21"/>
        <vers num="3.6.22"/>
        <vers num="3.6.23"/>
        <vers num="3.6.24"/>
        <vers num="3.6.25"/>
        <vers num="3.6.26"/>
        <vers num="3.6.27"/>
        <vers num="3.6.28"/>
        <vers num="3.6.3"/>
        <vers num="3.6.4"/>
        <vers num="3.6.6"/>
        <vers num="3.6.7"/>
        <vers num="3.6.8"/>
        <vers num="3.6.9"/>
        <vers num="4.0" edition="beta1"/>
        <vers num="4.0" edition="beta10"/>
        <vers num="4.0" edition="beta11"/>
        <vers num="4.0" edition="beta12"/>
        <vers num="4.0" edition="beta2"/>
        <vers num="4.0" edition="beta3"/>
        <vers num="4.0" edition="beta4"/>
        <vers num="4.0" edition="beta5"/>
        <vers num="4.0" edition="beta6"/>
        <vers num="4.0" edition="beta7"/>
        <vers num="4.0" edition="beta8"/>
        <vers num="4.0" edition="beta9"/>
        <vers num="4.0.1"/>
        <vers num="5.0"/>
        <vers num="5.0.1"/>
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers num="6.0.2"/>
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="8.0"/>
        <vers num="8.0.1"/>
        <vers num="9.0"/>
        <vers num="9.0.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1507" published="2014-03-19" name="CVE-2014-1507" modified="2014-03-19" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">Directory traversal vulnerability in the DeviceStorage API in Mozilla FirefoxOS before 1.2.2 allows attackers to bypass the media sandbox protection mechanism, and read or modify arbitrary files, via a crafted application that uses a relative pathname for a DeviceStorageFile object.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=940684" source="CONFIRM">https://bugzilla.mozilla.org/show_bug.cgi?id=940684</ref>
      <ref url="http://www.mozilla.org/security/announce/2014/mfsa2014-25.html" source="CONFIRM" adv="1">http://www.mozilla.org/security/announce/2014/mfsa2014-25.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="mozilla" name="firefoxos">
        <vers prev="1" num="1.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1508" published="2014-03-19" name="CVE-2014-1508" modified="2014-04-01" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:P)" CVSS_score="6.8" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.6" CVSS_base_score="6.8">
    <desc>
      <descript source="cve">The libxul.so!gfxContext::Polygon function in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to obtain sensitive information from process memory, cause a denial of service (out-of-bounds read and application crash), or possibly bypass the Same Origin Policy via vectors involving MathML polygon rendering.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=963198" source="CONFIRM">https://bugzilla.mozilla.org/show_bug.cgi?id=963198</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2151-1" source="UBUNTU">USN-2151-1</ref>
      <ref url="http://www.mozilla.org/security/announce/2014/mfsa2014-26.html" source="CONFIRM" adv="1">http://www.mozilla.org/security/announce/2014/mfsa2014-26.html</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2881" source="DEBIAN">DSA-2881</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0316.html" source="REDHAT">RHSA-2014:0316</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0310.html" source="REDHAT">RHSA-2014:0310</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00022.html" source="SUSE">openSUSE-SU-2014:0448</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.html" source="SUSE">openSUSE-SU-2014:0419</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00016.html" source="SUSE">SUSE-SU-2014:0418</ref>
    </refs>
    <vuln_soft>
      <prod vendor="mozilla" name="firefox">
        <vers num="0.1"/>
        <vers num="0.10"/>
        <vers num="0.10.1"/>
        <vers num="0.2"/>
        <vers num="0.3"/>
        <vers num="0.4"/>
        <vers num="0.5"/>
        <vers num="0.6"/>
        <vers num="0.6.1"/>
        <vers num="0.7"/>
        <vers num="0.7.1"/>
        <vers num="0.8"/>
        <vers num="0.9" edition="rc"/>
        <vers num="0.9.1"/>
        <vers num="0.9.2"/>
        <vers num="0.9.3"/>
        <vers num="1.0" edition="preview_release"/>
        <vers num="1.0.1"/>
        <vers num="1.0.2"/>
        <vers num="1.0.3"/>
        <vers num="1.0.4"/>
        <vers num="1.0.5"/>
        <vers num="1.0.6"/>
        <vers num="1.0.7"/>
        <vers num="1.0.8"/>
        <vers num="1.5" edition="beta1"/>
        <vers num="1.5" edition="beta2"/>
        <vers num="1.5.0.1"/>
        <vers num="1.5.0.10"/>
        <vers num="1.5.0.11"/>
        <vers num="1.5.0.12"/>
        <vers num="1.5.0.2"/>
        <vers num="1.5.0.3"/>
        <vers num="1.5.0.4"/>
        <vers num="1.5.0.5"/>
        <vers num="1.5.0.6"/>
        <vers num="1.5.0.7"/>
        <vers num="1.5.0.8"/>
        <vers num="1.5.0.9"/>
        <vers num="1.5.1"/>
        <vers num="1.5.2"/>
        <vers num="1.5.3"/>
        <vers num="1.5.4"/>
        <vers num="1.5.5"/>
        <vers num="1.5.6"/>
        <vers num="1.5.7"/>
        <vers num="1.5.8"/>
        <vers num="10.0"/>
        <vers num="10.0.1"/>
        <vers num="10.0.10"/>
        <vers num="10.0.11"/>
        <vers num="10.0.12"/>
        <vers num="10.0.2"/>
        <vers num="10.0.3"/>
        <vers num="10.0.4"/>
        <vers num="10.0.5"/>
        <vers num="10.0.6"/>
        <vers num="10.0.7"/>
        <vers num="10.0.8"/>
        <vers num="10.0.9"/>
        <vers num="11.0"/>
        <vers num="12.0" edition="beta6"/>
        <vers num="13.0"/>
        <vers num="13.0.1"/>
        <vers num="14.0"/>
        <vers num="14.0.1"/>
        <vers num="15.0"/>
        <vers num="15.0.1"/>
        <vers num="16.0"/>
        <vers num="16.0.1"/>
        <vers num="16.0.2"/>
        <vers num="17.0.10"/>
        <vers num="17.0.11"/>
        <vers num="17.0.2"/>
        <vers num="17.0.3"/>
        <vers num="17.0.4"/>
        <vers num="17.0.5"/>
        <vers num="17.0.6"/>
        <vers num="17.0.7"/>
        <vers num="17.0.8"/>
        <vers num="17.0.9"/>
        <vers num="18.0"/>
        <vers num="18.0.1"/>
        <vers num="18.0.2"/>
        <vers num="19.0"/>
        <vers num="19.0.1"/>
        <vers num="19.0.2"/>
        <vers num="2.0"/>
        <vers num="2.0.0.1"/>
        <vers num="2.0.0.10"/>
        <vers num="2.0.0.11"/>
        <vers num="2.0.0.12"/>
        <vers num="2.0.0.13"/>
        <vers num="2.0.0.14"/>
        <vers num="2.0.0.15"/>
        <vers num="2.0.0.16"/>
        <vers num="2.0.0.17"/>
        <vers num="2.0.0.18"/>
        <vers num="2.0.0.19"/>
        <vers num="2.0.0.2"/>
        <vers num="2.0.0.20"/>
        <vers num="2.0.0.3"/>
        <vers num="2.0.0.4"/>
        <vers num="2.0.0.5"/>
        <vers num="2.0.0.6"/>
        <vers num="2.0.0.7"/>
        <vers num="2.0.0.8"/>
        <vers num="2.0.0.9"/>
        <vers num="20.0"/>
        <vers num="20.0.1"/>
        <vers num="21.0"/>
        <vers num="23.0"/>
        <vers num="23.0.1"/>
        <vers num="24.0"/>
        <vers num="24.1"/>
        <vers num="24.1.1"/>
        <vers num="25.0"/>
        <vers num="25.0.1"/>
        <vers num="26.0"/>
        <vers num="27.0"/>
        <vers prev="1" num="27.0.1"/>
        <vers num="3.0"/>
        <vers num="3.0.1"/>
        <vers num="3.0.10"/>
        <vers num="3.0.11"/>
        <vers num="3.0.12"/>
        <vers num="3.0.13"/>
        <vers num="3.0.14"/>
        <vers num="3.0.15"/>
        <vers num="3.0.16"/>
        <vers num="3.0.17"/>
        <vers num="3.0.18"/>
        <vers num="3.0.19"/>
        <vers num="3.0.2"/>
        <vers num="3.0.3"/>
        <vers num="3.0.4"/>
        <vers num="3.0.5"/>
        <vers num="3.0.6"/>
        <vers num="3.0.7"/>
        <vers num="3.0.8"/>
        <vers num="3.0.9"/>
        <vers num="3.5"/>
        <vers num="3.5.1"/>
        <vers num="3.5.10"/>
        <vers num="3.5.11"/>
        <vers num="3.5.12"/>
        <vers num="3.5.13"/>
        <vers num="3.5.14"/>
        <vers num="3.5.15"/>
        <vers num="3.5.16"/>
        <vers num="3.5.17"/>
        <vers num="3.5.18"/>
        <vers num="3.5.19"/>
        <vers num="3.5.2"/>
        <vers num="3.5.3"/>
        <vers num="3.5.4"/>
        <vers num="3.5.5"/>
        <vers num="3.5.6"/>
        <vers num="3.5.7"/>
        <vers num="3.5.8"/>
        <vers num="3.5.9"/>
        <vers num="3.6"/>
        <vers num="3.6.10"/>
        <vers num="3.6.11"/>
        <vers num="3.6.12"/>
        <vers num="3.6.13"/>
        <vers num="3.6.14"/>
        <vers num="3.6.15"/>
        <vers num="3.6.16"/>
        <vers num="3.6.17"/>
        <vers num="3.6.18"/>
        <vers num="3.6.19"/>
        <vers num="3.6.2"/>
        <vers num="3.6.20"/>
        <vers num="3.6.21"/>
        <vers num="3.6.22"/>
        <vers num="3.6.23"/>
        <vers num="3.6.24"/>
        <vers num="3.6.25"/>
        <vers num="3.6.26"/>
        <vers num="3.6.27"/>
        <vers num="3.6.28"/>
        <vers num="3.6.3"/>
        <vers num="3.6.4"/>
        <vers num="3.6.6"/>
        <vers num="3.6.7"/>
        <vers num="3.6.8"/>
        <vers num="3.6.9"/>
        <vers num="4.0" edition="beta1"/>
        <vers num="4.0" edition="beta10"/>
        <vers num="4.0" edition="beta11"/>
        <vers num="4.0" edition="beta12"/>
        <vers num="4.0" edition="beta2"/>
        <vers num="4.0" edition="beta3"/>
        <vers num="4.0" edition="beta4"/>
        <vers num="4.0" edition="beta5"/>
        <vers num="4.0" edition="beta6"/>
        <vers num="4.0" edition="beta7"/>
        <vers num="4.0" edition="beta8"/>
        <vers num="4.0" edition="beta9"/>
        <vers num="4.0.1"/>
        <vers num="5.0"/>
        <vers num="5.0.1"/>
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers num="6.0.2"/>
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="8.0"/>
        <vers num="8.0.1"/>
        <vers num="9.0"/>
        <vers num="9.0.1"/>
      </prod>
      <prod vendor="mozilla" name="firefox_esr">
        <vers num="24.0"/>
        <vers num="24.0.1"/>
        <vers num="24.0.2"/>
        <vers num="24.1.0"/>
        <vers num="24.1.1"/>
        <vers num="24.2"/>
        <vers num="24.3"/>
      </prod>
      <prod vendor="mozilla" name="seamonkey">
        <vers num="2.0" edition="alpha_1"/>
        <vers num="2.0" edition="alpha_2"/>
        <vers num="2.0" edition="alpha_3"/>
        <vers num="2.0" edition="beta_1"/>
        <vers num="2.0" edition="beta_2"/>
        <vers num="2.0" edition="rc1"/>
        <vers num="2.0" edition="rc2"/>
        <vers num="2.0.1"/>
        <vers num="2.0.10"/>
        <vers num="2.0.11"/>
        <vers num="2.0.12"/>
        <vers num="2.0.13"/>
        <vers num="2.0.14"/>
        <vers num="2.0.2"/>
        <vers num="2.0.3"/>
        <vers num="2.0.4"/>
        <vers num="2.0.5"/>
        <vers num="2.0.6"/>
        <vers num="2.0.7"/>
        <vers num="2.0.8"/>
        <vers num="2.0.9"/>
        <vers num="2.1" edition="alpha1"/>
        <vers num="2.1" edition="alpha2"/>
        <vers num="2.1" edition="alpha3"/>
        <vers num="2.1" edition="beta1"/>
        <vers num="2.1" edition="beta2"/>
        <vers num="2.1" edition="beta3"/>
        <vers num="2.1" edition="rc1"/>
        <vers num="2.1" edition="rc2"/>
        <vers num="2.10" edition="beta1"/>
        <vers num="2.10" edition="beta2"/>
        <vers num="2.10" edition="beta3"/>
        <vers num="2.10.1"/>
        <vers num="2.11" edition="beta1"/>
        <vers num="2.11" edition="beta2"/>
        <vers num="2.11" edition="beta3"/>
        <vers num="2.11" edition="beta4"/>
        <vers num="2.11" edition="beta5"/>
        <vers num="2.11" edition="beta6"/>
        <vers num="2.12" edition="beta1"/>
        <vers num="2.12" edition="beta2"/>
        <vers num="2.12" edition="beta3"/>
        <vers num="2.12" edition="beta4"/>
        <vers num="2.12" edition="beta5"/>
        <vers num="2.12" edition="beta6"/>
        <vers num="2.12.1"/>
        <vers num="2.13" edition="beta1"/>
        <vers num="2.13" edition="beta2"/>
        <vers num="2.13" edition="beta3"/>
        <vers num="2.13" edition="beta4"/>
        <vers num="2.13" edition="beta5"/>
        <vers num="2.13" edition="beta6"/>
        <vers num="2.13.1"/>
        <vers num="2.13.2"/>
        <vers num="2.14" edition="beta1"/>
        <vers num="2.14" edition="beta2"/>
        <vers num="2.14" edition="beta3"/>
        <vers num="2.14" edition="beta4"/>
        <vers num="2.14" edition="beta5"/>
        <vers num="2.15" edition="beta1"/>
        <vers num="2.15" edition="beta2"/>
        <vers num="2.15" edition="beta3"/>
        <vers num="2.15" edition="beta4"/>
        <vers num="2.15" edition="beta5"/>
        <vers num="2.15" edition="beta6"/>
        <vers num="2.15.1"/>
        <vers num="2.15.2"/>
        <vers num="2.16" edition="beta1"/>
        <vers num="2.16" edition="beta2"/>
        <vers num="2.16" edition="beta3"/>
        <vers num="2.16" edition="beta4"/>
        <vers num="2.16" edition="beta5"/>
        <vers num="2.16.1"/>
        <vers num="2.16.2"/>
        <vers num="2.17" edition="beta1"/>
        <vers num="2.17" edition="beta2"/>
        <vers num="2.17" edition="beta3"/>
        <vers num="2.17" edition="beta4"/>
        <vers num="2.17.1"/>
        <vers num="2.18" edition="beta1"/>
        <vers num="2.18" edition="beta2"/>
        <vers num="2.18" edition="beta3"/>
        <vers num="2.18" edition="beta4"/>
        <vers num="2.19" edition="beta1"/>
        <vers num="2.19" edition="beta2"/>
        <vers num="2.2" edition="beta1"/>
        <vers num="2.2" edition="beta2"/>
        <vers num="2.2" edition="beta3"/>
        <vers num="2.20" edition="beta1"/>
        <vers num="2.20" edition="beta2"/>
        <vers num="2.20" edition="beta3"/>
        <vers num="2.21" edition="beta1"/>
        <vers num="2.21" edition="beta2"/>
        <vers num="2.22" edition="beta1"/>
        <vers num="2.22" edition="beta2"/>
        <vers num="2.22.1"/>
        <vers num="2.23" edition="beta1"/>
        <vers num="2.23" edition="beta2"/>
        <vers num="2.24" edition="beta1"/>
        <vers prev="1" num="2.25" edition="beta1"/>
        <vers prev="1" num="2.25" edition="beta2"/>
        <vers num="2.3" edition="beta1"/>
        <vers num="2.3" edition="beta2"/>
        <vers num="2.3" edition="beta3"/>
        <vers num="2.3.1"/>
        <vers num="2.3.2"/>
        <vers num="2.3.3"/>
        <vers num="2.4" edition="beta1"/>
        <vers num="2.4" edition="beta2"/>
        <vers num="2.4" edition="beta3"/>
        <vers num="2.4.1"/>
        <vers num="2.5" edition="beta1"/>
        <vers num="2.5" edition="beta2"/>
        <vers num="2.5" edition="beta3"/>
        <vers num="2.5" edition="beta4"/>
        <vers num="2.6" edition="beta1"/>
        <vers num="2.6" edition="beta2"/>
        <vers num="2.6" edition="beta3"/>
        <vers num="2.6" edition="beta4"/>
        <vers num="2.6.1"/>
        <vers num="2.7" edition="beta1"/>
        <vers num="2.7" edition="beta2"/>
        <vers num="2.7" edition="beta3"/>
        <vers num="2.7" edition="beta4"/>
        <vers num="2.7" edition="beta5"/>
        <vers num="2.7.1"/>
        <vers num="2.7.2"/>
        <vers num="2.8" edition="beta1"/>
        <vers num="2.8" edition="beta2"/>
        <vers num="2.8" edition="beta3"/>
        <vers num="2.8" edition="beta4"/>
        <vers num="2.8" edition="beta5"/>
        <vers num="2.8" edition="beta6"/>
        <vers num="2.9" edition="beta1"/>
        <vers num="2.9" edition="beta2"/>
        <vers num="2.9" edition="beta3"/>
        <vers num="2.9" edition="beta4"/>
        <vers num="2.9.1"/>
      </prod>
      <prod vendor="mozilla" name="thunderbird">
        <vers num="0.1"/>
        <vers num="0.2"/>
        <vers num="0.3"/>
        <vers num="0.4"/>
        <vers num="0.5"/>
        <vers num="0.6"/>
        <vers num="0.7"/>
        <vers num="0.7.1"/>
        <vers num="0.7.2"/>
        <vers num="0.7.3"/>
        <vers num="0.8"/>
        <vers num="0.9"/>
        <vers num="1.0"/>
        <vers num="1.0.1"/>
        <vers num="1.0.2"/>
        <vers num="1.0.3"/>
        <vers num="1.0.4"/>
        <vers num="1.0.5" edition="beta"/>
        <vers num="1.0.6"/>
        <vers num="1.0.7"/>
        <vers num="1.0.8"/>
        <vers num="1.5" edition="beta2"/>
        <vers num="1.5.0.1"/>
        <vers num="1.5.0.10"/>
        <vers num="1.5.0.11"/>
        <vers num="1.5.0.12"/>
        <vers num="1.5.0.13"/>
        <vers num="1.5.0.14"/>
        <vers num="1.5.0.2"/>
        <vers num="1.5.0.3"/>
        <vers num="1.5.0.4"/>
        <vers num="1.5.0.5"/>
        <vers num="1.5.0.6"/>
        <vers num="1.5.0.7"/>
        <vers num="1.5.0.8"/>
        <vers num="1.5.0.9"/>
        <vers num="1.5.1"/>
        <vers num="1.5.2"/>
        <vers num="1.7.1"/>
        <vers num="1.7.3"/>
        <vers num="10.0"/>
        <vers num="10.0.1"/>
        <vers num="10.0.2"/>
        <vers num="10.0.3"/>
        <vers num="10.0.4"/>
        <vers num="11.0"/>
        <vers num="11.0.1"/>
        <vers num="12.0"/>
        <vers num="12.0.1"/>
        <vers num="13.0"/>
        <vers num="13.0.1"/>
        <vers num="14.0"/>
        <vers num="15.0"/>
        <vers num="15.0.1"/>
        <vers num="16.0"/>
        <vers num="16.0.1"/>
        <vers num="16.0.2"/>
        <vers num="17.0"/>
        <vers num="17.0.1"/>
        <vers num="17.0.2"/>
        <vers num="17.0.3"/>
        <vers num="17.0.4"/>
        <vers num="17.0.5"/>
        <vers num="17.0.6"/>
        <vers num="17.0.7"/>
        <vers num="17.0.8"/>
        <vers num="2.0"/>
        <vers num="2.0.0.0"/>
        <vers num="2.0.0.1"/>
        <vers num="2.0.0.11"/>
        <vers num="2.0.0.12"/>
        <vers num="2.0.0.13"/>
        <vers num="2.0.0.14"/>
        <vers num="2.0.0.15"/>
        <vers num="2.0.0.16"/>
        <vers num="2.0.0.17"/>
        <vers num="2.0.0.18"/>
        <vers num="2.0.0.19"/>
        <vers num="2.0.0.2"/>
        <vers num="2.0.0.20"/>
        <vers num="2.0.0.21"/>
        <vers num="2.0.0.22"/>
        <vers num="2.0.0.23"/>
        <vers num="2.0.0.3"/>
        <vers num="2.0.0.4"/>
        <vers num="2.0.0.5"/>
        <vers num="2.0.0.6"/>
        <vers num="2.0.0.7"/>
        <vers num="2.0.0.8"/>
        <vers num="2.0.0.9"/>
        <vers num="24.0"/>
        <vers num="24.0.1"/>
        <vers num="24.1"/>
        <vers num="24.1.1"/>
        <vers num="24.2"/>
        <vers prev="1" num="24.3"/>
        <vers num="3.0"/>
        <vers num="3.0.1"/>
        <vers num="3.0.10"/>
        <vers num="3.0.11"/>
        <vers num="3.0.2"/>
        <vers num="3.0.3"/>
        <vers num="3.0.4"/>
        <vers num="3.0.5"/>
        <vers num="3.0.6"/>
        <vers num="3.0.7"/>
        <vers num="3.0.8"/>
        <vers num="3.0.9"/>
        <vers num="3.1"/>
        <vers num="3.1.1"/>
        <vers num="3.1.10"/>
        <vers num="3.1.11"/>
        <vers num="3.1.12"/>
        <vers num="3.1.13"/>
        <vers num="3.1.14"/>
        <vers num="3.1.15"/>
        <vers num="3.1.16"/>
        <vers num="3.1.17"/>
        <vers num="3.1.2"/>
        <vers num="3.1.3"/>
        <vers num="3.1.4"/>
        <vers num="3.1.5"/>
        <vers num="3.1.6"/>
        <vers num="3.1.7"/>
        <vers num="3.1.8"/>
        <vers num="3.1.9"/>
        <vers num="5.0"/>
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers num="6.0.2"/>
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="8.0"/>
        <vers num="9.0"/>
        <vers num="9.0.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1509" published="2014-03-19" name="CVE-2014-1509" modified="2014-04-01" CVSS_version="2.0" CVSS_vector="(AV:N/AC:H/Au:N/C:C/I:C/A:C)" CVSS_score="7.6" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="4.9" CVSS_base_score="7.6">
    <desc>
      <descript source="cve">Buffer overflow in the _cairo_truetype_index_to_ucs4 function in cairo, as used in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25, allows remote attackers to execute arbitrary code via a crafted extension that renders fonts in a PDF document.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=966021" source="CONFIRM">https://bugzilla.mozilla.org/show_bug.cgi?id=966021</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2151-1" source="UBUNTU">USN-2151-1</ref>
      <ref url="http://www.mozilla.org/security/announce/2014/mfsa2014-27.html" source="CONFIRM" adv="1">http://www.mozilla.org/security/announce/2014/mfsa2014-27.html</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0316.html" source="REDHAT">RHSA-2014:0316</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0310.html" source="REDHAT">RHSA-2014:0310</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00022.html" source="SUSE">openSUSE-SU-2014:0448</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.html" source="SUSE">openSUSE-SU-2014:0419</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00016.html" source="SUSE">SUSE-SU-2014:0418</ref>
    </refs>
    <vuln_soft>
      <prod vendor="mozilla" name="firefox">
        <vers num="0.1"/>
        <vers num="0.10"/>
        <vers num="0.10.1"/>
        <vers num="0.2"/>
        <vers num="0.3"/>
        <vers num="0.4"/>
        <vers num="0.5"/>
        <vers num="0.6"/>
        <vers num="0.6.1"/>
        <vers num="0.7"/>
        <vers num="0.7.1"/>
        <vers num="0.8"/>
        <vers num="0.9" edition="rc"/>
        <vers num="0.9.1"/>
        <vers num="0.9.2"/>
        <vers num="0.9.3"/>
        <vers num="1.0" edition="preview_release"/>
        <vers num="1.0.1"/>
        <vers num="1.0.2"/>
        <vers num="1.0.3"/>
        <vers num="1.0.4"/>
        <vers num="1.0.5"/>
        <vers num="1.0.6"/>
        <vers num="1.0.7"/>
        <vers num="1.0.8"/>
        <vers num="1.5" edition="beta1"/>
        <vers num="1.5" edition="beta2"/>
        <vers num="1.5.0.1"/>
        <vers num="1.5.0.10"/>
        <vers num="1.5.0.11"/>
        <vers num="1.5.0.12"/>
        <vers num="1.5.0.2"/>
        <vers num="1.5.0.3"/>
        <vers num="1.5.0.4"/>
        <vers num="1.5.0.5"/>
        <vers num="1.5.0.6"/>
        <vers num="1.5.0.7"/>
        <vers num="1.5.0.8"/>
        <vers num="1.5.0.9"/>
        <vers num="1.5.1"/>
        <vers num="1.5.2"/>
        <vers num="1.5.3"/>
        <vers num="1.5.4"/>
        <vers num="1.5.5"/>
        <vers num="1.5.6"/>
        <vers num="1.5.7"/>
        <vers num="1.5.8"/>
        <vers num="10.0"/>
        <vers num="10.0.1"/>
        <vers num="10.0.10"/>
        <vers num="10.0.11"/>
        <vers num="10.0.12"/>
        <vers num="10.0.2"/>
        <vers num="10.0.3"/>
        <vers num="10.0.4"/>
        <vers num="10.0.5"/>
        <vers num="10.0.6"/>
        <vers num="10.0.7"/>
        <vers num="10.0.8"/>
        <vers num="10.0.9"/>
        <vers num="11.0"/>
        <vers num="12.0" edition="beta6"/>
        <vers num="13.0"/>
        <vers num="13.0.1"/>
        <vers num="14.0"/>
        <vers num="14.0.1"/>
        <vers num="15.0"/>
        <vers num="15.0.1"/>
        <vers num="16.0"/>
        <vers num="16.0.1"/>
        <vers num="16.0.2"/>
        <vers num="17.0.10"/>
        <vers num="17.0.11"/>
        <vers num="17.0.2"/>
        <vers num="17.0.3"/>
        <vers num="17.0.4"/>
        <vers num="17.0.5"/>
        <vers num="17.0.6"/>
        <vers num="17.0.7"/>
        <vers num="17.0.8"/>
        <vers num="17.0.9"/>
        <vers num="18.0"/>
        <vers num="18.0.1"/>
        <vers num="18.0.2"/>
        <vers num="19.0"/>
        <vers num="19.0.1"/>
        <vers num="19.0.2"/>
        <vers num="2.0"/>
        <vers num="2.0.0.1"/>
        <vers num="2.0.0.10"/>
        <vers num="2.0.0.11"/>
        <vers num="2.0.0.12"/>
        <vers num="2.0.0.13"/>
        <vers num="2.0.0.14"/>
        <vers num="2.0.0.15"/>
        <vers num="2.0.0.16"/>
        <vers num="2.0.0.17"/>
        <vers num="2.0.0.18"/>
        <vers num="2.0.0.19"/>
        <vers num="2.0.0.2"/>
        <vers num="2.0.0.20"/>
        <vers num="2.0.0.3"/>
        <vers num="2.0.0.4"/>
        <vers num="2.0.0.5"/>
        <vers num="2.0.0.6"/>
        <vers num="2.0.0.7"/>
        <vers num="2.0.0.8"/>
        <vers num="2.0.0.9"/>
        <vers num="20.0"/>
        <vers num="20.0.1"/>
        <vers num="21.0"/>
        <vers num="23.0"/>
        <vers num="23.0.1"/>
        <vers num="24.0"/>
        <vers num="24.1"/>
        <vers num="24.1.1"/>
        <vers num="25.0"/>
        <vers num="25.0.1"/>
        <vers num="26.0"/>
        <vers num="27.0"/>
        <vers prev="1" num="27.0.1"/>
        <vers num="3.0"/>
        <vers num="3.0.1"/>
        <vers num="3.0.10"/>
        <vers num="3.0.11"/>
        <vers num="3.0.12"/>
        <vers num="3.0.13"/>
        <vers num="3.0.14"/>
        <vers num="3.0.15"/>
        <vers num="3.0.16"/>
        <vers num="3.0.17"/>
        <vers num="3.0.18"/>
        <vers num="3.0.19"/>
        <vers num="3.0.2"/>
        <vers num="3.0.3"/>
        <vers num="3.0.4"/>
        <vers num="3.0.5"/>
        <vers num="3.0.6"/>
        <vers num="3.0.7"/>
        <vers num="3.0.8"/>
        <vers num="3.0.9"/>
        <vers num="3.5"/>
        <vers num="3.5.1"/>
        <vers num="3.5.10"/>
        <vers num="3.5.11"/>
        <vers num="3.5.12"/>
        <vers num="3.5.13"/>
        <vers num="3.5.14"/>
        <vers num="3.5.15"/>
        <vers num="3.5.16"/>
        <vers num="3.5.17"/>
        <vers num="3.5.18"/>
        <vers num="3.5.19"/>
        <vers num="3.5.2"/>
        <vers num="3.5.3"/>
        <vers num="3.5.4"/>
        <vers num="3.5.5"/>
        <vers num="3.5.6"/>
        <vers num="3.5.7"/>
        <vers num="3.5.8"/>
        <vers num="3.5.9"/>
        <vers num="3.6"/>
        <vers num="3.6.10"/>
        <vers num="3.6.11"/>
        <vers num="3.6.12"/>
        <vers num="3.6.13"/>
        <vers num="3.6.14"/>
        <vers num="3.6.15"/>
        <vers num="3.6.16"/>
        <vers num="3.6.17"/>
        <vers num="3.6.18"/>
        <vers num="3.6.19"/>
        <vers num="3.6.2"/>
        <vers num="3.6.20"/>
        <vers num="3.6.21"/>
        <vers num="3.6.22"/>
        <vers num="3.6.23"/>
        <vers num="3.6.24"/>
        <vers num="3.6.25"/>
        <vers num="3.6.26"/>
        <vers num="3.6.27"/>
        <vers num="3.6.28"/>
        <vers num="3.6.3"/>
        <vers num="3.6.4"/>
        <vers num="3.6.6"/>
        <vers num="3.6.7"/>
        <vers num="3.6.8"/>
        <vers num="3.6.9"/>
        <vers num="4.0" edition="beta1"/>
        <vers num="4.0" edition="beta10"/>
        <vers num="4.0" edition="beta11"/>
        <vers num="4.0" edition="beta12"/>
        <vers num="4.0" edition="beta2"/>
        <vers num="4.0" edition="beta3"/>
        <vers num="4.0" edition="beta4"/>
        <vers num="4.0" edition="beta5"/>
        <vers num="4.0" edition="beta6"/>
        <vers num="4.0" edition="beta7"/>
        <vers num="4.0" edition="beta8"/>
        <vers num="4.0" edition="beta9"/>
        <vers num="4.0.1"/>
        <vers num="5.0"/>
        <vers num="5.0.1"/>
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers num="6.0.2"/>
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="8.0"/>
        <vers num="8.0.1"/>
        <vers num="9.0"/>
        <vers num="9.0.1"/>
      </prod>
      <prod vendor="mozilla" name="firefox_esr">
        <vers num="24.0"/>
        <vers num="24.0.1"/>
        <vers num="24.0.2"/>
        <vers num="24.1.0"/>
        <vers num="24.1.1"/>
        <vers num="24.2"/>
        <vers num="24.3"/>
      </prod>
      <prod vendor="mozilla" name="seamonkey">
        <vers num="2.0" edition="alpha_1"/>
        <vers num="2.0" edition="alpha_2"/>
        <vers num="2.0" edition="alpha_3"/>
        <vers num="2.0" edition="beta_1"/>
        <vers num="2.0" edition="beta_2"/>
        <vers num="2.0" edition="rc1"/>
        <vers num="2.0" edition="rc2"/>
        <vers num="2.0.1"/>
        <vers num="2.0.10"/>
        <vers num="2.0.11"/>
        <vers num="2.0.12"/>
        <vers num="2.0.13"/>
        <vers num="2.0.14"/>
        <vers num="2.0.2"/>
        <vers num="2.0.3"/>
        <vers num="2.0.4"/>
        <vers num="2.0.5"/>
        <vers num="2.0.6"/>
        <vers num="2.0.7"/>
        <vers num="2.0.8"/>
        <vers num="2.0.9"/>
        <vers num="2.1" edition="alpha1"/>
        <vers num="2.1" edition="alpha2"/>
        <vers num="2.1" edition="alpha3"/>
        <vers num="2.1" edition="beta1"/>
        <vers num="2.1" edition="beta2"/>
        <vers num="2.1" edition="beta3"/>
        <vers num="2.1" edition="rc1"/>
        <vers num="2.1" edition="rc2"/>
        <vers num="2.10" edition="beta1"/>
        <vers num="2.10" edition="beta2"/>
        <vers num="2.10" edition="beta3"/>
        <vers num="2.10.1"/>
        <vers num="2.11" edition="beta1"/>
        <vers num="2.11" edition="beta2"/>
        <vers num="2.11" edition="beta3"/>
        <vers num="2.11" edition="beta4"/>
        <vers num="2.11" edition="beta5"/>
        <vers num="2.11" edition="beta6"/>
        <vers num="2.12" edition="beta1"/>
        <vers num="2.12" edition="beta2"/>
        <vers num="2.12" edition="beta3"/>
        <vers num="2.12" edition="beta4"/>
        <vers num="2.12" edition="beta5"/>
        <vers num="2.12" edition="beta6"/>
        <vers num="2.12.1"/>
        <vers num="2.13" edition="beta1"/>
        <vers num="2.13" edition="beta2"/>
        <vers num="2.13" edition="beta3"/>
        <vers num="2.13" edition="beta4"/>
        <vers num="2.13" edition="beta5"/>
        <vers num="2.13" edition="beta6"/>
        <vers num="2.13.1"/>
        <vers num="2.13.2"/>
        <vers num="2.14" edition="beta1"/>
        <vers num="2.14" edition="beta2"/>
        <vers num="2.14" edition="beta3"/>
        <vers num="2.14" edition="beta4"/>
        <vers num="2.14" edition="beta5"/>
        <vers num="2.15" edition="beta1"/>
        <vers num="2.15" edition="beta2"/>
        <vers num="2.15" edition="beta3"/>
        <vers num="2.15" edition="beta4"/>
        <vers num="2.15" edition="beta5"/>
        <vers num="2.15" edition="beta6"/>
        <vers num="2.15.1"/>
        <vers num="2.15.2"/>
        <vers num="2.16" edition="beta1"/>
        <vers num="2.16" edition="beta2"/>
        <vers num="2.16" edition="beta3"/>
        <vers num="2.16" edition="beta4"/>
        <vers num="2.16" edition="beta5"/>
        <vers num="2.16.1"/>
        <vers num="2.16.2"/>
        <vers num="2.17" edition="beta1"/>
        <vers num="2.17" edition="beta2"/>
        <vers num="2.17" edition="beta3"/>
        <vers num="2.17" edition="beta4"/>
        <vers num="2.17.1"/>
        <vers num="2.18" edition="beta1"/>
        <vers num="2.18" edition="beta2"/>
        <vers num="2.18" edition="beta3"/>
        <vers num="2.18" edition="beta4"/>
        <vers num="2.19" edition="beta1"/>
        <vers num="2.19" edition="beta2"/>
        <vers num="2.2" edition="beta1"/>
        <vers num="2.2" edition="beta2"/>
        <vers num="2.2" edition="beta3"/>
        <vers num="2.20" edition="beta1"/>
        <vers num="2.20" edition="beta2"/>
        <vers num="2.20" edition="beta3"/>
        <vers num="2.21" edition="beta1"/>
        <vers num="2.21" edition="beta2"/>
        <vers num="2.22" edition="beta1"/>
        <vers num="2.22" edition="beta2"/>
        <vers num="2.22.1"/>
        <vers num="2.23" edition="beta1"/>
        <vers num="2.23" edition="beta2"/>
        <vers num="2.24" edition="beta1"/>
        <vers prev="1" num="2.25" edition="beta1"/>
        <vers prev="1" num="2.25" edition="beta2"/>
        <vers num="2.3" edition="beta1"/>
        <vers num="2.3" edition="beta2"/>
        <vers num="2.3" edition="beta3"/>
        <vers num="2.3.1"/>
        <vers num="2.3.2"/>
        <vers num="2.3.3"/>
        <vers num="2.4" edition="beta1"/>
        <vers num="2.4" edition="beta2"/>
        <vers num="2.4" edition="beta3"/>
        <vers num="2.4.1"/>
        <vers num="2.5" edition="beta1"/>
        <vers num="2.5" edition="beta2"/>
        <vers num="2.5" edition="beta3"/>
        <vers num="2.5" edition="beta4"/>
        <vers num="2.6" edition="beta1"/>
        <vers num="2.6" edition="beta2"/>
        <vers num="2.6" edition="beta3"/>
        <vers num="2.6" edition="beta4"/>
        <vers num="2.6.1"/>
        <vers num="2.7" edition="beta1"/>
        <vers num="2.7" edition="beta2"/>
        <vers num="2.7" edition="beta3"/>
        <vers num="2.7" edition="beta4"/>
        <vers num="2.7" edition="beta5"/>
        <vers num="2.7.1"/>
        <vers num="2.7.2"/>
        <vers num="2.8" edition="beta1"/>
        <vers num="2.8" edition="beta2"/>
        <vers num="2.8" edition="beta3"/>
        <vers num="2.8" edition="beta4"/>
        <vers num="2.8" edition="beta5"/>
        <vers num="2.8" edition="beta6"/>
        <vers num="2.9" edition="beta1"/>
        <vers num="2.9" edition="beta2"/>
        <vers num="2.9" edition="beta3"/>
        <vers num="2.9" edition="beta4"/>
        <vers num="2.9.1"/>
      </prod>
      <prod vendor="mozilla" name="thunderbird">
        <vers num="0.1"/>
        <vers num="0.2"/>
        <vers num="0.3"/>
        <vers num="0.4"/>
        <vers num="0.5"/>
        <vers num="0.6"/>
        <vers num="0.7"/>
        <vers num="0.7.1"/>
        <vers num="0.7.2"/>
        <vers num="0.7.3"/>
        <vers num="0.8"/>
        <vers num="0.9"/>
        <vers num="1.0"/>
        <vers num="1.0.1"/>
        <vers num="1.0.2"/>
        <vers num="1.0.3"/>
        <vers num="1.0.4"/>
        <vers num="1.0.5" edition="beta"/>
        <vers num="1.0.6"/>
        <vers num="1.0.7"/>
        <vers num="1.0.8"/>
        <vers num="1.5" edition="beta2"/>
        <vers num="1.5.0.1"/>
        <vers num="1.5.0.10"/>
        <vers num="1.5.0.11"/>
        <vers num="1.5.0.12"/>
        <vers num="1.5.0.13"/>
        <vers num="1.5.0.14"/>
        <vers num="1.5.0.2"/>
        <vers num="1.5.0.3"/>
        <vers num="1.5.0.4"/>
        <vers num="1.5.0.5"/>
        <vers num="1.5.0.6"/>
        <vers num="1.5.0.7"/>
        <vers num="1.5.0.8"/>
        <vers num="1.5.0.9"/>
        <vers num="1.5.1"/>
        <vers num="1.5.2"/>
        <vers num="1.7.1"/>
        <vers num="1.7.3"/>
        <vers num="10.0"/>
        <vers num="10.0.1"/>
        <vers num="10.0.2"/>
        <vers num="10.0.3"/>
        <vers num="10.0.4"/>
        <vers num="11.0"/>
        <vers num="11.0.1"/>
        <vers num="12.0"/>
        <vers num="12.0.1"/>
        <vers num="13.0"/>
        <vers num="13.0.1"/>
        <vers num="14.0"/>
        <vers num="15.0"/>
        <vers num="15.0.1"/>
        <vers num="16.0"/>
        <vers num="16.0.1"/>
        <vers num="16.0.2"/>
        <vers num="17.0"/>
        <vers num="17.0.1"/>
        <vers num="17.0.2"/>
        <vers num="17.0.3"/>
        <vers num="17.0.4"/>
        <vers num="17.0.5"/>
        <vers num="17.0.6"/>
        <vers num="17.0.7"/>
        <vers num="17.0.8"/>
        <vers num="2.0"/>
        <vers num="2.0.0.0"/>
        <vers num="2.0.0.1"/>
        <vers num="2.0.0.11"/>
        <vers num="2.0.0.12"/>
        <vers num="2.0.0.13"/>
        <vers num="2.0.0.14"/>
        <vers num="2.0.0.15"/>
        <vers num="2.0.0.16"/>
        <vers num="2.0.0.17"/>
        <vers num="2.0.0.18"/>
        <vers num="2.0.0.19"/>
        <vers num="2.0.0.2"/>
        <vers num="2.0.0.20"/>
        <vers num="2.0.0.21"/>
        <vers num="2.0.0.22"/>
        <vers num="2.0.0.23"/>
        <vers num="2.0.0.3"/>
        <vers num="2.0.0.4"/>
        <vers num="2.0.0.5"/>
        <vers num="2.0.0.6"/>
        <vers num="2.0.0.7"/>
        <vers num="2.0.0.8"/>
        <vers num="2.0.0.9"/>
        <vers num="24.0"/>
        <vers num="24.0.1"/>
        <vers num="24.1"/>
        <vers num="24.1.1"/>
        <vers num="24.2"/>
        <vers prev="1" num="24.3"/>
        <vers num="3.0"/>
        <vers num="3.0.1"/>
        <vers num="3.0.10"/>
        <vers num="3.0.11"/>
        <vers num="3.0.2"/>
        <vers num="3.0.3"/>
        <vers num="3.0.4"/>
        <vers num="3.0.5"/>
        <vers num="3.0.6"/>
        <vers num="3.0.7"/>
        <vers num="3.0.8"/>
        <vers num="3.0.9"/>
        <vers num="3.1"/>
        <vers num="3.1.1"/>
        <vers num="3.1.10"/>
        <vers num="3.1.11"/>
        <vers num="3.1.12"/>
        <vers num="3.1.13"/>
        <vers num="3.1.14"/>
        <vers num="3.1.15"/>
        <vers num="3.1.16"/>
        <vers num="3.1.17"/>
        <vers num="3.1.2"/>
        <vers num="3.1.3"/>
        <vers num="3.1.4"/>
        <vers num="3.1.5"/>
        <vers num="3.1.6"/>
        <vers num="3.1.7"/>
        <vers num="3.1.8"/>
        <vers num="3.1.9"/>
        <vers num="5.0"/>
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers num="6.0.2"/>
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="8.0"/>
        <vers num="9.0"/>
        <vers num="9.0.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1510" published="2014-03-19" name="CVE-2014-1510" modified="2014-04-01" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to execute arbitrary JavaScript code with chrome privileges by using an IDL fragment to trigger a window.open call.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=982906" source="CONFIRM">https://bugzilla.mozilla.org/show_bug.cgi?id=982906</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2151-1" source="UBUNTU">USN-2151-1</ref>
      <ref url="http://www.mozilla.org/security/announce/2014/mfsa2014-29.html" source="CONFIRM" adv="1">http://www.mozilla.org/security/announce/2014/mfsa2014-29.html</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2881" source="DEBIAN">DSA-2881</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0316.html" source="REDHAT">RHSA-2014:0316</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0310.html" source="REDHAT">RHSA-2014:0310</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00022.html" source="SUSE">openSUSE-SU-2014:0448</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.html" source="SUSE">openSUSE-SU-2014:0419</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00016.html" source="SUSE">SUSE-SU-2014:0418</ref>
    </refs>
    <vuln_soft>
      <prod vendor="mozilla" name="firefox">
        <vers num="0.1"/>
        <vers num="0.10"/>
        <vers num="0.10.1"/>
        <vers num="0.2"/>
        <vers num="0.3"/>
        <vers num="0.4"/>
        <vers num="0.5"/>
        <vers num="0.6"/>
        <vers num="0.6.1"/>
        <vers num="0.7"/>
        <vers num="0.7.1"/>
        <vers num="0.8"/>
        <vers num="0.9" edition="rc"/>
        <vers num="0.9.1"/>
        <vers num="0.9.2"/>
        <vers num="0.9.3"/>
        <vers num="1.0" edition="preview_release"/>
        <vers num="1.0.1"/>
        <vers num="1.0.2"/>
        <vers num="1.0.3"/>
        <vers num="1.0.4"/>
        <vers num="1.0.5"/>
        <vers num="1.0.6"/>
        <vers num="1.0.7"/>
        <vers num="1.0.8"/>
        <vers num="1.5" edition="beta1"/>
        <vers num="1.5" edition="beta2"/>
        <vers num="1.5.0.1"/>
        <vers num="1.5.0.10"/>
        <vers num="1.5.0.11"/>
        <vers num="1.5.0.12"/>
        <vers num="1.5.0.2"/>
        <vers num="1.5.0.3"/>
        <vers num="1.5.0.4"/>
        <vers num="1.5.0.5"/>
        <vers num="1.5.0.6"/>
        <vers num="1.5.0.7"/>
        <vers num="1.5.0.8"/>
        <vers num="1.5.0.9"/>
        <vers num="1.5.1"/>
        <vers num="1.5.2"/>
        <vers num="1.5.3"/>
        <vers num="1.5.4"/>
        <vers num="1.5.5"/>
        <vers num="1.5.6"/>
        <vers num="1.5.7"/>
        <vers num="1.5.8"/>
        <vers num="10.0"/>
        <vers num="10.0.1"/>
        <vers num="10.0.10"/>
        <vers num="10.0.11"/>
        <vers num="10.0.12"/>
        <vers num="10.0.2"/>
        <vers num="10.0.3"/>
        <vers num="10.0.4"/>
        <vers num="10.0.5"/>
        <vers num="10.0.6"/>
        <vers num="10.0.7"/>
        <vers num="10.0.8"/>
        <vers num="10.0.9"/>
        <vers num="11.0"/>
        <vers num="12.0" edition="beta6"/>
        <vers num="13.0"/>
        <vers num="13.0.1"/>
        <vers num="14.0"/>
        <vers num="14.0.1"/>
        <vers num="15.0"/>
        <vers num="15.0.1"/>
        <vers num="16.0"/>
        <vers num="16.0.1"/>
        <vers num="16.0.2"/>
        <vers num="17.0.10"/>
        <vers num="17.0.11"/>
        <vers num="17.0.2"/>
        <vers num="17.0.3"/>
        <vers num="17.0.4"/>
        <vers num="17.0.5"/>
        <vers num="17.0.6"/>
        <vers num="17.0.7"/>
        <vers num="17.0.8"/>
        <vers num="17.0.9"/>
        <vers num="18.0"/>
        <vers num="18.0.1"/>
        <vers num="18.0.2"/>
        <vers num="19.0"/>
        <vers num="19.0.1"/>
        <vers num="19.0.2"/>
        <vers num="2.0"/>
        <vers num="2.0.0.1"/>
        <vers num="2.0.0.10"/>
        <vers num="2.0.0.11"/>
        <vers num="2.0.0.12"/>
        <vers num="2.0.0.13"/>
        <vers num="2.0.0.14"/>
        <vers num="2.0.0.15"/>
        <vers num="2.0.0.16"/>
        <vers num="2.0.0.17"/>
        <vers num="2.0.0.18"/>
        <vers num="2.0.0.19"/>
        <vers num="2.0.0.2"/>
        <vers num="2.0.0.20"/>
        <vers num="2.0.0.3"/>
        <vers num="2.0.0.4"/>
        <vers num="2.0.0.5"/>
        <vers num="2.0.0.6"/>
        <vers num="2.0.0.7"/>
        <vers num="2.0.0.8"/>
        <vers num="2.0.0.9"/>
        <vers num="20.0"/>
        <vers num="20.0.1"/>
        <vers num="21.0"/>
        <vers num="23.0"/>
        <vers num="23.0.1"/>
        <vers num="24.0"/>
        <vers num="24.1"/>
        <vers num="24.1.1"/>
        <vers num="25.0"/>
        <vers num="25.0.1"/>
        <vers num="26.0"/>
        <vers num="27.0"/>
        <vers prev="1" num="27.0.1"/>
        <vers num="3.0"/>
        <vers num="3.0.1"/>
        <vers num="3.0.10"/>
        <vers num="3.0.11"/>
        <vers num="3.0.12"/>
        <vers num="3.0.13"/>
        <vers num="3.0.14"/>
        <vers num="3.0.15"/>
        <vers num="3.0.16"/>
        <vers num="3.0.17"/>
        <vers num="3.0.18"/>
        <vers num="3.0.19"/>
        <vers num="3.0.2"/>
        <vers num="3.0.3"/>
        <vers num="3.0.4"/>
        <vers num="3.0.5"/>
        <vers num="3.0.6"/>
        <vers num="3.0.7"/>
        <vers num="3.0.8"/>
        <vers num="3.0.9"/>
        <vers num="3.5"/>
        <vers num="3.5.1"/>
        <vers num="3.5.10"/>
        <vers num="3.5.11"/>
        <vers num="3.5.12"/>
        <vers num="3.5.13"/>
        <vers num="3.5.14"/>
        <vers num="3.5.15"/>
        <vers num="3.5.16"/>
        <vers num="3.5.17"/>
        <vers num="3.5.18"/>
        <vers num="3.5.19"/>
        <vers num="3.5.2"/>
        <vers num="3.5.3"/>
        <vers num="3.5.4"/>
        <vers num="3.5.5"/>
        <vers num="3.5.6"/>
        <vers num="3.5.7"/>
        <vers num="3.5.8"/>
        <vers num="3.5.9"/>
        <vers num="3.6"/>
        <vers num="3.6.10"/>
        <vers num="3.6.11"/>
        <vers num="3.6.12"/>
        <vers num="3.6.13"/>
        <vers num="3.6.14"/>
        <vers num="3.6.15"/>
        <vers num="3.6.16"/>
        <vers num="3.6.17"/>
        <vers num="3.6.18"/>
        <vers num="3.6.19"/>
        <vers num="3.6.2"/>
        <vers num="3.6.20"/>
        <vers num="3.6.21"/>
        <vers num="3.6.22"/>
        <vers num="3.6.23"/>
        <vers num="3.6.24"/>
        <vers num="3.6.25"/>
        <vers num="3.6.26"/>
        <vers num="3.6.27"/>
        <vers num="3.6.28"/>
        <vers num="3.6.3"/>
        <vers num="3.6.4"/>
        <vers num="3.6.6"/>
        <vers num="3.6.7"/>
        <vers num="3.6.8"/>
        <vers num="3.6.9"/>
        <vers num="4.0" edition="beta1"/>
        <vers num="4.0" edition="beta10"/>
        <vers num="4.0" edition="beta11"/>
        <vers num="4.0" edition="beta12"/>
        <vers num="4.0" edition="beta2"/>
        <vers num="4.0" edition="beta3"/>
        <vers num="4.0" edition="beta4"/>
        <vers num="4.0" edition="beta5"/>
        <vers num="4.0" edition="beta6"/>
        <vers num="4.0" edition="beta7"/>
        <vers num="4.0" edition="beta8"/>
        <vers num="4.0" edition="beta9"/>
        <vers num="4.0.1"/>
        <vers num="5.0"/>
        <vers num="5.0.1"/>
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers num="6.0.2"/>
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="8.0"/>
        <vers num="8.0.1"/>
        <vers num="9.0"/>
        <vers num="9.0.1"/>
      </prod>
      <prod vendor="mozilla" name="firefox_esr">
        <vers num="24.0"/>
        <vers num="24.0.1"/>
        <vers num="24.0.2"/>
        <vers num="24.1.0"/>
        <vers num="24.1.1"/>
        <vers num="24.2"/>
        <vers num="24.3"/>
      </prod>
      <prod vendor="mozilla" name="seamonkey">
        <vers num="2.0" edition="alpha_1"/>
        <vers num="2.0" edition="alpha_2"/>
        <vers num="2.0" edition="alpha_3"/>
        <vers num="2.0" edition="beta_1"/>
        <vers num="2.0" edition="beta_2"/>
        <vers num="2.0" edition="rc1"/>
        <vers num="2.0" edition="rc2"/>
        <vers num="2.0.1"/>
        <vers num="2.0.10"/>
        <vers num="2.0.11"/>
        <vers num="2.0.12"/>
        <vers num="2.0.13"/>
        <vers num="2.0.14"/>
        <vers num="2.0.2"/>
        <vers num="2.0.3"/>
        <vers num="2.0.4"/>
        <vers num="2.0.5"/>
        <vers num="2.0.6"/>
        <vers num="2.0.7"/>
        <vers num="2.0.8"/>
        <vers num="2.0.9"/>
        <vers num="2.1" edition="alpha1"/>
        <vers num="2.1" edition="alpha2"/>
        <vers num="2.1" edition="alpha3"/>
        <vers num="2.1" edition="beta1"/>
        <vers num="2.1" edition="beta2"/>
        <vers num="2.1" edition="beta3"/>
        <vers num="2.1" edition="rc1"/>
        <vers num="2.1" edition="rc2"/>
        <vers num="2.10" edition="beta1"/>
        <vers num="2.10" edition="beta2"/>
        <vers num="2.10" edition="beta3"/>
        <vers num="2.10.1"/>
        <vers num="2.11" edition="beta1"/>
        <vers num="2.11" edition="beta2"/>
        <vers num="2.11" edition="beta3"/>
        <vers num="2.11" edition="beta4"/>
        <vers num="2.11" edition="beta5"/>
        <vers num="2.11" edition="beta6"/>
        <vers num="2.12" edition="beta1"/>
        <vers num="2.12" edition="beta2"/>
        <vers num="2.12" edition="beta3"/>
        <vers num="2.12" edition="beta4"/>
        <vers num="2.12" edition="beta5"/>
        <vers num="2.12" edition="beta6"/>
        <vers num="2.12.1"/>
        <vers num="2.13" edition="beta1"/>
        <vers num="2.13" edition="beta2"/>
        <vers num="2.13" edition="beta3"/>
        <vers num="2.13" edition="beta4"/>
        <vers num="2.13" edition="beta5"/>
        <vers num="2.13" edition="beta6"/>
        <vers num="2.13.1"/>
        <vers num="2.13.2"/>
        <vers num="2.14" edition="beta1"/>
        <vers num="2.14" edition="beta2"/>
        <vers num="2.14" edition="beta3"/>
        <vers num="2.14" edition="beta4"/>
        <vers num="2.14" edition="beta5"/>
        <vers num="2.15" edition="beta1"/>
        <vers num="2.15" edition="beta2"/>
        <vers num="2.15" edition="beta3"/>
        <vers num="2.15" edition="beta4"/>
        <vers num="2.15" edition="beta5"/>
        <vers num="2.15" edition="beta6"/>
        <vers num="2.15.1"/>
        <vers num="2.15.2"/>
        <vers num="2.16" edition="beta1"/>
        <vers num="2.16" edition="beta2"/>
        <vers num="2.16" edition="beta3"/>
        <vers num="2.16" edition="beta4"/>
        <vers num="2.16" edition="beta5"/>
        <vers num="2.16.1"/>
        <vers num="2.16.2"/>
        <vers num="2.17" edition="beta1"/>
        <vers num="2.17" edition="beta2"/>
        <vers num="2.17" edition="beta3"/>
        <vers num="2.17" edition="beta4"/>
        <vers num="2.17.1"/>
        <vers num="2.18" edition="beta1"/>
        <vers num="2.18" edition="beta2"/>
        <vers num="2.18" edition="beta3"/>
        <vers num="2.18" edition="beta4"/>
        <vers num="2.19" edition="beta1"/>
        <vers num="2.19" edition="beta2"/>
        <vers num="2.2" edition="beta1"/>
        <vers num="2.2" edition="beta2"/>
        <vers num="2.2" edition="beta3"/>
        <vers num="2.20" edition="beta1"/>
        <vers num="2.20" edition="beta2"/>
        <vers num="2.20" edition="beta3"/>
        <vers num="2.21" edition="beta1"/>
        <vers num="2.21" edition="beta2"/>
        <vers num="2.22" edition="beta1"/>
        <vers num="2.22" edition="beta2"/>
        <vers num="2.22.1"/>
        <vers num="2.23" edition="beta1"/>
        <vers num="2.23" edition="beta2"/>
        <vers num="2.24" edition="beta1"/>
        <vers prev="1" num="2.25" edition="beta1"/>
        <vers prev="1" num="2.25" edition="beta2"/>
        <vers num="2.3" edition="beta1"/>
        <vers num="2.3" edition="beta2"/>
        <vers num="2.3" edition="beta3"/>
        <vers num="2.3.1"/>
        <vers num="2.3.2"/>
        <vers num="2.3.3"/>
        <vers num="2.4" edition="beta1"/>
        <vers num="2.4" edition="beta2"/>
        <vers num="2.4" edition="beta3"/>
        <vers num="2.4.1"/>
        <vers num="2.5" edition="beta1"/>
        <vers num="2.5" edition="beta2"/>
        <vers num="2.5" edition="beta3"/>
        <vers num="2.5" edition="beta4"/>
        <vers num="2.6" edition="beta1"/>
        <vers num="2.6" edition="beta2"/>
        <vers num="2.6" edition="beta3"/>
        <vers num="2.6" edition="beta4"/>
        <vers num="2.6.1"/>
        <vers num="2.7" edition="beta1"/>
        <vers num="2.7" edition="beta2"/>
        <vers num="2.7" edition="beta3"/>
        <vers num="2.7" edition="beta4"/>
        <vers num="2.7" edition="beta5"/>
        <vers num="2.7.1"/>
        <vers num="2.7.2"/>
        <vers num="2.8" edition="beta1"/>
        <vers num="2.8" edition="beta2"/>
        <vers num="2.8" edition="beta3"/>
        <vers num="2.8" edition="beta4"/>
        <vers num="2.8" edition="beta5"/>
        <vers num="2.8" edition="beta6"/>
        <vers num="2.9" edition="beta1"/>
        <vers num="2.9" edition="beta2"/>
        <vers num="2.9" edition="beta3"/>
        <vers num="2.9" edition="beta4"/>
        <vers num="2.9.1"/>
      </prod>
      <prod vendor="mozilla" name="thunderbird">
        <vers num="0.1"/>
        <vers num="0.2"/>
        <vers num="0.3"/>
        <vers num="0.4"/>
        <vers num="0.5"/>
        <vers num="0.6"/>
        <vers num="0.7"/>
        <vers num="0.7.1"/>
        <vers num="0.7.2"/>
        <vers num="0.7.3"/>
        <vers num="0.8"/>
        <vers num="0.9"/>
        <vers num="1.0"/>
        <vers num="1.0.1"/>
        <vers num="1.0.2"/>
        <vers num="1.0.3"/>
        <vers num="1.0.4"/>
        <vers num="1.0.5" edition="beta"/>
        <vers num="1.0.6"/>
        <vers num="1.0.7"/>
        <vers num="1.0.8"/>
        <vers num="1.5" edition="beta2"/>
        <vers num="1.5.0.1"/>
        <vers num="1.5.0.10"/>
        <vers num="1.5.0.11"/>
        <vers num="1.5.0.12"/>
        <vers num="1.5.0.13"/>
        <vers num="1.5.0.14"/>
        <vers num="1.5.0.2"/>
        <vers num="1.5.0.3"/>
        <vers num="1.5.0.4"/>
        <vers num="1.5.0.5"/>
        <vers num="1.5.0.6"/>
        <vers num="1.5.0.7"/>
        <vers num="1.5.0.8"/>
        <vers num="1.5.0.9"/>
        <vers num="1.5.1"/>
        <vers num="1.5.2"/>
        <vers num="1.7.1"/>
        <vers num="1.7.3"/>
        <vers num="10.0"/>
        <vers num="10.0.1"/>
        <vers num="10.0.2"/>
        <vers num="10.0.3"/>
        <vers num="10.0.4"/>
        <vers num="11.0"/>
        <vers num="11.0.1"/>
        <vers num="12.0"/>
        <vers num="12.0.1"/>
        <vers num="13.0"/>
        <vers num="13.0.1"/>
        <vers num="14.0"/>
        <vers num="15.0"/>
        <vers num="15.0.1"/>
        <vers num="16.0"/>
        <vers num="16.0.1"/>
        <vers num="16.0.2"/>
        <vers num="17.0"/>
        <vers num="17.0.1"/>
        <vers num="17.0.2"/>
        <vers num="17.0.3"/>
        <vers num="17.0.4"/>
        <vers num="17.0.5"/>
        <vers num="17.0.6"/>
        <vers num="17.0.7"/>
        <vers num="17.0.8"/>
        <vers num="2.0"/>
        <vers num="2.0.0.0"/>
        <vers num="2.0.0.1"/>
        <vers num="2.0.0.11"/>
        <vers num="2.0.0.12"/>
        <vers num="2.0.0.13"/>
        <vers num="2.0.0.14"/>
        <vers num="2.0.0.15"/>
        <vers num="2.0.0.16"/>
        <vers num="2.0.0.17"/>
        <vers num="2.0.0.18"/>
        <vers num="2.0.0.19"/>
        <vers num="2.0.0.2"/>
        <vers num="2.0.0.20"/>
        <vers num="2.0.0.21"/>
        <vers num="2.0.0.22"/>
        <vers num="2.0.0.23"/>
        <vers num="2.0.0.3"/>
        <vers num="2.0.0.4"/>
        <vers num="2.0.0.5"/>
        <vers num="2.0.0.6"/>
        <vers num="2.0.0.7"/>
        <vers num="2.0.0.8"/>
        <vers num="2.0.0.9"/>
        <vers num="24.0"/>
        <vers num="24.0.1"/>
        <vers num="24.1"/>
        <vers num="24.1.1"/>
        <vers num="24.2"/>
        <vers prev="1" num="24.3"/>
        <vers num="3.0"/>
        <vers num="3.0.1"/>
        <vers num="3.0.10"/>
        <vers num="3.0.11"/>
        <vers num="3.0.2"/>
        <vers num="3.0.3"/>
        <vers num="3.0.4"/>
        <vers num="3.0.5"/>
        <vers num="3.0.6"/>
        <vers num="3.0.7"/>
        <vers num="3.0.8"/>
        <vers num="3.0.9"/>
        <vers num="3.1"/>
        <vers num="3.1.1"/>
        <vers num="3.1.10"/>
        <vers num="3.1.11"/>
        <vers num="3.1.12"/>
        <vers num="3.1.13"/>
        <vers num="3.1.14"/>
        <vers num="3.1.15"/>
        <vers num="3.1.16"/>
        <vers num="3.1.17"/>
        <vers num="3.1.2"/>
        <vers num="3.1.3"/>
        <vers num="3.1.4"/>
        <vers num="3.1.5"/>
        <vers num="3.1.6"/>
        <vers num="3.1.7"/>
        <vers num="3.1.8"/>
        <vers num="3.1.9"/>
        <vers num="5.0"/>
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers num="6.0.2"/>
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="8.0"/>
        <vers num="9.0"/>
        <vers num="9.0.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1511" published="2014-03-19" name="CVE-2014-1511" modified="2014-04-01" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remote attackers to bypass the popup blocker via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=982909" source="CONFIRM">https://bugzilla.mozilla.org/show_bug.cgi?id=982909</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2151-1" source="UBUNTU">USN-2151-1</ref>
      <ref url="http://www.mozilla.org/security/announce/2014/mfsa2014-29.html" source="CONFIRM" adv="1">http://www.mozilla.org/security/announce/2014/mfsa2014-29.html</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2881" source="DEBIAN">DSA-2881</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0316.html" source="REDHAT">RHSA-2014:0316</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0310.html" source="REDHAT">RHSA-2014:0310</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00022.html" source="SUSE">openSUSE-SU-2014:0448</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.html" source="SUSE">openSUSE-SU-2014:0419</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00016.html" source="SUSE">SUSE-SU-2014:0418</ref>
    </refs>
    <vuln_soft>
      <prod vendor="mozilla" name="firefox">
        <vers num="0.1"/>
        <vers num="0.10"/>
        <vers num="0.10.1"/>
        <vers num="0.2"/>
        <vers num="0.3"/>
        <vers num="0.4"/>
        <vers num="0.5"/>
        <vers num="0.6"/>
        <vers num="0.6.1"/>
        <vers num="0.7"/>
        <vers num="0.7.1"/>
        <vers num="0.8"/>
        <vers num="0.9" edition="rc"/>
        <vers num="0.9.1"/>
        <vers num="0.9.2"/>
        <vers num="0.9.3"/>
        <vers num="1.0" edition="preview_release"/>
        <vers num="1.0.1"/>
        <vers num="1.0.2"/>
        <vers num="1.0.3"/>
        <vers num="1.0.4"/>
        <vers num="1.0.5"/>
        <vers num="1.0.6"/>
        <vers num="1.0.7"/>
        <vers num="1.0.8"/>
        <vers num="1.5" edition="beta1"/>
        <vers num="1.5" edition="beta2"/>
        <vers num="1.5.0.1"/>
        <vers num="1.5.0.10"/>
        <vers num="1.5.0.11"/>
        <vers num="1.5.0.12"/>
        <vers num="1.5.0.2"/>
        <vers num="1.5.0.3"/>
        <vers num="1.5.0.4"/>
        <vers num="1.5.0.5"/>
        <vers num="1.5.0.6"/>
        <vers num="1.5.0.7"/>
        <vers num="1.5.0.8"/>
        <vers num="1.5.0.9"/>
        <vers num="1.5.1"/>
        <vers num="1.5.2"/>
        <vers num="1.5.3"/>
        <vers num="1.5.4"/>
        <vers num="1.5.5"/>
        <vers num="1.5.6"/>
        <vers num="1.5.7"/>
        <vers num="1.5.8"/>
        <vers num="10.0"/>
        <vers num="10.0.1"/>
        <vers num="10.0.10"/>
        <vers num="10.0.11"/>
        <vers num="10.0.12"/>
        <vers num="10.0.2"/>
        <vers num="10.0.3"/>
        <vers num="10.0.4"/>
        <vers num="10.0.5"/>
        <vers num="10.0.6"/>
        <vers num="10.0.7"/>
        <vers num="10.0.8"/>
        <vers num="10.0.9"/>
        <vers num="11.0"/>
        <vers num="12.0" edition="beta6"/>
        <vers num="13.0"/>
        <vers num="13.0.1"/>
        <vers num="14.0"/>
        <vers num="14.0.1"/>
        <vers num="15.0"/>
        <vers num="15.0.1"/>
        <vers num="16.0"/>
        <vers num="16.0.1"/>
        <vers num="16.0.2"/>
        <vers num="17.0.10"/>
        <vers num="17.0.11"/>
        <vers num="17.0.2"/>
        <vers num="17.0.3"/>
        <vers num="17.0.4"/>
        <vers num="17.0.5"/>
        <vers num="17.0.6"/>
        <vers num="17.0.7"/>
        <vers num="17.0.8"/>
        <vers num="17.0.9"/>
        <vers num="18.0"/>
        <vers num="18.0.1"/>
        <vers num="18.0.2"/>
        <vers num="19.0"/>
        <vers num="19.0.1"/>
        <vers num="19.0.2"/>
        <vers num="2.0"/>
        <vers num="2.0.0.1"/>
        <vers num="2.0.0.10"/>
        <vers num="2.0.0.11"/>
        <vers num="2.0.0.12"/>
        <vers num="2.0.0.13"/>
        <vers num="2.0.0.14"/>
        <vers num="2.0.0.15"/>
        <vers num="2.0.0.16"/>
        <vers num="2.0.0.17"/>
        <vers num="2.0.0.18"/>
        <vers num="2.0.0.19"/>
        <vers num="2.0.0.2"/>
        <vers num="2.0.0.20"/>
        <vers num="2.0.0.3"/>
        <vers num="2.0.0.4"/>
        <vers num="2.0.0.5"/>
        <vers num="2.0.0.6"/>
        <vers num="2.0.0.7"/>
        <vers num="2.0.0.8"/>
        <vers num="2.0.0.9"/>
        <vers num="20.0"/>
        <vers num="20.0.1"/>
        <vers num="21.0"/>
        <vers num="23.0"/>
        <vers num="23.0.1"/>
        <vers num="24.0"/>
        <vers num="24.1"/>
        <vers num="24.1.1"/>
        <vers num="25.0"/>
        <vers num="25.0.1"/>
        <vers num="26.0"/>
        <vers num="27.0"/>
        <vers prev="1" num="27.0.1"/>
        <vers num="3.0"/>
        <vers num="3.0.1"/>
        <vers num="3.0.10"/>
        <vers num="3.0.11"/>
        <vers num="3.0.12"/>
        <vers num="3.0.13"/>
        <vers num="3.0.14"/>
        <vers num="3.0.15"/>
        <vers num="3.0.16"/>
        <vers num="3.0.17"/>
        <vers num="3.0.18"/>
        <vers num="3.0.19"/>
        <vers num="3.0.2"/>
        <vers num="3.0.3"/>
        <vers num="3.0.4"/>
        <vers num="3.0.5"/>
        <vers num="3.0.6"/>
        <vers num="3.0.7"/>
        <vers num="3.0.8"/>
        <vers num="3.0.9"/>
        <vers num="3.5"/>
        <vers num="3.5.1"/>
        <vers num="3.5.10"/>
        <vers num="3.5.11"/>
        <vers num="3.5.12"/>
        <vers num="3.5.13"/>
        <vers num="3.5.14"/>
        <vers num="3.5.15"/>
        <vers num="3.5.16"/>
        <vers num="3.5.17"/>
        <vers num="3.5.18"/>
        <vers num="3.5.19"/>
        <vers num="3.5.2"/>
        <vers num="3.5.3"/>
        <vers num="3.5.4"/>
        <vers num="3.5.5"/>
        <vers num="3.5.6"/>
        <vers num="3.5.7"/>
        <vers num="3.5.8"/>
        <vers num="3.5.9"/>
        <vers num="3.6"/>
        <vers num="3.6.10"/>
        <vers num="3.6.11"/>
        <vers num="3.6.12"/>
        <vers num="3.6.13"/>
        <vers num="3.6.14"/>
        <vers num="3.6.15"/>
        <vers num="3.6.16"/>
        <vers num="3.6.17"/>
        <vers num="3.6.18"/>
        <vers num="3.6.19"/>
        <vers num="3.6.2"/>
        <vers num="3.6.20"/>
        <vers num="3.6.21"/>
        <vers num="3.6.22"/>
        <vers num="3.6.23"/>
        <vers num="3.6.24"/>
        <vers num="3.6.25"/>
        <vers num="3.6.26"/>
        <vers num="3.6.27"/>
        <vers num="3.6.28"/>
        <vers num="3.6.3"/>
        <vers num="3.6.4"/>
        <vers num="3.6.6"/>
        <vers num="3.6.7"/>
        <vers num="3.6.8"/>
        <vers num="3.6.9"/>
        <vers num="4.0" edition="beta1"/>
        <vers num="4.0" edition="beta10"/>
        <vers num="4.0" edition="beta11"/>
        <vers num="4.0" edition="beta12"/>
        <vers num="4.0" edition="beta2"/>
        <vers num="4.0" edition="beta3"/>
        <vers num="4.0" edition="beta4"/>
        <vers num="4.0" edition="beta5"/>
        <vers num="4.0" edition="beta6"/>
        <vers num="4.0" edition="beta7"/>
        <vers num="4.0" edition="beta8"/>
        <vers num="4.0" edition="beta9"/>
        <vers num="4.0.1"/>
        <vers num="5.0"/>
        <vers num="5.0.1"/>
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers num="6.0.2"/>
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="8.0"/>
        <vers num="8.0.1"/>
        <vers num="9.0"/>
        <vers num="9.0.1"/>
      </prod>
      <prod vendor="mozilla" name="firefox_esr">
        <vers num="24.0"/>
        <vers num="24.0.1"/>
        <vers num="24.0.2"/>
        <vers num="24.1.0"/>
        <vers num="24.1.1"/>
        <vers num="24.2"/>
        <vers num="24.3"/>
      </prod>
      <prod vendor="mozilla" name="seamonkey">
        <vers num="2.0" edition="alpha_1"/>
        <vers num="2.0" edition="alpha_2"/>
        <vers num="2.0" edition="alpha_3"/>
        <vers num="2.0" edition="beta_1"/>
        <vers num="2.0" edition="beta_2"/>
        <vers num="2.0" edition="rc1"/>
        <vers num="2.0" edition="rc2"/>
        <vers num="2.0.1"/>
        <vers num="2.0.10"/>
        <vers num="2.0.11"/>
        <vers num="2.0.12"/>
        <vers num="2.0.13"/>
        <vers num="2.0.14"/>
        <vers num="2.0.2"/>
        <vers num="2.0.3"/>
        <vers num="2.0.4"/>
        <vers num="2.0.5"/>
        <vers num="2.0.6"/>
        <vers num="2.0.7"/>
        <vers num="2.0.8"/>
        <vers num="2.0.9"/>
        <vers num="2.1" edition="alpha1"/>
        <vers num="2.1" edition="alpha2"/>
        <vers num="2.1" edition="alpha3"/>
        <vers num="2.1" edition="beta1"/>
        <vers num="2.1" edition="beta2"/>
        <vers num="2.1" edition="beta3"/>
        <vers num="2.1" edition="rc1"/>
        <vers num="2.1" edition="rc2"/>
        <vers num="2.10" edition="beta1"/>
        <vers num="2.10" edition="beta2"/>
        <vers num="2.10" edition="beta3"/>
        <vers num="2.10.1"/>
        <vers num="2.11" edition="beta1"/>
        <vers num="2.11" edition="beta2"/>
        <vers num="2.11" edition="beta3"/>
        <vers num="2.11" edition="beta4"/>
        <vers num="2.11" edition="beta5"/>
        <vers num="2.11" edition="beta6"/>
        <vers num="2.12" edition="beta1"/>
        <vers num="2.12" edition="beta2"/>
        <vers num="2.12" edition="beta3"/>
        <vers num="2.12" edition="beta4"/>
        <vers num="2.12" edition="beta5"/>
        <vers num="2.12" edition="beta6"/>
        <vers num="2.12.1"/>
        <vers num="2.13" edition="beta1"/>
        <vers num="2.13" edition="beta2"/>
        <vers num="2.13" edition="beta3"/>
        <vers num="2.13" edition="beta4"/>
        <vers num="2.13" edition="beta5"/>
        <vers num="2.13" edition="beta6"/>
        <vers num="2.13.1"/>
        <vers num="2.13.2"/>
        <vers num="2.14" edition="beta1"/>
        <vers num="2.14" edition="beta2"/>
        <vers num="2.14" edition="beta3"/>
        <vers num="2.14" edition="beta4"/>
        <vers num="2.14" edition="beta5"/>
        <vers num="2.15" edition="beta1"/>
        <vers num="2.15" edition="beta2"/>
        <vers num="2.15" edition="beta3"/>
        <vers num="2.15" edition="beta4"/>
        <vers num="2.15" edition="beta5"/>
        <vers num="2.15" edition="beta6"/>
        <vers num="2.15.1"/>
        <vers num="2.15.2"/>
        <vers num="2.16" edition="beta1"/>
        <vers num="2.16" edition="beta2"/>
        <vers num="2.16" edition="beta3"/>
        <vers num="2.16" edition="beta4"/>
        <vers num="2.16" edition="beta5"/>
        <vers num="2.16.1"/>
        <vers num="2.16.2"/>
        <vers num="2.17" edition="beta1"/>
        <vers num="2.17" edition="beta2"/>
        <vers num="2.17" edition="beta3"/>
        <vers num="2.17" edition="beta4"/>
        <vers num="2.17.1"/>
        <vers num="2.18" edition="beta1"/>
        <vers num="2.18" edition="beta2"/>
        <vers num="2.18" edition="beta3"/>
        <vers num="2.18" edition="beta4"/>
        <vers num="2.19" edition="beta1"/>
        <vers num="2.19" edition="beta2"/>
        <vers num="2.2" edition="beta1"/>
        <vers num="2.2" edition="beta2"/>
        <vers num="2.2" edition="beta3"/>
        <vers num="2.20" edition="beta1"/>
        <vers num="2.20" edition="beta2"/>
        <vers num="2.20" edition="beta3"/>
        <vers num="2.21" edition="beta1"/>
        <vers num="2.21" edition="beta2"/>
        <vers num="2.22" edition="beta1"/>
        <vers num="2.22" edition="beta2"/>
        <vers num="2.22.1"/>
        <vers num="2.23" edition="beta1"/>
        <vers num="2.23" edition="beta2"/>
        <vers num="2.24" edition="beta1"/>
        <vers prev="1" num="2.25" edition="beta1"/>
        <vers prev="1" num="2.25" edition="beta2"/>
        <vers num="2.3" edition="beta1"/>
        <vers num="2.3" edition="beta2"/>
        <vers num="2.3" edition="beta3"/>
        <vers num="2.3.1"/>
        <vers num="2.3.2"/>
        <vers num="2.3.3"/>
        <vers num="2.4" edition="beta1"/>
        <vers num="2.4" edition="beta2"/>
        <vers num="2.4" edition="beta3"/>
        <vers num="2.4.1"/>
        <vers num="2.5" edition="beta1"/>
        <vers num="2.5" edition="beta2"/>
        <vers num="2.5" edition="beta3"/>
        <vers num="2.5" edition="beta4"/>
        <vers num="2.6" edition="beta1"/>
        <vers num="2.6" edition="beta2"/>
        <vers num="2.6" edition="beta3"/>
        <vers num="2.6" edition="beta4"/>
        <vers num="2.6.1"/>
        <vers num="2.7" edition="beta1"/>
        <vers num="2.7" edition="beta2"/>
        <vers num="2.7" edition="beta3"/>
        <vers num="2.7" edition="beta4"/>
        <vers num="2.7" edition="beta5"/>
        <vers num="2.7.1"/>
        <vers num="2.7.2"/>
        <vers num="2.8" edition="beta1"/>
        <vers num="2.8" edition="beta2"/>
        <vers num="2.8" edition="beta3"/>
        <vers num="2.8" edition="beta4"/>
        <vers num="2.8" edition="beta5"/>
        <vers num="2.8" edition="beta6"/>
        <vers num="2.9" edition="beta1"/>
        <vers num="2.9" edition="beta2"/>
        <vers num="2.9" edition="beta3"/>
        <vers num="2.9" edition="beta4"/>
        <vers num="2.9.1"/>
      </prod>
      <prod vendor="mozilla" name="thunderbird">
        <vers num="0.1"/>
        <vers num="0.2"/>
        <vers num="0.3"/>
        <vers num="0.4"/>
        <vers num="0.5"/>
        <vers num="0.6"/>
        <vers num="0.7"/>
        <vers num="0.7.1"/>
        <vers num="0.7.2"/>
        <vers num="0.7.3"/>
        <vers num="0.8"/>
        <vers num="0.9"/>
        <vers num="1.0"/>
        <vers num="1.0.1"/>
        <vers num="1.0.2"/>
        <vers num="1.0.3"/>
        <vers num="1.0.4"/>
        <vers num="1.0.5" edition="beta"/>
        <vers num="1.0.6"/>
        <vers num="1.0.7"/>
        <vers num="1.0.8"/>
        <vers num="1.5" edition="beta2"/>
        <vers num="1.5.0.1"/>
        <vers num="1.5.0.10"/>
        <vers num="1.5.0.11"/>
        <vers num="1.5.0.12"/>
        <vers num="1.5.0.13"/>
        <vers num="1.5.0.14"/>
        <vers num="1.5.0.2"/>
        <vers num="1.5.0.3"/>
        <vers num="1.5.0.4"/>
        <vers num="1.5.0.5"/>
        <vers num="1.5.0.6"/>
        <vers num="1.5.0.7"/>
        <vers num="1.5.0.8"/>
        <vers num="1.5.0.9"/>
        <vers num="1.5.1"/>
        <vers num="1.5.2"/>
        <vers num="1.7.1"/>
        <vers num="1.7.3"/>
        <vers num="10.0"/>
        <vers num="10.0.1"/>
        <vers num="10.0.2"/>
        <vers num="10.0.3"/>
        <vers num="10.0.4"/>
        <vers num="11.0"/>
        <vers num="11.0.1"/>
        <vers num="12.0"/>
        <vers num="12.0.1"/>
        <vers num="13.0"/>
        <vers num="13.0.1"/>
        <vers num="14.0"/>
        <vers num="15.0"/>
        <vers num="15.0.1"/>
        <vers num="16.0"/>
        <vers num="16.0.1"/>
        <vers num="16.0.2"/>
        <vers num="17.0"/>
        <vers num="17.0.1"/>
        <vers num="17.0.2"/>
        <vers num="17.0.3"/>
        <vers num="17.0.4"/>
        <vers num="17.0.5"/>
        <vers num="17.0.6"/>
        <vers num="17.0.7"/>
        <vers num="17.0.8"/>
        <vers num="2.0"/>
        <vers num="2.0.0.0"/>
        <vers num="2.0.0.1"/>
        <vers num="2.0.0.11"/>
        <vers num="2.0.0.12"/>
        <vers num="2.0.0.13"/>
        <vers num="2.0.0.14"/>
        <vers num="2.0.0.15"/>
        <vers num="2.0.0.16"/>
        <vers num="2.0.0.17"/>
        <vers num="2.0.0.18"/>
        <vers num="2.0.0.19"/>
        <vers num="2.0.0.2"/>
        <vers num="2.0.0.20"/>
        <vers num="2.0.0.21"/>
        <vers num="2.0.0.22"/>
        <vers num="2.0.0.23"/>
        <vers num="2.0.0.3"/>
        <vers num="2.0.0.4"/>
        <vers num="2.0.0.5"/>
        <vers num="2.0.0.6"/>
        <vers num="2.0.0.7"/>
        <vers num="2.0.0.8"/>
        <vers num="2.0.0.9"/>
        <vers num="24.0"/>
        <vers num="24.0.1"/>
        <vers num="24.1"/>
        <vers num="24.1.1"/>
        <vers num="24.2"/>
        <vers prev="1" num="24.3"/>
        <vers num="3.0"/>
        <vers num="3.0.1"/>
        <vers num="3.0.10"/>
        <vers num="3.0.11"/>
        <vers num="3.0.2"/>
        <vers num="3.0.3"/>
        <vers num="3.0.4"/>
        <vers num="3.0.5"/>
        <vers num="3.0.6"/>
        <vers num="3.0.7"/>
        <vers num="3.0.8"/>
        <vers num="3.0.9"/>
        <vers num="3.1"/>
        <vers num="3.1.1"/>
        <vers num="3.1.10"/>
        <vers num="3.1.11"/>
        <vers num="3.1.12"/>
        <vers num="3.1.13"/>
        <vers num="3.1.14"/>
        <vers num="3.1.15"/>
        <vers num="3.1.16"/>
        <vers num="3.1.17"/>
        <vers num="3.1.2"/>
        <vers num="3.1.3"/>
        <vers num="3.1.4"/>
        <vers num="3.1.5"/>
        <vers num="3.1.6"/>
        <vers num="3.1.7"/>
        <vers num="3.1.8"/>
        <vers num="3.1.9"/>
        <vers num="5.0"/>
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers num="6.0.2"/>
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="8.0"/>
        <vers num="9.0"/>
        <vers num="9.0.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1512" published="2014-03-19" name="CVE-2014-1512" modified="2014-04-01" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">Use-after-free vulnerability in the TypeObject class in the JavaScript engine in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to execute arbitrary code by triggering extensive memory consumption while garbage collection is occurring, as demonstrated by improper handling of BumpChunk objects.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=982957" source="CONFIRM">https://bugzilla.mozilla.org/show_bug.cgi?id=982957</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2151-1" source="UBUNTU">USN-2151-1</ref>
      <ref url="http://www.mozilla.org/security/announce/2014/mfsa2014-30.html" source="CONFIRM" adv="1">http://www.mozilla.org/security/announce/2014/mfsa2014-30.html</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2881" source="DEBIAN">DSA-2881</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0316.html" source="REDHAT">RHSA-2014:0316</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0310.html" source="REDHAT">RHSA-2014:0310</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00022.html" source="SUSE">openSUSE-SU-2014:0448</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.html" source="SUSE">openSUSE-SU-2014:0419</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00016.html" source="SUSE">SUSE-SU-2014:0418</ref>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-03/0145.html" source="BUGTRAQ">20140326 VUPEN Security Research - Mozilla Firefox "BumpChunk" Object Processing Use-after-free (Pwn2Own)</ref>
    </refs>
    <vuln_soft>
      <prod vendor="mozilla" name="firefox">
        <vers num="0.1"/>
        <vers num="0.10"/>
        <vers num="0.10.1"/>
        <vers num="0.2"/>
        <vers num="0.3"/>
        <vers num="0.4"/>
        <vers num="0.5"/>
        <vers num="0.6"/>
        <vers num="0.6.1"/>
        <vers num="0.7"/>
        <vers num="0.7.1"/>
        <vers num="0.8"/>
        <vers num="0.9" edition="rc"/>
        <vers num="0.9.1"/>
        <vers num="0.9.2"/>
        <vers num="0.9.3"/>
        <vers num="1.0" edition="preview_release"/>
        <vers num="1.0.1"/>
        <vers num="1.0.2"/>
        <vers num="1.0.3"/>
        <vers num="1.0.4"/>
        <vers num="1.0.5"/>
        <vers num="1.0.6"/>
        <vers num="1.0.7"/>
        <vers num="1.0.8"/>
        <vers num="1.5" edition="beta1"/>
        <vers num="1.5" edition="beta2"/>
        <vers num="1.5.0.1"/>
        <vers num="1.5.0.10"/>
        <vers num="1.5.0.11"/>
        <vers num="1.5.0.12"/>
        <vers num="1.5.0.2"/>
        <vers num="1.5.0.3"/>
        <vers num="1.5.0.4"/>
        <vers num="1.5.0.5"/>
        <vers num="1.5.0.6"/>
        <vers num="1.5.0.7"/>
        <vers num="1.5.0.8"/>
        <vers num="1.5.0.9"/>
        <vers num="1.5.1"/>
        <vers num="1.5.2"/>
        <vers num="1.5.3"/>
        <vers num="1.5.4"/>
        <vers num="1.5.5"/>
        <vers num="1.5.6"/>
        <vers num="1.5.7"/>
        <vers num="1.5.8"/>
        <vers num="10.0"/>
        <vers num="10.0.1"/>
        <vers num="10.0.10"/>
        <vers num="10.0.11"/>
        <vers num="10.0.12"/>
        <vers num="10.0.2"/>
        <vers num="10.0.3"/>
        <vers num="10.0.4"/>
        <vers num="10.0.5"/>
        <vers num="10.0.6"/>
        <vers num="10.0.7"/>
        <vers num="10.0.8"/>
        <vers num="10.0.9"/>
        <vers num="11.0"/>
        <vers num="12.0" edition="beta6"/>
        <vers num="13.0"/>
        <vers num="13.0.1"/>
        <vers num="14.0"/>
        <vers num="14.0.1"/>
        <vers num="15.0"/>
        <vers num="15.0.1"/>
        <vers num="16.0"/>
        <vers num="16.0.1"/>
        <vers num="16.0.2"/>
        <vers num="17.0.10"/>
        <vers num="17.0.11"/>
        <vers num="17.0.2"/>
        <vers num="17.0.3"/>
        <vers num="17.0.4"/>
        <vers num="17.0.5"/>
        <vers num="17.0.6"/>
        <vers num="17.0.7"/>
        <vers num="17.0.8"/>
        <vers num="17.0.9"/>
        <vers num="18.0"/>
        <vers num="18.0.1"/>
        <vers num="18.0.2"/>
        <vers num="19.0"/>
        <vers num="19.0.1"/>
        <vers num="19.0.2"/>
        <vers num="2.0"/>
        <vers num="2.0.0.1"/>
        <vers num="2.0.0.10"/>
        <vers num="2.0.0.11"/>
        <vers num="2.0.0.12"/>
        <vers num="2.0.0.13"/>
        <vers num="2.0.0.14"/>
        <vers num="2.0.0.15"/>
        <vers num="2.0.0.16"/>
        <vers num="2.0.0.17"/>
        <vers num="2.0.0.18"/>
        <vers num="2.0.0.19"/>
        <vers num="2.0.0.2"/>
        <vers num="2.0.0.20"/>
        <vers num="2.0.0.3"/>
        <vers num="2.0.0.4"/>
        <vers num="2.0.0.5"/>
        <vers num="2.0.0.6"/>
        <vers num="2.0.0.7"/>
        <vers num="2.0.0.8"/>
        <vers num="2.0.0.9"/>
        <vers num="20.0"/>
        <vers num="20.0.1"/>
        <vers num="21.0"/>
        <vers num="23.0"/>
        <vers num="23.0.1"/>
        <vers num="24.0"/>
        <vers num="24.1"/>
        <vers num="24.1.1"/>
        <vers num="25.0"/>
        <vers num="25.0.1"/>
        <vers num="26.0"/>
        <vers num="27.0"/>
        <vers prev="1" num="27.0.1"/>
        <vers num="3.0"/>
        <vers num="3.0.1"/>
        <vers num="3.0.10"/>
        <vers num="3.0.11"/>
        <vers num="3.0.12"/>
        <vers num="3.0.13"/>
        <vers num="3.0.14"/>
        <vers num="3.0.15"/>
        <vers num="3.0.16"/>
        <vers num="3.0.17"/>
        <vers num="3.0.18"/>
        <vers num="3.0.19"/>
        <vers num="3.0.2"/>
        <vers num="3.0.3"/>
        <vers num="3.0.4"/>
        <vers num="3.0.5"/>
        <vers num="3.0.6"/>
        <vers num="3.0.7"/>
        <vers num="3.0.8"/>
        <vers num="3.0.9"/>
        <vers num="3.5"/>
        <vers num="3.5.1"/>
        <vers num="3.5.10"/>
        <vers num="3.5.11"/>
        <vers num="3.5.12"/>
        <vers num="3.5.13"/>
        <vers num="3.5.14"/>
        <vers num="3.5.15"/>
        <vers num="3.5.16"/>
        <vers num="3.5.17"/>
        <vers num="3.5.18"/>
        <vers num="3.5.19"/>
        <vers num="3.5.2"/>
        <vers num="3.5.3"/>
        <vers num="3.5.4"/>
        <vers num="3.5.5"/>
        <vers num="3.5.6"/>
        <vers num="3.5.7"/>
        <vers num="3.5.8"/>
        <vers num="3.5.9"/>
        <vers num="3.6"/>
        <vers num="3.6.10"/>
        <vers num="3.6.11"/>
        <vers num="3.6.12"/>
        <vers num="3.6.13"/>
        <vers num="3.6.14"/>
        <vers num="3.6.15"/>
        <vers num="3.6.16"/>
        <vers num="3.6.17"/>
        <vers num="3.6.18"/>
        <vers num="3.6.19"/>
        <vers num="3.6.2"/>
        <vers num="3.6.20"/>
        <vers num="3.6.21"/>
        <vers num="3.6.22"/>
        <vers num="3.6.23"/>
        <vers num="3.6.24"/>
        <vers num="3.6.25"/>
        <vers num="3.6.26"/>
        <vers num="3.6.27"/>
        <vers num="3.6.28"/>
        <vers num="3.6.3"/>
        <vers num="3.6.4"/>
        <vers num="3.6.6"/>
        <vers num="3.6.7"/>
        <vers num="3.6.8"/>
        <vers num="3.6.9"/>
        <vers num="4.0" edition="beta1"/>
        <vers num="4.0" edition="beta10"/>
        <vers num="4.0" edition="beta11"/>
        <vers num="4.0" edition="beta12"/>
        <vers num="4.0" edition="beta2"/>
        <vers num="4.0" edition="beta3"/>
        <vers num="4.0" edition="beta4"/>
        <vers num="4.0" edition="beta5"/>
        <vers num="4.0" edition="beta6"/>
        <vers num="4.0" edition="beta7"/>
        <vers num="4.0" edition="beta8"/>
        <vers num="4.0" edition="beta9"/>
        <vers num="4.0.1"/>
        <vers num="5.0"/>
        <vers num="5.0.1"/>
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers num="6.0.2"/>
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="8.0"/>
        <vers num="8.0.1"/>
        <vers num="9.0"/>
        <vers num="9.0.1"/>
      </prod>
      <prod vendor="mozilla" name="firefox_esr">
        <vers num="24.0"/>
        <vers num="24.0.1"/>
        <vers num="24.0.2"/>
        <vers num="24.1.0"/>
        <vers num="24.1.1"/>
        <vers num="24.2"/>
        <vers num="24.3"/>
      </prod>
      <prod vendor="mozilla" name="seamonkey">
        <vers num="2.0" edition="alpha_1"/>
        <vers num="2.0" edition="alpha_2"/>
        <vers num="2.0" edition="alpha_3"/>
        <vers num="2.0" edition="beta_1"/>
        <vers num="2.0" edition="beta_2"/>
        <vers num="2.0" edition="rc1"/>
        <vers num="2.0" edition="rc2"/>
        <vers num="2.0.1"/>
        <vers num="2.0.10"/>
        <vers num="2.0.11"/>
        <vers num="2.0.12"/>
        <vers num="2.0.13"/>
        <vers num="2.0.14"/>
        <vers num="2.0.2"/>
        <vers num="2.0.3"/>
        <vers num="2.0.4"/>
        <vers num="2.0.5"/>
        <vers num="2.0.6"/>
        <vers num="2.0.7"/>
        <vers num="2.0.8"/>
        <vers num="2.0.9"/>
        <vers num="2.1" edition="alpha1"/>
        <vers num="2.1" edition="alpha2"/>
        <vers num="2.1" edition="alpha3"/>
        <vers num="2.1" edition="beta1"/>
        <vers num="2.1" edition="beta2"/>
        <vers num="2.1" edition="beta3"/>
        <vers num="2.1" edition="rc1"/>
        <vers num="2.1" edition="rc2"/>
        <vers num="2.10" edition="beta1"/>
        <vers num="2.10" edition="beta2"/>
        <vers num="2.10" edition="beta3"/>
        <vers num="2.10.1"/>
        <vers num="2.11" edition="beta1"/>
        <vers num="2.11" edition="beta2"/>
        <vers num="2.11" edition="beta3"/>
        <vers num="2.11" edition="beta4"/>
        <vers num="2.11" edition="beta5"/>
        <vers num="2.11" edition="beta6"/>
        <vers num="2.12" edition="beta1"/>
        <vers num="2.12" edition="beta2"/>
        <vers num="2.12" edition="beta3"/>
        <vers num="2.12" edition="beta4"/>
        <vers num="2.12" edition="beta5"/>
        <vers num="2.12" edition="beta6"/>
        <vers num="2.12.1"/>
        <vers num="2.13" edition="beta1"/>
        <vers num="2.13" edition="beta2"/>
        <vers num="2.13" edition="beta3"/>
        <vers num="2.13" edition="beta4"/>
        <vers num="2.13" edition="beta5"/>
        <vers num="2.13" edition="beta6"/>
        <vers num="2.13.1"/>
        <vers num="2.13.2"/>
        <vers num="2.14" edition="beta1"/>
        <vers num="2.14" edition="beta2"/>
        <vers num="2.14" edition="beta3"/>
        <vers num="2.14" edition="beta4"/>
        <vers num="2.14" edition="beta5"/>
        <vers num="2.15" edition="beta1"/>
        <vers num="2.15" edition="beta2"/>
        <vers num="2.15" edition="beta3"/>
        <vers num="2.15" edition="beta4"/>
        <vers num="2.15" edition="beta5"/>
        <vers num="2.15" edition="beta6"/>
        <vers num="2.15.1"/>
        <vers num="2.15.2"/>
        <vers num="2.16" edition="beta1"/>
        <vers num="2.16" edition="beta2"/>
        <vers num="2.16" edition="beta3"/>
        <vers num="2.16" edition="beta4"/>
        <vers num="2.16" edition="beta5"/>
        <vers num="2.16.1"/>
        <vers num="2.16.2"/>
        <vers num="2.17" edition="beta1"/>
        <vers num="2.17" edition="beta2"/>
        <vers num="2.17" edition="beta3"/>
        <vers num="2.17" edition="beta4"/>
        <vers num="2.17.1"/>
        <vers num="2.18" edition="beta1"/>
        <vers num="2.18" edition="beta2"/>
        <vers num="2.18" edition="beta3"/>
        <vers num="2.18" edition="beta4"/>
        <vers num="2.19" edition="beta1"/>
        <vers num="2.19" edition="beta2"/>
        <vers num="2.2" edition="beta1"/>
        <vers num="2.2" edition="beta2"/>
        <vers num="2.2" edition="beta3"/>
        <vers num="2.20" edition="beta1"/>
        <vers num="2.20" edition="beta2"/>
        <vers num="2.20" edition="beta3"/>
        <vers num="2.21" edition="beta1"/>
        <vers num="2.21" edition="beta2"/>
        <vers num="2.22" edition="beta1"/>
        <vers num="2.22" edition="beta2"/>
        <vers num="2.22.1"/>
        <vers num="2.23" edition="beta1"/>
        <vers num="2.23" edition="beta2"/>
        <vers num="2.24" edition="beta1"/>
        <vers prev="1" num="2.25" edition="beta1"/>
        <vers prev="1" num="2.25" edition="beta2"/>
        <vers num="2.3" edition="beta1"/>
        <vers num="2.3" edition="beta2"/>
        <vers num="2.3" edition="beta3"/>
        <vers num="2.3.1"/>
        <vers num="2.3.2"/>
        <vers num="2.3.3"/>
        <vers num="2.4" edition="beta1"/>
        <vers num="2.4" edition="beta2"/>
        <vers num="2.4" edition="beta3"/>
        <vers num="2.4.1"/>
        <vers num="2.5" edition="beta1"/>
        <vers num="2.5" edition="beta2"/>
        <vers num="2.5" edition="beta3"/>
        <vers num="2.5" edition="beta4"/>
        <vers num="2.6" edition="beta1"/>
        <vers num="2.6" edition="beta2"/>
        <vers num="2.6" edition="beta3"/>
        <vers num="2.6" edition="beta4"/>
        <vers num="2.6.1"/>
        <vers num="2.7" edition="beta1"/>
        <vers num="2.7" edition="beta2"/>
        <vers num="2.7" edition="beta3"/>
        <vers num="2.7" edition="beta4"/>
        <vers num="2.7" edition="beta5"/>
        <vers num="2.7.1"/>
        <vers num="2.7.2"/>
        <vers num="2.8" edition="beta1"/>
        <vers num="2.8" edition="beta2"/>
        <vers num="2.8" edition="beta3"/>
        <vers num="2.8" edition="beta4"/>
        <vers num="2.8" edition="beta5"/>
        <vers num="2.8" edition="beta6"/>
        <vers num="2.9" edition="beta1"/>
        <vers num="2.9" edition="beta2"/>
        <vers num="2.9" edition="beta3"/>
        <vers num="2.9" edition="beta4"/>
        <vers num="2.9.1"/>
      </prod>
      <prod vendor="mozilla" name="thunderbird">
        <vers num="0.1"/>
        <vers num="0.2"/>
        <vers num="0.3"/>
        <vers num="0.4"/>
        <vers num="0.5"/>
        <vers num="0.6"/>
        <vers num="0.7"/>
        <vers num="0.7.1"/>
        <vers num="0.7.2"/>
        <vers num="0.7.3"/>
        <vers num="0.8"/>
        <vers num="0.9"/>
        <vers num="1.0"/>
        <vers num="1.0.1"/>
        <vers num="1.0.2"/>
        <vers num="1.0.3"/>
        <vers num="1.0.4"/>
        <vers num="1.0.5" edition="beta"/>
        <vers num="1.0.6"/>
        <vers num="1.0.7"/>
        <vers num="1.0.8"/>
        <vers num="1.5" edition="beta2"/>
        <vers num="1.5.0.1"/>
        <vers num="1.5.0.10"/>
        <vers num="1.5.0.11"/>
        <vers num="1.5.0.12"/>
        <vers num="1.5.0.13"/>
        <vers num="1.5.0.14"/>
        <vers num="1.5.0.2"/>
        <vers num="1.5.0.3"/>
        <vers num="1.5.0.4"/>
        <vers num="1.5.0.5"/>
        <vers num="1.5.0.6"/>
        <vers num="1.5.0.7"/>
        <vers num="1.5.0.8"/>
        <vers num="1.5.0.9"/>
        <vers num="1.5.1"/>
        <vers num="1.5.2"/>
        <vers num="1.7.1"/>
        <vers num="1.7.3"/>
        <vers num="10.0"/>
        <vers num="10.0.1"/>
        <vers num="10.0.2"/>
        <vers num="10.0.3"/>
        <vers num="10.0.4"/>
        <vers num="11.0"/>
        <vers num="11.0.1"/>
        <vers num="12.0"/>
        <vers num="12.0.1"/>
        <vers num="13.0"/>
        <vers num="13.0.1"/>
        <vers num="14.0"/>
        <vers num="15.0"/>
        <vers num="15.0.1"/>
        <vers num="16.0"/>
        <vers num="16.0.1"/>
        <vers num="16.0.2"/>
        <vers num="17.0"/>
        <vers num="17.0.1"/>
        <vers num="17.0.2"/>
        <vers num="17.0.3"/>
        <vers num="17.0.4"/>
        <vers num="17.0.5"/>
        <vers num="17.0.6"/>
        <vers num="17.0.7"/>
        <vers num="17.0.8"/>
        <vers num="2.0"/>
        <vers num="2.0.0.0"/>
        <vers num="2.0.0.1"/>
        <vers num="2.0.0.11"/>
        <vers num="2.0.0.12"/>
        <vers num="2.0.0.13"/>
        <vers num="2.0.0.14"/>
        <vers num="2.0.0.15"/>
        <vers num="2.0.0.16"/>
        <vers num="2.0.0.17"/>
        <vers num="2.0.0.18"/>
        <vers num="2.0.0.19"/>
        <vers num="2.0.0.2"/>
        <vers num="2.0.0.20"/>
        <vers num="2.0.0.21"/>
        <vers num="2.0.0.22"/>
        <vers num="2.0.0.23"/>
        <vers num="2.0.0.3"/>
        <vers num="2.0.0.4"/>
        <vers num="2.0.0.5"/>
        <vers num="2.0.0.6"/>
        <vers num="2.0.0.7"/>
        <vers num="2.0.0.8"/>
        <vers num="2.0.0.9"/>
        <vers num="24.0"/>
        <vers num="24.0.1"/>
        <vers num="24.1"/>
        <vers num="24.1.1"/>
        <vers num="24.2"/>
        <vers prev="1" num="24.3"/>
        <vers num="3.0"/>
        <vers num="3.0.1"/>
        <vers num="3.0.10"/>
        <vers num="3.0.11"/>
        <vers num="3.0.2"/>
        <vers num="3.0.3"/>
        <vers num="3.0.4"/>
        <vers num="3.0.5"/>
        <vers num="3.0.6"/>
        <vers num="3.0.7"/>
        <vers num="3.0.8"/>
        <vers num="3.0.9"/>
        <vers num="3.1"/>
        <vers num="3.1.1"/>
        <vers num="3.1.10"/>
        <vers num="3.1.11"/>
        <vers num="3.1.12"/>
        <vers num="3.1.13"/>
        <vers num="3.1.14"/>
        <vers num="3.1.15"/>
        <vers num="3.1.16"/>
        <vers num="3.1.17"/>
        <vers num="3.1.2"/>
        <vers num="3.1.3"/>
        <vers num="3.1.4"/>
        <vers num="3.1.5"/>
        <vers num="3.1.6"/>
        <vers num="3.1.7"/>
        <vers num="3.1.8"/>
        <vers num="3.1.9"/>
        <vers num="5.0"/>
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers num="6.0.2"/>
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="8.0"/>
        <vers num="9.0"/>
        <vers num="9.0.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1513" published="2014-03-19" name="CVE-2014-1513" modified="2014-04-01" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">TypedArrayObject.cpp in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 does not prevent a zero-length transition during use of an ArrayBuffer object, which allows remote attackers to execute arbitrary code or cause a denial of service (heap-based out-of-bounds write or read) via a crafted web site.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=982974" source="CONFIRM">https://bugzilla.mozilla.org/show_bug.cgi?id=982974</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2151-1" source="UBUNTU">USN-2151-1</ref>
      <ref url="http://www.mozilla.org/security/announce/2014/mfsa2014-31.html" source="CONFIRM" adv="1">http://www.mozilla.org/security/announce/2014/mfsa2014-31.html</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2881" source="DEBIAN">DSA-2881</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0316.html" source="REDHAT">RHSA-2014:0316</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0310.html" source="REDHAT">RHSA-2014:0310</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00022.html" source="SUSE">openSUSE-SU-2014:0448</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.html" source="SUSE">openSUSE-SU-2014:0419</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00016.html" source="SUSE">SUSE-SU-2014:0418</ref>
    </refs>
    <vuln_soft>
      <prod vendor="mozilla" name="firefox">
        <vers num="0.1"/>
        <vers num="0.10"/>
        <vers num="0.10.1"/>
        <vers num="0.2"/>
        <vers num="0.3"/>
        <vers num="0.4"/>
        <vers num="0.5"/>
        <vers num="0.6"/>
        <vers num="0.6.1"/>
        <vers num="0.7"/>
        <vers num="0.7.1"/>
        <vers num="0.8"/>
        <vers num="0.9" edition="rc"/>
        <vers num="0.9.1"/>
        <vers num="0.9.2"/>
        <vers num="0.9.3"/>
        <vers num="1.0" edition="preview_release"/>
        <vers num="1.0.1"/>
        <vers num="1.0.2"/>
        <vers num="1.0.3"/>
        <vers num="1.0.4"/>
        <vers num="1.0.5"/>
        <vers num="1.0.6"/>
        <vers num="1.0.7"/>
        <vers num="1.0.8"/>
        <vers num="1.5" edition="beta1"/>
        <vers num="1.5" edition="beta2"/>
        <vers num="1.5.0.1"/>
        <vers num="1.5.0.10"/>
        <vers num="1.5.0.11"/>
        <vers num="1.5.0.12"/>
        <vers num="1.5.0.2"/>
        <vers num="1.5.0.3"/>
        <vers num="1.5.0.4"/>
        <vers num="1.5.0.5"/>
        <vers num="1.5.0.6"/>
        <vers num="1.5.0.7"/>
        <vers num="1.5.0.8"/>
        <vers num="1.5.0.9"/>
        <vers num="1.5.1"/>
        <vers num="1.5.2"/>
        <vers num="1.5.3"/>
        <vers num="1.5.4"/>
        <vers num="1.5.5"/>
        <vers num="1.5.6"/>
        <vers num="1.5.7"/>
        <vers num="1.5.8"/>
        <vers num="10.0"/>
        <vers num="10.0.1"/>
        <vers num="10.0.10"/>
        <vers num="10.0.11"/>
        <vers num="10.0.12"/>
        <vers num="10.0.2"/>
        <vers num="10.0.3"/>
        <vers num="10.0.4"/>
        <vers num="10.0.5"/>
        <vers num="10.0.6"/>
        <vers num="10.0.7"/>
        <vers num="10.0.8"/>
        <vers num="10.0.9"/>
        <vers num="11.0"/>
        <vers num="12.0" edition="beta6"/>
        <vers num="13.0"/>
        <vers num="13.0.1"/>
        <vers num="14.0"/>
        <vers num="14.0.1"/>
        <vers num="15.0"/>
        <vers num="15.0.1"/>
        <vers num="16.0"/>
        <vers num="16.0.1"/>
        <vers num="16.0.2"/>
        <vers num="17.0.10"/>
        <vers num="17.0.11"/>
        <vers num="17.0.2"/>
        <vers num="17.0.3"/>
        <vers num="17.0.4"/>
        <vers num="17.0.5"/>
        <vers num="17.0.6"/>
        <vers num="17.0.7"/>
        <vers num="17.0.8"/>
        <vers num="17.0.9"/>
        <vers num="18.0"/>
        <vers num="18.0.1"/>
        <vers num="18.0.2"/>
        <vers num="19.0"/>
        <vers num="19.0.1"/>
        <vers num="19.0.2"/>
        <vers num="2.0"/>
        <vers num="2.0.0.1"/>
        <vers num="2.0.0.10"/>
        <vers num="2.0.0.11"/>
        <vers num="2.0.0.12"/>
        <vers num="2.0.0.13"/>
        <vers num="2.0.0.14"/>
        <vers num="2.0.0.15"/>
        <vers num="2.0.0.16"/>
        <vers num="2.0.0.17"/>
        <vers num="2.0.0.18"/>
        <vers num="2.0.0.19"/>
        <vers num="2.0.0.2"/>
        <vers num="2.0.0.20"/>
        <vers num="2.0.0.3"/>
        <vers num="2.0.0.4"/>
        <vers num="2.0.0.5"/>
        <vers num="2.0.0.6"/>
        <vers num="2.0.0.7"/>
        <vers num="2.0.0.8"/>
        <vers num="2.0.0.9"/>
        <vers num="20.0"/>
        <vers num="20.0.1"/>
        <vers num="21.0"/>
        <vers num="23.0"/>
        <vers num="23.0.1"/>
        <vers num="24.0"/>
        <vers num="24.1"/>
        <vers num="24.1.1"/>
        <vers num="25.0"/>
        <vers num="25.0.1"/>
        <vers num="26.0"/>
        <vers num="27.0"/>
        <vers prev="1" num="27.0.1"/>
        <vers num="3.0"/>
        <vers num="3.0.1"/>
        <vers num="3.0.10"/>
        <vers num="3.0.11"/>
        <vers num="3.0.12"/>
        <vers num="3.0.13"/>
        <vers num="3.0.14"/>
        <vers num="3.0.15"/>
        <vers num="3.0.16"/>
        <vers num="3.0.17"/>
        <vers num="3.0.18"/>
        <vers num="3.0.19"/>
        <vers num="3.0.2"/>
        <vers num="3.0.3"/>
        <vers num="3.0.4"/>
        <vers num="3.0.5"/>
        <vers num="3.0.6"/>
        <vers num="3.0.7"/>
        <vers num="3.0.8"/>
        <vers num="3.0.9"/>
        <vers num="3.5"/>
        <vers num="3.5.1"/>
        <vers num="3.5.10"/>
        <vers num="3.5.11"/>
        <vers num="3.5.12"/>
        <vers num="3.5.13"/>
        <vers num="3.5.14"/>
        <vers num="3.5.15"/>
        <vers num="3.5.16"/>
        <vers num="3.5.17"/>
        <vers num="3.5.18"/>
        <vers num="3.5.19"/>
        <vers num="3.5.2"/>
        <vers num="3.5.3"/>
        <vers num="3.5.4"/>
        <vers num="3.5.5"/>
        <vers num="3.5.6"/>
        <vers num="3.5.7"/>
        <vers num="3.5.8"/>
        <vers num="3.5.9"/>
        <vers num="3.6"/>
        <vers num="3.6.10"/>
        <vers num="3.6.11"/>
        <vers num="3.6.12"/>
        <vers num="3.6.13"/>
        <vers num="3.6.14"/>
        <vers num="3.6.15"/>
        <vers num="3.6.16"/>
        <vers num="3.6.17"/>
        <vers num="3.6.18"/>
        <vers num="3.6.19"/>
        <vers num="3.6.2"/>
        <vers num="3.6.20"/>
        <vers num="3.6.21"/>
        <vers num="3.6.22"/>
        <vers num="3.6.23"/>
        <vers num="3.6.24"/>
        <vers num="3.6.25"/>
        <vers num="3.6.26"/>
        <vers num="3.6.27"/>
        <vers num="3.6.28"/>
        <vers num="3.6.3"/>
        <vers num="3.6.4"/>
        <vers num="3.6.6"/>
        <vers num="3.6.7"/>
        <vers num="3.6.8"/>
        <vers num="3.6.9"/>
        <vers num="4.0" edition="beta1"/>
        <vers num="4.0" edition="beta10"/>
        <vers num="4.0" edition="beta11"/>
        <vers num="4.0" edition="beta12"/>
        <vers num="4.0" edition="beta2"/>
        <vers num="4.0" edition="beta3"/>
        <vers num="4.0" edition="beta4"/>
        <vers num="4.0" edition="beta5"/>
        <vers num="4.0" edition="beta6"/>
        <vers num="4.0" edition="beta7"/>
        <vers num="4.0" edition="beta8"/>
        <vers num="4.0" edition="beta9"/>
        <vers num="4.0.1"/>
        <vers num="5.0"/>
        <vers num="5.0.1"/>
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers num="6.0.2"/>
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="8.0"/>
        <vers num="8.0.1"/>
        <vers num="9.0"/>
        <vers num="9.0.1"/>
      </prod>
      <prod vendor="mozilla" name="firefox_esr">
        <vers num="24.0"/>
        <vers num="24.0.1"/>
        <vers num="24.0.2"/>
        <vers num="24.1.0"/>
        <vers num="24.1.1"/>
        <vers num="24.2"/>
        <vers num="24.3"/>
      </prod>
      <prod vendor="mozilla" name="seamonkey">
        <vers num="2.0" edition="alpha_1"/>
        <vers num="2.0" edition="alpha_2"/>
        <vers num="2.0" edition="alpha_3"/>
        <vers num="2.0" edition="beta_1"/>
        <vers num="2.0" edition="beta_2"/>
        <vers num="2.0" edition="rc1"/>
        <vers num="2.0" edition="rc2"/>
        <vers num="2.0.1"/>
        <vers num="2.0.10"/>
        <vers num="2.0.11"/>
        <vers num="2.0.12"/>
        <vers num="2.0.13"/>
        <vers num="2.0.14"/>
        <vers num="2.0.2"/>
        <vers num="2.0.3"/>
        <vers num="2.0.4"/>
        <vers num="2.0.5"/>
        <vers num="2.0.6"/>
        <vers num="2.0.7"/>
        <vers num="2.0.8"/>
        <vers num="2.0.9"/>
        <vers num="2.1" edition="alpha1"/>
        <vers num="2.1" edition="alpha2"/>
        <vers num="2.1" edition="alpha3"/>
        <vers num="2.1" edition="beta1"/>
        <vers num="2.1" edition="beta2"/>
        <vers num="2.1" edition="beta3"/>
        <vers num="2.1" edition="rc1"/>
        <vers num="2.1" edition="rc2"/>
        <vers num="2.10" edition="beta1"/>
        <vers num="2.10" edition="beta2"/>
        <vers num="2.10" edition="beta3"/>
        <vers num="2.10.1"/>
        <vers num="2.11" edition="beta1"/>
        <vers num="2.11" edition="beta2"/>
        <vers num="2.11" edition="beta3"/>
        <vers num="2.11" edition="beta4"/>
        <vers num="2.11" edition="beta5"/>
        <vers num="2.11" edition="beta6"/>
        <vers num="2.12" edition="beta1"/>
        <vers num="2.12" edition="beta2"/>
        <vers num="2.12" edition="beta3"/>
        <vers num="2.12" edition="beta4"/>
        <vers num="2.12" edition="beta5"/>
        <vers num="2.12" edition="beta6"/>
        <vers num="2.12.1"/>
        <vers num="2.13" edition="beta1"/>
        <vers num="2.13" edition="beta2"/>
        <vers num="2.13" edition="beta3"/>
        <vers num="2.13" edition="beta4"/>
        <vers num="2.13" edition="beta5"/>
        <vers num="2.13" edition="beta6"/>
        <vers num="2.13.1"/>
        <vers num="2.13.2"/>
        <vers num="2.14" edition="beta1"/>
        <vers num="2.14" edition="beta2"/>
        <vers num="2.14" edition="beta3"/>
        <vers num="2.14" edition="beta4"/>
        <vers num="2.14" edition="beta5"/>
        <vers num="2.15" edition="beta1"/>
        <vers num="2.15" edition="beta2"/>
        <vers num="2.15" edition="beta3"/>
        <vers num="2.15" edition="beta4"/>
        <vers num="2.15" edition="beta5"/>
        <vers num="2.15" edition="beta6"/>
        <vers num="2.15.1"/>
        <vers num="2.15.2"/>
        <vers num="2.16" edition="beta1"/>
        <vers num="2.16" edition="beta2"/>
        <vers num="2.16" edition="beta3"/>
        <vers num="2.16" edition="beta4"/>
        <vers num="2.16" edition="beta5"/>
        <vers num="2.16.1"/>
        <vers num="2.16.2"/>
        <vers num="2.17" edition="beta1"/>
        <vers num="2.17" edition="beta2"/>
        <vers num="2.17" edition="beta3"/>
        <vers num="2.17" edition="beta4"/>
        <vers num="2.17.1"/>
        <vers num="2.18" edition="beta1"/>
        <vers num="2.18" edition="beta2"/>
        <vers num="2.18" edition="beta3"/>
        <vers num="2.18" edition="beta4"/>
        <vers num="2.19" edition="beta1"/>
        <vers num="2.19" edition="beta2"/>
        <vers num="2.2" edition="beta1"/>
        <vers num="2.2" edition="beta2"/>
        <vers num="2.2" edition="beta3"/>
        <vers num="2.20" edition="beta1"/>
        <vers num="2.20" edition="beta2"/>
        <vers num="2.20" edition="beta3"/>
        <vers num="2.21" edition="beta1"/>
        <vers num="2.21" edition="beta2"/>
        <vers num="2.22" edition="beta1"/>
        <vers num="2.22" edition="beta2"/>
        <vers num="2.22.1"/>
        <vers num="2.23" edition="beta1"/>
        <vers num="2.23" edition="beta2"/>
        <vers num="2.24" edition="beta1"/>
        <vers prev="1" num="2.25" edition="beta1"/>
        <vers prev="1" num="2.25" edition="beta2"/>
        <vers num="2.3" edition="beta1"/>
        <vers num="2.3" edition="beta2"/>
        <vers num="2.3" edition="beta3"/>
        <vers num="2.3.1"/>
        <vers num="2.3.2"/>
        <vers num="2.3.3"/>
        <vers num="2.4" edition="beta1"/>
        <vers num="2.4" edition="beta2"/>
        <vers num="2.4" edition="beta3"/>
        <vers num="2.4.1"/>
        <vers num="2.5" edition="beta1"/>
        <vers num="2.5" edition="beta2"/>
        <vers num="2.5" edition="beta3"/>
        <vers num="2.5" edition="beta4"/>
        <vers num="2.6" edition="beta1"/>
        <vers num="2.6" edition="beta2"/>
        <vers num="2.6" edition="beta3"/>
        <vers num="2.6" edition="beta4"/>
        <vers num="2.6.1"/>
        <vers num="2.7" edition="beta1"/>
        <vers num="2.7" edition="beta2"/>
        <vers num="2.7" edition="beta3"/>
        <vers num="2.7" edition="beta4"/>
        <vers num="2.7" edition="beta5"/>
        <vers num="2.7.1"/>
        <vers num="2.7.2"/>
        <vers num="2.8" edition="beta1"/>
        <vers num="2.8" edition="beta2"/>
        <vers num="2.8" edition="beta3"/>
        <vers num="2.8" edition="beta4"/>
        <vers num="2.8" edition="beta5"/>
        <vers num="2.8" edition="beta6"/>
        <vers num="2.9" edition="beta1"/>
        <vers num="2.9" edition="beta2"/>
        <vers num="2.9" edition="beta3"/>
        <vers num="2.9" edition="beta4"/>
        <vers num="2.9.1"/>
      </prod>
      <prod vendor="mozilla" name="thunderbird">
        <vers num="0.1"/>
        <vers num="0.2"/>
        <vers num="0.3"/>
        <vers num="0.4"/>
        <vers num="0.5"/>
        <vers num="0.6"/>
        <vers num="0.7"/>
        <vers num="0.7.1"/>
        <vers num="0.7.2"/>
        <vers num="0.7.3"/>
        <vers num="0.8"/>
        <vers num="0.9"/>
        <vers num="1.0"/>
        <vers num="1.0.1"/>
        <vers num="1.0.2"/>
        <vers num="1.0.3"/>
        <vers num="1.0.4"/>
        <vers num="1.0.5" edition="beta"/>
        <vers num="1.0.6"/>
        <vers num="1.0.7"/>
        <vers num="1.0.8"/>
        <vers num="1.5" edition="beta2"/>
        <vers num="1.5.0.1"/>
        <vers num="1.5.0.10"/>
        <vers num="1.5.0.11"/>
        <vers num="1.5.0.12"/>
        <vers num="1.5.0.13"/>
        <vers num="1.5.0.14"/>
        <vers num="1.5.0.2"/>
        <vers num="1.5.0.3"/>
        <vers num="1.5.0.4"/>
        <vers num="1.5.0.5"/>
        <vers num="1.5.0.6"/>
        <vers num="1.5.0.7"/>
        <vers num="1.5.0.8"/>
        <vers num="1.5.0.9"/>
        <vers num="1.5.1"/>
        <vers num="1.5.2"/>
        <vers num="1.7.1"/>
        <vers num="1.7.3"/>
        <vers num="10.0"/>
        <vers num="10.0.1"/>
        <vers num="10.0.2"/>
        <vers num="10.0.3"/>
        <vers num="10.0.4"/>
        <vers num="11.0"/>
        <vers num="11.0.1"/>
        <vers num="12.0"/>
        <vers num="12.0.1"/>
        <vers num="13.0"/>
        <vers num="13.0.1"/>
        <vers num="14.0"/>
        <vers num="15.0"/>
        <vers num="15.0.1"/>
        <vers num="16.0"/>
        <vers num="16.0.1"/>
        <vers num="16.0.2"/>
        <vers num="17.0"/>
        <vers num="17.0.1"/>
        <vers num="17.0.2"/>
        <vers num="17.0.3"/>
        <vers num="17.0.4"/>
        <vers num="17.0.5"/>
        <vers num="17.0.6"/>
        <vers num="17.0.7"/>
        <vers num="17.0.8"/>
        <vers num="2.0"/>
        <vers num="2.0.0.0"/>
        <vers num="2.0.0.1"/>
        <vers num="2.0.0.11"/>
        <vers num="2.0.0.12"/>
        <vers num="2.0.0.13"/>
        <vers num="2.0.0.14"/>
        <vers num="2.0.0.15"/>
        <vers num="2.0.0.16"/>
        <vers num="2.0.0.17"/>
        <vers num="2.0.0.18"/>
        <vers num="2.0.0.19"/>
        <vers num="2.0.0.2"/>
        <vers num="2.0.0.20"/>
        <vers num="2.0.0.21"/>
        <vers num="2.0.0.22"/>
        <vers num="2.0.0.23"/>
        <vers num="2.0.0.3"/>
        <vers num="2.0.0.4"/>
        <vers num="2.0.0.5"/>
        <vers num="2.0.0.6"/>
        <vers num="2.0.0.7"/>
        <vers num="2.0.0.8"/>
        <vers num="2.0.0.9"/>
        <vers num="24.0"/>
        <vers num="24.0.1"/>
        <vers num="24.1"/>
        <vers num="24.1.1"/>
        <vers num="24.2"/>
        <vers prev="1" num="24.3"/>
        <vers num="3.0"/>
        <vers num="3.0.1"/>
        <vers num="3.0.10"/>
        <vers num="3.0.11"/>
        <vers num="3.0.2"/>
        <vers num="3.0.3"/>
        <vers num="3.0.4"/>
        <vers num="3.0.5"/>
        <vers num="3.0.6"/>
        <vers num="3.0.7"/>
        <vers num="3.0.8"/>
        <vers num="3.0.9"/>
        <vers num="3.1"/>
        <vers num="3.1.1"/>
        <vers num="3.1.10"/>
        <vers num="3.1.11"/>
        <vers num="3.1.12"/>
        <vers num="3.1.13"/>
        <vers num="3.1.14"/>
        <vers num="3.1.15"/>
        <vers num="3.1.16"/>
        <vers num="3.1.17"/>
        <vers num="3.1.2"/>
        <vers num="3.1.3"/>
        <vers num="3.1.4"/>
        <vers num="3.1.5"/>
        <vers num="3.1.6"/>
        <vers num="3.1.7"/>
        <vers num="3.1.8"/>
        <vers num="3.1.9"/>
        <vers num="5.0"/>
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers num="6.0.2"/>
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="8.0"/>
        <vers num="9.0"/>
        <vers num="9.0.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1514" published="2014-03-19" name="CVE-2014-1514" modified="2014-04-01" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">vmtypedarrayobject.cpp in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 does not validate the length of the destination array before a copy operation, which allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds write and application crash) by triggering incorrect use of the TypedArrayObject class.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=983344" source="CONFIRM">https://bugzilla.mozilla.org/show_bug.cgi?id=983344</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2151-1" source="UBUNTU">USN-2151-1</ref>
      <ref url="http://www.mozilla.org/security/announce/2014/mfsa2014-32.html" source="CONFIRM" adv="1">http://www.mozilla.org/security/announce/2014/mfsa2014-32.html</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2881" source="DEBIAN">DSA-2881</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0316.html" source="REDHAT">RHSA-2014:0316</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0310.html" source="REDHAT">RHSA-2014:0310</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00022.html" source="SUSE">openSUSE-SU-2014:0448</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.html" source="SUSE">openSUSE-SU-2014:0419</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00016.html" source="SUSE">SUSE-SU-2014:0418</ref>
    </refs>
    <vuln_soft>
      <prod vendor="mozilla" name="firefox">
        <vers num="0.1"/>
        <vers num="0.10"/>
        <vers num="0.10.1"/>
        <vers num="0.2"/>
        <vers num="0.3"/>
        <vers num="0.4"/>
        <vers num="0.5"/>
        <vers num="0.6"/>
        <vers num="0.6.1"/>
        <vers num="0.7"/>
        <vers num="0.7.1"/>
        <vers num="0.8"/>
        <vers num="0.9" edition="rc"/>
        <vers num="0.9.1"/>
        <vers num="0.9.2"/>
        <vers num="0.9.3"/>
        <vers num="1.0" edition="preview_release"/>
        <vers num="1.0.1"/>
        <vers num="1.0.2"/>
        <vers num="1.0.3"/>
        <vers num="1.0.4"/>
        <vers num="1.0.5"/>
        <vers num="1.0.6"/>
        <vers num="1.0.7"/>
        <vers num="1.0.8"/>
        <vers num="1.5" edition="beta1"/>
        <vers num="1.5" edition="beta2"/>
        <vers num="1.5.0.1"/>
        <vers num="1.5.0.10"/>
        <vers num="1.5.0.11"/>
        <vers num="1.5.0.12"/>
        <vers num="1.5.0.2"/>
        <vers num="1.5.0.3"/>
        <vers num="1.5.0.4"/>
        <vers num="1.5.0.5"/>
        <vers num="1.5.0.6"/>
        <vers num="1.5.0.7"/>
        <vers num="1.5.0.8"/>
        <vers num="1.5.0.9"/>
        <vers num="1.5.1"/>
        <vers num="1.5.2"/>
        <vers num="1.5.3"/>
        <vers num="1.5.4"/>
        <vers num="1.5.5"/>
        <vers num="1.5.6"/>
        <vers num="1.5.7"/>
        <vers num="1.5.8"/>
        <vers num="10.0"/>
        <vers num="10.0.1"/>
        <vers num="10.0.10"/>
        <vers num="10.0.11"/>
        <vers num="10.0.12"/>
        <vers num="10.0.2"/>
        <vers num="10.0.3"/>
        <vers num="10.0.4"/>
        <vers num="10.0.5"/>
        <vers num="10.0.6"/>
        <vers num="10.0.7"/>
        <vers num="10.0.8"/>
        <vers num="10.0.9"/>
        <vers num="11.0"/>
        <vers num="12.0" edition="beta6"/>
        <vers num="13.0"/>
        <vers num="13.0.1"/>
        <vers num="14.0"/>
        <vers num="14.0.1"/>
        <vers num="15.0"/>
        <vers num="15.0.1"/>
        <vers num="16.0"/>
        <vers num="16.0.1"/>
        <vers num="16.0.2"/>
        <vers num="17.0.10"/>
        <vers num="17.0.11"/>
        <vers num="17.0.2"/>
        <vers num="17.0.3"/>
        <vers num="17.0.4"/>
        <vers num="17.0.5"/>
        <vers num="17.0.6"/>
        <vers num="17.0.7"/>
        <vers num="17.0.8"/>
        <vers num="17.0.9"/>
        <vers num="18.0"/>
        <vers num="18.0.1"/>
        <vers num="18.0.2"/>
        <vers num="19.0"/>
        <vers num="19.0.1"/>
        <vers num="19.0.2"/>
        <vers num="2.0"/>
        <vers num="2.0.0.1"/>
        <vers num="2.0.0.10"/>
        <vers num="2.0.0.11"/>
        <vers num="2.0.0.12"/>
        <vers num="2.0.0.13"/>
        <vers num="2.0.0.14"/>
        <vers num="2.0.0.15"/>
        <vers num="2.0.0.16"/>
        <vers num="2.0.0.17"/>
        <vers num="2.0.0.18"/>
        <vers num="2.0.0.19"/>
        <vers num="2.0.0.2"/>
        <vers num="2.0.0.20"/>
        <vers num="2.0.0.3"/>
        <vers num="2.0.0.4"/>
        <vers num="2.0.0.5"/>
        <vers num="2.0.0.6"/>
        <vers num="2.0.0.7"/>
        <vers num="2.0.0.8"/>
        <vers num="2.0.0.9"/>
        <vers num="20.0"/>
        <vers num="20.0.1"/>
        <vers num="21.0"/>
        <vers num="23.0"/>
        <vers num="23.0.1"/>
        <vers num="24.0"/>
        <vers num="24.1"/>
        <vers num="24.1.1"/>
        <vers num="25.0"/>
        <vers num="25.0.1"/>
        <vers num="26.0"/>
        <vers num="27.0"/>
        <vers prev="1" num="27.0.1"/>
        <vers num="3.0"/>
        <vers num="3.0.1"/>
        <vers num="3.0.10"/>
        <vers num="3.0.11"/>
        <vers num="3.0.12"/>
        <vers num="3.0.13"/>
        <vers num="3.0.14"/>
        <vers num="3.0.15"/>
        <vers num="3.0.16"/>
        <vers num="3.0.17"/>
        <vers num="3.0.18"/>
        <vers num="3.0.19"/>
        <vers num="3.0.2"/>
        <vers num="3.0.3"/>
        <vers num="3.0.4"/>
        <vers num="3.0.5"/>
        <vers num="3.0.6"/>
        <vers num="3.0.7"/>
        <vers num="3.0.8"/>
        <vers num="3.0.9"/>
        <vers num="3.5"/>
        <vers num="3.5.1"/>
        <vers num="3.5.10"/>
        <vers num="3.5.11"/>
        <vers num="3.5.12"/>
        <vers num="3.5.13"/>
        <vers num="3.5.14"/>
        <vers num="3.5.15"/>
        <vers num="3.5.16"/>
        <vers num="3.5.17"/>
        <vers num="3.5.18"/>
        <vers num="3.5.19"/>
        <vers num="3.5.2"/>
        <vers num="3.5.3"/>
        <vers num="3.5.4"/>
        <vers num="3.5.5"/>
        <vers num="3.5.6"/>
        <vers num="3.5.7"/>
        <vers num="3.5.8"/>
        <vers num="3.5.9"/>
        <vers num="3.6"/>
        <vers num="3.6.10"/>
        <vers num="3.6.11"/>
        <vers num="3.6.12"/>
        <vers num="3.6.13"/>
        <vers num="3.6.14"/>
        <vers num="3.6.15"/>
        <vers num="3.6.16"/>
        <vers num="3.6.17"/>
        <vers num="3.6.18"/>
        <vers num="3.6.19"/>
        <vers num="3.6.2"/>
        <vers num="3.6.20"/>
        <vers num="3.6.21"/>
        <vers num="3.6.22"/>
        <vers num="3.6.23"/>
        <vers num="3.6.24"/>
        <vers num="3.6.25"/>
        <vers num="3.6.26"/>
        <vers num="3.6.27"/>
        <vers num="3.6.28"/>
        <vers num="3.6.3"/>
        <vers num="3.6.4"/>
        <vers num="3.6.6"/>
        <vers num="3.6.7"/>
        <vers num="3.6.8"/>
        <vers num="3.6.9"/>
        <vers num="4.0" edition="beta1"/>
        <vers num="4.0" edition="beta10"/>
        <vers num="4.0" edition="beta11"/>
        <vers num="4.0" edition="beta12"/>
        <vers num="4.0" edition="beta2"/>
        <vers num="4.0" edition="beta3"/>
        <vers num="4.0" edition="beta4"/>
        <vers num="4.0" edition="beta5"/>
        <vers num="4.0" edition="beta6"/>
        <vers num="4.0" edition="beta7"/>
        <vers num="4.0" edition="beta8"/>
        <vers num="4.0" edition="beta9"/>
        <vers num="4.0.1"/>
        <vers num="5.0"/>
        <vers num="5.0.1"/>
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers num="6.0.2"/>
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="8.0"/>
        <vers num="8.0.1"/>
        <vers num="9.0"/>
        <vers num="9.0.1"/>
      </prod>
      <prod vendor="mozilla" name="firefox_esr">
        <vers num="24.0"/>
        <vers num="24.0.1"/>
        <vers num="24.0.2"/>
        <vers num="24.1.0"/>
        <vers num="24.1.1"/>
        <vers num="24.2"/>
        <vers num="24.3"/>
      </prod>
      <prod vendor="mozilla" name="seamonkey">
        <vers num="2.0" edition="alpha_1"/>
        <vers num="2.0" edition="alpha_2"/>
        <vers num="2.0" edition="alpha_3"/>
        <vers num="2.0" edition="beta_1"/>
        <vers num="2.0" edition="beta_2"/>
        <vers num="2.0" edition="rc1"/>
        <vers num="2.0" edition="rc2"/>
        <vers num="2.0.1"/>
        <vers num="2.0.10"/>
        <vers num="2.0.11"/>
        <vers num="2.0.12"/>
        <vers num="2.0.13"/>
        <vers num="2.0.14"/>
        <vers num="2.0.2"/>
        <vers num="2.0.3"/>
        <vers num="2.0.4"/>
        <vers num="2.0.5"/>
        <vers num="2.0.6"/>
        <vers num="2.0.7"/>
        <vers num="2.0.8"/>
        <vers num="2.0.9"/>
        <vers num="2.1" edition="alpha1"/>
        <vers num="2.1" edition="alpha2"/>
        <vers num="2.1" edition="alpha3"/>
        <vers num="2.1" edition="beta1"/>
        <vers num="2.1" edition="beta2"/>
        <vers num="2.1" edition="beta3"/>
        <vers num="2.1" edition="rc1"/>
        <vers num="2.1" edition="rc2"/>
        <vers num="2.10" edition="beta1"/>
        <vers num="2.10" edition="beta2"/>
        <vers num="2.10" edition="beta3"/>
        <vers num="2.10.1"/>
        <vers num="2.11" edition="beta1"/>
        <vers num="2.11" edition="beta2"/>
        <vers num="2.11" edition="beta3"/>
        <vers num="2.11" edition="beta4"/>
        <vers num="2.11" edition="beta5"/>
        <vers num="2.11" edition="beta6"/>
        <vers num="2.12" edition="beta1"/>
        <vers num="2.12" edition="beta2"/>
        <vers num="2.12" edition="beta3"/>
        <vers num="2.12" edition="beta4"/>
        <vers num="2.12" edition="beta5"/>
        <vers num="2.12" edition="beta6"/>
        <vers num="2.12.1"/>
        <vers num="2.13" edition="beta1"/>
        <vers num="2.13" edition="beta2"/>
        <vers num="2.13" edition="beta3"/>
        <vers num="2.13" edition="beta4"/>
        <vers num="2.13" edition="beta5"/>
        <vers num="2.13" edition="beta6"/>
        <vers num="2.13.1"/>
        <vers num="2.13.2"/>
        <vers num="2.14" edition="beta1"/>
        <vers num="2.14" edition="beta2"/>
        <vers num="2.14" edition="beta3"/>
        <vers num="2.14" edition="beta4"/>
        <vers num="2.14" edition="beta5"/>
        <vers num="2.15" edition="beta1"/>
        <vers num="2.15" edition="beta2"/>
        <vers num="2.15" edition="beta3"/>
        <vers num="2.15" edition="beta4"/>
        <vers num="2.15" edition="beta5"/>
        <vers num="2.15" edition="beta6"/>
        <vers num="2.15.1"/>
        <vers num="2.15.2"/>
        <vers num="2.16" edition="beta1"/>
        <vers num="2.16" edition="beta2"/>
        <vers num="2.16" edition="beta3"/>
        <vers num="2.16" edition="beta4"/>
        <vers num="2.16" edition="beta5"/>
        <vers num="2.16.1"/>
        <vers num="2.16.2"/>
        <vers num="2.17" edition="beta1"/>
        <vers num="2.17" edition="beta2"/>
        <vers num="2.17" edition="beta3"/>
        <vers num="2.17" edition="beta4"/>
        <vers num="2.17.1"/>
        <vers num="2.18" edition="beta1"/>
        <vers num="2.18" edition="beta2"/>
        <vers num="2.18" edition="beta3"/>
        <vers num="2.18" edition="beta4"/>
        <vers num="2.19" edition="beta1"/>
        <vers num="2.19" edition="beta2"/>
        <vers num="2.2" edition="beta1"/>
        <vers num="2.2" edition="beta2"/>
        <vers num="2.2" edition="beta3"/>
        <vers num="2.20" edition="beta1"/>
        <vers num="2.20" edition="beta2"/>
        <vers num="2.20" edition="beta3"/>
        <vers num="2.21" edition="beta1"/>
        <vers num="2.21" edition="beta2"/>
        <vers num="2.22" edition="beta1"/>
        <vers num="2.22" edition="beta2"/>
        <vers num="2.22.1"/>
        <vers num="2.23" edition="beta1"/>
        <vers num="2.23" edition="beta2"/>
        <vers num="2.24" edition="beta1"/>
        <vers prev="1" num="2.25" edition="beta1"/>
        <vers prev="1" num="2.25" edition="beta2"/>
        <vers num="2.3" edition="beta1"/>
        <vers num="2.3" edition="beta2"/>
        <vers num="2.3" edition="beta3"/>
        <vers num="2.3.1"/>
        <vers num="2.3.2"/>
        <vers num="2.3.3"/>
        <vers num="2.4" edition="beta1"/>
        <vers num="2.4" edition="beta2"/>
        <vers num="2.4" edition="beta3"/>
        <vers num="2.4.1"/>
        <vers num="2.5" edition="beta1"/>
        <vers num="2.5" edition="beta2"/>
        <vers num="2.5" edition="beta3"/>
        <vers num="2.5" edition="beta4"/>
        <vers num="2.6" edition="beta1"/>
        <vers num="2.6" edition="beta2"/>
        <vers num="2.6" edition="beta3"/>
        <vers num="2.6" edition="beta4"/>
        <vers num="2.6.1"/>
        <vers num="2.7" edition="beta1"/>
        <vers num="2.7" edition="beta2"/>
        <vers num="2.7" edition="beta3"/>
        <vers num="2.7" edition="beta4"/>
        <vers num="2.7" edition="beta5"/>
        <vers num="2.7.1"/>
        <vers num="2.7.2"/>
        <vers num="2.8" edition="beta1"/>
        <vers num="2.8" edition="beta2"/>
        <vers num="2.8" edition="beta3"/>
        <vers num="2.8" edition="beta4"/>
        <vers num="2.8" edition="beta5"/>
        <vers num="2.8" edition="beta6"/>
        <vers num="2.9" edition="beta1"/>
        <vers num="2.9" edition="beta2"/>
        <vers num="2.9" edition="beta3"/>
        <vers num="2.9" edition="beta4"/>
        <vers num="2.9.1"/>
      </prod>
      <prod vendor="mozilla" name="thunderbird">
        <vers num="0.1"/>
        <vers num="0.2"/>
        <vers num="0.3"/>
        <vers num="0.4"/>
        <vers num="0.5"/>
        <vers num="0.6"/>
        <vers num="0.7"/>
        <vers num="0.7.1"/>
        <vers num="0.7.2"/>
        <vers num="0.7.3"/>
        <vers num="0.8"/>
        <vers num="0.9"/>
        <vers num="1.0"/>
        <vers num="1.0.1"/>
        <vers num="1.0.2"/>
        <vers num="1.0.3"/>
        <vers num="1.0.4"/>
        <vers num="1.0.5" edition="beta"/>
        <vers num="1.0.6"/>
        <vers num="1.0.7"/>
        <vers num="1.0.8"/>
        <vers num="1.5" edition="beta2"/>
        <vers num="1.5.0.1"/>
        <vers num="1.5.0.10"/>
        <vers num="1.5.0.11"/>
        <vers num="1.5.0.12"/>
        <vers num="1.5.0.13"/>
        <vers num="1.5.0.14"/>
        <vers num="1.5.0.2"/>
        <vers num="1.5.0.3"/>
        <vers num="1.5.0.4"/>
        <vers num="1.5.0.5"/>
        <vers num="1.5.0.6"/>
        <vers num="1.5.0.7"/>
        <vers num="1.5.0.8"/>
        <vers num="1.5.0.9"/>
        <vers num="1.5.1"/>
        <vers num="1.5.2"/>
        <vers num="1.7.1"/>
        <vers num="1.7.3"/>
        <vers num="10.0"/>
        <vers num="10.0.1"/>
        <vers num="10.0.2"/>
        <vers num="10.0.3"/>
        <vers num="10.0.4"/>
        <vers num="11.0"/>
        <vers num="11.0.1"/>
        <vers num="12.0"/>
        <vers num="12.0.1"/>
        <vers num="13.0"/>
        <vers num="13.0.1"/>
        <vers num="14.0"/>
        <vers num="15.0"/>
        <vers num="15.0.1"/>
        <vers num="16.0"/>
        <vers num="16.0.1"/>
        <vers num="16.0.2"/>
        <vers num="17.0"/>
        <vers num="17.0.1"/>
        <vers num="17.0.2"/>
        <vers num="17.0.3"/>
        <vers num="17.0.4"/>
        <vers num="17.0.5"/>
        <vers num="17.0.6"/>
        <vers num="17.0.7"/>
        <vers num="17.0.8"/>
        <vers num="2.0"/>
        <vers num="2.0.0.0"/>
        <vers num="2.0.0.1"/>
        <vers num="2.0.0.11"/>
        <vers num="2.0.0.12"/>
        <vers num="2.0.0.13"/>
        <vers num="2.0.0.14"/>
        <vers num="2.0.0.15"/>
        <vers num="2.0.0.16"/>
        <vers num="2.0.0.17"/>
        <vers num="2.0.0.18"/>
        <vers num="2.0.0.19"/>
        <vers num="2.0.0.2"/>
        <vers num="2.0.0.20"/>
        <vers num="2.0.0.21"/>
        <vers num="2.0.0.22"/>
        <vers num="2.0.0.23"/>
        <vers num="2.0.0.3"/>
        <vers num="2.0.0.4"/>
        <vers num="2.0.0.5"/>
        <vers num="2.0.0.6"/>
        <vers num="2.0.0.7"/>
        <vers num="2.0.0.8"/>
        <vers num="2.0.0.9"/>
        <vers num="24.0"/>
        <vers num="24.0.1"/>
        <vers num="24.1"/>
        <vers num="24.1.1"/>
        <vers num="24.2"/>
        <vers prev="1" num="24.3"/>
        <vers num="3.0"/>
        <vers num="3.0.1"/>
        <vers num="3.0.10"/>
        <vers num="3.0.11"/>
        <vers num="3.0.2"/>
        <vers num="3.0.3"/>
        <vers num="3.0.4"/>
        <vers num="3.0.5"/>
        <vers num="3.0.6"/>
        <vers num="3.0.7"/>
        <vers num="3.0.8"/>
        <vers num="3.0.9"/>
        <vers num="3.1"/>
        <vers num="3.1.1"/>
        <vers num="3.1.10"/>
        <vers num="3.1.11"/>
        <vers num="3.1.12"/>
        <vers num="3.1.13"/>
        <vers num="3.1.14"/>
        <vers num="3.1.15"/>
        <vers num="3.1.16"/>
        <vers num="3.1.17"/>
        <vers num="3.1.2"/>
        <vers num="3.1.3"/>
        <vers num="3.1.4"/>
        <vers num="3.1.5"/>
        <vers num="3.1.6"/>
        <vers num="3.1.7"/>
        <vers num="3.1.8"/>
        <vers num="3.1.9"/>
        <vers num="5.0"/>
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers num="6.0.2"/>
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="8.0"/>
        <vers num="9.0"/>
        <vers num="9.0.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-1515" published="2014-03-25" name="CVE-2014-1515" modified="2014-04-01" CVSS_version="2.0" CVSS_vector="(AV:L/AC:M/Au:N/C:P/I:N/A:N)" CVSS_score="1.9" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="3.4" CVSS_base_score="1.9">
    <desc>
      <descript source="cve">Mozilla Firefox before 28.0.1 on Android processes a file: URL by copying a local file onto the SD card, which allows attackers to obtain sensitive information from the Firefox profile directory via a crafted application.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="https://www.mozilla.org/security/announce/2014/mfsa2014-33.html" source="CONFIRM" adv="1">https://www.mozilla.org/security/announce/2014/mfsa2014-33.html</ref>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=945429" source="CONFIRM">https://bugzilla.mozilla.org/show_bug.cgi?id=945429</ref>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-03/0153.html" source="BUGTRAQ">20140326 Firefox for Android Profile Directory Derandomization and Data Exfiltration (CVE-2014-1484, CVE-2014-1506, CVE-2014-1515, CVE-2014-1516)</ref>
    </refs>
    <vuln_soft>
      <prod vendor="mozilla" name="firefox">
        <vers prev="1" num="28.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1516" published="2014-03-29" name="CVE-2014-1516" modified="2014-03-31" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:N/A:N)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">The saltProfileName function in base/GeckoProfileDirectories.java in Mozilla Firefox through 28.0.1 on Android relies on Android's weak approach to seeding the Math.random function, which makes it easier for attackers to bypass a profile-randomization protection mechanism via a crafted application.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.slideshare.net/ibmsecurity/overtaking-firefox-profiles-vulnerabilities-in-firefox-for-android" source="MISC">http://www.slideshare.net/ibmsecurity/overtaking-firefox-profiles-vulnerabilities-in-firefox-for-android</ref>
      <ref url="http://securityintelligence.com/vulnerabilities-firefox-android-overtaking-firefox-profiles/" source="MISC">http://securityintelligence.com/vulnerabilities-firefox-android-overtaking-firefox-profiles/</ref>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-03/0153.html" source="BUGTRAQ">20140326 Firefox for Android Profile Directory Derandomization and Data Exfiltration (CVE-2014-1484, CVE-2014-1506, CVE-2014-1515, CVE-2014-1516)</ref>
    </refs>
    <vuln_soft>
      <prod vendor="mozilla" name="firefox">
        <vers prev="1" num="28.0.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1517" published="2014-04-19" name="CVE-2014-1517" modified="2014-04-21" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:P/I:N/A:N)" CVSS_score="4.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.0" CVSS_base_score="4.0">
    <desc>
      <descript source="cve">The login form in Bugzilla 2.x, 3.x, 4.x before 4.4.3, and 4.5.x before 4.5.3 does not properly handle a correctly authenticated but unintended login attempt, which makes it easier for remote authenticated users to obtain sensitive information by arranging for a victim to login to the attacker's account and then submit a vulnerability report, related to a "login CSRF" issue.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=713926" source="CONFIRM" patch="1">https://bugzilla.mozilla.org/show_bug.cgi?id=713926</ref>
      <ref url="http://git.mozilla.org/?p=bugzilla/bugzilla.git;a=commit;h=0e390970ba51b14a5dc780be7c6f0d6d7baa67e3" source="CONFIRM" patch="1">http://git.mozilla.org/?p=bugzilla/bugzilla.git;a=commit;h=0e390970ba51b14a5dc780be7c6f0d6d7baa67e3</ref>
      <ref url="http://www.bugzilla.org/security/4.0.11/" source="CONFIRM" adv="1">http://www.bugzilla.org/security/4.0.11/</ref>
    </refs>
    <vuln_soft>
      <prod vendor="mozilla" name="bugzilla">
        <vers num="2.0"/>
        <vers num="2.10"/>
        <vers num="2.12"/>
        <vers num="2.14"/>
        <vers num="2.14.1"/>
        <vers num="2.14.2"/>
        <vers num="2.14.3"/>
        <vers num="2.14.4"/>
        <vers num="2.14.5"/>
        <vers num="2.16" edition="rc1"/>
        <vers num="2.16" edition="rc2"/>
        <vers num="2.16.1"/>
        <vers num="2.16.10"/>
        <vers num="2.16.11"/>
        <vers num="2.16.2"/>
        <vers num="2.16.3"/>
        <vers num="2.16.4"/>
        <vers num="2.16.5"/>
        <vers num="2.16.6"/>
        <vers num="2.16.7"/>
        <vers num="2.16.8"/>
        <vers num="2.16.9"/>
        <vers num="2.17"/>
        <vers num="2.17.1"/>
        <vers num="2.17.2"/>
        <vers num="2.17.3"/>
        <vers num="2.17.4"/>
        <vers num="2.17.5"/>
        <vers num="2.17.6"/>
        <vers num="2.17.7"/>
        <vers num="2.18" edition="rc1"/>
        <vers num="2.18" edition="rc2"/>
        <vers num="2.18" edition="rc3"/>
        <vers num="2.18.1"/>
        <vers num="2.18.2"/>
        <vers num="2.18.3"/>
        <vers num="2.18.4"/>
        <vers num="2.18.5"/>
        <vers num="2.18.6"/>
        <vers num="2.18.6+"/>
        <vers num="2.18.7"/>
        <vers num="2.18.8"/>
        <vers num="2.18.9"/>
        <vers num="2.19"/>
        <vers num="2.19.1"/>
        <vers num="2.19.2"/>
        <vers num="2.19.3"/>
        <vers num="2.2"/>
        <vers num="2.20" edition="rc1"/>
        <vers num="2.20" edition="rc2"/>
        <vers num="2.20.1"/>
        <vers num="2.20.2"/>
        <vers num="2.20.3"/>
        <vers num="2.20.4"/>
        <vers num="2.20.5"/>
        <vers num="2.20.6"/>
        <vers num="2.20.7"/>
        <vers num="2.21"/>
        <vers num="2.21.1"/>
        <vers num="2.21.2" edition="rc1"/>
        <vers num="2.22" edition="rc1"/>
        <vers num="2.22.1"/>
        <vers num="2.22.2"/>
        <vers num="2.22.3"/>
        <vers num="2.22.4"/>
        <vers num="2.22.5"/>
        <vers num="2.22.6"/>
        <vers num="2.22.7"/>
        <vers num="2.23"/>
        <vers num="2.23.1"/>
        <vers num="2.23.2"/>
        <vers num="2.23.3"/>
        <vers num="2.23.4"/>
        <vers num="2.4"/>
        <vers num="2.6"/>
        <vers num="2.8"/>
        <vers num="2.9"/>
        <vers num="3.0" edition="rc1"/>
        <vers num="3.0.0"/>
        <vers num="3.0.1"/>
        <vers num="3.0.10"/>
        <vers num="3.0.11"/>
        <vers num="3.0.2"/>
        <vers num="3.0.3"/>
        <vers num="3.0.4"/>
        <vers num="3.0.5"/>
        <vers num="3.0.6"/>
        <vers num="3.0.7"/>
        <vers num="3.0.8"/>
        <vers num="3.0.9"/>
        <vers num="3.1.0"/>
        <vers num="3.1.1"/>
        <vers num="3.1.2"/>
        <vers num="3.1.3"/>
        <vers num="3.1.4"/>
        <vers num="3.2" edition="rc1"/>
        <vers num="3.2" edition="rc2"/>
        <vers num="3.2.1"/>
        <vers num="3.2.10"/>
        <vers num="3.2.2"/>
        <vers num="3.2.3"/>
        <vers num="3.2.4"/>
        <vers num="3.2.5"/>
        <vers num="3.2.6"/>
        <vers num="3.2.7"/>
        <vers num="3.2.8"/>
        <vers num="3.2.9"/>
        <vers num="3.3"/>
        <vers num="3.3.1"/>
        <vers num="3.3.2"/>
        <vers num="3.3.3"/>
        <vers num="3.3.4"/>
        <vers num="3.4" edition="rc1"/>
        <vers num="3.4.1"/>
        <vers num="3.4.10"/>
        <vers num="3.4.11"/>
        <vers num="3.4.12"/>
        <vers num="3.4.13"/>
        <vers num="3.4.2"/>
        <vers num="3.4.3"/>
        <vers num="3.4.4"/>
        <vers num="3.4.5"/>
        <vers num="3.4.6"/>
        <vers num="3.4.7"/>
        <vers num="3.4.8"/>
        <vers num="3.4.9"/>
        <vers num="3.5"/>
        <vers num="3.5.1"/>
        <vers num="3.5.2"/>
        <vers num="3.5.3"/>
        <vers num="3.6" edition="rc1"/>
        <vers num="3.6.0"/>
        <vers num="3.6.1"/>
        <vers num="3.6.10"/>
        <vers num="3.6.11"/>
        <vers num="3.6.12"/>
        <vers num="3.6.13"/>
        <vers num="3.6.2"/>
        <vers num="3.6.3"/>
        <vers num="3.6.4"/>
        <vers num="3.6.5"/>
        <vers num="3.6.6"/>
        <vers num="3.6.7"/>
        <vers num="3.6.8"/>
        <vers num="3.6.9"/>
        <vers num="3.7"/>
        <vers num="3.7.1"/>
        <vers num="3.7.2"/>
        <vers num="3.7.3"/>
        <vers num="4.0" edition="rc1"/>
        <vers num="4.0" edition="rc2"/>
        <vers num="4.0.1"/>
        <vers num="4.0.10"/>
        <vers num="4.0.11"/>
        <vers num="4.0.12"/>
        <vers num="4.0.13"/>
        <vers num="4.0.2"/>
        <vers num="4.0.3"/>
        <vers num="4.0.4"/>
        <vers num="4.0.5"/>
        <vers num="4.0.6"/>
        <vers num="4.0.7"/>
        <vers num="4.0.8"/>
        <vers num="4.0.9"/>
        <vers num="4.1"/>
        <vers num="4.1.1"/>
        <vers num="4.1.2"/>
        <vers num="4.1.3"/>
        <vers num="4.2" edition="rc1"/>
        <vers num="4.2" edition="rc2"/>
        <vers num="4.2.1"/>
        <vers num="4.2.2"/>
        <vers num="4.2.3"/>
        <vers num="4.2.4"/>
        <vers num="4.2.5"/>
        <vers num="4.2.6"/>
        <vers num="4.2.7"/>
        <vers num="4.2.8"/>
        <vers num="4.2.9"/>
        <vers num="4.3"/>
        <vers num="4.3.1"/>
        <vers num="4.3.2"/>
        <vers num="4.3.3"/>
        <vers num="4.4" edition="-"/>
        <vers num="4.4" edition="rc1"/>
        <vers num="4.4" edition="rc2"/>
        <vers num="4.4.1"/>
        <vers num="4.4.2"/>
        <vers num="4.5"/>
        <vers num="4.5.1"/>
        <vers num="4.5.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1518" published="2014-04-30" name="CVE-2014-1518" modified="2014-04-30" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:C/I:C/A:C)" CVSS_score="10.0" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="10.0" CVSS_base_score="10.0">
    <desc>
      <descript source="cve">Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=993546" source="CONFIRM">https://bugzilla.mozilla.org/show_bug.cgi?id=993546</ref>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=992968" source="CONFIRM">https://bugzilla.mozilla.org/show_bug.cgi?id=992968</ref>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=991471" source="CONFIRM">https://bugzilla.mozilla.org/show_bug.cgi?id=991471</ref>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=986843" source="CONFIRM">https://bugzilla.mozilla.org/show_bug.cgi?id=986843</ref>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=986678" source="CONFIRM">https://bugzilla.mozilla.org/show_bug.cgi?id=986678</ref>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=980537" source="CONFIRM">https://bugzilla.mozilla.org/show_bug.cgi?id=980537</ref>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=966630" source="CONFIRM">https://bugzilla.mozilla.org/show_bug.cgi?id=966630</ref>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=952022" source="CONFIRM">https://bugzilla.mozilla.org/show_bug.cgi?id=952022</ref>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=944353" source="CONFIRM">https://bugzilla.mozilla.org/show_bug.cgi?id=944353</ref>
      <ref url="http://www.mozilla.org/security/announce/2014/mfsa2014-34.html" source="CONFIRM" adv="1">http://www.mozilla.org/security/announce/2014/mfsa2014-34.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="mozilla" name="firefox">
        <vers num="0.1"/>
        <vers num="0.10"/>
        <vers num="0.10.1"/>
        <vers num="0.2"/>
        <vers num="0.3"/>
        <vers num="0.4"/>
        <vers num="0.5"/>
        <vers num="0.6"/>
        <vers num="0.6.1"/>
        <vers num="0.7"/>
        <vers num="0.7.1"/>
        <vers num="0.8"/>
        <vers num="0.9" edition="rc"/>
        <vers num="0.9.1"/>
        <vers num="0.9.2"/>
        <vers num="0.9.3"/>
        <vers num="1.0" edition="preview_release"/>
        <vers num="1.0.1"/>
        <vers num="1.0.2"/>
        <vers num="1.0.3"/>
        <vers num="1.0.4"/>
        <vers num="1.0.5"/>
        <vers num="1.0.6"/>
        <vers num="1.0.7"/>
        <vers num="1.0.8"/>
        <vers num="1.5" edition="beta1"/>
        <vers num="1.5" edition="beta2"/>
        <vers num="1.5.0.1"/>
        <vers num="1.5.0.10"/>
        <vers num="1.5.0.11"/>
        <vers num="1.5.0.12"/>
        <vers num="1.5.0.2"/>
        <vers num="1.5.0.3"/>
        <vers num="1.5.0.4"/>
        <vers num="1.5.0.5"/>
        <vers num="1.5.0.6"/>
        <vers num="1.5.0.7"/>
        <vers num="1.5.0.8"/>
        <vers num="1.5.0.9"/>
        <vers num="1.5.1"/>
        <vers num="1.5.2"/>
        <vers num="1.5.3"/>
        <vers num="1.5.4"/>
        <vers num="1.5.5"/>
        <vers num="1.5.6"/>
        <vers num="1.5.7"/>
        <vers num="1.5.8"/>
        <vers num="10.0"/>
        <vers num="10.0.1"/>
        <vers num="10.0.10"/>
        <vers num="10.0.11"/>
        <vers num="10.0.12"/>
        <vers num="10.0.2"/>
        <vers num="10.0.3"/>
        <vers num="10.0.4"/>
        <vers num="10.0.5"/>
        <vers num="10.0.6"/>
        <vers num="10.0.7"/>
        <vers num="10.0.8"/>
        <vers num="10.0.9"/>
        <vers num="11.0"/>
        <vers num="12.0" edition="beta6"/>
        <vers num="13.0"/>
        <vers num="13.0.1"/>
        <vers num="14.0"/>
        <vers num="14.0.1"/>
        <vers num="15.0"/>
        <vers num="15.0.1"/>
        <vers num="16.0"/>
        <vers num="16.0.1"/>
        <vers num="16.0.2"/>
        <vers num="17.0.10"/>
        <vers num="17.0.11"/>
        <vers num="17.0.2"/>
        <vers num="17.0.3"/>
        <vers num="17.0.4"/>
        <vers num="17.0.5"/>
        <vers num="17.0.6"/>
        <vers num="17.0.7"/>
        <vers num="17.0.8"/>
        <vers num="17.0.9"/>
        <vers num="18.0"/>
        <vers num="18.0.1"/>
        <vers num="18.0.2"/>
        <vers num="19.0"/>
        <vers num="19.0.1"/>
        <vers num="19.0.2"/>
        <vers num="2.0"/>
        <vers num="2.0.0.1"/>
        <vers num="2.0.0.10"/>
        <vers num="2.0.0.11"/>
        <vers num="2.0.0.12"/>
        <vers num="2.0.0.13"/>
        <vers num="2.0.0.14"/>
        <vers num="2.0.0.15"/>
        <vers num="2.0.0.16"/>
        <vers num="2.0.0.17"/>
        <vers num="2.0.0.18"/>
        <vers num="2.0.0.19"/>
        <vers num="2.0.0.2"/>
        <vers num="2.0.0.20"/>
        <vers num="2.0.0.3"/>
        <vers num="2.0.0.4"/>
        <vers num="2.0.0.5"/>
        <vers num="2.0.0.6"/>
        <vers num="2.0.0.7"/>
        <vers num="2.0.0.8"/>
        <vers num="2.0.0.9"/>
        <vers num="20.0"/>
        <vers num="20.0.1"/>
        <vers num="21.0"/>
        <vers num="23.0"/>
        <vers num="23.0.1"/>
        <vers num="24.0"/>
        <vers num="24.1"/>
        <vers num="24.1.1"/>
        <vers num="25.0"/>
        <vers num="25.0.1"/>
        <vers num="26.0"/>
        <vers num="27.0"/>
        <vers num="27.0.1"/>
        <vers prev="1" num="28.0"/>
        <vers num="3.0"/>
        <vers num="3.0.1"/>
        <vers num="3.0.10"/>
        <vers num="3.0.11"/>
        <vers num="3.0.12"/>
        <vers num="3.0.13"/>
        <vers num="3.0.14"/>
        <vers num="3.0.15"/>
        <vers num="3.0.16"/>
        <vers num="3.0.17"/>
        <vers num="3.0.18"/>
        <vers num="3.0.19"/>
        <vers num="3.0.2"/>
        <vers num="3.0.3"/>
        <vers num="3.0.4"/>
        <vers num="3.0.5"/>
        <vers num="3.0.6"/>
        <vers num="3.0.7"/>
        <vers num="3.0.8"/>
        <vers num="3.0.9"/>
        <vers num="3.5"/>
        <vers num="3.5.1"/>
        <vers num="3.5.10"/>
        <vers num="3.5.11"/>
        <vers num="3.5.12"/>
        <vers num="3.5.13"/>
        <vers num="3.5.14"/>
        <vers num="3.5.15"/>
        <vers num="3.5.16"/>
        <vers num="3.5.17"/>
        <vers num="3.5.18"/>
        <vers num="3.5.19"/>
        <vers num="3.5.2"/>
        <vers num="3.5.3"/>
        <vers num="3.5.4"/>
        <vers num="3.5.5"/>
        <vers num="3.5.6"/>
        <vers num="3.5.7"/>
        <vers num="3.5.8"/>
        <vers num="3.5.9"/>
        <vers num="3.6"/>
        <vers num="3.6.10"/>
        <vers num="3.6.11"/>
        <vers num="3.6.12"/>
        <vers num="3.6.13"/>
        <vers num="3.6.14"/>
        <vers num="3.6.15"/>
        <vers num="3.6.16"/>
        <vers num="3.6.17"/>
        <vers num="3.6.18"/>
        <vers num="3.6.19"/>
        <vers num="3.6.2"/>
        <vers num="3.6.20"/>
        <vers num="3.6.21"/>
        <vers num="3.6.22"/>
        <vers num="3.6.23"/>
        <vers num="3.6.24"/>
        <vers num="3.6.25"/>
        <vers num="3.6.26"/>
        <vers num="3.6.27"/>
        <vers num="3.6.28"/>
        <vers num="3.6.3"/>
        <vers num="3.6.4"/>
        <vers num="3.6.6"/>
        <vers num="3.6.7"/>
        <vers num="3.6.8"/>
        <vers num="3.6.9"/>
        <vers num="4.0" edition="beta1"/>
        <vers num="4.0" edition="beta10"/>
        <vers num="4.0" edition="beta11"/>
        <vers num="4.0" edition="beta12"/>
        <vers num="4.0" edition="beta2"/>
        <vers num="4.0" edition="beta3"/>
        <vers num="4.0" edition="beta4"/>
        <vers num="4.0" edition="beta5"/>
        <vers num="4.0" edition="beta6"/>
        <vers num="4.0" edition="beta7"/>
        <vers num="4.0" edition="beta8"/>
        <vers num="4.0" edition="beta9"/>
        <vers num="4.0.1"/>
        <vers num="5.0"/>
        <vers num="5.0.1"/>
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers num="6.0.2"/>
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="8.0"/>
        <vers num="8.0.1"/>
        <vers num="9.0"/>
        <vers num="9.0.1"/>
      </prod>
      <prod vendor="mozilla" name="firefox_esr">
        <vers num="24.0"/>
        <vers num="24.0.1"/>
        <vers num="24.0.2"/>
        <vers num="24.1.0"/>
        <vers num="24.1.1"/>
        <vers num="24.2"/>
        <vers num="24.3"/>
        <vers num="24.4"/>
      </prod>
      <prod vendor="mozilla" name="seamonkey">
        <vers num="2.0" edition="alpha_1"/>
        <vers num="2.0" edition="alpha_2"/>
        <vers num="2.0" edition="alpha_3"/>
        <vers num="2.0" edition="beta_1"/>
        <vers num="2.0" edition="beta_2"/>
        <vers num="2.0" edition="rc1"/>
        <vers num="2.0" edition="rc2"/>
        <vers num="2.0.1"/>
        <vers num="2.0.10"/>
        <vers num="2.0.11"/>
        <vers num="2.0.12"/>
        <vers num="2.0.13"/>
        <vers num="2.0.14"/>
        <vers num="2.0.2"/>
        <vers num="2.0.3"/>
        <vers num="2.0.4"/>
        <vers num="2.0.5"/>
        <vers num="2.0.6"/>
        <vers num="2.0.7"/>
        <vers num="2.0.8"/>
        <vers num="2.0.9"/>
        <vers num="2.1" edition="alpha1"/>
        <vers num="2.1" edition="alpha2"/>
        <vers num="2.1" edition="alpha3"/>
        <vers num="2.1" edition="beta1"/>
        <vers num="2.1" edition="beta2"/>
        <vers num="2.1" edition="beta3"/>
        <vers num="2.1" edition="rc1"/>
        <vers num="2.1" edition="rc2"/>
        <vers num="2.10" edition="beta1"/>
        <vers num="2.10" edition="beta2"/>
        <vers num="2.10" edition="beta3"/>
        <vers num="2.10.1"/>
        <vers num="2.11" edition="beta1"/>
        <vers num="2.11" edition="beta2"/>
        <vers num="2.11" edition="beta3"/>
        <vers num="2.11" edition="beta4"/>
        <vers num="2.11" edition="beta5"/>
        <vers num="2.11" edition="beta6"/>
        <vers num="2.12" edition="beta1"/>
        <vers num="2.12" edition="beta2"/>
        <vers num="2.12" edition="beta3"/>
        <vers num="2.12" edition="beta4"/>
        <vers num="2.12" edition="beta5"/>
        <vers num="2.12" edition="beta6"/>
        <vers num="2.12.1"/>
        <vers num="2.13" edition="beta1"/>
        <vers num="2.13" edition="beta2"/>
        <vers num="2.13" edition="beta3"/>
        <vers num="2.13" edition="beta4"/>
        <vers num="2.13" edition="beta5"/>
        <vers num="2.13" edition="beta6"/>
        <vers num="2.13.1"/>
        <vers num="2.13.2"/>
        <vers num="2.14" edition="beta1"/>
        <vers num="2.14" edition="beta2"/>
        <vers num="2.14" edition="beta3"/>
        <vers num="2.14" edition="beta4"/>
        <vers num="2.14" edition="beta5"/>
        <vers num="2.15" edition="beta1"/>
        <vers num="2.15" edition="beta2"/>
        <vers num="2.15" edition="beta3"/>
        <vers num="2.15" edition="beta4"/>
        <vers num="2.15" edition="beta5"/>
        <vers num="2.15" edition="beta6"/>
        <vers num="2.15.1"/>
        <vers num="2.15.2"/>
        <vers num="2.16" edition="beta1"/>
        <vers num="2.16" edition="beta2"/>
        <vers num="2.16" edition="beta3"/>
        <vers num="2.16" edition="beta4"/>
        <vers num="2.16" edition="beta5"/>
        <vers num="2.16.1"/>
        <vers num="2.16.2"/>
        <vers num="2.17" edition="beta1"/>
        <vers num="2.17" edition="beta2"/>
        <vers num="2.17" edition="beta3"/>
        <vers num="2.17" edition="beta4"/>
        <vers num="2.17.1"/>
        <vers num="2.18" edition="beta1"/>
        <vers num="2.18" edition="beta2"/>
        <vers num="2.18" edition="beta3"/>
        <vers num="2.18" edition="beta4"/>
        <vers num="2.19" edition="beta1"/>
        <vers num="2.19" edition="beta2"/>
        <vers num="2.2" edition="beta1"/>
        <vers num="2.2" edition="beta2"/>
        <vers num="2.2" edition="beta3"/>
        <vers num="2.20" edition="beta1"/>
        <vers num="2.20" edition="beta2"/>
        <vers num="2.20" edition="beta3"/>
        <vers num="2.21" edition="beta1"/>
        <vers num="2.21" edition="beta2"/>
        <vers num="2.22" edition="beta1"/>
        <vers num="2.22" edition="beta2"/>
        <vers num="2.22.1"/>
        <vers num="2.23" edition="beta1"/>
        <vers num="2.23" edition="beta2"/>
        <vers num="2.24" edition="beta1"/>
        <vers num="2.25" edition="-"/>
        <vers num="2.25" edition="beta1"/>
        <vers num="2.25" edition="beta2"/>
        <vers num="2.25" edition="beta3"/>
        <vers prev="1" num="2.26" edition="rc1"/>
        <vers num="2.3" edition="beta1"/>
        <vers num="2.3" edition="beta2"/>
        <vers num="2.3" edition="beta3"/>
        <vers num="2.3.1"/>
        <vers num="2.3.2"/>
        <vers num="2.3.3"/>
        <vers num="2.4" edition="beta1"/>
        <vers num="2.4" edition="beta2"/>
        <vers num="2.4" edition="beta3"/>
        <vers num="2.4.1"/>
        <vers num="2.5" edition="beta1"/>
        <vers num="2.5" edition="beta2"/>
        <vers num="2.5" edition="beta3"/>
        <vers num="2.5" edition="beta4"/>
        <vers num="2.6" edition="beta1"/>
        <vers num="2.6" edition="beta2"/>
        <vers num="2.6" edition="beta3"/>
        <vers num="2.6" edition="beta4"/>
        <vers num="2.6.1"/>
        <vers num="2.7" edition="beta1"/>
        <vers num="2.7" edition="beta2"/>
        <vers num="2.7" edition="beta3"/>
        <vers num="2.7" edition="beta4"/>
        <vers num="2.7" edition="beta5"/>
        <vers num="2.7.1"/>
        <vers num="2.7.2"/>
        <vers num="2.8" edition="beta1"/>
        <vers num="2.8" edition="beta2"/>
        <vers num="2.8" edition="beta3"/>
        <vers num="2.8" edition="beta4"/>
        <vers num="2.8" edition="beta5"/>
        <vers num="2.8" edition="beta6"/>
        <vers num="2.9" edition="beta1"/>
        <vers num="2.9" edition="beta2"/>
        <vers num="2.9" edition="beta3"/>
        <vers num="2.9" edition="beta4"/>
        <vers num="2.9.1"/>
      </prod>
      <prod vendor="mozilla" name="thunderbird">
        <vers num="0.1"/>
        <vers num="0.2"/>
        <vers num="0.3"/>
        <vers num="0.4"/>
        <vers num="0.5"/>
        <vers num="0.6"/>
        <vers num="0.7"/>
        <vers num="0.7.1"/>
        <vers num="0.7.2"/>
        <vers num="0.7.3"/>
        <vers num="0.8"/>
        <vers num="0.9"/>
        <vers num="1.0"/>
        <vers num="1.0.1"/>
        <vers num="1.0.2"/>
        <vers num="1.0.3"/>
        <vers num="1.0.4"/>
        <vers num="1.0.5" edition="beta"/>
        <vers num="1.0.6"/>
        <vers num="1.0.7"/>
        <vers num="1.0.8"/>
        <vers num="1.5" edition="beta2"/>
        <vers num="1.5.0.1"/>
        <vers num="1.5.0.10"/>
        <vers num="1.5.0.11"/>
        <vers num="1.5.0.12"/>
        <vers num="1.5.0.13"/>
        <vers num="1.5.0.14"/>
        <vers num="1.5.0.2"/>
        <vers num="1.5.0.3"/>
        <vers num="1.5.0.4"/>
        <vers num="1.5.0.5"/>
        <vers num="1.5.0.6"/>
        <vers num="1.5.0.7"/>
        <vers num="1.5.0.8"/>
        <vers num="1.5.0.9"/>
        <vers num="1.5.1"/>
        <vers num="1.5.2"/>
        <vers num="1.7.1"/>
        <vers num="1.7.3"/>
        <vers num="10.0"/>
        <vers num="10.0.1"/>
        <vers num="10.0.2"/>
        <vers num="10.0.3"/>
        <vers num="10.0.4"/>
        <vers num="11.0"/>
        <vers num="11.0.1"/>
        <vers num="12.0"/>
        <vers num="12.0.1"/>
        <vers num="13.0"/>
        <vers num="13.0.1"/>
        <vers num="14.0"/>
        <vers num="15.0"/>
        <vers num="15.0.1"/>
        <vers num="16.0"/>
        <vers num="16.0.1"/>
        <vers num="16.0.2"/>
        <vers num="17.0"/>
        <vers num="17.0.1"/>
        <vers num="17.0.2"/>
        <vers num="17.0.3"/>
        <vers num="17.0.4"/>
        <vers num="17.0.5"/>
        <vers num="17.0.6"/>
        <vers num="17.0.7"/>
        <vers num="17.0.8"/>
        <vers num="2.0"/>
        <vers num="2.0.0.0"/>
        <vers num="2.0.0.1"/>
        <vers num="2.0.0.11"/>
        <vers num="2.0.0.12"/>
        <vers num="2.0.0.13"/>
        <vers num="2.0.0.14"/>
        <vers num="2.0.0.15"/>
        <vers num="2.0.0.16"/>
        <vers num="2.0.0.17"/>
        <vers num="2.0.0.18"/>
        <vers num="2.0.0.19"/>
        <vers num="2.0.0.2"/>
        <vers num="2.0.0.20"/>
        <vers num="2.0.0.21"/>
        <vers num="2.0.0.22"/>
        <vers num="2.0.0.23"/>
        <vers num="2.0.0.3"/>
        <vers num="2.0.0.4"/>
        <vers num="2.0.0.5"/>
        <vers num="2.0.0.6"/>
        <vers num="2.0.0.7"/>
        <vers num="2.0.0.8"/>
        <vers num="2.0.0.9"/>
        <vers num="24.0"/>
        <vers num="24.0.1"/>
        <vers num="24.1"/>
        <vers num="24.1.1"/>
        <vers num="24.2"/>
        <vers num="24.3"/>
        <vers prev="1" num="24.4"/>
        <vers num="3.0"/>
        <vers num="3.0.1"/>
        <vers num="3.0.10"/>
        <vers num="3.0.11"/>
        <vers num="3.0.2"/>
        <vers num="3.0.3"/>
        <vers num="3.0.4"/>
        <vers num="3.0.5"/>
        <vers num="3.0.6"/>
        <vers num="3.0.7"/>
        <vers num="3.0.8"/>
        <vers num="3.0.9"/>
        <vers num="3.1"/>
        <vers num="3.1.1"/>
        <vers num="3.1.10"/>
        <vers num="3.1.11"/>
        <vers num="3.1.12"/>
        <vers num="3.1.13"/>
        <vers num="3.1.14"/>
        <vers num="3.1.15"/>
        <vers num="3.1.16"/>
        <vers num="3.1.17"/>
        <vers num="3.1.2"/>
        <vers num="3.1.3"/>
        <vers num="3.1.4"/>
        <vers num="3.1.5"/>
        <vers num="3.1.6"/>
        <vers num="3.1.7"/>
        <vers num="3.1.8"/>
        <vers num="3.1.9"/>
        <vers num="5.0"/>
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers num="6.0.2"/>
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="8.0"/>
        <vers num="9.0"/>
        <vers num="9.0.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1519" published="2014-04-30" name="CVE-2014-1519" modified="2014-04-30" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:C/I:C/A:C)" CVSS_score="10.0" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="10.0" CVSS_base_score="10.0">
    <desc>
      <descript source="cve">Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 29.0 and SeaMonkey before 2.26 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=996883" source="CONFIRM">https://bugzilla.mozilla.org/show_bug.cgi?id=996883</ref>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=995607" source="CONFIRM">https://bugzilla.mozilla.org/show_bug.cgi?id=995607</ref>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=990794" source="CONFIRM">https://bugzilla.mozilla.org/show_bug.cgi?id=990794</ref>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=986864" source="CONFIRM">https://bugzilla.mozilla.org/show_bug.cgi?id=986864</ref>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=977955" source="CONFIRM">https://bugzilla.mozilla.org/show_bug.cgi?id=977955</ref>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=953104" source="CONFIRM">https://bugzilla.mozilla.org/show_bug.cgi?id=953104</ref>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=946658" source="CONFIRM">https://bugzilla.mozilla.org/show_bug.cgi?id=946658</ref>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=919592" source="CONFIRM">https://bugzilla.mozilla.org/show_bug.cgi?id=919592</ref>
      <ref url="http://www.mozilla.org/security/announce/2014/mfsa2014-34.html" source="CONFIRM" adv="1">http://www.mozilla.org/security/announce/2014/mfsa2014-34.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="mozilla" name="firefox">
        <vers num="0.1"/>
        <vers num="0.10"/>
        <vers num="0.10.1"/>
        <vers num="0.2"/>
        <vers num="0.3"/>
        <vers num="0.4"/>
        <vers num="0.5"/>
        <vers num="0.6"/>
        <vers num="0.6.1"/>
        <vers num="0.7"/>
        <vers num="0.7.1"/>
        <vers num="0.8"/>
        <vers num="0.9" edition="rc"/>
        <vers num="0.9.1"/>
        <vers num="0.9.2"/>
        <vers num="0.9.3"/>
        <vers num="1.0" edition="preview_release"/>
        <vers num="1.0.1"/>
        <vers num="1.0.2"/>
        <vers num="1.0.3"/>
        <vers num="1.0.4"/>
        <vers num="1.0.5"/>
        <vers num="1.0.6"/>
        <vers num="1.0.7"/>
        <vers num="1.0.8"/>
        <vers num="1.5" edition="beta1"/>
        <vers num="1.5" edition="beta2"/>
        <vers num="1.5.0.1"/>
        <vers num="1.5.0.10"/>
        <vers num="1.5.0.11"/>
        <vers num="1.5.0.12"/>
        <vers num="1.5.0.2"/>
        <vers num="1.5.0.3"/>
        <vers num="1.5.0.4"/>
        <vers num="1.5.0.5"/>
        <vers num="1.5.0.6"/>
        <vers num="1.5.0.7"/>
        <vers num="1.5.0.8"/>
        <vers num="1.5.0.9"/>
        <vers num="1.5.1"/>
        <vers num="1.5.2"/>
        <vers num="1.5.3"/>
        <vers num="1.5.4"/>
        <vers num="1.5.5"/>
        <vers num="1.5.6"/>
        <vers num="1.5.7"/>
        <vers num="1.5.8"/>
        <vers num="10.0"/>
        <vers num="10.0.1"/>
        <vers num="10.0.10"/>
        <vers num="10.0.11"/>
        <vers num="10.0.12"/>
        <vers num="10.0.2"/>
        <vers num="10.0.3"/>
        <vers num="10.0.4"/>
        <vers num="10.0.5"/>
        <vers num="10.0.6"/>
        <vers num="10.0.7"/>
        <vers num="10.0.8"/>
        <vers num="10.0.9"/>
        <vers num="11.0"/>
        <vers num="12.0" edition="beta6"/>
        <vers num="13.0"/>
        <vers num="13.0.1"/>
        <vers num="14.0"/>
        <vers num="14.0.1"/>
        <vers num="15.0"/>
        <vers num="15.0.1"/>
        <vers num="16.0"/>
        <vers num="16.0.1"/>
        <vers num="16.0.2"/>
        <vers num="17.0.10"/>
        <vers num="17.0.11"/>
        <vers num="17.0.2"/>
        <vers num="17.0.3"/>
        <vers num="17.0.4"/>
        <vers num="17.0.5"/>
        <vers num="17.0.6"/>
        <vers num="17.0.7"/>
        <vers num="17.0.8"/>
        <vers num="17.0.9"/>
        <vers num="18.0"/>
        <vers num="18.0.1"/>
        <vers num="18.0.2"/>
        <vers num="19.0"/>
        <vers num="19.0.1"/>
        <vers num="19.0.2"/>
        <vers num="2.0"/>
        <vers num="2.0.0.1"/>
        <vers num="2.0.0.10"/>
        <vers num="2.0.0.11"/>
        <vers num="2.0.0.12"/>
        <vers num="2.0.0.13"/>
        <vers num="2.0.0.14"/>
        <vers num="2.0.0.15"/>
        <vers num="2.0.0.16"/>
        <vers num="2.0.0.17"/>
        <vers num="2.0.0.18"/>
        <vers num="2.0.0.19"/>
        <vers num="2.0.0.2"/>
        <vers num="2.0.0.20"/>
        <vers num="2.0.0.3"/>
        <vers num="2.0.0.4"/>
        <vers num="2.0.0.5"/>
        <vers num="2.0.0.6"/>
        <vers num="2.0.0.7"/>
        <vers num="2.0.0.8"/>
        <vers num="2.0.0.9"/>
        <vers num="20.0"/>
        <vers num="20.0.1"/>
        <vers num="21.0"/>
        <vers num="23.0"/>
        <vers num="23.0.1"/>
        <vers num="24.0"/>
        <vers num="24.1"/>
        <vers num="24.1.1"/>
        <vers num="25.0"/>
        <vers num="25.0.1"/>
        <vers num="26.0"/>
        <vers num="27.0"/>
        <vers num="27.0.1"/>
        <vers prev="1" num="28.0"/>
        <vers num="3.0"/>
        <vers num="3.0.1"/>
        <vers num="3.0.10"/>
        <vers num="3.0.11"/>
        <vers num="3.0.12"/>
        <vers num="3.0.13"/>
        <vers num="3.0.14"/>
        <vers num="3.0.15"/>
        <vers num="3.0.16"/>
        <vers num="3.0.17"/>
        <vers num="3.0.18"/>
        <vers num="3.0.19"/>
        <vers num="3.0.2"/>
        <vers num="3.0.3"/>
        <vers num="3.0.4"/>
        <vers num="3.0.5"/>
        <vers num="3.0.6"/>
        <vers num="3.0.7"/>
        <vers num="3.0.8"/>
        <vers num="3.0.9"/>
        <vers num="3.5"/>
        <vers num="3.5.1"/>
        <vers num="3.5.10"/>
        <vers num="3.5.11"/>
        <vers num="3.5.12"/>
        <vers num="3.5.13"/>
        <vers num="3.5.14"/>
        <vers num="3.5.15"/>
        <vers num="3.5.16"/>
        <vers num="3.5.17"/>
        <vers num="3.5.18"/>
        <vers num="3.5.19"/>
        <vers num="3.5.2"/>
        <vers num="3.5.3"/>
        <vers num="3.5.4"/>
        <vers num="3.5.5"/>
        <vers num="3.5.6"/>
        <vers num="3.5.7"/>
        <vers num="3.5.8"/>
        <vers num="3.5.9"/>
        <vers num="3.6"/>
        <vers num="3.6.10"/>
        <vers num="3.6.11"/>
        <vers num="3.6.12"/>
        <vers num="3.6.13"/>
        <vers num="3.6.14"/>
        <vers num="3.6.15"/>
        <vers num="3.6.16"/>
        <vers num="3.6.17"/>
        <vers num="3.6.18"/>
        <vers num="3.6.19"/>
        <vers num="3.6.2"/>
        <vers num="3.6.20"/>
        <vers num="3.6.21"/>
        <vers num="3.6.22"/>
        <vers num="3.6.23"/>
        <vers num="3.6.24"/>
        <vers num="3.6.25"/>
        <vers num="3.6.26"/>
        <vers num="3.6.27"/>
        <vers num="3.6.28"/>
        <vers num="3.6.3"/>
        <vers num="3.6.4"/>
        <vers num="3.6.6"/>
        <vers num="3.6.7"/>
        <vers num="3.6.8"/>
        <vers num="3.6.9"/>
        <vers num="4.0" edition="beta1"/>
        <vers num="4.0" edition="beta10"/>
        <vers num="4.0" edition="beta11"/>
        <vers num="4.0" edition="beta12"/>
        <vers num="4.0" edition="beta2"/>
        <vers num="4.0" edition="beta3"/>
        <vers num="4.0" edition="beta4"/>
        <vers num="4.0" edition="beta5"/>
        <vers num="4.0" edition="beta6"/>
        <vers num="4.0" edition="beta7"/>
        <vers num="4.0" edition="beta8"/>
        <vers num="4.0" edition="beta9"/>
        <vers num="4.0.1"/>
        <vers num="5.0"/>
        <vers num="5.0.1"/>
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers num="6.0.2"/>
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="8.0"/>
        <vers num="8.0.1"/>
        <vers num="9.0"/>
        <vers num="9.0.1"/>
      </prod>
      <prod vendor="mozilla" name="seamonkey">
        <vers num="2.0" edition="alpha_1"/>
        <vers num="2.0" edition="alpha_2"/>
        <vers num="2.0" edition="alpha_3"/>
        <vers num="2.0" edition="beta_1"/>
        <vers num="2.0" edition="beta_2"/>
        <vers num="2.0" edition="rc1"/>
        <vers num="2.0" edition="rc2"/>
        <vers num="2.0.1"/>
        <vers num="2.0.10"/>
        <vers num="2.0.11"/>
        <vers num="2.0.12"/>
        <vers num="2.0.13"/>
        <vers num="2.0.14"/>
        <vers num="2.0.2"/>
        <vers num="2.0.3"/>
        <vers num="2.0.4"/>
        <vers num="2.0.5"/>
        <vers num="2.0.6"/>
        <vers num="2.0.7"/>
        <vers num="2.0.8"/>
        <vers num="2.0.9"/>
        <vers num="2.1" edition="alpha1"/>
        <vers num="2.1" edition="alpha2"/>
        <vers num="2.1" edition="alpha3"/>
        <vers num="2.1" edition="beta1"/>
        <vers num="2.1" edition="beta2"/>
        <vers num="2.1" edition="beta3"/>
        <vers num="2.1" edition="rc1"/>
        <vers num="2.1" edition="rc2"/>
        <vers num="2.10" edition="beta1"/>
        <vers num="2.10" edition="beta2"/>
        <vers num="2.10" edition="beta3"/>
        <vers num="2.10.1"/>
        <vers num="2.11" edition="beta1"/>
        <vers num="2.11" edition="beta2"/>
        <vers num="2.11" edition="beta3"/>
        <vers num="2.11" edition="beta4"/>
        <vers num="2.11" edition="beta5"/>
        <vers num="2.11" edition="beta6"/>
        <vers num="2.12" edition="beta1"/>
        <vers num="2.12" edition="beta2"/>
        <vers num="2.12" edition="beta3"/>
        <vers num="2.12" edition="beta4"/>
        <vers num="2.12" edition="beta5"/>
        <vers num="2.12" edition="beta6"/>
        <vers num="2.12.1"/>
        <vers num="2.13" edition="beta1"/>
        <vers num="2.13" edition="beta2"/>
        <vers num="2.13" edition="beta3"/>
        <vers num="2.13" edition="beta4"/>
        <vers num="2.13" edition="beta5"/>
        <vers num="2.13" edition="beta6"/>
        <vers num="2.13.1"/>
        <vers num="2.13.2"/>
        <vers num="2.14" edition="beta1"/>
        <vers num="2.14" edition="beta2"/>
        <vers num="2.14" edition="beta3"/>
        <vers num="2.14" edition="beta4"/>
        <vers num="2.14" edition="beta5"/>
        <vers num="2.15" edition="beta1"/>
        <vers num="2.15" edition="beta2"/>
        <vers num="2.15" edition="beta3"/>
        <vers num="2.15" edition="beta4"/>
        <vers num="2.15" edition="beta5"/>
        <vers num="2.15" edition="beta6"/>
        <vers num="2.15.1"/>
        <vers num="2.15.2"/>
        <vers num="2.16" edition="beta1"/>
        <vers num="2.16" edition="beta2"/>
        <vers num="2.16" edition="beta3"/>
        <vers num="2.16" edition="beta4"/>
        <vers num="2.16" edition="beta5"/>
        <vers num="2.16.1"/>
        <vers num="2.16.2"/>
        <vers num="2.17" edition="beta1"/>
        <vers num="2.17" edition="beta2"/>
        <vers num="2.17" edition="beta3"/>
        <vers num="2.17" edition="beta4"/>
        <vers num="2.17.1"/>
        <vers num="2.18" edition="beta1"/>
        <vers num="2.18" edition="beta2"/>
        <vers num="2.18" edition="beta3"/>
        <vers num="2.18" edition="beta4"/>
        <vers num="2.19" edition="beta1"/>
        <vers num="2.19" edition="beta2"/>
        <vers num="2.2" edition="beta1"/>
        <vers num="2.2" edition="beta2"/>
        <vers num="2.2" edition="beta3"/>
        <vers num="2.20" edition="beta1"/>
        <vers num="2.20" edition="beta2"/>
        <vers num="2.20" edition="beta3"/>
        <vers num="2.21" edition="beta1"/>
        <vers num="2.21" edition="beta2"/>
        <vers num="2.22" edition="beta1"/>
        <vers num="2.22" edition="beta2"/>
        <vers num="2.22.1"/>
        <vers num="2.23" edition="beta1"/>
        <vers num="2.23" edition="beta2"/>
        <vers num="2.24" edition="beta1"/>
        <vers num="2.25" edition="-"/>
        <vers num="2.25" edition="beta1"/>
        <vers num="2.25" edition="beta2"/>
        <vers num="2.25" edition="beta3"/>
        <vers prev="1" num="2.26" edition="rc1"/>
        <vers num="2.3" edition="beta1"/>
        <vers num="2.3" edition="beta2"/>
        <vers num="2.3" edition="beta3"/>
        <vers num="2.3.1"/>
        <vers num="2.3.2"/>
        <vers num="2.3.3"/>
        <vers num="2.4" edition="beta1"/>
        <vers num="2.4" edition="beta2"/>
        <vers num="2.4" edition="beta3"/>
        <vers num="2.4.1"/>
        <vers num="2.5" edition="beta1"/>
        <vers num="2.5" edition="beta2"/>
        <vers num="2.5" edition="beta3"/>
        <vers num="2.5" edition="beta4"/>
        <vers num="2.6" edition="beta1"/>
        <vers num="2.6" edition="beta2"/>
        <vers num="2.6" edition="beta3"/>
        <vers num="2.6" edition="beta4"/>
        <vers num="2.6.1"/>
        <vers num="2.7" edition="beta1"/>
        <vers num="2.7" edition="beta2"/>
        <vers num="2.7" edition="beta3"/>
        <vers num="2.7" edition="beta4"/>
        <vers num="2.7" edition="beta5"/>
        <vers num="2.7.1"/>
        <vers num="2.7.2"/>
        <vers num="2.8" edition="beta1"/>
        <vers num="2.8" edition="beta2"/>
        <vers num="2.8" edition="beta3"/>
        <vers num="2.8" edition="beta4"/>
        <vers num="2.8" edition="beta5"/>
        <vers num="2.8" edition="beta6"/>
        <vers num="2.9" edition="beta1"/>
        <vers num="2.9" edition="beta2"/>
        <vers num="2.9" edition="beta3"/>
        <vers num="2.9" edition="beta4"/>
        <vers num="2.9.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1520" published="2014-04-30" name="CVE-2014-1520" modified="2014-04-30" CVSS_version="2.0" CVSS_vector="(AV:L/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="6.9" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="3.4" CVSS_base_score="6.9">
    <desc>
      <descript source="cve">maintenservice_installer.exe in the Maintenance Service Installer in Mozilla Firefox before 29.0 and Firefox ESR 24.x before 24.5 on Windows allows local users to gain privileges by placing a Trojan horse DLL file into a temporary directory at an unspecified point in the update process.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=961676" source="CONFIRM">https://bugzilla.mozilla.org/show_bug.cgi?id=961676</ref>
      <ref url="http://www.mozilla.org/security/announce/2014/mfsa2014-35.html" source="CONFIRM" adv="1">http://www.mozilla.org/security/announce/2014/mfsa2014-35.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="mozilla" name="firefox">
        <vers num="0.1"/>
        <vers num="0.10"/>
        <vers num="0.10.1"/>
        <vers num="0.2"/>
        <vers num="0.3"/>
        <vers num="0.4"/>
        <vers num="0.5"/>
        <vers num="0.6"/>
        <vers num="0.6.1"/>
        <vers num="0.7"/>
        <vers num="0.7.1"/>
        <vers num="0.8"/>
        <vers num="0.9" edition="rc"/>
        <vers num="0.9.1"/>
        <vers num="0.9.2"/>
        <vers num="0.9.3"/>
        <vers num="1.0" edition="preview_release"/>
        <vers num="1.0.1"/>
        <vers num="1.0.2"/>
        <vers num="1.0.3"/>
        <vers num="1.0.4"/>
        <vers num="1.0.5"/>
        <vers num="1.0.6"/>
        <vers num="1.0.7"/>
        <vers num="1.0.8"/>
        <vers num="1.5" edition="beta1"/>
        <vers num="1.5" edition="beta2"/>
        <vers num="1.5.0.1"/>
        <vers num="1.5.0.10"/>
        <vers num="1.5.0.11"/>
        <vers num="1.5.0.12"/>
        <vers num="1.5.0.2"/>
        <vers num="1.5.0.3"/>
        <vers num="1.5.0.4"/>
        <vers num="1.5.0.5"/>
        <vers num="1.5.0.6"/>
        <vers num="1.5.0.7"/>
        <vers num="1.5.0.8"/>
        <vers num="1.5.0.9"/>
        <vers num="1.5.1"/>
        <vers num="1.5.2"/>
        <vers num="1.5.3"/>
        <vers num="1.5.4"/>
        <vers num="1.5.5"/>
        <vers num="1.5.6"/>
        <vers num="1.5.7"/>
        <vers num="1.5.8"/>
        <vers num="10.0"/>
        <vers num="10.0.1"/>
        <vers num="10.0.10"/>
        <vers num="10.0.11"/>
        <vers num="10.0.12"/>
        <vers num="10.0.2"/>
        <vers num="10.0.3"/>
        <vers num="10.0.4"/>
        <vers num="10.0.5"/>
        <vers num="10.0.6"/>
        <vers num="10.0.7"/>
        <vers num="10.0.8"/>
        <vers num="10.0.9"/>
        <vers num="11.0"/>
        <vers num="12.0" edition="beta6"/>
        <vers num="13.0"/>
        <vers num="13.0.1"/>
        <vers num="14.0"/>
        <vers num="14.0.1"/>
        <vers num="15.0"/>
        <vers num="15.0.1"/>
        <vers num="16.0"/>
        <vers num="16.0.1"/>
        <vers num="16.0.2"/>
        <vers num="17.0.10"/>
        <vers num="17.0.11"/>
        <vers num="17.0.2"/>
        <vers num="17.0.3"/>
        <vers num="17.0.4"/>
        <vers num="17.0.5"/>
        <vers num="17.0.6"/>
        <vers num="17.0.7"/>
        <vers num="17.0.8"/>
        <vers num="17.0.9"/>
        <vers num="18.0"/>
        <vers num="18.0.1"/>
        <vers num="18.0.2"/>
        <vers num="19.0"/>
        <vers num="19.0.1"/>
        <vers num="19.0.2"/>
        <vers num="2.0"/>
        <vers num="2.0.0.1"/>
        <vers num="2.0.0.10"/>
        <vers num="2.0.0.11"/>
        <vers num="2.0.0.12"/>
        <vers num="2.0.0.13"/>
        <vers num="2.0.0.14"/>
        <vers num="2.0.0.15"/>
        <vers num="2.0.0.16"/>
        <vers num="2.0.0.17"/>
        <vers num="2.0.0.18"/>
        <vers num="2.0.0.19"/>
        <vers num="2.0.0.2"/>
        <vers num="2.0.0.20"/>
        <vers num="2.0.0.3"/>
        <vers num="2.0.0.4"/>
        <vers num="2.0.0.5"/>
        <vers num="2.0.0.6"/>
        <vers num="2.0.0.7"/>
        <vers num="2.0.0.8"/>
        <vers num="2.0.0.9"/>
        <vers num="20.0"/>
        <vers num="20.0.1"/>
        <vers num="21.0"/>
        <vers num="23.0"/>
        <vers num="23.0.1"/>
        <vers num="24.0"/>
        <vers num="24.1"/>
        <vers num="24.1.1"/>
        <vers num="25.0"/>
        <vers num="25.0.1"/>
        <vers num="26.0"/>
        <vers num="27.0"/>
        <vers num="27.0.1"/>
        <vers prev="1" num="28.0"/>
        <vers num="3.0"/>
        <vers num="3.0.1"/>
        <vers num="3.0.10"/>
        <vers num="3.0.11"/>
        <vers num="3.0.12"/>
        <vers num="3.0.13"/>
        <vers num="3.0.14"/>
        <vers num="3.0.15"/>
        <vers num="3.0.16"/>
        <vers num="3.0.17"/>
        <vers num="3.0.18"/>
        <vers num="3.0.19"/>
        <vers num="3.0.2"/>
        <vers num="3.0.3"/>
        <vers num="3.0.4"/>
        <vers num="3.0.5"/>
        <vers num="3.0.6"/>
        <vers num="3.0.7"/>
        <vers num="3.0.8"/>
        <vers num="3.0.9"/>
        <vers num="3.5"/>
        <vers num="3.5.1"/>
        <vers num="3.5.10"/>
        <vers num="3.5.11"/>
        <vers num="3.5.12"/>
        <vers num="3.5.13"/>
        <vers num="3.5.14"/>
        <vers num="3.5.15"/>
        <vers num="3.5.16"/>
        <vers num="3.5.17"/>
        <vers num="3.5.18"/>
        <vers num="3.5.19"/>
        <vers num="3.5.2"/>
        <vers num="3.5.3"/>
        <vers num="3.5.4"/>
        <vers num="3.5.5"/>
        <vers num="3.5.6"/>
        <vers num="3.5.7"/>
        <vers num="3.5.8"/>
        <vers num="3.5.9"/>
        <vers num="3.6"/>
        <vers num="3.6.10"/>
        <vers num="3.6.11"/>
        <vers num="3.6.12"/>
        <vers num="3.6.13"/>
        <vers num="3.6.14"/>
        <vers num="3.6.15"/>
        <vers num="3.6.16"/>
        <vers num="3.6.17"/>
        <vers num="3.6.18"/>
        <vers num="3.6.19"/>
        <vers num="3.6.2"/>
        <vers num="3.6.20"/>
        <vers num="3.6.21"/>
        <vers num="3.6.22"/>
        <vers num="3.6.23"/>
        <vers num="3.6.24"/>
        <vers num="3.6.25"/>
        <vers num="3.6.26"/>
        <vers num="3.6.27"/>
        <vers num="3.6.28"/>
        <vers num="3.6.3"/>
        <vers num="3.6.4"/>
        <vers num="3.6.6"/>
        <vers num="3.6.7"/>
        <vers num="3.6.8"/>
        <vers num="3.6.9"/>
        <vers num="4.0" edition="beta1"/>
        <vers num="4.0" edition="beta10"/>
        <vers num="4.0" edition="beta11"/>
        <vers num="4.0" edition="beta12"/>
        <vers num="4.0" edition="beta2"/>
        <vers num="4.0" edition="beta3"/>
        <vers num="4.0" edition="beta4"/>
        <vers num="4.0" edition="beta5"/>
        <vers num="4.0" edition="beta6"/>
        <vers num="4.0" edition="beta7"/>
        <vers num="4.0" edition="beta8"/>
        <vers num="4.0" edition="beta9"/>
        <vers num="4.0.1"/>
        <vers num="5.0"/>
        <vers num="5.0.1"/>
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers num="6.0.2"/>
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="8.0"/>
        <vers num="8.0.1"/>
        <vers num="9.0"/>
        <vers num="9.0.1"/>
      </prod>
      <prod vendor="mozilla" name="firefox_esr">
        <vers num="24.0"/>
        <vers num="24.0.1"/>
        <vers num="24.0.2"/>
        <vers num="24.1.0"/>
        <vers num="24.1.1"/>
        <vers num="24.2"/>
        <vers num="24.3"/>
        <vers num="24.4"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1522" published="2014-04-30" name="CVE-2014-1522" modified="2014-04-30" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:C/I:C/A:C)" CVSS_score="10.0" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="10.0" CVSS_base_score="10.0">
    <desc>
      <descript source="cve">The mozilla::dom::OscillatorNodeEngine::ComputeCustom function in the Web Audio subsystem in Mozilla Firefox before 29.0 and SeaMonkey before 2.26 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read, memory corruption, and application crash) via crafted content.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=995289" source="CONFIRM">https://bugzilla.mozilla.org/show_bug.cgi?id=995289</ref>
      <ref url="http://www.mozilla.org/security/announce/2014/mfsa2014-36.html" source="CONFIRM" adv="1">http://www.mozilla.org/security/announce/2014/mfsa2014-36.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="mozilla" name="firefox">
        <vers num="0.1"/>
        <vers num="0.10"/>
        <vers num="0.10.1"/>
        <vers num="0.2"/>
        <vers num="0.3"/>
        <vers num="0.4"/>
        <vers num="0.5"/>
        <vers num="0.6"/>
        <vers num="0.6.1"/>
        <vers num="0.7"/>
        <vers num="0.7.1"/>
        <vers num="0.8"/>
        <vers num="0.9" edition="rc"/>
        <vers num="0.9.1"/>
        <vers num="0.9.2"/>
        <vers num="0.9.3"/>
        <vers num="1.0" edition="preview_release"/>
        <vers num="1.0.1"/>
        <vers num="1.0.2"/>
        <vers num="1.0.3"/>
        <vers num="1.0.4"/>
        <vers num="1.0.5"/>
        <vers num="1.0.6"/>
        <vers num="1.0.7"/>
        <vers num="1.0.8"/>
        <vers num="1.5" edition="beta1"/>
        <vers num="1.5" edition="beta2"/>
        <vers num="1.5.0.1"/>
        <vers num="1.5.0.10"/>
        <vers num="1.5.0.11"/>
        <vers num="1.5.0.12"/>
        <vers num="1.5.0.2"/>
        <vers num="1.5.0.3"/>
        <vers num="1.5.0.4"/>
        <vers num="1.5.0.5"/>
        <vers num="1.5.0.6"/>
        <vers num="1.5.0.7"/>
        <vers num="1.5.0.8"/>
        <vers num="1.5.0.9"/>
        <vers num="1.5.1"/>
        <vers num="1.5.2"/>
        <vers num="1.5.3"/>
        <vers num="1.5.4"/>
        <vers num="1.5.5"/>
        <vers num="1.5.6"/>
        <vers num="1.5.7"/>
        <vers num="1.5.8"/>
        <vers num="10.0"/>
        <vers num="10.0.1"/>
        <vers num="10.0.10"/>
        <vers num="10.0.11"/>
        <vers num="10.0.12"/>
        <vers num="10.0.2"/>
        <vers num="10.0.3"/>
        <vers num="10.0.4"/>
        <vers num="10.0.5"/>
        <vers num="10.0.6"/>
        <vers num="10.0.7"/>
        <vers num="10.0.8"/>
        <vers num="10.0.9"/>
        <vers num="11.0"/>
        <vers num="12.0" edition="beta6"/>
        <vers num="13.0"/>
        <vers num="13.0.1"/>
        <vers num="14.0"/>
        <vers num="14.0.1"/>
        <vers num="15.0"/>
        <vers num="15.0.1"/>
        <vers num="16.0"/>
        <vers num="16.0.1"/>
        <vers num="16.0.2"/>
        <vers num="17.0.10"/>
        <vers num="17.0.11"/>
        <vers num="17.0.2"/>
        <vers num="17.0.3"/>
        <vers num="17.0.4"/>
        <vers num="17.0.5"/>
        <vers num="17.0.6"/>
        <vers num="17.0.7"/>
        <vers num="17.0.8"/>
        <vers num="17.0.9"/>
        <vers num="18.0"/>
        <vers num="18.0.1"/>
        <vers num="18.0.2"/>
        <vers num="19.0"/>
        <vers num="19.0.1"/>
        <vers num="19.0.2"/>
        <vers num="2.0"/>
        <vers num="2.0.0.1"/>
        <vers num="2.0.0.10"/>
        <vers num="2.0.0.11"/>
        <vers num="2.0.0.12"/>
        <vers num="2.0.0.13"/>
        <vers num="2.0.0.14"/>
        <vers num="2.0.0.15"/>
        <vers num="2.0.0.16"/>
        <vers num="2.0.0.17"/>
        <vers num="2.0.0.18"/>
        <vers num="2.0.0.19"/>
        <vers num="2.0.0.2"/>
        <vers num="2.0.0.20"/>
        <vers num="2.0.0.3"/>
        <vers num="2.0.0.4"/>
        <vers num="2.0.0.5"/>
        <vers num="2.0.0.6"/>
        <vers num="2.0.0.7"/>
        <vers num="2.0.0.8"/>
        <vers num="2.0.0.9"/>
        <vers num="20.0"/>
        <vers num="20.0.1"/>
        <vers num="21.0"/>
        <vers num="23.0"/>
        <vers num="23.0.1"/>
        <vers num="24.0"/>
        <vers num="24.1"/>
        <vers num="24.1.1"/>
        <vers num="25.0"/>
        <vers num="25.0.1"/>
        <vers num="26.0"/>
        <vers num="27.0"/>
        <vers num="27.0.1"/>
        <vers prev="1" num="28.0"/>
        <vers num="3.0"/>
        <vers num="3.0.1"/>
        <vers num="3.0.10"/>
        <vers num="3.0.11"/>
        <vers num="3.0.12"/>
        <vers num="3.0.13"/>
        <vers num="3.0.14"/>
        <vers num="3.0.15"/>
        <vers num="3.0.16"/>
        <vers num="3.0.17"/>
        <vers num="3.0.18"/>
        <vers num="3.0.19"/>
        <vers num="3.0.2"/>
        <vers num="3.0.3"/>
        <vers num="3.0.4"/>
        <vers num="3.0.5"/>
        <vers num="3.0.6"/>
        <vers num="3.0.7"/>
        <vers num="3.0.8"/>
        <vers num="3.0.9"/>
        <vers num="3.5"/>
        <vers num="3.5.1"/>
        <vers num="3.5.10"/>
        <vers num="3.5.11"/>
        <vers num="3.5.12"/>
        <vers num="3.5.13"/>
        <vers num="3.5.14"/>
        <vers num="3.5.15"/>
        <vers num="3.5.16"/>
        <vers num="3.5.17"/>
        <vers num="3.5.18"/>
        <vers num="3.5.19"/>
        <vers num="3.5.2"/>
        <vers num="3.5.3"/>
        <vers num="3.5.4"/>
        <vers num="3.5.5"/>
        <vers num="3.5.6"/>
        <vers num="3.5.7"/>
        <vers num="3.5.8"/>
        <vers num="3.5.9"/>
        <vers num="3.6"/>
        <vers num="3.6.10"/>
        <vers num="3.6.11"/>
        <vers num="3.6.12"/>
        <vers num="3.6.13"/>
        <vers num="3.6.14"/>
        <vers num="3.6.15"/>
        <vers num="3.6.16"/>
        <vers num="3.6.17"/>
        <vers num="3.6.18"/>
        <vers num="3.6.19"/>
        <vers num="3.6.2"/>
        <vers num="3.6.20"/>
        <vers num="3.6.21"/>
        <vers num="3.6.22"/>
        <vers num="3.6.23"/>
        <vers num="3.6.24"/>
        <vers num="3.6.25"/>
        <vers num="3.6.26"/>
        <vers num="3.6.27"/>
        <vers num="3.6.28"/>
        <vers num="3.6.3"/>
        <vers num="3.6.4"/>
        <vers num="3.6.6"/>
        <vers num="3.6.7"/>
        <vers num="3.6.8"/>
        <vers num="3.6.9"/>
        <vers num="4.0" edition="beta1"/>
        <vers num="4.0" edition="beta10"/>
        <vers num="4.0" edition="beta11"/>
        <vers num="4.0" edition="beta12"/>
        <vers num="4.0" edition="beta2"/>
        <vers num="4.0" edition="beta3"/>
        <vers num="4.0" edition="beta4"/>
        <vers num="4.0" edition="beta5"/>
        <vers num="4.0" edition="beta6"/>
        <vers num="4.0" edition="beta7"/>
        <vers num="4.0" edition="beta8"/>
        <vers num="4.0" edition="beta9"/>
        <vers num="4.0.1"/>
        <vers num="5.0"/>
        <vers num="5.0.1"/>
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers num="6.0.2"/>
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="8.0"/>
        <vers num="8.0.1"/>
        <vers num="9.0"/>
        <vers num="9.0.1"/>
      </prod>
      <prod vendor="mozilla" name="seamonkey">
        <vers num="2.0" edition="alpha_1"/>
        <vers num="2.0" edition="alpha_2"/>
        <vers num="2.0" edition="alpha_3"/>
        <vers num="2.0" edition="beta_1"/>
        <vers num="2.0" edition="beta_2"/>
        <vers num="2.0" edition="rc1"/>
        <vers num="2.0" edition="rc2"/>
        <vers num="2.0.1"/>
        <vers num="2.0.10"/>
        <vers num="2.0.11"/>
        <vers num="2.0.12"/>
        <vers num="2.0.13"/>
        <vers num="2.0.14"/>
        <vers num="2.0.2"/>
        <vers num="2.0.3"/>
        <vers num="2.0.4"/>
        <vers num="2.0.5"/>
        <vers num="2.0.6"/>
        <vers num="2.0.7"/>
        <vers num="2.0.8"/>
        <vers num="2.0.9"/>
        <vers num="2.1" edition="alpha1"/>
        <vers num="2.1" edition="alpha2"/>
        <vers num="2.1" edition="alpha3"/>
        <vers num="2.1" edition="beta1"/>
        <vers num="2.1" edition="beta2"/>
        <vers num="2.1" edition="beta3"/>
        <vers num="2.1" edition="rc1"/>
        <vers num="2.1" edition="rc2"/>
        <vers num="2.10" edition="beta1"/>
        <vers num="2.10" edition="beta2"/>
        <vers num="2.10" edition="beta3"/>
        <vers num="2.10.1"/>
        <vers num="2.11" edition="beta1"/>
        <vers num="2.11" edition="beta2"/>
        <vers num="2.11" edition="beta3"/>
        <vers num="2.11" edition="beta4"/>
        <vers num="2.11" edition="beta5"/>
        <vers num="2.11" edition="beta6"/>
        <vers num="2.12" edition="beta1"/>
        <vers num="2.12" edition="beta2"/>
        <vers num="2.12" edition="beta3"/>
        <vers num="2.12" edition="beta4"/>
        <vers num="2.12" edition="beta5"/>
        <vers num="2.12" edition="beta6"/>
        <vers num="2.12.1"/>
        <vers num="2.13" edition="beta1"/>
        <vers num="2.13" edition="beta2"/>
        <vers num="2.13" edition="beta3"/>
        <vers num="2.13" edition="beta4"/>
        <vers num="2.13" edition="beta5"/>
        <vers num="2.13" edition="beta6"/>
        <vers num="2.13.1"/>
        <vers num="2.13.2"/>
        <vers num="2.14" edition="beta1"/>
        <vers num="2.14" edition="beta2"/>
        <vers num="2.14" edition="beta3"/>
        <vers num="2.14" edition="beta4"/>
        <vers num="2.14" edition="beta5"/>
        <vers num="2.15" edition="beta1"/>
        <vers num="2.15" edition="beta2"/>
        <vers num="2.15" edition="beta3"/>
        <vers num="2.15" edition="beta4"/>
        <vers num="2.15" edition="beta5"/>
        <vers num="2.15" edition="beta6"/>
        <vers num="2.15.1"/>
        <vers num="2.15.2"/>
        <vers num="2.16" edition="beta1"/>
        <vers num="2.16" edition="beta2"/>
        <vers num="2.16" edition="beta3"/>
        <vers num="2.16" edition="beta4"/>
        <vers num="2.16" edition="beta5"/>
        <vers num="2.16.1"/>
        <vers num="2.16.2"/>
        <vers num="2.17" edition="beta1"/>
        <vers num="2.17" edition="beta2"/>
        <vers num="2.17" edition="beta3"/>
        <vers num="2.17" edition="beta4"/>
        <vers num="2.17.1"/>
        <vers num="2.18" edition="beta1"/>
        <vers num="2.18" edition="beta2"/>
        <vers num="2.18" edition="beta3"/>
        <vers num="2.18" edition="beta4"/>
        <vers num="2.19" edition="beta1"/>
        <vers num="2.19" edition="beta2"/>
        <vers num="2.2" edition="beta1"/>
        <vers num="2.2" edition="beta2"/>
        <vers num="2.2" edition="beta3"/>
        <vers num="2.20" edition="beta1"/>
        <vers num="2.20" edition="beta2"/>
        <vers num="2.20" edition="beta3"/>
        <vers num="2.21" edition="beta1"/>
        <vers num="2.21" edition="beta2"/>
        <vers num="2.22" edition="beta1"/>
        <vers num="2.22" edition="beta2"/>
        <vers num="2.22.1"/>
        <vers num="2.23" edition="beta1"/>
        <vers num="2.23" edition="beta2"/>
        <vers num="2.24" edition="beta1"/>
        <vers num="2.25" edition="-"/>
        <vers num="2.25" edition="beta1"/>
        <vers num="2.25" edition="beta2"/>
        <vers num="2.25" edition="beta3"/>
        <vers prev="1" num="2.26" edition="rc1"/>
        <vers num="2.3" edition="beta1"/>
        <vers num="2.3" edition="beta2"/>
        <vers num="2.3" edition="beta3"/>
        <vers num="2.3.1"/>
        <vers num="2.3.2"/>
        <vers num="2.3.3"/>
        <vers num="2.4" edition="beta1"/>
        <vers num="2.4" edition="beta2"/>
        <vers num="2.4" edition="beta3"/>
        <vers num="2.4.1"/>
        <vers num="2.5" edition="beta1"/>
        <vers num="2.5" edition="beta2"/>
        <vers num="2.5" edition="beta3"/>
        <vers num="2.5" edition="beta4"/>
        <vers num="2.6" edition="beta1"/>
        <vers num="2.6" edition="beta2"/>
        <vers num="2.6" edition="beta3"/>
        <vers num="2.6" edition="beta4"/>
        <vers num="2.6.1"/>
        <vers num="2.7" edition="beta1"/>
        <vers num="2.7" edition="beta2"/>
        <vers num="2.7" edition="beta3"/>
        <vers num="2.7" edition="beta4"/>
        <vers num="2.7" edition="beta5"/>
        <vers num="2.7.1"/>
        <vers num="2.7.2"/>
        <vers num="2.8" edition="beta1"/>
        <vers num="2.8" edition="beta2"/>
        <vers num="2.8" edition="beta3"/>
        <vers num="2.8" edition="beta4"/>
        <vers num="2.8" edition="beta5"/>
        <vers num="2.8" edition="beta6"/>
        <vers num="2.9" edition="beta1"/>
        <vers num="2.9" edition="beta2"/>
        <vers num="2.9" edition="beta3"/>
        <vers num="2.9" edition="beta4"/>
        <vers num="2.9.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1523" published="2014-04-30" name="CVE-2014-1523" modified="2014-04-30" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:N/A:P)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Heap-based buffer overflow in the read_u32 function in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted JPEG image.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=969226" source="CONFIRM">https://bugzilla.mozilla.org/show_bug.cgi?id=969226</ref>
      <ref url="http://www.mozilla.org/security/announce/2014/mfsa2014-37.html" source="CONFIRM" adv="1">http://www.mozilla.org/security/announce/2014/mfsa2014-37.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="mozilla" name="firefox">
        <vers num="0.1"/>
        <vers num="0.10"/>
        <vers num="0.10.1"/>
        <vers num="0.2"/>
        <vers num="0.3"/>
        <vers num="0.4"/>
        <vers num="0.5"/>
        <vers num="0.6"/>
        <vers num="0.6.1"/>
        <vers num="0.7"/>
        <vers num="0.7.1"/>
        <vers num="0.8"/>
        <vers num="0.9" edition="rc"/>
        <vers num="0.9.1"/>
        <vers num="0.9.2"/>
        <vers num="0.9.3"/>
        <vers num="1.0" edition="preview_release"/>
        <vers num="1.0.1"/>
        <vers num="1.0.2"/>
        <vers num="1.0.3"/>
        <vers num="1.0.4"/>
        <vers num="1.0.5"/>
        <vers num="1.0.6"/>
        <vers num="1.0.7"/>
        <vers num="1.0.8"/>
        <vers num="1.5" edition="beta1"/>
        <vers num="1.5" edition="beta2"/>
        <vers num="1.5.0.1"/>
        <vers num="1.5.0.10"/>
        <vers num="1.5.0.11"/>
        <vers num="1.5.0.12"/>
        <vers num="1.5.0.2"/>
        <vers num="1.5.0.3"/>
        <vers num="1.5.0.4"/>
        <vers num="1.5.0.5"/>
        <vers num="1.5.0.6"/>
        <vers num="1.5.0.7"/>
        <vers num="1.5.0.8"/>
        <vers num="1.5.0.9"/>
        <vers num="1.5.1"/>
        <vers num="1.5.2"/>
        <vers num="1.5.3"/>
        <vers num="1.5.4"/>
        <vers num="1.5.5"/>
        <vers num="1.5.6"/>
        <vers num="1.5.7"/>
        <vers num="1.5.8"/>
        <vers num="10.0"/>
        <vers num="10.0.1"/>
        <vers num="10.0.10"/>
        <vers num="10.0.11"/>
        <vers num="10.0.12"/>
        <vers num="10.0.2"/>
        <vers num="10.0.3"/>
        <vers num="10.0.4"/>
        <vers num="10.0.5"/>
        <vers num="10.0.6"/>
        <vers num="10.0.7"/>
        <vers num="10.0.8"/>
        <vers num="10.0.9"/>
        <vers num="11.0"/>
        <vers num="12.0" edition="beta6"/>
        <vers num="13.0"/>
        <vers num="13.0.1"/>
        <vers num="14.0"/>
        <vers num="14.0.1"/>
        <vers num="15.0"/>
        <vers num="15.0.1"/>
        <vers num="16.0"/>
        <vers num="16.0.1"/>
        <vers num="16.0.2"/>
        <vers num="17.0.10"/>
        <vers num="17.0.11"/>
        <vers num="17.0.2"/>
        <vers num="17.0.3"/>
        <vers num="17.0.4"/>
        <vers num="17.0.5"/>
        <vers num="17.0.6"/>
        <vers num="17.0.7"/>
        <vers num="17.0.8"/>
        <vers num="17.0.9"/>
        <vers num="18.0"/>
        <vers num="18.0.1"/>
        <vers num="18.0.2"/>
        <vers num="19.0"/>
        <vers num="19.0.1"/>
        <vers num="19.0.2"/>
        <vers num="2.0"/>
        <vers num="2.0.0.1"/>
        <vers num="2.0.0.10"/>
        <vers num="2.0.0.11"/>
        <vers num="2.0.0.12"/>
        <vers num="2.0.0.13"/>
        <vers num="2.0.0.14"/>
        <vers num="2.0.0.15"/>
        <vers num="2.0.0.16"/>
        <vers num="2.0.0.17"/>
        <vers num="2.0.0.18"/>
        <vers num="2.0.0.19"/>
        <vers num="2.0.0.2"/>
        <vers num="2.0.0.20"/>
        <vers num="2.0.0.3"/>
        <vers num="2.0.0.4"/>
        <vers num="2.0.0.5"/>
        <vers num="2.0.0.6"/>
        <vers num="2.0.0.7"/>
        <vers num="2.0.0.8"/>
        <vers num="2.0.0.9"/>
        <vers num="20.0"/>
        <vers num="20.0.1"/>
        <vers num="21.0"/>
        <vers num="23.0"/>
        <vers num="23.0.1"/>
        <vers num="24.0"/>
        <vers num="24.1"/>
        <vers num="24.1.1"/>
        <vers num="25.0"/>
        <vers num="25.0.1"/>
        <vers num="26.0"/>
        <vers num="27.0"/>
        <vers num="27.0.1"/>
        <vers prev="1" num="28.0"/>
        <vers num="3.0"/>
        <vers num="3.0.1"/>
        <vers num="3.0.10"/>
        <vers num="3.0.11"/>
        <vers num="3.0.12"/>
        <vers num="3.0.13"/>
        <vers num="3.0.14"/>
        <vers num="3.0.15"/>
        <vers num="3.0.16"/>
        <vers num="3.0.17"/>
        <vers num="3.0.18"/>
        <vers num="3.0.19"/>
        <vers num="3.0.2"/>
        <vers num="3.0.3"/>
        <vers num="3.0.4"/>
        <vers num="3.0.5"/>
        <vers num="3.0.6"/>
        <vers num="3.0.7"/>
        <vers num="3.0.8"/>
        <vers num="3.0.9"/>
        <vers num="3.5"/>
        <vers num="3.5.1"/>
        <vers num="3.5.10"/>
        <vers num="3.5.11"/>
        <vers num="3.5.12"/>
        <vers num="3.5.13"/>
        <vers num="3.5.14"/>
        <vers num="3.5.15"/>
        <vers num="3.5.16"/>
        <vers num="3.5.17"/>
        <vers num="3.5.18"/>
        <vers num="3.5.19"/>
        <vers num="3.5.2"/>
        <vers num="3.5.3"/>
        <vers num="3.5.4"/>
        <vers num="3.5.5"/>
        <vers num="3.5.6"/>
        <vers num="3.5.7"/>
        <vers num="3.5.8"/>
        <vers num="3.5.9"/>
        <vers num="3.6"/>
        <vers num="3.6.10"/>
        <vers num="3.6.11"/>
        <vers num="3.6.12"/>
        <vers num="3.6.13"/>
        <vers num="3.6.14"/>
        <vers num="3.6.15"/>
        <vers num="3.6.16"/>
        <vers num="3.6.17"/>
        <vers num="3.6.18"/>
        <vers num="3.6.19"/>
        <vers num="3.6.2"/>
        <vers num="3.6.20"/>
        <vers num="3.6.21"/>
        <vers num="3.6.22"/>
        <vers num="3.6.23"/>
        <vers num="3.6.24"/>
        <vers num="3.6.25"/>
        <vers num="3.6.26"/>
        <vers num="3.6.27"/>
        <vers num="3.6.28"/>
        <vers num="3.6.3"/>
        <vers num="3.6.4"/>
        <vers num="3.6.6"/>
        <vers num="3.6.7"/>
        <vers num="3.6.8"/>
        <vers num="3.6.9"/>
        <vers num="4.0" edition="beta1"/>
        <vers num="4.0" edition="beta10"/>
        <vers num="4.0" edition="beta11"/>
        <vers num="4.0" edition="beta12"/>
        <vers num="4.0" edition="beta2"/>
        <vers num="4.0" edition="beta3"/>
        <vers num="4.0" edition="beta4"/>
        <vers num="4.0" edition="beta5"/>
        <vers num="4.0" edition="beta6"/>
        <vers num="4.0" edition="beta7"/>
        <vers num="4.0" edition="beta8"/>
        <vers num="4.0" edition="beta9"/>
        <vers num="4.0.1"/>
        <vers num="5.0"/>
        <vers num="5.0.1"/>
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers num="6.0.2"/>
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="8.0"/>
        <vers num="8.0.1"/>
        <vers num="9.0"/>
        <vers num="9.0.1"/>
      </prod>
      <prod vendor="mozilla" name="firefox_esr">
        <vers num="24.0"/>
        <vers num="24.0.1"/>
        <vers num="24.0.2"/>
        <vers num="24.1.0"/>
        <vers num="24.1.1"/>
        <vers num="24.2"/>
        <vers num="24.3"/>
        <vers num="24.4"/>
      </prod>
      <prod vendor="mozilla" name="seamonkey">
        <vers num="2.0" edition="alpha_1"/>
        <vers num="2.0" edition="alpha_2"/>
        <vers num="2.0" edition="alpha_3"/>
        <vers num="2.0" edition="beta_1"/>
        <vers num="2.0" edition="beta_2"/>
        <vers num="2.0" edition="rc1"/>
        <vers num="2.0" edition="rc2"/>
        <vers num="2.0.1"/>
        <vers num="2.0.10"/>
        <vers num="2.0.11"/>
        <vers num="2.0.12"/>
        <vers num="2.0.13"/>
        <vers num="2.0.14"/>
        <vers num="2.0.2"/>
        <vers num="2.0.3"/>
        <vers num="2.0.4"/>
        <vers num="2.0.5"/>
        <vers num="2.0.6"/>
        <vers num="2.0.7"/>
        <vers num="2.0.8"/>
        <vers num="2.0.9"/>
        <vers num="2.1" edition="alpha1"/>
        <vers num="2.1" edition="alpha2"/>
        <vers num="2.1" edition="alpha3"/>
        <vers num="2.1" edition="beta1"/>
        <vers num="2.1" edition="beta2"/>
        <vers num="2.1" edition="beta3"/>
        <vers num="2.1" edition="rc1"/>
        <vers num="2.1" edition="rc2"/>
        <vers num="2.10" edition="beta1"/>
        <vers num="2.10" edition="beta2"/>
        <vers num="2.10" edition="beta3"/>
        <vers num="2.10.1"/>
        <vers num="2.11" edition="beta1"/>
        <vers num="2.11" edition="beta2"/>
        <vers num="2.11" edition="beta3"/>
        <vers num="2.11" edition="beta4"/>
        <vers num="2.11" edition="beta5"/>
        <vers num="2.11" edition="beta6"/>
        <vers num="2.12" edition="beta1"/>
        <vers num="2.12" edition="beta2"/>
        <vers num="2.12" edition="beta3"/>
        <vers num="2.12" edition="beta4"/>
        <vers num="2.12" edition="beta5"/>
        <vers num="2.12" edition="beta6"/>
        <vers num="2.12.1"/>
        <vers num="2.13" edition="beta1"/>
        <vers num="2.13" edition="beta2"/>
        <vers num="2.13" edition="beta3"/>
        <vers num="2.13" edition="beta4"/>
        <vers num="2.13" edition="beta5"/>
        <vers num="2.13" edition="beta6"/>
        <vers num="2.13.1"/>
        <vers num="2.13.2"/>
        <vers num="2.14" edition="beta1"/>
        <vers num="2.14" edition="beta2"/>
        <vers num="2.14" edition="beta3"/>
        <vers num="2.14" edition="beta4"/>
        <vers num="2.14" edition="beta5"/>
        <vers num="2.15" edition="beta1"/>
        <vers num="2.15" edition="beta2"/>
        <vers num="2.15" edition="beta3"/>
        <vers num="2.15" edition="beta4"/>
        <vers num="2.15" edition="beta5"/>
        <vers num="2.15" edition="beta6"/>
        <vers num="2.15.1"/>
        <vers num="2.15.2"/>
        <vers num="2.16" edition="beta1"/>
        <vers num="2.16" edition="beta2"/>
        <vers num="2.16" edition="beta3"/>
        <vers num="2.16" edition="beta4"/>
        <vers num="2.16" edition="beta5"/>
        <vers num="2.16.1"/>
        <vers num="2.16.2"/>
        <vers num="2.17" edition="beta1"/>
        <vers num="2.17" edition="beta2"/>
        <vers num="2.17" edition="beta3"/>
        <vers num="2.17" edition="beta4"/>
        <vers num="2.17.1"/>
        <vers num="2.18" edition="beta1"/>
        <vers num="2.18" edition="beta2"/>
        <vers num="2.18" edition="beta3"/>
        <vers num="2.18" edition="beta4"/>
        <vers num="2.19" edition="beta1"/>
        <vers num="2.19" edition="beta2"/>
        <vers num="2.2" edition="beta1"/>
        <vers num="2.2" edition="beta2"/>
        <vers num="2.2" edition="beta3"/>
        <vers num="2.20" edition="beta1"/>
        <vers num="2.20" edition="beta2"/>
        <vers num="2.20" edition="beta3"/>
        <vers num="2.21" edition="beta1"/>
        <vers num="2.21" edition="beta2"/>
        <vers num="2.22" edition="beta1"/>
        <vers num="2.22" edition="beta2"/>
        <vers num="2.22.1"/>
        <vers num="2.23" edition="beta1"/>
        <vers num="2.23" edition="beta2"/>
        <vers num="2.24" edition="beta1"/>
        <vers num="2.25" edition="-"/>
        <vers num="2.25" edition="beta1"/>
        <vers num="2.25" edition="beta2"/>
        <vers num="2.25" edition="beta3"/>
        <vers prev="1" num="2.26" edition="rc1"/>
        <vers num="2.3" edition="beta1"/>
        <vers num="2.3" edition="beta2"/>
        <vers num="2.3" edition="beta3"/>
        <vers num="2.3.1"/>
        <vers num="2.3.2"/>
        <vers num="2.3.3"/>
        <vers num="2.4" edition="beta1"/>
        <vers num="2.4" edition="beta2"/>
        <vers num="2.4" edition="beta3"/>
        <vers num="2.4.1"/>
        <vers num="2.5" edition="beta1"/>
        <vers num="2.5" edition="beta2"/>
        <vers num="2.5" edition="beta3"/>
        <vers num="2.5" edition="beta4"/>
        <vers num="2.6" edition="beta1"/>
        <vers num="2.6" edition="beta2"/>
        <vers num="2.6" edition="beta3"/>
        <vers num="2.6" edition="beta4"/>
        <vers num="2.6.1"/>
        <vers num="2.7" edition="beta1"/>
        <vers num="2.7" edition="beta2"/>
        <vers num="2.7" edition="beta3"/>
        <vers num="2.7" edition="beta4"/>
        <vers num="2.7" edition="beta5"/>
        <vers num="2.7.1"/>
        <vers num="2.7.2"/>
        <vers num="2.8" edition="beta1"/>
        <vers num="2.8" edition="beta2"/>
        <vers num="2.8" edition="beta3"/>
        <vers num="2.8" edition="beta4"/>
        <vers num="2.8" edition="beta5"/>
        <vers num="2.8" edition="beta6"/>
        <vers num="2.9" edition="beta1"/>
        <vers num="2.9" edition="beta2"/>
        <vers num="2.9" edition="beta3"/>
        <vers num="2.9" edition="beta4"/>
        <vers num="2.9.1"/>
      </prod>
      <prod vendor="mozilla" name="thunderbird">
        <vers num="0.1"/>
        <vers num="0.2"/>
        <vers num="0.3"/>
        <vers num="0.4"/>
        <vers num="0.5"/>
        <vers num="0.6"/>
        <vers num="0.7"/>
        <vers num="0.7.1"/>
        <vers num="0.7.2"/>
        <vers num="0.7.3"/>
        <vers num="0.8"/>
        <vers num="0.9"/>
        <vers num="1.0"/>
        <vers num="1.0.1"/>
        <vers num="1.0.2"/>
        <vers num="1.0.3"/>
        <vers num="1.0.4"/>
        <vers num="1.0.5" edition="beta"/>
        <vers num="1.0.6"/>
        <vers num="1.0.7"/>
        <vers num="1.0.8"/>
        <vers num="1.5" edition="beta2"/>
        <vers num="1.5.0.1"/>
        <vers num="1.5.0.10"/>
        <vers num="1.5.0.11"/>
        <vers num="1.5.0.12"/>
        <vers num="1.5.0.13"/>
        <vers num="1.5.0.14"/>
        <vers num="1.5.0.2"/>
        <vers num="1.5.0.3"/>
        <vers num="1.5.0.4"/>
        <vers num="1.5.0.5"/>
        <vers num="1.5.0.6"/>
        <vers num="1.5.0.7"/>
        <vers num="1.5.0.8"/>
        <vers num="1.5.0.9"/>
        <vers num="1.5.1"/>
        <vers num="1.5.2"/>
        <vers num="1.7.1"/>
        <vers num="1.7.3"/>
        <vers num="10.0"/>
        <vers num="10.0.1"/>
        <vers num="10.0.2"/>
        <vers num="10.0.3"/>
        <vers num="10.0.4"/>
        <vers num="11.0"/>
        <vers num="11.0.1"/>
        <vers num="12.0"/>
        <vers num="12.0.1"/>
        <vers num="13.0"/>
        <vers num="13.0.1"/>
        <vers num="14.0"/>
        <vers num="15.0"/>
        <vers num="15.0.1"/>
        <vers num="16.0"/>
        <vers num="16.0.1"/>
        <vers num="16.0.2"/>
        <vers num="17.0"/>
        <vers num="17.0.1"/>
        <vers num="17.0.2"/>
        <vers num="17.0.3"/>
        <vers num="17.0.4"/>
        <vers num="17.0.5"/>
        <vers num="17.0.6"/>
        <vers num="17.0.7"/>
        <vers num="17.0.8"/>
        <vers num="2.0"/>
        <vers num="2.0.0.0"/>
        <vers num="2.0.0.1"/>
        <vers num="2.0.0.11"/>
        <vers num="2.0.0.12"/>
        <vers num="2.0.0.13"/>
        <vers num="2.0.0.14"/>
        <vers num="2.0.0.15"/>
        <vers num="2.0.0.16"/>
        <vers num="2.0.0.17"/>
        <vers num="2.0.0.18"/>
        <vers num="2.0.0.19"/>
        <vers num="2.0.0.2"/>
        <vers num="2.0.0.20"/>
        <vers num="2.0.0.21"/>
        <vers num="2.0.0.22"/>
        <vers num="2.0.0.23"/>
        <vers num="2.0.0.3"/>
        <vers num="2.0.0.4"/>
        <vers num="2.0.0.5"/>
        <vers num="2.0.0.6"/>
        <vers num="2.0.0.7"/>
        <vers num="2.0.0.8"/>
        <vers num="2.0.0.9"/>
        <vers num="24.0"/>
        <vers num="24.0.1"/>
        <vers num="24.1"/>
        <vers num="24.1.1"/>
        <vers num="24.2"/>
        <vers num="24.3"/>
        <vers prev="1" num="24.4"/>
        <vers num="3.0"/>
        <vers num="3.0.1"/>
        <vers num="3.0.10"/>
        <vers num="3.0.11"/>
        <vers num="3.0.2"/>
        <vers num="3.0.3"/>
        <vers num="3.0.4"/>
        <vers num="3.0.5"/>
        <vers num="3.0.6"/>
        <vers num="3.0.7"/>
        <vers num="3.0.8"/>
        <vers num="3.0.9"/>
        <vers num="3.1"/>
        <vers num="3.1.1"/>
        <vers num="3.1.10"/>
        <vers num="3.1.11"/>
        <vers num="3.1.12"/>
        <vers num="3.1.13"/>
        <vers num="3.1.14"/>
        <vers num="3.1.15"/>
        <vers num="3.1.16"/>
        <vers num="3.1.17"/>
        <vers num="3.1.2"/>
        <vers num="3.1.3"/>
        <vers num="3.1.4"/>
        <vers num="3.1.5"/>
        <vers num="3.1.6"/>
        <vers num="3.1.7"/>
        <vers num="3.1.8"/>
        <vers num="3.1.9"/>
        <vers num="5.0"/>
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers num="6.0.2"/>
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="8.0"/>
        <vers num="9.0"/>
        <vers num="9.0.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1524" published="2014-04-30" name="CVE-2014-1524" modified="2014-04-30" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:C/I:C/A:C)" CVSS_score="10.0" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="10.0" CVSS_base_score="10.0">
    <desc>
      <descript source="cve">The nsXBLProtoImpl::InstallImplementation function in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 does not properly check whether objects are XBL objects, which allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow) via crafted JavaScript code that accesses a non-XBL object as if it were an XBL object.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=989183" source="CONFIRM">https://bugzilla.mozilla.org/show_bug.cgi?id=989183</ref>
      <ref url="http://www.mozilla.org/security/announce/2014/mfsa2014-38.html" source="CONFIRM" adv="1">http://www.mozilla.org/security/announce/2014/mfsa2014-38.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="mozilla" name="firefox">
        <vers num="0.1"/>
        <vers num="0.10"/>
        <vers num="0.10.1"/>
        <vers num="0.2"/>
        <vers num="0.3"/>
        <vers num="0.4"/>
        <vers num="0.5"/>
        <vers num="0.6"/>
        <vers num="0.6.1"/>
        <vers num="0.7"/>
        <vers num="0.7.1"/>
        <vers num="0.8"/>
        <vers num="0.9" edition="rc"/>
        <vers num="0.9.1"/>
        <vers num="0.9.2"/>
        <vers num="0.9.3"/>
        <vers num="1.0" edition="preview_release"/>
        <vers num="1.0.1"/>
        <vers num="1.0.2"/>
        <vers num="1.0.3"/>
        <vers num="1.0.4"/>
        <vers num="1.0.5"/>
        <vers num="1.0.6"/>
        <vers num="1.0.7"/>
        <vers num="1.0.8"/>
        <vers num="1.5" edition="beta1"/>
        <vers num="1.5" edition="beta2"/>
        <vers num="1.5.0.1"/>
        <vers num="1.5.0.10"/>
        <vers num="1.5.0.11"/>
        <vers num="1.5.0.12"/>
        <vers num="1.5.0.2"/>
        <vers num="1.5.0.3"/>
        <vers num="1.5.0.4"/>
        <vers num="1.5.0.5"/>
        <vers num="1.5.0.6"/>
        <vers num="1.5.0.7"/>
        <vers num="1.5.0.8"/>
        <vers num="1.5.0.9"/>
        <vers num="1.5.1"/>
        <vers num="1.5.2"/>
        <vers num="1.5.3"/>
        <vers num="1.5.4"/>
        <vers num="1.5.5"/>
        <vers num="1.5.6"/>
        <vers num="1.5.7"/>
        <vers num="1.5.8"/>
        <vers num="10.0"/>
        <vers num="10.0.1"/>
        <vers num="10.0.10"/>
        <vers num="10.0.11"/>
        <vers num="10.0.12"/>
        <vers num="10.0.2"/>
        <vers num="10.0.3"/>
        <vers num="10.0.4"/>
        <vers num="10.0.5"/>
        <vers num="10.0.6"/>
        <vers num="10.0.7"/>
        <vers num="10.0.8"/>
        <vers num="10.0.9"/>
        <vers num="11.0"/>
        <vers num="12.0" edition="beta6"/>
        <vers num="13.0"/>
        <vers num="13.0.1"/>
        <vers num="14.0"/>
        <vers num="14.0.1"/>
        <vers num="15.0"/>
        <vers num="15.0.1"/>
        <vers num="16.0"/>
        <vers num="16.0.1"/>
        <vers num="16.0.2"/>
        <vers num="17.0.10"/>
        <vers num="17.0.11"/>
        <vers num="17.0.2"/>
        <vers num="17.0.3"/>
        <vers num="17.0.4"/>
        <vers num="17.0.5"/>
        <vers num="17.0.6"/>
        <vers num="17.0.7"/>
        <vers num="17.0.8"/>
        <vers num="17.0.9"/>
        <vers num="18.0"/>
        <vers num="18.0.1"/>
        <vers num="18.0.2"/>
        <vers num="19.0"/>
        <vers num="19.0.1"/>
        <vers num="19.0.2"/>
        <vers num="2.0"/>
        <vers num="2.0.0.1"/>
        <vers num="2.0.0.10"/>
        <vers num="2.0.0.11"/>
        <vers num="2.0.0.12"/>
        <vers num="2.0.0.13"/>
        <vers num="2.0.0.14"/>
        <vers num="2.0.0.15"/>
        <vers num="2.0.0.16"/>
        <vers num="2.0.0.17"/>
        <vers num="2.0.0.18"/>
        <vers num="2.0.0.19"/>
        <vers num="2.0.0.2"/>
        <vers num="2.0.0.20"/>
        <vers num="2.0.0.3"/>
        <vers num="2.0.0.4"/>
        <vers num="2.0.0.5"/>
        <vers num="2.0.0.6"/>
        <vers num="2.0.0.7"/>
        <vers num="2.0.0.8"/>
        <vers num="2.0.0.9"/>
        <vers num="20.0"/>
        <vers num="20.0.1"/>
        <vers num="21.0"/>
        <vers num="23.0"/>
        <vers num="23.0.1"/>
        <vers num="24.0"/>
        <vers num="24.1"/>
        <vers num="24.1.1"/>
        <vers num="25.0"/>
        <vers num="25.0.1"/>
        <vers num="26.0"/>
        <vers num="27.0"/>
        <vers num="27.0.1"/>
        <vers prev="1" num="28.0"/>
        <vers num="3.0"/>
        <vers num="3.0.1"/>
        <vers num="3.0.10"/>
        <vers num="3.0.11"/>
        <vers num="3.0.12"/>
        <vers num="3.0.13"/>
        <vers num="3.0.14"/>
        <vers num="3.0.15"/>
        <vers num="3.0.16"/>
        <vers num="3.0.17"/>
        <vers num="3.0.18"/>
        <vers num="3.0.19"/>
        <vers num="3.0.2"/>
        <vers num="3.0.3"/>
        <vers num="3.0.4"/>
        <vers num="3.0.5"/>
        <vers num="3.0.6"/>
        <vers num="3.0.7"/>
        <vers num="3.0.8"/>
        <vers num="3.0.9"/>
        <vers num="3.5"/>
        <vers num="3.5.1"/>
        <vers num="3.5.10"/>
        <vers num="3.5.11"/>
        <vers num="3.5.12"/>
        <vers num="3.5.13"/>
        <vers num="3.5.14"/>
        <vers num="3.5.15"/>
        <vers num="3.5.16"/>
        <vers num="3.5.17"/>
        <vers num="3.5.18"/>
        <vers num="3.5.19"/>
        <vers num="3.5.2"/>
        <vers num="3.5.3"/>
        <vers num="3.5.4"/>
        <vers num="3.5.5"/>
        <vers num="3.5.6"/>
        <vers num="3.5.7"/>
        <vers num="3.5.8"/>
        <vers num="3.5.9"/>
        <vers num="3.6"/>
        <vers num="3.6.10"/>
        <vers num="3.6.11"/>
        <vers num="3.6.12"/>
        <vers num="3.6.13"/>
        <vers num="3.6.14"/>
        <vers num="3.6.15"/>
        <vers num="3.6.16"/>
        <vers num="3.6.17"/>
        <vers num="3.6.18"/>
        <vers num="3.6.19"/>
        <vers num="3.6.2"/>
        <vers num="3.6.20"/>
        <vers num="3.6.21"/>
        <vers num="3.6.22"/>
        <vers num="3.6.23"/>
        <vers num="3.6.24"/>
        <vers num="3.6.25"/>
        <vers num="3.6.26"/>
        <vers num="3.6.27"/>
        <vers num="3.6.28"/>
        <vers num="3.6.3"/>
        <vers num="3.6.4"/>
        <vers num="3.6.6"/>
        <vers num="3.6.7"/>
        <vers num="3.6.8"/>
        <vers num="3.6.9"/>
        <vers num="4.0" edition="beta1"/>
        <vers num="4.0" edition="beta10"/>
        <vers num="4.0" edition="beta11"/>
        <vers num="4.0" edition="beta12"/>
        <vers num="4.0" edition="beta2"/>
        <vers num="4.0" edition="beta3"/>
        <vers num="4.0" edition="beta4"/>
        <vers num="4.0" edition="beta5"/>
        <vers num="4.0" edition="beta6"/>
        <vers num="4.0" edition="beta7"/>
        <vers num="4.0" edition="beta8"/>
        <vers num="4.0" edition="beta9"/>
        <vers num="4.0.1"/>
        <vers num="5.0"/>
        <vers num="5.0.1"/>
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers num="6.0.2"/>
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="8.0"/>
        <vers num="8.0.1"/>
        <vers num="9.0"/>
        <vers num="9.0.1"/>
      </prod>
      <prod vendor="mozilla" name="firefox_esr">
        <vers num="24.0"/>
        <vers num="24.0.1"/>
        <vers num="24.0.2"/>
        <vers num="24.1.0"/>
        <vers num="24.1.1"/>
        <vers num="24.2"/>
        <vers num="24.3"/>
        <vers num="24.4"/>
      </prod>
      <prod vendor="mozilla" name="seamonkey">
        <vers num="2.0" edition="alpha_1"/>
        <vers num="2.0" edition="alpha_2"/>
        <vers num="2.0" edition="alpha_3"/>
        <vers num="2.0" edition="beta_1"/>
        <vers num="2.0" edition="beta_2"/>
        <vers num="2.0" edition="rc1"/>
        <vers num="2.0" edition="rc2"/>
        <vers num="2.0.1"/>
        <vers num="2.0.10"/>
        <vers num="2.0.11"/>
        <vers num="2.0.12"/>
        <vers num="2.0.13"/>
        <vers num="2.0.14"/>
        <vers num="2.0.2"/>
        <vers num="2.0.3"/>
        <vers num="2.0.4"/>
        <vers num="2.0.5"/>
        <vers num="2.0.6"/>
        <vers num="2.0.7"/>
        <vers num="2.0.8"/>
        <vers num="2.0.9"/>
        <vers num="2.1" edition="alpha1"/>
        <vers num="2.1" edition="alpha2"/>
        <vers num="2.1" edition="alpha3"/>
        <vers num="2.1" edition="beta1"/>
        <vers num="2.1" edition="beta2"/>
        <vers num="2.1" edition="beta3"/>
        <vers num="2.1" edition="rc1"/>
        <vers num="2.1" edition="rc2"/>
        <vers num="2.10" edition="beta1"/>
        <vers num="2.10" edition="beta2"/>
        <vers num="2.10" edition="beta3"/>
        <vers num="2.10.1"/>
        <vers num="2.11" edition="beta1"/>
        <vers num="2.11" edition="beta2"/>
        <vers num="2.11" edition="beta3"/>
        <vers num="2.11" edition="beta4"/>
        <vers num="2.11" edition="beta5"/>
        <vers num="2.11" edition="beta6"/>
        <vers num="2.12" edition="beta1"/>
        <vers num="2.12" edition="beta2"/>
        <vers num="2.12" edition="beta3"/>
        <vers num="2.12" edition="beta4"/>
        <vers num="2.12" edition="beta5"/>
        <vers num="2.12" edition="beta6"/>
        <vers num="2.12.1"/>
        <vers num="2.13" edition="beta1"/>
        <vers num="2.13" edition="beta2"/>
        <vers num="2.13" edition="beta3"/>
        <vers num="2.13" edition="beta4"/>
        <vers num="2.13" edition="beta5"/>
        <vers num="2.13" edition="beta6"/>
        <vers num="2.13.1"/>
        <vers num="2.13.2"/>
        <vers num="2.14" edition="beta1"/>
        <vers num="2.14" edition="beta2"/>
        <vers num="2.14" edition="beta3"/>
        <vers num="2.14" edition="beta4"/>
        <vers num="2.14" edition="beta5"/>
        <vers num="2.15" edition="beta1"/>
        <vers num="2.15" edition="beta2"/>
        <vers num="2.15" edition="beta3"/>
        <vers num="2.15" edition="beta4"/>
        <vers num="2.15" edition="beta5"/>
        <vers num="2.15" edition="beta6"/>
        <vers num="2.15.1"/>
        <vers num="2.15.2"/>
        <vers num="2.16" edition="beta1"/>
        <vers num="2.16" edition="beta2"/>
        <vers num="2.16" edition="beta3"/>
        <vers num="2.16" edition="beta4"/>
        <vers num="2.16" edition="beta5"/>
        <vers num="2.16.1"/>
        <vers num="2.16.2"/>
        <vers num="2.17" edition="beta1"/>
        <vers num="2.17" edition="beta2"/>
        <vers num="2.17" edition="beta3"/>
        <vers num="2.17" edition="beta4"/>
        <vers num="2.17.1"/>
        <vers num="2.18" edition="beta1"/>
        <vers num="2.18" edition="beta2"/>
        <vers num="2.18" edition="beta3"/>
        <vers num="2.18" edition="beta4"/>
        <vers num="2.19" edition="beta1"/>
        <vers num="2.19" edition="beta2"/>
        <vers num="2.2" edition="beta1"/>
        <vers num="2.2" edition="beta2"/>
        <vers num="2.2" edition="beta3"/>
        <vers num="2.20" edition="beta1"/>
        <vers num="2.20" edition="beta2"/>
        <vers num="2.20" edition="beta3"/>
        <vers num="2.21" edition="beta1"/>
        <vers num="2.21" edition="beta2"/>
        <vers num="2.22" edition="beta1"/>
        <vers num="2.22" edition="beta2"/>
        <vers num="2.22.1"/>
        <vers num="2.23" edition="beta1"/>
        <vers num="2.23" edition="beta2"/>
        <vers num="2.24" edition="beta1"/>
        <vers num="2.25" edition="-"/>
        <vers num="2.25" edition="beta1"/>
        <vers num="2.25" edition="beta2"/>
        <vers num="2.25" edition="beta3"/>
        <vers prev="1" num="2.26" edition="rc1"/>
        <vers num="2.3" edition="beta1"/>
        <vers num="2.3" edition="beta2"/>
        <vers num="2.3" edition="beta3"/>
        <vers num="2.3.1"/>
        <vers num="2.3.2"/>
        <vers num="2.3.3"/>
        <vers num="2.4" edition="beta1"/>
        <vers num="2.4" edition="beta2"/>
        <vers num="2.4" edition="beta3"/>
        <vers num="2.4.1"/>
        <vers num="2.5" edition="beta1"/>
        <vers num="2.5" edition="beta2"/>
        <vers num="2.5" edition="beta3"/>
        <vers num="2.5" edition="beta4"/>
        <vers num="2.6" edition="beta1"/>
        <vers num="2.6" edition="beta2"/>
        <vers num="2.6" edition="beta3"/>
        <vers num="2.6" edition="beta4"/>
        <vers num="2.6.1"/>
        <vers num="2.7" edition="beta1"/>
        <vers num="2.7" edition="beta2"/>
        <vers num="2.7" edition="beta3"/>
        <vers num="2.7" edition="beta4"/>
        <vers num="2.7" edition="beta5"/>
        <vers num="2.7.1"/>
        <vers num="2.7.2"/>
        <vers num="2.8" edition="beta1"/>
        <vers num="2.8" edition="beta2"/>
        <vers num="2.8" edition="beta3"/>
        <vers num="2.8" edition="beta4"/>
        <vers num="2.8" edition="beta5"/>
        <vers num="2.8" edition="beta6"/>
        <vers num="2.9" edition="beta1"/>
        <vers num="2.9" edition="beta2"/>
        <vers num="2.9" edition="beta3"/>
        <vers num="2.9" edition="beta4"/>
        <vers num="2.9.1"/>
      </prod>
      <prod vendor="mozilla" name="thunderbird">
        <vers num="0.1"/>
        <vers num="0.2"/>
        <vers num="0.3"/>
        <vers num="0.4"/>
        <vers num="0.5"/>
        <vers num="0.6"/>
        <vers num="0.7"/>
        <vers num="0.7.1"/>
        <vers num="0.7.2"/>
        <vers num="0.7.3"/>
        <vers num="0.8"/>
        <vers num="0.9"/>
        <vers num="1.0"/>
        <vers num="1.0.1"/>
        <vers num="1.0.2"/>
        <vers num="1.0.3"/>
        <vers num="1.0.4"/>
        <vers num="1.0.5" edition="beta"/>
        <vers num="1.0.6"/>
        <vers num="1.0.7"/>
        <vers num="1.0.8"/>
        <vers num="1.5" edition="beta2"/>
        <vers num="1.5.0.1"/>
        <vers num="1.5.0.10"/>
        <vers num="1.5.0.11"/>
        <vers num="1.5.0.12"/>
        <vers num="1.5.0.13"/>
        <vers num="1.5.0.14"/>
        <vers num="1.5.0.2"/>
        <vers num="1.5.0.3"/>
        <vers num="1.5.0.4"/>
        <vers num="1.5.0.5"/>
        <vers num="1.5.0.6"/>
        <vers num="1.5.0.7"/>
        <vers num="1.5.0.8"/>
        <vers num="1.5.0.9"/>
        <vers num="1.5.1"/>
        <vers num="1.5.2"/>
        <vers num="1.7.1"/>
        <vers num="1.7.3"/>
        <vers num="10.0"/>
        <vers num="10.0.1"/>
        <vers num="10.0.2"/>
        <vers num="10.0.3"/>
        <vers num="10.0.4"/>
        <vers num="11.0"/>
        <vers num="11.0.1"/>
        <vers num="12.0"/>
        <vers num="12.0.1"/>
        <vers num="13.0"/>
        <vers num="13.0.1"/>
        <vers num="14.0"/>
        <vers num="15.0"/>
        <vers num="15.0.1"/>
        <vers num="16.0"/>
        <vers num="16.0.1"/>
        <vers num="16.0.2"/>
        <vers num="17.0"/>
        <vers num="17.0.1"/>
        <vers num="17.0.2"/>
        <vers num="17.0.3"/>
        <vers num="17.0.4"/>
        <vers num="17.0.5"/>
        <vers num="17.0.6"/>
        <vers num="17.0.7"/>
        <vers num="17.0.8"/>
        <vers num="2.0"/>
        <vers num="2.0.0.0"/>
        <vers num="2.0.0.1"/>
        <vers num="2.0.0.11"/>
        <vers num="2.0.0.12"/>
        <vers num="2.0.0.13"/>
        <vers num="2.0.0.14"/>
        <vers num="2.0.0.15"/>
        <vers num="2.0.0.16"/>
        <vers num="2.0.0.17"/>
        <vers num="2.0.0.18"/>
        <vers num="2.0.0.19"/>
        <vers num="2.0.0.2"/>
        <vers num="2.0.0.20"/>
        <vers num="2.0.0.21"/>
        <vers num="2.0.0.22"/>
        <vers num="2.0.0.23"/>
        <vers num="2.0.0.3"/>
        <vers num="2.0.0.4"/>
        <vers num="2.0.0.5"/>
        <vers num="2.0.0.6"/>
        <vers num="2.0.0.7"/>
        <vers num="2.0.0.8"/>
        <vers num="2.0.0.9"/>
        <vers num="24.0"/>
        <vers num="24.0.1"/>
        <vers num="24.1"/>
        <vers num="24.1.1"/>
        <vers num="24.2"/>
        <vers num="24.3"/>
        <vers prev="1" num="24.4"/>
        <vers num="3.0"/>
        <vers num="3.0.1"/>
        <vers num="3.0.10"/>
        <vers num="3.0.11"/>
        <vers num="3.0.2"/>
        <vers num="3.0.3"/>
        <vers num="3.0.4"/>
        <vers num="3.0.5"/>
        <vers num="3.0.6"/>
        <vers num="3.0.7"/>
        <vers num="3.0.8"/>
        <vers num="3.0.9"/>
        <vers num="3.1"/>
        <vers num="3.1.1"/>
        <vers num="3.1.10"/>
        <vers num="3.1.11"/>
        <vers num="3.1.12"/>
        <vers num="3.1.13"/>
        <vers num="3.1.14"/>
        <vers num="3.1.15"/>
        <vers num="3.1.16"/>
        <vers num="3.1.17"/>
        <vers num="3.1.2"/>
        <vers num="3.1.3"/>
        <vers num="3.1.4"/>
        <vers num="3.1.5"/>
        <vers num="3.1.6"/>
        <vers num="3.1.7"/>
        <vers num="3.1.8"/>
        <vers num="3.1.9"/>
        <vers num="5.0"/>
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers num="6.0.2"/>
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="8.0"/>
        <vers num="9.0"/>
        <vers num="9.0.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1525" published="2014-04-30" name="CVE-2014-1525" modified="2014-04-30" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">The mozilla::dom::TextTrack::AddCue function in Mozilla Firefox before 29.0 and SeaMonkey before 2.26 does not properly perform garbage collection for Text Track Manager variables, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and heap memory corruption) via a crafted VIDEO element in an HTML document.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=989210" source="CONFIRM">https://bugzilla.mozilla.org/show_bug.cgi?id=989210</ref>
      <ref url="http://www.mozilla.org/security/announce/2014/mfsa2014-39.html" source="CONFIRM" adv="1">http://www.mozilla.org/security/announce/2014/mfsa2014-39.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="mozilla" name="firefox">
        <vers num="0.1"/>
        <vers num="0.10"/>
        <vers num="0.10.1"/>
        <vers num="0.2"/>
        <vers num="0.3"/>
        <vers num="0.4"/>
        <vers num="0.5"/>
        <vers num="0.6"/>
        <vers num="0.6.1"/>
        <vers num="0.7"/>
        <vers num="0.7.1"/>
        <vers num="0.8"/>
        <vers num="0.9" edition="rc"/>
        <vers num="0.9.1"/>
        <vers num="0.9.2"/>
        <vers num="0.9.3"/>
        <vers num="1.0" edition="preview_release"/>
        <vers num="1.0.1"/>
        <vers num="1.0.2"/>
        <vers num="1.0.3"/>
        <vers num="1.0.4"/>
        <vers num="1.0.5"/>
        <vers num="1.0.6"/>
        <vers num="1.0.7"/>
        <vers num="1.0.8"/>
        <vers num="1.5" edition="beta1"/>
        <vers num="1.5" edition="beta2"/>
        <vers num="1.5.0.1"/>
        <vers num="1.5.0.10"/>
        <vers num="1.5.0.11"/>
        <vers num="1.5.0.12"/>
        <vers num="1.5.0.2"/>
        <vers num="1.5.0.3"/>
        <vers num="1.5.0.4"/>
        <vers num="1.5.0.5"/>
        <vers num="1.5.0.6"/>
        <vers num="1.5.0.7"/>
        <vers num="1.5.0.8"/>
        <vers num="1.5.0.9"/>
        <vers num="1.5.1"/>
        <vers num="1.5.2"/>
        <vers num="1.5.3"/>
        <vers num="1.5.4"/>
        <vers num="1.5.5"/>
        <vers num="1.5.6"/>
        <vers num="1.5.7"/>
        <vers num="1.5.8"/>
        <vers num="10.0"/>
        <vers num="10.0.1"/>
        <vers num="10.0.10"/>
        <vers num="10.0.11"/>
        <vers num="10.0.12"/>
        <vers num="10.0.2"/>
        <vers num="10.0.3"/>
        <vers num="10.0.4"/>
        <vers num="10.0.5"/>
        <vers num="10.0.6"/>
        <vers num="10.0.7"/>
        <vers num="10.0.8"/>
        <vers num="10.0.9"/>
        <vers num="11.0"/>
        <vers num="12.0" edition="beta6"/>
        <vers num="13.0"/>
        <vers num="13.0.1"/>
        <vers num="14.0"/>
        <vers num="14.0.1"/>
        <vers num="15.0"/>
        <vers num="15.0.1"/>
        <vers num="16.0"/>
        <vers num="16.0.1"/>
        <vers num="16.0.2"/>
        <vers num="17.0.10"/>
        <vers num="17.0.11"/>
        <vers num="17.0.2"/>
        <vers num="17.0.3"/>
        <vers num="17.0.4"/>
        <vers num="17.0.5"/>
        <vers num="17.0.6"/>
        <vers num="17.0.7"/>
        <vers num="17.0.8"/>
        <vers num="17.0.9"/>
        <vers num="18.0"/>
        <vers num="18.0.1"/>
        <vers num="18.0.2"/>
        <vers num="19.0"/>
        <vers num="19.0.1"/>
        <vers num="19.0.2"/>
        <vers num="2.0"/>
        <vers num="2.0.0.1"/>
        <vers num="2.0.0.10"/>
        <vers num="2.0.0.11"/>
        <vers num="2.0.0.12"/>
        <vers num="2.0.0.13"/>
        <vers num="2.0.0.14"/>
        <vers num="2.0.0.15"/>
        <vers num="2.0.0.16"/>
        <vers num="2.0.0.17"/>
        <vers num="2.0.0.18"/>
        <vers num="2.0.0.19"/>
        <vers num="2.0.0.2"/>
        <vers num="2.0.0.20"/>
        <vers num="2.0.0.3"/>
        <vers num="2.0.0.4"/>
        <vers num="2.0.0.5"/>
        <vers num="2.0.0.6"/>
        <vers num="2.0.0.7"/>
        <vers num="2.0.0.8"/>
        <vers num="2.0.0.9"/>
        <vers num="20.0"/>
        <vers num="20.0.1"/>
        <vers num="21.0"/>
        <vers num="23.0"/>
        <vers num="23.0.1"/>
        <vers num="24.0"/>
        <vers num="24.1"/>
        <vers num="24.1.1"/>
        <vers num="25.0"/>
        <vers num="25.0.1"/>
        <vers num="26.0"/>
        <vers num="27.0"/>
        <vers num="27.0.1"/>
        <vers prev="1" num="28.0"/>
        <vers num="3.0"/>
        <vers num="3.0.1"/>
        <vers num="3.0.10"/>
        <vers num="3.0.11"/>
        <vers num="3.0.12"/>
        <vers num="3.0.13"/>
        <vers num="3.0.14"/>
        <vers num="3.0.15"/>
        <vers num="3.0.16"/>
        <vers num="3.0.17"/>
        <vers num="3.0.18"/>
        <vers num="3.0.19"/>
        <vers num="3.0.2"/>
        <vers num="3.0.3"/>
        <vers num="3.0.4"/>
        <vers num="3.0.5"/>
        <vers num="3.0.6"/>
        <vers num="3.0.7"/>
        <vers num="3.0.8"/>
        <vers num="3.0.9"/>
        <vers num="3.5"/>
        <vers num="3.5.1"/>
        <vers num="3.5.10"/>
        <vers num="3.5.11"/>
        <vers num="3.5.12"/>
        <vers num="3.5.13"/>
        <vers num="3.5.14"/>
        <vers num="3.5.15"/>
        <vers num="3.5.16"/>
        <vers num="3.5.17"/>
        <vers num="3.5.18"/>
        <vers num="3.5.19"/>
        <vers num="3.5.2"/>
        <vers num="3.5.3"/>
        <vers num="3.5.4"/>
        <vers num="3.5.5"/>
        <vers num="3.5.6"/>
        <vers num="3.5.7"/>
        <vers num="3.5.8"/>
        <vers num="3.5.9"/>
        <vers num="3.6"/>
        <vers num="3.6.10"/>
        <vers num="3.6.11"/>
        <vers num="3.6.12"/>
        <vers num="3.6.13"/>
        <vers num="3.6.14"/>
        <vers num="3.6.15"/>
        <vers num="3.6.16"/>
        <vers num="3.6.17"/>
        <vers num="3.6.18"/>
        <vers num="3.6.19"/>
        <vers num="3.6.2"/>
        <vers num="3.6.20"/>
        <vers num="3.6.21"/>
        <vers num="3.6.22"/>
        <vers num="3.6.23"/>
        <vers num="3.6.24"/>
        <vers num="3.6.25"/>
        <vers num="3.6.26"/>
        <vers num="3.6.27"/>
        <vers num="3.6.28"/>
        <vers num="3.6.3"/>
        <vers num="3.6.4"/>
        <vers num="3.6.6"/>
        <vers num="3.6.7"/>
        <vers num="3.6.8"/>
        <vers num="3.6.9"/>
        <vers num="4.0" edition="beta1"/>
        <vers num="4.0" edition="beta10"/>
        <vers num="4.0" edition="beta11"/>
        <vers num="4.0" edition="beta12"/>
        <vers num="4.0" edition="beta2"/>
        <vers num="4.0" edition="beta3"/>
        <vers num="4.0" edition="beta4"/>
        <vers num="4.0" edition="beta5"/>
        <vers num="4.0" edition="beta6"/>
        <vers num="4.0" edition="beta7"/>
        <vers num="4.0" edition="beta8"/>
        <vers num="4.0" edition="beta9"/>
        <vers num="4.0.1"/>
        <vers num="5.0"/>
        <vers num="5.0.1"/>
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers num="6.0.2"/>
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="8.0"/>
        <vers num="8.0.1"/>
        <vers num="9.0"/>
        <vers num="9.0.1"/>
      </prod>
      <prod vendor="mozilla" name="seamonkey">
        <vers num="2.0" edition="alpha_1"/>
        <vers num="2.0" edition="alpha_2"/>
        <vers num="2.0" edition="alpha_3"/>
        <vers num="2.0" edition="beta_1"/>
        <vers num="2.0" edition="beta_2"/>
        <vers num="2.0" edition="rc1"/>
        <vers num="2.0" edition="rc2"/>
        <vers num="2.0.1"/>
        <vers num="2.0.10"/>
        <vers num="2.0.11"/>
        <vers num="2.0.12"/>
        <vers num="2.0.13"/>
        <vers num="2.0.14"/>
        <vers num="2.0.2"/>
        <vers num="2.0.3"/>
        <vers num="2.0.4"/>
        <vers num="2.0.5"/>
        <vers num="2.0.6"/>
        <vers num="2.0.7"/>
        <vers num="2.0.8"/>
        <vers num="2.0.9"/>
        <vers num="2.1" edition="alpha1"/>
        <vers num="2.1" edition="alpha2"/>
        <vers num="2.1" edition="alpha3"/>
        <vers num="2.1" edition="beta1"/>
        <vers num="2.1" edition="beta2"/>
        <vers num="2.1" edition="beta3"/>
        <vers num="2.1" edition="rc1"/>
        <vers num="2.1" edition="rc2"/>
        <vers num="2.10" edition="beta1"/>
        <vers num="2.10" edition="beta2"/>
        <vers num="2.10" edition="beta3"/>
        <vers num="2.10.1"/>
        <vers num="2.11" edition="beta1"/>
        <vers num="2.11" edition="beta2"/>
        <vers num="2.11" edition="beta3"/>
        <vers num="2.11" edition="beta4"/>
        <vers num="2.11" edition="beta5"/>
        <vers num="2.11" edition="beta6"/>
        <vers num="2.12" edition="beta1"/>
        <vers num="2.12" edition="beta2"/>
        <vers num="2.12" edition="beta3"/>
        <vers num="2.12" edition="beta4"/>
        <vers num="2.12" edition="beta5"/>
        <vers num="2.12" edition="beta6"/>
        <vers num="2.12.1"/>
        <vers num="2.13" edition="beta1"/>
        <vers num="2.13" edition="beta2"/>
        <vers num="2.13" edition="beta3"/>
        <vers num="2.13" edition="beta4"/>
        <vers num="2.13" edition="beta5"/>
        <vers num="2.13" edition="beta6"/>
        <vers num="2.13.1"/>
        <vers num="2.13.2"/>
        <vers num="2.14" edition="beta1"/>
        <vers num="2.14" edition="beta2"/>
        <vers num="2.14" edition="beta3"/>
        <vers num="2.14" edition="beta4"/>
        <vers num="2.14" edition="beta5"/>
        <vers num="2.15" edition="beta1"/>
        <vers num="2.15" edition="beta2"/>
        <vers num="2.15" edition="beta3"/>
        <vers num="2.15" edition="beta4"/>
        <vers num="2.15" edition="beta5"/>
        <vers num="2.15" edition="beta6"/>
        <vers num="2.15.1"/>
        <vers num="2.15.2"/>
        <vers num="2.16" edition="beta1"/>
        <vers num="2.16" edition="beta2"/>
        <vers num="2.16" edition="beta3"/>
        <vers num="2.16" edition="beta4"/>
        <vers num="2.16" edition="beta5"/>
        <vers num="2.16.1"/>
        <vers num="2.16.2"/>
        <vers num="2.17" edition="beta1"/>
        <vers num="2.17" edition="beta2"/>
        <vers num="2.17" edition="beta3"/>
        <vers num="2.17" edition="beta4"/>
        <vers num="2.17.1"/>
        <vers num="2.18" edition="beta1"/>
        <vers num="2.18" edition="beta2"/>
        <vers num="2.18" edition="beta3"/>
        <vers num="2.18" edition="beta4"/>
        <vers num="2.19" edition="beta1"/>
        <vers num="2.19" edition="beta2"/>
        <vers num="2.2" edition="beta1"/>
        <vers num="2.2" edition="beta2"/>
        <vers num="2.2" edition="beta3"/>
        <vers num="2.20" edition="beta1"/>
        <vers num="2.20" edition="beta2"/>
        <vers num="2.20" edition="beta3"/>
        <vers num="2.21" edition="beta1"/>
        <vers num="2.21" edition="beta2"/>
        <vers num="2.22" edition="beta1"/>
        <vers num="2.22" edition="beta2"/>
        <vers num="2.22.1"/>
        <vers num="2.23" edition="beta1"/>
        <vers num="2.23" edition="beta2"/>
        <vers num="2.24" edition="beta1"/>
        <vers num="2.25" edition="-"/>
        <vers num="2.25" edition="beta1"/>
        <vers num="2.25" edition="beta2"/>
        <vers num="2.25" edition="beta3"/>
        <vers prev="1" num="2.26" edition="rc1"/>
        <vers num="2.3" edition="beta1"/>
        <vers num="2.3" edition="beta2"/>
        <vers num="2.3" edition="beta3"/>
        <vers num="2.3.1"/>
        <vers num="2.3.2"/>
        <vers num="2.3.3"/>
        <vers num="2.4" edition="beta1"/>
        <vers num="2.4" edition="beta2"/>
        <vers num="2.4" edition="beta3"/>
        <vers num="2.4.1"/>
        <vers num="2.5" edition="beta1"/>
        <vers num="2.5" edition="beta2"/>
        <vers num="2.5" edition="beta3"/>
        <vers num="2.5" edition="beta4"/>
        <vers num="2.6" edition="beta1"/>
        <vers num="2.6" edition="beta2"/>
        <vers num="2.6" edition="beta3"/>
        <vers num="2.6" edition="beta4"/>
        <vers num="2.6.1"/>
        <vers num="2.7" edition="beta1"/>
        <vers num="2.7" edition="beta2"/>
        <vers num="2.7" edition="beta3"/>
        <vers num="2.7" edition="beta4"/>
        <vers num="2.7" edition="beta5"/>
        <vers num="2.7.1"/>
        <vers num="2.7.2"/>
        <vers num="2.8" edition="beta1"/>
        <vers num="2.8" edition="beta2"/>
        <vers num="2.8" edition="beta3"/>
        <vers num="2.8" edition="beta4"/>
        <vers num="2.8" edition="beta5"/>
        <vers num="2.8" edition="beta6"/>
        <vers num="2.9" edition="beta1"/>
        <vers num="2.9" edition="beta2"/>
        <vers num="2.9" edition="beta3"/>
        <vers num="2.9" edition="beta4"/>
        <vers num="2.9.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1526" published="2014-04-30" name="CVE-2014-1526" modified="2014-04-30" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:N)" CVSS_score="5.8" CVSS_impact_subscore="4.9" CVSS_exploit_subscore="8.6" CVSS_base_score="5.8">
    <desc>
      <descript source="cve">The XrayWrapper implementation in Mozilla Firefox before 29.0 and SeaMonkey before 2.26 allows user-assisted remote attackers to bypass intended access restrictions via a crafted web site that is visited in the debugger, leading to unwrapping operations and calls to DOM methods on the unwrapped objects.</descript>
    </desc>
    <loss_types>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=988106" source="CONFIRM">https://bugzilla.mozilla.org/show_bug.cgi?id=988106</ref>
      <ref url="http://www.mozilla.org/security/announce/2014/mfsa2014-47.html" source="CONFIRM" adv="1">http://www.mozilla.org/security/announce/2014/mfsa2014-47.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="mozilla" name="firefox">
        <vers num="0.1"/>
        <vers num="0.10"/>
        <vers num="0.10.1"/>
        <vers num="0.2"/>
        <vers num="0.3"/>
        <vers num="0.4"/>
        <vers num="0.5"/>
        <vers num="0.6"/>
        <vers num="0.6.1"/>
        <vers num="0.7"/>
        <vers num="0.7.1"/>
        <vers num="0.8"/>
        <vers num="0.9" edition="rc"/>
        <vers num="0.9.1"/>
        <vers num="0.9.2"/>
        <vers num="0.9.3"/>
        <vers num="1.0" edition="preview_release"/>
        <vers num="1.0.1"/>
        <vers num="1.0.2"/>
        <vers num="1.0.3"/>
        <vers num="1.0.4"/>
        <vers num="1.0.5"/>
        <vers num="1.0.6"/>
        <vers num="1.0.7"/>
        <vers num="1.0.8"/>
        <vers num="1.5" edition="beta1"/>
        <vers num="1.5" edition="beta2"/>
        <vers num="1.5.0.1"/>
        <vers num="1.5.0.10"/>
        <vers num="1.5.0.11"/>
        <vers num="1.5.0.12"/>
        <vers num="1.5.0.2"/>
        <vers num="1.5.0.3"/>
        <vers num="1.5.0.4"/>
        <vers num="1.5.0.5"/>
        <vers num="1.5.0.6"/>
        <vers num="1.5.0.7"/>
        <vers num="1.5.0.8"/>
        <vers num="1.5.0.9"/>
        <vers num="1.5.1"/>
        <vers num="1.5.2"/>
        <vers num="1.5.3"/>
        <vers num="1.5.4"/>
        <vers num="1.5.5"/>
        <vers num="1.5.6"/>
        <vers num="1.5.7"/>
        <vers num="1.5.8"/>
        <vers num="10.0"/>
        <vers num="10.0.1"/>
        <vers num="10.0.10"/>
        <vers num="10.0.11"/>
        <vers num="10.0.12"/>
        <vers num="10.0.2"/>
        <vers num="10.0.3"/>
        <vers num="10.0.4"/>
        <vers num="10.0.5"/>
        <vers num="10.0.6"/>
        <vers num="10.0.7"/>
        <vers num="10.0.8"/>
        <vers num="10.0.9"/>
        <vers num="11.0"/>
        <vers num="12.0" edition="beta6"/>
        <vers num="13.0"/>
        <vers num="13.0.1"/>
        <vers num="14.0"/>
        <vers num="14.0.1"/>
        <vers num="15.0"/>
        <vers num="15.0.1"/>
        <vers num="16.0"/>
        <vers num="16.0.1"/>
        <vers num="16.0.2"/>
        <vers num="17.0.10"/>
        <vers num="17.0.11"/>
        <vers num="17.0.2"/>
        <vers num="17.0.3"/>
        <vers num="17.0.4"/>
        <vers num="17.0.5"/>
        <vers num="17.0.6"/>
        <vers num="17.0.7"/>
        <vers num="17.0.8"/>
        <vers num="17.0.9"/>
        <vers num="18.0"/>
        <vers num="18.0.1"/>
        <vers num="18.0.2"/>
        <vers num="19.0"/>
        <vers num="19.0.1"/>
        <vers num="19.0.2"/>
        <vers num="2.0"/>
        <vers num="2.0.0.1"/>
        <vers num="2.0.0.10"/>
        <vers num="2.0.0.11"/>
        <vers num="2.0.0.12"/>
        <vers num="2.0.0.13"/>
        <vers num="2.0.0.14"/>
        <vers num="2.0.0.15"/>
        <vers num="2.0.0.16"/>
        <vers num="2.0.0.17"/>
        <vers num="2.0.0.18"/>
        <vers num="2.0.0.19"/>
        <vers num="2.0.0.2"/>
        <vers num="2.0.0.20"/>
        <vers num="2.0.0.3"/>
        <vers num="2.0.0.4"/>
        <vers num="2.0.0.5"/>
        <vers num="2.0.0.6"/>
        <vers num="2.0.0.7"/>
        <vers num="2.0.0.8"/>
        <vers num="2.0.0.9"/>
        <vers num="20.0"/>
        <vers num="20.0.1"/>
        <vers num="21.0"/>
        <vers num="23.0"/>
        <vers num="23.0.1"/>
        <vers num="24.0"/>
        <vers num="24.1"/>
        <vers num="24.1.1"/>
        <vers num="25.0"/>
        <vers num="25.0.1"/>
        <vers num="26.0"/>
        <vers num="27.0"/>
        <vers num="27.0.1"/>
        <vers prev="1" num="28.0"/>
        <vers num="3.0"/>
        <vers num="3.0.1"/>
        <vers num="3.0.10"/>
        <vers num="3.0.11"/>
        <vers num="3.0.12"/>
        <vers num="3.0.13"/>
        <vers num="3.0.14"/>
        <vers num="3.0.15"/>
        <vers num="3.0.16"/>
        <vers num="3.0.17"/>
        <vers num="3.0.18"/>
        <vers num="3.0.19"/>
        <vers num="3.0.2"/>
        <vers num="3.0.3"/>
        <vers num="3.0.4"/>
        <vers num="3.0.5"/>
        <vers num="3.0.6"/>
        <vers num="3.0.7"/>
        <vers num="3.0.8"/>
        <vers num="3.0.9"/>
        <vers num="3.5"/>
        <vers num="3.5.1"/>
        <vers num="3.5.10"/>
        <vers num="3.5.11"/>
        <vers num="3.5.12"/>
        <vers num="3.5.13"/>
        <vers num="3.5.14"/>
        <vers num="3.5.15"/>
        <vers num="3.5.16"/>
        <vers num="3.5.17"/>
        <vers num="3.5.18"/>
        <vers num="3.5.19"/>
        <vers num="3.5.2"/>
        <vers num="3.5.3"/>
        <vers num="3.5.4"/>
        <vers num="3.5.5"/>
        <vers num="3.5.6"/>
        <vers num="3.5.7"/>
        <vers num="3.5.8"/>
        <vers num="3.5.9"/>
        <vers num="3.6"/>
        <vers num="3.6.10"/>
        <vers num="3.6.11"/>
        <vers num="3.6.12"/>
        <vers num="3.6.13"/>
        <vers num="3.6.14"/>
        <vers num="3.6.15"/>
        <vers num="3.6.16"/>
        <vers num="3.6.17"/>
        <vers num="3.6.18"/>
        <vers num="3.6.19"/>
        <vers num="3.6.2"/>
        <vers num="3.6.20"/>
        <vers num="3.6.21"/>
        <vers num="3.6.22"/>
        <vers num="3.6.23"/>
        <vers num="3.6.24"/>
        <vers num="3.6.25"/>
        <vers num="3.6.26"/>
        <vers num="3.6.27"/>
        <vers num="3.6.28"/>
        <vers num="3.6.3"/>
        <vers num="3.6.4"/>
        <vers num="3.6.6"/>
        <vers num="3.6.7"/>
        <vers num="3.6.8"/>
        <vers num="3.6.9"/>
        <vers num="4.0" edition="beta1"/>
        <vers num="4.0" edition="beta10"/>
        <vers num="4.0" edition="beta11"/>
        <vers num="4.0" edition="beta12"/>
        <vers num="4.0" edition="beta2"/>
        <vers num="4.0" edition="beta3"/>
        <vers num="4.0" edition="beta4"/>
        <vers num="4.0" edition="beta5"/>
        <vers num="4.0" edition="beta6"/>
        <vers num="4.0" edition="beta7"/>
        <vers num="4.0" edition="beta8"/>
        <vers num="4.0" edition="beta9"/>
        <vers num="4.0.1"/>
        <vers num="5.0"/>
        <vers num="5.0.1"/>
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers num="6.0.2"/>
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="8.0"/>
        <vers num="8.0.1"/>
        <vers num="9.0"/>
        <vers num="9.0.1"/>
      </prod>
      <prod vendor="mozilla" name="seamonkey">
        <vers num="2.0" edition="alpha_1"/>
        <vers num="2.0" edition="alpha_2"/>
        <vers num="2.0" edition="alpha_3"/>
        <vers num="2.0" edition="beta_1"/>
        <vers num="2.0" edition="beta_2"/>
        <vers num="2.0" edition="rc1"/>
        <vers num="2.0" edition="rc2"/>
        <vers num="2.0.1"/>
        <vers num="2.0.10"/>
        <vers num="2.0.11"/>
        <vers num="2.0.12"/>
        <vers num="2.0.13"/>
        <vers num="2.0.14"/>
        <vers num="2.0.2"/>
        <vers num="2.0.3"/>
        <vers num="2.0.4"/>
        <vers num="2.0.5"/>
        <vers num="2.0.6"/>
        <vers num="2.0.7"/>
        <vers num="2.0.8"/>
        <vers num="2.0.9"/>
        <vers num="2.1" edition="alpha1"/>
        <vers num="2.1" edition="alpha2"/>
        <vers num="2.1" edition="alpha3"/>
        <vers num="2.1" edition="beta1"/>
        <vers num="2.1" edition="beta2"/>
        <vers num="2.1" edition="beta3"/>
        <vers num="2.1" edition="rc1"/>
        <vers num="2.1" edition="rc2"/>
        <vers num="2.10" edition="beta1"/>
        <vers num="2.10" edition="beta2"/>
        <vers num="2.10" edition="beta3"/>
        <vers num="2.10.1"/>
        <vers num="2.11" edition="beta1"/>
        <vers num="2.11" edition="beta2"/>
        <vers num="2.11" edition="beta3"/>
        <vers num="2.11" edition="beta4"/>
        <vers num="2.11" edition="beta5"/>
        <vers num="2.11" edition="beta6"/>
        <vers num="2.12" edition="beta1"/>
        <vers num="2.12" edition="beta2"/>
        <vers num="2.12" edition="beta3"/>
        <vers num="2.12" edition="beta4"/>
        <vers num="2.12" edition="beta5"/>
        <vers num="2.12" edition="beta6"/>
        <vers num="2.12.1"/>
        <vers num="2.13" edition="beta1"/>
        <vers num="2.13" edition="beta2"/>
        <vers num="2.13" edition="beta3"/>
        <vers num="2.13" edition="beta4"/>
        <vers num="2.13" edition="beta5"/>
        <vers num="2.13" edition="beta6"/>
        <vers num="2.13.1"/>
        <vers num="2.13.2"/>
        <vers num="2.14" edition="beta1"/>
        <vers num="2.14" edition="beta2"/>
        <vers num="2.14" edition="beta3"/>
        <vers num="2.14" edition="beta4"/>
        <vers num="2.14" edition="beta5"/>
        <vers num="2.15" edition="beta1"/>
        <vers num="2.15" edition="beta2"/>
        <vers num="2.15" edition="beta3"/>
        <vers num="2.15" edition="beta4"/>
        <vers num="2.15" edition="beta5"/>
        <vers num="2.15" edition="beta6"/>
        <vers num="2.15.1"/>
        <vers num="2.15.2"/>
        <vers num="2.16" edition="beta1"/>
        <vers num="2.16" edition="beta2"/>
        <vers num="2.16" edition="beta3"/>
        <vers num="2.16" edition="beta4"/>
        <vers num="2.16" edition="beta5"/>
        <vers num="2.16.1"/>
        <vers num="2.16.2"/>
        <vers num="2.17" edition="beta1"/>
        <vers num="2.17" edition="beta2"/>
        <vers num="2.17" edition="beta3"/>
        <vers num="2.17" edition="beta4"/>
        <vers num="2.17.1"/>
        <vers num="2.18" edition="beta1"/>
        <vers num="2.18" edition="beta2"/>
        <vers num="2.18" edition="beta3"/>
        <vers num="2.18" edition="beta4"/>
        <vers num="2.19" edition="beta1"/>
        <vers num="2.19" edition="beta2"/>
        <vers num="2.2" edition="beta1"/>
        <vers num="2.2" edition="beta2"/>
        <vers num="2.2" edition="beta3"/>
        <vers num="2.20" edition="beta1"/>
        <vers num="2.20" edition="beta2"/>
        <vers num="2.20" edition="beta3"/>
        <vers num="2.21" edition="beta1"/>
        <vers num="2.21" edition="beta2"/>
        <vers num="2.22" edition="beta1"/>
        <vers num="2.22" edition="beta2"/>
        <vers num="2.22.1"/>
        <vers num="2.23" edition="beta1"/>
        <vers num="2.23" edition="beta2"/>
        <vers num="2.24" edition="beta1"/>
        <vers num="2.25" edition="-"/>
        <vers num="2.25" edition="beta1"/>
        <vers num="2.25" edition="beta2"/>
        <vers num="2.25" edition="beta3"/>
        <vers prev="1" num="2.26" edition="rc1"/>
        <vers num="2.3" edition="beta1"/>
        <vers num="2.3" edition="beta2"/>
        <vers num="2.3" edition="beta3"/>
        <vers num="2.3.1"/>
        <vers num="2.3.2"/>
        <vers num="2.3.3"/>
        <vers num="2.4" edition="beta1"/>
        <vers num="2.4" edition="beta2"/>
        <vers num="2.4" edition="beta3"/>
        <vers num="2.4.1"/>
        <vers num="2.5" edition="beta1"/>
        <vers num="2.5" edition="beta2"/>
        <vers num="2.5" edition="beta3"/>
        <vers num="2.5" edition="beta4"/>
        <vers num="2.6" edition="beta1"/>
        <vers num="2.6" edition="beta2"/>
        <vers num="2.6" edition="beta3"/>
        <vers num="2.6" edition="beta4"/>
        <vers num="2.6.1"/>
        <vers num="2.7" edition="beta1"/>
        <vers num="2.7" edition="beta2"/>
        <vers num="2.7" edition="beta3"/>
        <vers num="2.7" edition="beta4"/>
        <vers num="2.7" edition="beta5"/>
        <vers num="2.7.1"/>
        <vers num="2.7.2"/>
        <vers num="2.8" edition="beta1"/>
        <vers num="2.8" edition="beta2"/>
        <vers num="2.8" edition="beta3"/>
        <vers num="2.8" edition="beta4"/>
        <vers num="2.8" edition="beta5"/>
        <vers num="2.8" edition="beta6"/>
        <vers num="2.9" edition="beta1"/>
        <vers num="2.9" edition="beta2"/>
        <vers num="2.9" edition="beta3"/>
        <vers num="2.9" edition="beta4"/>
        <vers num="2.9.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1527" published="2014-04-30" name="CVE-2014-1527" modified="2014-04-30" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:P/A:N)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">Mozilla Firefox before 29.0 on Android allows remote attackers to spoof the address bar via crafted JavaScript code that uses DOM events to prevent the reemergence of the actual address bar after scrolling has taken it off of the screen.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=960146" source="CONFIRM">https://bugzilla.mozilla.org/show_bug.cgi?id=960146</ref>
      <ref url="http://www.mozilla.org/security/announce/2014/mfsa2014-40.html" source="CONFIRM" adv="1">http://www.mozilla.org/security/announce/2014/mfsa2014-40.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="mozilla" name="firefox">
        <vers num="0.1"/>
        <vers num="0.10"/>
        <vers num="0.10.1"/>
        <vers num="0.2"/>
        <vers num="0.3"/>
        <vers num="0.4"/>
        <vers num="0.5"/>
        <vers num="0.6"/>
        <vers num="0.6.1"/>
        <vers num="0.7"/>
        <vers num="0.7.1"/>
        <vers num="0.8"/>
        <vers num="0.9" edition="rc"/>
        <vers num="0.9.1"/>
        <vers num="0.9.2"/>
        <vers num="0.9.3"/>
        <vers num="1.0" edition="preview_release"/>
        <vers num="1.0.1"/>
        <vers num="1.0.2"/>
        <vers num="1.0.3"/>
        <vers num="1.0.4"/>
        <vers num="1.0.5"/>
        <vers num="1.0.6"/>
        <vers num="1.0.7"/>
        <vers num="1.0.8"/>
        <vers num="1.5" edition="beta1"/>
        <vers num="1.5" edition="beta2"/>
        <vers num="1.5.0.1"/>
        <vers num="1.5.0.10"/>
        <vers num="1.5.0.11"/>
        <vers num="1.5.0.12"/>
        <vers num="1.5.0.2"/>
        <vers num="1.5.0.3"/>
        <vers num="1.5.0.4"/>
        <vers num="1.5.0.5"/>
        <vers num="1.5.0.6"/>
        <vers num="1.5.0.7"/>
        <vers num="1.5.0.8"/>
        <vers num="1.5.0.9"/>
        <vers num="1.5.1"/>
        <vers num="1.5.2"/>
        <vers num="1.5.3"/>
        <vers num="1.5.4"/>
        <vers num="1.5.5"/>
        <vers num="1.5.6"/>
        <vers num="1.5.7"/>
        <vers num="1.5.8"/>
        <vers num="10.0"/>
        <vers num="10.0.1"/>
        <vers num="10.0.10"/>
        <vers num="10.0.11"/>
        <vers num="10.0.12"/>
        <vers num="10.0.2"/>
        <vers num="10.0.3"/>
        <vers num="10.0.4"/>
        <vers num="10.0.5"/>
        <vers num="10.0.6"/>
        <vers num="10.0.7"/>
        <vers num="10.0.8"/>
        <vers num="10.0.9"/>
        <vers num="11.0"/>
        <vers num="12.0" edition="beta6"/>
        <vers num="13.0"/>
        <vers num="13.0.1"/>
        <vers num="14.0"/>
        <vers num="14.0.1"/>
        <vers num="15.0"/>
        <vers num="15.0.1"/>
        <vers num="16.0"/>
        <vers num="16.0.1"/>
        <vers num="16.0.2"/>
        <vers num="17.0.10"/>
        <vers num="17.0.11"/>
        <vers num="17.0.2"/>
        <vers num="17.0.3"/>
        <vers num="17.0.4"/>
        <vers num="17.0.5"/>
        <vers num="17.0.6"/>
        <vers num="17.0.7"/>
        <vers num="17.0.8"/>
        <vers num="17.0.9"/>
        <vers num="18.0"/>
        <vers num="18.0.1"/>
        <vers num="18.0.2"/>
        <vers num="19.0"/>
        <vers num="19.0.1"/>
        <vers num="19.0.2"/>
        <vers num="2.0"/>
        <vers num="2.0.0.1"/>
        <vers num="2.0.0.10"/>
        <vers num="2.0.0.11"/>
        <vers num="2.0.0.12"/>
        <vers num="2.0.0.13"/>
        <vers num="2.0.0.14"/>
        <vers num="2.0.0.15"/>
        <vers num="2.0.0.16"/>
        <vers num="2.0.0.17"/>
        <vers num="2.0.0.18"/>
        <vers num="2.0.0.19"/>
        <vers num="2.0.0.2"/>
        <vers num="2.0.0.20"/>
        <vers num="2.0.0.3"/>
        <vers num="2.0.0.4"/>
        <vers num="2.0.0.5"/>
        <vers num="2.0.0.6"/>
        <vers num="2.0.0.7"/>
        <vers num="2.0.0.8"/>
        <vers num="2.0.0.9"/>
        <vers num="20.0"/>
        <vers num="20.0.1"/>
        <vers num="21.0"/>
        <vers num="23.0"/>
        <vers num="23.0.1"/>
        <vers num="24.0"/>
        <vers num="24.1"/>
        <vers num="24.1.1"/>
        <vers num="25.0"/>
        <vers num="25.0.1"/>
        <vers num="26.0"/>
        <vers num="27.0"/>
        <vers num="27.0.1"/>
        <vers prev="1" num="28.0"/>
        <vers num="3.0"/>
        <vers num="3.0.1"/>
        <vers num="3.0.10"/>
        <vers num="3.0.11"/>
        <vers num="3.0.12"/>
        <vers num="3.0.13"/>
        <vers num="3.0.14"/>
        <vers num="3.0.15"/>
        <vers num="3.0.16"/>
        <vers num="3.0.17"/>
        <vers num="3.0.18"/>
        <vers num="3.0.19"/>
        <vers num="3.0.2"/>
        <vers num="3.0.3"/>
        <vers num="3.0.4"/>
        <vers num="3.0.5"/>
        <vers num="3.0.6"/>
        <vers num="3.0.7"/>
        <vers num="3.0.8"/>
        <vers num="3.0.9"/>
        <vers num="3.5"/>
        <vers num="3.5.1"/>
        <vers num="3.5.10"/>
        <vers num="3.5.11"/>
        <vers num="3.5.12"/>
        <vers num="3.5.13"/>
        <vers num="3.5.14"/>
        <vers num="3.5.15"/>
        <vers num="3.5.16"/>
        <vers num="3.5.17"/>
        <vers num="3.5.18"/>
        <vers num="3.5.19"/>
        <vers num="3.5.2"/>
        <vers num="3.5.3"/>
        <vers num="3.5.4"/>
        <vers num="3.5.5"/>
        <vers num="3.5.6"/>
        <vers num="3.5.7"/>
        <vers num="3.5.8"/>
        <vers num="3.5.9"/>
        <vers num="3.6"/>
        <vers num="3.6.10"/>
        <vers num="3.6.11"/>
        <vers num="3.6.12"/>
        <vers num="3.6.13"/>
        <vers num="3.6.14"/>
        <vers num="3.6.15"/>
        <vers num="3.6.16"/>
        <vers num="3.6.17"/>
        <vers num="3.6.18"/>
        <vers num="3.6.19"/>
        <vers num="3.6.2"/>
        <vers num="3.6.20"/>
        <vers num="3.6.21"/>
        <vers num="3.6.22"/>
        <vers num="3.6.23"/>
        <vers num="3.6.24"/>
        <vers num="3.6.25"/>
        <vers num="3.6.26"/>
        <vers num="3.6.27"/>
        <vers num="3.6.28"/>
        <vers num="3.6.3"/>
        <vers num="3.6.4"/>
        <vers num="3.6.6"/>
        <vers num="3.6.7"/>
        <vers num="3.6.8"/>
        <vers num="3.6.9"/>
        <vers num="4.0" edition="beta1"/>
        <vers num="4.0" edition="beta10"/>
        <vers num="4.0" edition="beta11"/>
        <vers num="4.0" edition="beta12"/>
        <vers num="4.0" edition="beta2"/>
        <vers num="4.0" edition="beta3"/>
        <vers num="4.0" edition="beta4"/>
        <vers num="4.0" edition="beta5"/>
        <vers num="4.0" edition="beta6"/>
        <vers num="4.0" edition="beta7"/>
        <vers num="4.0" edition="beta8"/>
        <vers num="4.0" edition="beta9"/>
        <vers num="4.0.1"/>
        <vers num="5.0"/>
        <vers num="5.0.1"/>
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers num="6.0.2"/>
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="8.0"/>
        <vers num="8.0.1"/>
        <vers num="9.0"/>
        <vers num="9.0.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1528" published="2014-04-30" name="CVE-2014-1528" modified="2014-04-30" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:C/I:C/A:C)" CVSS_score="10.0" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="10.0" CVSS_base_score="10.0">
    <desc>
      <descript source="cve">The sse2_composite_src_x888_8888 function in Pixman, as used in Cairo in Mozilla Firefox 28.0 and SeaMonkey 2.25 on Windows, allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds write and application crash) by painting on a CANVAS element.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=963962" source="CONFIRM">https://bugzilla.mozilla.org/show_bug.cgi?id=963962</ref>
      <ref url="http://www.mozilla.org/security/announce/2014/mfsa2014-41.html" source="CONFIRM" adv="1">http://www.mozilla.org/security/announce/2014/mfsa2014-41.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="mozilla" name="firefox">
        <vers num="28.0"/>
      </prod>
      <prod vendor="mozilla" name="seamonkey">
        <vers num="2.25" edition="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1529" published="2014-04-30" name="CVE-2014-1529" modified="2014-04-30" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">The Web Notification API in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allows remote attackers to bypass intended source-component restrictions and execute arbitrary JavaScript code in a privileged context via a crafted web page for which Notification.permission is granted.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=987003" source="CONFIRM">https://bugzilla.mozilla.org/show_bug.cgi?id=987003</ref>
      <ref url="http://www.mozilla.org/security/announce/2014/mfsa2014-42.html" source="CONFIRM" adv="1">http://www.mozilla.org/security/announce/2014/mfsa2014-42.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="mozilla" name="firefox">
        <vers num="0.1"/>
        <vers num="0.10"/>
        <vers num="0.10.1"/>
        <vers num="0.2"/>
        <vers num="0.3"/>
        <vers num="0.4"/>
        <vers num="0.5"/>
        <vers num="0.6"/>
        <vers num="0.6.1"/>
        <vers num="0.7"/>
        <vers num="0.7.1"/>
        <vers num="0.8"/>
        <vers num="0.9" edition="rc"/>
        <vers num="0.9.1"/>
        <vers num="0.9.2"/>
        <vers num="0.9.3"/>
        <vers num="1.0" edition="preview_release"/>
        <vers num="1.0.1"/>
        <vers num="1.0.2"/>
        <vers num="1.0.3"/>
        <vers num="1.0.4"/>
        <vers num="1.0.5"/>
        <vers num="1.0.6"/>
        <vers num="1.0.7"/>
        <vers num="1.0.8"/>
        <vers num="1.5" edition="beta1"/>
        <vers num="1.5" edition="beta2"/>
        <vers num="1.5.0.1"/>
        <vers num="1.5.0.10"/>
        <vers num="1.5.0.11"/>
        <vers num="1.5.0.12"/>
        <vers num="1.5.0.2"/>
        <vers num="1.5.0.3"/>
        <vers num="1.5.0.4"/>
        <vers num="1.5.0.5"/>
        <vers num="1.5.0.6"/>
        <vers num="1.5.0.7"/>
        <vers num="1.5.0.8"/>
        <vers num="1.5.0.9"/>
        <vers num="1.5.1"/>
        <vers num="1.5.2"/>
        <vers num="1.5.3"/>
        <vers num="1.5.4"/>
        <vers num="1.5.5"/>
        <vers num="1.5.6"/>
        <vers num="1.5.7"/>
        <vers num="1.5.8"/>
        <vers num="10.0"/>
        <vers num="10.0.1"/>
        <vers num="10.0.10"/>
        <vers num="10.0.11"/>
        <vers num="10.0.12"/>
        <vers num="10.0.2"/>
        <vers num="10.0.3"/>
        <vers num="10.0.4"/>
        <vers num="10.0.5"/>
        <vers num="10.0.6"/>
        <vers num="10.0.7"/>
        <vers num="10.0.8"/>
        <vers num="10.0.9"/>
        <vers num="11.0"/>
        <vers num="12.0" edition="beta6"/>
        <vers num="13.0"/>
        <vers num="13.0.1"/>
        <vers num="14.0"/>
        <vers num="14.0.1"/>
        <vers num="15.0"/>
        <vers num="15.0.1"/>
        <vers num="16.0"/>
        <vers num="16.0.1"/>
        <vers num="16.0.2"/>
        <vers num="17.0.10"/>
        <vers num="17.0.11"/>
        <vers num="17.0.2"/>
        <vers num="17.0.3"/>
        <vers num="17.0.4"/>
        <vers num="17.0.5"/>
        <vers num="17.0.6"/>
        <vers num="17.0.7"/>
        <vers num="17.0.8"/>
        <vers num="17.0.9"/>
        <vers num="18.0"/>
        <vers num="18.0.1"/>
        <vers num="18.0.2"/>
        <vers num="19.0"/>
        <vers num="19.0.1"/>
        <vers num="19.0.2"/>
        <vers num="2.0"/>
        <vers num="2.0.0.1"/>
        <vers num="2.0.0.10"/>
        <vers num="2.0.0.11"/>
        <vers num="2.0.0.12"/>
        <vers num="2.0.0.13"/>
        <vers num="2.0.0.14"/>
        <vers num="2.0.0.15"/>
        <vers num="2.0.0.16"/>
        <vers num="2.0.0.17"/>
        <vers num="2.0.0.18"/>
        <vers num="2.0.0.19"/>
        <vers num="2.0.0.2"/>
        <vers num="2.0.0.20"/>
        <vers num="2.0.0.3"/>
        <vers num="2.0.0.4"/>
        <vers num="2.0.0.5"/>
        <vers num="2.0.0.6"/>
        <vers num="2.0.0.7"/>
        <vers num="2.0.0.8"/>
        <vers num="2.0.0.9"/>
        <vers num="20.0"/>
        <vers num="20.0.1"/>
        <vers num="21.0"/>
        <vers num="23.0"/>
        <vers num="23.0.1"/>
        <vers num="24.0"/>
        <vers num="24.1"/>
        <vers num="24.1.1"/>
        <vers num="25.0"/>
        <vers num="25.0.1"/>
        <vers num="26.0"/>
        <vers num="27.0"/>
        <vers num="27.0.1"/>
        <vers prev="1" num="28.0"/>
        <vers num="3.0"/>
        <vers num="3.0.1"/>
        <vers num="3.0.10"/>
        <vers num="3.0.11"/>
        <vers num="3.0.12"/>
        <vers num="3.0.13"/>
        <vers num="3.0.14"/>
        <vers num="3.0.15"/>
        <vers num="3.0.16"/>
        <vers num="3.0.17"/>
        <vers num="3.0.18"/>
        <vers num="3.0.19"/>
        <vers num="3.0.2"/>
        <vers num="3.0.3"/>
        <vers num="3.0.4"/>
        <vers num="3.0.5"/>
        <vers num="3.0.6"/>
        <vers num="3.0.7"/>
        <vers num="3.0.8"/>
        <vers num="3.0.9"/>
        <vers num="3.5"/>
        <vers num="3.5.1"/>
        <vers num="3.5.10"/>
        <vers num="3.5.11"/>
        <vers num="3.5.12"/>
        <vers num="3.5.13"/>
        <vers num="3.5.14"/>
        <vers num="3.5.15"/>
        <vers num="3.5.16"/>
        <vers num="3.5.17"/>
        <vers num="3.5.18"/>
        <vers num="3.5.19"/>
        <vers num="3.5.2"/>
        <vers num="3.5.3"/>
        <vers num="3.5.4"/>
        <vers num="3.5.5"/>
        <vers num="3.5.6"/>
        <vers num="3.5.7"/>
        <vers num="3.5.8"/>
        <vers num="3.5.9"/>
        <vers num="3.6"/>
        <vers num="3.6.10"/>
        <vers num="3.6.11"/>
        <vers num="3.6.12"/>
        <vers num="3.6.13"/>
        <vers num="3.6.14"/>
        <vers num="3.6.15"/>
        <vers num="3.6.16"/>
        <vers num="3.6.17"/>
        <vers num="3.6.18"/>
        <vers num="3.6.19"/>
        <vers num="3.6.2"/>
        <vers num="3.6.20"/>
        <vers num="3.6.21"/>
        <vers num="3.6.22"/>
        <vers num="3.6.23"/>
        <vers num="3.6.24"/>
        <vers num="3.6.25"/>
        <vers num="3.6.26"/>
        <vers num="3.6.27"/>
        <vers num="3.6.28"/>
        <vers num="3.6.3"/>
        <vers num="3.6.4"/>
        <vers num="3.6.6"/>
        <vers num="3.6.7"/>
        <vers num="3.6.8"/>
        <vers num="3.6.9"/>
        <vers num="4.0" edition="beta1"/>
        <vers num="4.0" edition="beta10"/>
        <vers num="4.0" edition="beta11"/>
        <vers num="4.0" edition="beta12"/>
        <vers num="4.0" edition="beta2"/>
        <vers num="4.0" edition="beta3"/>
        <vers num="4.0" edition="beta4"/>
        <vers num="4.0" edition="beta5"/>
        <vers num="4.0" edition="beta6"/>
        <vers num="4.0" edition="beta7"/>
        <vers num="4.0" edition="beta8"/>
        <vers num="4.0" edition="beta9"/>
        <vers num="4.0.1"/>
        <vers num="5.0"/>
        <vers num="5.0.1"/>
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers num="6.0.2"/>
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="8.0"/>
        <vers num="8.0.1"/>
        <vers num="9.0"/>
        <vers num="9.0.1"/>
      </prod>
      <prod vendor="mozilla" name="firefox_esr">
        <vers num="24.0"/>
        <vers num="24.0.1"/>
        <vers num="24.0.2"/>
        <vers num="24.1.0"/>
        <vers num="24.1.1"/>
        <vers num="24.2"/>
        <vers num="24.3"/>
        <vers num="24.4"/>
      </prod>
      <prod vendor="mozilla" name="seamonkey">
        <vers num="2.0" edition="alpha_1"/>
        <vers num="2.0" edition="alpha_2"/>
        <vers num="2.0" edition="alpha_3"/>
        <vers num="2.0" edition="beta_1"/>
        <vers num="2.0" edition="beta_2"/>
        <vers num="2.0" edition="rc1"/>
        <vers num="2.0" edition="rc2"/>
        <vers num="2.0.1"/>
        <vers num="2.0.10"/>
        <vers num="2.0.11"/>
        <vers num="2.0.12"/>
        <vers num="2.0.13"/>
        <vers num="2.0.14"/>
        <vers num="2.0.2"/>
        <vers num="2.0.3"/>
        <vers num="2.0.4"/>
        <vers num="2.0.5"/>
        <vers num="2.0.6"/>
        <vers num="2.0.7"/>
        <vers num="2.0.8"/>
        <vers num="2.0.9"/>
        <vers num="2.1" edition="alpha1"/>
        <vers num="2.1" edition="alpha2"/>
        <vers num="2.1" edition="alpha3"/>
        <vers num="2.1" edition="beta1"/>
        <vers num="2.1" edition="beta2"/>
        <vers num="2.1" edition="beta3"/>
        <vers num="2.1" edition="rc1"/>
        <vers num="2.1" edition="rc2"/>
        <vers num="2.10" edition="beta1"/>
        <vers num="2.10" edition="beta2"/>
        <vers num="2.10" edition="beta3"/>
        <vers num="2.10.1"/>
        <vers num="2.11" edition="beta1"/>
        <vers num="2.11" edition="beta2"/>
        <vers num="2.11" edition="beta3"/>
        <vers num="2.11" edition="beta4"/>
        <vers num="2.11" edition="beta5"/>
        <vers num="2.11" edition="beta6"/>
        <vers num="2.12" edition="beta1"/>
        <vers num="2.12" edition="beta2"/>
        <vers num="2.12" edition="beta3"/>
        <vers num="2.12" edition="beta4"/>
        <vers num="2.12" edition="beta5"/>
        <vers num="2.12" edition="beta6"/>
        <vers num="2.12.1"/>
        <vers num="2.13" edition="beta1"/>
        <vers num="2.13" edition="beta2"/>
        <vers num="2.13" edition="beta3"/>
        <vers num="2.13" edition="beta4"/>
        <vers num="2.13" edition="beta5"/>
        <vers num="2.13" edition="beta6"/>
        <vers num="2.13.1"/>
        <vers num="2.13.2"/>
        <vers num="2.14" edition="beta1"/>
        <vers num="2.14" edition="beta2"/>
        <vers num="2.14" edition="beta3"/>
        <vers num="2.14" edition="beta4"/>
        <vers num="2.14" edition="beta5"/>
        <vers num="2.15" edition="beta1"/>
        <vers num="2.15" edition="beta2"/>
        <vers num="2.15" edition="beta3"/>
        <vers num="2.15" edition="beta4"/>
        <vers num="2.15" edition="beta5"/>
        <vers num="2.15" edition="beta6"/>
        <vers num="2.15.1"/>
        <vers num="2.15.2"/>
        <vers num="2.16" edition="beta1"/>
        <vers num="2.16" edition="beta2"/>
        <vers num="2.16" edition="beta3"/>
        <vers num="2.16" edition="beta4"/>
        <vers num="2.16" edition="beta5"/>
        <vers num="2.16.1"/>
        <vers num="2.16.2"/>
        <vers num="2.17" edition="beta1"/>
        <vers num="2.17" edition="beta2"/>
        <vers num="2.17" edition="beta3"/>
        <vers num="2.17" edition="beta4"/>
        <vers num="2.17.1"/>
        <vers num="2.18" edition="beta1"/>
        <vers num="2.18" edition="beta2"/>
        <vers num="2.18" edition="beta3"/>
        <vers num="2.18" edition="beta4"/>
        <vers num="2.19" edition="beta1"/>
        <vers num="2.19" edition="beta2"/>
        <vers num="2.2" edition="beta1"/>
        <vers num="2.2" edition="beta2"/>
        <vers num="2.2" edition="beta3"/>
        <vers num="2.20" edition="beta1"/>
        <vers num="2.20" edition="beta2"/>
        <vers num="2.20" edition="beta3"/>
        <vers num="2.21" edition="beta1"/>
        <vers num="2.21" edition="beta2"/>
        <vers num="2.22" edition="beta1"/>
        <vers num="2.22" edition="beta2"/>
        <vers num="2.22.1"/>
        <vers num="2.23" edition="beta1"/>
        <vers num="2.23" edition="beta2"/>
        <vers num="2.24" edition="beta1"/>
        <vers num="2.25" edition="-"/>
        <vers num="2.25" edition="beta1"/>
        <vers num="2.25" edition="beta2"/>
        <vers num="2.25" edition="beta3"/>
        <vers prev="1" num="2.26" edition="rc1"/>
        <vers num="2.3" edition="beta1"/>
        <vers num="2.3" edition="beta2"/>
        <vers num="2.3" edition="beta3"/>
        <vers num="2.3.1"/>
        <vers num="2.3.2"/>
        <vers num="2.3.3"/>
        <vers num="2.4" edition="beta1"/>
        <vers num="2.4" edition="beta2"/>
        <vers num="2.4" edition="beta3"/>
        <vers num="2.4.1"/>
        <vers num="2.5" edition="beta1"/>
        <vers num="2.5" edition="beta2"/>
        <vers num="2.5" edition="beta3"/>
        <vers num="2.5" edition="beta4"/>
        <vers num="2.6" edition="beta1"/>
        <vers num="2.6" edition="beta2"/>
        <vers num="2.6" edition="beta3"/>
        <vers num="2.6" edition="beta4"/>
        <vers num="2.6.1"/>
        <vers num="2.7" edition="beta1"/>
        <vers num="2.7" edition="beta2"/>
        <vers num="2.7" edition="beta3"/>
        <vers num="2.7" edition="beta4"/>
        <vers num="2.7" edition="beta5"/>
        <vers num="2.7.1"/>
        <vers num="2.7.2"/>
        <vers num="2.8" edition="beta1"/>
        <vers num="2.8" edition="beta2"/>
        <vers num="2.8" edition="beta3"/>
        <vers num="2.8" edition="beta4"/>
        <vers num="2.8" edition="beta5"/>
        <vers num="2.8" edition="beta6"/>
        <vers num="2.9" edition="beta1"/>
        <vers num="2.9" edition="beta2"/>
        <vers num="2.9" edition="beta3"/>
        <vers num="2.9" edition="beta4"/>
        <vers num="2.9.1"/>
      </prod>
      <prod vendor="mozilla" name="thunderbird">
        <vers num="0.1"/>
        <vers num="0.2"/>
        <vers num="0.3"/>
        <vers num="0.4"/>
        <vers num="0.5"/>
        <vers num="0.6"/>
        <vers num="0.7"/>
        <vers num="0.7.1"/>
        <vers num="0.7.2"/>
        <vers num="0.7.3"/>
        <vers num="0.8"/>
        <vers num="0.9"/>
        <vers num="1.0"/>
        <vers num="1.0.1"/>
        <vers num="1.0.2"/>
        <vers num="1.0.3"/>
        <vers num="1.0.4"/>
        <vers num="1.0.5" edition="beta"/>
        <vers num="1.0.6"/>
        <vers num="1.0.7"/>
        <vers num="1.0.8"/>
        <vers num="1.5" edition="beta2"/>
        <vers num="1.5.0.1"/>
        <vers num="1.5.0.10"/>
        <vers num="1.5.0.11"/>
        <vers num="1.5.0.12"/>
        <vers num="1.5.0.13"/>
        <vers num="1.5.0.14"/>
        <vers num="1.5.0.2"/>
        <vers num="1.5.0.3"/>
        <vers num="1.5.0.4"/>
        <vers num="1.5.0.5"/>
        <vers num="1.5.0.6"/>
        <vers num="1.5.0.7"/>
        <vers num="1.5.0.8"/>
        <vers num="1.5.0.9"/>
        <vers num="1.5.1"/>
        <vers num="1.5.2"/>
        <vers num="1.7.1"/>
        <vers num="1.7.3"/>
        <vers num="10.0"/>
        <vers num="10.0.1"/>
        <vers num="10.0.2"/>
        <vers num="10.0.3"/>
        <vers num="10.0.4"/>
        <vers num="11.0"/>
        <vers num="11.0.1"/>
        <vers num="12.0"/>
        <vers num="12.0.1"/>
        <vers num="13.0"/>
        <vers num="13.0.1"/>
        <vers num="14.0"/>
        <vers num="15.0"/>
        <vers num="15.0.1"/>
        <vers num="16.0"/>
        <vers num="16.0.1"/>
        <vers num="16.0.2"/>
        <vers num="17.0"/>
        <vers num="17.0.1"/>
        <vers num="17.0.2"/>
        <vers num="17.0.3"/>
        <vers num="17.0.4"/>
        <vers num="17.0.5"/>
        <vers num="17.0.6"/>
        <vers num="17.0.7"/>
        <vers num="17.0.8"/>
        <vers num="2.0"/>
        <vers num="2.0.0.0"/>
        <vers num="2.0.0.1"/>
        <vers num="2.0.0.11"/>
        <vers num="2.0.0.12"/>
        <vers num="2.0.0.13"/>
        <vers num="2.0.0.14"/>
        <vers num="2.0.0.15"/>
        <vers num="2.0.0.16"/>
        <vers num="2.0.0.17"/>
        <vers num="2.0.0.18"/>
        <vers num="2.0.0.19"/>
        <vers num="2.0.0.2"/>
        <vers num="2.0.0.20"/>
        <vers num="2.0.0.21"/>
        <vers num="2.0.0.22"/>
        <vers num="2.0.0.23"/>
        <vers num="2.0.0.3"/>
        <vers num="2.0.0.4"/>
        <vers num="2.0.0.5"/>
        <vers num="2.0.0.6"/>
        <vers num="2.0.0.7"/>
        <vers num="2.0.0.8"/>
        <vers num="2.0.0.9"/>
        <vers num="24.0"/>
        <vers num="24.0.1"/>
        <vers num="24.1"/>
        <vers num="24.1.1"/>
        <vers num="24.2"/>
        <vers num="24.3"/>
        <vers prev="1" num="24.4"/>
        <vers num="3.0"/>
        <vers num="3.0.1"/>
        <vers num="3.0.10"/>
        <vers num="3.0.11"/>
        <vers num="3.0.2"/>
        <vers num="3.0.3"/>
        <vers num="3.0.4"/>
        <vers num="3.0.5"/>
        <vers num="3.0.6"/>
        <vers num="3.0.7"/>
        <vers num="3.0.8"/>
        <vers num="3.0.9"/>
        <vers num="3.1"/>
        <vers num="3.1.1"/>
        <vers num="3.1.10"/>
        <vers num="3.1.11"/>
        <vers num="3.1.12"/>
        <vers num="3.1.13"/>
        <vers num="3.1.14"/>
        <vers num="3.1.15"/>
        <vers num="3.1.16"/>
        <vers num="3.1.17"/>
        <vers num="3.1.2"/>
        <vers num="3.1.3"/>
        <vers num="3.1.4"/>
        <vers num="3.1.5"/>
        <vers num="3.1.6"/>
        <vers num="3.1.7"/>
        <vers num="3.1.8"/>
        <vers num="3.1.9"/>
        <vers num="5.0"/>
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers num="6.0.2"/>
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="8.0"/>
        <vers num="9.0"/>
        <vers num="9.0.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1530" published="2014-04-30" name="CVE-2014-1530" modified="2014-04-30" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">The docshell implementation in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allows remote attackers to trigger the loading of a URL with a spoofed baseURI property, and conduct cross-site scripting (XSS) attacks, via a crafted web site that performs history navigation.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=895557" source="CONFIRM">https://bugzilla.mozilla.org/show_bug.cgi?id=895557</ref>
      <ref url="http://www.mozilla.org/security/announce/2014/mfsa2014-43.html" source="CONFIRM" adv="1">http://www.mozilla.org/security/announce/2014/mfsa2014-43.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="mozilla" name="firefox">
        <vers num="0.1"/>
        <vers num="0.10"/>
        <vers num="0.10.1"/>
        <vers num="0.2"/>
        <vers num="0.3"/>
        <vers num="0.4"/>
        <vers num="0.5"/>
        <vers num="0.6"/>
        <vers num="0.6.1"/>
        <vers num="0.7"/>
        <vers num="0.7.1"/>
        <vers num="0.8"/>
        <vers num="0.9" edition="rc"/>
        <vers num="0.9.1"/>
        <vers num="0.9.2"/>
        <vers num="0.9.3"/>
        <vers num="1.0" edition="preview_release"/>
        <vers num="1.0.1"/>
        <vers num="1.0.2"/>
        <vers num="1.0.3"/>
        <vers num="1.0.4"/>
        <vers num="1.0.5"/>
        <vers num="1.0.6"/>
        <vers num="1.0.7"/>
        <vers num="1.0.8"/>
        <vers num="1.5" edition="beta1"/>
        <vers num="1.5" edition="beta2"/>
        <vers num="1.5.0.1"/>
        <vers num="1.5.0.10"/>
        <vers num="1.5.0.11"/>
        <vers num="1.5.0.12"/>
        <vers num="1.5.0.2"/>
        <vers num="1.5.0.3"/>
        <vers num="1.5.0.4"/>
        <vers num="1.5.0.5"/>
        <vers num="1.5.0.6"/>
        <vers num="1.5.0.7"/>
        <vers num="1.5.0.8"/>
        <vers num="1.5.0.9"/>
        <vers num="1.5.1"/>
        <vers num="1.5.2"/>
        <vers num="1.5.3"/>
        <vers num="1.5.4"/>
        <vers num="1.5.5"/>
        <vers num="1.5.6"/>
        <vers num="1.5.7"/>
        <vers num="1.5.8"/>
        <vers num="10.0"/>
        <vers num="10.0.1"/>
        <vers num="10.0.10"/>
        <vers num="10.0.11"/>
        <vers num="10.0.12"/>
        <vers num="10.0.2"/>
        <vers num="10.0.3"/>
        <vers num="10.0.4"/>
        <vers num="10.0.5"/>
        <vers num="10.0.6"/>
        <vers num="10.0.7"/>
        <vers num="10.0.8"/>
        <vers num="10.0.9"/>
        <vers num="11.0"/>
        <vers num="12.0" edition="beta6"/>
        <vers num="13.0"/>
        <vers num="13.0.1"/>
        <vers num="14.0"/>
        <vers num="14.0.1"/>
        <vers num="15.0"/>
        <vers num="15.0.1"/>
        <vers num="16.0"/>
        <vers num="16.0.1"/>
        <vers num="16.0.2"/>
        <vers num="17.0.10"/>
        <vers num="17.0.11"/>
        <vers num="17.0.2"/>
        <vers num="17.0.3"/>
        <vers num="17.0.4"/>
        <vers num="17.0.5"/>
        <vers num="17.0.6"/>
        <vers num="17.0.7"/>
        <vers num="17.0.8"/>
        <vers num="17.0.9"/>
        <vers num="18.0"/>
        <vers num="18.0.1"/>
        <vers num="18.0.2"/>
        <vers num="19.0"/>
        <vers num="19.0.1"/>
        <vers num="19.0.2"/>
        <vers num="2.0"/>
        <vers num="2.0.0.1"/>
        <vers num="2.0.0.10"/>
        <vers num="2.0.0.11"/>
        <vers num="2.0.0.12"/>
        <vers num="2.0.0.13"/>
        <vers num="2.0.0.14"/>
        <vers num="2.0.0.15"/>
        <vers num="2.0.0.16"/>
        <vers num="2.0.0.17"/>
        <vers num="2.0.0.18"/>
        <vers num="2.0.0.19"/>
        <vers num="2.0.0.2"/>
        <vers num="2.0.0.20"/>
        <vers num="2.0.0.3"/>
        <vers num="2.0.0.4"/>
        <vers num="2.0.0.5"/>
        <vers num="2.0.0.6"/>
        <vers num="2.0.0.7"/>
        <vers num="2.0.0.8"/>
        <vers num="2.0.0.9"/>
        <vers num="20.0"/>
        <vers num="20.0.1"/>
        <vers num="21.0"/>
        <vers num="23.0"/>
        <vers num="23.0.1"/>
        <vers num="24.0"/>
        <vers num="24.1"/>
        <vers num="24.1.1"/>
        <vers num="25.0"/>
        <vers num="25.0.1"/>
        <vers num="26.0"/>
        <vers num="27.0"/>
        <vers num="27.0.1"/>
        <vers prev="1" num="28.0"/>
        <vers num="3.0"/>
        <vers num="3.0.1"/>
        <vers num="3.0.10"/>
        <vers num="3.0.11"/>
        <vers num="3.0.12"/>
        <vers num="3.0.13"/>
        <vers num="3.0.14"/>
        <vers num="3.0.15"/>
        <vers num="3.0.16"/>
        <vers num="3.0.17"/>
        <vers num="3.0.18"/>
        <vers num="3.0.19"/>
        <vers num="3.0.2"/>
        <vers num="3.0.3"/>
        <vers num="3.0.4"/>
        <vers num="3.0.5"/>
        <vers num="3.0.6"/>
        <vers num="3.0.7"/>
        <vers num="3.0.8"/>
        <vers num="3.0.9"/>
        <vers num="3.5"/>
        <vers num="3.5.1"/>
        <vers num="3.5.10"/>
        <vers num="3.5.11"/>
        <vers num="3.5.12"/>
        <vers num="3.5.13"/>
        <vers num="3.5.14"/>
        <vers num="3.5.15"/>
        <vers num="3.5.16"/>
        <vers num="3.5.17"/>
        <vers num="3.5.18"/>
        <vers num="3.5.19"/>
        <vers num="3.5.2"/>
        <vers num="3.5.3"/>
        <vers num="3.5.4"/>
        <vers num="3.5.5"/>
        <vers num="3.5.6"/>
        <vers num="3.5.7"/>
        <vers num="3.5.8"/>
        <vers num="3.5.9"/>
        <vers num="3.6"/>
        <vers num="3.6.10"/>
        <vers num="3.6.11"/>
        <vers num="3.6.12"/>
        <vers num="3.6.13"/>
        <vers num="3.6.14"/>
        <vers num="3.6.15"/>
        <vers num="3.6.16"/>
        <vers num="3.6.17"/>
        <vers num="3.6.18"/>
        <vers num="3.6.19"/>
        <vers num="3.6.2"/>
        <vers num="3.6.20"/>
        <vers num="3.6.21"/>
        <vers num="3.6.22"/>
        <vers num="3.6.23"/>
        <vers num="3.6.24"/>
        <vers num="3.6.25"/>
        <vers num="3.6.26"/>
        <vers num="3.6.27"/>
        <vers num="3.6.28"/>
        <vers num="3.6.3"/>
        <vers num="3.6.4"/>
        <vers num="3.6.6"/>
        <vers num="3.6.7"/>
        <vers num="3.6.8"/>
        <vers num="3.6.9"/>
        <vers num="4.0" edition="beta1"/>
        <vers num="4.0" edition="beta10"/>
        <vers num="4.0" edition="beta11"/>
        <vers num="4.0" edition="beta12"/>
        <vers num="4.0" edition="beta2"/>
        <vers num="4.0" edition="beta3"/>
        <vers num="4.0" edition="beta4"/>
        <vers num="4.0" edition="beta5"/>
        <vers num="4.0" edition="beta6"/>
        <vers num="4.0" edition="beta7"/>
        <vers num="4.0" edition="beta8"/>
        <vers num="4.0" edition="beta9"/>
        <vers num="4.0.1"/>
        <vers num="5.0"/>
        <vers num="5.0.1"/>
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers num="6.0.2"/>
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="8.0"/>
        <vers num="8.0.1"/>
        <vers num="9.0"/>
        <vers num="9.0.1"/>
      </prod>
      <prod vendor="mozilla" name="firefox_esr">
        <vers num="24.0"/>
        <vers num="24.0.1"/>
        <vers num="24.0.2"/>
        <vers num="24.1.0"/>
        <vers num="24.1.1"/>
        <vers num="24.2"/>
        <vers num="24.3"/>
        <vers num="24.4"/>
      </prod>
      <prod vendor="mozilla" name="seamonkey">
        <vers num="2.0" edition="alpha_1"/>
        <vers num="2.0" edition="alpha_2"/>
        <vers num="2.0" edition="alpha_3"/>
        <vers num="2.0" edition="beta_1"/>
        <vers num="2.0" edition="beta_2"/>
        <vers num="2.0" edition="rc1"/>
        <vers num="2.0" edition="rc2"/>
        <vers num="2.0.1"/>
        <vers num="2.0.10"/>
        <vers num="2.0.11"/>
        <vers num="2.0.12"/>
        <vers num="2.0.13"/>
        <vers num="2.0.14"/>
        <vers num="2.0.2"/>
        <vers num="2.0.3"/>
        <vers num="2.0.4"/>
        <vers num="2.0.5"/>
        <vers num="2.0.6"/>
        <vers num="2.0.7"/>
        <vers num="2.0.8"/>
        <vers num="2.0.9"/>
        <vers num="2.1" edition="alpha1"/>
        <vers num="2.1" edition="alpha2"/>
        <vers num="2.1" edition="alpha3"/>
        <vers num="2.1" edition="beta1"/>
        <vers num="2.1" edition="beta2"/>
        <vers num="2.1" edition="beta3"/>
        <vers num="2.1" edition="rc1"/>
        <vers num="2.1" edition="rc2"/>
        <vers num="2.10" edition="beta1"/>
        <vers num="2.10" edition="beta2"/>
        <vers num="2.10" edition="beta3"/>
        <vers num="2.10.1"/>
        <vers num="2.11" edition="beta1"/>
        <vers num="2.11" edition="beta2"/>
        <vers num="2.11" edition="beta3"/>
        <vers num="2.11" edition="beta4"/>
        <vers num="2.11" edition="beta5"/>
        <vers num="2.11" edition="beta6"/>
        <vers num="2.12" edition="beta1"/>
        <vers num="2.12" edition="beta2"/>
        <vers num="2.12" edition="beta3"/>
        <vers num="2.12" edition="beta4"/>
        <vers num="2.12" edition="beta5"/>
        <vers num="2.12" edition="beta6"/>
        <vers num="2.12.1"/>
        <vers num="2.13" edition="beta1"/>
        <vers num="2.13" edition="beta2"/>
        <vers num="2.13" edition="beta3"/>
        <vers num="2.13" edition="beta4"/>
        <vers num="2.13" edition="beta5"/>
        <vers num="2.13" edition="beta6"/>
        <vers num="2.13.1"/>
        <vers num="2.13.2"/>
        <vers num="2.14" edition="beta1"/>
        <vers num="2.14" edition="beta2"/>
        <vers num="2.14" edition="beta3"/>
        <vers num="2.14" edition="beta4"/>
        <vers num="2.14" edition="beta5"/>
        <vers num="2.15" edition="beta1"/>
        <vers num="2.15" edition="beta2"/>
        <vers num="2.15" edition="beta3"/>
        <vers num="2.15" edition="beta4"/>
        <vers num="2.15" edition="beta5"/>
        <vers num="2.15" edition="beta6"/>
        <vers num="2.15.1"/>
        <vers num="2.15.2"/>
        <vers num="2.16" edition="beta1"/>
        <vers num="2.16" edition="beta2"/>
        <vers num="2.16" edition="beta3"/>
        <vers num="2.16" edition="beta4"/>
        <vers num="2.16" edition="beta5"/>
        <vers num="2.16.1"/>
        <vers num="2.16.2"/>
        <vers num="2.17" edition="beta1"/>
        <vers num="2.17" edition="beta2"/>
        <vers num="2.17" edition="beta3"/>
        <vers num="2.17" edition="beta4"/>
        <vers num="2.17.1"/>
        <vers num="2.18" edition="beta1"/>
        <vers num="2.18" edition="beta2"/>
        <vers num="2.18" edition="beta3"/>
        <vers num="2.18" edition="beta4"/>
        <vers num="2.19" edition="beta1"/>
        <vers num="2.19" edition="beta2"/>
        <vers num="2.2" edition="beta1"/>
        <vers num="2.2" edition="beta2"/>
        <vers num="2.2" edition="beta3"/>
        <vers num="2.20" edition="beta1"/>
        <vers num="2.20" edition="beta2"/>
        <vers num="2.20" edition="beta3"/>
        <vers num="2.21" edition="beta1"/>
        <vers num="2.21" edition="beta2"/>
        <vers num="2.22" edition="beta1"/>
        <vers num="2.22" edition="beta2"/>
        <vers num="2.22.1"/>
        <vers num="2.23" edition="beta1"/>
        <vers num="2.23" edition="beta2"/>
        <vers num="2.24" edition="beta1"/>
        <vers num="2.25" edition="-"/>
        <vers num="2.25" edition="beta1"/>
        <vers num="2.25" edition="beta2"/>
        <vers num="2.25" edition="beta3"/>
        <vers prev="1" num="2.26" edition="rc1"/>
        <vers num="2.3" edition="beta1"/>
        <vers num="2.3" edition="beta2"/>
        <vers num="2.3" edition="beta3"/>
        <vers num="2.3.1"/>
        <vers num="2.3.2"/>
        <vers num="2.3.3"/>
        <vers num="2.4" edition="beta1"/>
        <vers num="2.4" edition="beta2"/>
        <vers num="2.4" edition="beta3"/>
        <vers num="2.4.1"/>
        <vers num="2.5" edition="beta1"/>
        <vers num="2.5" edition="beta2"/>
        <vers num="2.5" edition="beta3"/>
        <vers num="2.5" edition="beta4"/>
        <vers num="2.6" edition="beta1"/>
        <vers num="2.6" edition="beta2"/>
        <vers num="2.6" edition="beta3"/>
        <vers num="2.6" edition="beta4"/>
        <vers num="2.6.1"/>
        <vers num="2.7" edition="beta1"/>
        <vers num="2.7" edition="beta2"/>
        <vers num="2.7" edition="beta3"/>
        <vers num="2.7" edition="beta4"/>
        <vers num="2.7" edition="beta5"/>
        <vers num="2.7.1"/>
        <vers num="2.7.2"/>
        <vers num="2.8" edition="beta1"/>
        <vers num="2.8" edition="beta2"/>
        <vers num="2.8" edition="beta3"/>
        <vers num="2.8" edition="beta4"/>
        <vers num="2.8" edition="beta5"/>
        <vers num="2.8" edition="beta6"/>
        <vers num="2.9" edition="beta1"/>
        <vers num="2.9" edition="beta2"/>
        <vers num="2.9" edition="beta3"/>
        <vers num="2.9" edition="beta4"/>
        <vers num="2.9.1"/>
      </prod>
      <prod vendor="mozilla" name="thunderbird">
        <vers num="0.1"/>
        <vers num="0.2"/>
        <vers num="0.3"/>
        <vers num="0.4"/>
        <vers num="0.5"/>
        <vers num="0.6"/>
        <vers num="0.7"/>
        <vers num="0.7.1"/>
        <vers num="0.7.2"/>
        <vers num="0.7.3"/>
        <vers num="0.8"/>
        <vers num="0.9"/>
        <vers num="1.0"/>
        <vers num="1.0.1"/>
        <vers num="1.0.2"/>
        <vers num="1.0.3"/>
        <vers num="1.0.4"/>
        <vers num="1.0.5" edition="beta"/>
        <vers num="1.0.6"/>
        <vers num="1.0.7"/>
        <vers num="1.0.8"/>
        <vers num="1.5" edition="beta2"/>
        <vers num="1.5.0.1"/>
        <vers num="1.5.0.10"/>
        <vers num="1.5.0.11"/>
        <vers num="1.5.0.12"/>
        <vers num="1.5.0.13"/>
        <vers num="1.5.0.14"/>
        <vers num="1.5.0.2"/>
        <vers num="1.5.0.3"/>
        <vers num="1.5.0.4"/>
        <vers num="1.5.0.5"/>
        <vers num="1.5.0.6"/>
        <vers num="1.5.0.7"/>
        <vers num="1.5.0.8"/>
        <vers num="1.5.0.9"/>
        <vers num="1.5.1"/>
        <vers num="1.5.2"/>
        <vers num="1.7.1"/>
        <vers num="1.7.3"/>
        <vers num="10.0"/>
        <vers num="10.0.1"/>
        <vers num="10.0.2"/>
        <vers num="10.0.3"/>
        <vers num="10.0.4"/>
        <vers num="11.0"/>
        <vers num="11.0.1"/>
        <vers num="12.0"/>
        <vers num="12.0.1"/>
        <vers num="13.0"/>
        <vers num="13.0.1"/>
        <vers num="14.0"/>
        <vers num="15.0"/>
        <vers num="15.0.1"/>
        <vers num="16.0"/>
        <vers num="16.0.1"/>
        <vers num="16.0.2"/>
        <vers num="17.0"/>
        <vers num="17.0.1"/>
        <vers num="17.0.2"/>
        <vers num="17.0.3"/>
        <vers num="17.0.4"/>
        <vers num="17.0.5"/>
        <vers num="17.0.6"/>
        <vers num="17.0.7"/>
        <vers num="17.0.8"/>
        <vers num="2.0"/>
        <vers num="2.0.0.0"/>
        <vers num="2.0.0.1"/>
        <vers num="2.0.0.11"/>
        <vers num="2.0.0.12"/>
        <vers num="2.0.0.13"/>
        <vers num="2.0.0.14"/>
        <vers num="2.0.0.15"/>
        <vers num="2.0.0.16"/>
        <vers num="2.0.0.17"/>
        <vers num="2.0.0.18"/>
        <vers num="2.0.0.19"/>
        <vers num="2.0.0.2"/>
        <vers num="2.0.0.20"/>
        <vers num="2.0.0.21"/>
        <vers num="2.0.0.22"/>
        <vers num="2.0.0.23"/>
        <vers num="2.0.0.3"/>
        <vers num="2.0.0.4"/>
        <vers num="2.0.0.5"/>
        <vers num="2.0.0.6"/>
        <vers num="2.0.0.7"/>
        <vers num="2.0.0.8"/>
        <vers num="2.0.0.9"/>
        <vers num="24.0"/>
        <vers num="24.0.1"/>
        <vers num="24.1"/>
        <vers num="24.1.1"/>
        <vers num="24.2"/>
        <vers num="24.3"/>
        <vers prev="1" num="24.4"/>
        <vers num="3.0"/>
        <vers num="3.0.1"/>
        <vers num="3.0.10"/>
        <vers num="3.0.11"/>
        <vers num="3.0.2"/>
        <vers num="3.0.3"/>
        <vers num="3.0.4"/>
        <vers num="3.0.5"/>
        <vers num="3.0.6"/>
        <vers num="3.0.7"/>
        <vers num="3.0.8"/>
        <vers num="3.0.9"/>
        <vers num="3.1"/>
        <vers num="3.1.1"/>
        <vers num="3.1.10"/>
        <vers num="3.1.11"/>
        <vers num="3.1.12"/>
        <vers num="3.1.13"/>
        <vers num="3.1.14"/>
        <vers num="3.1.15"/>
        <vers num="3.1.16"/>
        <vers num="3.1.17"/>
        <vers num="3.1.2"/>
        <vers num="3.1.3"/>
        <vers num="3.1.4"/>
        <vers num="3.1.5"/>
        <vers num="3.1.6"/>
        <vers num="3.1.7"/>
        <vers num="3.1.8"/>
        <vers num="3.1.9"/>
        <vers num="5.0"/>
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers num="6.0.2"/>
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="8.0"/>
        <vers num="9.0"/>
        <vers num="9.0.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1531" published="2014-04-30" name="CVE-2014-1531" modified="2014-04-30" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:C/I:C/A:C)" CVSS_score="10.0" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="10.0" CVSS_base_score="10.0">
    <desc>
      <descript source="cve">Use-after-free vulnerability in the nsGenericHTMLElement::GetWidthHeightForImage function in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via vectors involving an imgLoader object that is not properly handled during an image-resize operation.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=987140" source="CONFIRM">https://bugzilla.mozilla.org/show_bug.cgi?id=987140</ref>
      <ref url="http://www.mozilla.org/security/announce/2014/mfsa2014-44.html" source="CONFIRM" adv="1">http://www.mozilla.org/security/announce/2014/mfsa2014-44.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="mozilla" name="firefox">
        <vers num="0.1"/>
        <vers num="0.10"/>
        <vers num="0.10.1"/>
        <vers num="0.2"/>
        <vers num="0.3"/>
        <vers num="0.4"/>
        <vers num="0.5"/>
        <vers num="0.6"/>
        <vers num="0.6.1"/>
        <vers num="0.7"/>
        <vers num="0.7.1"/>
        <vers num="0.8"/>
        <vers num="0.9" edition="rc"/>
        <vers num="0.9.1"/>
        <vers num="0.9.2"/>
        <vers num="0.9.3"/>
        <vers num="1.0" edition="preview_release"/>
        <vers num="1.0.1"/>
        <vers num="1.0.2"/>
        <vers num="1.0.3"/>
        <vers num="1.0.4"/>
        <vers num="1.0.5"/>
        <vers num="1.0.6"/>
        <vers num="1.0.7"/>
        <vers num="1.0.8"/>
        <vers num="1.5" edition="beta1"/>
        <vers num="1.5" edition="beta2"/>
        <vers num="1.5.0.1"/>
        <vers num="1.5.0.10"/>
        <vers num="1.5.0.11"/>
        <vers num="1.5.0.12"/>
        <vers num="1.5.0.2"/>
        <vers num="1.5.0.3"/>
        <vers num="1.5.0.4"/>
        <vers num="1.5.0.5"/>
        <vers num="1.5.0.6"/>
        <vers num="1.5.0.7"/>
        <vers num="1.5.0.8"/>
        <vers num="1.5.0.9"/>
        <vers num="1.5.1"/>
        <vers num="1.5.2"/>
        <vers num="1.5.3"/>
        <vers num="1.5.4"/>
        <vers num="1.5.5"/>
        <vers num="1.5.6"/>
        <vers num="1.5.7"/>
        <vers num="1.5.8"/>
        <vers num="10.0"/>
        <vers num="10.0.1"/>
        <vers num="10.0.10"/>
        <vers num="10.0.11"/>
        <vers num="10.0.12"/>
        <vers num="10.0.2"/>
        <vers num="10.0.3"/>
        <vers num="10.0.4"/>
        <vers num="10.0.5"/>
        <vers num="10.0.6"/>
        <vers num="10.0.7"/>
        <vers num="10.0.8"/>
        <vers num="10.0.9"/>
        <vers num="11.0"/>
        <vers num="12.0" edition="beta6"/>
        <vers num="13.0"/>
        <vers num="13.0.1"/>
        <vers num="14.0"/>
        <vers num="14.0.1"/>
        <vers num="15.0"/>
        <vers num="15.0.1"/>
        <vers num="16.0"/>
        <vers num="16.0.1"/>
        <vers num="16.0.2"/>
        <vers num="17.0.10"/>
        <vers num="17.0.11"/>
        <vers num="17.0.2"/>
        <vers num="17.0.3"/>
        <vers num="17.0.4"/>
        <vers num="17.0.5"/>
        <vers num="17.0.6"/>
        <vers num="17.0.7"/>
        <vers num="17.0.8"/>
        <vers num="17.0.9"/>
        <vers num="18.0"/>
        <vers num="18.0.1"/>
        <vers num="18.0.2"/>
        <vers num="19.0"/>
        <vers num="19.0.1"/>
        <vers num="19.0.2"/>
        <vers num="2.0"/>
        <vers num="2.0.0.1"/>
        <vers num="2.0.0.10"/>
        <vers num="2.0.0.11"/>
        <vers num="2.0.0.12"/>
        <vers num="2.0.0.13"/>
        <vers num="2.0.0.14"/>
        <vers num="2.0.0.15"/>
        <vers num="2.0.0.16"/>
        <vers num="2.0.0.17"/>
        <vers num="2.0.0.18"/>
        <vers num="2.0.0.19"/>
        <vers num="2.0.0.2"/>
        <vers num="2.0.0.20"/>
        <vers num="2.0.0.3"/>
        <vers num="2.0.0.4"/>
        <vers num="2.0.0.5"/>
        <vers num="2.0.0.6"/>
        <vers num="2.0.0.7"/>
        <vers num="2.0.0.8"/>
        <vers num="2.0.0.9"/>
        <vers num="20.0"/>
        <vers num="20.0.1"/>
        <vers num="21.0"/>
        <vers num="23.0"/>
        <vers num="23.0.1"/>
        <vers num="24.0"/>
        <vers num="24.1"/>
        <vers num="24.1.1"/>
        <vers num="25.0"/>
        <vers num="25.0.1"/>
        <vers num="26.0"/>
        <vers num="27.0"/>
        <vers num="27.0.1"/>
        <vers prev="1" num="28.0"/>
        <vers num="3.0"/>
        <vers num="3.0.1"/>
        <vers num="3.0.10"/>
        <vers num="3.0.11"/>
        <vers num="3.0.12"/>
        <vers num="3.0.13"/>
        <vers num="3.0.14"/>
        <vers num="3.0.15"/>
        <vers num="3.0.16"/>
        <vers num="3.0.17"/>
        <vers num="3.0.18"/>
        <vers num="3.0.19"/>
        <vers num="3.0.2"/>
        <vers num="3.0.3"/>
        <vers num="3.0.4"/>
        <vers num="3.0.5"/>
        <vers num="3.0.6"/>
        <vers num="3.0.7"/>
        <vers num="3.0.8"/>
        <vers num="3.0.9"/>
        <vers num="3.5"/>
        <vers num="3.5.1"/>
        <vers num="3.5.10"/>
        <vers num="3.5.11"/>
        <vers num="3.5.12"/>
        <vers num="3.5.13"/>
        <vers num="3.5.14"/>
        <vers num="3.5.15"/>
        <vers num="3.5.16"/>
        <vers num="3.5.17"/>
        <vers num="3.5.18"/>
        <vers num="3.5.19"/>
        <vers num="3.5.2"/>
        <vers num="3.5.3"/>
        <vers num="3.5.4"/>
        <vers num="3.5.5"/>
        <vers num="3.5.6"/>
        <vers num="3.5.7"/>
        <vers num="3.5.8"/>
        <vers num="3.5.9"/>
        <vers num="3.6"/>
        <vers num="3.6.10"/>
        <vers num="3.6.11"/>
        <vers num="3.6.12"/>
        <vers num="3.6.13"/>
        <vers num="3.6.14"/>
        <vers num="3.6.15"/>
        <vers num="3.6.16"/>
        <vers num="3.6.17"/>
        <vers num="3.6.18"/>
        <vers num="3.6.19"/>
        <vers num="3.6.2"/>
        <vers num="3.6.20"/>
        <vers num="3.6.21"/>
        <vers num="3.6.22"/>
        <vers num="3.6.23"/>
        <vers num="3.6.24"/>
        <vers num="3.6.25"/>
        <vers num="3.6.26"/>
        <vers num="3.6.27"/>
        <vers num="3.6.28"/>
        <vers num="3.6.3"/>
        <vers num="3.6.4"/>
        <vers num="3.6.6"/>
        <vers num="3.6.7"/>
        <vers num="3.6.8"/>
        <vers num="3.6.9"/>
        <vers num="4.0" edition="beta1"/>
        <vers num="4.0" edition="beta10"/>
        <vers num="4.0" edition="beta11"/>
        <vers num="4.0" edition="beta12"/>
        <vers num="4.0" edition="beta2"/>
        <vers num="4.0" edition="beta3"/>
        <vers num="4.0" edition="beta4"/>
        <vers num="4.0" edition="beta5"/>
        <vers num="4.0" edition="beta6"/>
        <vers num="4.0" edition="beta7"/>
        <vers num="4.0" edition="beta8"/>
        <vers num="4.0" edition="beta9"/>
        <vers num="4.0.1"/>
        <vers num="5.0"/>
        <vers num="5.0.1"/>
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers num="6.0.2"/>
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="8.0"/>
        <vers num="8.0.1"/>
        <vers num="9.0"/>
        <vers num="9.0.1"/>
      </prod>
      <prod vendor="mozilla" name="firefox_esr">
        <vers num="24.0"/>
        <vers num="24.0.1"/>
        <vers num="24.0.2"/>
        <vers num="24.1.0"/>
        <vers num="24.1.1"/>
        <vers num="24.2"/>
        <vers num="24.3"/>
        <vers num="24.4"/>
      </prod>
      <prod vendor="mozilla" name="seamonkey">
        <vers num="2.0" edition="alpha_1"/>
        <vers num="2.0" edition="alpha_2"/>
        <vers num="2.0" edition="alpha_3"/>
        <vers num="2.0" edition="beta_1"/>
        <vers num="2.0" edition="beta_2"/>
        <vers num="2.0" edition="rc1"/>
        <vers num="2.0" edition="rc2"/>
        <vers num="2.0.1"/>
        <vers num="2.0.10"/>
        <vers num="2.0.11"/>
        <vers num="2.0.12"/>
        <vers num="2.0.13"/>
        <vers num="2.0.14"/>
        <vers num="2.0.2"/>
        <vers num="2.0.3"/>
        <vers num="2.0.4"/>
        <vers num="2.0.5"/>
        <vers num="2.0.6"/>
        <vers num="2.0.7"/>
        <vers num="2.0.8"/>
        <vers num="2.0.9"/>
        <vers num="2.1" edition="alpha1"/>
        <vers num="2.1" edition="alpha2"/>
        <vers num="2.1" edition="alpha3"/>
        <vers num="2.1" edition="beta1"/>
        <vers num="2.1" edition="beta2"/>
        <vers num="2.1" edition="beta3"/>
        <vers num="2.1" edition="rc1"/>
        <vers num="2.1" edition="rc2"/>
        <vers num="2.10" edition="beta1"/>
        <vers num="2.10" edition="beta2"/>
        <vers num="2.10" edition="beta3"/>
        <vers num="2.10.1"/>
        <vers num="2.11" edition="beta1"/>
        <vers num="2.11" edition="beta2"/>
        <vers num="2.11" edition="beta3"/>
        <vers num="2.11" edition="beta4"/>
        <vers num="2.11" edition="beta5"/>
        <vers num="2.11" edition="beta6"/>
        <vers num="2.12" edition="beta1"/>
        <vers num="2.12" edition="beta2"/>
        <vers num="2.12" edition="beta3"/>
        <vers num="2.12" edition="beta4"/>
        <vers num="2.12" edition="beta5"/>
        <vers num="2.12" edition="beta6"/>
        <vers num="2.12.1"/>
        <vers num="2.13" edition="beta1"/>
        <vers num="2.13" edition="beta2"/>
        <vers num="2.13" edition="beta3"/>
        <vers num="2.13" edition="beta4"/>
        <vers num="2.13" edition="beta5"/>
        <vers num="2.13" edition="beta6"/>
        <vers num="2.13.1"/>
        <vers num="2.13.2"/>
        <vers num="2.14" edition="beta1"/>
        <vers num="2.14" edition="beta2"/>
        <vers num="2.14" edition="beta3"/>
        <vers num="2.14" edition="beta4"/>
        <vers num="2.14" edition="beta5"/>
        <vers num="2.15" edition="beta1"/>
        <vers num="2.15" edition="beta2"/>
        <vers num="2.15" edition="beta3"/>
        <vers num="2.15" edition="beta4"/>
        <vers num="2.15" edition="beta5"/>
        <vers num="2.15" edition="beta6"/>
        <vers num="2.15.1"/>
        <vers num="2.15.2"/>
        <vers num="2.16" edition="beta1"/>
        <vers num="2.16" edition="beta2"/>
        <vers num="2.16" edition="beta3"/>
        <vers num="2.16" edition="beta4"/>
        <vers num="2.16" edition="beta5"/>
        <vers num="2.16.1"/>
        <vers num="2.16.2"/>
        <vers num="2.17" edition="beta1"/>
        <vers num="2.17" edition="beta2"/>
        <vers num="2.17" edition="beta3"/>
        <vers num="2.17" edition="beta4"/>
        <vers num="2.17.1"/>
        <vers num="2.18" edition="beta1"/>
        <vers num="2.18" edition="beta2"/>
        <vers num="2.18" edition="beta3"/>
        <vers num="2.18" edition="beta4"/>
        <vers num="2.19" edition="beta1"/>
        <vers num="2.19" edition="beta2"/>
        <vers num="2.2" edition="beta1"/>
        <vers num="2.2" edition="beta2"/>
        <vers num="2.2" edition="beta3"/>
        <vers num="2.20" edition="beta1"/>
        <vers num="2.20" edition="beta2"/>
        <vers num="2.20" edition="beta3"/>
        <vers num="2.21" edition="beta1"/>
        <vers num="2.21" edition="beta2"/>
        <vers num="2.22" edition="beta1"/>
        <vers num="2.22" edition="beta2"/>
        <vers num="2.22.1"/>
        <vers num="2.23" edition="beta1"/>
        <vers num="2.23" edition="beta2"/>
        <vers num="2.24" edition="beta1"/>
        <vers num="2.25" edition="-"/>
        <vers num="2.25" edition="beta1"/>
        <vers num="2.25" edition="beta2"/>
        <vers num="2.25" edition="beta3"/>
        <vers prev="1" num="2.26" edition="rc1"/>
        <vers num="2.3" edition="beta1"/>
        <vers num="2.3" edition="beta2"/>
        <vers num="2.3" edition="beta3"/>
        <vers num="2.3.1"/>
        <vers num="2.3.2"/>
        <vers num="2.3.3"/>
        <vers num="2.4" edition="beta1"/>
        <vers num="2.4" edition="beta2"/>
        <vers num="2.4" edition="beta3"/>
        <vers num="2.4.1"/>
        <vers num="2.5" edition="beta1"/>
        <vers num="2.5" edition="beta2"/>
        <vers num="2.5" edition="beta3"/>
        <vers num="2.5" edition="beta4"/>
        <vers num="2.6" edition="beta1"/>
        <vers num="2.6" edition="beta2"/>
        <vers num="2.6" edition="beta3"/>
        <vers num="2.6" edition="beta4"/>
        <vers num="2.6.1"/>
        <vers num="2.7" edition="beta1"/>
        <vers num="2.7" edition="beta2"/>
        <vers num="2.7" edition="beta3"/>
        <vers num="2.7" edition="beta4"/>
        <vers num="2.7" edition="beta5"/>
        <vers num="2.7.1"/>
        <vers num="2.7.2"/>
        <vers num="2.8" edition="beta1"/>
        <vers num="2.8" edition="beta2"/>
        <vers num="2.8" edition="beta3"/>
        <vers num="2.8" edition="beta4"/>
        <vers num="2.8" edition="beta5"/>
        <vers num="2.8" edition="beta6"/>
        <vers num="2.9" edition="beta1"/>
        <vers num="2.9" edition="beta2"/>
        <vers num="2.9" edition="beta3"/>
        <vers num="2.9" edition="beta4"/>
        <vers num="2.9.1"/>
      </prod>
      <prod vendor="mozilla" name="thunderbird">
        <vers num="0.1"/>
        <vers num="0.2"/>
        <vers num="0.3"/>
        <vers num="0.4"/>
        <vers num="0.5"/>
        <vers num="0.6"/>
        <vers num="0.7"/>
        <vers num="0.7.1"/>
        <vers num="0.7.2"/>
        <vers num="0.7.3"/>
        <vers num="0.8"/>
        <vers num="0.9"/>
        <vers num="1.0"/>
        <vers num="1.0.1"/>
        <vers num="1.0.2"/>
        <vers num="1.0.3"/>
        <vers num="1.0.4"/>
        <vers num="1.0.5" edition="beta"/>
        <vers num="1.0.6"/>
        <vers num="1.0.7"/>
        <vers num="1.0.8"/>
        <vers num="1.5" edition="beta2"/>
        <vers num="1.5.0.1"/>
        <vers num="1.5.0.10"/>
        <vers num="1.5.0.11"/>
        <vers num="1.5.0.12"/>
        <vers num="1.5.0.13"/>
        <vers num="1.5.0.14"/>
        <vers num="1.5.0.2"/>
        <vers num="1.5.0.3"/>
        <vers num="1.5.0.4"/>
        <vers num="1.5.0.5"/>
        <vers num="1.5.0.6"/>
        <vers num="1.5.0.7"/>
        <vers num="1.5.0.8"/>
        <vers num="1.5.0.9"/>
        <vers num="1.5.1"/>
        <vers num="1.5.2"/>
        <vers num="1.7.1"/>
        <vers num="1.7.3"/>
        <vers num="10.0"/>
        <vers num="10.0.1"/>
        <vers num="10.0.2"/>
        <vers num="10.0.3"/>
        <vers num="10.0.4"/>
        <vers num="11.0"/>
        <vers num="11.0.1"/>
        <vers num="12.0"/>
        <vers num="12.0.1"/>
        <vers num="13.0"/>
        <vers num="13.0.1"/>
        <vers num="14.0"/>
        <vers num="15.0"/>
        <vers num="15.0.1"/>
        <vers num="16.0"/>
        <vers num="16.0.1"/>
        <vers num="16.0.2"/>
        <vers num="17.0"/>
        <vers num="17.0.1"/>
        <vers num="17.0.2"/>
        <vers num="17.0.3"/>
        <vers num="17.0.4"/>
        <vers num="17.0.5"/>
        <vers num="17.0.6"/>
        <vers num="17.0.7"/>
        <vers num="17.0.8"/>
        <vers num="2.0"/>
        <vers num="2.0.0.0"/>
        <vers num="2.0.0.1"/>
        <vers num="2.0.0.11"/>
        <vers num="2.0.0.12"/>
        <vers num="2.0.0.13"/>
        <vers num="2.0.0.14"/>
        <vers num="2.0.0.15"/>
        <vers num="2.0.0.16"/>
        <vers num="2.0.0.17"/>
        <vers num="2.0.0.18"/>
        <vers num="2.0.0.19"/>
        <vers num="2.0.0.2"/>
        <vers num="2.0.0.20"/>
        <vers num="2.0.0.21"/>
        <vers num="2.0.0.22"/>
        <vers num="2.0.0.23"/>
        <vers num="2.0.0.3"/>
        <vers num="2.0.0.4"/>
        <vers num="2.0.0.5"/>
        <vers num="2.0.0.6"/>
        <vers num="2.0.0.7"/>
        <vers num="2.0.0.8"/>
        <vers num="2.0.0.9"/>
        <vers num="24.0"/>
        <vers num="24.0.1"/>
        <vers num="24.1"/>
        <vers num="24.1.1"/>
        <vers num="24.2"/>
        <vers num="24.3"/>
        <vers prev="1" num="24.4"/>
        <vers num="3.0"/>
        <vers num="3.0.1"/>
        <vers num="3.0.10"/>
        <vers num="3.0.11"/>
        <vers num="3.0.2"/>
        <vers num="3.0.3"/>
        <vers num="3.0.4"/>
        <vers num="3.0.5"/>
        <vers num="3.0.6"/>
        <vers num="3.0.7"/>
        <vers num="3.0.8"/>
        <vers num="3.0.9"/>
        <vers num="3.1"/>
        <vers num="3.1.1"/>
        <vers num="3.1.10"/>
        <vers num="3.1.11"/>
        <vers num="3.1.12"/>
        <vers num="3.1.13"/>
        <vers num="3.1.14"/>
        <vers num="3.1.15"/>
        <vers num="3.1.16"/>
        <vers num="3.1.17"/>
        <vers num="3.1.2"/>
        <vers num="3.1.3"/>
        <vers num="3.1.4"/>
        <vers num="3.1.5"/>
        <vers num="3.1.6"/>
        <vers num="3.1.7"/>
        <vers num="3.1.8"/>
        <vers num="3.1.9"/>
        <vers num="5.0"/>
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers num="6.0.2"/>
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="8.0"/>
        <vers num="9.0"/>
        <vers num="9.0.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1532" published="2014-04-30" name="CVE-2014-1532" modified="2014-04-30" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:C/I:C/A:C)" CVSS_score="10.0" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="10.0" CVSS_base_score="10.0">
    <desc>
      <descript source="cve">Use-after-free vulnerability in the nsHostResolver::ConditionallyRefreshRecord function in libxul.so in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via vectors related to host resolution.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=966006" source="CONFIRM">https://bugzilla.mozilla.org/show_bug.cgi?id=966006</ref>
      <ref url="http://www.mozilla.org/security/announce/2014/mfsa2014-46.html" source="CONFIRM" adv="1">http://www.mozilla.org/security/announce/2014/mfsa2014-46.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="mozilla" name="firefox">
        <vers num="0.1"/>
        <vers num="0.10"/>
        <vers num="0.10.1"/>
        <vers num="0.2"/>
        <vers num="0.3"/>
        <vers num="0.4"/>
        <vers num="0.5"/>
        <vers num="0.6"/>
        <vers num="0.6.1"/>
        <vers num="0.7"/>
        <vers num="0.7.1"/>
        <vers num="0.8"/>
        <vers num="0.9" edition="rc"/>
        <vers num="0.9.1"/>
        <vers num="0.9.2"/>
        <vers num="0.9.3"/>
        <vers num="1.0" edition="preview_release"/>
        <vers num="1.0.1"/>
        <vers num="1.0.2"/>
        <vers num="1.0.3"/>
        <vers num="1.0.4"/>
        <vers num="1.0.5"/>
        <vers num="1.0.6"/>
        <vers num="1.0.7"/>
        <vers num="1.0.8"/>
        <vers num="1.5" edition="beta1"/>
        <vers num="1.5" edition="beta2"/>
        <vers num="1.5.0.1"/>
        <vers num="1.5.0.10"/>
        <vers num="1.5.0.11"/>
        <vers num="1.5.0.12"/>
        <vers num="1.5.0.2"/>
        <vers num="1.5.0.3"/>
        <vers num="1.5.0.4"/>
        <vers num="1.5.0.5"/>
        <vers num="1.5.0.6"/>
        <vers num="1.5.0.7"/>
        <vers num="1.5.0.8"/>
        <vers num="1.5.0.9"/>
        <vers num="1.5.1"/>
        <vers num="1.5.2"/>
        <vers num="1.5.3"/>
        <vers num="1.5.4"/>
        <vers num="1.5.5"/>
        <vers num="1.5.6"/>
        <vers num="1.5.7"/>
        <vers num="1.5.8"/>
        <vers num="10.0"/>
        <vers num="10.0.1"/>
        <vers num="10.0.10"/>
        <vers num="10.0.11"/>
        <vers num="10.0.12"/>
        <vers num="10.0.2"/>
        <vers num="10.0.3"/>
        <vers num="10.0.4"/>
        <vers num="10.0.5"/>
        <vers num="10.0.6"/>
        <vers num="10.0.7"/>
        <vers num="10.0.8"/>
        <vers num="10.0.9"/>
        <vers num="11.0"/>
        <vers num="12.0" edition="beta6"/>
        <vers num="13.0"/>
        <vers num="13.0.1"/>
        <vers num="14.0"/>
        <vers num="14.0.1"/>
        <vers num="15.0"/>
        <vers num="15.0.1"/>
        <vers num="16.0"/>
        <vers num="16.0.1"/>
        <vers num="16.0.2"/>
        <vers num="17.0.10"/>
        <vers num="17.0.11"/>
        <vers num="17.0.2"/>
        <vers num="17.0.3"/>
        <vers num="17.0.4"/>
        <vers num="17.0.5"/>
        <vers num="17.0.6"/>
        <vers num="17.0.7"/>
        <vers num="17.0.8"/>
        <vers num="17.0.9"/>
        <vers num="18.0"/>
        <vers num="18.0.1"/>
        <vers num="18.0.2"/>
        <vers num="19.0"/>
        <vers num="19.0.1"/>
        <vers num="19.0.2"/>
        <vers num="2.0"/>
        <vers num="2.0.0.1"/>
        <vers num="2.0.0.10"/>
        <vers num="2.0.0.11"/>
        <vers num="2.0.0.12"/>
        <vers num="2.0.0.13"/>
        <vers num="2.0.0.14"/>
        <vers num="2.0.0.15"/>
        <vers num="2.0.0.16"/>
        <vers num="2.0.0.17"/>
        <vers num="2.0.0.18"/>
        <vers num="2.0.0.19"/>
        <vers num="2.0.0.2"/>
        <vers num="2.0.0.20"/>
        <vers num="2.0.0.3"/>
        <vers num="2.0.0.4"/>
        <vers num="2.0.0.5"/>
        <vers num="2.0.0.6"/>
        <vers num="2.0.0.7"/>
        <vers num="2.0.0.8"/>
        <vers num="2.0.0.9"/>
        <vers num="20.0"/>
        <vers num="20.0.1"/>
        <vers num="21.0"/>
        <vers num="23.0"/>
        <vers num="23.0.1"/>
        <vers num="24.0"/>
        <vers num="24.1"/>
        <vers num="24.1.1"/>
        <vers num="25.0"/>
        <vers num="25.0.1"/>
        <vers num="26.0"/>
        <vers num="27.0"/>
        <vers num="27.0.1"/>
        <vers prev="1" num="28.0"/>
        <vers num="3.0"/>
        <vers num="3.0.1"/>
        <vers num="3.0.10"/>
        <vers num="3.0.11"/>
        <vers num="3.0.12"/>
        <vers num="3.0.13"/>
        <vers num="3.0.14"/>
        <vers num="3.0.15"/>
        <vers num="3.0.16"/>
        <vers num="3.0.17"/>
        <vers num="3.0.18"/>
        <vers num="3.0.19"/>
        <vers num="3.0.2"/>
        <vers num="3.0.3"/>
        <vers num="3.0.4"/>
        <vers num="3.0.5"/>
        <vers num="3.0.6"/>
        <vers num="3.0.7"/>
        <vers num="3.0.8"/>
        <vers num="3.0.9"/>
        <vers num="3.5"/>
        <vers num="3.5.1"/>
        <vers num="3.5.10"/>
        <vers num="3.5.11"/>
        <vers num="3.5.12"/>
        <vers num="3.5.13"/>
        <vers num="3.5.14"/>
        <vers num="3.5.15"/>
        <vers num="3.5.16"/>
        <vers num="3.5.17"/>
        <vers num="3.5.18"/>
        <vers num="3.5.19"/>
        <vers num="3.5.2"/>
        <vers num="3.5.3"/>
        <vers num="3.5.4"/>
        <vers num="3.5.5"/>
        <vers num="3.5.6"/>
        <vers num="3.5.7"/>
        <vers num="3.5.8"/>
        <vers num="3.5.9"/>
        <vers num="3.6"/>
        <vers num="3.6.10"/>
        <vers num="3.6.11"/>
        <vers num="3.6.12"/>
        <vers num="3.6.13"/>
        <vers num="3.6.14"/>
        <vers num="3.6.15"/>
        <vers num="3.6.16"/>
        <vers num="3.6.17"/>
        <vers num="3.6.18"/>
        <vers num="3.6.19"/>
        <vers num="3.6.2"/>
        <vers num="3.6.20"/>
        <vers num="3.6.21"/>
        <vers num="3.6.22"/>
        <vers num="3.6.23"/>
        <vers num="3.6.24"/>
        <vers num="3.6.25"/>
        <vers num="3.6.26"/>
        <vers num="3.6.27"/>
        <vers num="3.6.28"/>
        <vers num="3.6.3"/>
        <vers num="3.6.4"/>
        <vers num="3.6.6"/>
        <vers num="3.6.7"/>
        <vers num="3.6.8"/>
        <vers num="3.6.9"/>
        <vers num="4.0" edition="beta1"/>
        <vers num="4.0" edition="beta10"/>
        <vers num="4.0" edition="beta11"/>
        <vers num="4.0" edition="beta12"/>
        <vers num="4.0" edition="beta2"/>
        <vers num="4.0" edition="beta3"/>
        <vers num="4.0" edition="beta4"/>
        <vers num="4.0" edition="beta5"/>
        <vers num="4.0" edition="beta6"/>
        <vers num="4.0" edition="beta7"/>
        <vers num="4.0" edition="beta8"/>
        <vers num="4.0" edition="beta9"/>
        <vers num="4.0.1"/>
        <vers num="5.0"/>
        <vers num="5.0.1"/>
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers num="6.0.2"/>
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="8.0"/>
        <vers num="8.0.1"/>
        <vers num="9.0"/>
        <vers num="9.0.1"/>
      </prod>
      <prod vendor="mozilla" name="firefox_esr">
        <vers num="24.0"/>
        <vers num="24.0.1"/>
        <vers num="24.0.2"/>
        <vers num="24.1.0"/>
        <vers num="24.1.1"/>
        <vers num="24.2"/>
        <vers num="24.3"/>
        <vers num="24.4"/>
      </prod>
      <prod vendor="mozilla" name="seamonkey">
        <vers num="2.0" edition="alpha_1"/>
        <vers num="2.0" edition="alpha_2"/>
        <vers num="2.0" edition="alpha_3"/>
        <vers num="2.0" edition="beta_1"/>
        <vers num="2.0" edition="beta_2"/>
        <vers num="2.0" edition="rc1"/>
        <vers num="2.0" edition="rc2"/>
        <vers num="2.0.1"/>
        <vers num="2.0.10"/>
        <vers num="2.0.11"/>
        <vers num="2.0.12"/>
        <vers num="2.0.13"/>
        <vers num="2.0.14"/>
        <vers num="2.0.2"/>
        <vers num="2.0.3"/>
        <vers num="2.0.4"/>
        <vers num="2.0.5"/>
        <vers num="2.0.6"/>
        <vers num="2.0.7"/>
        <vers num="2.0.8"/>
        <vers num="2.0.9"/>
        <vers num="2.1" edition="alpha1"/>
        <vers num="2.1" edition="alpha2"/>
        <vers num="2.1" edition="alpha3"/>
        <vers num="2.1" edition="beta1"/>
        <vers num="2.1" edition="beta2"/>
        <vers num="2.1" edition="beta3"/>
        <vers num="2.1" edition="rc1"/>
        <vers num="2.1" edition="rc2"/>
        <vers num="2.10" edition="beta1"/>
        <vers num="2.10" edition="beta2"/>
        <vers num="2.10" edition="beta3"/>
        <vers num="2.10.1"/>
        <vers num="2.11" edition="beta1"/>
        <vers num="2.11" edition="beta2"/>
        <vers num="2.11" edition="beta3"/>
        <vers num="2.11" edition="beta4"/>
        <vers num="2.11" edition="beta5"/>
        <vers num="2.11" edition="beta6"/>
        <vers num="2.12" edition="beta1"/>
        <vers num="2.12" edition="beta2"/>
        <vers num="2.12" edition="beta3"/>
        <vers num="2.12" edition="beta4"/>
        <vers num="2.12" edition="beta5"/>
        <vers num="2.12" edition="beta6"/>
        <vers num="2.12.1"/>
        <vers num="2.13" edition="beta1"/>
        <vers num="2.13" edition="beta2"/>
        <vers num="2.13" edition="beta3"/>
        <vers num="2.13" edition="beta4"/>
        <vers num="2.13" edition="beta5"/>
        <vers num="2.13" edition="beta6"/>
        <vers num="2.13.1"/>
        <vers num="2.13.2"/>
        <vers num="2.14" edition="beta1"/>
        <vers num="2.14" edition="beta2"/>
        <vers num="2.14" edition="beta3"/>
        <vers num="2.14" edition="beta4"/>
        <vers num="2.14" edition="beta5"/>
        <vers num="2.15" edition="beta1"/>
        <vers num="2.15" edition="beta2"/>
        <vers num="2.15" edition="beta3"/>
        <vers num="2.15" edition="beta4"/>
        <vers num="2.15" edition="beta5"/>
        <vers num="2.15" edition="beta6"/>
        <vers num="2.15.1"/>
        <vers num="2.15.2"/>
        <vers num="2.16" edition="beta1"/>
        <vers num="2.16" edition="beta2"/>
        <vers num="2.16" edition="beta3"/>
        <vers num="2.16" edition="beta4"/>
        <vers num="2.16" edition="beta5"/>
        <vers num="2.16.1"/>
        <vers num="2.16.2"/>
        <vers num="2.17" edition="beta1"/>
        <vers num="2.17" edition="beta2"/>
        <vers num="2.17" edition="beta3"/>
        <vers num="2.17" edition="beta4"/>
        <vers num="2.17.1"/>
        <vers num="2.18" edition="beta1"/>
        <vers num="2.18" edition="beta2"/>
        <vers num="2.18" edition="beta3"/>
        <vers num="2.18" edition="beta4"/>
        <vers num="2.19" edition="beta1"/>
        <vers num="2.19" edition="beta2"/>
        <vers num="2.2" edition="beta1"/>
        <vers num="2.2" edition="beta2"/>
        <vers num="2.2" edition="beta3"/>
        <vers num="2.20" edition="beta1"/>
        <vers num="2.20" edition="beta2"/>
        <vers num="2.20" edition="beta3"/>
        <vers num="2.21" edition="beta1"/>
        <vers num="2.21" edition="beta2"/>
        <vers num="2.22" edition="beta1"/>
        <vers num="2.22" edition="beta2"/>
        <vers num="2.22.1"/>
        <vers num="2.23" edition="beta1"/>
        <vers num="2.23" edition="beta2"/>
        <vers num="2.24" edition="beta1"/>
        <vers num="2.25" edition="-"/>
        <vers num="2.25" edition="beta1"/>
        <vers num="2.25" edition="beta2"/>
        <vers num="2.25" edition="beta3"/>
        <vers prev="1" num="2.26" edition="rc1"/>
        <vers num="2.3" edition="beta1"/>
        <vers num="2.3" edition="beta2"/>
        <vers num="2.3" edition="beta3"/>
        <vers num="2.3.1"/>
        <vers num="2.3.2"/>
        <vers num="2.3.3"/>
        <vers num="2.4" edition="beta1"/>
        <vers num="2.4" edition="beta2"/>
        <vers num="2.4" edition="beta3"/>
        <vers num="2.4.1"/>
        <vers num="2.5" edition="beta1"/>
        <vers num="2.5" edition="beta2"/>
        <vers num="2.5" edition="beta3"/>
        <vers num="2.5" edition="beta4"/>
        <vers num="2.6" edition="beta1"/>
        <vers num="2.6" edition="beta2"/>
        <vers num="2.6" edition="beta3"/>
        <vers num="2.6" edition="beta4"/>
        <vers num="2.6.1"/>
        <vers num="2.7" edition="beta1"/>
        <vers num="2.7" edition="beta2"/>
        <vers num="2.7" edition="beta3"/>
        <vers num="2.7" edition="beta4"/>
        <vers num="2.7" edition="beta5"/>
        <vers num="2.7.1"/>
        <vers num="2.7.2"/>
        <vers num="2.8" edition="beta1"/>
        <vers num="2.8" edition="beta2"/>
        <vers num="2.8" edition="beta3"/>
        <vers num="2.8" edition="beta4"/>
        <vers num="2.8" edition="beta5"/>
        <vers num="2.8" edition="beta6"/>
        <vers num="2.9" edition="beta1"/>
        <vers num="2.9" edition="beta2"/>
        <vers num="2.9" edition="beta3"/>
        <vers num="2.9" edition="beta4"/>
        <vers num="2.9.1"/>
      </prod>
      <prod vendor="mozilla" name="thunderbird">
        <vers num="0.1"/>
        <vers num="0.2"/>
        <vers num="0.3"/>
        <vers num="0.4"/>
        <vers num="0.5"/>
        <vers num="0.6"/>
        <vers num="0.7"/>
        <vers num="0.7.1"/>
        <vers num="0.7.2"/>
        <vers num="0.7.3"/>
        <vers num="0.8"/>
        <vers num="0.9"/>
        <vers num="1.0"/>
        <vers num="1.0.1"/>
        <vers num="1.0.2"/>
        <vers num="1.0.3"/>
        <vers num="1.0.4"/>
        <vers num="1.0.5" edition="beta"/>
        <vers num="1.0.6"/>
        <vers num="1.0.7"/>
        <vers num="1.0.8"/>
        <vers num="1.5" edition="beta2"/>
        <vers num="1.5.0.1"/>
        <vers num="1.5.0.10"/>
        <vers num="1.5.0.11"/>
        <vers num="1.5.0.12"/>
        <vers num="1.5.0.13"/>
        <vers num="1.5.0.14"/>
        <vers num="1.5.0.2"/>
        <vers num="1.5.0.3"/>
        <vers num="1.5.0.4"/>
        <vers num="1.5.0.5"/>
        <vers num="1.5.0.6"/>
        <vers num="1.5.0.7"/>
        <vers num="1.5.0.8"/>
        <vers num="1.5.0.9"/>
        <vers num="1.5.1"/>
        <vers num="1.5.2"/>
        <vers num="1.7.1"/>
        <vers num="1.7.3"/>
        <vers num="10.0"/>
        <vers num="10.0.1"/>
        <vers num="10.0.2"/>
        <vers num="10.0.3"/>
        <vers num="10.0.4"/>
        <vers num="11.0"/>
        <vers num="11.0.1"/>
        <vers num="12.0"/>
        <vers num="12.0.1"/>
        <vers num="13.0"/>
        <vers num="13.0.1"/>
        <vers num="14.0"/>
        <vers num="15.0"/>
        <vers num="15.0.1"/>
        <vers num="16.0"/>
        <vers num="16.0.1"/>
        <vers num="16.0.2"/>
        <vers num="17.0"/>
        <vers num="17.0.1"/>
        <vers num="17.0.2"/>
        <vers num="17.0.3"/>
        <vers num="17.0.4"/>
        <vers num="17.0.5"/>
        <vers num="17.0.6"/>
        <vers num="17.0.7"/>
        <vers num="17.0.8"/>
        <vers num="2.0"/>
        <vers num="2.0.0.0"/>
        <vers num="2.0.0.1"/>
        <vers num="2.0.0.11"/>
        <vers num="2.0.0.12"/>
        <vers num="2.0.0.13"/>
        <vers num="2.0.0.14"/>
        <vers num="2.0.0.15"/>
        <vers num="2.0.0.16"/>
        <vers num="2.0.0.17"/>
        <vers num="2.0.0.18"/>
        <vers num="2.0.0.19"/>
        <vers num="2.0.0.2"/>
        <vers num="2.0.0.20"/>
        <vers num="2.0.0.21"/>
        <vers num="2.0.0.22"/>
        <vers num="2.0.0.23"/>
        <vers num="2.0.0.3"/>
        <vers num="2.0.0.4"/>
        <vers num="2.0.0.5"/>
        <vers num="2.0.0.6"/>
        <vers num="2.0.0.7"/>
        <vers num="2.0.0.8"/>
        <vers num="2.0.0.9"/>
        <vers num="24.0"/>
        <vers num="24.0.1"/>
        <vers num="24.1"/>
        <vers num="24.1.1"/>
        <vers num="24.2"/>
        <vers num="24.3"/>
        <vers prev="1" num="24.4"/>
        <vers num="3.0"/>
        <vers num="3.0.1"/>
        <vers num="3.0.10"/>
        <vers num="3.0.11"/>
        <vers num="3.0.2"/>
        <vers num="3.0.3"/>
        <vers num="3.0.4"/>
        <vers num="3.0.5"/>
        <vers num="3.0.6"/>
        <vers num="3.0.7"/>
        <vers num="3.0.8"/>
        <vers num="3.0.9"/>
        <vers num="3.1"/>
        <vers num="3.1.1"/>
        <vers num="3.1.10"/>
        <vers num="3.1.11"/>
        <vers num="3.1.12"/>
        <vers num="3.1.13"/>
        <vers num="3.1.14"/>
        <vers num="3.1.15"/>
        <vers num="3.1.16"/>
        <vers num="3.1.17"/>
        <vers num="3.1.2"/>
        <vers num="3.1.3"/>
        <vers num="3.1.4"/>
        <vers num="3.1.5"/>
        <vers num="3.1.6"/>
        <vers num="3.1.7"/>
        <vers num="3.1.8"/>
        <vers num="3.1.9"/>
        <vers num="5.0"/>
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers num="6.0.2"/>
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="8.0"/>
        <vers num="9.0"/>
        <vers num="9.0.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1597" published="2014-02-27" name="CVE-2014-1597" modified="2014-02-28" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">SQL injection vulnerability in the CMDB web application in synetics i-doit pro before 1.2.5 and i-doit open allows remote attackers to execute arbitrary SQL commands via the objID parameter to the default URI.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/91269" source="XF">idoit-cve20141597-sql-injection(91269)</ref>
      <ref url="http://www.securityfocus.com/bid/65557" source="BID">65557</ref>
      <ref url="http://www.i-doit.com/en/company/news/single-news/?tx_ttnews%5Btt_news%5D=141" source="CONFIRM">http://www.i-doit.com/en/company/news/single-news/?tx_ttnews%5Btt_news%5D=141</ref>
      <ref url="http://www.csnc.ch/misc/files/advisories/CVE-2014-1597_i-doit_SQL_Injection.txt" source="MISC">http://www.csnc.ch/misc/files/advisories/CVE-2014-1597_i-doit_SQL_Injection.txt</ref>
      <ref url="http://secunia.com/advisories/56931" source="SECUNIA" adv="1">56931</ref>
      <ref url="http://archives.neohapsis.com/archives/fulldisclosure/2014-02/0154.html" source="FULLDISC">20140217 SQL Injection i-doit Pro (CVE-2014-1597)</ref>
    </refs>
    <vuln_soft>
      <prod vendor="i-doit" name="i-doit">
        <vers num="-" edition=":~~open~~~"/>
        <vers num="1.0" edition=":~~pro~~~"/>
        <vers num="1.0.2" edition=":~~pro~~~"/>
        <vers num="1.1.1" edition=":~~pro~~~"/>
        <vers num="1.1.2" edition=":~~pro~~~"/>
        <vers num="1.2.1" edition=":~~pro~~~"/>
        <vers num="1.2.2" edition=":~~pro~~~"/>
        <vers num="1.2.3" edition=":~~pro~~~"/>
        <vers prev="1" num="1.2.4" edition=":~~pro~~~"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1599" published="2014-03-09" name="CVE-2014-1599" modified="2014-03-10" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Multiple cross-site scripting (XSS) vulnerabilities in the SFR Box router with firmware NB6-MAIN-R3.3.4 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters to (1) dns, (2) dhcp, (3) nat, (4) route, or (5) lan in network/; or (6) wifi/config.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://www.securityfocus.com/archive/1/archive/1/531349/100/0/threaded" source="BUGTRAQ">20140305 CVE-2014-1599 - 39 Type-1 XSS in SFR DSL/Fiber Box</ref>
    </refs>
    <vuln_soft>
      <prod vendor="sfr" name="sfr_box_router">
        <vers num="-"/>
      </prod>
      <prod vendor="sfr" name="sfr_box_router_firmware">
        <vers num="nb6-main-r3.3.4"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-1604" published="2014-01-27" name="CVE-2014-1604" modified="2014-01-28" CVSS_version="2.0" CVSS_vector="(AV:L/AC:L/Au:N/C:N/I:P/A:N)" CVSS_score="2.1" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="3.9" CVSS_base_score="2.1">
    <desc>
      <descript source="cve">The parser cache functionality in parsergenerator.py in RPLY (aka python-rply) before 0.7.1 allows local users to spoof cache data by pre-creating a temporary rply-*.json file with a predictable name.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="https://github.com/alex/rply/commit/fc9bbcd25b0b4f09bbd6339f710ad24c129d5d7c" source="CONFIRM">https://github.com/alex/rply/commit/fc9bbcd25b0b4f09bbd6339f710ad24c129d5d7c</ref>
      <ref url="http://xforce.iss.net/xforce/xfdb/90593" source="XF">rply-cve20141604-insecure-permissions(90593)</ref>
      <ref url="http://www.osvdb.org/102202" source="OSVDB">102202</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/01/18/4" source="MLIST">[oss-security] 20140117 Re: Fwd: [Python-modules-team] Bug#735263: python-rply: insecure use of /tmp</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/01/17/8" source="MLIST">[oss-security] 20140114 Fwd: [Python-modules-team] Bug#735263: python-rply: insecure use of /tmp</ref>
      <ref url="http://secunia.com/advisories/56429" source="SECUNIA" adv="1">56429</ref>
      <ref url="http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=735263" source="CONFIRM">http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=735263</ref>
    </refs>
    <vuln_soft>
      <prod vendor="python" name="rply">
        <vers prev="1" num="0.7.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1607" published="2014-01-26" name="CVE-2014-1607" modified="2014-01-31" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">** DISPUTED ** Cross-site scripting (XSS) vulnerability in the EventCalendar module for Drupal 7.14 allows remote attackers to inject arbitrary web script or HTML via the year parameter to eventcalander/. NOTE: this issue has been disputed by the Drupal Security Team; it may be site-specific.  If so, then this CVE will be REJECTed in the future.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="https://groups.drupal.org/node/402023" source="MISC">https://groups.drupal.org/node/402023</ref>
      <ref url="http://www.securityfocus.com/archive/1/archive/1/530876/100/0/threaded" source="BUGTRAQ">20140123 [CVE-2014-1607.] Cross Site Scripting(XSS) in Drupal Event calendar module</ref>
    </refs>
    <vuln_soft>
      <prod vendor="drupal" name="drupal">
        <vers num="7.14"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1608" published="2014-03-18" name="CVE-2014-1608" modified="2014-03-19" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">SQL injection vulnerability in the mci_file_get function in api/soap/mc_file_api.php in MantisBT before 1.2.16 allows remote attackers to execute arbitrary SQL commands via a crafted envelope tag in a mc_issue_attachment_get SOAP request.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.ocert.org/advisories/ocert-2014-001.html" source="MISC">http://www.ocert.org/advisories/ocert-2014-001.html</ref>
      <ref url="https://github.com/mantisbt/mantisbt/commit/00b4c17088fa56594d85fe46b6c6057bb3421102" source="CONFIRM" patch="1">https://github.com/mantisbt/mantisbt/commit/00b4c17088fa56594d85fe46b6c6057bb3421102</ref>
      <ref url="https://bugzilla.redhat.com/show_bug.cgi?id=1063111" source="CONFIRM">https://bugzilla.redhat.com/show_bug.cgi?id=1063111</ref>
      <ref url="http://www.securityfocus.com/bid/65445" source="BID">65445</ref>
      <ref url="http://www.mantisbt.org/bugs/view.php?id=16879" source="CONFIRM">http://www.mantisbt.org/bugs/view.php?id=16879</ref>
    </refs>
    <vuln_soft>
      <prod vendor="mantisbt" name="mantisbt">
        <vers num="1.2.0" edition="a1"/>
        <vers num="1.2.0" edition="a2"/>
        <vers num="1.2.0" edition="a3"/>
        <vers num="1.2.0" edition="rc1"/>
        <vers num="1.2.0" edition="rc2"/>
        <vers num="1.2.1"/>
        <vers num="1.2.10"/>
        <vers num="1.2.11"/>
        <vers num="1.2.13"/>
        <vers num="1.2.14"/>
        <vers prev="1" num="1.2.15"/>
        <vers num="1.2.2"/>
        <vers num="1.2.3"/>
        <vers num="1.2.4"/>
        <vers num="1.2.5"/>
        <vers num="1.2.6"/>
        <vers num="1.2.7"/>
        <vers num="1.2.8"/>
        <vers num="1.2.9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1609" published="2014-03-20" name="CVE-2014-1609" modified="2014-03-20" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">Multiple SQL injection vulnerabilities in MantisBT before 1.2.16 allow remote attackers to execute arbitrary SQL commands via unspecified parameters to the (1) mc_project_get_attachments function in api/soap/mc_project_api.php; the (2) news_get_limited_rows function in core/news_api.php; the (3) summary_print_by_enum, (4) summary_print_by_age, (5) summary_print_by_developer, (6) summary_print_by_reporter, or (7) summary_print_by_category function in core/summary_api.php; the (8) create_bug_enum_summary or (9) enum_bug_group function in plugins/MantisGraph/core/graph_api.php; (10) bug_graph_bycategory.php or (11) bug_graph_bystatus.php in plugins/MantisGraph/pages/; or (12) proj_doc_page.php, related to use of the db_query function, a different vulnerability than CVE-2014-1608.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.ocert.org/advisories/ocert-2014-001.html" source="MISC">http://www.ocert.org/advisories/ocert-2014-001.html</ref>
      <ref url="https://github.com/mantisbt/mantisbt/commit/7efe0175f0853e18ebfacedfd2374c4179028b3f" source="CONFIRM" patch="1">https://github.com/mantisbt/mantisbt/commit/7efe0175f0853e18ebfacedfd2374c4179028b3f</ref>
      <ref url="https://bugzilla.redhat.com/show_bug.cgi?id=1063111" source="CONFIRM">https://bugzilla.redhat.com/show_bug.cgi?id=1063111</ref>
      <ref url="http://www.securityfocus.com/bid/65461" source="BID">65461</ref>
      <ref url="http://www.mantisbt.org/bugs/view.php?id=16880" source="CONFIRM">http://www.mantisbt.org/bugs/view.php?id=16880</ref>
    </refs>
    <vuln_soft>
      <prod vendor="mantisbt" name="mantisbt">
        <vers num="1.2.0" edition="a1"/>
        <vers num="1.2.0" edition="a2"/>
        <vers num="1.2.0" edition="a3"/>
        <vers num="1.2.0" edition="rc1"/>
        <vers num="1.2.0" edition="rc2"/>
        <vers num="1.2.1"/>
        <vers num="1.2.10"/>
        <vers num="1.2.11"/>
        <vers num="1.2.13"/>
        <vers num="1.2.14"/>
        <vers prev="1" num="1.2.15"/>
        <vers num="1.2.2"/>
        <vers num="1.2.3"/>
        <vers num="1.2.4"/>
        <vers num="1.2.5"/>
        <vers num="1.2.6"/>
        <vers num="1.2.7"/>
        <vers num="1.2.8"/>
        <vers num="1.2.9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1610" published="2014-01-30" name="CVE-2014-1610" modified="2014-04-19" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:S/C:P/I:P/A:P)" CVSS_score="6.0" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="6.8" CVSS_base_score="6.0">
    <desc>
      <descript source="cve">MediaWiki 1.22.x before 1.22.2, 1.21.x before 1.21.5 and 1.19.x before 1.19.11, when DjVu or PDF file upload support is enabled, allows remote attackers to execute arbitrary commands via shell metacharacters in (1) the page parameter to includes/media/DjVu.php; (2) the w parameter (aka width field) to thumb.php, which is not properly handled by includes/media/PdfHandler_body.php; and possibly unspecified vectors in (3) includes/media/Bitmap.php and (4) includes/media/ImageHandler.php.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://gerrit.wikimedia.org/r/#/c/110215/" source="MISC">https://gerrit.wikimedia.org/r/#/c/110215/</ref>
      <ref url="https://gerrit.wikimedia.org/r/#/c/110069/2/includes/media/Bitmap.php" source="MISC">https://gerrit.wikimedia.org/r/#/c/110069/2/includes/media/Bitmap.php</ref>
      <ref url="https://gerrit.wikimedia.org/r/#/c/110069/" source="MISC" adv="1">https://gerrit.wikimedia.org/r/#/c/110069/</ref>
      <ref url="https://bugzilla.wikimedia.org/show_bug.cgi?id=60339" source="CONFIRM">https://bugzilla.wikimedia.org/show_bug.cgi?id=60339</ref>
      <ref url="https://bugzilla.wikimedia.org/attachment.cgi?id=14384&amp;action=diff" source="MISC">https://bugzilla.wikimedia.org/attachment.cgi?id=14384&amp;action=diff</ref>
      <ref url="https://bugzilla.wikimedia.org/attachment.cgi?id=14361&amp;action=diff" source="MISC">https://bugzilla.wikimedia.org/attachment.cgi?id=14361&amp;action=diff</ref>
      <ref url="http://www.securitytracker.com/id/1029707" source="SECTRACK">1029707</ref>
      <ref url="http://www.securityfocus.com/bid/65223" source="BID">65223</ref>
      <ref url="http://www.osvdb.org/102631" source="OSVDB">102631</ref>
      <ref url="http://www.exploit-db.com/exploits/31329/" source="EXPLOIT-DB">31329</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2891" source="DEBIAN">DSA-2891</ref>
      <ref url="http://www.checkpoint.com/threatcloud-central/articles/2014-01-28-tc-researchers-discover.html" source="MISC">http://www.checkpoint.com/threatcloud-central/articles/2014-01-28-tc-researchers-discover.html</ref>
      <ref url="http://www.checkpoint.com/defense/advisories/public/2014/cpai-26-jan.html" source="MISC">http://www.checkpoint.com/defense/advisories/public/2014/cpai-26-jan.html</ref>
      <ref url="http://secunia.com/advisories/57472" source="SECUNIA">57472</ref>
      <ref url="http://secunia.com/advisories/56695" source="SECUNIA" adv="1">56695</ref>
      <ref url="http://osvdb.org/102630" source="OSVDB">102630</ref>
      <ref url="http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-January/000140.html" source="MLIST" adv="1">[MediaWiki-announce] 20140128 MediaWiki Security Releases: 1.22.2, 1.21.5 and 1.19.11</ref>
      <ref url="http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127948.html" source="FEDORA">FEDORA-2014-1745</ref>
      <ref url="http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127942.html" source="FEDORA">FEDORA-2014-1802</ref>
    </refs>
    <vuln_soft>
      <prod vendor="mediawiki" name="mediawiki">
        <vers num="1.19.0"/>
        <vers num="1.19.1"/>
        <vers num="1.19.10"/>
        <vers num="1.19.2"/>
        <vers num="1.19.3"/>
        <vers num="1.19.4"/>
        <vers num="1.19.5"/>
        <vers num="1.19.6"/>
        <vers num="1.19.7"/>
        <vers num="1.19.8"/>
        <vers num="1.19.9"/>
        <vers num="1.21.1"/>
        <vers num="1.21.2"/>
        <vers num="1.21.3"/>
        <vers num="1.21.4"/>
        <vers num="1.22.0"/>
        <vers num="1.22.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1611" published="2014-01-30" name="CVE-2014-1611" modified="2014-02-21" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in the Anonymous Posting module 7.x-1.2 and 7.x-1.3 for Drupal allows remote attackers to inject arbitrary web script or HTML via the contact name field.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="https://drupal.org/node/2173437" source="CONFIRM" patch="1">https://drupal.org/node/2173437</ref>
      <ref url="https://drupal.org/node/2173321" source="MISC" patch="1" adv="1">https://drupal.org/node/2173321</ref>
      <ref url="http://xforce.iss.net/xforce/xfdb/90526" source="XF">anonymousposting-contactname-xss(90526)</ref>
      <ref url="http://secunia.com/advisories/56476" source="SECUNIA" adv="1">56476</ref>
      <ref url="http://seclists.org/fulldisclosure/2014/Jan/77" source="FULLDISC">20140115 [Security-news] SA-CONTRIB-2014-002 - Anonymous Posting - Cross Site Scripting (XSS)</ref>
      <ref url="http://packetstormsecurity.com/files/124803/Drupal-Anonymous-Posting-7.x-Cross-Site-Scripting.html" source="MISC">http://packetstormsecurity.com/files/124803/Drupal-Anonymous-Posting-7.x-Cross-Site-Scripting.html</ref>
      <ref url="http://osvdb.org/102126" source="OSVDB">102126</ref>
    </refs>
    <vuln_soft>
      <prod vendor="anonymous_posting_project" name="anonymous_posting">
        <vers num="7.x-1.2"/>
        <vers num="7.x-1.3"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1612" published="2014-01-30" name="CVE-2014-1612" modified="2014-02-21" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in login.esp in the Web Management Interface in Media5 Mediatrix 4402 VoIP Gateway with firmware Dgw 1.1.13.186 and earlier allows remote attackers to inject arbitrary web script or HTML via the username parameter.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://www.kb.cert.org/vuls/id/252294" source="CERT-VN">VU#252294</ref>
      <ref url="http://xforce.iss.net/xforce/xfdb/90656" source="XF">mediatrixwebmanagement-cve20141612-xss(90656)</ref>
      <ref url="http://www.securityfocus.com/archive/1/archive/1/530871/100/0/threaded" source="BUGTRAQ">20140123 Reflected cross-site scripting (XSS) vulnerability in Mediatrix Web Management Interface login page</ref>
      <ref url="http://secunia.com/advisories/56638" source="SECUNIA">56638</ref>
      <ref url="http://packetstormsecurity.com/files/124931/Mediatrix-4402-Cross-Site-Scripting.html" source="MISC">http://packetstormsecurity.com/files/124931/Mediatrix-4402-Cross-Site-Scripting.html</ref>
      <ref url="http://osvdb.org/102415" source="OSVDB">102415</ref>
    </refs>
    <vuln_soft>
      <prod vendor="media5" name="mediatrix_voip_gateway_4402_firmware">
        <vers num="dgw_1.1.13.186"/>
      </prod>
      <prod vendor="media5" name="mediatrix_voip_gateway">
        <vers num="4402"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1615" published="2014-04-22" name="CVE-2014-1615" modified="2014-04-23" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:P)" CVSS_score="6.8" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.6" CVSS_base_score="6.8">
    <desc>
      <descript source="cve">Multiple cross-site request forgery (CSRF) vulnerabilities in Carbon Black before 4.1.0 allow remote attackers to hijack the authentication of administrators for requests that add new administrative users and have other unspecified action, as demonstrated by a request to api/user.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://www.secureworks.com/advisories/SWRX-2014-007/SWRX-2014-007.pdf" source="MISC">http://www.secureworks.com/advisories/SWRX-2014-007/SWRX-2014-007.pdf</ref>
      <ref url="http://secunia.com/advisories/57645" source="SECUNIA" adv="1">57645</ref>
    </refs>
    <vuln_soft>
      <prod vendor="carbonblack" name="carbon_black">
        <vers num="4.0.3"/>
        <vers prev="1" num="4.1.0" edition="beta1"/>
        <vers prev="1" num="4.1.0" edition="beta2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1618" published="2014-01-21" name="CVE-2014-1618" modified="2014-01-22" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">Multiple SQL injection vulnerabilities in UAEPD Shopping Cart Script allow remote attackers to execute arbitrary SQL commands via the (1) cat_id or (2) p_id parameter to products.php or id parameter to (3) page.php or (4) news.php.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90214" source="XF">uaepd-multiple-sql-injection(90214)</ref>
      <ref url="http://www.securityfocus.com/bid/64734" source="BID">64734</ref>
      <ref url="http://www.iphobos.com/blog/2014/01/04/uaepd-script-multiple-sql-injection-vulnerabilty" source="MISC">http://www.iphobos.com/blog/2014/01/04/uaepd-script-multiple-sql-injection-vulnerabilty</ref>
      <ref url="http://secunia.com/advisories/56351" source="SECUNIA" adv="1">56351</ref>
      <ref url="http://packetstormsecurity.com/files/124723/uaepdshopping-sql.txt" source="MISC">http://packetstormsecurity.com/files/124723/uaepdshopping-sql.txt</ref>
      <ref url="http://osvdb.org/101900" source="OSVDB">101900</ref>
      <ref url="http://osvdb.org/101899" source="OSVDB">101899</ref>
      <ref url="http://osvdb.org/101859" source="OSVDB">101859</ref>
    </refs>
    <vuln_soft>
      <prod vendor="uaepd" name="shopping_cart_script">
        <vers num="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1619" published="2014-01-21" name="CVE-2014-1619" modified="2014-01-22" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">Multiple SQL injection vulnerabilities in Cubic CMS 5.1.1, 5.1.2, and 5.2 allow remote attackers to execute arbitrary SQL commands via the (1) resource_id or (2) version_id parameter to recursos/agent.php or (3) login or (4) pass parameter to login.usuario.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90153" source="XF">cubiccms-agent-login-sql-injection(90153)</ref>
      <ref url="http://www.cubicfactory.com/es/cubic-cms/changelog/id/260" source="CONFIRM">http://www.cubicfactory.com/es/cubic-cms/changelog/id/260</ref>
      <ref url="http://packetstormsecurity.com/files/124652" source="MISC">http://packetstormsecurity.com/files/124652</ref>
      <ref url="http://osvdb.org/101721" source="OSVDB">101721</ref>
      <ref url="http://osvdb.org/101719" source="OSVDB">101719</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cubicfactory" name="cubic_cms">
        <vers num="5.1.1"/>
        <vers num="5.1.2"/>
        <vers num="5.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1620" published="2014-01-21" name="CVE-2014-1620" modified="2014-01-22" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Multiple cross-site scripting (XSS) vulnerabilities in add.php in HIOX Guest Book (HGB) 5.0 allow remote attackers to inject arbitrary web script or HTML via the (1) name1, (2) email, or (3) cmt parameter.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90156" source="XF">hiox-guestbook-add-xss(90156)</ref>
      <ref url="http://packetstormsecurity.com/files/124681/Hiox-Guest-Book-5.0-Cross-Site-Scripting.html" source="MISC">http://packetstormsecurity.com/files/124681/Hiox-Guest-Book-5.0-Cross-Site-Scripting.html</ref>
      <ref url="http://osvdb.org/101844" source="OSVDB">101844</ref>
    </refs>
    <vuln_soft>
      <prod vendor="hiox" name="hiox_guest_book">
        <vers num="5.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-1624" published="2014-01-27" name="CVE-2014-1624" modified="2014-02-24" CVSS_version="2.0" CVSS_vector="(AV:L/AC:M/Au:N/C:N/I:P/A:P)" CVSS_score="3.3" CVSS_impact_subscore="4.9" CVSS_exploit_subscore="3.4" CVSS_base_score="3.3">
    <desc>
      <descript source="cve">Race condition in the xdg.BaseDirectory.get_runtime_dir function in python-xdg 0.25 allows local users to overwrite arbitrary files by pre-creating /tmp/pyxdg-runtime-dir-fallback-victim to point to a victim-owned location, then replacing it with a symlink to an attacker-controlled location once the get_runtime_dir function is called.</descript>
    </desc>
    <loss_types>
      <avail/>
      <int/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90618" source="XF">pythonxdg-cve20141624-symlink(90618)</ref>
      <ref url="http://www.securityfocus.com/bid/65042" source="BID">65042</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/01/21/4" source="MLIST">[oss-security] 20140121 Re: Fwd: [Python-modules-team] Bug#736247: python-xdg: get_runtime_dir(strict=False): insecure use of /tmp</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/01/21/3" source="MLIST">[oss-security] 20140121 Fwd: [Python-modules-team] Bug#736247: python-xdg: get_runtime_dir(strict=False): insecure use of /tmp</ref>
      <ref url="http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=736247" source="MISC">http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=736247</ref>
    </refs>
    <vuln_soft>
      <prod vendor="python" name="pyxdg">
        <vers num="0.25"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1626" published="2014-01-25" name="CVE-2014-1626" modified="2014-01-27" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:N/A:N)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">XML External Entity (XXE) vulnerability in MARC::File::XML module before 1.0.2 for Perl, as used in Evergreen, Koha, perl4lib, and possibly other products, allows context-dependent attackers to read arbitrary files via a crafted XML file.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://metacpan.org/source/GMCHARLT/MARC-XML-1.0.2/Changes" source="CONFIRM">https://metacpan.org/source/GMCHARLT/MARC-XML-1.0.2/Changes</ref>
      <ref url="http://xforce.iss.net/xforce/xfdb/90620" source="XF">marcfile-xml-info-disc(90620)</ref>
      <ref url="http://www.securityfocus.com/bid/65057" source="BID">65057</ref>
      <ref url="http://www.nntp.perl.org/group/perl.perl4lib/2014/01/msg3073.html" source="CONFIRM">http://www.nntp.perl.org/group/perl.perl4lib/2014/01/msg3073.html</ref>
      <ref url="http://secunia.com/advisories/55404" source="SECUNIA" adv="1">55404</ref>
      <ref url="http://osvdb.org/102367" source="OSVDB">102367</ref>
      <ref url="http://lists.katipo.co.nz/pipermail/koha/2014-January/038430.html" source="MLIST">[Koha] 20140122 SECURITY release: MARC::File::XML 1.0.2</ref>
      <ref url="http://libmail.georgialibraries.org/pipermail/open-ils-general/2014-January/009442.html" source="MLIST">[OPEN-ILS-GENERAL] 20140121 SECURITY release: MARC::File::XML 1.0.2</ref>
    </refs>
    <vuln_soft>
      <prod vendor="galen_charlton" name="marc-xml">
        <vers num="1.0"/>
        <vers prev="1" num="1.0.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1636" published="2014-01-22" name="CVE-2014-1636" modified="2014-02-21" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">Multiple SQL injection vulnerabilities in Command School Student Management System 1.06.01 allow remote attackers to execute arbitrary SQL commands via the id parameter in an edit action to (1) admin_school_names.php, (2) admin_subjects.php, (3) admin_grades.php, (4) admin_terms.php, (5) admin_school_years.php, (6) admin_sgrades.php, (7) admin_media_codes_1.php, (8) admin_infraction_codes.php, (9) admin_generations.php, (10) admin_relations.php, (11) admin_titles.php, or (12) health_allergies.php in sw/.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90175" source="XF">commandschool-id-sql-injection(90175)</ref>
      <ref url="http://www.securityfocus.com/bid/64707" source="BID">64707</ref>
      <ref url="http://packetstormsecurity.com/files/124708/Command-School-Student-Management-System-1.06.01-SQL-Injection-CSRF-XSS.html" source="MISC">http://packetstormsecurity.com/files/124708/Command-School-Student-Management-System-1.06.01-SQL-Injection-CSRF-XSS.html</ref>
      <ref url="http://osvdb.org/101885" source="OSVDB">101885</ref>
      <ref url="http://osvdb.org/101884" source="OSVDB">101884</ref>
      <ref url="http://osvdb.org/101883" source="OSVDB">101883</ref>
      <ref url="http://osvdb.org/101882" source="OSVDB">101882</ref>
      <ref url="http://osvdb.org/101881" source="OSVDB">101881</ref>
      <ref url="http://osvdb.org/101880" source="OSVDB">101880</ref>
      <ref url="http://osvdb.org/101879" source="OSVDB">101879</ref>
      <ref url="http://osvdb.org/101878" source="OSVDB">101878</ref>
      <ref url="http://osvdb.org/101877" source="OSVDB">101877</ref>
      <ref url="http://osvdb.org/101876" source="OSVDB">101876</ref>
      <ref url="http://osvdb.org/101875" source="OSVDB">101875</ref>
      <ref url="http://osvdb.org/101874" source="OSVDB">101874</ref>
    </refs>
    <vuln_soft>
      <prod vendor="doug_poulin" name="ommand_school_student_management_system">
        <vers num="1.06.01"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1637" published="2014-01-22" name="CVE-2014-1637" modified="2014-02-21" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:N/A:N)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">Command School Student Management System 1.06.01 does not properly restrict access to sw/backup/backup_ray2.php, which allows remote attackers to download a database backup via a direct request.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.securityfocus.com/bid/64707" source="BID">64707</ref>
      <ref url="http://packetstormsecurity.com/files/124708/Command-School-Student-Management-System-1.06.01-SQL-Injection-CSRF-XSS.html" source="MISC">http://packetstormsecurity.com/files/124708/Command-School-Student-Management-System-1.06.01-SQL-Injection-CSRF-XSS.html</ref>
      <ref url="http://osvdb.org/101888" source="OSVDB">101888</ref>
    </refs>
    <vuln_soft>
      <prod vendor="doug_poulin" name="ommand_school_student_management_system">
        <vers num="1.06.01"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-1638" published="2014-01-27" name="CVE-2014-1638" modified="2014-01-28" CVSS_version="2.0" CVSS_vector="(AV:L/AC:M/Au:N/C:N/I:P/A:P)" CVSS_score="3.3" CVSS_impact_subscore="4.9" CVSS_exploit_subscore="3.4" CVSS_base_score="3.3">
    <desc>
      <descript source="cve">(1) debian/postrm and (2) debian/localepurge.config in localepurge before 0.7.3.2 use tempfile to create a safe temporary file but appends a suffix to the original filename and writes to this new filename, which allows local users to overwrite arbitrary files via a symlink attack on the new filename.</descript>
    </desc>
    <loss_types>
      <avail/>
      <int/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90669" source="XF">localepurge-cve20141638-symlink(90669)</ref>
      <ref url="http://www.securityfocus.com/bid/65098" source="BID">65098</ref>
      <ref url="http://www.osvdb.org/102381" source="OSVDB">102381</ref>
      <ref url="http://www.osvdb.org/102379" source="OSVDB">102379</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/01/22/4" source="MLIST">[oss-security] 20140122 Re: Getting tempfile/mktemp wrong</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/01/22/3" source="MLIST">[oss-security] 20140122 Getting tempfile/mktemp wrong</ref>
      <ref url="http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=736359" source="CONFIRM" adv="1">http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=736359</ref>
    </refs>
    <vuln_soft>
      <prod vendor="debian" name="localepurge">
        <vers prev="1" num="0.7.3.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-1639" published="2014-01-27" name="CVE-2014-1639" modified="2014-02-24" CVSS_version="2.0" CVSS_vector="(AV:L/AC:M/Au:N/C:N/I:P/A:P)" CVSS_score="3.3" CVSS_impact_subscore="4.9" CVSS_exploit_subscore="3.4" CVSS_base_score="3.3">
    <desc>
      <descript source="cve">syncevo/installcheck-local.sh in syncevolution before 1.3.99.7 uses mktemp to create a safe temporary file but appends a suffix to the original filename and writes to this new filename, which allows local users to overwrite arbitrary files via a symlink attack on the new filename.</descript>
    </desc>
    <loss_types>
      <avail/>
      <int/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90662" source="XF">syncevolution-cve20141639-symlink(90662)</ref>
      <ref url="http://www.securityfocus.com/bid/65098" source="BID">65098</ref>
      <ref url="http://www.osvdb.org/102380" source="OSVDB">102380</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/01/22/4" source="MLIST">[oss-security] 20140122 Re: Getting tempfile/mktemp wrong</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/01/22/3" source="MLIST">[oss-security] 20140122 Getting tempfile/mktemp wrong</ref>
      <ref url="http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=736357" source="CONFIRM" adv="1">http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=736357</ref>
    </refs>
    <vuln_soft>
      <prod vendor="debian" name="syncevolution">
        <vers prev="1" num="1.3.99.6"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-1640" published="2014-01-27" name="CVE-2014-1640" modified="2014-02-24" CVSS_version="2.0" CVSS_vector="(AV:L/AC:M/Au:N/C:N/I:P/A:P)" CVSS_score="3.3" CVSS_impact_subscore="4.9" CVSS_exploit_subscore="3.4" CVSS_base_score="3.3">
    <desc>
      <descript source="cve">axiom-test.sh in axiom 20100701-1.1 uses tempfile to create a safe temporary file but appends a suffix to the original filename and writes to this new filename, which allows local users to overwrite arbitrary files via a symlink attack on the new filename.</descript>
    </desc>
    <loss_types>
      <avail/>
      <int/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90663" source="XF">axiom-cve20141640-symlink(90663)</ref>
      <ref url="http://www.osvdb.org/102383" source="OSVDB">102383</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/01/22/4" source="MLIST">[oss-security] 20140122 Re: Getting tempfile/mktemp wrong</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/01/22/3" source="MLIST">[oss-security] 20140122 Getting tempfile/mktemp wrong</ref>
      <ref url="http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=736358" source="MISC">http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=736358</ref>
    </refs>
    <vuln_soft>
      <prod vendor="debian" name="axiom">
        <vers num="20100701-1.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1642" published="2014-01-26" name="CVE-2014-1642" modified="2014-04-19" CVSS_version="2.0" CVSS_vector="(AV:L/AC:M/Au:N/C:P/I:P/A:P)" CVSS_score="4.4" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="3.4" CVSS_base_score="4.4">
    <desc>
      <descript source="cve">The IRQ setup in Xen 4.2.x and 4.3.x, when using device passthrough and configured to support a large number of CPUs, frees certain memory that may still be intended for use, which allows local guest administrators to cause a denial of service (memory corruption and hypervisor crash) and possibly execute arbitrary code via vectors related to an out-of-memory error that triggers a (1) use-after-free or (2) double free.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90649" source="XF">xen-irq-cve20141642-code-exec(90649)</ref>
      <ref url="http://xenbits.xen.org/xsa/advisory-83.html" source="CONFIRM" adv="1">http://xenbits.xen.org/xsa/advisory-83.html</ref>
      <ref url="http://www.securitytracker.com/id/1029679" source="SECTRACK">1029679</ref>
      <ref url="http://www.securityfocus.com/bid/65097" source="BID">65097</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/01/23/4" source="MLIST">[oss-security] 20140123 Xen Security Advisory 83 (CVE-2014-1642) - Out-of-memory  condition yielding memory corruption during IRQ setup</ref>
      <ref url="http://secunia.com/advisories/56557" source="SECUNIA" adv="1">56557</ref>
      <ref url="http://osvdb.org/102406" source="OSVDB">102406</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00011.html" source="SUSE">SUSE-SU-2014:0373</ref>
      <ref url="http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127607.html" source="FEDORA">FEDORA-2014-1552</ref>
    </refs>
    <vuln_soft>
      <prod vendor="xen" name="xen">
        <vers num="4.2.0"/>
        <vers num="4.2.1"/>
        <vers num="4.2.2"/>
        <vers num="4.2.3"/>
        <vers num="4.3.0"/>
        <vers num="4.3.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1643" published="2014-02-06" name="CVE-2014-1643" modified="2014-02-07" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:P/I:N/A:N)" CVSS_score="4.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.0" CVSS_base_score="4.0">
    <desc>
      <descript source="cve">The Web Email Protection component in Symantec Encryption Management Server (aka PGP Universal Server) before 3.3.2 allows remote authenticated users to read the stored outbound e-mail messages of arbitrary users via a modified URL.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&amp;pvid=security_advisory&amp;year=&amp;suid=20140205_00" source="CONFIRM" adv="1">http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&amp;pvid=security_advisory&amp;year=&amp;suid=20140205_00</ref>
      <ref url="http://www.securityfocus.com/bid/65300" source="BID">65300</ref>
    </refs>
    <vuln_soft>
      <prod vendor="symantec" name="encryption_management_server">
        <vers num="3.3.0" edition="mp1"/>
        <vers num="3.3.0" edition="mp2"/>
        <vers prev="1" num="3.3.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1644" published="2014-03-28" name="CVE-2014-1644" modified="2014-03-31" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">The forgotten-password feature in forcepasswd.do in the management GUI in Symantec LiveUpdate Administrator (LUA) 2.x before 2.3.2.110 allows remote attackers to reset arbitrary passwords by providing the e-mail address associated with a user account.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&amp;pvid=security_advisory&amp;year=&amp;suid=20140327_00" source="CONFIRM" patch="1" adv="1">http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&amp;pvid=security_advisory&amp;year=&amp;suid=20140327_00</ref>
      <ref url="https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140328-0_Symantec_LiveUpdate_Administrator_Multiple_vulnerabilities_wo_poc_v10.txt" source="MISC">https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140328-0_Symantec_LiveUpdate_Administrator_Multiple_vulnerabilities_wo_poc_v10.txt</ref>
      <ref url="http://www.securityfocus.com/bid/66399" source="BID">66399</ref>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-03/0172.html" source="BUGTRAQ">20140328 SEC Consult SA-20140328-0 :: Multiple vulnerabilities in Symantec LiveUpdate Administrator</ref>
    </refs>
    <vuln_soft>
      <prod vendor="symantec" name="liveupdate_administrator">
        <vers num="2.1.0"/>
        <vers num="2.1.2"/>
        <vers num="2.1.3"/>
        <vers num="2.2.1"/>
        <vers num="2.2.2"/>
        <vers num="2.2.2.9"/>
        <vers num="2.3.0"/>
        <vers num="2.3.1"/>
        <vers prev="1" num="2.3.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1645" published="2014-03-28" name="CVE-2014-1645" modified="2014-03-31" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">SQL injection vulnerability in forcepasswd.do in the management GUI in Symantec LiveUpdate Administrator (LUA) 2.x before 2.3.2.110 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&amp;pvid=security_advisory&amp;year=&amp;suid=20140327_00" source="CONFIRM" patch="1" adv="1">http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&amp;pvid=security_advisory&amp;year=&amp;suid=20140327_00</ref>
      <ref url="https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140328-0_Symantec_LiveUpdate_Administrator_Multiple_vulnerabilities_wo_poc_v10.txt" source="MISC">https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140328-0_Symantec_LiveUpdate_Administrator_Multiple_vulnerabilities_wo_poc_v10.txt</ref>
      <ref url="http://www.securityfocus.com/bid/66400" source="BID">66400</ref>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-03/0172.html" source="BUGTRAQ">20140328 SEC Consult SA-20140328-0 :: Multiple vulnerabilities in Symantec LiveUpdate Administrator</ref>
    </refs>
    <vuln_soft>
      <prod vendor="symantec" name="liveupdate_administrator">
        <vers num="2.1.0"/>
        <vers num="2.1.2"/>
        <vers num="2.1.3"/>
        <vers num="2.2.1"/>
        <vers num="2.2.2"/>
        <vers num="2.2.2.9"/>
        <vers num="2.3.0"/>
        <vers num="2.3.1"/>
        <vers prev="1" num="2.3.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-1646" published="2014-04-23" name="CVE-2014-1646" modified="2014-04-24" CVSS_version="2.0" CVSS_vector="(AV:N/AC:H/Au:N/C:N/I:N/A:P)" CVSS_score="2.6" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="4.9" CVSS_base_score="2.6">
    <desc>
      <descript source="cve">Symantec PGP Desktop 10.0.x through 10.2.x and Encryption Desktop Professional 10.3.x before 10.3.2 MP1 do not properly perform memory copies, which allows remote attackers to cause a denial of service (read access violation and application crash) via a malformed certificate.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&amp;pvid=security_advisory&amp;year=&amp;suid=20140423_00" source="CONFIRM" adv="1">http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&amp;pvid=security_advisory&amp;year=&amp;suid=20140423_00</ref>
      <ref url="http://www.securityfocus.com/bid/67016" source="BID">67016</ref>
    </refs>
    <vuln_soft>
      <prod vendor="symantec" name="encryption_desktop">
        <vers num="10.3.0" edition=":~~professional~~~"/>
        <vers num="10.3.1" edition=":~~professional~~~"/>
        <vers num="10.3.2" edition="-:~~professional~~~"/>
      </prod>
      <prod vendor="symantec" name="pgp_desktop">
        <vers num="10.0.0"/>
        <vers num="10.0.1"/>
        <vers num="10.0.2"/>
        <vers num="10.0.3"/>
        <vers num="10.1.0"/>
        <vers num="10.1.1"/>
        <vers num="10.1.2"/>
        <vers num="10.2.0"/>
        <vers num="10.2.1"/>
        <vers num="10.2.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-1647" published="2014-04-23" name="CVE-2014-1647" modified="2014-04-24" CVSS_version="2.0" CVSS_vector="(AV:N/AC:H/Au:N/C:N/I:N/A:P)" CVSS_score="2.6" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="4.9" CVSS_base_score="2.6">
    <desc>
      <descript source="cve">Symantec PGP Desktop 10.0.x through 10.2.x and Encryption Desktop Professional 10.3.x before 10.3.2 MP1 do not properly perform block-data moves, which allows remote attackers to cause a denial of service (read access violation and application crash) via a malformed certificate.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&amp;pvid=security_advisory&amp;year=&amp;suid=20140423_00" source="CONFIRM" adv="1">http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&amp;pvid=security_advisory&amp;year=&amp;suid=20140423_00</ref>
      <ref url="http://www.securityfocus.com/bid/67020" source="BID">67020</ref>
    </refs>
    <vuln_soft>
      <prod vendor="symantec" name="encryption_desktop">
        <vers num="10.3.0" edition=":~~professional~~~"/>
        <vers num="10.3.1" edition=":~~professional~~~"/>
        <vers num="10.3.2" edition="-:~~professional~~~"/>
      </prod>
      <prod vendor="symantec" name="pgp_desktop">
        <vers num="10.0.0"/>
        <vers num="10.0.1"/>
        <vers num="10.0.2"/>
        <vers num="10.0.3"/>
        <vers num="10.1.0"/>
        <vers num="10.1.1"/>
        <vers num="10.1.2"/>
        <vers num="10.2.0"/>
        <vers num="10.2.1"/>
        <vers num="10.2.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1648" published="2014-04-23" name="CVE-2014-1648" modified="2014-04-24" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in brightmail/setting/compliance/DlpConnectFlow$view.flo in the management console in Symantec Messaging Gateway 10.x before 10.5.2 allows remote attackers to inject arbitrary web script or HTML via the displayTab parameter.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&amp;pvid=security_advisory&amp;year=&amp;suid=20140422_00" source="CONFIRM" adv="1">http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&amp;pvid=security_advisory&amp;year=&amp;suid=20140422_00</ref>
      <ref url="http://www.securityfocus.com/bid/66966" source="BID">66966</ref>
      <ref url="http://seclists.org/fulldisclosure/2014/Apr/256" source="FULLDISC">20140422 (CVE-2014-1648) Symantec Messaging Gateway Management Console Cross Site Scripting Vulnerability</ref>
    </refs>
    <vuln_soft>
      <prod vendor="symantec" name="messaging_gateway">
        <vers num="10.0"/>
        <vers num="10.0.1"/>
        <vers num="10.0.2"/>
        <vers num="10.0.3"/>
        <vers num="10.5.0"/>
        <vers num="10.5.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1663" published="2014-02-06" name="CVE-2014-1663" modified="2014-02-07" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:N/A:N)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">Unspecified vulnerability in Citrix XenMobile Device Manager server (formerly Zenprise Device Manager server) 8.5, 8.6, and MDM 8.0.1 allows remote attackers to obtain sensitive information via unknown vectors.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.securityfocus.com/bid/65348" source="BID">65348</ref>
      <ref url="http://support.citrix.com/article/CTX140044" source="CONFIRM" adv="1">http://support.citrix.com/article/CTX140044</ref>
      <ref url="http://secunia.com/advisories/56438" source="SECUNIA" adv="1">56438</ref>
    </refs>
    <vuln_soft>
      <prod vendor="citrix" name="xenmobile_device_manager">
        <vers num="8.5"/>
        <vers num="8.6"/>
      </prod>
      <prod vendor="citrix" name="xenmobile_device_manager_mdm">
        <vers num="8.0.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1664" published="2014-01-26" name="CVE-2014-1664" modified="2014-01-31" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:N/A:N)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">The Citrix GoToMeeting application 5.0.799.1238 for Android logs HTTP requests containing sensitive information, which allows attackers to obtain user IDs, meeting details, and authentication tokens via an application that reads the system log file.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90695" source="XF">gotomeeting-cve20141664-info-disc(90695)</ref>
      <ref url="http://www.securityfocus.com/bid/65123" source="BID">65123</ref>
      <ref url="http://www.securityfocus.com/archive/1/archive/1/530879/100/0/threaded" source="BUGTRAQ">20140124 [CVE-2014-1664] GoToMeeting Information Disclosure via Logging Output (Android)</ref>
      <ref url="http://osvdb.org/102559" source="OSVDB">102559</ref>
    </refs>
    <vuln_soft>
      <prod vendor="citrix" name="gotomeeting">
        <vers num="5.0.799.1238" edition="-:~-~-~android~~"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1666" published="2014-01-26" name="CVE-2014-1666" modified="2014-04-19" CVSS_version="2.0" CVSS_vector="(AV:A/AC:L/Au:N/C:C/I:C/A:C)" CVSS_score="8.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="6.5" CVSS_base_score="8.3">
    <desc>
      <descript source="cve">The do_physdev_op function in Xen 4.1.5, 4.1.6.1, 4.2.2 through 4.2.3, and 4.3.x does not properly restrict access to the (1) PHYSDEVOP_prepare_msix and (2) PHYSDEVOP_release_msix operations, which allows local PV guests to cause a denial of service (host or guest malfunction) or possibly gain privileges via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <local_network/>
    </range>
    <refs>
      <ref url="http://xenbits.xen.org/xsa/xsa87-unstable-4.3.patch" source="MISC" patch="1" adv="1">http://xenbits.xen.org/xsa/xsa87-unstable-4.3.patch</ref>
      <ref url="http://xforce.iss.net/xforce/xfdb/90675" source="XF">xen-cve20141666-priv-esc(90675)</ref>
      <ref url="http://xenbits.xen.org/xsa/advisory-87.html" source="CONFIRM">http://xenbits.xen.org/xsa/advisory-87.html</ref>
      <ref url="http://www.securitytracker.com/id/1029684" source="SECTRACK">1029684</ref>
      <ref url="http://www.securityfocus.com/bid/65125" source="BID">65125</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/01/24/6" source="MLIST">[oss-security] 20140123 Xen Security Advisory 87 (CVE-2014-1666) - PHYSDEVOP_{prepare,release}_msix  exposed to unprivileged guests</ref>
      <ref url="http://secunia.com/advisories/56650" source="SECUNIA" adv="1">56650</ref>
      <ref url="http://osvdb.org/102536" source="OSVDB">102536</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00011.html" source="SUSE">SUSE-SU-2014:0373</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00010.html" source="SUSE">SUSE-SU-2014:0372</ref>
      <ref url="http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127607.html" source="FEDORA">FEDORA-2014-1552</ref>
    </refs>
    <vuln_soft>
      <prod vendor="xen" name="xen">
        <vers num="4.1.5"/>
        <vers num="4.1.6.1"/>
        <vers num="4.2.2"/>
        <vers num="4.2.3"/>
        <vers num="4.3.0"/>
        <vers num="4.3.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1670" published="2014-01-25" name="CVE-2014-1670" modified="2014-01-31" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:P)" CVSS_score="6.8" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.6" CVSS_base_score="6.8">
    <desc>
      <descript source="cve">The Microsoft Bing application before 4.2.1 for Android allows remote attackers to install arbitrary APK files via vectors involving a crafted DNS response.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="https://play.google.com/store/apps/details?id=com.microsoft.bing" source="MISC">https://play.google.com/store/apps/details?id=com.microsoft.bing</ref>
      <ref url="http://www.youtube.com/watch?v=_j1RKtTxZ3k" source="MISC">http://www.youtube.com/watch?v=_j1RKtTxZ3k</ref>
      <ref url="http://www.securityfocus.com/bid/65128" source="BID">65128</ref>
      <ref url="http://osvdb.org/102575" source="OSVDB">102575</ref>
      <ref url="http://blog.trustlook.com/2014/01/23/trustlook-reported-microsofts-first-ever-android-vulnerability/" source="MISC">http://blog.trustlook.com/2014/01/23/trustlook-reported-microsofts-first-ever-android-vulnerability/</ref>
    </refs>
    <vuln_soft>
      <prod vendor="microsoft" name="bing">
        <vers prev="1" num="4.2.0" edition="-:~-~-~android~~"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1671" published="2014-01-25" name="CVE-2014-1671" modified="2014-01-31" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:P/I:P/A:P)" CVSS_score="6.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.0" CVSS_base_score="6.5">
    <desc>
      <descript source="cve">Multiple SQL injection vulnerabilities in Dell KACE K1000 5.4.76847 and possibly earlier allow remote attackers or remote authenticated users to execute arbitrary SQL commands via the macAddress element in a (1) getUploadPath or (2) getKBot SOAP request to service/kbot_service.php; the ID parameter to (3) userui/advisory_detail.php or (4) userui/ticket.php; and the (5) ORDER[] parameter to userui/ticket_list.php.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90592" source="XF">kace-multiple-sql-injection(90592)</ref>
      <ref url="http://www.securityfocus.com/bid/65029" source="BID">65029</ref>
      <ref url="http://www.baesystemsdetica.com.au/Research/Advisories/Dell-KACE-K1000-SQL-Injection-%28DS-2014-001%29" source="MISC">http://www.baesystemsdetica.com.au/Research/Advisories/Dell-KACE-K1000-SQL-Injection-(DS-2014-001)</ref>
      <ref url="http://secunia.com/advisories/56396" source="SECUNIA" adv="1">56396</ref>
    </refs>
    <vuln_soft>
      <prod vendor="dell" name="kace_k1000_systems_management_appliance_software">
        <vers num="5.4.76847"/>
      </prod>
      <prod vendor="dell" name="kace_k1000_systems_management_virtual_appliance">
        <vers num="-"/>
      </prod>
      <prod vendor="dell" name="kace_k1000_systems_management_appliance">
        <vers num="-"/>
      </prod>
      <prod vendor="dell" name="kace_k1100s_systems_management_appliance">
        <vers num="-"/>
      </prod>
      <prod vendor="dell" name="kace_k1200s_systems_management_appliance">
        <vers num="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1672" published="2014-01-25" name="CVE-2014-1672" modified="2014-01-27" CVSS_version="2.0" CVSS_vector="(AV:N/AC:H/Au:N/C:P/I:P/A:N)" CVSS_score="4.0" CVSS_impact_subscore="4.9" CVSS_exploit_subscore="4.9" CVSS_base_score="4.0">
    <desc>
      <descript source="cve">Check Point R75.47 Security Gateway and Management Server does not properly enforce Anti-Spoofing when the routing table is modified and the "Get - Interfaces with Topology" action is performed, which allows attackers to bypass intended access restrictions.</descript>
    </desc>
    <sols>
      <sol source="nvd">Per: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&amp;solutionid=sk98087

"This issue affects only R75.47 Security Gateway and R75.47 Management Server."</sol>
    </sols>
    <loss_types>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&amp;solutionid=sk98087" source="CONFIRM" adv="1">https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&amp;solutionid=sk98087</ref>
    </refs>
    <vuln_soft>
      <prod vendor="checkpoint" name="management_server">
        <vers num="r75.47"/>
      </prod>
      <prod vendor="checkpoint" name="security_gateway">
        <vers num="r75.47"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1673" published="2014-01-25" name="CVE-2014-1673" modified="2014-01-31" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:N/A:N)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">Check Point Session Authentication Agent allows remote attackers to obtain sensitive information (user credentials) via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&amp;solutionid=sk98263" source="CONFIRM" adv="1">https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&amp;solutionid=sk98263</ref>
      <ref url="http://xforce.iss.net/xforce/xfdb/90746" source="XF">check-point-cve20141673-unauth-access(90746)</ref>
      <ref url="http://seclists.org/fulldisclosure/2014/Jan/185" source="FULLDISC">20140127 [CVE-2014-1673] Check Point Session Authentication Agent vulnerability</ref>
      <ref url="http://packetstormsecurity.com/files/124967" source="MISC">http://packetstormsecurity.com/files/124967</ref>
      <ref url="http://osvdb.org/102418" source="OSVDB">102418</ref>
    </refs>
    <vuln_soft>
      <prod vendor="checkpoint" name="session_authentication_agent">
        <vers num="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1680" published="2014-02-14" name="CVE-2014-1680" modified="2014-02-21" CVSS_version="2.0" CVSS_vector="(AV:L/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="6.9" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="3.4" CVSS_base_score="6.9">
    <desc>
      <descript source="cve">Untrusted search path vulnerability in Bandisoft Bandizip before 3.10 allows local users to gain privileges via a Trojan horse dwmapi.dll file in the current working directory.</descript>
      <descript source="nvd">Per: http://cwe.mitre.org/data/definitions/426.html

"CWE-426: Untrusted Search Path"</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90966" source="XF">bandzip-dll-cve20141680-code-exec(90966)</ref>
      <ref url="http://www.bandisoft.com/bandizip/history" source="MISC">http://www.bandisoft.com/bandizip/history</ref>
      <ref url="http://packetstormsecurity.com/files/125059" source="MISC">http://packetstormsecurity.com/files/125059</ref>
      <ref url="http://osvdb.org/102979" source="OSVDB">102979</ref>
    </refs>
    <vuln_soft>
      <prod vendor="bandisoft" name="bandizip">
        <vers num="3.00"/>
        <vers num="3.01"/>
        <vers num="3.02"/>
        <vers num="3.03"/>
        <vers num="3.04"/>
        <vers num="3.05"/>
        <vers num="3.06"/>
        <vers num="3.07"/>
        <vers num="3.08"/>
        <vers prev="1" num="3.09"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1681" published="2014-01-28" name="CVE-2014-1681" modified="2014-02-06" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:C/I:C/A:C)" CVSS_score="10.0" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="10.0" CVSS_base_score="10.0">
    <desc>
      <descript source="cve">Multiple unspecified vulnerabilities in Google Chrome before 32.0.1700.102 have unknown impact and attack vectors, related to 12 "security fixes [that were not] either contributed by external researchers or particularly interesting."</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://osvdb.org/102633" source="OSVDB">102633</ref>
      <ref url="http://googlechromereleases.blogspot.com/2014/01/stable-channel-update_27.html" source="CONFIRM" adv="1">http://googlechromereleases.blogspot.com/2014/01/stable-channel-update_27.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="google" name="chrome">
        <vers num="32.0.1700.0"/>
        <vers num="32.0.1700.10"/>
        <vers num="32.0.1700.100"/>
        <vers prev="1" num="32.0.1700.101"/>
        <vers num="32.0.1700.11"/>
        <vers num="32.0.1700.12"/>
        <vers num="32.0.1700.13"/>
        <vers num="32.0.1700.14"/>
        <vers num="32.0.1700.15"/>
        <vers num="32.0.1700.16"/>
        <vers num="32.0.1700.17"/>
        <vers num="32.0.1700.18"/>
        <vers num="32.0.1700.19"/>
        <vers num="32.0.1700.2"/>
        <vers num="32.0.1700.21"/>
        <vers num="32.0.1700.22"/>
        <vers num="32.0.1700.23"/>
        <vers num="32.0.1700.24"/>
        <vers num="32.0.1700.26"/>
        <vers num="32.0.1700.27"/>
        <vers num="32.0.1700.28"/>
        <vers num="32.0.1700.29"/>
        <vers num="32.0.1700.3"/>
        <vers num="32.0.1700.30"/>
        <vers num="32.0.1700.31"/>
        <vers num="32.0.1700.32"/>
        <vers num="32.0.1700.33"/>
        <vers num="32.0.1700.34"/>
        <vers num="32.0.1700.35"/>
        <vers num="32.0.1700.38"/>
        <vers num="32.0.1700.39"/>
        <vers num="32.0.1700.4"/>
        <vers num="32.0.1700.41"/>
        <vers num="32.0.1700.5"/>
        <vers num="32.0.1700.50"/>
        <vers num="32.0.1700.51"/>
        <vers num="32.0.1700.52"/>
        <vers num="32.0.1700.53"/>
        <vers num="32.0.1700.54"/>
        <vers num="32.0.1700.55"/>
        <vers num="32.0.1700.56"/>
        <vers num="32.0.1700.57"/>
        <vers num="32.0.1700.58"/>
        <vers num="32.0.1700.59"/>
        <vers num="32.0.1700.6"/>
        <vers num="32.0.1700.62"/>
        <vers num="32.0.1700.63"/>
        <vers num="32.0.1700.64"/>
        <vers num="32.0.1700.65"/>
        <vers num="32.0.1700.66"/>
        <vers num="32.0.1700.67"/>
        <vers num="32.0.1700.68"/>
        <vers num="32.0.1700.69"/>
        <vers num="32.0.1700.7"/>
        <vers num="32.0.1700.70"/>
        <vers num="32.0.1700.71"/>
        <vers num="32.0.1700.72"/>
        <vers num="32.0.1700.74"/>
        <vers num="32.0.1700.75"/>
        <vers num="32.0.1700.76"/>
        <vers num="32.0.1700.77"/>
        <vers num="32.0.1700.8"/>
        <vers num="32.0.1700.9"/>
        <vers num="32.0.1700.94"/>
        <vers num="32.0.1700.95"/>
        <vers num="32.0.1700.96"/>
        <vers num="32.0.1700.97"/>
        <vers num="32.0.1700.98"/>
        <vers num="32.0.1700.99"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1683" published="2014-01-29" name="CVE-2014-1683" modified="2014-02-21" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:P)" CVSS_score="6.8" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.6" CVSS_base_score="6.8">
    <desc>
      <descript source="cve">The bashMail function in cms/data/skins/techjunkie/fragments/contacts/functions.php in SkyBlueCanvas CMS before 1.1 r248-04, when the pid parameter is 4, allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) name, (2) email, (3) subject, or (4) message parameter to index.php, when the pid parameter is 4.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90670" source="XF">skybluecanvas-index-command-exec(90670)</ref>
      <ref url="http://www.securityfocus.com/bid/65129" source="BID">65129</ref>
      <ref url="http://www.exploit-db.com/exploits/31432" source="EXPLOIT-DB">31432</ref>
      <ref url="http://www.exploit-db.com/exploits/31183" source="EXPLOIT-DB">31183</ref>
      <ref url="http://secunia.com/advisories/56646" source="SECUNIA">56646</ref>
      <ref url="http://seclists.org/fulldisclosure/2014/Jan/159" source="FULLDISC">20140123 Remote Command Injection Vulnerability in SkyBlueCanvas CMS</ref>
      <ref url="http://packetstormsecurity.com/files/124948/SkyBlueCanvas-CMS-1.1-r248-03-Command-Injection.html" source="MISC">http://packetstormsecurity.com/files/124948/SkyBlueCanvas-CMS-1.1-r248-03-Command-Injection.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="skybluecanvas" name="skybluecanvas">
        <vers prev="1" num="1.1_r248-03"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1684" published="2014-03-03" name="CVE-2014-1684" modified="2014-03-07" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:N/A:P)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">The ASF_ReadObject_file_properties function in modules/demux/asf/libasf.c in the ASF Demuxer in VideoLAN VLC Media Player before 2.1.3 allows remote attackers to cause a denial of service (divide-by-zero error and crash) via a zero minimum and maximum data packet size in an ASF file.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://git.videolan.org/gitweb.cgi/vlc.git/?p=vlc.git;a=commitdiff;h=98787d0843612271e99d62bee0dfd8197f0cf404" source="CONFIRM" patch="1">http://git.videolan.org/gitweb.cgi/vlc.git/?p=vlc.git;a=commitdiff;h=98787d0843612271e99d62bee0dfd8197f0cf404</ref>
      <ref url="https://trac.videolan.org/vlc/ticket/10482" source="CONFIRM">https://trac.videolan.org/vlc/ticket/10482</ref>
      <ref url="http://www.elsherei.com/?p=269" source="MISC">http://www.elsherei.com/?p=269</ref>
    </refs>
    <vuln_soft>
      <prod vendor="videolan" name="vlc_media_player">
        <vers num="1.0.0"/>
        <vers num="1.0.1"/>
        <vers num="1.0.2"/>
        <vers num="1.0.3"/>
        <vers num="1.0.4"/>
        <vers num="1.0.5"/>
        <vers num="1.0.6"/>
        <vers num="1.1.0"/>
        <vers num="1.1.1"/>
        <vers num="1.1.10"/>
        <vers num="1.1.10.1"/>
        <vers num="1.1.11"/>
        <vers num="1.1.12"/>
        <vers num="1.1.13"/>
        <vers num="1.1.2"/>
        <vers num="1.1.3"/>
        <vers num="1.1.4"/>
        <vers num="1.1.4.1"/>
        <vers num="1.1.5"/>
        <vers num="1.1.6"/>
        <vers num="1.1.6.1"/>
        <vers num="1.1.7"/>
        <vers num="1.1.8"/>
        <vers num="1.1.9"/>
        <vers num="2.0.0"/>
        <vers num="2.0.1"/>
        <vers num="2.0.2"/>
        <vers num="2.0.3"/>
        <vers num="2.0.4"/>
        <vers num="2.0.5"/>
        <vers num="2.0.6"/>
        <vers num="2.0.7"/>
        <vers num="2.0.8"/>
        <vers num="2.0.9"/>
        <vers num="2.1.0"/>
        <vers num="2.1.1"/>
        <vers prev="1" num="2.1.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-1690" published="2014-02-28" name="CVE-2014-1690" modified="2014-04-19" CVSS_version="2.0" CVSS_vector="(AV:N/AC:H/Au:N/C:P/I:N/A:N)" CVSS_score="2.6" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="4.9" CVSS_base_score="2.6">
    <desc>
      <descript source="cve">The help function in net/netfilter/nf_nat_irc.c in the Linux kernel before 3.12.8 allows remote attackers to obtain sensitive information from kernel memory by establishing an IRC DCC session in which incorrect packet data is transmitted during use of the NAT mangle feature.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://github.com/torvalds/linux/commit/2690d97ade05c5325cbf7c72b94b90d265659886" source="CONFIRM" patch="1">https://github.com/torvalds/linux/commit/2690d97ade05c5325cbf7c72b94b90d265659886</ref>
      <ref url="http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=2690d97ade05c5325cbf7c72b94b90d265659886" source="CONFIRM" patch="1">http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=2690d97ade05c5325cbf7c72b94b90d265659886</ref>
      <ref url="https://bugzilla.redhat.com/show_bug.cgi?id=1058748" source="CONFIRM">https://bugzilla.redhat.com/show_bug.cgi?id=1058748</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2158-1" source="UBUNTU">USN-2158-1</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2140-1" source="UBUNTU">USN-2140-1</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2137-1" source="UBUNTU">USN-2137-1</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/01/28/3" source="MLIST">[oss-security] 20140128 Re: CVE request Linux kernel: netfilter: nf_nat: leakage of uninitialized buffer in IRC NAT helper</ref>
      <ref url="http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.12.8" source="CONFIRM">http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.12.8</ref>
    </refs>
    <vuln_soft>
      <prod vendor="linux" name="linux_kernel">
        <vers num="3.0" edition="rc1"/>
        <vers num="3.0" edition="rc2"/>
        <vers num="3.0" edition="rc3"/>
        <vers num="3.0" edition="rc4"/>
        <vers num="3.0" edition="rc5"/>
        <vers num="3.0" edition="rc6"/>
        <vers num="3.0" edition="rc7"/>
        <vers num="3.0.1"/>
        <vers num="3.0.10"/>
        <vers num="3.0.11"/>
        <vers num="3.0.12"/>
        <vers num="3.0.13"/>
        <vers num="3.0.14"/>
        <vers num="3.0.15"/>
        <vers num="3.0.16"/>
        <vers num="3.0.17"/>
        <vers num="3.0.18"/>
        <vers num="3.0.19"/>
        <vers num="3.0.2"/>
        <vers num="3.0.20"/>
        <vers num="3.0.21"/>
        <vers num="3.0.22"/>
        <vers num="3.0.23"/>
        <vers num="3.0.24"/>
        <vers num="3.0.25"/>
        <vers num="3.0.26"/>
        <vers num="3.0.27"/>
        <vers num="3.0.28"/>
        <vers num="3.0.29"/>
        <vers num="3.0.3"/>
        <vers num="3.0.30"/>
        <vers num="3.0.31"/>
        <vers num="3.0.32"/>
        <vers num="3.0.33"/>
        <vers num="3.0.34"/>
        <vers num="3.0.35"/>
        <vers num="3.0.36"/>
        <vers num="3.0.37"/>
        <vers num="3.0.38"/>
        <vers num="3.0.39"/>
        <vers num="3.0.4"/>
        <vers num="3.0.40"/>
        <vers num="3.0.41"/>
        <vers num="3.0.42"/>
        <vers num="3.0.43"/>
        <vers num="3.0.44"/>
        <vers num="3.0.45"/>
        <vers num="3.0.46"/>
        <vers num="3.0.47"/>
        <vers num="3.0.48"/>
        <vers num="3.0.49"/>
        <vers num="3.0.5"/>
        <vers num="3.0.50"/>
        <vers num="3.0.51"/>
        <vers num="3.0.52"/>
        <vers num="3.0.53"/>
        <vers num="3.0.54"/>
        <vers num="3.0.55"/>
        <vers num="3.0.56"/>
        <vers num="3.0.57"/>
        <vers num="3.0.58"/>
        <vers num="3.0.59"/>
        <vers num="3.0.6"/>
        <vers num="3.0.60"/>
        <vers num="3.0.61"/>
        <vers num="3.0.62"/>
        <vers num="3.0.63"/>
        <vers num="3.0.64"/>
        <vers num="3.0.65"/>
        <vers num="3.0.66"/>
        <vers num="3.0.67"/>
        <vers num="3.0.68"/>
        <vers num="3.0.7"/>
        <vers num="3.0.8"/>
        <vers num="3.0.9"/>
        <vers num="3.1" edition="rc1"/>
        <vers num="3.1" edition="rc2"/>
        <vers num="3.1" edition="rc3"/>
        <vers num="3.1" edition="rc4"/>
        <vers num="3.1.1"/>
        <vers num="3.1.10"/>
        <vers num="3.1.2"/>
        <vers num="3.1.3"/>
        <vers num="3.1.4"/>
        <vers num="3.1.5"/>
        <vers num="3.1.6"/>
        <vers num="3.1.7"/>
        <vers num="3.1.8"/>
        <vers num="3.1.9"/>
        <vers num="3.10"/>
        <vers num="3.10.1"/>
        <vers num="3.10.10"/>
        <vers num="3.10.11"/>
        <vers num="3.10.12"/>
        <vers num="3.10.13"/>
        <vers num="3.10.14"/>
        <vers num="3.10.15"/>
        <vers num="3.10.16"/>
        <vers num="3.10.17"/>
        <vers num="3.10.18"/>
        <vers num="3.10.19"/>
        <vers num="3.10.2"/>
        <vers num="3.10.20"/>
        <vers num="3.10.21"/>
        <vers num="3.10.22"/>
        <vers num="3.10.23"/>
        <vers num="3.10.24"/>
        <vers num="3.10.25"/>
        <vers num="3.10.26"/>
        <vers num="3.10.27"/>
        <vers num="3.10.28"/>
        <vers num="3.10.29"/>
        <vers num="3.10.3"/>
        <vers num="3.10.4"/>
        <vers num="3.10.5"/>
        <vers num="3.10.6"/>
        <vers num="3.10.7"/>
        <vers num="3.10.8"/>
        <vers num="3.10.9"/>
        <vers num="3.11"/>
        <vers num="3.11.1"/>
        <vers num="3.11.10"/>
        <vers num="3.11.2"/>
        <vers num="3.11.3"/>
        <vers num="3.11.4"/>
        <vers num="3.11.5"/>
        <vers num="3.11.6"/>
        <vers num="3.11.7"/>
        <vers num="3.11.8"/>
        <vers num="3.11.9"/>
        <vers num="3.12"/>
        <vers num="3.12.1"/>
        <vers num="3.12.10"/>
        <vers num="3.12.2"/>
        <vers num="3.12.3"/>
        <vers num="3.12.4"/>
        <vers num="3.12.5"/>
        <vers num="3.12.6"/>
        <vers prev="1" num="3.12.7"/>
        <vers num="3.2" edition="rc2"/>
        <vers num="3.2" edition="rc3"/>
        <vers num="3.2" edition="rc4"/>
        <vers num="3.2" edition="rc5"/>
        <vers num="3.2" edition="rc6"/>
        <vers num="3.2" edition="rc7"/>
        <vers num="3.2.1"/>
        <vers num="3.2.10"/>
        <vers num="3.2.11"/>
        <vers num="3.2.12"/>
        <vers num="3.2.13"/>
        <vers num="3.2.14"/>
        <vers num="3.2.15"/>
        <vers num="3.2.16"/>
        <vers num="3.2.17"/>
        <vers num="3.2.18"/>
        <vers num="3.2.19"/>
        <vers num="3.2.2"/>
        <vers num="3.2.20"/>
        <vers num="3.2.21"/>
        <vers num="3.2.22"/>
        <vers num="3.2.23"/>
        <vers num="3.2.24"/>
        <vers num="3.2.25"/>
        <vers num="3.2.26"/>
        <vers num="3.2.27"/>
        <vers num="3.2.28"/>
        <vers num="3.2.29"/>
        <vers num="3.2.3"/>
        <vers num="3.2.30"/>
        <vers num="3.2.4"/>
        <vers num="3.2.5"/>
        <vers num="3.2.6"/>
        <vers num="3.2.7"/>
        <vers num="3.2.8"/>
        <vers num="3.2.9"/>
        <vers num="3.3" edition="rc1"/>
        <vers num="3.3" edition="rc2"/>
        <vers num="3.3" edition="rc3"/>
        <vers num="3.3" edition="rc4"/>
        <vers num="3.3" edition="rc5"/>
        <vers num="3.3" edition="rc6"/>
        <vers num="3.3" edition="rc7"/>
        <vers num="3.3.1"/>
        <vers num="3.3.2"/>
        <vers num="3.3.3"/>
        <vers num="3.3.4"/>
        <vers num="3.3.5"/>
        <vers num="3.3.6"/>
        <vers num="3.3.7"/>
        <vers num="3.3.8"/>
        <vers num="3.4" edition="rc1"/>
        <vers num="3.4" edition="rc2"/>
        <vers num="3.4" edition="rc3"/>
        <vers num="3.4" edition="rc4"/>
        <vers num="3.4" edition="rc5"/>
        <vers num="3.4" edition="rc6"/>
        <vers num="3.4" edition="rc7"/>
        <vers num="3.4.1"/>
        <vers num="3.4.10"/>
        <vers num="3.4.11"/>
        <vers num="3.4.12"/>
        <vers num="3.4.13"/>
        <vers num="3.4.14"/>
        <vers num="3.4.15"/>
        <vers num="3.4.16"/>
        <vers num="3.4.17"/>
        <vers num="3.4.18"/>
        <vers num="3.4.19"/>
        <vers num="3.4.2"/>
        <vers num="3.4.20"/>
        <vers num="3.4.21"/>
        <vers num="3.4.22"/>
        <vers num="3.4.23"/>
        <vers num="3.4.24"/>
        <vers num="3.4.25"/>
        <vers num="3.4.26"/>
        <vers num="3.4.27"/>
        <vers num="3.4.28"/>
        <vers num="3.4.29"/>
        <vers num="3.4.3"/>
        <vers num="3.4.30"/>
        <vers num="3.4.31"/>
        <vers num="3.4.32"/>
        <vers num="3.4.33"/>
        <vers num="3.4.34"/>
        <vers num="3.4.35"/>
        <vers num="3.4.36"/>
        <vers num="3.4.37"/>
        <vers num="3.4.38"/>
        <vers num="3.4.39"/>
        <vers num="3.4.4"/>
        <vers num="3.4.40"/>
        <vers num="3.4.41"/>
        <vers num="3.4.42"/>
        <vers num="3.4.43"/>
        <vers num="3.4.44"/>
        <vers num="3.4.45"/>
        <vers num="3.4.46"/>
        <vers num="3.4.47"/>
        <vers num="3.4.48"/>
        <vers num="3.4.49"/>
        <vers num="3.4.5"/>
        <vers num="3.4.50"/>
        <vers num="3.4.51"/>
        <vers num="3.4.52"/>
        <vers num="3.4.53"/>
        <vers num="3.4.54"/>
        <vers num="3.4.55"/>
        <vers num="3.4.56"/>
        <vers num="3.4.57"/>
        <vers num="3.4.58"/>
        <vers num="3.4.59"/>
        <vers num="3.4.6"/>
        <vers num="3.4.60"/>
        <vers num="3.4.61"/>
        <vers num="3.4.62"/>
        <vers num="3.4.63"/>
        <vers num="3.4.64"/>
        <vers num="3.4.65"/>
        <vers num="3.4.66"/>
        <vers num="3.4.67"/>
        <vers num="3.4.68"/>
        <vers num="3.4.69"/>
        <vers num="3.4.7"/>
        <vers num="3.4.70"/>
        <vers num="3.4.71"/>
        <vers num="3.4.72"/>
        <vers num="3.4.73"/>
        <vers num="3.4.74"/>
        <vers num="3.4.75"/>
        <vers num="3.4.76"/>
        <vers num="3.4.77"/>
        <vers num="3.4.78"/>
        <vers num="3.4.79"/>
        <vers num="3.4.8"/>
        <vers num="3.4.9"/>
        <vers num="3.5.1"/>
        <vers num="3.5.2"/>
        <vers num="3.5.3"/>
        <vers num="3.5.4"/>
        <vers num="3.5.5"/>
        <vers num="3.5.6"/>
        <vers num="3.5.7"/>
        <vers num="3.6"/>
        <vers num="3.6.1"/>
        <vers num="3.6.10"/>
        <vers num="3.6.11"/>
        <vers num="3.6.2"/>
        <vers num="3.6.3"/>
        <vers num="3.6.4"/>
        <vers num="3.6.5"/>
        <vers num="3.6.6"/>
        <vers num="3.6.7"/>
        <vers num="3.6.8"/>
        <vers num="3.6.9"/>
        <vers num="3.7"/>
        <vers num="3.7.1"/>
        <vers num="3.7.10"/>
        <vers num="3.7.2"/>
        <vers num="3.7.3"/>
        <vers num="3.7.4"/>
        <vers num="3.7.5"/>
        <vers num="3.7.6"/>
        <vers num="3.7.7"/>
        <vers num="3.7.8"/>
        <vers num="3.7.9"/>
        <vers num="3.8.0"/>
        <vers num="3.8.1"/>
        <vers num="3.8.10"/>
        <vers num="3.8.11"/>
        <vers num="3.8.12"/>
        <vers num="3.8.13"/>
        <vers num="3.8.2"/>
        <vers num="3.8.3"/>
        <vers num="3.8.4"/>
        <vers num="3.8.5"/>
        <vers num="3.8.6"/>
        <vers num="3.8.7"/>
        <vers num="3.8.8"/>
        <vers num="3.8.9"/>
        <vers num="3.9" edition="rc1"/>
        <vers num="3.9" edition="rc2"/>
        <vers num="3.9" edition="rc3"/>
        <vers num="3.9" edition="rc4"/>
        <vers num="3.9" edition="rc5"/>
        <vers num="3.9" edition="rc6"/>
        <vers num="3.9" edition="rc7"/>
        <vers num="3.9.0"/>
        <vers num="3.9.1"/>
        <vers num="3.9.10"/>
        <vers num="3.9.11"/>
        <vers num="3.9.2"/>
        <vers num="3.9.3"/>
        <vers num="3.9.4"/>
        <vers num="3.9.5"/>
        <vers num="3.9.6"/>
        <vers num="3.9.7"/>
        <vers num="3.9.8"/>
        <vers num="3.9.9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1691" published="2014-04-01" name="CVE-2014-1691" modified="2014-04-02" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">The framework/Util/lib/Horde/Variables.php script in the Util library in Horde before 5.1.1 allows remote attackers to conduct object injection attacks and execute arbitrary PHP code via a crafted serialized object in the _formvars form.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://github.com/horde/horde/commit/da6afc7e9f4e290f782eca9dbca794f772caccb3" source="CONFIRM" patch="1">https://github.com/horde/horde/commit/da6afc7e9f4e290f782eca9dbca794f772caccb3</ref>
      <ref url="http://seclists.org/oss-sec/2014/q1/156" source="MLIST" patch="1">[oss-security] 20140128  Re: Remote code execution in horde &lt; 5.1.1</ref>
      <ref url="http://seclists.org/oss-sec/2014/q1/153" source="MLIST" patch="1">[oss-security] 20140128  Remote code execution in horde &lt; 5.1.1</ref>
      <ref url="https://github.com/horde/horde/blob/82c400788537cfc0106b68447789ff53793ac086/bundles/groupware/docs/CHANGES#L215" source="CONFIRM">https://github.com/horde/horde/blob/82c400788537cfc0106b68447789ff53793ac086/bundles/groupware/docs/CHANGES#L215</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2853" source="DEBIAN">DSA-2853</ref>
      <ref url="http://seclists.org/oss-sec/2014/q1/169" source="MLIST">[oss-security] 20140129  Re: Remote code execution in horde &lt; 5.1.1</ref>
    </refs>
    <vuln_soft>
      <prod vendor="horde" name="horde_application_framework">
        <vers num="5.0.0"/>
        <vers num="5.0.1"/>
        <vers num="5.0.2"/>
        <vers num="5.0.3"/>
        <vers num="5.0.4"/>
        <vers prev="1" num="5.1.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1692" published="2014-01-29" name="CVE-2014-1692" modified="2014-02-06" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">The hash_buffer function in schnorr.c in OpenSSH through 6.4, when Makefile.inc is modified to enable the J-PAKE protocol, does not initialize certain data structures, which might allow remote attackers to cause a denial of service (memory corruption) or have unspecified other impact via vectors that trigger an error condition.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90819" source="XF">openssh-cve20141692-code-exec(90819)</ref>
      <ref url="http://www.securityfocus.com/bid/65230" source="BID">65230</ref>
      <ref url="http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/schnorr.c#rev1.10" source="MISC">http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/schnorr.c#rev1.10</ref>
      <ref url="http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/Attic/schnorr.c.diff?r1=1.9;r2=1.10;f=h" source="MISC">http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/Attic/schnorr.c.diff?r1=1.9;r2=1.10;f=h</ref>
      <ref url="http://osvdb.org/102611" source="OSVDB">102611</ref>
      <ref url="http://openwall.com/lists/oss-security/2014/01/29/2" source="MLIST">[oss-security] 20140128 OpenSSH J-PAKE vulnerability (no cause for panic! remain calm!)</ref>
      <ref url="http://openwall.com/lists/oss-security/2014/01/29/10" source="MLIST">[oss-security] 20140129 Re: OpenSSH J-PAKE vulnerability (no cause for panic! remain calm!)</ref>
    </refs>
    <vuln_soft>
      <prod vendor="openbsd" name="openssh">
        <vers num="1.2"/>
        <vers num="1.2.1"/>
        <vers num="1.2.2"/>
        <vers num="1.2.27"/>
        <vers num="1.2.3"/>
        <vers num="1.3"/>
        <vers num="1.5"/>
        <vers num="1.5.7"/>
        <vers num="1.5.8"/>
        <vers num="2"/>
        <vers num="2.1"/>
        <vers num="2.1.1"/>
        <vers num="2.2"/>
        <vers num="2.3"/>
        <vers num="2.3.1"/>
        <vers num="2.5"/>
        <vers num="2.5.1"/>
        <vers num="2.5.2"/>
        <vers num="2.9"/>
        <vers num="2.9.9"/>
        <vers num="2.9.9p2"/>
        <vers num="2.9p1"/>
        <vers num="2.9p2"/>
        <vers num="3.0"/>
        <vers num="3.0.1"/>
        <vers num="3.0.1p1"/>
        <vers num="3.0.2"/>
        <vers num="3.0.2p1"/>
        <vers num="3.0p1"/>
        <vers num="3.1"/>
        <vers num="3.1p1"/>
        <vers num="3.2"/>
        <vers num="3.2.2"/>
        <vers num="3.2.2p1"/>
        <vers num="3.2.3p1"/>
        <vers num="3.3"/>
        <vers num="3.3p1"/>
        <vers num="3.4"/>
        <vers num="3.4p1"/>
        <vers num="3.5"/>
        <vers num="3.5p1"/>
        <vers num="3.6"/>
        <vers num="3.6.1"/>
        <vers num="3.6.1p1"/>
        <vers num="3.6.1p2"/>
        <vers num="3.7"/>
        <vers num="3.7.1"/>
        <vers num="3.7.1p1"/>
        <vers num="3.7.1p2"/>
        <vers num="3.8"/>
        <vers num="3.8.1"/>
        <vers num="3.8.1p1"/>
        <vers num="3.9"/>
        <vers num="3.9.1"/>
        <vers num="3.9.1p1"/>
        <vers num="4.0"/>
        <vers num="4.0p1"/>
        <vers num="4.1"/>
        <vers num="4.1p1"/>
        <vers num="4.2"/>
        <vers num="4.2p1"/>
        <vers num="4.3"/>
        <vers num="4.3p1"/>
        <vers num="4.3p2"/>
        <vers num="4.4"/>
        <vers num="4.4p1"/>
        <vers num="4.5"/>
        <vers num="4.6"/>
        <vers num="4.7"/>
        <vers num="4.8"/>
        <vers num="4.9"/>
        <vers num="5.0"/>
        <vers num="5.1"/>
        <vers num="5.2"/>
        <vers num="5.3"/>
        <vers num="5.4"/>
        <vers num="5.5"/>
        <vers num="5.6"/>
        <vers num="5.7"/>
        <vers num="5.8"/>
        <vers num="5.8p2"/>
        <vers num="5.9"/>
        <vers num="6.0"/>
        <vers num="6.1"/>
        <vers num="6.2"/>
        <vers num="6.3"/>
        <vers prev="1" num="6.4"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1694" published="2014-02-04" name="CVE-2014-1694" modified="2014-03-05" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:P)" CVSS_score="6.8" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.6" CVSS_base_score="6.8">
    <desc>
      <descript source="cve">Multiple cross-site request forgery (CSRF) vulnerabilities in (1) CustomerPreferences.pm, (2) CustomerTicketMessage.pm, (3) CustomerTicketProcess.pm, and (4) CustomerTicketZoom.pm in Kernel/Modules/ in Open Ticket Request System (OTRS) 3.1.x before 3.1.19, 3.2.x before 3.2.14, and 3.3.x before 3.3.4 allow remote attackers to hijack the authentication of arbitrary users for requests that (5) create tickets or (6) send follow-ups to existing tickets.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="https://www.otrs.com/security-advisory-2014-01-csrf-issue-customer-web-interface" source="CONFIRM" patch="1" adv="1">https://www.otrs.com/security-advisory-2014-01-csrf-issue-customer-web-interface</ref>
      <ref url="https://github.com/OTRS/otrs/commit/ca2c3390fd60d9a3f810ed2c22cbc2c193457b77" source="CONFIRM" patch="1">https://github.com/OTRS/otrs/commit/ca2c3390fd60d9a3f810ed2c22cbc2c193457b77</ref>
      <ref url="https://github.com/OTRS/otrs/commit/92f417277f43832f1a0462f2485fe1fd3fd52312" source="CONFIRM" patch="1">https://github.com/OTRS/otrs/commit/92f417277f43832f1a0462f2485fe1fd3fd52312</ref>
      <ref url="https://github.com/OTRS/otrs/commit/6f324aaf8647729d509eebf063a0181f9f9196f7" source="CONFIRM" patch="1">https://github.com/OTRS/otrs/commit/6f324aaf8647729d509eebf063a0181f9f9196f7</ref>
      <ref url="https://www.otrs.com/release-notes-otrs-help-desk-3-3-4" source="CONFIRM">https://www.otrs.com/release-notes-otrs-help-desk-3-3-4</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/01/29/7" source="MLIST">[oss-security] 20140129 CVE Request: otrs: CSRF issue in customer web interface</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/01/29/15" source="MLIST">[oss-security] 20140129 Re: CVE Request: otrs: CSRF issue in customer web interface</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2867" source="DEBIAN">DSA-2867</ref>
      <ref url="http://secunia.com/advisories/56655" source="SECUNIA" adv="1">56655</ref>
      <ref url="http://secunia.com/advisories/56644" source="SECUNIA" adv="1">56644</ref>
      <ref url="http://osvdb.org/102632" source="OSVDB">102632</ref>
      <ref url="http://bugs.otrs.org/show_bug.cgi?id=10099" source="CONFIRM">http://bugs.otrs.org/show_bug.cgi?id=10099</ref>
    </refs>
    <vuln_soft>
      <prod vendor="otrs" name="otrs">
        <vers num="3.1.0"/>
        <vers num="3.1.1"/>
        <vers num="3.1.10"/>
        <vers num="3.1.11"/>
        <vers num="3.1.13"/>
        <vers num="3.1.14"/>
        <vers num="3.1.15"/>
        <vers num="3.1.16"/>
        <vers num="3.1.17"/>
        <vers num="3.1.18"/>
        <vers num="3.1.2"/>
        <vers num="3.1.3"/>
        <vers num="3.1.4"/>
        <vers num="3.1.5"/>
        <vers num="3.1.6"/>
        <vers num="3.1.7"/>
        <vers num="3.1.8"/>
        <vers num="3.1.9"/>
        <vers num="3.2.0" edition="beta1"/>
        <vers num="3.2.0" edition="beta2"/>
        <vers num="3.2.0" edition="beta3"/>
        <vers num="3.2.0" edition="beta4"/>
        <vers num="3.2.0" edition="beta5"/>
        <vers num="3.2.0" edition="rc1"/>
        <vers num="3.2.1"/>
        <vers num="3.2.10"/>
        <vers num="3.2.2"/>
        <vers num="3.2.3"/>
        <vers num="3.2.4"/>
        <vers num="3.2.5"/>
        <vers num="3.2.6"/>
        <vers num="3.2.7"/>
        <vers num="3.2.8"/>
        <vers num="3.2.9"/>
        <vers num="3.3.0" edition="beta1"/>
        <vers num="3.3.0" edition="beta2"/>
        <vers num="3.3.0" edition="beta3"/>
        <vers num="3.3.0" edition="beta4"/>
        <vers num="3.3.0" edition="beta5"/>
        <vers num="3.3.0" edition="rc1"/>
        <vers num="3.3.1"/>
        <vers num="3.3.2"/>
        <vers num="3.3.3"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1695" published="2014-02-28" name="CVE-2014-1695" modified="2014-03-28" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) 3.1.x before 3.1.20, 3.2.x before 3.2.15, and 3.3.x before 3.3.5 allows remote attackers to inject arbitrary web script or HTML via a crafted HTML email.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="https://www.otrs.com/security-advisory-2014-03-xss-issue" source="CONFIRM" adv="1">https://www.otrs.com/security-advisory-2014-03-xss-issue</ref>
      <ref url="http://www.securityfocus.com/bid/65844" source="BID">65844</ref>
      <ref url="http://secunia.com/advisories/57018" source="SECUNIA" adv="1">57018</ref>
      <ref url="http://lists.opensuse.org/opensuse-updates/2014-03/msg00030.html" source="SUSE">openSUSE-SU-2014:0360</ref>
    </refs>
    <vuln_soft>
      <prod vendor="otrs" name="otrs">
        <vers num="3.1.0"/>
        <vers num="3.1.1"/>
        <vers num="3.1.10"/>
        <vers num="3.1.11"/>
        <vers num="3.1.13"/>
        <vers num="3.1.14"/>
        <vers num="3.1.15"/>
        <vers num="3.1.16"/>
        <vers num="3.1.17"/>
        <vers num="3.1.18"/>
        <vers num="3.1.19"/>
        <vers num="3.1.2"/>
        <vers num="3.1.3"/>
        <vers num="3.1.4"/>
        <vers num="3.1.5"/>
        <vers num="3.1.6"/>
        <vers num="3.1.7"/>
        <vers num="3.1.8"/>
        <vers num="3.1.9"/>
        <vers num="3.2.0" edition="beta1"/>
        <vers num="3.2.0" edition="beta2"/>
        <vers num="3.2.0" edition="beta3"/>
        <vers num="3.2.0" edition="beta4"/>
        <vers num="3.2.0" edition="beta5"/>
        <vers num="3.2.0" edition="rc1"/>
        <vers num="3.2.1"/>
        <vers num="3.2.10"/>
        <vers num="3.2.14"/>
        <vers num="3.2.2"/>
        <vers num="3.2.3"/>
        <vers num="3.2.4"/>
        <vers num="3.2.5"/>
        <vers num="3.2.6"/>
        <vers num="3.2.7"/>
        <vers num="3.2.8"/>
        <vers num="3.2.9"/>
        <vers num="3.3.0" edition="beta1"/>
        <vers num="3.3.0" edition="beta2"/>
        <vers num="3.3.0" edition="beta3"/>
        <vers num="3.3.0" edition="beta4"/>
        <vers num="3.3.0" edition="beta5"/>
        <vers num="3.3.0" edition="rc1"/>
        <vers num="3.3.1"/>
        <vers num="3.3.2"/>
        <vers num="3.3.3"/>
        <vers num="3.3.4"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1696" published="2014-02-06" name="CVE-2014-1696" modified="2014-02-21" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:N/A:N)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">Siemens SIMATIC WinCC OA before 3.12 P002 January uses a weak hash algorithm for passwords, which makes it easier for remote attackers to obtain access via a brute-force attack.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://ics-cert.us-cert.gov/advisories/ICSA-14-035-01" source="MISC">http://ics-cert.us-cert.gov/advisories/ICSA-14-035-01</ref>
      <ref url="http://xforce.iss.net/xforce/xfdb/90934" source="XF">simatic-wincc-cve20141696-priv-esc(90934)</ref>
      <ref url="http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-342587.pdf" source="CONFIRM" adv="1">http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-342587.pdf</ref>
      <ref url="http://osvdb.org/102809" source="OSVDB">102809</ref>
    </refs>
    <vuln_soft>
      <prod vendor="siemens" name="simatic_wincc_open_architecture">
        <vers prev="1" num="3.12"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1697" published="2014-02-06" name="CVE-2014-1697" modified="2014-02-21" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">The integrated web server in Siemens SIMATIC WinCC OA before 3.12 P002 January allows remote attackers to execute arbitrary code via crafted packets to TCP port 4999.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://ics-cert.us-cert.gov/advisories/ICSA-14-035-01" source="MISC">http://ics-cert.us-cert.gov/advisories/ICSA-14-035-01</ref>
      <ref url="http://xforce.iss.net/xforce/xfdb/90933" source="XF">simatic-wincc-cve20141697-code-exec(90933)</ref>
      <ref url="http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-342587.pdf" source="CONFIRM" adv="1">http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-342587.pdf</ref>
      <ref url="http://www.securityfocus.com/bid/65351" source="BID">65351</ref>
      <ref url="http://secunia.com/advisories/56651" source="SECUNIA">56651</ref>
      <ref url="http://osvdb.org/102810" source="OSVDB">102810</ref>
    </refs>
    <vuln_soft>
      <prod vendor="siemens" name="simatic_wincc_open_architecture">
        <vers prev="1" num="3.12"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1698" published="2014-02-06" name="CVE-2014-1698" modified="2014-02-21" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:N/A:N)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">Directory traversal vulnerability in Siemens SIMATIC WinCC OA before 3.12 P002 January allows remote attackers to read arbitrary files via crafted packets to TCP port 4999.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://ics-cert.us-cert.gov/advisories/ICSA-14-035-01" source="MISC">http://ics-cert.us-cert.gov/advisories/ICSA-14-035-01</ref>
      <ref url="http://xforce.iss.net/xforce/xfdb/90935" source="XF">simatic-wincc-cve20141698-dir-trav(90935)</ref>
      <ref url="http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-342587.pdf" source="CONFIRM" adv="1">http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-342587.pdf</ref>
      <ref url="http://www.securityfocus.com/bid/65349" source="BID">65349</ref>
      <ref url="http://secunia.com/advisories/56651" source="SECUNIA">56651</ref>
      <ref url="http://osvdb.org/102811" source="OSVDB">102811</ref>
    </refs>
    <vuln_soft>
      <prod vendor="siemens" name="simatic_wincc_open_architecture">
        <vers prev="1" num="3.12"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1699" published="2014-02-06" name="CVE-2014-1699" modified="2014-02-21" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:P)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">Siemens SIMATIC WinCC OA before 3.12 P002 January allows remote attackers to cause a denial of service (monitoring-service outage) via malformed HTTP requests to port 4999.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://ics-cert.us-cert.gov/advisories/ICSA-14-035-01" source="MISC">http://ics-cert.us-cert.gov/advisories/ICSA-14-035-01</ref>
      <ref url="http://xforce.iss.net/xforce/xfdb/90936" source="XF">simatic-wincc-cve20141699-dos(90936)</ref>
      <ref url="http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-342587.pdf" source="CONFIRM" adv="1">http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-342587.pdf</ref>
      <ref url="http://www.securityfocus.com/bid/65347" source="BID">65347</ref>
      <ref url="http://secunia.com/advisories/56651" source="SECUNIA">56651</ref>
      <ref url="http://osvdb.org/102812" source="OSVDB">102812</ref>
    </refs>
    <vuln_soft>
      <prod vendor="siemens" name="simatic_wincc_open_architecture">
        <vers prev="1" num="3.12"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1700" published="2014-03-16" name="CVE-2014-1700" modified="2014-04-01" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">Use-after-free vulnerability in modules/speech/SpeechSynthesis.cpp in Blink, as used in Google Chrome before 33.0.1750.149, allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging improper handling of a certain utterance data structure.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://src.chromium.org/viewvc/blink?revision=168171&amp;view=revision" source="CONFIRM">https://src.chromium.org/viewvc/blink?revision=168171&amp;view=revision</ref>
      <ref url="https://code.google.com/p/chromium/issues/detail?id=344881" source="CONFIRM">https://code.google.com/p/chromium/issues/detail?id=344881</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2883" source="DEBIAN">DSA-2883</ref>
      <ref url="http://googlechromereleases.blogspot.com/2014/03/stable-channel-update_11.html" source="CONFIRM" adv="1">http://googlechromereleases.blogspot.com/2014/03/stable-channel-update_11.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="google" name="chrome">
        <vers num="33.0.1750.0"/>
        <vers num="33.0.1750.1"/>
        <vers num="33.0.1750.10"/>
        <vers num="33.0.1750.104"/>
        <vers num="33.0.1750.106"/>
        <vers num="33.0.1750.107"/>
        <vers num="33.0.1750.108"/>
        <vers num="33.0.1750.109"/>
        <vers num="33.0.1750.11"/>
        <vers num="33.0.1750.110"/>
        <vers num="33.0.1750.111"/>
        <vers num="33.0.1750.112"/>
        <vers num="33.0.1750.113"/>
        <vers num="33.0.1750.115"/>
        <vers num="33.0.1750.116"/>
        <vers num="33.0.1750.117"/>
        <vers num="33.0.1750.12"/>
        <vers num="33.0.1750.124"/>
        <vers num="33.0.1750.125"/>
        <vers num="33.0.1750.126"/>
        <vers num="33.0.1750.13"/>
        <vers num="33.0.1750.132"/>
        <vers num="33.0.1750.133"/>
        <vers num="33.0.1750.135"/>
        <vers num="33.0.1750.136"/>
        <vers num="33.0.1750.14"/>
        <vers num="33.0.1750.144"/>
        <vers prev="1" num="33.0.1750.146"/>
        <vers num="33.0.1750.15"/>
        <vers num="33.0.1750.16"/>
        <vers num="33.0.1750.18"/>
        <vers num="33.0.1750.19"/>
        <vers num="33.0.1750.2"/>
        <vers num="33.0.1750.20"/>
        <vers num="33.0.1750.21"/>
        <vers num="33.0.1750.22"/>
        <vers num="33.0.1750.23"/>
        <vers num="33.0.1750.24"/>
        <vers num="33.0.1750.25"/>
        <vers num="33.0.1750.26"/>
        <vers num="33.0.1750.27"/>
        <vers num="33.0.1750.28"/>
        <vers num="33.0.1750.29"/>
        <vers num="33.0.1750.3"/>
        <vers num="33.0.1750.30"/>
        <vers num="33.0.1750.31"/>
        <vers num="33.0.1750.34"/>
        <vers num="33.0.1750.35"/>
        <vers num="33.0.1750.36"/>
        <vers num="33.0.1750.37"/>
        <vers num="33.0.1750.38"/>
        <vers num="33.0.1750.39"/>
        <vers num="33.0.1750.4"/>
        <vers num="33.0.1750.40"/>
        <vers num="33.0.1750.41"/>
        <vers num="33.0.1750.42"/>
        <vers num="33.0.1750.43"/>
        <vers num="33.0.1750.44"/>
        <vers num="33.0.1750.45"/>
        <vers num="33.0.1750.46"/>
        <vers num="33.0.1750.47"/>
        <vers num="33.0.1750.48"/>
        <vers num="33.0.1750.49"/>
        <vers num="33.0.1750.5"/>
        <vers num="33.0.1750.50"/>
        <vers num="33.0.1750.51"/>
        <vers num="33.0.1750.52"/>
        <vers num="33.0.1750.53"/>
        <vers num="33.0.1750.54"/>
        <vers num="33.0.1750.55"/>
        <vers num="33.0.1750.56"/>
        <vers num="33.0.1750.57"/>
        <vers num="33.0.1750.58"/>
        <vers num="33.0.1750.59"/>
        <vers num="33.0.1750.6"/>
        <vers num="33.0.1750.60"/>
        <vers num="33.0.1750.61"/>
        <vers num="33.0.1750.62"/>
        <vers num="33.0.1750.63"/>
        <vers num="33.0.1750.64"/>
        <vers num="33.0.1750.65"/>
        <vers num="33.0.1750.66"/>
        <vers num="33.0.1750.67"/>
        <vers num="33.0.1750.68"/>
        <vers num="33.0.1750.69"/>
        <vers num="33.0.1750.7"/>
        <vers num="33.0.1750.70"/>
        <vers num="33.0.1750.71"/>
        <vers num="33.0.1750.73"/>
        <vers num="33.0.1750.74"/>
        <vers num="33.0.1750.75"/>
        <vers num="33.0.1750.76"/>
        <vers num="33.0.1750.77"/>
        <vers num="33.0.1750.79"/>
        <vers num="33.0.1750.8"/>
        <vers num="33.0.1750.80"/>
        <vers num="33.0.1750.81"/>
        <vers num="33.0.1750.82"/>
        <vers num="33.0.1750.83"/>
        <vers num="33.0.1750.85"/>
        <vers num="33.0.1750.88"/>
        <vers num="33.0.1750.89"/>
        <vers num="33.0.1750.9"/>
        <vers num="33.0.1750.90"/>
        <vers num="33.0.1750.91"/>
        <vers num="33.0.1750.92"/>
        <vers num="33.0.1750.93"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1701" published="2014-03-16" name="CVE-2014-1701" modified="2014-04-01" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">The GenerateFunction function in bindings/scripts/code_generator_v8.pm in Blink, as used in Google Chrome before 33.0.1750.149, does not implement a certain cross-origin restriction for the EventTarget::dispatchEvent function, which allows remote attackers to conduct Universal XSS (UXSS) attacks via vectors involving events.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://src.chromium.org/viewvc/blink?revision=166999&amp;view=revision" source="CONFIRM">https://src.chromium.org/viewvc/blink?revision=166999&amp;view=revision</ref>
      <ref url="https://code.google.com/p/chromium/issues/detail?id=342618" source="CONFIRM">https://code.google.com/p/chromium/issues/detail?id=342618</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2883" source="DEBIAN">DSA-2883</ref>
      <ref url="http://googlechromereleases.blogspot.com/2014/03/stable-channel-update_11.html" source="CONFIRM" adv="1">http://googlechromereleases.blogspot.com/2014/03/stable-channel-update_11.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="google" name="chrome">
        <vers num="33.0.1750.0"/>
        <vers num="33.0.1750.1"/>
        <vers num="33.0.1750.10"/>
        <vers num="33.0.1750.104"/>
        <vers num="33.0.1750.106"/>
        <vers num="33.0.1750.107"/>
        <vers num="33.0.1750.108"/>
        <vers num="33.0.1750.109"/>
        <vers num="33.0.1750.11"/>
        <vers num="33.0.1750.110"/>
        <vers num="33.0.1750.111"/>
        <vers num="33.0.1750.112"/>
        <vers num="33.0.1750.113"/>
        <vers num="33.0.1750.115"/>
        <vers num="33.0.1750.116"/>
        <vers num="33.0.1750.117"/>
        <vers num="33.0.1750.12"/>
        <vers num="33.0.1750.124"/>
        <vers num="33.0.1750.125"/>
        <vers num="33.0.1750.126"/>
        <vers num="33.0.1750.13"/>
        <vers num="33.0.1750.132"/>
        <vers num="33.0.1750.133"/>
        <vers num="33.0.1750.135"/>
        <vers num="33.0.1750.136"/>
        <vers num="33.0.1750.14"/>
        <vers num="33.0.1750.144"/>
        <vers prev="1" num="33.0.1750.146"/>
        <vers num="33.0.1750.15"/>
        <vers num="33.0.1750.16"/>
        <vers num="33.0.1750.18"/>
        <vers num="33.0.1750.19"/>
        <vers num="33.0.1750.2"/>
        <vers num="33.0.1750.20"/>
        <vers num="33.0.1750.21"/>
        <vers num="33.0.1750.22"/>
        <vers num="33.0.1750.23"/>
        <vers num="33.0.1750.24"/>
        <vers num="33.0.1750.25"/>
        <vers num="33.0.1750.26"/>
        <vers num="33.0.1750.27"/>
        <vers num="33.0.1750.28"/>
        <vers num="33.0.1750.29"/>
        <vers num="33.0.1750.3"/>
        <vers num="33.0.1750.30"/>
        <vers num="33.0.1750.31"/>
        <vers num="33.0.1750.34"/>
        <vers num="33.0.1750.35"/>
        <vers num="33.0.1750.36"/>
        <vers num="33.0.1750.37"/>
        <vers num="33.0.1750.38"/>
        <vers num="33.0.1750.39"/>
        <vers num="33.0.1750.4"/>
        <vers num="33.0.1750.40"/>
        <vers num="33.0.1750.41"/>
        <vers num="33.0.1750.42"/>
        <vers num="33.0.1750.43"/>
        <vers num="33.0.1750.44"/>
        <vers num="33.0.1750.45"/>
        <vers num="33.0.1750.46"/>
        <vers num="33.0.1750.47"/>
        <vers num="33.0.1750.48"/>
        <vers num="33.0.1750.49"/>
        <vers num="33.0.1750.5"/>
        <vers num="33.0.1750.50"/>
        <vers num="33.0.1750.51"/>
        <vers num="33.0.1750.52"/>
        <vers num="33.0.1750.53"/>
        <vers num="33.0.1750.54"/>
        <vers num="33.0.1750.55"/>
        <vers num="33.0.1750.56"/>
        <vers num="33.0.1750.57"/>
        <vers num="33.0.1750.58"/>
        <vers num="33.0.1750.59"/>
        <vers num="33.0.1750.6"/>
        <vers num="33.0.1750.60"/>
        <vers num="33.0.1750.61"/>
        <vers num="33.0.1750.62"/>
        <vers num="33.0.1750.63"/>
        <vers num="33.0.1750.64"/>
        <vers num="33.0.1750.65"/>
        <vers num="33.0.1750.66"/>
        <vers num="33.0.1750.67"/>
        <vers num="33.0.1750.68"/>
        <vers num="33.0.1750.69"/>
        <vers num="33.0.1750.7"/>
        <vers num="33.0.1750.70"/>
        <vers num="33.0.1750.71"/>
        <vers num="33.0.1750.73"/>
        <vers num="33.0.1750.74"/>
        <vers num="33.0.1750.75"/>
        <vers num="33.0.1750.76"/>
        <vers num="33.0.1750.77"/>
        <vers num="33.0.1750.79"/>
        <vers num="33.0.1750.8"/>
        <vers num="33.0.1750.80"/>
        <vers num="33.0.1750.81"/>
        <vers num="33.0.1750.82"/>
        <vers num="33.0.1750.83"/>
        <vers num="33.0.1750.85"/>
        <vers num="33.0.1750.88"/>
        <vers num="33.0.1750.89"/>
        <vers num="33.0.1750.9"/>
        <vers num="33.0.1750.90"/>
        <vers num="33.0.1750.91"/>
        <vers num="33.0.1750.92"/>
        <vers num="33.0.1750.93"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1702" published="2014-03-16" name="CVE-2014-1702" modified="2014-04-01" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">Use-after-free vulnerability in the DatabaseThread::cleanupDatabaseThread function in modules/webdatabase/DatabaseThread.cpp in the web database implementation in Blink, as used in Google Chrome before 33.0.1750.149, allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging improper handling of scheduled tasks during shutdown of a thread.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://src.chromium.org/viewvc/blink?revision=168059&amp;view=revision" source="CONFIRM">https://src.chromium.org/viewvc/blink?revision=168059&amp;view=revision</ref>
      <ref url="https://code.google.com/p/chromium/issues/detail?id=333058" source="CONFIRM">https://code.google.com/p/chromium/issues/detail?id=333058</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2883" source="DEBIAN">DSA-2883</ref>
      <ref url="http://googlechromereleases.blogspot.com/2014/03/stable-channel-update_11.html" source="CONFIRM" adv="1">http://googlechromereleases.blogspot.com/2014/03/stable-channel-update_11.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="google" name="chrome">
        <vers num="33.0.1750.0"/>
        <vers num="33.0.1750.1"/>
        <vers num="33.0.1750.10"/>
        <vers num="33.0.1750.104"/>
        <vers num="33.0.1750.106"/>
        <vers num="33.0.1750.107"/>
        <vers num="33.0.1750.108"/>
        <vers num="33.0.1750.109"/>
        <vers num="33.0.1750.11"/>
        <vers num="33.0.1750.110"/>
        <vers num="33.0.1750.111"/>
        <vers num="33.0.1750.112"/>
        <vers num="33.0.1750.113"/>
        <vers num="33.0.1750.115"/>
        <vers num="33.0.1750.116"/>
        <vers num="33.0.1750.117"/>
        <vers num="33.0.1750.12"/>
        <vers num="33.0.1750.124"/>
        <vers num="33.0.1750.125"/>
        <vers num="33.0.1750.126"/>
        <vers num="33.0.1750.13"/>
        <vers num="33.0.1750.132"/>
        <vers num="33.0.1750.133"/>
        <vers num="33.0.1750.135"/>
        <vers num="33.0.1750.136"/>
        <vers num="33.0.1750.14"/>
        <vers num="33.0.1750.144"/>
        <vers prev="1" num="33.0.1750.146"/>
        <vers num="33.0.1750.15"/>
        <vers num="33.0.1750.16"/>
        <vers num="33.0.1750.18"/>
        <vers num="33.0.1750.19"/>
        <vers num="33.0.1750.2"/>
        <vers num="33.0.1750.20"/>
        <vers num="33.0.1750.21"/>
        <vers num="33.0.1750.22"/>
        <vers num="33.0.1750.23"/>
        <vers num="33.0.1750.24"/>
        <vers num="33.0.1750.25"/>
        <vers num="33.0.1750.26"/>
        <vers num="33.0.1750.27"/>
        <vers num="33.0.1750.28"/>
        <vers num="33.0.1750.29"/>
        <vers num="33.0.1750.3"/>
        <vers num="33.0.1750.30"/>
        <vers num="33.0.1750.31"/>
        <vers num="33.0.1750.34"/>
        <vers num="33.0.1750.35"/>
        <vers num="33.0.1750.36"/>
        <vers num="33.0.1750.37"/>
        <vers num="33.0.1750.38"/>
        <vers num="33.0.1750.39"/>
        <vers num="33.0.1750.4"/>
        <vers num="33.0.1750.40"/>
        <vers num="33.0.1750.41"/>
        <vers num="33.0.1750.42"/>
        <vers num="33.0.1750.43"/>
        <vers num="33.0.1750.44"/>
        <vers num="33.0.1750.45"/>
        <vers num="33.0.1750.46"/>
        <vers num="33.0.1750.47"/>
        <vers num="33.0.1750.48"/>
        <vers num="33.0.1750.49"/>
        <vers num="33.0.1750.5"/>
        <vers num="33.0.1750.50"/>
        <vers num="33.0.1750.51"/>
        <vers num="33.0.1750.52"/>
        <vers num="33.0.1750.53"/>
        <vers num="33.0.1750.54"/>
        <vers num="33.0.1750.55"/>
        <vers num="33.0.1750.56"/>
        <vers num="33.0.1750.57"/>
        <vers num="33.0.1750.58"/>
        <vers num="33.0.1750.59"/>
        <vers num="33.0.1750.6"/>
        <vers num="33.0.1750.60"/>
        <vers num="33.0.1750.61"/>
        <vers num="33.0.1750.62"/>
        <vers num="33.0.1750.63"/>
        <vers num="33.0.1750.64"/>
        <vers num="33.0.1750.65"/>
        <vers num="33.0.1750.66"/>
        <vers num="33.0.1750.67"/>
        <vers num="33.0.1750.68"/>
        <vers num="33.0.1750.69"/>
        <vers num="33.0.1750.7"/>
        <vers num="33.0.1750.70"/>
        <vers num="33.0.1750.71"/>
        <vers num="33.0.1750.73"/>
        <vers num="33.0.1750.74"/>
        <vers num="33.0.1750.75"/>
        <vers num="33.0.1750.76"/>
        <vers num="33.0.1750.77"/>
        <vers num="33.0.1750.79"/>
        <vers num="33.0.1750.8"/>
        <vers num="33.0.1750.80"/>
        <vers num="33.0.1750.81"/>
        <vers num="33.0.1750.82"/>
        <vers num="33.0.1750.83"/>
        <vers num="33.0.1750.85"/>
        <vers num="33.0.1750.88"/>
        <vers num="33.0.1750.89"/>
        <vers num="33.0.1750.9"/>
        <vers num="33.0.1750.90"/>
        <vers num="33.0.1750.91"/>
        <vers num="33.0.1750.92"/>
        <vers num="33.0.1750.93"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1703" published="2014-03-16" name="CVE-2014-1703" modified="2014-04-01" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">Use-after-free vulnerability in the WebSocketDispatcherHost::SendOrDrop function in content/browser/renderer_host/websocket_dispatcher_host.cc in the Web Sockets implementation in Google Chrome before 33.0.1750.149 might allow remote attackers to bypass the sandbox protection mechanism by leveraging an incorrect deletion in a certain failure case.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://src.chromium.org/viewvc/chrome?revision=247627&amp;view=revision" source="CONFIRM">https://src.chromium.org/viewvc/chrome?revision=247627&amp;view=revision</ref>
      <ref url="https://code.google.com/p/chromium/issues/detail?id=338354" source="CONFIRM">https://code.google.com/p/chromium/issues/detail?id=338354</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2883" source="DEBIAN">DSA-2883</ref>
      <ref url="http://googlechromereleases.blogspot.com/2014/03/stable-channel-update_11.html" source="CONFIRM" adv="1">http://googlechromereleases.blogspot.com/2014/03/stable-channel-update_11.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="google" name="chrome">
        <vers num="33.0.1750.0"/>
        <vers num="33.0.1750.1"/>
        <vers num="33.0.1750.10"/>
        <vers num="33.0.1750.104"/>
        <vers num="33.0.1750.106"/>
        <vers num="33.0.1750.107"/>
        <vers num="33.0.1750.108"/>
        <vers num="33.0.1750.109"/>
        <vers num="33.0.1750.11"/>
        <vers num="33.0.1750.110"/>
        <vers num="33.0.1750.111"/>
        <vers num="33.0.1750.112"/>
        <vers num="33.0.1750.113"/>
        <vers num="33.0.1750.115"/>
        <vers num="33.0.1750.116"/>
        <vers num="33.0.1750.117"/>
        <vers num="33.0.1750.12"/>
        <vers num="33.0.1750.124"/>
        <vers num="33.0.1750.125"/>
        <vers num="33.0.1750.126"/>
        <vers num="33.0.1750.13"/>
        <vers num="33.0.1750.132"/>
        <vers num="33.0.1750.133"/>
        <vers num="33.0.1750.135"/>
        <vers num="33.0.1750.136"/>
        <vers num="33.0.1750.14"/>
        <vers num="33.0.1750.144"/>
        <vers prev="1" num="33.0.1750.146"/>
        <vers num="33.0.1750.15"/>
        <vers num="33.0.1750.16"/>
        <vers num="33.0.1750.18"/>
        <vers num="33.0.1750.19"/>
        <vers num="33.0.1750.2"/>
        <vers num="33.0.1750.20"/>
        <vers num="33.0.1750.21"/>
        <vers num="33.0.1750.22"/>
        <vers num="33.0.1750.23"/>
        <vers num="33.0.1750.24"/>
        <vers num="33.0.1750.25"/>
        <vers num="33.0.1750.26"/>
        <vers num="33.0.1750.27"/>
        <vers num="33.0.1750.28"/>
        <vers num="33.0.1750.29"/>
        <vers num="33.0.1750.3"/>
        <vers num="33.0.1750.30"/>
        <vers num="33.0.1750.31"/>
        <vers num="33.0.1750.34"/>
        <vers num="33.0.1750.35"/>
        <vers num="33.0.1750.36"/>
        <vers num="33.0.1750.37"/>
        <vers num="33.0.1750.38"/>
        <vers num="33.0.1750.39"/>
        <vers num="33.0.1750.4"/>
        <vers num="33.0.1750.40"/>
        <vers num="33.0.1750.41"/>
        <vers num="33.0.1750.42"/>
        <vers num="33.0.1750.43"/>
        <vers num="33.0.1750.44"/>
        <vers num="33.0.1750.45"/>
        <vers num="33.0.1750.46"/>
        <vers num="33.0.1750.47"/>
        <vers num="33.0.1750.48"/>
        <vers num="33.0.1750.49"/>
        <vers num="33.0.1750.5"/>
        <vers num="33.0.1750.50"/>
        <vers num="33.0.1750.51"/>
        <vers num="33.0.1750.52"/>
        <vers num="33.0.1750.53"/>
        <vers num="33.0.1750.54"/>
        <vers num="33.0.1750.55"/>
        <vers num="33.0.1750.56"/>
        <vers num="33.0.1750.57"/>
        <vers num="33.0.1750.58"/>
        <vers num="33.0.1750.59"/>
        <vers num="33.0.1750.6"/>
        <vers num="33.0.1750.60"/>
        <vers num="33.0.1750.61"/>
        <vers num="33.0.1750.62"/>
        <vers num="33.0.1750.63"/>
        <vers num="33.0.1750.64"/>
        <vers num="33.0.1750.65"/>
        <vers num="33.0.1750.66"/>
        <vers num="33.0.1750.67"/>
        <vers num="33.0.1750.68"/>
        <vers num="33.0.1750.69"/>
        <vers num="33.0.1750.7"/>
        <vers num="33.0.1750.70"/>
        <vers num="33.0.1750.71"/>
        <vers num="33.0.1750.73"/>
        <vers num="33.0.1750.74"/>
        <vers num="33.0.1750.75"/>
        <vers num="33.0.1750.76"/>
        <vers num="33.0.1750.77"/>
        <vers num="33.0.1750.79"/>
        <vers num="33.0.1750.8"/>
        <vers num="33.0.1750.80"/>
        <vers num="33.0.1750.81"/>
        <vers num="33.0.1750.82"/>
        <vers num="33.0.1750.83"/>
        <vers num="33.0.1750.85"/>
        <vers num="33.0.1750.88"/>
        <vers num="33.0.1750.89"/>
        <vers num="33.0.1750.9"/>
        <vers num="33.0.1750.90"/>
        <vers num="33.0.1750.91"/>
        <vers num="33.0.1750.92"/>
        <vers num="33.0.1750.93"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1704" published="2014-03-16" name="CVE-2014-1704" modified="2014-04-01" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:C/I:C/A:C)" CVSS_score="10.0" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="10.0" CVSS_base_score="10.0">
    <desc>
      <descript source="cve">Multiple unspecified vulnerabilities in Google V8 before 3.23.17.18, as used in Google Chrome before 33.0.1750.149, allow attackers to cause a denial of service or possibly have other impact via unknown vectors.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://code.google.com/p/v8/source/detail?r=19668" source="CONFIRM">https://code.google.com/p/v8/source/detail?r=19668</ref>
      <ref url="https://code.google.com/p/v8/source/detail?r=19614" source="CONFIRM">https://code.google.com/p/v8/source/detail?r=19614</ref>
      <ref url="https://code.google.com/p/v8/source/detail?r=18564" source="CONFIRM">https://code.google.com/p/v8/source/detail?r=18564</ref>
      <ref url="https://code.google.com/p/chromium/issues/detail?id=349079" source="CONFIRM">https://code.google.com/p/chromium/issues/detail?id=349079</ref>
      <ref url="https://code.google.com/p/chromium/issues/detail?id=345715" source="CONFIRM">https://code.google.com/p/chromium/issues/detail?id=345715</ref>
      <ref url="https://code.google.com/p/chromium/issues/detail?id=328202" source="CONFIRM">https://code.google.com/p/chromium/issues/detail?id=328202</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2883" source="DEBIAN">DSA-2883</ref>
      <ref url="http://googlechromereleases.blogspot.com/2014/03/stable-channel-update_11.html" source="CONFIRM" adv="1">http://googlechromereleases.blogspot.com/2014/03/stable-channel-update_11.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="google" name="chrome">
        <vers num="33.0.1750.0"/>
        <vers num="33.0.1750.1"/>
        <vers num="33.0.1750.10"/>
        <vers num="33.0.1750.104"/>
        <vers num="33.0.1750.106"/>
        <vers num="33.0.1750.107"/>
        <vers num="33.0.1750.108"/>
        <vers num="33.0.1750.109"/>
        <vers num="33.0.1750.11"/>
        <vers num="33.0.1750.110"/>
        <vers num="33.0.1750.111"/>
        <vers num="33.0.1750.112"/>
        <vers num="33.0.1750.113"/>
        <vers num="33.0.1750.115"/>
        <vers num="33.0.1750.116"/>
        <vers num="33.0.1750.117"/>
        <vers num="33.0.1750.12"/>
        <vers num="33.0.1750.124"/>
        <vers num="33.0.1750.125"/>
        <vers num="33.0.1750.126"/>
        <vers num="33.0.1750.13"/>
        <vers num="33.0.1750.132"/>
        <vers num="33.0.1750.133"/>
        <vers num="33.0.1750.135"/>
        <vers num="33.0.1750.136"/>
        <vers num="33.0.1750.14"/>
        <vers num="33.0.1750.144"/>
        <vers prev="1" num="33.0.1750.146"/>
        <vers num="33.0.1750.15"/>
        <vers num="33.0.1750.16"/>
        <vers num="33.0.1750.18"/>
        <vers num="33.0.1750.19"/>
        <vers num="33.0.1750.2"/>
        <vers num="33.0.1750.20"/>
        <vers num="33.0.1750.21"/>
        <vers num="33.0.1750.22"/>
        <vers num="33.0.1750.23"/>
        <vers num="33.0.1750.24"/>
        <vers num="33.0.1750.25"/>
        <vers num="33.0.1750.26"/>
        <vers num="33.0.1750.27"/>
        <vers num="33.0.1750.28"/>
        <vers num="33.0.1750.29"/>
        <vers num="33.0.1750.3"/>
        <vers num="33.0.1750.30"/>
        <vers num="33.0.1750.31"/>
        <vers num="33.0.1750.34"/>
        <vers num="33.0.1750.35"/>
        <vers num="33.0.1750.36"/>
        <vers num="33.0.1750.37"/>
        <vers num="33.0.1750.38"/>
        <vers num="33.0.1750.39"/>
        <vers num="33.0.1750.4"/>
        <vers num="33.0.1750.40"/>
        <vers num="33.0.1750.41"/>
        <vers num="33.0.1750.42"/>
        <vers num="33.0.1750.43"/>
        <vers num="33.0.1750.44"/>
        <vers num="33.0.1750.45"/>
        <vers num="33.0.1750.46"/>
        <vers num="33.0.1750.47"/>
        <vers num="33.0.1750.48"/>
        <vers num="33.0.1750.49"/>
        <vers num="33.0.1750.5"/>
        <vers num="33.0.1750.50"/>
        <vers num="33.0.1750.51"/>
        <vers num="33.0.1750.52"/>
        <vers num="33.0.1750.53"/>
        <vers num="33.0.1750.54"/>
        <vers num="33.0.1750.55"/>
        <vers num="33.0.1750.56"/>
        <vers num="33.0.1750.57"/>
        <vers num="33.0.1750.58"/>
        <vers num="33.0.1750.59"/>
        <vers num="33.0.1750.6"/>
        <vers num="33.0.1750.60"/>
        <vers num="33.0.1750.61"/>
        <vers num="33.0.1750.62"/>
        <vers num="33.0.1750.63"/>
        <vers num="33.0.1750.64"/>
        <vers num="33.0.1750.65"/>
        <vers num="33.0.1750.66"/>
        <vers num="33.0.1750.67"/>
        <vers num="33.0.1750.68"/>
        <vers num="33.0.1750.69"/>
        <vers num="33.0.1750.7"/>
        <vers num="33.0.1750.70"/>
        <vers num="33.0.1750.71"/>
        <vers num="33.0.1750.73"/>
        <vers num="33.0.1750.74"/>
        <vers num="33.0.1750.75"/>
        <vers num="33.0.1750.76"/>
        <vers num="33.0.1750.77"/>
        <vers num="33.0.1750.79"/>
        <vers num="33.0.1750.8"/>
        <vers num="33.0.1750.80"/>
        <vers num="33.0.1750.81"/>
        <vers num="33.0.1750.82"/>
        <vers num="33.0.1750.83"/>
        <vers num="33.0.1750.85"/>
        <vers num="33.0.1750.88"/>
        <vers num="33.0.1750.89"/>
        <vers num="33.0.1750.9"/>
        <vers num="33.0.1750.90"/>
        <vers num="33.0.1750.91"/>
        <vers num="33.0.1750.92"/>
        <vers num="33.0.1750.93"/>
      </prod>
      <prod vendor="google" name="v8">
        <vers num="3.23.0"/>
        <vers num="3.23.1"/>
        <vers num="3.23.10"/>
        <vers num="3.23.11"/>
        <vers num="3.23.12"/>
        <vers num="3.23.13"/>
        <vers num="3.23.14"/>
        <vers num="3.23.15"/>
        <vers num="3.23.16"/>
        <vers prev="1" num="3.23.17"/>
        <vers num="3.23.2"/>
        <vers num="3.23.3"/>
        <vers num="3.23.4"/>
        <vers num="3.23.5"/>
        <vers num="3.23.6"/>
        <vers num="3.23.7"/>
        <vers num="3.23.8"/>
        <vers num="3.23.9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1705" published="2014-03-16" name="CVE-2014-1705" modified="2014-04-01" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">Google V8, as used in Google Chrome before 33.0.1750.152 on OS X and Linux and before 33.0.1750.154 on Windows, allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://code.google.com/p/chromium/issues/detail?id=351787" source="CONFIRM">https://code.google.com/p/chromium/issues/detail?id=351787</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2883" source="DEBIAN">DSA-2883</ref>
      <ref url="http://googlechromereleases.blogspot.com/2014/03/stable-channel-update_14.html" source="CONFIRM" adv="1">http://googlechromereleases.blogspot.com/2014/03/stable-channel-update_14.html</ref>
      <ref url="http://googlechromereleases.blogspot.com/2014/03/stable-channel-update-for-chrome-os_14.html" source="CONFIRM" adv="1">http://googlechromereleases.blogspot.com/2014/03/stable-channel-update-for-chrome-os_14.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="google" name="chrome">
        <vers num="33.0.1750.0"/>
        <vers num="33.0.1750.1"/>
        <vers num="33.0.1750.10"/>
        <vers num="33.0.1750.104"/>
        <vers num="33.0.1750.106"/>
        <vers num="33.0.1750.107"/>
        <vers num="33.0.1750.108"/>
        <vers num="33.0.1750.109"/>
        <vers num="33.0.1750.11"/>
        <vers num="33.0.1750.110"/>
        <vers num="33.0.1750.111"/>
        <vers num="33.0.1750.112"/>
        <vers num="33.0.1750.113"/>
        <vers num="33.0.1750.115"/>
        <vers num="33.0.1750.116"/>
        <vers num="33.0.1750.117"/>
        <vers num="33.0.1750.12"/>
        <vers num="33.0.1750.124"/>
        <vers num="33.0.1750.125"/>
        <vers num="33.0.1750.126"/>
        <vers num="33.0.1750.13"/>
        <vers num="33.0.1750.132"/>
        <vers num="33.0.1750.133"/>
        <vers num="33.0.1750.135"/>
        <vers num="33.0.1750.136"/>
        <vers num="33.0.1750.14"/>
        <vers num="33.0.1750.144"/>
        <vers num="33.0.1750.146"/>
        <vers num="33.0.1750.149"/>
        <vers num="33.0.1750.15"/>
        <vers prev="1" num="33.0.1750.151"/>
        <vers num="33.0.1750.152"/>
        <vers prev="1" num="33.0.1750.153"/>
        <vers num="33.0.1750.16"/>
        <vers num="33.0.1750.18"/>
        <vers num="33.0.1750.19"/>
        <vers num="33.0.1750.2"/>
        <vers num="33.0.1750.20"/>
        <vers num="33.0.1750.21"/>
        <vers num="33.0.1750.22"/>
        <vers num="33.0.1750.23"/>
        <vers num="33.0.1750.24"/>
        <vers num="33.0.1750.25"/>
        <vers num="33.0.1750.26"/>
        <vers num="33.0.1750.27"/>
        <vers num="33.0.1750.28"/>
        <vers num="33.0.1750.29"/>
        <vers num="33.0.1750.3"/>
        <vers num="33.0.1750.30"/>
        <vers num="33.0.1750.31"/>
        <vers num="33.0.1750.34"/>
        <vers num="33.0.1750.35"/>
        <vers num="33.0.1750.36"/>
        <vers num="33.0.1750.37"/>
        <vers num="33.0.1750.38"/>
        <vers num="33.0.1750.39"/>
        <vers num="33.0.1750.4"/>
        <vers num="33.0.1750.40"/>
        <vers num="33.0.1750.41"/>
        <vers num="33.0.1750.42"/>
        <vers num="33.0.1750.43"/>
        <vers num="33.0.1750.44"/>
        <vers num="33.0.1750.45"/>
        <vers num="33.0.1750.46"/>
        <vers num="33.0.1750.47"/>
        <vers num="33.0.1750.48"/>
        <vers num="33.0.1750.49"/>
        <vers num="33.0.1750.5"/>
        <vers num="33.0.1750.50"/>
        <vers num="33.0.1750.51"/>
        <vers num="33.0.1750.52"/>
        <vers num="33.0.1750.53"/>
        <vers num="33.0.1750.54"/>
        <vers num="33.0.1750.55"/>
        <vers num="33.0.1750.56"/>
        <vers num="33.0.1750.57"/>
        <vers num="33.0.1750.58"/>
        <vers num="33.0.1750.59"/>
        <vers num="33.0.1750.6"/>
        <vers num="33.0.1750.60"/>
        <vers num="33.0.1750.61"/>
        <vers num="33.0.1750.62"/>
        <vers num="33.0.1750.63"/>
        <vers num="33.0.1750.64"/>
        <vers num="33.0.1750.65"/>
        <vers num="33.0.1750.66"/>
        <vers num="33.0.1750.67"/>
        <vers num="33.0.1750.68"/>
        <vers num="33.0.1750.69"/>
        <vers num="33.0.1750.7"/>
        <vers num="33.0.1750.70"/>
        <vers num="33.0.1750.71"/>
        <vers num="33.0.1750.73"/>
        <vers num="33.0.1750.74"/>
        <vers num="33.0.1750.75"/>
        <vers num="33.0.1750.76"/>
        <vers num="33.0.1750.77"/>
        <vers num="33.0.1750.79"/>
        <vers num="33.0.1750.8"/>
        <vers num="33.0.1750.80"/>
        <vers num="33.0.1750.81"/>
        <vers num="33.0.1750.82"/>
        <vers num="33.0.1750.83"/>
        <vers num="33.0.1750.85"/>
        <vers num="33.0.1750.88"/>
        <vers num="33.0.1750.89"/>
        <vers num="33.0.1750.9"/>
        <vers num="33.0.1750.90"/>
        <vers num="33.0.1750.91"/>
        <vers num="33.0.1750.92"/>
        <vers num="33.0.1750.93"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1706" published="2014-03-16" name="CVE-2014-1706" modified="2014-03-25" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">crosh in Google Chrome OS before 33.0.1750.152 allows attackers to inject commands via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://code.google.com/p/chromium/issues/detail?id=351796" source="CONFIRM">https://code.google.com/p/chromium/issues/detail?id=351796</ref>
      <ref url="http://googlechromereleases.blogspot.com/2014/03/stable-channel-update-for-chrome-os_14.html" source="CONFIRM" adv="1">http://googlechromereleases.blogspot.com/2014/03/stable-channel-update-for-chrome-os_14.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="google" name="chrome_os">
        <vers num="33.0.1750.112"/>
        <vers num="33.0.1750.124"/>
        <vers prev="1" num="33.0.1750.149"/>
        <vers num="33.0.1750.16"/>
        <vers num="33.0.1750.2"/>
        <vers num="33.0.1750.29"/>
        <vers num="33.0.1750.5"/>
        <vers num="33.0.1750.51"/>
        <vers num="33.0.1750.58"/>
        <vers num="33.0.1750.70"/>
        <vers num="33.0.1750.93"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1707" published="2014-03-16" name="CVE-2014-1707" modified="2014-03-25" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">Directory traversal vulnerability in CrosDisks in Google Chrome OS before 33.0.1750.152 has unspecified impact and attack vectors.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://code.google.com/p/chromium/issues/detail?id=351811" source="CONFIRM">https://code.google.com/p/chromium/issues/detail?id=351811</ref>
      <ref url="http://googlechromereleases.blogspot.com/2014/03/stable-channel-update-for-chrome-os_14.html" source="CONFIRM" adv="1">http://googlechromereleases.blogspot.com/2014/03/stable-channel-update-for-chrome-os_14.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="google" name="chrome_os">
        <vers num="33.0.1750.112"/>
        <vers num="33.0.1750.124"/>
        <vers prev="1" num="33.0.1750.149"/>
        <vers num="33.0.1750.16"/>
        <vers num="33.0.1750.2"/>
        <vers num="33.0.1750.29"/>
        <vers num="33.0.1750.5"/>
        <vers num="33.0.1750.51"/>
        <vers num="33.0.1750.58"/>
        <vers num="33.0.1750.70"/>
        <vers num="33.0.1750.93"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1708" published="2014-03-16" name="CVE-2014-1708" modified="2014-03-25" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:C/I:C/A:C)" CVSS_score="10.0" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="10.0" CVSS_base_score="10.0">
    <desc>
      <descript source="cve">The boot implementation in Google Chrome OS before 33.0.1750.152 does not properly consider file persistence, which allows remote attackers to execute arbitrary code via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://code.google.com/p/chromium/issues/detail?id=344051" source="CONFIRM">https://code.google.com/p/chromium/issues/detail?id=344051</ref>
      <ref url="http://googlechromereleases.blogspot.com/2014/03/stable-channel-update-for-chrome-os_14.html" source="CONFIRM" adv="1">http://googlechromereleases.blogspot.com/2014/03/stable-channel-update-for-chrome-os_14.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="google" name="chrome_os">
        <vers num="33.0.1750.112"/>
        <vers num="33.0.1750.124"/>
        <vers prev="1" num="33.0.1750.149"/>
        <vers num="33.0.1750.16"/>
        <vers num="33.0.1750.2"/>
        <vers num="33.0.1750.29"/>
        <vers num="33.0.1750.5"/>
        <vers num="33.0.1750.51"/>
        <vers num="33.0.1750.58"/>
        <vers num="33.0.1750.70"/>
        <vers num="33.0.1750.93"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1710" published="2014-03-16" name="CVE-2014-1710" modified="2014-03-25" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">The AsyncPixelTransfersCompletedQuery::End function in gpu/command_buffer/service/query_manager.cc in Google Chrome, as used in Google Chrome OS before 33.0.1750.152, does not check whether a certain position is within the bounds of a shared-memory segment, which allows remote attackers to cause a denial of service (GPU command-buffer memory corruption) or possibly have unspecified other impact via unknown vectors.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://src.chromium.org/viewvc/chrome?revision=256918&amp;view=revision" source="CONFIRM">https://src.chromium.org/viewvc/chrome?revision=256918&amp;view=revision</ref>
      <ref url="https://src.chromium.org/viewvc/chrome?revision=256723&amp;view=revision" source="CONFIRM">https://src.chromium.org/viewvc/chrome?revision=256723&amp;view=revision</ref>
      <ref url="https://code.google.com/p/chromium/issues/detail?id=351852" source="CONFIRM">https://code.google.com/p/chromium/issues/detail?id=351852</ref>
      <ref url="http://googlechromereleases.blogspot.com/2014/03/stable-channel-update-for-chrome-os_14.html" source="CONFIRM" adv="1">http://googlechromereleases.blogspot.com/2014/03/stable-channel-update-for-chrome-os_14.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="google" name="chrome_os">
        <vers num="33.0.1750.112"/>
        <vers num="33.0.1750.124"/>
        <vers prev="1" num="33.0.1750.149"/>
        <vers num="33.0.1750.16"/>
        <vers num="33.0.1750.2"/>
        <vers num="33.0.1750.29"/>
        <vers num="33.0.1750.5"/>
        <vers num="33.0.1750.51"/>
        <vers num="33.0.1750.58"/>
        <vers num="33.0.1750.70"/>
        <vers num="33.0.1750.93"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1711" published="2014-03-16" name="CVE-2014-1711" modified="2014-03-25" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">The GPU driver in the kernel in Google Chrome OS before 33.0.1750.152 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via unknown vectors.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://code.google.com/p/chromium/issues/detail?id=351855" source="CONFIRM">https://code.google.com/p/chromium/issues/detail?id=351855</ref>
      <ref url="http://googlechromereleases.blogspot.com/2014/03/stable-channel-update-for-chrome-os_14.html" source="CONFIRM" adv="1">http://googlechromereleases.blogspot.com/2014/03/stable-channel-update-for-chrome-os_14.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="google" name="chrome_os">
        <vers num="33.0.1750.112"/>
        <vers num="33.0.1750.124"/>
        <vers prev="1" num="33.0.1750.149"/>
        <vers num="33.0.1750.16"/>
        <vers num="33.0.1750.2"/>
        <vers num="33.0.1750.29"/>
        <vers num="33.0.1750.5"/>
        <vers num="33.0.1750.51"/>
        <vers num="33.0.1750.58"/>
        <vers num="33.0.1750.70"/>
        <vers num="33.0.1750.93"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1713" published="2014-03-16" name="CVE-2014-1713" modified="2014-04-24" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">Use-after-free vulnerability in the AttributeSetter function in bindings/templates/attributes.cpp in the bindings in Blink, as used in Google Chrome before 33.0.1750.152 on OS X and Linux and before 33.0.1750.154 on Windows, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving the document.location value.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://src.chromium.org/viewvc/blink?revision=169176&amp;view=revision" source="CONFIRM">https://src.chromium.org/viewvc/blink?revision=169176&amp;view=revision</ref>
      <ref url="https://code.google.com/p/chromium/issues/detail?id=352374" source="CONFIRM">https://code.google.com/p/chromium/issues/detail?id=352374</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2883" source="DEBIAN">DSA-2883</ref>
      <ref url="http://googlechromereleases.blogspot.com/2014/03/stable-channel-update_14.html" source="CONFIRM" adv="1">http://googlechromereleases.blogspot.com/2014/03/stable-channel-update_14.html</ref>
      <ref url="http://googlechromereleases.blogspot.com/2014/03/stable-channel-update-for-chrome-os_14.html" source="CONFIRM" adv="1">http://googlechromereleases.blogspot.com/2014/03/stable-channel-update-for-chrome-os_14.html</ref>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-04/0136.html" source="APPLE">APPLE-SA-2014-04-22-2</ref>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-04/0135.html" source="APPLE">APPLE-SA-2014-04-22-3</ref>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-04/0009.html" source="APPLE">APPLE-SA-2014-04-01-1</ref>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-03/0144.html" source="BUGTRAQ">20140326 VUPEN Security Research - Google Chrome Blink "locationAttributeSetter" Use-after-free (Pwn2Own)</ref>
    </refs>
    <vuln_soft>
      <prod vendor="google" name="chrome">
        <vers num="33.0.1750.0"/>
        <vers num="33.0.1750.1"/>
        <vers num="33.0.1750.10"/>
        <vers num="33.0.1750.104"/>
        <vers num="33.0.1750.106"/>
        <vers num="33.0.1750.107"/>
        <vers num="33.0.1750.108"/>
        <vers num="33.0.1750.109"/>
        <vers num="33.0.1750.11"/>
        <vers num="33.0.1750.110"/>
        <vers num="33.0.1750.111"/>
        <vers num="33.0.1750.112"/>
        <vers num="33.0.1750.113"/>
        <vers num="33.0.1750.115"/>
        <vers num="33.0.1750.116"/>
        <vers num="33.0.1750.117"/>
        <vers num="33.0.1750.12"/>
        <vers num="33.0.1750.124"/>
        <vers num="33.0.1750.125"/>
        <vers num="33.0.1750.126"/>
        <vers num="33.0.1750.13"/>
        <vers num="33.0.1750.132"/>
        <vers num="33.0.1750.133"/>
        <vers num="33.0.1750.135"/>
        <vers num="33.0.1750.136"/>
        <vers num="33.0.1750.14"/>
        <vers num="33.0.1750.144"/>
        <vers num="33.0.1750.146"/>
        <vers num="33.0.1750.149"/>
        <vers num="33.0.1750.15"/>
        <vers prev="1" num="33.0.1750.151"/>
        <vers num="33.0.1750.152"/>
        <vers prev="1" num="33.0.1750.153"/>
        <vers num="33.0.1750.16"/>
        <vers num="33.0.1750.18"/>
        <vers num="33.0.1750.19"/>
        <vers num="33.0.1750.2"/>
        <vers num="33.0.1750.20"/>
        <vers num="33.0.1750.21"/>
        <vers num="33.0.1750.22"/>
        <vers num="33.0.1750.23"/>
        <vers num="33.0.1750.24"/>
        <vers num="33.0.1750.25"/>
        <vers num="33.0.1750.26"/>
        <vers num="33.0.1750.27"/>
        <vers num="33.0.1750.28"/>
        <vers num="33.0.1750.29"/>
        <vers num="33.0.1750.3"/>
        <vers num="33.0.1750.30"/>
        <vers num="33.0.1750.31"/>
        <vers num="33.0.1750.34"/>
        <vers num="33.0.1750.35"/>
        <vers num="33.0.1750.36"/>
        <vers num="33.0.1750.37"/>
        <vers num="33.0.1750.38"/>
        <vers num="33.0.1750.39"/>
        <vers num="33.0.1750.4"/>
        <vers num="33.0.1750.40"/>
        <vers num="33.0.1750.41"/>
        <vers num="33.0.1750.42"/>
        <vers num="33.0.1750.43"/>
        <vers num="33.0.1750.44"/>
        <vers num="33.0.1750.45"/>
        <vers num="33.0.1750.46"/>
        <vers num="33.0.1750.47"/>
        <vers num="33.0.1750.48"/>
        <vers num="33.0.1750.49"/>
        <vers num="33.0.1750.5"/>
        <vers num="33.0.1750.50"/>
        <vers num="33.0.1750.51"/>
        <vers num="33.0.1750.52"/>
        <vers num="33.0.1750.53"/>
        <vers num="33.0.1750.54"/>
        <vers num="33.0.1750.55"/>
        <vers num="33.0.1750.56"/>
        <vers num="33.0.1750.57"/>
        <vers num="33.0.1750.58"/>
        <vers num="33.0.1750.59"/>
        <vers num="33.0.1750.6"/>
        <vers num="33.0.1750.60"/>
        <vers num="33.0.1750.61"/>
        <vers num="33.0.1750.62"/>
        <vers num="33.0.1750.63"/>
        <vers num="33.0.1750.64"/>
        <vers num="33.0.1750.65"/>
        <vers num="33.0.1750.66"/>
        <vers num="33.0.1750.67"/>
        <vers num="33.0.1750.68"/>
        <vers num="33.0.1750.69"/>
        <vers num="33.0.1750.7"/>
        <vers num="33.0.1750.70"/>
        <vers num="33.0.1750.71"/>
        <vers num="33.0.1750.73"/>
        <vers num="33.0.1750.74"/>
        <vers num="33.0.1750.75"/>
        <vers num="33.0.1750.76"/>
        <vers num="33.0.1750.77"/>
        <vers num="33.0.1750.79"/>
        <vers num="33.0.1750.8"/>
        <vers num="33.0.1750.80"/>
        <vers num="33.0.1750.81"/>
        <vers num="33.0.1750.82"/>
        <vers num="33.0.1750.83"/>
        <vers num="33.0.1750.85"/>
        <vers num="33.0.1750.88"/>
        <vers num="33.0.1750.89"/>
        <vers num="33.0.1750.9"/>
        <vers num="33.0.1750.90"/>
        <vers num="33.0.1750.91"/>
        <vers num="33.0.1750.92"/>
        <vers num="33.0.1750.93"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1714" published="2014-03-16" name="CVE-2014-1714" modified="2014-04-01" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">The ScopedClipboardWriter::WritePickledData function in ui/base/clipboard/scoped_clipboard_writer.cc in Google Chrome before 33.0.1750.152 on OS X and Linux and before 33.0.1750.154 on Windows does not verify a certain format value, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the clipboard.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://src.chromium.org/viewvc/chrome?revision=256974&amp;view=revision" source="CONFIRM" adv="1">https://src.chromium.org/viewvc/chrome?revision=256974&amp;view=revision</ref>
      <ref url="https://code.google.com/p/chromium/issues/detail?id=352395" source="CONFIRM">https://code.google.com/p/chromium/issues/detail?id=352395</ref>
      <ref url="http://googlechromereleases.blogspot.com/2014/03/stable-channel-update_14.html" source="CONFIRM" adv="1">http://googlechromereleases.blogspot.com/2014/03/stable-channel-update_14.html</ref>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-03/0143.html" source="BUGTRAQ">20140326 VUPEN Security Research - Google Chrome "Clipboard::WriteData()" Function Sandbox Escape (Pwn2Own)</ref>
    </refs>
    <vuln_soft>
      <prod vendor="google" name="chrome">
        <vers num="33.0.1750.0"/>
        <vers num="33.0.1750.1"/>
        <vers num="33.0.1750.10"/>
        <vers num="33.0.1750.104"/>
        <vers num="33.0.1750.106"/>
        <vers num="33.0.1750.107"/>
        <vers num="33.0.1750.108"/>
        <vers num="33.0.1750.109"/>
        <vers num="33.0.1750.11"/>
        <vers num="33.0.1750.110"/>
        <vers num="33.0.1750.111"/>
        <vers num="33.0.1750.112"/>
        <vers num="33.0.1750.113"/>
        <vers num="33.0.1750.115"/>
        <vers num="33.0.1750.116"/>
        <vers num="33.0.1750.117"/>
        <vers num="33.0.1750.12"/>
        <vers num="33.0.1750.124"/>
        <vers num="33.0.1750.125"/>
        <vers num="33.0.1750.126"/>
        <vers num="33.0.1750.13"/>
        <vers num="33.0.1750.132"/>
        <vers num="33.0.1750.133"/>
        <vers num="33.0.1750.135"/>
        <vers num="33.0.1750.136"/>
        <vers num="33.0.1750.14"/>
        <vers num="33.0.1750.144"/>
        <vers num="33.0.1750.146"/>
        <vers num="33.0.1750.149"/>
        <vers num="33.0.1750.15"/>
        <vers prev="1" num="33.0.1750.151"/>
        <vers num="33.0.1750.152"/>
        <vers prev="1" num="33.0.1750.153"/>
        <vers num="33.0.1750.16"/>
        <vers num="33.0.1750.18"/>
        <vers num="33.0.1750.19"/>
        <vers num="33.0.1750.2"/>
        <vers num="33.0.1750.20"/>
        <vers num="33.0.1750.21"/>
        <vers num="33.0.1750.22"/>
        <vers num="33.0.1750.23"/>
        <vers num="33.0.1750.24"/>
        <vers num="33.0.1750.25"/>
        <vers num="33.0.1750.26"/>
        <vers num="33.0.1750.27"/>
        <vers num="33.0.1750.28"/>
        <vers num="33.0.1750.29"/>
        <vers num="33.0.1750.3"/>
        <vers num="33.0.1750.30"/>
        <vers num="33.0.1750.31"/>
        <vers num="33.0.1750.34"/>
        <vers num="33.0.1750.35"/>
        <vers num="33.0.1750.36"/>
        <vers num="33.0.1750.37"/>
        <vers num="33.0.1750.38"/>
        <vers num="33.0.1750.39"/>
        <vers num="33.0.1750.4"/>
        <vers num="33.0.1750.40"/>
        <vers num="33.0.1750.41"/>
        <vers num="33.0.1750.42"/>
        <vers num="33.0.1750.43"/>
        <vers num="33.0.1750.44"/>
        <vers num="33.0.1750.45"/>
        <vers num="33.0.1750.46"/>
        <vers num="33.0.1750.47"/>
        <vers num="33.0.1750.48"/>
        <vers num="33.0.1750.49"/>
        <vers num="33.0.1750.5"/>
        <vers num="33.0.1750.50"/>
        <vers num="33.0.1750.51"/>
        <vers num="33.0.1750.52"/>
        <vers num="33.0.1750.53"/>
        <vers num="33.0.1750.54"/>
        <vers num="33.0.1750.55"/>
        <vers num="33.0.1750.56"/>
        <vers num="33.0.1750.57"/>
        <vers num="33.0.1750.58"/>
        <vers num="33.0.1750.59"/>
        <vers num="33.0.1750.6"/>
        <vers num="33.0.1750.60"/>
        <vers num="33.0.1750.61"/>
        <vers num="33.0.1750.62"/>
        <vers num="33.0.1750.63"/>
        <vers num="33.0.1750.64"/>
        <vers num="33.0.1750.65"/>
        <vers num="33.0.1750.66"/>
        <vers num="33.0.1750.67"/>
        <vers num="33.0.1750.68"/>
        <vers num="33.0.1750.69"/>
        <vers num="33.0.1750.7"/>
        <vers num="33.0.1750.70"/>
        <vers num="33.0.1750.71"/>
        <vers num="33.0.1750.73"/>
        <vers num="33.0.1750.74"/>
        <vers num="33.0.1750.75"/>
        <vers num="33.0.1750.76"/>
        <vers num="33.0.1750.77"/>
        <vers num="33.0.1750.79"/>
        <vers num="33.0.1750.8"/>
        <vers num="33.0.1750.80"/>
        <vers num="33.0.1750.81"/>
        <vers num="33.0.1750.82"/>
        <vers num="33.0.1750.83"/>
        <vers num="33.0.1750.85"/>
        <vers num="33.0.1750.88"/>
        <vers num="33.0.1750.89"/>
        <vers num="33.0.1750.9"/>
        <vers num="33.0.1750.90"/>
        <vers num="33.0.1750.91"/>
        <vers num="33.0.1750.92"/>
        <vers num="33.0.1750.93"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1715" published="2014-03-16" name="CVE-2014-1715" modified="2014-04-01" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">Directory traversal vulnerability in Google Chrome before 33.0.1750.152 on OS X and Linux and before 33.0.1750.154 on Windows has unspecified impact and attack vectors.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://code.google.com/p/chromium/issues/detail?id=352429" source="CONFIRM">https://code.google.com/p/chromium/issues/detail?id=352429</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2883" source="DEBIAN">DSA-2883</ref>
      <ref url="http://googlechromereleases.blogspot.com/2014/03/stable-channel-update_14.html" source="CONFIRM" adv="1">http://googlechromereleases.blogspot.com/2014/03/stable-channel-update_14.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="google" name="chrome">
        <vers num="33.0.1750.0"/>
        <vers num="33.0.1750.1"/>
        <vers num="33.0.1750.10"/>
        <vers num="33.0.1750.104"/>
        <vers num="33.0.1750.106"/>
        <vers num="33.0.1750.107"/>
        <vers num="33.0.1750.108"/>
        <vers num="33.0.1750.109"/>
        <vers num="33.0.1750.11"/>
        <vers num="33.0.1750.110"/>
        <vers num="33.0.1750.111"/>
        <vers num="33.0.1750.112"/>
        <vers num="33.0.1750.113"/>
        <vers num="33.0.1750.115"/>
        <vers num="33.0.1750.116"/>
        <vers num="33.0.1750.117"/>
        <vers num="33.0.1750.12"/>
        <vers num="33.0.1750.124"/>
        <vers num="33.0.1750.125"/>
        <vers num="33.0.1750.126"/>
        <vers num="33.0.1750.13"/>
        <vers num="33.0.1750.132"/>
        <vers num="33.0.1750.133"/>
        <vers num="33.0.1750.135"/>
        <vers num="33.0.1750.136"/>
        <vers num="33.0.1750.14"/>
        <vers num="33.0.1750.144"/>
        <vers num="33.0.1750.146"/>
        <vers num="33.0.1750.149"/>
        <vers num="33.0.1750.15"/>
        <vers prev="1" num="33.0.1750.151"/>
        <vers num="33.0.1750.152"/>
        <vers prev="1" num="33.0.1750.153"/>
        <vers num="33.0.1750.16"/>
        <vers num="33.0.1750.18"/>
        <vers num="33.0.1750.19"/>
        <vers num="33.0.1750.2"/>
        <vers num="33.0.1750.20"/>
        <vers num="33.0.1750.21"/>
        <vers num="33.0.1750.22"/>
        <vers num="33.0.1750.23"/>
        <vers num="33.0.1750.24"/>
        <vers num="33.0.1750.25"/>
        <vers num="33.0.1750.26"/>
        <vers num="33.0.1750.27"/>
        <vers num="33.0.1750.28"/>
        <vers num="33.0.1750.29"/>
        <vers num="33.0.1750.3"/>
        <vers num="33.0.1750.30"/>
        <vers num="33.0.1750.31"/>
        <vers num="33.0.1750.34"/>
        <vers num="33.0.1750.35"/>
        <vers num="33.0.1750.36"/>
        <vers num="33.0.1750.37"/>
        <vers num="33.0.1750.38"/>
        <vers num="33.0.1750.39"/>
        <vers num="33.0.1750.4"/>
        <vers num="33.0.1750.40"/>
        <vers num="33.0.1750.41"/>
        <vers num="33.0.1750.42"/>
        <vers num="33.0.1750.43"/>
        <vers num="33.0.1750.44"/>
        <vers num="33.0.1750.45"/>
        <vers num="33.0.1750.46"/>
        <vers num="33.0.1750.47"/>
        <vers num="33.0.1750.48"/>
        <vers num="33.0.1750.49"/>
        <vers num="33.0.1750.5"/>
        <vers num="33.0.1750.50"/>
        <vers num="33.0.1750.51"/>
        <vers num="33.0.1750.52"/>
        <vers num="33.0.1750.53"/>
        <vers num="33.0.1750.54"/>
        <vers num="33.0.1750.55"/>
        <vers num="33.0.1750.56"/>
        <vers num="33.0.1750.57"/>
        <vers num="33.0.1750.58"/>
        <vers num="33.0.1750.59"/>
        <vers num="33.0.1750.6"/>
        <vers num="33.0.1750.60"/>
        <vers num="33.0.1750.61"/>
        <vers num="33.0.1750.62"/>
        <vers num="33.0.1750.63"/>
        <vers num="33.0.1750.64"/>
        <vers num="33.0.1750.65"/>
        <vers num="33.0.1750.66"/>
        <vers num="33.0.1750.67"/>
        <vers num="33.0.1750.68"/>
        <vers num="33.0.1750.69"/>
        <vers num="33.0.1750.7"/>
        <vers num="33.0.1750.70"/>
        <vers num="33.0.1750.71"/>
        <vers num="33.0.1750.73"/>
        <vers num="33.0.1750.74"/>
        <vers num="33.0.1750.75"/>
        <vers num="33.0.1750.76"/>
        <vers num="33.0.1750.77"/>
        <vers num="33.0.1750.79"/>
        <vers num="33.0.1750.8"/>
        <vers num="33.0.1750.80"/>
        <vers num="33.0.1750.81"/>
        <vers num="33.0.1750.82"/>
        <vers num="33.0.1750.83"/>
        <vers num="33.0.1750.85"/>
        <vers num="33.0.1750.88"/>
        <vers num="33.0.1750.89"/>
        <vers num="33.0.1750.9"/>
        <vers num="33.0.1750.90"/>
        <vers num="33.0.1750.91"/>
        <vers num="33.0.1750.92"/>
        <vers num="33.0.1750.93"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1716" published="2014-04-09" name="CVE-2014-1716" modified="2014-04-09" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in the Runtime_SetPrototype function in runtime.cc in Google V8, as used in Google Chrome before 34.0.1847.116, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Universal XSS (UXSS)."</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://code.google.com/p/v8/source/detail?r=20138" source="CONFIRM">https://code.google.com/p/v8/source/detail?r=20138</ref>
      <ref url="https://code.google.com/p/chromium/issues/detail?id=354123" source="CONFIRM">https://code.google.com/p/chromium/issues/detail?id=354123</ref>
      <ref url="http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html" source="CONFIRM" adv="1">http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="google" name="chrome">
        <vers prev="1" num="34.0.1847.115"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1717" published="2014-04-09" name="CVE-2014-1717" modified="2014-04-09" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">Google V8, as used in Google Chrome before 34.0.1847.116, does not properly use numeric casts during handling of typed arrays, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted JavaScript code.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://code.google.com/p/v8/source/detail?r=20020" source="CONFIRM">https://code.google.com/p/v8/source/detail?r=20020</ref>
      <ref url="https://code.google.com/p/chromium/issues/detail?id=353004" source="CONFIRM">https://code.google.com/p/chromium/issues/detail?id=353004</ref>
      <ref url="http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html" source="CONFIRM" adv="1">http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="google" name="chrome">
        <vers prev="1" num="34.0.1847.115"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1718" published="2014-04-09" name="CVE-2014-1718" modified="2014-04-09" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">Integer overflow in the SoftwareFrameManager::SwapToNewFrame function in content/browser/renderer_host/software_frame_manager.cc in the software compositor in Google Chrome before 34.0.1847.116 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger an attempted mapping of a large amount of renderer memory.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://src.chromium.org/viewvc/chrome?revision=261817&amp;view=revision" source="CONFIRM">https://src.chromium.org/viewvc/chrome?revision=261817&amp;view=revision</ref>
      <ref url="https://src.chromium.org/viewvc/chrome?revision=260969&amp;view=revision" source="CONFIRM">https://src.chromium.org/viewvc/chrome?revision=260969&amp;view=revision</ref>
      <ref url="https://src.chromium.org/viewvc/chrome?revision=258418&amp;view=revision" source="CONFIRM">https://src.chromium.org/viewvc/chrome?revision=258418&amp;view=revision</ref>
      <ref url="https://src.chromium.org/viewvc/chrome?revision=257417&amp;view=revision" source="CONFIRM">https://src.chromium.org/viewvc/chrome?revision=257417&amp;view=revision</ref>
      <ref url="https://code.google.com/p/chromium/issues/detail?id=348332" source="CONFIRM">https://code.google.com/p/chromium/issues/detail?id=348332</ref>
      <ref url="http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html" source="CONFIRM" adv="1">http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="google" name="chrome">
        <vers prev="1" num="34.0.1847.115"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1719" published="2014-04-09" name="CVE-2014-1719" modified="2014-04-09" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">Use-after-free vulnerability in the WebSharedWorkerStub::OnTerminateWorkerContext function in content/worker/websharedworker_stub.cc in the Web Workers implementation in Google Chrome before 34.0.1847.116 allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via vectors that trigger a SharedWorker termination during script loading.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://src.chromium.org/viewvc/chrome?revision=252010&amp;view=revision" source="CONFIRM">https://src.chromium.org/viewvc/chrome?revision=252010&amp;view=revision</ref>
      <ref url="https://code.google.com/p/chromium/issues/detail?id=343661" source="CONFIRM">https://code.google.com/p/chromium/issues/detail?id=343661</ref>
      <ref url="http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html" source="CONFIRM" adv="1">http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="google" name="chrome">
        <vers prev="1" num="34.0.1847.115"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1720" published="2014-04-09" name="CVE-2014-1720" modified="2014-04-09" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">Use-after-free vulnerability in the HTMLBodyElement::insertedInto function in core/html/HTMLBodyElement.cpp in Blink, as used in Google Chrome before 34.0.1847.116, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving attributes.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://src.chromium.org/viewvc/blink?revision=170216&amp;view=revision" source="CONFIRM">https://src.chromium.org/viewvc/blink?revision=170216&amp;view=revision</ref>
      <ref url="https://code.google.com/p/chromium/issues/detail?id=356095" source="CONFIRM">https://code.google.com/p/chromium/issues/detail?id=356095</ref>
      <ref url="http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html" source="CONFIRM" adv="1">http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="google" name="chrome">
        <vers prev="1" num="34.0.1847.115"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1721" published="2014-04-09" name="CVE-2014-1721" modified="2014-04-09" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">Google V8, as used in Google Chrome before 34.0.1847.116, does not properly implement lazy deoptimization, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via crafted JavaScript code, as demonstrated by improper handling of a heap allocation of a number outside the Small Integer (aka smi) range.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://code.google.com/p/v8/source/detail?r=19834" source="CONFIRM">https://code.google.com/p/v8/source/detail?r=19834</ref>
      <ref url="https://code.google.com/p/chromium/issues/detail?id=350434" source="CONFIRM">https://code.google.com/p/chromium/issues/detail?id=350434</ref>
      <ref url="http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html" source="CONFIRM" adv="1">http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="google" name="chrome">
        <vers prev="1" num="34.0.1847.115"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1722" published="2014-04-09" name="CVE-2014-1722" modified="2014-04-09" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">Use-after-free vulnerability in the RenderBlock::addChildIgnoringAnonymousColumnBlocks function in core/rendering/RenderBlock.cpp in Blink, as used in Google Chrome before 34.0.1847.116, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving addition of a child node.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://src.chromium.org/viewvc/blink?revision=164405&amp;view=revision" source="CONFIRM">https://src.chromium.org/viewvc/blink?revision=164405&amp;view=revision</ref>
      <ref url="https://code.google.com/p/chromium/issues/detail?id=330626" source="CONFIRM">https://code.google.com/p/chromium/issues/detail?id=330626</ref>
      <ref url="http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html" source="CONFIRM" adv="1">http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="google" name="chrome">
        <vers prev="1" num="34.0.1847.115"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1723" published="2014-04-09" name="CVE-2014-1723" modified="2014-04-09" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">The UnescapeURLWithOffsetsImpl function in net/base/escape.cc in Google Chrome before 34.0.1847.116 does not properly handle bidirectional Internationalized Resource Identifiers (IRIs), which makes it easier for remote attackers to spoof URLs via crafted use of right-to-left (RTL) Unicode text.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://src.chromium.org/viewvc/chrome?revision=254091&amp;view=revision" source="CONFIRM">https://src.chromium.org/viewvc/chrome?revision=254091&amp;view=revision</ref>
      <ref url="https://code.google.com/p/chromium/issues/detail?id=337746" source="CONFIRM">https://code.google.com/p/chromium/issues/detail?id=337746</ref>
      <ref url="http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html" source="CONFIRM" adv="1">http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="google" name="chrome">
        <vers prev="1" num="34.0.1847.115"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1724" published="2014-04-09" name="CVE-2014-1724" modified="2014-04-09" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">Use-after-free vulnerability in Free(b)soft Laboratory Speech Dispatcher 0.7.1, as used in Google Chrome before 34.0.1847.116, allows remote attackers to cause a denial of service (application hang) or possibly have unspecified other impact via a text-to-speech request.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://src.chromium.org/viewvc/chrome?revision=259109&amp;view=revision" source="CONFIRM">https://src.chromium.org/viewvc/chrome?revision=259109&amp;view=revision</ref>
      <ref url="https://code.google.com/p/chromium/issues/detail?id=327295" source="CONFIRM">https://code.google.com/p/chromium/issues/detail?id=327295</ref>
      <ref url="http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html" source="CONFIRM" adv="1">http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="google" name="chrome">
        <vers prev="1" num="34.0.1847.115"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1725" published="2014-04-09" name="CVE-2014-1725" modified="2014-04-09" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:P)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">The base64DecodeInternal function in wtf/text/Base64.cpp in Blink, as used in Google Chrome before 34.0.1847.116, does not properly handle string data composed exclusively of whitespace characters, which allows remote attackers to cause a denial of service (out-of-bounds read) via a window.atob method call.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://src.chromium.org/viewvc/blink?revision=170264&amp;view=revision" source="CONFIRM">https://src.chromium.org/viewvc/blink?revision=170264&amp;view=revision</ref>
      <ref url="https://code.google.com/p/chromium/issues/detail?id=357332" source="CONFIRM">https://code.google.com/p/chromium/issues/detail?id=357332</ref>
      <ref url="http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html" source="CONFIRM" adv="1">http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="google" name="chrome">
        <vers prev="1" num="34.0.1847.115"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1726" published="2014-04-09" name="CVE-2014-1726" modified="2014-04-09" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">The drag implementation in Google Chrome before 34.0.1847.116 allows user-assisted remote attackers to bypass the Same Origin Policy and forge local pathnames by leveraging renderer access.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="https://src.chromium.org/viewvc/chrome?revision=259353&amp;view=revision" source="CONFIRM">https://src.chromium.org/viewvc/chrome?revision=259353&amp;view=revision</ref>
      <ref url="https://code.google.com/p/chromium/issues/detail?id=346135" source="CONFIRM">https://code.google.com/p/chromium/issues/detail?id=346135</ref>
      <ref url="http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html" source="CONFIRM" adv="1">http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="google" name="chrome">
        <vers prev="1" num="34.0.1847.115"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1727" published="2014-04-09" name="CVE-2014-1727" modified="2014-04-09" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">Use-after-free vulnerability in content/renderer/renderer_webcolorchooser_impl.h in Google Chrome before 34.0.1847.116 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to forms.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html" source="CONFIRM" patch="1" adv="1">http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html</ref>
      <ref url="https://src.chromium.org/viewvc/chrome?revision=255276&amp;view=revision" source="CONFIRM">https://src.chromium.org/viewvc/chrome?revision=255276&amp;view=revision</ref>
      <ref url="https://code.google.com/p/chromium/issues/detail?id=342735" source="CONFIRM">https://code.google.com/p/chromium/issues/detail?id=342735</ref>
    </refs>
    <vuln_soft>
      <prod vendor="google" name="chrome">
        <vers prev="1" num="34.0.1847.115"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1728" published="2014-04-09" name="CVE-2014-1728" modified="2014-04-09" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">Multiple unspecified vulnerabilities in Google Chrome before 34.0.1847.116 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://code.google.com/p/chromium/issues/detail?id=360298" source="CONFIRM">https://code.google.com/p/chromium/issues/detail?id=360298</ref>
      <ref url="https://code.google.com/p/chromium/issues/detail?id=358059" source="CONFIRM">https://code.google.com/p/chromium/issues/detail?id=358059</ref>
      <ref url="https://code.google.com/p/chromium/issues/detail?id=356517" source="CONFIRM">https://code.google.com/p/chromium/issues/detail?id=356517</ref>
      <ref url="https://code.google.com/p/chromium/issues/detail?id=356235" source="CONFIRM">https://code.google.com/p/chromium/issues/detail?id=356235</ref>
      <ref url="https://code.google.com/p/chromium/issues/detail?id=355586" source="CONFIRM">https://code.google.com/p/chromium/issues/detail?id=355586</ref>
      <ref url="https://code.google.com/p/chromium/issues/detail?id=354297" source="CONFIRM">https://code.google.com/p/chromium/issues/detail?id=354297</ref>
      <ref url="https://code.google.com/p/chromium/issues/detail?id=353013" source="CONFIRM">https://code.google.com/p/chromium/issues/detail?id=353013</ref>
      <ref url="https://code.google.com/p/chromium/issues/detail?id=352982" source="CONFIRM">https://code.google.com/p/chromium/issues/detail?id=352982</ref>
      <ref url="https://code.google.com/p/chromium/issues/detail?id=351815" source="CONFIRM">https://code.google.com/p/chromium/issues/detail?id=351815</ref>
      <ref url="https://code.google.com/p/chromium/issues/detail?id=350863" source="CONFIRM">https://code.google.com/p/chromium/issues/detail?id=350863</ref>
      <ref url="https://code.google.com/p/chromium/issues/detail?id=350537" source="CONFIRM">https://code.google.com/p/chromium/issues/detail?id=350537</ref>
      <ref url="https://code.google.com/p/chromium/issues/detail?id=350533" source="CONFIRM">https://code.google.com/p/chromium/issues/detail?id=350533</ref>
      <ref url="https://code.google.com/p/chromium/issues/detail?id=348319" source="CONFIRM">https://code.google.com/p/chromium/issues/detail?id=348319</ref>
      <ref url="https://code.google.com/p/chromium/issues/detail?id=347262" source="CONFIRM">https://code.google.com/p/chromium/issues/detail?id=347262</ref>
      <ref url="https://code.google.com/p/chromium/issues/detail?id=345820" source="CONFIRM">https://code.google.com/p/chromium/issues/detail?id=345820</ref>
      <ref url="http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html" source="CONFIRM" adv="1">http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="google" name="chrome">
        <vers prev="1" num="34.0.1847.115"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1729" published="2014-04-09" name="CVE-2014-1729" modified="2014-04-09" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">Multiple unspecified vulnerabilities in Google V8 before 3.24.35.22, as used in Google Chrome before 34.0.1847.116, allow attackers to cause a denial of service or possibly have other impact via unknown vectors.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://code.google.com/p/v8/source/detail?r=20409" source="CONFIRM">https://code.google.com/p/v8/source/detail?r=20409</ref>
      <ref url="https://code.google.com/p/v8/source/detail?r=20345" source="CONFIRM">https://code.google.com/p/v8/source/detail?r=20345</ref>
      <ref url="https://code.google.com/p/v8/source/detail?r=20033" source="CONFIRM">https://code.google.com/p/v8/source/detail?r=20033</ref>
      <ref url="https://code.google.com/p/v8/source/detail?r=19923" source="CONFIRM">https://code.google.com/p/v8/source/detail?r=19923</ref>
      <ref url="https://code.google.com/p/v8/source/detail?r=19584" source="CONFIRM">https://code.google.com/p/v8/source/detail?r=19584</ref>
      <ref url="https://code.google.com/p/v8/source/detail?r=19572" source="CONFIRM">https://code.google.com/p/v8/source/detail?r=19572</ref>
      <ref url="https://code.google.com/p/chromium/issues/detail?id=358059" source="CONFIRM">https://code.google.com/p/chromium/issues/detail?id=358059</ref>
      <ref url="https://code.google.com/p/chromium/issues/detail?id=355586" source="CONFIRM">https://code.google.com/p/chromium/issues/detail?id=355586</ref>
      <ref url="https://code.google.com/p/chromium/issues/detail?id=352982" source="CONFIRM">https://code.google.com/p/chromium/issues/detail?id=352982</ref>
      <ref url="https://code.google.com/p/chromium/issues/detail?id=350863" source="CONFIRM">https://code.google.com/p/chromium/issues/detail?id=350863</ref>
      <ref url="https://code.google.com/p/chromium/issues/detail?id=348319" source="CONFIRM">https://code.google.com/p/chromium/issues/detail?id=348319</ref>
      <ref url="https://code.google.com/p/chromium/issues/detail?id=347262" source="CONFIRM">https://code.google.com/p/chromium/issues/detail?id=347262</ref>
      <ref url="https://code.google.com/p/chromium/issues/detail?id=345820" source="CONFIRM">https://code.google.com/p/chromium/issues/detail?id=345820</ref>
      <ref url="http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html" source="CONFIRM" adv="1">http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="google" name="chrome">
        <vers prev="1" num="34.0.1847.115"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1730" published="2014-04-26" name="CVE-2014-1730" modified="2014-04-28" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:C/I:N/A:N)" CVSS_score="7.8" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="10.0" CVSS_base_score="7.8">
    <desc>
      <descript source="cve">Google V8, as used in Google Chrome before 34.0.1847.131 on Windows and OS X and before 34.0.1847.132 on Linux, does not properly store internationalization metadata, which allows remote attackers to bypass intended access restrictions by leveraging "type confusion" and reading property values, related to i18n.js and runtime.cc.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://code.google.com/p/v8/source/detail?r=20595" source="CONFIRM">https://code.google.com/p/v8/source/detail?r=20595</ref>
      <ref url="https://code.google.com/p/v8/source/detail?r=20593" source="CONFIRM">https://code.google.com/p/v8/source/detail?r=20593</ref>
      <ref url="https://code.google.com/p/v8/source/detail?r=20388" source="CONFIRM">https://code.google.com/p/v8/source/detail?r=20388</ref>
      <ref url="https://code.google.com/p/v8/source/detail?r=20377" source="CONFIRM">https://code.google.com/p/v8/source/detail?r=20377</ref>
      <ref url="https://code.google.com/p/v8/source/detail?r=20375" source="CONFIRM">https://code.google.com/p/v8/source/detail?r=20375</ref>
      <ref url="https://code.google.com/p/chromium/issues/detail?id=354967" source="CONFIRM">https://code.google.com/p/chromium/issues/detail?id=354967</ref>
      <ref url="http://googlechromereleases.blogspot.com/2014/04/stable-channel-update_24.html" source="CONFIRM" adv="1">http://googlechromereleases.blogspot.com/2014/04/stable-channel-update_24.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="google" name="chrome">
        <vers prev="1" num="34.0.1847.130"/>
        <vers prev="1" num="34.0.1847.131"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1731" published="2014-04-26" name="CVE-2014-1731" modified="2014-04-28" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">core/html/HTMLSelectElement.cpp in the DOM implementation in Blink, as used in Google Chrome before 34.0.1847.131 on Windows and OS X and before 34.0.1847.132 on Linux, does not properly check renderer state upon a focus event, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that leverage "type confusion" for SELECT elements.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://src.chromium.org/viewvc/blink?revision=171216&amp;view=revision" source="CONFIRM">https://src.chromium.org/viewvc/blink?revision=171216&amp;view=revision</ref>
      <ref url="https://code.google.com/p/chromium/issues/detail?id=349903" source="CONFIRM">https://code.google.com/p/chromium/issues/detail?id=349903</ref>
      <ref url="http://googlechromereleases.blogspot.com/2014/04/stable-channel-update_24.html" source="CONFIRM" adv="1">http://googlechromereleases.blogspot.com/2014/04/stable-channel-update_24.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="google" name="chrome">
        <vers prev="1" num="34.0.1847.130"/>
        <vers prev="1" num="34.0.1847.131"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1732" published="2014-04-26" name="CVE-2014-1732" modified="2014-04-28" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">Use-after-free vulnerability in browser/ui/views/speech_recognition_bubble_views.cc in Google Chrome before 34.0.1847.131 on Windows and OS X and before 34.0.1847.132 on Linux allows remote attackers to cause a denial of service or possibly have unspecified other impact via an INPUT element that triggers the presence of a Speech Recognition Bubble window for an incorrect duration.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://src.chromium.org/viewvc/chrome?revision=261737&amp;view=revision" source="CONFIRM">https://src.chromium.org/viewvc/chrome?revision=261737&amp;view=revision</ref>
      <ref url="https://code.google.com/p/chromium/issues/detail?id=352851" source="CONFIRM">https://code.google.com/p/chromium/issues/detail?id=352851</ref>
      <ref url="http://googlechromereleases.blogspot.com/2014/04/stable-channel-update_24.html" source="CONFIRM" adv="1">http://googlechromereleases.blogspot.com/2014/04/stable-channel-update_24.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="google" name="chrome">
        <vers prev="1" num="34.0.1847.130"/>
        <vers prev="1" num="34.0.1847.131"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1733" published="2014-04-26" name="CVE-2014-1733" modified="2014-04-28" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">The PointerCompare function in codegen.cc in Seccomp-BPF, as used in Google Chrome before 34.0.1847.131 on Windows and OS X and before 34.0.1847.132 on Linux, does not properly merge blocks, which might allow remote attackers to bypass intended sandbox restrictions by leveraging renderer access.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://src.chromium.org/viewvc/chrome?revision=260157&amp;view=revision" source="CONFIRM">https://src.chromium.org/viewvc/chrome?revision=260157&amp;view=revision</ref>
      <ref url="https://code.google.com/p/chromium/issues/detail?id=351103" source="CONFIRM">https://code.google.com/p/chromium/issues/detail?id=351103</ref>
      <ref url="http://googlechromereleases.blogspot.com/2014/04/stable-channel-update_24.html" source="CONFIRM" adv="1">http://googlechromereleases.blogspot.com/2014/04/stable-channel-update_24.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="google" name="chrome">
        <vers prev="1" num="34.0.1847.130"/>
        <vers prev="1" num="34.0.1847.131"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1734" published="2014-04-26" name="CVE-2014-1734" modified="2014-04-28" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">Multiple unspecified vulnerabilities in Google Chrome before 34.0.1847.131 on Windows and OS X and before 34.0.1847.132 on Linux allow attackers to cause a denial of service or possibly have other impact via unknown vectors.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://code.google.com/p/chromium/issues/detail?id=367314" source="CONFIRM">https://code.google.com/p/chromium/issues/detail?id=367314</ref>
      <ref url="https://code.google.com/p/chromium/issues/detail?id=357382" source="CONFIRM">https://code.google.com/p/chromium/issues/detail?id=357382</ref>
      <ref url="https://code.google.com/p/chromium/issues/detail?id=356181" source="CONFIRM">https://code.google.com/p/chromium/issues/detail?id=356181</ref>
      <ref url="http://googlechromereleases.blogspot.com/2014/04/stable-channel-update_24.html" source="CONFIRM" adv="1">http://googlechromereleases.blogspot.com/2014/04/stable-channel-update_24.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="google" name="chrome">
        <vers prev="1" num="34.0.1847.130"/>
        <vers prev="1" num="34.0.1847.131"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1735" published="2014-04-26" name="CVE-2014-1735" modified="2014-04-28" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">Multiple unspecified vulnerabilities in Google V8 before 3.24.35.33, as used in Google Chrome before 34.0.1847.131 on Windows and OS X and before 34.0.1847.132 on Linux, allow attackers to cause a denial of service or possibly have other impact via unknown vectors.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://src.chromium.org/viewvc/blink?revision=171127&amp;view=revision" source="CONFIRM">https://src.chromium.org/viewvc/blink?revision=171127&amp;view=revision</ref>
      <ref url="https://src.chromium.org/viewvc/blink?revision=171077&amp;view=revision" source="CONFIRM">https://src.chromium.org/viewvc/blink?revision=171077&amp;view=revision</ref>
      <ref url="https://code.google.com/p/v8/source/detail?r=20624" source="CONFIRM">https://code.google.com/p/v8/source/detail?r=20624</ref>
      <ref url="https://code.google.com/p/v8/source/detail?r=20622" source="CONFIRM">https://code.google.com/p/v8/source/detail?r=20622</ref>
      <ref url="https://code.google.com/p/v8/source/detail?r=20501" source="CONFIRM">https://code.google.com/p/v8/source/detail?r=20501</ref>
      <ref url="https://code.google.com/p/chromium/issues/detail?id=360429" source="CONFIRM">https://code.google.com/p/chromium/issues/detail?id=360429</ref>
      <ref url="https://code.google.com/p/chromium/issues/detail?id=359525" source="CONFIRM">https://code.google.com/p/chromium/issues/detail?id=359525</ref>
      <ref url="https://code.google.com/p/chromium/issues/detail?id=359130" source="CONFIRM">https://code.google.com/p/chromium/issues/detail?id=359130</ref>
      <ref url="http://googlechromereleases.blogspot.com/2014/04/stable-channel-update_24.html" source="CONFIRM" adv="1">http://googlechromereleases.blogspot.com/2014/04/stable-channel-update_24.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="google" name="chrome">
        <vers prev="1" num="34.0.1847.130"/>
        <vers prev="1" num="34.0.1847.131"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1751" published="2014-04-08" name="CVE-2014-1751" modified="2014-04-09" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0235 and CVE-2014-1755.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://technet.microsoft.com/security/bulletin/MS14-018" source="MS" adv="1">MS14-018</ref>
    </refs>
    <vuln_soft>
      <prod vendor="microsoft" name="internet_explorer">
        <vers num="9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1752" published="2014-04-08" name="CVE-2014-1752" modified="2014-04-09" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">Microsoft Internet Explorer 6 and 7 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://technet.microsoft.com/security/bulletin/MS14-018" source="MS" adv="1">MS14-018</ref>
    </refs>
    <vuln_soft>
      <prod vendor="microsoft" name="internet_explorer">
        <vers num="6"/>
        <vers num="7"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1753" published="2014-04-08" name="CVE-2014-1753" modified="2014-04-09" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">Microsoft Internet Explorer 6 through 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://technet.microsoft.com/security/bulletin/MS14-018" source="MS" adv="1">MS14-018</ref>
    </refs>
    <vuln_soft>
      <prod vendor="microsoft" name="internet_explorer">
        <vers num="6" edition="sp1"/>
        <vers num="7"/>
        <vers num="8"/>
        <vers num="9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1755" published="2014-04-08" name="CVE-2014-1755" modified="2014-04-09" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0235 and CVE-2014-1751.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://technet.microsoft.com/security/bulletin/MS14-018" source="MS" adv="1">MS14-018</ref>
    </refs>
    <vuln_soft>
      <prod vendor="microsoft" name="internet_explorer">
        <vers num="9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1757" published="2014-04-08" name="CVE-2014-1757" modified="2014-04-09" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">Microsoft Word 2007 SP3 and 2010 SP1 and SP2, and Office Compatibility Pack SP3, allocates memory incorrectly for file conversions from a binary (aka .doc) format to a newer format, which allows remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office File Format Converter Vulnerability."</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://technet.microsoft.com/security/bulletin/MS14-017" source="MS" adv="1">MS14-017</ref>
    </refs>
    <vuln_soft>
      <prod vendor="microsoft" name="office_compatibility_pack">
        <vers num="" edition="sp3"/>
      </prod>
      <prod vendor="microsoft" name="word">
        <vers num="2007" edition="sp3"/>
        <vers num="2010" edition="sp1"/>
        <vers num="2010" edition="sp2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1758" published="2014-04-08" name="CVE-2014-1758" modified="2014-04-09" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">Stack-based buffer overflow in Microsoft Word 2003 SP3 allows remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Word Stack Overflow Vulnerability."</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://technet.microsoft.com/security/bulletin/MS14-017" source="MS" adv="1">MS14-017</ref>
    </refs>
    <vuln_soft>
      <prod vendor="microsoft" name="word">
        <vers num="2003" edition="sp3"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1759" published="2014-04-08" name="CVE-2014-1759" modified="2014-04-09" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">pubconv.dll in Microsoft Publisher 2003 SP3 and 2007 SP3 allows remote attackers to execute arbitrary code or cause a denial of service (incorrect pointer dereference and application crash) via a crafted .pub file, aka "Arbitrary Pointer Dereference Vulnerability."</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://technet.microsoft.com/security/bulletin/MS14-020" source="MS" adv="1">MS14-020</ref>
    </refs>
    <vuln_soft>
      <prod vendor="microsoft" name="publisher">
        <vers num="2003" edition="sp3"/>
        <vers num="2007" edition="sp3"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1760" published="2014-04-08" name="CVE-2014-1760" modified="2014-04-09" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://technet.microsoft.com/security/bulletin/MS14-018" source="MS" adv="1">MS14-018</ref>
    </refs>
    <vuln_soft>
      <prod vendor="microsoft" name="internet_explorer">
        <vers num="11" edition="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1761" published="2014-03-25" name="CVE-2014-1761" modified="2014-04-19" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">Microsoft Word 2003 SP3, 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Word Viewer; Office Compatibility Pack SP3; Office for Mac 2011; Word Automation Services on SharePoint Server 2010 SP1 and SP2 and 2013; Office Web Apps 2010 SP1 and SP2; and Office Web Apps Server 2013 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted RTF data, as exploited in the wild in March 2014.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://technet.microsoft.com/security/bulletin/MS14-017" source="MS">MS14-017</ref>
      <ref url="http://technet.microsoft.com/security/advisory/2953095" source="CONFIRM" adv="1">http://technet.microsoft.com/security/advisory/2953095</ref>
    </refs>
    <vuln_soft>
      <prod vendor="microsoft" name="office">
        <vers num="2011" edition=":mac"/>
      </prod>
      <prod vendor="microsoft" name="office_compatibility_pack">
        <vers num="" edition="sp3"/>
      </prod>
      <prod vendor="microsoft" name="office_web_apps">
        <vers num="2010" edition="sp1"/>
        <vers num="2010" edition="sp2"/>
      </prod>
      <prod vendor="microsoft" name="office_web_apps_server">
        <vers num="2013"/>
      </prod>
      <prod vendor="microsoft" name="sharepoint_server">
        <vers num="2010" edition="sp1"/>
        <vers num="2010" edition="sp2"/>
        <vers num="2013"/>
      </prod>
      <prod vendor="microsoft" name="word">
        <vers num="2003" edition="sp3"/>
        <vers num="2007" edition="sp3"/>
        <vers num="2010" edition="sp1:~~~x64~~"/>
        <vers num="2010" edition="sp1:~~~x86~~"/>
        <vers num="2010" edition="sp2:~~~x64~~"/>
        <vers num="2010" edition="sp2:~~~x86~~"/>
        <vers num="2013" edition="-:~-~-~rt~~"/>
      </prod>
      <prod vendor="microsoft" name="word_viewer">
        <vers num=""/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1762" published="2014-04-27" name="CVE-2014-1762" modified="2014-04-28" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">Unspecified vulnerability in Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code with medium-integrity privileges and bypass a sandbox protection mechanism via unknown vectors, as demonstrated by ZDI during a Pwn4Fun competition at CanSecWest 2014.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.pwn2own.com/2014/03/pwn2own-results-for-wednesday-day-one/" source="MISC">http://www.pwn2own.com/2014/03/pwn2own-results-for-wednesday-day-one/</ref>
      <ref url="http://twitter.com/thezdi/statuses/443810610958958592" source="MISC">http://twitter.com/thezdi/statuses/443810610958958592</ref>
    </refs>
    <vuln_soft>
      <prod vendor="microsoft" name="internet_explorer">
        <vers num="11" edition="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1763" published="2014-04-27" name="CVE-2014-1763" modified="2014-04-28" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:C/I:C/A:C)" CVSS_score="10.0" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="10.0" CVSS_base_score="10.0">
    <desc>
      <descript source="cve">Use-after-free vulnerability in Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code and bypass a sandbox protection mechanism via unspecified vectors, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2014.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.pwn2own.com/2014/03/pwn2own-results-for-wednesday-day-one/" source="MISC">http://www.pwn2own.com/2014/03/pwn2own-results-for-wednesday-day-one/</ref>
      <ref url="http://twitter.com/thezdi/statuses/443855973673754624" source="MISC">http://twitter.com/thezdi/statuses/443855973673754624</ref>
    </refs>
    <vuln_soft>
      <prod vendor="microsoft" name="internet_explorer">
        <vers num="11" edition="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1764" published="2014-04-27" name="CVE-2014-1764" modified="2014-04-28" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:C/I:C/A:C)" CVSS_score="10.0" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="10.0" CVSS_base_score="10.0">
    <desc>
      <descript source="cve">Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code and bypass a sandbox protection mechanism by leveraging "object confusion" in a broker process, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2014.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.pwn2own.com/2014/03/pwn2own-results-for-wednesday-day-one/" source="MISC">http://www.pwn2own.com/2014/03/pwn2own-results-for-wednesday-day-one/</ref>
      <ref url="http://twitter.com/thezdi/statuses/443855973673754624" source="MISC">http://twitter.com/thezdi/statuses/443855973673754624</ref>
    </refs>
    <vuln_soft>
      <prod vendor="microsoft" name="internet_explorer">
        <vers num="11" edition="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1765" published="2014-04-27" name="CVE-2014-1765" modified="2014-04-28" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:C/I:C/A:C)" CVSS_score="10.0" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="10.0" CVSS_base_score="10.0">
    <desc>
      <descript source="cve">Multiple use-after-free vulnerabilities in Microsoft Internet Explorer 11 allow remote attackers to execute arbitrary code via unspecified vectors, as demonstrated by Sebastian Apelt and Andreas Schmidt during a Pwn2Own competition at CanSecWest 2014.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.pwn2own.com/2014/03/pwn2own-results-thursday-day-two/" source="MISC">http://www.pwn2own.com/2014/03/pwn2own-results-thursday-day-two/</ref>
      <ref url="http://twitter.com/thezdi/statuses/444216845734666240" source="MISC">http://twitter.com/thezdi/statuses/444216845734666240</ref>
    </refs>
    <vuln_soft>
      <prod vendor="microsoft" name="internet_explorer">
        <vers num="11" edition="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1766" published="2014-04-27" name="CVE-2014-1766" modified="2014-04-28" CVSS_version="2.0" CVSS_vector="(AV:L/AC:L/Au:N/C:C/I:C/A:C)" CVSS_score="7.2" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="3.9" CVSS_base_score="7.2">
    <desc>
      <descript source="cve">Unspecified vulnerability in the kernel in Microsoft Windows 8.1 allows local users to gain privileges via unknown vectors, as demonstrated by Sebastian Apelt and Andreas Schmidt during a Pwn2Own competition at CanSecWest 2014.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="http://www.pwn2own.com/2014/03/pwn2own-results-thursday-day-two/" source="MISC">http://www.pwn2own.com/2014/03/pwn2own-results-thursday-day-two/</ref>
      <ref url="http://twitter.com/thezdi/statuses/444216845734666240" source="MISC">http://twitter.com/thezdi/statuses/444216845734666240</ref>
    </refs>
    <vuln_soft>
      <prod vendor="microsoft" name="windows_8.1">
        <vers num="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1776" published="2014-04-27" name="CVE-2014-1776" modified="2014-04-28" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:C/I:C/A:C)" CVSS_score="10.0" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="10.0" CVSS_base_score="10.0">
    <desc>
      <descript source="cve">Use-after-free vulnerability in VGX.DLL in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, as exploited in the wild in April 2014.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://technet.microsoft.com/library/security/2963983" source="CONFIRM" adv="1">https://technet.microsoft.com/library/security/2963983</ref>
      <ref url="http://www.fireeye.com/blog/uncategorized/2014/04/new-zero-day-exploit-targeting-internet-explorer-versions-9-through-11-identified-in-targeted-attacks.html" source="MISC">http://www.fireeye.com/blog/uncategorized/2014/04/new-zero-day-exploit-targeting-internet-explorer-versions-9-through-11-identified-in-targeted-attacks.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="microsoft" name="internet_explorer">
        <vers num="10"/>
        <vers num="11" edition="-"/>
        <vers num="6"/>
        <vers num="7"/>
        <vers num="8"/>
        <vers num="9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-1826" published="2014-03-26" name="CVE-2014-1826" modified="2014-03-26" CVSS_version="2.0" CVSS_vector="(AV:N/AC:H/Au:N/C:N/I:P/A:N)" CVSS_score="2.6" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="4.9" CVSS_base_score="2.6">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in the iThoughtsHD app 4.19 for iOS on iPad devices, when the WiFi Transfer feature is used, allows remote attackers to inject arbitrary web script or HTML via a crafted map name.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://www.madirish.net/559" source="MISC">http://www.madirish.net/559</ref>
    </refs>
    <vuln_soft>
      <prod vendor="ithoughts" name="ithoughtshd">
        <vers num="4.19" edition=":~~~iphone_os~ipad~"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1827" published="2014-03-26" name="CVE-2014-1827" modified="2014-03-26" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">The iThoughtsHD app 4.19 for iOS on iPad devices, when the WiFi Transfer feature is used, allows remote attackers to upload arbitrary files by placing a %00 sequence after a dangerous extension, as demonstrated by a .html%00.txt file.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://www.madirish.net/559" source="MISC">http://www.madirish.net/559</ref>
    </refs>
    <vuln_soft>
      <prod vendor="ithoughts" name="ithoughtshd">
        <vers num="4.19" edition=":~~~iphone_os~ipad~"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1828" published="2014-03-26" name="CVE-2014-1828" modified="2014-03-26" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:N/A:P)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">The iThoughts web server in the iThoughtsHD app 4.19 for iOS on iPad devices allows remote attackers to cause a denial of service (disk consumption) by uploading a large file.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://www.madirish.net/559" source="MISC">http://www.madirish.net/559</ref>
    </refs>
    <vuln_soft>
      <prod vendor="ithoughts" name="ithoughtshd">
        <vers num="4.19" edition=":~~~iphone_os~ipad~"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1833" published="2014-02-05" name="CVE-2014-1833" modified="2014-02-21" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:P/A:N)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">Directory traversal vulnerability in uupdate in devscripts 2.14.1 allows remote attackers to modify arbitrary files via a crafted .orig.tar file, related to a symlink.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://bugzilla.redhat.com/show_bug.cgi?id=1059947" source="CONFIRM" adv="1">https://bugzilla.redhat.com/show_bug.cgi?id=1059947</ref>
      <ref url="http://www.securityfocus.com/bid/65260" source="BID">65260</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/01/31/7" source="MLIST">[oss-security] 20140131 CVE request: uupdate (devscripts) directory traversal</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/01/31/11" source="MLIST">[oss-security] 20140131 Re: CVE request: uupdate (devscripts) directory traversal</ref>
      <ref url="http://osvdb.org/102748" source="OSVDB">102748</ref>
      <ref url="http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737160" source="MISC">http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737160</ref>
    </refs>
    <vuln_soft>
      <prod vendor="devscripts_devel_team" name="devscripts">
        <vers num="2.14.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1837" published="2014-01-30" name="CVE-2014-1837" modified="2014-02-21" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in the StackIdeas Komento (com_komento) component before 1.7.4 for Joomla! allows remote attackers to inject arbitrary web script or HTML via vectors related to "checking new comments."</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90974" source="XF">komento-joomla-cve20141837-xss(90974)</ref>
      <ref url="http://www.securityfocus.com/bid/65173" source="BID">65173</ref>
      <ref url="http://stackideas.com/downloads/changelog/komento" source="CONFIRM" adv="1">http://stackideas.com/downloads/changelog/komento</ref>
      <ref url="http://secunia.com/advisories/56577" source="SECUNIA" adv="1">56577</ref>
      <ref url="http://osvdb.org/102563" source="OSVDB">102563</ref>
    </refs>
    <vuln_soft>
      <prod vendor="stackideas" name="komento">
        <vers num="1.7.0"/>
        <vers num="1.7.1"/>
        <vers num="1.7.2"/>
        <vers prev="1" num="1.7.3"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1838" published="2014-03-11" name="CVE-2014-1838" modified="2014-03-12" CVSS_version="2.0" CVSS_vector="(AV:L/AC:M/Au:N/C:P/I:P/A:P)" CVSS_score="4.4" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="3.4" CVSS_base_score="4.4">
    <desc>
      <descript source="cve">The (1) extract_keys_from_pdf and (2) fill_pdf functions in pdf_ext.py in logilab-commons before 0.61.0 allows local users to overwrite arbitrary files and possibly have other unspecified impact via a symlink attack on /tmp/toto.fdf.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737051" source="CONFIRM">https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737051</ref>
      <ref url="http://www.logilab.org/ticket/207561" source="CONFIRM">http://www.logilab.org/ticket/207561</ref>
      <ref url="http://secunia.com/advisories/57209" source="SECUNIA">57209</ref>
      <ref url="http://lists.opensuse.org/opensuse-updates/2014-02/msg00085.html" source="SUSE">openSUSE-SU-2014:0306</ref>
      <ref url="http://comments.gmane.org/gmane.comp.security.oss.general/11986" source="MLIST">[oss-security] 20140131 CVE request: temp file issues in python's logilab-common module</ref>
    </refs>
    <vuln_soft>
      <prod vendor="logilab" name="logilab-common">
        <vers prev="1" num="0.60.0"/>
      </prod>
      <prod vendor="novell" name="opensuse">
        <vers num="12.3"/>
        <vers num="13.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1839" published="2014-03-11" name="CVE-2014-1839" modified="2014-03-12" CVSS_version="2.0" CVSS_vector="(AV:L/AC:M/Au:N/C:P/I:P/A:P)" CVSS_score="4.4" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="3.4" CVSS_base_score="4.4">
    <desc>
      <descript source="cve">The Execute class in shellutils in logilab-commons before 0.61.0 uses tempfile.mktemp, which allows local users to have an unspecified impact by pre-creating the temporary file.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737051" source="CONFIRM">https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737051</ref>
      <ref url="http://www.logilab.org/ticket/207562" source="CONFIRM">http://www.logilab.org/ticket/207562</ref>
      <ref url="http://secunia.com/advisories/57209" source="SECUNIA" adv="1">57209</ref>
      <ref url="http://lists.opensuse.org/opensuse-updates/2014-02/msg00085.html" source="SUSE">openSUSE-SU-2014:0306</ref>
      <ref url="http://comments.gmane.org/gmane.comp.security.oss.general/11986" source="MLIST">[oss-security] 20140131 CVE request: temp file issues in python's logilab-common module</ref>
    </refs>
    <vuln_soft>
      <prod vendor="logilab" name="logilab-common">
        <vers prev="1" num="0.60.0"/>
      </prod>
      <prod vendor="novell" name="opensuse">
        <vers num="12.3"/>
        <vers num="13.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1840" published="2014-03-03" name="CVE-2014-1840" modified="2014-03-04" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in Upload/search.php in MyBB 1.6.12 and earlier allows remote attackers to inject arbitrary web script or HTML via the keywords parameter in a do_search action, which is not properly handled in a forced SQL error message.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://packetstormsecurity.com/files/125038/MyBB-1.6.12-POST-Cross-Site-Scripting.html" source="MISC">http://packetstormsecurity.com/files/125038/MyBB-1.6.12-POST-Cross-Site-Scripting.html</ref>
      <ref url="http://osandamalith.wordpress.com/2014/02/02/mybb-1-6-12-post-xss-0day/" source="MISC">http://osandamalith.wordpress.com/2014/02/02/mybb-1-6-12-post-xss-0day/</ref>
    </refs>
    <vuln_soft>
      <prod vendor="mybb" name="mybb">
        <vers num="1.6.0"/>
        <vers num="1.6.1"/>
        <vers num="1.6.10"/>
        <vers num="1.6.11"/>
        <vers prev="1" num="1.6.12"/>
        <vers num="1.6.2"/>
        <vers num="1.6.3"/>
        <vers num="1.6.4"/>
        <vers num="1.6.5"/>
        <vers num="1.6.6"/>
        <vers num="1.6.7"/>
        <vers num="1.6.8"/>
        <vers num="1.6.9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1841" published="2014-04-29" name="CVE-2014-1841" modified="2014-04-29" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:N/A:N)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">Directory traversal vulnerability in the web interface in Titan FTP Server before 10.40 build 1829 allows remote attackers to copy an arbitrary user's home folder via a Move action with a .. (dot dot) in the src parameter.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://archives.neohapsis.com/archives/fulldisclosure/2014-02/0092.html" source="FULLDISC">20140210 Titan FTP Server Directory Traversal Vulnerabilities - [CVE-2014-1841 / CVE-2014-1842 / CVE-2014-1843]</ref>
    </refs>
    <vuln_soft>
      <prod vendor="southrivertech" name="titan_ftp_server">
        <vers num="10.0.1733"/>
        <vers num="10.01.1740"/>
        <vers num="10.30"/>
        <vers prev="1" num="10.40"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1842" published="2014-04-29" name="CVE-2014-1842" modified="2014-04-29" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:N/A:N)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">Directory traversal vulnerability in the web interface in Titan FTP Server before 10.40 build 1829 allows remote attackers to list all usernames via a Go action with a .. (dot dot) in the search-bar value.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://archives.neohapsis.com/archives/fulldisclosure/2014-02/0092.html" source="FULLDISC">20140210 Titan FTP Server Directory Traversal Vulnerabilities - [CVE-2014-1841 / CVE-2014-1842 / CVE-2014-1843]</ref>
    </refs>
    <vuln_soft>
      <prod vendor="southrivertech" name="titan_ftp_server">
        <vers num="10.0.1733"/>
        <vers num="10.01.1740"/>
        <vers num="10.30"/>
        <vers prev="1" num="10.40"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1843" published="2014-04-29" name="CVE-2014-1843" modified="2014-04-29" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:N/A:N)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">Directory traversal vulnerability in the web interface in Titan FTP Server before 10.40 build 1829 allows remote attackers to obtain the property information of an arbitrary home folder via a Properties action with a .. (dot dot) in the src parameter.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://archives.neohapsis.com/archives/fulldisclosure/2014-02/0092.html" source="FULLDISC">20140210 Titan FTP Server Directory Traversal Vulnerabilities - [CVE-2014-1841 / CVE-2014-1842 / CVE-2014-1843]</ref>
    </refs>
    <vuln_soft>
      <prod vendor="southrivertech" name="titan_ftp_server">
        <vers num="10.0.1733"/>
        <vers num="10.01.1740"/>
        <vers num="10.30"/>
        <vers prev="1" num="10.40"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1854" published="2014-02-27" name="CVE-2014-1854" modified="2014-03-07" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">SQL injection vulnerability in library/clicktracker.php in the AdRotate Pro plugin 3.9 through 3.9.5 and AdRotate Free plugin 3.9 through 3.9.4 for WordPress allows remote attackers to execute arbitrary SQL commands via the track parameter.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://www.htbridge.com/advisory/HTB23201" source="MISC">https://www.htbridge.com/advisory/HTB23201</ref>
      <ref url="http://xforce.iss.net/xforce/xfdb/91253" source="XF">adrotate-track-sql-injection(91253)</ref>
      <ref url="http://www.securityfocus.com/bid/65709" source="BID">65709</ref>
      <ref url="http://www.securityfocus.com/archive/1/archive/1/531176/100/0/threaded" source="BUGTRAQ">20140220 SQL Injection in AdRotate</ref>
      <ref url="http://www.exploit-db.com/exploits/31834" source="EXPLOIT-DB">31834</ref>
      <ref url="http://www.adrotateplugin.com/2014/01/adrotate-pro-3-9-6-and-adrotate-free-3-9-5" source="CONFIRM" adv="1">http://www.adrotateplugin.com/2014/01/adrotate-pro-3-9-6-and-adrotate-free-3-9-5</ref>
      <ref url="http://secunia.com/advisories/57079" source="SECUNIA" adv="1">57079</ref>
    </refs>
    <vuln_soft>
      <prod vendor="adrotateplugin" name="adrotate">
        <vers num="3.9." edition=":~free~wordpress~~~"/>
        <vers num="3.9." edition=":~pro~wordpress~~~"/>
        <vers num="3.9.1" edition=":~free~wordpress~~~"/>
        <vers num="3.9.1" edition=":~pro~wordpress~~~"/>
        <vers num="3.9.2" edition=":~free~wordpress~~~"/>
        <vers num="3.9.2" edition=":~pro~wordpress~~~"/>
        <vers num="3.9.3" edition=":~free~wordpress~~~"/>
        <vers num="3.9.3" edition=":~pro~wordpress~~~"/>
        <vers num="3.9.4" edition=":~free~wordpress~~~"/>
        <vers num="3.9.4" edition=":~pro~wordpress~~~"/>
        <vers num="3.9.5" edition=":~pro~wordpress~~~"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1861" published="2014-02-18" name="CVE-2014-1861" modified="2014-02-20" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">The client in Jetro COCKPIT Secure Browsing (JCSB) 4.3.1 and 4.3.3 does not validate the FileName element in an RDP_FILE_TRANSFER document, which allows remote JCSB servers to execute arbitrary programs by providing a .EXE extension.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://blog.quaji.com/2014/02/remote-code-execution-on-all-enterprise.html" source="MISC">http://blog.quaji.com/2014/02/remote-code-execution-on-all-enterprise.html</ref>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-02/0075.html" source="BUGTRAQ">20140217 Jetro Cockpit Secure Browsing vulnerability - Client missing input validation allowing RCE</ref>
    </refs>
    <vuln_soft>
      <prod vendor="jetroplatforms" name="jetro_cockpit_secure_browsing">
        <vers num="4.3.1"/>
        <vers num="4.3.3"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1869" published="2014-02-07" name="CVE-2014-1869" modified="2014-02-21" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Multiple cross-site scripting (XSS) vulnerabilities in ZeroClipboard.swf in ZeroClipboard before 1.3.2, as maintained by Jon Rohan and James M. Greene, allow remote attackers to inject arbitrary web script or HTML via vectors related to certain SWF query parameters (aka loaderInfo.parameters).</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="https://github.com/zeroclipboard/zeroclipboard/releases/tag/v1.3.2" source="CONFIRM" patch="1" adv="1">https://github.com/zeroclipboard/zeroclipboard/releases/tag/v1.3.2</ref>
      <ref url="https://github.com/zeroclipboard/zeroclipboard/pull/335" source="CONFIRM">https://github.com/zeroclipboard/zeroclipboard/pull/335</ref>
      <ref url="https://github.com/zeroclipboard/zeroclipboard/commit/2f9eb9750a433965572d047e24b0fc78fd1415ca" source="MISC">https://github.com/zeroclipboard/zeroclipboard/commit/2f9eb9750a433965572d047e24b0fc78fd1415ca</ref>
      <ref url="http://xforce.iss.net/xforce/xfdb/91085" source="XF">zeroclipboard-cve20141869-xss(91085)</ref>
      <ref url="http://www.securityfocus.com/bid/65484" source="BID">65484</ref>
      <ref url="http://secunia.com/advisories/56821" source="SECUNIA">56821</ref>
    </refs>
    <vuln_soft>
      <prod vendor="zeroclipboard_project" name="zeroclipboard">
        <vers num="1.0.5"/>
        <vers num="1.0.7"/>
        <vers num="1.0.8"/>
        <vers num="1.1.0"/>
        <vers num="1.1.1"/>
        <vers num="1.1.2"/>
        <vers num="1.1.3"/>
        <vers num="1.1.4"/>
        <vers num="1.1.5"/>
        <vers num="1.1.6"/>
        <vers num="1.1.7"/>
        <vers num="1.2.0"/>
        <vers num="1.2.1"/>
        <vers num="1.2.2"/>
        <vers num="1.2.3"/>
        <vers num="1.3.0"/>
        <vers prev="1" num="1.3.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1870" published="2014-02-06" name="CVE-2014-1870" modified="2014-02-07" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Opera before 19 on Mac OS X allows user-assisted remote attackers to spoof the address bar via vectors involving a drag-and-drop operation.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://blogs.opera.com/security/2014/01/security-changes-features-opera-19/" source="CONFIRM" adv="1">http://blogs.opera.com/security/2014/01/security-changes-features-opera-19/</ref>
    </refs>
    <vuln_soft>
      <prod vendor="opera" name="opera_browser">
        <vers num="1.00"/>
        <vers num="10.00" edition="alpha"/>
        <vers num="10.00" edition="beta1"/>
        <vers num="10.00" edition="beta2"/>
        <vers num="10.00" edition="beta3"/>
        <vers num="10.01"/>
        <vers num="10.10" edition="beta1"/>
        <vers num="10.11"/>
        <vers num="10.20" edition="alpha"/>
        <vers num="10.50" edition="beta1"/>
        <vers num="10.50" edition="beta2"/>
        <vers num="10.51"/>
        <vers num="10.52" edition="beta1"/>
        <vers num="10.52" edition="beta2"/>
        <vers num="10.53" edition="b"/>
        <vers num="10.53" edition="beta1"/>
        <vers num="10.54"/>
        <vers num="10.60" edition="alpha"/>
        <vers num="10.60" edition="beta1"/>
        <vers num="10.61"/>
        <vers num="10.62"/>
        <vers num="10.63"/>
        <vers num="11.00" edition="beta"/>
        <vers num="11.01"/>
        <vers num="11.10" edition="beta"/>
        <vers num="11.11"/>
        <vers num="11.50" edition="beta"/>
        <vers num="11.51"/>
        <vers num="11.52"/>
        <vers num="11.52.1100"/>
        <vers num="11.60" edition="beta"/>
        <vers num="11.61"/>
        <vers num="11.62"/>
        <vers num="11.64"/>
        <vers num="11.65"/>
        <vers num="11.66"/>
        <vers num="11.67"/>
        <vers num="12.00" edition="beta"/>
        <vers num="12.01"/>
        <vers num="12.02"/>
        <vers num="12.10" edition="beta"/>
        <vers num="12.11"/>
        <vers num="12.12"/>
        <vers num="12.13"/>
        <vers num="12.14"/>
        <vers num="12.15"/>
        <vers num="15.00" edition="next"/>
        <vers num="16.00"/>
        <vers num="17.00"/>
        <vers prev="1" num="18.00"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1874" published="2014-02-28" name="CVE-2014-1874" modified="2014-03-16" CVSS_version="2.0" CVSS_vector="(AV:L/AC:M/Au:S/C:N/I:N/A:C)" CVSS_score="4.4" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="2.7" CVSS_base_score="4.4">
    <desc>
      <descript source="cve">The security_context_to_sid_core function in security/selinux/ss/services.c in the Linux kernel before 3.13.4 allows local users to cause a denial of service (system crash) by leveraging the CAP_MAC_ADMIN capability to set a zero-length security context.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="https://github.com/torvalds/linux/commit/2172fa709ab32ca60e86179dc67d0857be8e2c98" source="CONFIRM" patch="1">https://github.com/torvalds/linux/commit/2172fa709ab32ca60e86179dc67d0857be8e2c98</ref>
      <ref url="http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=2172fa709ab32ca60e86179dc67d0857be8e2c98" source="CONFIRM" patch="1">http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=2172fa709ab32ca60e86179dc67d0857be8e2c98</ref>
      <ref url="https://bugzilla.redhat.com/show_bug.cgi?id=1062356" source="CONFIRM">https://bugzilla.redhat.com/show_bug.cgi?id=1062356</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2141-1" source="UBUNTU">USN-2141-1</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2140-1" source="UBUNTU">USN-2140-1</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2139-1" source="UBUNTU">USN-2139-1</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2138-1" source="UBUNTU">USN-2138-1</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2137-1" source="UBUNTU">USN-2137-1</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2136-1" source="UBUNTU">USN-2136-1</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2135-1" source="UBUNTU">USN-2135-1</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2134-1" source="UBUNTU">USN-2134-1</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2133-1" source="UBUNTU">USN-2133-1</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2129-1" source="UBUNTU">USN-2129-1</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2128-1" source="UBUNTU">USN-2128-1</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/02/07/2" source="MLIST">[oss-security] 20140206 Re: CVE Request: Linux kernel: SELinux local DoS</ref>
      <ref url="http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.13.4" source="CONFIRM">http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.13.4</ref>
    </refs>
    <vuln_soft>
      <prod vendor="linux" name="linux_kernel">
        <vers num="3.0" edition="rc1"/>
        <vers num="3.0" edition="rc2"/>
        <vers num="3.0" edition="rc3"/>
        <vers num="3.0" edition="rc4"/>
        <vers num="3.0" edition="rc5"/>
        <vers num="3.0" edition="rc6"/>
        <vers num="3.0" edition="rc7"/>
        <vers num="3.0.1"/>
        <vers num="3.0.10"/>
        <vers num="3.0.11"/>
        <vers num="3.0.12"/>
        <vers num="3.0.13"/>
        <vers num="3.0.14"/>
        <vers num="3.0.15"/>
        <vers num="3.0.16"/>
        <vers num="3.0.17"/>
        <vers num="3.0.18"/>
        <vers num="3.0.19"/>
        <vers num="3.0.2"/>
        <vers num="3.0.20"/>
        <vers num="3.0.21"/>
        <vers num="3.0.22"/>
        <vers num="3.0.23"/>
        <vers num="3.0.24"/>
        <vers num="3.0.25"/>
        <vers num="3.0.26"/>
        <vers num="3.0.27"/>
        <vers num="3.0.28"/>
        <vers num="3.0.29"/>
        <vers num="3.0.3"/>
        <vers num="3.0.30"/>
        <vers num="3.0.31"/>
        <vers num="3.0.32"/>
        <vers num="3.0.33"/>
        <vers num="3.0.34"/>
        <vers num="3.0.35"/>
        <vers num="3.0.36"/>
        <vers num="3.0.37"/>
        <vers num="3.0.38"/>
        <vers num="3.0.39"/>
        <vers num="3.0.4"/>
        <vers num="3.0.40"/>
        <vers num="3.0.41"/>
        <vers num="3.0.42"/>
        <vers num="3.0.43"/>
        <vers num="3.0.44"/>
        <vers num="3.0.45"/>
        <vers num="3.0.46"/>
        <vers num="3.0.47"/>
        <vers num="3.0.48"/>
        <vers num="3.0.49"/>
        <vers num="3.0.5"/>
        <vers num="3.0.50"/>
        <vers num="3.0.51"/>
        <vers num="3.0.52"/>
        <vers num="3.0.53"/>
        <vers num="3.0.54"/>
        <vers num="3.0.55"/>
        <vers num="3.0.56"/>
        <vers num="3.0.57"/>
        <vers num="3.0.58"/>
        <vers num="3.0.59"/>
        <vers num="3.0.6"/>
        <vers num="3.0.60"/>
        <vers num="3.0.61"/>
        <vers num="3.0.62"/>
        <vers num="3.0.63"/>
        <vers num="3.0.64"/>
        <vers num="3.0.65"/>
        <vers num="3.0.66"/>
        <vers num="3.0.67"/>
        <vers num="3.0.68"/>
        <vers num="3.0.7"/>
        <vers num="3.0.8"/>
        <vers num="3.0.9"/>
        <vers num="3.1" edition="rc1"/>
        <vers num="3.1" edition="rc2"/>
        <vers num="3.1" edition="rc3"/>
        <vers num="3.1" edition="rc4"/>
        <vers num="3.1.1"/>
        <vers num="3.1.10"/>
        <vers num="3.1.2"/>
        <vers num="3.1.3"/>
        <vers num="3.1.4"/>
        <vers num="3.1.5"/>
        <vers num="3.1.6"/>
        <vers num="3.1.7"/>
        <vers num="3.1.8"/>
        <vers num="3.1.9"/>
        <vers num="3.10"/>
        <vers num="3.10.1"/>
        <vers num="3.10.10"/>
        <vers num="3.10.11"/>
        <vers num="3.10.12"/>
        <vers num="3.10.13"/>
        <vers num="3.10.14"/>
        <vers num="3.10.15"/>
        <vers num="3.10.16"/>
        <vers num="3.10.17"/>
        <vers num="3.10.18"/>
        <vers num="3.10.19"/>
        <vers num="3.10.2"/>
        <vers num="3.10.20"/>
        <vers num="3.10.21"/>
        <vers num="3.10.22"/>
        <vers num="3.10.23"/>
        <vers num="3.10.24"/>
        <vers num="3.10.25"/>
        <vers num="3.10.26"/>
        <vers num="3.10.27"/>
        <vers num="3.10.28"/>
        <vers num="3.10.29"/>
        <vers num="3.10.3"/>
        <vers num="3.10.4"/>
        <vers num="3.10.5"/>
        <vers num="3.10.6"/>
        <vers num="3.10.7"/>
        <vers num="3.10.8"/>
        <vers num="3.10.9"/>
        <vers num="3.11"/>
        <vers num="3.11.1"/>
        <vers num="3.11.10"/>
        <vers num="3.11.2"/>
        <vers num="3.11.3"/>
        <vers num="3.11.4"/>
        <vers num="3.11.5"/>
        <vers num="3.11.6"/>
        <vers num="3.11.7"/>
        <vers num="3.11.8"/>
        <vers num="3.11.9"/>
        <vers num="3.12"/>
        <vers num="3.12.1"/>
        <vers num="3.12.10"/>
        <vers num="3.12.11"/>
        <vers num="3.12.12"/>
        <vers num="3.12.13"/>
        <vers num="3.12.2"/>
        <vers num="3.12.3"/>
        <vers num="3.12.4"/>
        <vers num="3.12.5"/>
        <vers num="3.12.6"/>
        <vers num="3.12.7"/>
        <vers num="3.12.8"/>
        <vers num="3.12.9"/>
        <vers num="3.13"/>
        <vers num="3.13.1"/>
        <vers num="3.13.2"/>
        <vers prev="1" num="3.13.3"/>
        <vers num="3.2" edition="rc2"/>
        <vers num="3.2" edition="rc3"/>
        <vers num="3.2" edition="rc4"/>
        <vers num="3.2" edition="rc5"/>
        <vers num="3.2" edition="rc6"/>
        <vers num="3.2" edition="rc7"/>
        <vers num="3.2.1"/>
        <vers num="3.2.10"/>
        <vers num="3.2.11"/>
        <vers num="3.2.12"/>
        <vers num="3.2.13"/>
        <vers num="3.2.14"/>
        <vers num="3.2.15"/>
        <vers num="3.2.16"/>
        <vers num="3.2.17"/>
        <vers num="3.2.18"/>
        <vers num="3.2.19"/>
        <vers num="3.2.2"/>
        <vers num="3.2.20"/>
        <vers num="3.2.21"/>
        <vers num="3.2.22"/>
        <vers num="3.2.23"/>
        <vers num="3.2.24"/>
        <vers num="3.2.25"/>
        <vers num="3.2.26"/>
        <vers num="3.2.27"/>
        <vers num="3.2.28"/>
        <vers num="3.2.29"/>
        <vers num="3.2.3"/>
        <vers num="3.2.30"/>
        <vers num="3.2.4"/>
        <vers num="3.2.5"/>
        <vers num="3.2.6"/>
        <vers num="3.2.7"/>
        <vers num="3.2.8"/>
        <vers num="3.2.9"/>
        <vers num="3.3" edition="rc1"/>
        <vers num="3.3" edition="rc2"/>
        <vers num="3.3" edition="rc3"/>
        <vers num="3.3" edition="rc4"/>
        <vers num="3.3" edition="rc5"/>
        <vers num="3.3" edition="rc6"/>
        <vers num="3.3" edition="rc7"/>
        <vers num="3.3.1"/>
        <vers num="3.3.2"/>
        <vers num="3.3.3"/>
        <vers num="3.3.4"/>
        <vers num="3.3.5"/>
        <vers num="3.3.6"/>
        <vers num="3.3.7"/>
        <vers num="3.3.8"/>
        <vers num="3.4" edition="rc1"/>
        <vers num="3.4" edition="rc2"/>
        <vers num="3.4" edition="rc3"/>
        <vers num="3.4" edition="rc4"/>
        <vers num="3.4" edition="rc5"/>
        <vers num="3.4" edition="rc6"/>
        <vers num="3.4" edition="rc7"/>
        <vers num="3.4.1"/>
        <vers num="3.4.10"/>
        <vers num="3.4.11"/>
        <vers num="3.4.12"/>
        <vers num="3.4.13"/>
        <vers num="3.4.14"/>
        <vers num="3.4.15"/>
        <vers num="3.4.16"/>
        <vers num="3.4.17"/>
        <vers num="3.4.18"/>
        <vers num="3.4.19"/>
        <vers num="3.4.2"/>
        <vers num="3.4.20"/>
        <vers num="3.4.21"/>
        <vers num="3.4.22"/>
        <vers num="3.4.23"/>
        <vers num="3.4.24"/>
        <vers num="3.4.25"/>
        <vers num="3.4.26"/>
        <vers num="3.4.27"/>
        <vers num="3.4.28"/>
        <vers num="3.4.29"/>
        <vers num="3.4.3"/>
        <vers num="3.4.30"/>
        <vers num="3.4.31"/>
        <vers num="3.4.32"/>
        <vers num="3.4.33"/>
        <vers num="3.4.34"/>
        <vers num="3.4.35"/>
        <vers num="3.4.36"/>
        <vers num="3.4.37"/>
        <vers num="3.4.38"/>
        <vers num="3.4.39"/>
        <vers num="3.4.4"/>
        <vers num="3.4.40"/>
        <vers num="3.4.41"/>
        <vers num="3.4.42"/>
        <vers num="3.4.43"/>
        <vers num="3.4.44"/>
        <vers num="3.4.45"/>
        <vers num="3.4.46"/>
        <vers num="3.4.47"/>
        <vers num="3.4.48"/>
        <vers num="3.4.49"/>
        <vers num="3.4.5"/>
        <vers num="3.4.50"/>
        <vers num="3.4.51"/>
        <vers num="3.4.52"/>
        <vers num="3.4.53"/>
        <vers num="3.4.54"/>
        <vers num="3.4.55"/>
        <vers num="3.4.56"/>
        <vers num="3.4.57"/>
        <vers num="3.4.58"/>
        <vers num="3.4.59"/>
        <vers num="3.4.6"/>
        <vers num="3.4.60"/>
        <vers num="3.4.61"/>
        <vers num="3.4.62"/>
        <vers num="3.4.63"/>
        <vers num="3.4.64"/>
        <vers num="3.4.65"/>
        <vers num="3.4.66"/>
        <vers num="3.4.67"/>
        <vers num="3.4.68"/>
        <vers num="3.4.69"/>
        <vers num="3.4.7"/>
        <vers num="3.4.70"/>
        <vers num="3.4.71"/>
        <vers num="3.4.72"/>
        <vers num="3.4.73"/>
        <vers num="3.4.74"/>
        <vers num="3.4.75"/>
        <vers num="3.4.76"/>
        <vers num="3.4.77"/>
        <vers num="3.4.78"/>
        <vers num="3.4.79"/>
        <vers num="3.4.8"/>
        <vers num="3.4.9"/>
        <vers num="3.5.1"/>
        <vers num="3.5.2"/>
        <vers num="3.5.3"/>
        <vers num="3.5.4"/>
        <vers num="3.5.5"/>
        <vers num="3.5.6"/>
        <vers num="3.5.7"/>
        <vers num="3.6"/>
        <vers num="3.6.1"/>
        <vers num="3.6.10"/>
        <vers num="3.6.11"/>
        <vers num="3.6.2"/>
        <vers num="3.6.3"/>
        <vers num="3.6.4"/>
        <vers num="3.6.5"/>
        <vers num="3.6.6"/>
        <vers num="3.6.7"/>
        <vers num="3.6.8"/>
        <vers num="3.6.9"/>
        <vers num="3.7"/>
        <vers num="3.7.1"/>
        <vers num="3.7.10"/>
        <vers num="3.7.2"/>
        <vers num="3.7.3"/>
        <vers num="3.7.4"/>
        <vers num="3.7.5"/>
        <vers num="3.7.6"/>
        <vers num="3.7.7"/>
        <vers num="3.7.8"/>
        <vers num="3.7.9"/>
        <vers num="3.8.0"/>
        <vers num="3.8.1"/>
        <vers num="3.8.10"/>
        <vers num="3.8.11"/>
        <vers num="3.8.12"/>
        <vers num="3.8.13"/>
        <vers num="3.8.2"/>
        <vers num="3.8.3"/>
        <vers num="3.8.4"/>
        <vers num="3.8.5"/>
        <vers num="3.8.6"/>
        <vers num="3.8.7"/>
        <vers num="3.8.8"/>
        <vers num="3.8.9"/>
        <vers num="3.9" edition="rc1"/>
        <vers num="3.9" edition="rc2"/>
        <vers num="3.9" edition="rc3"/>
        <vers num="3.9" edition="rc4"/>
        <vers num="3.9" edition="rc5"/>
        <vers num="3.9" edition="rc6"/>
        <vers num="3.9" edition="rc7"/>
        <vers num="3.9.0"/>
        <vers num="3.9.1"/>
        <vers num="3.9.10"/>
        <vers num="3.9.11"/>
        <vers num="3.9.2"/>
        <vers num="3.9.3"/>
        <vers num="3.9.4"/>
        <vers num="3.9.5"/>
        <vers num="3.9.6"/>
        <vers num="3.9.7"/>
        <vers num="3.9.8"/>
        <vers num="3.9.9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1876" published="2014-02-10" name="CVE-2014-1876" modified="2014-04-19" CVSS_version="2.0" CVSS_vector="(AV:L/AC:M/Au:N/C:P/I:P/A:P)" CVSS_score="4.4" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="3.4" CVSS_base_score="4.4">
    <desc>
      <descript source="cve">The unpacker::redirect_stdio function in unpack.cpp in unpack200 in OpenJDK 6, 7, and 8; Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JRockit R27.8.1 and R28.3.1; and Java SE Embedded 7u51 does not securely create temporary files when a log file cannot be opened, which allows local users to overwrite arbitrary files via a symlink attack on /tmp/unpack.log.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="https://bugzilla.redhat.com/show_bug.cgi?id=1060907" source="MISC">https://bugzilla.redhat.com/show_bug.cgi?id=1060907</ref>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
      <ref url="http://seclists.org/oss-sec/2014/q1/285" source="MLIST">[oss-security] 20140207 Re: CVE request and heads-up on insecure temp file handling in unpack200 (OpenJDK, Oracle Java)</ref>
      <ref url="http://seclists.org/oss-sec/2014/q1/242" source="MLIST">[oss-security] 20140203 CVE request and heads-up on insecure temp file handling in unpack200 (OpenJDK, Oracle Java)</ref>
      <ref url="http://osvdb.org/102808" source="OSVDB">102808</ref>
      <ref url="http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737562" source="MISC">http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737562</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="openjdk">
        <vers num="1.6.0"/>
        <vers num="1.7.0"/>
        <vers num="1.8.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1877" published="2014-03-13" name="CVE-2014-1877" modified="2014-03-13" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Multiple cross-site scripting (XSS) vulnerabilities in Dokeos 2.1.1 allow remote attackers to inject arbitrary web script or HTML via the (1) Phone, (2) Street, (3) Address line, (4) Zip code, or (5) City field to main/auth/profile.php; (6) Subject field to main/social/groups.php; or (7) Message body field to main/messages/view_message.php.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/91295" source="XF">dokeos-cve20141877-xss(91295)</ref>
      <ref url="http://www.xchg.info/?p=381" source="MISC">http://www.xchg.info/?p=381</ref>
      <ref url="http://seclists.org/oss-sec/2014/q1/286" source="MLIST">[oss-security] 20140207 Re: Dokeos 2.1.1 Multiple Stored XSS Vulnerabilities</ref>
      <ref url="http://seclists.org/oss-sec/2014/q1/258" source="MLIST">[oss-security] 20140206 Dokeos 2.1.1 Multiple Stored XSS Vulnerabilities</ref>
    </refs>
    <vuln_soft>
      <prod vendor="dokeos_project" name="dokeos">
        <vers num="2.1.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1878" published="2014-02-28" name="CVE-2014-1878" modified="2014-02-28" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:P)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">Stack-based buffer overflow in the cmd_submitf function in cgi/cmd.c in Nagios Core, possibly 4.0.3rc1 and earlier, and Icinga before 1.8.6, 1.9 before 1.9.5, and 1.10 before 1.10.3 allows remote attackers to cause a denial of service (segmentation fault) via a long message to cmd.cgi.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://dev.icinga.org/issues/5434" source="CONFIRM" patch="1">https://dev.icinga.org/issues/5434</ref>
      <ref url="https://www.icinga.org/2014/02/11/bugfix-releases-1-10-3-1-9-5-1-8-6" source="CONFIRM">https://www.icinga.org/2014/02/11/bugfix-releases-1-10-3-1-9-5-1-8-6</ref>
      <ref url="https://bugzilla.redhat.com/show_bug.cgi?id=1066578" source="CONFIRM">https://bugzilla.redhat.com/show_bug.cgi?id=1066578</ref>
      <ref url="http://www.securityfocus.com/bid/65605" source="BID">65605</ref>
      <ref url="http://secunia.com/advisories/57024" source="SECUNIA" adv="1">57024</ref>
    </refs>
    <vuln_soft>
      <prod vendor="icinga" name="icinga">
        <vers num="1.10.0"/>
        <vers num="1.10.1"/>
        <vers num="1.10.2"/>
        <vers num="1.8.0"/>
        <vers num="1.8.1"/>
        <vers num="1.8.2"/>
        <vers num="1.8.3"/>
        <vers num="1.8.4"/>
        <vers prev="1" num="1.8.5"/>
        <vers num="1.9.0"/>
        <vers num="1.9.1"/>
        <vers num="1.9.2"/>
        <vers num="1.9.3"/>
        <vers num="1.9.4"/>
      </prod>
      <prod vendor="nagios" name="nagios">
        <vers num="4.0.0" edition="beta1"/>
        <vers num="4.0.0" edition="beta2"/>
        <vers num="4.0.0" edition="beta3"/>
        <vers num="4.0.0" edition="beta4"/>
        <vers num="4.0.2"/>
        <vers prev="1" num="4.0.3" edition="rc1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-1879" published="2014-02-20" name="CVE-2014-1879" modified="2014-03-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:S/C:N/I:P/A:N)" CVSS_score="3.5" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="6.8" CVSS_base_score="3.5">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in import.php in phpMyAdmin before 4.1.7 allows remote authenticated users to inject arbitrary web script or HTML via a crafted filename in an import action.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="https://github.com/phpmyadmin/phpmyadmin/commit/968d5d5f486820bfa30af046f063b9f23304e14a" source="CONFIRM">https://github.com/phpmyadmin/phpmyadmin/commit/968d5d5f486820bfa30af046f063b9f23304e14a</ref>
      <ref url="http://www.phpmyadmin.net/home_page/security/PMASA-2014-1.php" source="CONFIRM" adv="1">http://www.phpmyadmin.net/home_page/security/PMASA-2014-1.php</ref>
      <ref url="http://lists.opensuse.org/opensuse-updates/2014-03/msg00017.html" source="SUSE">openSUSE-SU-2014:0344</ref>
    </refs>
    <vuln_soft>
      <prod vendor="phpmyadmin" name="phpmyadmin">
        <vers num="1.0.0"/>
        <vers num="1.0.1"/>
        <vers num="1.0.2"/>
        <vers num="1.0.3"/>
        <vers num="1.0.4"/>
        <vers num="1.0.5"/>
        <vers num="1.0.6" edition="a"/>
        <vers num="1.0.7"/>
        <vers num="1.0.8"/>
        <vers num="1.1"/>
        <vers num="1.2"/>
        <vers num="1.2.1"/>
        <vers num="1.2.2"/>
        <vers num="1.2.3"/>
        <vers num="1.2.4"/>
        <vers num="1.2.5"/>
        <vers num="1.2.6"/>
        <vers num="1.2.7"/>
        <vers num="1.2.8"/>
        <vers num="1.2.9"/>
        <vers num="1.2.9.1"/>
        <vers num="1.2.9.2"/>
        <vers num="1.2.9.3"/>
        <vers num="1.2.9.4" edition="b"/>
        <vers num="1.2.9.4" edition="c"/>
        <vers num="1.2.9.5"/>
        <vers num="1.3" edition="alpha"/>
        <vers num="2.11.0"/>
        <vers num="2.11.1.0"/>
        <vers num="2.11.1.1"/>
        <vers num="2.11.1.2"/>
        <vers num="2.11.10.0"/>
        <vers num="2.11.10.1"/>
        <vers num="2.11.2.0"/>
        <vers num="2.11.2.1"/>
        <vers num="2.11.2.2"/>
        <vers num="2.11.3.0"/>
        <vers num="2.11.4.0"/>
        <vers num="2.11.5.0"/>
        <vers num="2.11.5.1"/>
        <vers num="2.11.5.2"/>
        <vers num="2.11.6.0"/>
        <vers num="2.11.7.0"/>
        <vers num="2.11.7.1"/>
        <vers num="2.11.8.0"/>
        <vers num="2.11.9.0"/>
        <vers num="2.11.9.1"/>
        <vers num="2.11.9.2"/>
        <vers num="2.11.9.3"/>
        <vers num="2.11.9.4"/>
        <vers num="2.11.9.5"/>
        <vers num="2.11.9.6"/>
        <vers num="3.0.0" edition="alpha"/>
        <vers num="3.0.0" edition="beta"/>
        <vers num="3.0.0" edition="rc1"/>
        <vers num="3.0.1" edition="rc1"/>
        <vers num="3.0.1.1"/>
        <vers num="3.1.0" edition="beta1"/>
        <vers num="3.1.1" edition="rc1"/>
        <vers num="3.1.2" edition="rc1"/>
        <vers num="3.1.3" edition="rc1"/>
        <vers num="3.1.3.1"/>
        <vers num="3.1.3.2"/>
        <vers num="3.1.4" edition="rc2"/>
        <vers num="3.1.5" edition="rc1"/>
        <vers num="3.2.0" edition="beta1"/>
        <vers num="3.2.0" edition="rc1"/>
        <vers num="3.2.1" edition="rc1"/>
        <vers num="3.2.2" edition="rc1"/>
        <vers num="3.3.0.0"/>
        <vers num="3.3.1.0"/>
        <vers num="3.3.10.0"/>
        <vers num="3.3.2.0"/>
        <vers num="3.3.3.0"/>
        <vers num="3.3.4.0"/>
        <vers num="3.3.5.0"/>
        <vers num="3.3.5.1"/>
        <vers num="3.3.6"/>
        <vers num="3.3.7"/>
        <vers num="3.3.8"/>
        <vers num="3.3.8.1"/>
        <vers num="3.3.9.0"/>
        <vers num="3.3.9.1"/>
        <vers num="3.3.9.2"/>
        <vers num="3.4.0.0"/>
        <vers num="3.4.1.0"/>
        <vers num="3.4.10.0"/>
        <vers num="3.4.10.1"/>
        <vers num="3.4.10.2"/>
        <vers num="3.4.11"/>
        <vers num="3.4.2.0"/>
        <vers num="3.4.3.0"/>
        <vers num="3.4.3.1"/>
        <vers num="3.4.3.2"/>
        <vers num="3.4.4.0"/>
        <vers num="3.4.5.0"/>
        <vers num="3.4.6.0"/>
        <vers num="3.4.7.0"/>
        <vers num="3.4.7.1"/>
        <vers num="3.4.8.0"/>
        <vers num="3.4.9.0"/>
        <vers num="3.5.0.0"/>
        <vers num="3.5.1.0"/>
        <vers num="3.5.2.0"/>
        <vers num="3.5.2.1"/>
        <vers num="3.5.2.2"/>
        <vers num="3.5.3.0"/>
        <vers num="3.5.4"/>
        <vers num="3.5.5"/>
        <vers num="3.5.6"/>
        <vers num="3.5.7" edition="rc1"/>
        <vers num="3.5.8" edition="rc1"/>
        <vers num="3.5.8.1"/>
        <vers num="3.5.8.2"/>
        <vers num="4.0.0" edition="rc2"/>
        <vers num="4.0.0" edition="rc3"/>
        <vers num="4.0.1"/>
        <vers num="4.0.2"/>
        <vers num="4.0.3"/>
        <vers num="4.0.4"/>
        <vers num="4.0.4.1"/>
        <vers num="4.0.4.2"/>
        <vers num="4.0.5"/>
        <vers num="4.0.6"/>
        <vers num="4.0.7"/>
        <vers num="4.0.8"/>
        <vers num="4.0.9"/>
        <vers num="4.1.0"/>
        <vers num="4.1.1"/>
        <vers num="4.1.2"/>
        <vers num="4.1.3"/>
        <vers num="4.1.4"/>
        <vers num="4.1.5"/>
        <vers prev="1" num="4.1.6"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1881" published="2014-03-02" name="CVE-2014-1881" modified="2014-03-03" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier allow remote attackers to bypass intended device-resource restrictions of an event-based bridge via a crafted library clone that leverages IFRAME script execution and waits a certain amount of time for an OnJsPrompt handler return value as an alternative to correct synchronization.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://seclists.org/bugtraq/2014/Jan/96" source="BUGTRAQ" patch="1">20140124 Security Vulnerabilities in Apache Cordova / PhoneGap</ref>
      <ref url="http://www.internetsociety.org/ndss2014/programme#session3" source="MISC">http://www.internetsociety.org/ndss2014/programme#session3</ref>
      <ref url="http://www.cs.utexas.edu/~shmat/shmat_ndss14nofrak.pdf" source="MISC">http://www.cs.utexas.edu/~shmat/shmat_ndss14nofrak.pdf</ref>
      <ref url="http://packetstormsecurity.com/files/124954/apachecordovaphonegap-bypass.txt" source="MISC">http://packetstormsecurity.com/files/124954/apachecordovaphonegap-bypass.txt</ref>
      <ref url="http://openwall.com/lists/oss-security/2014/02/07/9" source="MLIST">[oss-security] 20140207 Re: CVE request: multiple issues in Apache Cordova/PhoneGap</ref>
    </refs>
    <vuln_soft>
      <prod vendor="adobe" name="phonegap">
        <vers num="2.0.0" edition="rc1"/>
        <vers num="2.1.0"/>
        <vers num="2.2.0" edition="rc1"/>
        <vers num="2.2.0" edition="rc2"/>
        <vers num="2.3.0" edition="rc1"/>
        <vers num="2.3.0" edition="rc2"/>
        <vers num="2.4.0" edition="rc1"/>
        <vers num="2.5.0" edition="rc1"/>
        <vers num="2.6.0" edition="rc1"/>
        <vers num="2.7.0" edition="rc1"/>
        <vers num="2.8.0"/>
        <vers num="2.8.1"/>
        <vers prev="1" num="2.9.0" edition="rc1"/>
      </prod>
      <prod vendor="apache" name="cordova">
        <vers num="3.0.0" edition="rc1"/>
        <vers num="3.1.0" edition="rc1"/>
        <vers num="3.2.0" edition="rc1"/>
        <vers prev="1" num="3.3.0" edition="rc1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1882" published="2014-03-02" name="CVE-2014-1882" modified="2014-03-03" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier allow remote attackers to bypass intended device-resource restrictions of an event-based bridge via a crafted library clone that leverages IFRAME script execution and directly accesses bridge JavaScript objects, as demonstrated by certain cordova.require calls.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.internetsociety.org/ndss2014/programme#session3" source="MISC">http://www.internetsociety.org/ndss2014/programme#session3</ref>
      <ref url="http://www.cs.utexas.edu/~shmat/shmat_ndss14nofrak.pdf" source="MISC">http://www.cs.utexas.edu/~shmat/shmat_ndss14nofrak.pdf</ref>
      <ref url="http://seclists.org/bugtraq/2014/Jan/96" source="BUGTRAQ" adv="1">20140124 Security Vulnerabilities in Apache Cordova / PhoneGap</ref>
      <ref url="http://packetstormsecurity.com/files/124954/apachecordovaphonegap-bypass.txt" source="MISC">http://packetstormsecurity.com/files/124954/apachecordovaphonegap-bypass.txt</ref>
      <ref url="http://openwall.com/lists/oss-security/2014/02/07/9" source="MLIST">[oss-security] 20140207 Re: CVE request: multiple issues in Apache Cordova/PhoneGap</ref>
    </refs>
    <vuln_soft>
      <prod vendor="adobe" name="phonegap">
        <vers num="2.0.0" edition="rc1"/>
        <vers num="2.1.0"/>
        <vers num="2.2.0" edition="rc1"/>
        <vers num="2.2.0" edition="rc2"/>
        <vers num="2.3.0" edition="rc1"/>
        <vers num="2.3.0" edition="rc2"/>
        <vers num="2.4.0" edition="rc1"/>
        <vers num="2.5.0" edition="rc1"/>
        <vers num="2.6.0" edition="rc1"/>
        <vers num="2.7.0" edition="rc1"/>
        <vers num="2.8.0"/>
        <vers num="2.8.1"/>
        <vers prev="1" num="2.9.0" edition="rc1"/>
      </prod>
      <prod vendor="apache" name="cordova">
        <vers num="3.0.0" edition="rc1"/>
        <vers num="3.1.0" edition="rc1"/>
        <vers num="3.2.0" edition="rc1"/>
        <vers prev="1" num="3.3.0" edition="rc1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1883" published="2014-03-02" name="CVE-2014-1883" modified="2014-03-03" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">Adobe PhoneGap before 2.6.0 on Android uses the shouldOverrideUrlLoading callback instead of the proper shouldInterceptRequest callback, which allows remote attackers to bypass intended device-resource restrictions via content that is accessed (1) in an IFRAME element or (2) with the XMLHttpRequest method by a crafted application.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://seclists.org/bugtraq/2014/Jan/96" source="BUGTRAQ" patch="1">20140124 Security Vulnerabilities in Apache Cordova / PhoneGap</ref>
      <ref url="https://github.com/phonegap/phonegap/blob/2.6.0/changelog" source="MISC">https://github.com/phonegap/phonegap/blob/2.6.0/changelog</ref>
      <ref url="http://www.internetsociety.org/ndss2014/programme#session3" source="MISC">http://www.internetsociety.org/ndss2014/programme#session3</ref>
      <ref url="http://www.cs.utexas.edu/~shmat/shmat_ndss14nofrak.pdf" source="MISC">http://www.cs.utexas.edu/~shmat/shmat_ndss14nofrak.pdf</ref>
      <ref url="http://packetstormsecurity.com/files/124954/apachecordovaphonegap-bypass.txt" source="MISC">http://packetstormsecurity.com/files/124954/apachecordovaphonegap-bypass.txt</ref>
      <ref url="http://openwall.com/lists/oss-security/2014/02/07/9" source="MLIST">[oss-security] 20140207 Re: CVE request: multiple issues in Apache Cordova/PhoneGap</ref>
    </refs>
    <vuln_soft>
      <prod vendor="adobe" name="phonegap">
        <vers num="2.0.0" edition="rc1"/>
        <vers num="2.1.0"/>
        <vers num="2.2.0" edition="rc1"/>
        <vers num="2.2.0" edition="rc2"/>
        <vers num="2.3.0" edition="rc1"/>
        <vers num="2.3.0" edition="rc2"/>
        <vers num="2.4.0" edition="rc1"/>
        <vers prev="1" num="2.5.0" edition="rc1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1884" published="2014-03-02" name="CVE-2014-1884" modified="2014-03-03" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier on Windows Phone 7 and 8 do not properly restrict navigation events, which allows remote attackers to bypass intended device-resource restrictions via content that is accessed (1) in an IFRAME element or (2) with the XMLHttpRequest method by a crafted application.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.internetsociety.org/ndss2014/programme#session3" source="MISC">http://www.internetsociety.org/ndss2014/programme#session3</ref>
      <ref url="http://www.cs.utexas.edu/~shmat/shmat_ndss14nofrak.pdf" source="MISC">http://www.cs.utexas.edu/~shmat/shmat_ndss14nofrak.pdf</ref>
      <ref url="http://seclists.org/bugtraq/2014/Jan/96" source="BUGTRAQ" adv="1">20140124 Security Vulnerabilities in Apache Cordova / PhoneGap</ref>
      <ref url="http://packetstormsecurity.com/files/124954/apachecordovaphonegap-bypass.txt" source="MISC">http://packetstormsecurity.com/files/124954/apachecordovaphonegap-bypass.txt</ref>
      <ref url="http://openwall.com/lists/oss-security/2014/02/07/9" source="MLIST">[oss-security] 20140207 Re: CVE request: multiple issues in Apache Cordova/PhoneGap</ref>
    </refs>
    <vuln_soft>
      <prod vendor="adobe" name="phonegap">
        <vers num="2.0.0" edition="rc1"/>
        <vers num="2.1.0"/>
        <vers num="2.2.0" edition="rc1"/>
        <vers num="2.2.0" edition="rc2"/>
        <vers num="2.3.0" edition="rc1"/>
        <vers num="2.3.0" edition="rc2"/>
        <vers num="2.4.0" edition="rc1"/>
        <vers num="2.5.0" edition="rc1"/>
        <vers num="2.6.0" edition="rc1"/>
        <vers num="2.7.0" edition="rc1"/>
        <vers num="2.8.0"/>
        <vers num="2.8.1"/>
        <vers prev="1" num="2.9.0" edition="rc1"/>
      </prod>
      <prod vendor="apache" name="cordova">
        <vers num="3.0.0" edition="rc1"/>
        <vers num="3.1.0" edition="rc1"/>
        <vers num="3.2.0" edition="rc1"/>
        <vers prev="1" num="3.3.0" edition="rc1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1885" published="2014-03-02" name="CVE-2014-1885" modified="2014-03-07" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:P/A:P)" CVSS_score="6.4" CVSS_impact_subscore="4.9" CVSS_exploit_subscore="10.0" CVSS_base_score="6.4">
    <desc>
      <descript source="cve">The ForzeArmate application for Android, when Adobe PhoneGap 2.9.0 or earlier is used, allows remote attackers to execute arbitrary JavaScript code, and consequently obtain write access to external-storage resources, by leveraging control over any Google syndication advertising domain.</descript>
    </desc>
    <loss_types>
      <avail/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.internetsociety.org/ndss2014/programme#session3" source="MISC">http://www.internetsociety.org/ndss2014/programme#session3</ref>
      <ref url="http://www.cs.utexas.edu/~shmat/shmat_ndss14nofrak.pdf" source="MISC">http://www.cs.utexas.edu/~shmat/shmat_ndss14nofrak.pdf</ref>
      <ref url="http://openwall.com/lists/oss-security/2014/02/07/9" source="MLIST">[oss-security] 20140207 Re: CVE request: multiple issues in Apache Cordova/PhoneGap</ref>
    </refs>
    <vuln_soft>
      <prod vendor="hsgroup" name="forzearmate">
        <vers num="-" edition=":~~~android~~"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1886" published="2014-03-02" name="CVE-2014-1886" modified="2014-03-07" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:P)" CVSS_score="6.8" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.6" CVSS_base_score="6.8">
    <desc>
      <descript source="cve">The Edinburgh by Bus application for Android, when Adobe PhoneGap 2.9.0 or earlier is used, allows remote attackers to execute arbitrary JavaScript code, and consequently access external-storage resources, by leveraging control over one of a number of "obscure Eastern European dating sites."</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://www.internetsociety.org/ndss2014/programme#session3" source="MISC">http://www.internetsociety.org/ndss2014/programme#session3</ref>
      <ref url="http://www.cs.utexas.edu/~shmat/shmat_ndss14nofrak.pdf" source="MISC">http://www.cs.utexas.edu/~shmat/shmat_ndss14nofrak.pdf</ref>
      <ref url="http://openwall.com/lists/oss-security/2014/02/07/9" source="MLIST">[oss-security] 20140207 Re: CVE request: multiple issues in Apache Cordova/PhoneGap</ref>
    </refs>
    <vuln_soft>
      <prod vendor="edinburghtour" name="edinburgh_by_bus">
        <vers num="-" edition=":~~~android~~"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1887" published="2014-03-02" name="CVE-2014-1887" modified="2014-03-07" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:N/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">The DrinkedIn BarFinder application for Android, when Adobe PhoneGap 2.9.0 or earlier is used, allows remote attackers to execute arbitrary JavaScript code, and consequently obtain sensitive fine-geolocation information, by leveraging control over one of a number of adult sites, as demonstrated by (1) freelifetimecheating.com and (2) www.babesroulette.com.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://www.internetsociety.org/ndss2014/programme#session3" source="MISC">http://www.internetsociety.org/ndss2014/programme#session3</ref>
      <ref url="http://www.cs.utexas.edu/~shmat/shmat_ndss14nofrak.pdf" source="MISC">http://www.cs.utexas.edu/~shmat/shmat_ndss14nofrak.pdf</ref>
      <ref url="http://openwall.com/lists/oss-security/2014/02/07/9" source="MLIST">[oss-security] 20140207 Re: CVE request: multiple issues in Apache Cordova/PhoneGap</ref>
    </refs>
    <vuln_soft>
      <prod vendor="drinkedin" name="drinkedin_barfinder">
        <vers num="-" edition=":~~~android~~"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1888" published="2014-02-28" name="CVE-2014-1888" modified="2014-03-03" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in the BuddyPress plugin before 1.9.2 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the name field to groups/create/step/group-details.  NOTE: this can be exploited without authentication by leveraging CVE-2014-1889.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/91175" source="XF">buddypress-cve20141888-xss(91175)</ref>
      <ref url="http://www.securityfocus.com/bid/65555" source="BID">65555</ref>
      <ref url="http://www.securityfocus.com/archive/1/archive/1/531049/100/0/threaded" source="BUGTRAQ">20140213 Wordpress plugin Buddypress &lt;= 1.9.1 stored xss vulnerability</ref>
      <ref url="http://secunia.com/advisories/56950" source="SECUNIA" adv="1">56950</ref>
      <ref url="http://packetstormsecurity.com/files/125212/WordPress-Buddypress-1.9.1-Cross-Site-Scripting.html" source="MISC">http://packetstormsecurity.com/files/125212/WordPress-Buddypress-1.9.1-Cross-Site-Scripting.html</ref>
      <ref url="http://osvdb.org/103307" source="OSVDB">103307</ref>
      <ref url="http://buddypress.org/2014/02/buddypress-1-9-2" source="CONFIRM" adv="1">http://buddypress.org/2014/02/buddypress-1-9-2</ref>
    </refs>
    <vuln_soft>
      <prod vendor="buddypress" name="buddypress_plugin">
        <vers num="1.5"/>
        <vers num="1.5.1"/>
        <vers num="1.5.2"/>
        <vers num="1.5.3"/>
        <vers num="1.5.3.1"/>
        <vers num="1.5.4"/>
        <vers num="1.5.5"/>
        <vers num="1.5.6"/>
        <vers num="1.5.7"/>
        <vers num="1.6"/>
        <vers num="1.6.1"/>
        <vers num="1.6.2"/>
        <vers num="1.6.3"/>
        <vers num="1.6.4"/>
        <vers num="1.6.5"/>
        <vers num="1.7"/>
        <vers num="1.7.1"/>
        <vers num="1.7.2"/>
        <vers num="1.7.3"/>
        <vers num="1.8"/>
        <vers num="1.8.1"/>
        <vers prev="1" num="1.9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1891" published="2014-04-01" name="CVE-2014-1891" modified="2014-04-19" CVSS_version="2.0" CVSS_vector="(AV:A/AC:M/Au:S/C:N/I:N/A:C)" CVSS_score="5.2" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="4.4" CVSS_base_score="5.2">
    <desc>
      <descript source="cve">Multiple integer overflows in the (1) FLASK_GETBOOL, (2) FLASK_SETBOOL, (3) FLASK_USER, and (4) FLASK_CONTEXT_TO_SID suboperations in the flask hypercall in Xen 4.3.x, 4.2.x, 4.1.x, 3.2.x, and earlier, when XSM is enabled, allow local users to cause a denial of service (processor fault) via unspecified vectors, a different vulnerability than CVE-2014-1892, CVE-2014-1893, and CVE-2014-1894.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <local_network/>
    </range>
    <refs>
      <ref url="http://xenbits.xen.org/xsa/advisory-84.html" source="CONFIRM" patch="1" adv="1">http://xenbits.xen.org/xsa/advisory-84.html</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/02/10/8" source="MLIST">[oss-security] 20140210 Xen Security Advisory 84 (CVE-2014-1891,CVE-2014-1892,CVE-2014-1893,CVE-2014-1894) - integer overflow in several XSM/Flask hypercalls</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/02/07/4" source="MLIST">[oss-security] 20140207 Re: Xen Security Advisory 84 - integer overflow in several XSM/Flask hypercalls</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/02/07/12" source="MLIST">[oss-security] 20140207 Re: Xen Security Advisory 84 - integer overflow in several XSM/Flask hypercalls</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html" source="SUSE">SUSE-SU-2014:0446</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00011.html" source="SUSE">SUSE-SU-2014:0373</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00010.html" source="SUSE">SUSE-SU-2014:0372</ref>
    </refs>
    <vuln_soft>
      <prod vendor="xen" name="xen">
        <vers num="3.2.0"/>
        <vers num="3.2.1"/>
        <vers num="3.2.2"/>
        <vers num="3.2.3"/>
        <vers num="3.3.0"/>
        <vers num="3.3.1"/>
        <vers num="3.3.2"/>
        <vers num="3.4.0"/>
        <vers num="3.4.1"/>
        <vers num="3.4.2"/>
        <vers num="3.4.3"/>
        <vers num="3.4.4"/>
        <vers num="4.1.0"/>
        <vers num="4.1.1"/>
        <vers num="4.1.2"/>
        <vers num="4.1.3"/>
        <vers num="4.1.4"/>
        <vers num="4.1.5"/>
        <vers num="4.1.6.1"/>
        <vers num="4.2.0"/>
        <vers num="4.2.1"/>
        <vers num="4.2.2"/>
        <vers num="4.2.3"/>
        <vers prev="1" num="4.3.0"/>
        <vers num="4.3.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1892" published="2014-04-01" name="CVE-2014-1892" modified="2014-04-19" CVSS_version="2.0" CVSS_vector="(AV:A/AC:M/Au:S/C:N/I:N/A:C)" CVSS_score="5.2" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="4.4" CVSS_base_score="5.2">
    <desc>
      <descript source="cve">Xen 3.3 through 4.1, when XSM is enabled, allows local users to cause a denial of service via vectors related to a "large memory allocation," a different vulnerability than CVE-2014-1891, CVE-2014-1893, and CVE-2014-1894.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <local_network/>
    </range>
    <refs>
      <ref url="http://xenbits.xen.org/xsa/advisory-84.html" source="CONFIRM" patch="1" adv="1">http://xenbits.xen.org/xsa/advisory-84.html</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/02/10/8" source="MLIST">[oss-security] 20140210 Xen Security Advisory 84 (CVE-2014-1891,CVE-2014-1892,CVE-2014-1893,CVE-2014-1894) - integer overflow in several XSM/Flask hypercalls</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/02/07/4" source="MLIST">[oss-security] 20140207 Re: Xen Security Advisory 84 - integer overflow in several XSM/Flask hypercalls</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/02/07/12" source="MLIST">[oss-security] 20140207 Re: Xen Security Advisory 84 - integer overflow in several XSM/Flask hypercalls</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html" source="SUSE">SUSE-SU-2014:0446</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00011.html" source="SUSE">SUSE-SU-2014:0373</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00010.html" source="SUSE">SUSE-SU-2014:0372</ref>
    </refs>
    <vuln_soft>
      <prod vendor="xen" name="xen">
        <vers num="3.3.0"/>
        <vers num="3.3.1"/>
        <vers num="3.3.2"/>
        <vers num="3.4.0"/>
        <vers num="3.4.1"/>
        <vers num="3.4.2"/>
        <vers num="3.4.3"/>
        <vers num="3.4.4"/>
        <vers num="4.0.0"/>
        <vers num="4.0.1"/>
        <vers num="4.0.2"/>
        <vers num="4.0.3"/>
        <vers num="4.0.4"/>
        <vers num="4.1.0"/>
        <vers num="4.1.1"/>
        <vers num="4.1.2"/>
        <vers num="4.1.3"/>
        <vers num="4.1.4"/>
        <vers num="4.1.5"/>
        <vers num="4.1.6.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1893" published="2014-04-01" name="CVE-2014-1893" modified="2014-04-19" CVSS_version="2.0" CVSS_vector="(AV:A/AC:M/Au:S/C:N/I:N/A:C)" CVSS_score="5.2" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="4.4" CVSS_base_score="5.2">
    <desc>
      <descript source="cve">Multiple integer overflows in the (1) FLASK_GETBOOL and (2) FLASK_SETBOOL suboperations in the flask hypercall in Xen 4.1.x, 3.3.x, 3.2.x, and earlier, when XSM is enabled, allow local users to cause a denial of service (processor fault) via unspecified vectors, a different vulnerability than CVE-2014-1891, CVE-2014-1892, and CVE-2014-1894.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <local_network/>
    </range>
    <refs>
      <ref url="http://xenbits.xen.org/xsa/advisory-84.html" source="CONFIRM" patch="1" adv="1">http://xenbits.xen.org/xsa/advisory-84.html</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/02/10/8" source="MLIST">[oss-security] 20140210 Xen Security Advisory 84 (CVE-2014-1891,CVE-2014-1892,CVE-2014-1893,CVE-2014-1894) - integer overflow in several XSM/Flask hypercalls</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/02/07/4" source="MLIST">[oss-security] 20140207 Re: Xen Security Advisory 84 - integer overflow in several XSM/Flask hypercalls</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/02/07/12" source="MLIST">[oss-security] 20140207 Re: Xen Security Advisory 84 - integer overflow in several XSM/Flask hypercalls</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html" source="SUSE">SUSE-SU-2014:0446</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00011.html" source="SUSE">SUSE-SU-2014:0373</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00010.html" source="SUSE">SUSE-SU-2014:0372</ref>
    </refs>
    <vuln_soft>
      <prod vendor="xen" name="xen">
        <vers num="3.2.0"/>
        <vers num="3.2.1"/>
        <vers num="3.2.2"/>
        <vers num="3.2.3"/>
        <vers num="3.3.0"/>
        <vers num="3.3.1"/>
        <vers num="3.3.2"/>
        <vers num="3.4.0"/>
        <vers num="3.4.1"/>
        <vers num="3.4.2"/>
        <vers num="3.4.3"/>
        <vers num="3.4.4"/>
        <vers num="4.0.0"/>
        <vers num="4.0.1"/>
        <vers num="4.0.2"/>
        <vers num="4.0.3"/>
        <vers num="4.0.4"/>
        <vers num="4.1.0"/>
        <vers num="4.1.1"/>
        <vers num="4.1.2"/>
        <vers num="4.1.3"/>
        <vers num="4.1.4"/>
        <vers num="4.1.5"/>
        <vers prev="1" num="4.1.6.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1894" published="2014-04-01" name="CVE-2014-1894" modified="2014-04-19" CVSS_version="2.0" CVSS_vector="(AV:A/AC:M/Au:S/C:N/I:N/A:C)" CVSS_score="5.2" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="4.4" CVSS_base_score="5.2">
    <desc>
      <descript source="cve">Multiple integer overflows in unspecified suboperations in the flask hypercall in Xen 3.2.x and earlier, when XSM is enabled, allow local users to cause a denial of service (processor fault) via unspecified vectors, a different vulnerability than CVE-2014-1891, CVE-2014-1892, and CVE-2014-1893.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <local_network/>
    </range>
    <refs>
      <ref url="http://xenbits.xen.org/xsa/advisory-84.html" source="CONFIRM" patch="1" adv="1">http://xenbits.xen.org/xsa/advisory-84.html</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/02/10/8" source="MLIST">[oss-security] 20140210 Xen Security Advisory 84 (CVE-2014-1891,CVE-2014-1892,CVE-2014-1893,CVE-2014-1894) - integer overflow in several XSM/Flask hypercalls</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/02/07/4" source="MLIST">[oss-security] 20140207 Re: Xen Security Advisory 84 - integer overflow in several XSM/Flask hypercalls</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/02/07/12" source="MLIST">[oss-security] 20140207 Re: Xen Security Advisory 84 - integer overflow in several XSM/Flask hypercalls</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html" source="SUSE">SUSE-SU-2014:0446</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00011.html" source="SUSE">SUSE-SU-2014:0373</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00010.html" source="SUSE">SUSE-SU-2014:0372</ref>
    </refs>
    <vuln_soft>
      <prod vendor="xen" name="xen">
        <vers num="3.0.2"/>
        <vers num="3.0.3"/>
        <vers num="3.0.4"/>
        <vers num="3.1.3"/>
        <vers num="3.1.4"/>
        <vers num="3.2.0"/>
        <vers num="3.2.1"/>
        <vers num="3.2.2"/>
        <vers prev="1" num="3.2.3"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1895" published="2014-04-01" name="CVE-2014-1895" modified="2014-04-19" CVSS_version="2.0" CVSS_vector="(AV:A/AC:M/Au:S/C:P/I:N/A:C)" CVSS_score="5.8" CVSS_impact_subscore="7.8" CVSS_exploit_subscore="4.4" CVSS_base_score="5.8">
    <desc>
      <descript source="cve">Off-by-one error in the flask_security_avc_cachestats function in xsm/flask/flask_op.c in Xen 4.2.x and 4.3.x, when the maximum number of physical CPUs are in use, allows local users to cause a denial of service (host crash) or obtain sensitive information from hypervisor memory by leveraging a FLASK_AVC_CACHESTAT hypercall, which triggers a buffer over-read.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
    </loss_types>
    <range>
      <local_network/>
    </range>
    <refs>
      <ref url="http://xenbits.xen.org/xsa/advisory-85.html" source="CONFIRM" patch="1" adv="1">http://xenbits.xen.org/xsa/advisory-85.html</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/02/10/6" source="MLIST">[oss-security] 20140210 Xen Security Advisory 85 (CVE-2014-1895) - Off-by-one error in FLASK_AVC_CACHESTAT hypercall</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/02/07/12" source="MLIST">[oss-security] 20140207 Re: Xen Security Advisory 84 - integer overflow in several XSM/Flask hypercalls</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00011.html" source="SUSE">SUSE-SU-2014:0373</ref>
    </refs>
    <vuln_soft>
      <prod vendor="xen" name="xen">
        <vers num="4.2.0"/>
        <vers num="4.2.1"/>
        <vers num="4.2.2"/>
        <vers num="4.2.3"/>
        <vers num="4.3.0"/>
        <vers num="4.3.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1896" published="2014-04-01" name="CVE-2014-1896" modified="2014-04-19" CVSS_version="2.0" CVSS_vector="(AV:A/AC:M/Au:S/C:P/I:P/A:P)" CVSS_score="4.9" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="4.4" CVSS_base_score="4.9">
    <desc>
      <descript source="cve">The (1) do_send and (2) do_recv functions in io.c in libvchan in Xen 4.2.x, 4.3.x, and 4.4-RC series allows local guests to cause a denial of service or possibly gain privileges via crafted xenstore ring indexes, which triggers a "read or write past the end of the ring."</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <local_network/>
    </range>
    <refs>
      <ref url="http://xenbits.xen.org/xsa/xsa86.patch" source="CONFIRM" patch="1">http://xenbits.xen.org/xsa/xsa86.patch</ref>
      <ref url="http://xenbits.xen.org/xsa/advisory-86.html" source="CONFIRM" patch="1" adv="1">http://xenbits.xen.org/xsa/advisory-86.html</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/02/10/7" source="MLIST">[oss-security] 20140210 Xen Security Advisory 86 (CVE-2014-1896) - libvchan failure handling malicious ring indexes</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/02/07/12" source="MLIST">[oss-security] 20140207 Re: Xen Security Advisory 84 - integer overflow in several XSM/Flask hypercalls</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00011.html" source="SUSE">SUSE-SU-2014:0373</ref>
    </refs>
    <vuln_soft>
      <prod vendor="xen" name="xen">
        <vers num="4.2.0"/>
        <vers num="4.2.1"/>
        <vers num="4.2.2"/>
        <vers num="4.2.3"/>
        <vers num="4.3.0"/>
        <vers num="4.3.1"/>
        <vers num="4.4.0" edition="rc1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" seq="2014-1899" published="2014-05-02" name="CVE-2014-1899" modified="2014-05-02">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in Citrix NetScaler Gateway (formerly Citrix Access Gateway Enterprise Edition) 9.x before 9.3.66.5 and 10.x before 10.1.123.9 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.</descript>
    </desc>
    <refs>
      <ref url="https://support.citrix.com/article/CTX140291" source="CONFIRM">https://support.citrix.com/article/CTX140291</ref>
    </refs>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1903" published="2014-02-18" name="CVE-2014-1903" modified="2014-02-21" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">admin/libraries/view.functions.php in FreePBX 2.9 before 2.9.0.14, 2.10 before 2.10.1.15, 2.11 before 2.11.0.23, and 12 before 12.0.1alpha22 does not restrict the set of functions accessible to the API handler, which allows remote attackers to execute arbitrary PHP code via the function and args parameters to admin/config.php.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.securityfocus.com/archive/1/archive/1/531040/100/0/threaded" source="BUGTRAQ">20140211 [CVE-2014-1903] FreePBX 2.9 through 12 RCE</ref>
      <ref url="http://www.freepbx.org/news/2014-02-06/security-vulnerability-notice" source="CONFIRM">http://www.freepbx.org/news/2014-02-06/security-vulnerability-notice</ref>
      <ref url="http://packetstormsecurity.com/files/125215/FreePBX-2.9-Remote-Code-Execution.html" source="MISC">http://packetstormsecurity.com/files/125215/FreePBX-2.9-Remote-Code-Execution.html</ref>
      <ref url="http://packetstormsecurity.com/files/125166/FreePBX-2.x-Code-Execution.html" source="MISC">http://packetstormsecurity.com/files/125166/FreePBX-2.x-Code-Execution.html</ref>
      <ref url="http://osvdb.org/103240" source="OSVDB">103240</ref>
      <ref url="http://issues.freepbx.org/browse/FREEPBX-7123" source="CONFIRM" adv="1">http://issues.freepbx.org/browse/FREEPBX-7123</ref>
      <ref url="http://issues.freepbx.org/browse/FREEPBX-7117" source="CONFIRM" adv="1">http://issues.freepbx.org/browse/FREEPBX-7117</ref>
      <ref url="http://code.freepbx.org/changelog/FreePBX_SVN?cs=16429" source="CONFIRM">http://code.freepbx.org/changelog/FreePBX_SVN?cs=16429</ref>
      <ref url="http://code.freepbx.org/changelog/FreePBX_Framework?cs=a29382efeb293ef4f42aa9b841dfc8eabb2d1e03" source="CONFIRM">http://code.freepbx.org/changelog/FreePBX_Framework?cs=a29382efeb293ef4f42aa9b841dfc8eabb2d1e03</ref>
      <ref url="http://archives.neohapsis.com/archives/fulldisclosure/2014-02/0111.html" source="FULLDISC">20140211 Re: Freepbx , php code execution exploit</ref>
      <ref url="http://archives.neohapsis.com/archives/fulldisclosure/2014-02/0097.html" source="FULLDISC">20140211 Freepbx , php code execution exploit</ref>
    </refs>
    <vuln_soft>
      <prod vendor="freepbx" name="freepbx">
        <vers num="2.10"/>
        <vers num="2.11"/>
        <vers num="2.12"/>
        <vers num="2.9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1904" published="2014-03-20" name="CVE-2014-1904" modified="2014-04-24" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in web/servlet/tags/form/FormTag.java in Spring MVC in Spring Framework 3.0.0 before 3.2.8 and 4.0.0 before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via the requested URI in a default action.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="https://jira.springsource.org/browse/SPR-11426" source="CONFIRM">https://jira.springsource.org/browse/SPR-11426</ref>
      <ref url="https://github.com/spring-projects/spring-framework/commit/741b4b229ae032bd17175b46f98673ce0bd2d485" source="CONFIRM">https://github.com/spring-projects/spring-framework/commit/741b4b229ae032bd17175b46f98673ce0bd2d485</ref>
      <ref url="http://www.securityfocus.com/archive/1/archive/1/531422/100/0/threaded" source="BUGTRAQ">20140311 CVE-2014-1904 XSS when using Spring MVC</ref>
      <ref url="http://www.gopivotal.com/security/cve-2014-1904" source="CONFIRM">http://www.gopivotal.com/security/cve-2014-1904</ref>
      <ref url="http://secunia.com/advisories/57915" source="SECUNIA">57915</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0400.html" source="REDHAT">RHSA-2014:0400</ref>
      <ref url="http://docs.spring.io/spring/docs/3.2.8.RELEASE/changelog.txt" source="CONFIRM" adv="1">http://docs.spring.io/spring/docs/3.2.8.RELEASE/changelog.txt</ref>
    </refs>
    <vuln_soft>
      <prod vendor="springsource" name="spring_framework">
        <vers num="3.0.0" edition="m1"/>
        <vers num="3.0.0" edition="m2"/>
        <vers num="3.0.0" edition="m3"/>
        <vers num="3.0.0" edition="m4"/>
        <vers num="3.0.0" edition="rc1"/>
        <vers num="3.0.0" edition="rc2"/>
        <vers num="3.0.0" edition="rc3"/>
        <vers num="3.0.1"/>
        <vers num="3.0.2"/>
        <vers num="3.0.3"/>
        <vers num="3.0.4"/>
        <vers num="3.0.5"/>
        <vers num="3.0.6"/>
        <vers num="3.0.7"/>
        <vers num="3.1.0"/>
        <vers num="3.1.1"/>
        <vers num="3.1.2"/>
        <vers num="3.1.3"/>
        <vers num="3.1.4"/>
        <vers num="3.2.0"/>
        <vers num="3.2.1"/>
        <vers num="3.2.2"/>
        <vers num="3.2.3"/>
        <vers num="3.2.4"/>
        <vers num="3.2.5"/>
        <vers num="3.2.6"/>
        <vers prev="1" num="3.2.7"/>
        <vers num="4.0.0" edition="m1"/>
        <vers num="4.0.0" edition="m2"/>
        <vers num="4.0.0" edition="rc1"/>
        <vers prev="1" num="4.0.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1906" published="2014-03-06" name="CVE-2014-1906" modified="2014-03-07" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Multiple cross-site scripting (XSS) vulnerabilities in the VideoWhisper Live Streaming Integration plugin before 4.29.5 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) m parameter to lb_status.php; (2) msg parameter to vc_chatlog.php; n parameter to (3) channel.php, (4) htmlchat.php, (5) video.php, or (6) videotext.php; (7) message parameter to lb_logout.php; or ct parameter to (8) lb_status.php or (9) v_status.php in ls/.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="https://www.htbridge.com/advisory/HTB23199" source="MISC">https://www.htbridge.com/advisory/HTB23199</ref>
      <ref url="http://xforce.iss.net/xforce/xfdb/91477" source="XF">videowhisper-cve20141906-xss(91477)</ref>
      <ref url="http://packetstormsecurity.com/files/125454" source="MISC">http://packetstormsecurity.com/files/125454</ref>
    </refs>
    <vuln_soft>
      <prod vendor="videowhisper" name="live_streaming_integration_plugin">
        <vers num="1.0.2"/>
        <vers num="2.0"/>
        <vers num="2.1"/>
        <vers num="2.2"/>
        <vers num="4.05"/>
        <vers num="4.07"/>
        <vers num="4.25"/>
        <vers num="4.25.3"/>
        <vers num="4.27"/>
        <vers num="4.27.3"/>
        <vers prev="1" num="4.27.4"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1907" published="2014-03-06" name="CVE-2014-1907" modified="2014-03-07" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:N/A:P)" CVSS_score="6.4" CVSS_impact_subscore="4.9" CVSS_exploit_subscore="10.0" CVSS_base_score="6.4">
    <desc>
      <descript source="cve">Multiple directory traversal vulnerabilities in the VideoWhisper Live Streaming Integration plugin before 4.29.5 for WordPress allow remote attackers to (1) read arbitrary files via a .. (dot dot) in the s parameter to ls/rtmp_login.php or (2) delete arbitrary files via a .. (dot dot) in the s parameter to ls/rtmp_logout.php.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://www.htbridge.com/advisory/HTB23199" source="MISC">https://www.htbridge.com/advisory/HTB23199</ref>
      <ref url="http://xforce.iss.net/xforce/xfdb/91478" source="XF">videowhisper-cve20141907-dir-trav(91478)</ref>
      <ref url="http://packetstormsecurity.com/files/125454" source="MISC">http://packetstormsecurity.com/files/125454</ref>
    </refs>
    <vuln_soft>
      <prod vendor="videowhisper" name="live_streaming_integration_plugin">
        <vers num="1.0.2"/>
        <vers num="2.0"/>
        <vers num="2.1"/>
        <vers num="2.2"/>
        <vers num="4.05"/>
        <vers num="4.07"/>
        <vers num="4.25"/>
        <vers num="4.25.3"/>
        <vers num="4.27"/>
        <vers num="4.27.3"/>
        <vers prev="1" num="4.27.4"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1910" published="2014-02-21" name="CVE-2014-1910" modified="2014-02-21" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:N)" CVSS_score="5.8" CVSS_impact_subscore="4.9" CVSS_exploit_subscore="8.6" CVSS_base_score="5.8">
    <desc>
      <descript source="cve">Citrix ShareFile Mobile and ShareFile Mobile for Tablets before 2.4.4 for Android do not verify X.509 certificates from SSL servers, which allow man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.</descript>
    </desc>
    <loss_types>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://support.citrix.com/article/CTX140303" source="CONFIRM" patch="1" adv="1">http://support.citrix.com/article/CTX140303</ref>
      <ref url="http://www.securitytracker.com/id/1029791" source="SECTRACK">1029791</ref>
      <ref url="http://secunia.com/advisories/57020" source="SECUNIA" adv="1">57020</ref>
    </refs>
    <vuln_soft>
      <prod vendor="citrix" name="sharefile_mobile">
        <vers prev="1" num="2.4" edition=":~~~android~~"/>
      </prod>
      <prod vendor="citrix" name="sharefile_mobile_for_tablets">
        <vers prev="1" num="2.4" edition=":~~~android~~"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1911" published="2014-03-06" name="CVE-2014-1911" modified="2014-03-07" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:C/I:N/A:N)" CVSS_score="7.8" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="10.0" CVSS_base_score="7.8">
    <desc>
      <descript source="cve">The Foscam FI8910W camera with firmware before 11.37.2.55 allows remote attackers to obtain sensitive video and image data via a blank username and password.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.kb.cert.org/vuls/id/525132" source="CERT-VN">VU#525132</ref>
      <ref url="http://foscam.us/forum/mjpeg-54-firmware-bug-user-logon-bypass-t8442.html" source="CONFIRM" adv="1">http://foscam.us/forum/mjpeg-54-firmware-bug-user-logon-bypass-t8442.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="foscam" name="fi8919w">
        <vers num="-"/>
      </prod>
      <prod vendor="foscam" name="fi8919w_firmware">
        <vers prev="1" num="11.37.2.54"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1912" published="2014-02-28" name="CVE-2014-1912" modified="2014-03-26" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">Buffer overflow in the socket.recvfrom_into function in Modules/socketmodule.c in Python 2.5 before 2.7.7, 3.x before 3.3.4, and 3.4.x before 3.4rc1 allows remote attackers to execute arbitrary code via a crafted string.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://bugs.python.org/issue20246" source="CONFIRM" patch="1">http://bugs.python.org/issue20246</ref>
      <ref url="https://www.trustedsec.com/february-2014/python-remote-code-execution-socket-recvfrom_into/" source="MISC">https://www.trustedsec.com/february-2014/python-remote-code-execution-socket-recvfrom_into/</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2125-1" source="UBUNTU">USN-2125-1</ref>
      <ref url="http://www.securitytracker.com/id/1029831" source="SECTRACK">1029831</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/02/12/16" source="MLIST">[oss-security] 20140212 Re: CVE request? buffer overflow in socket.recvfrom_into</ref>
      <ref url="http://www.exploit-db.com/exploits/31875" source="EXPLOIT-DB">31875</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2880" source="DEBIAN">DSA-2880</ref>
      <ref url="http://pastebin.com/raw.php?i=GHXSmNEg" source="MISC">http://pastebin.com/raw.php?i=GHXSmNEg</ref>
      <ref url="http://hg.python.org/cpython/rev/87673659d8f7" source="CONFIRM">http://hg.python.org/cpython/rev/87673659d8f7</ref>
    </refs>
    <vuln_soft>
      <prod vendor="python" name="python">
        <vers num="2.5"/>
        <vers num="2.5.1"/>
        <vers num="2.5.150"/>
        <vers num="2.5.2"/>
        <vers num="2.5.3"/>
        <vers num="2.5.4"/>
        <vers num="2.5.6"/>
        <vers num="2.6"/>
        <vers num="2.6.1"/>
        <vers num="2.6.2"/>
        <vers num="2.6.2150"/>
        <vers num="2.6.3"/>
        <vers num="2.6.4"/>
        <vers num="2.6.5"/>
        <vers num="2.6.6"/>
        <vers num="2.6.6150"/>
        <vers num="2.6.7"/>
        <vers num="2.6.8"/>
        <vers num="2.7"/>
        <vers num="2.7.1" edition="rc1"/>
        <vers num="2.7.1150" edition=":~~~~x64~"/>
        <vers num="2.7.2" edition="rc1"/>
        <vers num="2.7.2150"/>
        <vers num="2.7.3"/>
        <vers num="2.7.4"/>
        <vers num="2.7.5"/>
        <vers num="2.7.6"/>
        <vers num="3.0"/>
        <vers num="3.0.1"/>
        <vers num="3.1"/>
        <vers num="3.1.1"/>
        <vers num="3.1.2"/>
        <vers num="3.1.2150" edition=":~~~~x64~"/>
        <vers num="3.1.3"/>
        <vers num="3.1.4"/>
        <vers num="3.1.5"/>
        <vers num="3.2" edition="alpha"/>
        <vers num="3.2.0"/>
        <vers num="3.2.1"/>
        <vers num="3.2.2"/>
        <vers num="3.2.2150"/>
        <vers num="3.2.3"/>
        <vers num="3.2.4"/>
        <vers num="3.2.5"/>
        <vers num="3.3" edition="beta2"/>
        <vers num="3.3.0"/>
        <vers num="3.3.1"/>
        <vers num="3.3.2"/>
        <vers num="3.3.3"/>
        <vers num="3.4" edition="alpha1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1914" published="2014-02-07" name="CVE-2014-1914" modified="2014-02-21" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Multiple cross-site scripting (XSS) vulnerabilities in Command School Student Management System 1.06.01 allow remote attackers to inject arbitrary web script or HTML via the (1) topic parameter to sw/add_topic.php or (2) nick parameter to sw/chat/message.php.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/90179" source="XF">commandschool-message-xss(90179)</ref>
      <ref url="http://xforce.iss.net/xforce/xfdb/90178" source="XF">commandschool-addtopic-xss(90178)</ref>
      <ref url="http://www.securityfocus.com/bid/64707" source="BID">64707</ref>
      <ref url="http://packetstormsecurity.com/files/124708/Command-School-Student-Management-System-1.06.01-SQL-Injection-CSRF-XSS.html" source="MISC">http://packetstormsecurity.com/files/124708/Command-School-Student-Management-System-1.06.01-SQL-Injection-CSRF-XSS.html</ref>
      <ref url="http://osvdb.org/101892" source="OSVDB">101892</ref>
      <ref url="http://osvdb.org/101891" source="OSVDB">101891</ref>
    </refs>
    <vuln_soft>
      <prod vendor="doug_poulin" name="command_school_student_management_system">
        <vers num="1.06.01"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1915" published="2014-02-07" name="CVE-2014-1915" modified="2014-02-21" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:P)" CVSS_score="6.8" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.6" CVSS_base_score="6.8">
    <desc>
      <descript source="cve">Multiple cross-site request forgery (CSRF) vulnerabilities in Command School Student Management System 1.06.01 allow remote attackers to hijack the authentication of (1) administrators for requests that change the administrator password via an update action to sw/admin_change_password.php or (2) unspecified victims for requests that add a topic or blog entry to sw/add_topic.php.  NOTE: vector 2 can be leveraged to bypass the authentication requirements for exploiting vector 1 in CVE-2014-1914.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://www.securityfocus.com/bid/64707" source="BID">64707</ref>
      <ref url="http://packetstormsecurity.com/files/124708/Command-School-Student-Management-System-1.06.01-SQL-Injection-CSRF-XSS.html" source="MISC">http://packetstormsecurity.com/files/124708/Command-School-Student-Management-System-1.06.01-SQL-Injection-CSRF-XSS.html</ref>
      <ref url="http://osvdb.org/101890" source="OSVDB">101890</ref>
      <ref url="http://osvdb.org/101889" source="OSVDB">101889</ref>
    </refs>
    <vuln_soft>
      <prod vendor="doug_poulin" name="command_school_student_management_system">
        <vers num="1.06.01"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1916" published="2014-02-07" name="CVE-2014-1916" modified="2014-02-10" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:P)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">The (1) opus_packet_get_nb_frames and (2) opus_packet_get_samples_per_frame functions in the client in MumbleKit before commit fd190328a9b24d37382b269a5674b0c0c7a7e36d and Mumble for iOS 1.1 through 1.2.2 do not properly check the return value of the copyDataBlock method, which allow remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted length prefix value in an Opus voice packet.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://osvdb.org/102957" source="OSVDB">102957</ref>
      <ref url="http://mumble.info/security/Mumble-SA-2014-003.txt" source="CONFIRM" adv="1">http://mumble.info/security/Mumble-SA-2014-003.txt</ref>
    </refs>
    <vuln_soft>
      <prod vendor="light_speed_gaming" name="mumble">
        <vers num="1.1" edition=":~~~iphone_os~~"/>
        <vers num="1.1" edition="rc1:~~~iphone_os~~"/>
        <vers num="1.1.1" edition=":~~~iphone_os~~"/>
        <vers num="1.2" edition=":~~~iphone_os~~"/>
        <vers num="1.2.1" edition=":~~~iphone_os~~"/>
        <vers num="1.2.2" edition=":~~~iphone_os~~"/>
      </prod>
      <prod vendor="light_speed_gaming" name="mumblekit">
        <vers num="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1921" published="2014-02-14" name="CVE-2014-1921" modified="2014-02-21" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">parcimonie before 0.8.1, when using a large keyring, sleeps for the same amount of time between fetches, which allows attackers to correlate key fetches via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://gaffer.ptitcanardnoir.org/intrigeri/files/parcimonie/App-Parcimonie-0.8.1.tar.gz" source="CONFIRM" patch="1">https://gaffer.ptitcanardnoir.org/intrigeri/files/parcimonie/App-Parcimonie-0.8.1.tar.gz</ref>
      <ref url="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=738134" source="CONFIRM">https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=738134</ref>
      <ref url="http://xforce.iss.net/xforce/xfdb/91118" source="XF">parcimonie-cve20141921-info-disc(91118)</ref>
      <ref url="http://www.securityfocus.com/bid/65505" source="BID">65505</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2860" source="DEBIAN">DSA-2860</ref>
      <ref url="http://seclists.org/oss-sec/2014/q1/308" source="MLIST">[oss-security] 20140210 Re: CVE request: parcimonie (0.6 to 0.8, included) possible correlation between key fetches</ref>
      <ref url="http://seclists.org/oss-sec/2014/q1/305" source="MLIST">[oss-security] 20140210 CVE request: parcimonie (0.6 to 0.8, included) possible correlation between key fetches</ref>
    </refs>
    <vuln_soft>
      <prod vendor="parcimonie_project" name="parcimonie">
        <vers num="0.6-1"/>
        <vers num="0.6-3"/>
        <vers num="0.7-1"/>
        <vers prev="1" num="0.7.1-1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1930" published="2014-02-10" name="CVE-2014-1930" modified="2014-02-21" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:N/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Visibility Software Cyber Recruiter before 8.1.00 does not use the appropriate combination of HTTPS transport and response headers to prevent access to (1) AppSelfService.aspx and (2) AgencyPortal.aspx in the browser history, which allows remote attackers to obtain sensitive information by leveraging an unattended workstation.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.kb.cert.org/vuls/id/566894" source="CERT-VN">VU#566894</ref>
      <ref url="http://www.vspublic.com/help/Cyber%20Recruiter/default.aspx?pageid=release_details" source="CONFIRM" adv="1">http://www.vspublic.com/help/Cyber%20Recruiter/default.aspx?pageid=release_details</ref>
      <ref url="http://www.securityfocus.com/bid/65305" source="BID">65305</ref>
      <ref url="http://osvdb.org/102815" source="OSVDB">102815</ref>
      <ref url="http://osvdb.org/102814" source="OSVDB">102814</ref>
      <ref url="http://jvn.jp/vu/JVNVU97441356/index.html" source="MISC">http://jvn.jp/vu/JVNVU97441356/index.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="visibility_software" name="cyber_recruiter">
        <vers num="6.2"/>
        <vers num="6.4"/>
        <vers num="6.6"/>
        <vers num="6.8"/>
        <vers num="7.0"/>
        <vers num="7.2"/>
        <vers prev="1" num="8.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1931" published="2014-02-10" name="CVE-2014-1931" modified="2014-02-21" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:N/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">The user login page in Visibility Software Cyber Recruiter before 8.1.00 generates different responses for invalid password-retrieval attempts depending on which data elements are incorrect, which might allow remote attackers to obtain account-related information via a series of requests.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.vspublic.com/help/Cyber%20Recruiter/default.aspx?pageid=release_details" source="CONFIRM" adv="1">http://www.vspublic.com/help/Cyber%20Recruiter/default.aspx?pageid=release_details</ref>
      <ref url="http://www.securityfocus.com/bid/65564" source="BID">65564</ref>
    </refs>
    <vuln_soft>
      <prod vendor="visibility_software" name="cyber_recruiter">
        <vers num="6.2"/>
        <vers num="6.4"/>
        <vers num="6.6"/>
        <vers num="6.8"/>
        <vers num="7.0"/>
        <vers num="7.2"/>
        <vers prev="1" num="8.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1932" published="2014-04-17" name="CVE-2014-1932" modified="2014-04-18" CVSS_version="2.0" CVSS_vector="(AV:L/AC:M/Au:N/C:P/I:P/A:P)" CVSS_score="4.4" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="3.4" CVSS_base_score="4.4">
    <desc>
      <descript source="cve">The (1) load_djpeg function in JpegImagePlugin.py, (2) Ghostscript function in EpsImagePlugin.py, (3) load function in IptcImagePlugin.py, and (4) _copy function in Image.py in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 do not properly create temporary files, which allow local users to overwrite arbitrary files and obtain sensitive information via a symlink attack on the temporary file.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="https://github.com/python-imaging/Pillow/commit/4e9f367dfd3f04c8f5d23f7f759ec12782e10ee7" source="CONFIRM" patch="1">https://github.com/python-imaging/Pillow/commit/4e9f367dfd3f04c8f5d23f7f759ec12782e10ee7</ref>
      <ref url="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737059" source="CONFIRM">https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737059</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2168-1" source="UBUNTU">USN-2168-1</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/02/11/1" source="MLIST">[oss-security] 20140210 Re: CVE requests: Pacemaker, Python Imaging Library, eyeD3, 9base, rc, Gamera, RPLY - insecure use of /tmp</ref>
    </refs>
    <vuln_soft>
      <prod vendor="python" name="pillow">
        <vers prev="1" num="2.3.0"/>
      </prod>
      <prod vendor="pythonware" name="python_imaging_library">
        <vers prev="1" num="1.1.7"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-1933" published="2014-04-17" name="CVE-2014-1933" modified="2014-04-18" CVSS_version="2.0" CVSS_vector="(AV:L/AC:L/Au:N/C:N/I:P/A:N)" CVSS_score="2.1" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="3.9" CVSS_base_score="2.1">
    <desc>
      <descript source="cve">The (1) JpegImagePlugin.py and (2) EpsImagePlugin.py scripts in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 uses the names of temporary files on the command line, which makes it easier for local users to conduct symlink attacks by listing the processes.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="https://github.com/python-imaging/Pillow/commit/4e9f367dfd3f04c8f5d23f7f759ec12782e10ee7" source="CONFIRM" patch="1">https://github.com/python-imaging/Pillow/commit/4e9f367dfd3f04c8f5d23f7f759ec12782e10ee7</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2168-1" source="UBUNTU">USN-2168-1</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/02/11/1" source="MLIST">[oss-security] 20140210 Re: CVE requests: Pacemaker, Python Imaging Library, eyeD3, 9base, rc, Gamera, RPLY - insecure use of /tmp</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/02/10/15" source="MLIST">[oss-security] 20140210 CVE requests: Pacemaker, Python Imaging Library, eyeD3, 9base, rc, Gamera, RPLY - insecure use of /tmp</ref>
    </refs>
    <vuln_soft>
      <prod vendor="python" name="pillow">
        <vers prev="1" num="2.3.0"/>
      </prod>
      <prod vendor="pythonware" name="python_imaging_library">
        <vers prev="1" num="1.1.7"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1939" published="2014-03-02" name="CVE-2014-1939" modified="2014-03-04" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">java/android/webkit/BrowserFrame.java in Android before 4.4 uses the addJavascriptInterface API in conjunction with creating an object of the SearchBoxImpl class, which allows attackers to execute arbitrary Java code by leveraging access to the searchBoxJavaBridge_ interface at certain Android API levels.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://openwall.com/lists/oss-security/2014/02/11/2" source="MLIST">[oss-security] 20140210 CVE-2014-1939 searchBoxJavaBridge_ in Android Jelly Bean</ref>
      <ref url="http://blog.chromium.org/2013/11/introducing-chromium-powered-android.html" source="CONFIRM">http://blog.chromium.org/2013/11/introducing-chromium-powered-android.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="google" name="android">
        <vers num="4.0"/>
        <vers num="4.0.1"/>
        <vers num="4.0.2"/>
        <vers num="4.0.3"/>
        <vers num="4.0.4"/>
        <vers num="4.1"/>
        <vers num="4.1.2"/>
        <vers num="4.2"/>
        <vers num="4.2.1"/>
        <vers num="4.2.2"/>
        <vers num="4.3"/>
        <vers prev="1" num="4.3.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1942" published="2014-04-01" name="CVE-2014-1942" modified="2014-04-02" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in aal/loginverification.aspx in Pearson eSIS Enterprise Student Information System allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://www.kb.cert.org/vuls/id/163188" source="CERT-VN">VU#163188</ref>
    </refs>
    <vuln_soft>
      <prod vendor="pearson" name="esis_enterprise_student_information_system">
        <vers num="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1943" published="2014-02-18" name="CVE-2014-1943" modified="2014-03-26" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:P)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">Fine Free file before 5.17 allows context-dependent attackers to cause a denial of service (infinite recursion, CPU consumption, and crash) via a crafted indirect offset value in the magic of a file.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://github.com/glensc/file/blob/FILE5_17/ChangeLog" source="CONFIRM">https://github.com/glensc/file/blob/FILE5_17/ChangeLog</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2126-1" source="UBUNTU">USN-2126-1</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2123-1" source="UBUNTU">USN-2123-1</ref>
      <ref url="http://www.php.net/ChangeLog-5.php" source="CONFIRM">http://www.php.net/ChangeLog-5.php</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2868" source="DEBIAN">DSA-2868</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2861" source="DEBIAN">DSA-2861</ref>
      <ref url="http://mx.gw.com/pipermail/file/2014/001337.html" source="MLIST">[file] 20140213 segfault in magic_buffer</ref>
      <ref url="http://mx.gw.com/pipermail/file/2014/001334.html" source="MLIST">[file] 20140211 segfault in magic_buffer</ref>
      <ref url="http://mx.gw.com/pipermail/file/2014/001330.html" source="MLIST">[file] 20140211 segfault in magic_buffer</ref>
      <ref url="http://mx.gw.com/pipermail/file/2014/001327.html" source="MLIST">[file] 20142010 segfault in magic_buffer</ref>
      <ref url="http://lists.opensuse.org/opensuse-updates/2014-03/msg00037.html" source="SUSE">openSUSE-SU-2014:0367</ref>
      <ref url="http://lists.opensuse.org/opensuse-updates/2014-03/msg00034.html" source="SUSE">openSUSE-SU-2014:0364</ref>
    </refs>
    <vuln_soft>
      <prod vendor="fine_free_file_project" name="fine_free_file">
        <vers num="5.0"/>
        <vers num="5.1"/>
        <vers num="5.10"/>
        <vers num="5.11"/>
        <vers num="5.12"/>
        <vers num="5.13"/>
        <vers num="5.14"/>
        <vers num="5.15"/>
        <vers prev="1" num="5.16"/>
        <vers num="5.2"/>
        <vers num="5.3"/>
        <vers num="5.4"/>
        <vers num="5.7"/>
        <vers num="5.8"/>
        <vers num="5.9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1944" published="2014-03-09" name="CVE-2014-1944" modified="2014-03-10" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in Ilch CMS 2.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the text parameter to index.php/guestbook/index/newentry.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="https://github.com/IlchCMS/Ilch-2.0/commit/381e15f39d07d3cdf6aaaa25c0f2321f817935f7" source="CONFIRM" patch="1">https://github.com/IlchCMS/Ilch-2.0/commit/381e15f39d07d3cdf6aaaa25c0f2321f817935f7</ref>
      <ref url="https://www.htbridge.com/advisory/HTB23203" source="MISC">https://www.htbridge.com/advisory/HTB23203</ref>
      <ref url="http://xforce.iss.net/xforce/xfdb/91538" source="XF">ilchcms-cve20141944-xss(91538)</ref>
      <ref url="http://www.securityfocus.com/archive/1/archive/1/531350/100/0/threaded" source="BUGTRAQ">20140305 Cross-Site Scripting (XSS) in Ilch CMS</ref>
      <ref url="http://www.exploit-db.com/exploits/32076" source="EXPLOIT-DB">32076</ref>
    </refs>
    <vuln_soft>
      <prod vendor="ilch" name="ilch_cms">
        <vers prev="1" num="2.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1945" published="2014-03-09" name="CVE-2014-1945" modified="2014-03-10" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">SQL injection vulnerability in ajax_udf.php in OpenDocMan before 1.2.7.2 allows remote attackers to execute arbitrary SQL commands via the add_value parameter.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.opendocman.com/opendocman-v1-2-7-2-released" source="MISC" patch="1" adv="1">http://www.opendocman.com/opendocman-v1-2-7-2-released</ref>
      <ref url="http://www.opendocman.com/opendocman-v1-2-7-1-release" source="MISC" patch="1" adv="1">http://www.opendocman.com/opendocman-v1-2-7-1-release</ref>
      <ref url="https://www.htbridge.com/advisory/HTB23202" source="MISC">https://www.htbridge.com/advisory/HTB23202</ref>
      <ref url="http://www.securityfocus.com/bid/65775" source="BID">65775</ref>
      <ref url="http://secunia.com/advisories/56189" source="SECUNIA" adv="1">56189</ref>
    </refs>
    <vuln_soft>
      <prod vendor="opendocman" name="opendocman">
        <vers num="1.2.6.2" edition="-"/>
        <vers num="1.2.6.2" edition="a"/>
        <vers num="1.2.6.2" edition="b"/>
        <vers num="1.2.6.3" edition="-"/>
        <vers num="1.2.6.3" edition="a"/>
        <vers num="1.2.6.5"/>
        <vers num="1.2.6.6"/>
        <vers num="1.2.6.7" edition="-"/>
        <vers num="1.2.6.7" edition="beta"/>
        <vers num="1.2.6.8"/>
        <vers num="1.2.7"/>
        <vers prev="1" num="1.2.7.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-1948" published="2014-02-14" name="CVE-2014-1948" modified="2014-03-08" CVSS_version="2.0" CVSS_vector="(AV:L/AC:H/Au:N/C:P/I:P/A:N)" CVSS_score="2.6" CVSS_impact_subscore="4.9" CVSS_exploit_subscore="1.9" CVSS_base_score="2.6">
    <desc>
      <descript source="cve">OpenStack Image Registry and Delivery Service (Glance) 2013.2 through 2013.2.1 and Icehouse before icehouse-2 logs a URL containing the Swift store backend password when authentication fails and WARNING level logging is enabled, which allows local users to obtain sensitive information by reading the log.</descript>
    </desc>
    <loss_types>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="https://bugs.launchpad.net/glance/+bug/1275062" source="CONFIRM">https://bugs.launchpad.net/glance/+bug/1275062</ref>
      <ref url="http://www.securityfocus.com/bid/65507" source="BID">65507</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/02/12/18" source="MLIST">[oss-security] 20140212 [OSSA 2014-004] Glance Swift store backend password leak  (CVE-2014-1948)</ref>
      <ref url="http://secunia.com/advisories/56419" source="SECUNIA">56419</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0229.html" source="REDHAT">RHSA-2014:0229</ref>
    </refs>
    <vuln_soft>
      <prod vendor="openstack" name="image_registry_and_delivery_service_(glance)">
        <vers num="2013.2"/>
        <vers num="2013.2.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1950" published="2014-02-14" name="CVE-2014-1950" modified="2014-04-19" CVSS_version="2.0" CVSS_vector="(AV:L/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="4.6" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="3.9" CVSS_base_score="4.6">
    <desc>
      <descript source="cve">Use-after-free vulnerability in the xc_cpupool_getinfo function in Xen 4.1.x through 4.3.x, when using a multithreaded toolstack, does not properly handle a failure by the xc_cpumap_alloc function, which allows local users with access to management functions to cause a denial of service (heap corruption) and possibly gain privileges via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="http://xenbits.xen.org/xsa/advisory-88.html" source="CONFIRM" adv="1">http://xenbits.xen.org/xsa/advisory-88.html</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/02/12/17" source="MLIST">[oss-security] 20140212 Xen Security Advisory 88 (CVE-2014-1950) - use-after-free in xc_cpupool_getinfo() under memory pressure</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00011.html" source="SUSE">SUSE-SU-2014:0373</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00010.html" source="SUSE">SUSE-SU-2014:0372</ref>
    </refs>
    <vuln_soft>
      <prod vendor="xen" name="xen">
        <vers num="4.1.1"/>
        <vers num="4.1.2"/>
        <vers num="4.1.3"/>
        <vers num="4.1.4"/>
        <vers num="4.1.5"/>
        <vers num="4.1.6.1"/>
        <vers num="4.2.0"/>
        <vers num="4.2.1"/>
        <vers num="4.2.2"/>
        <vers num="4.2.3"/>
        <vers num="4.3.0"/>
        <vers num="4.3.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1955" published="2014-04-30" name="CVE-2014-1955" modified="2014-05-01" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in FortiGuard FortiWeb before 5.0.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://www.fortiguard.com/advisory/FG-IR-13-009/" source="CONFIRM" adv="1">http://www.fortiguard.com/advisory/FG-IR-13-009/</ref>
    </refs>
    <vuln_soft>
      <prod vendor="fortinet" name="fortiweb">
        <vers prev="1" num="5.0.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1956" published="2014-04-30" name="CVE-2014-1956" modified="2014-05-01" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">CRLF injection vulnerability in FortiGuard FortiWeb before 5.0.3 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.</descript>
      <descript source="nvd">CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') "http://cwe.mitre.org/data/definitions/113.html"</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.fortiguard.com/advisory/FG-IR-13-009/" source="CONFIRM" adv="1">http://www.fortiguard.com/advisory/FG-IR-13-009/</ref>
    </refs>
    <vuln_soft>
      <prod vendor="fortinet" name="fortiweb">
        <vers prev="1" num="5.0.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1957" published="2014-04-30" name="CVE-2014-1957" modified="2014-05-01" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:P/I:P/A:P)" CVSS_score="6.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.0" CVSS_base_score="6.5">
    <desc>
      <descript source="cve">FortiGuard FortiWeb before 5.0.3 allows remote authenticated users to gain privileges via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
      <sec_prot user="1"/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.fortiguard.com/advisory/FG-IR-13-009/" source="CONFIRM" adv="1">http://www.fortiguard.com/advisory/FG-IR-13-009/</ref>
    </refs>
    <vuln_soft>
      <prod vendor="fortinet" name="fortiweb">
        <vers prev="1" num="5.0.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1959" published="2014-03-06" name="CVE-2014-1959" modified="2014-03-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:N)" CVSS_score="5.8" CVSS_impact_subscore="4.9" CVSS_exploit_subscore="8.6" CVSS_base_score="5.8">
    <desc>
      <descript source="cve">lib/x509/verify.c in GnuTLS before 3.1.21 and 3.2.x before 3.2.11 treats version 1 X.509 certificates as intermediate CAs, which allows remote attackers to bypass intended restrictions by leveraging a X.509 V1 certificate from a trusted CA to issue new certificates.</descript>
    </desc>
    <loss_types>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://www.gitorious.org/gnutls/gnutls/commit/b1abfe3d182d68539900092eb42fc62cf1bb7e7c" source="CONFIRM" patch="1">https://www.gitorious.org/gnutls/gnutls/commit/b1abfe3d182d68539900092eb42fc62cf1bb7e7c</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2121-1" source="UBUNTU">USN-2121-1</ref>
      <ref url="http://www.gnutls.org/security.html" source="CONFIRM" adv="1">http://www.gnutls.org/security.html</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2866" source="DEBIAN">DSA-2866</ref>
      <ref url="http://seclists.org/oss-sec/2014/q1/345" source="MLIST">[oss-security] 20140213 Re: CVE Request - GnuTLS corrects flaw in certificate verification (3.1.x/3.2.x)</ref>
      <ref url="http://seclists.org/oss-sec/2014/q1/344" source="MLIST">[oss-security] 20140213 CVE Request - GnuTLS corrects flaw in certificate verification (3.1.x/3.2.x)</ref>
    </refs>
    <vuln_soft>
      <prod vendor="gnu" name="gnutls">
        <vers num="3.1.0"/>
        <vers num="3.1.1"/>
        <vers num="3.1.10"/>
        <vers num="3.1.11"/>
        <vers num="3.1.12"/>
        <vers num="3.1.13"/>
        <vers num="3.1.14"/>
        <vers num="3.1.15"/>
        <vers num="3.1.16"/>
        <vers num="3.1.17"/>
        <vers num="3.1.18"/>
        <vers num="3.1.19"/>
        <vers num="3.1.2"/>
        <vers prev="1" num="3.1.20"/>
        <vers num="3.1.3"/>
        <vers num="3.1.4"/>
        <vers num="3.1.5"/>
        <vers num="3.1.6"/>
        <vers num="3.1.7"/>
        <vers num="3.1.8"/>
        <vers num="3.1.9"/>
        <vers num="3.2.0"/>
        <vers num="3.2.1"/>
        <vers prev="1" num="3.2.10"/>
        <vers num="3.2.2"/>
        <vers num="3.2.3"/>
        <vers num="3.2.4"/>
        <vers num="3.2.5"/>
        <vers num="3.2.6"/>
        <vers num="3.2.7"/>
        <vers num="3.2.8"/>
        <vers num="3.2.8.1"/>
        <vers num="3.2.9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1960" published="2014-02-14" name="CVE-2014-1960" modified="2014-02-21" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:N/A:N)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">The Solution Manager in SAP NetWeaver does not properly restrict access, which allows remote attackers to obtain sensitive information via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://service.sap.com/sap/support/notes/1828885" source="CONFIRM">https://service.sap.com/sap/support/notes/1828885</ref>
      <ref url="http://xforce.iss.net/xforce/xfdb/91093" source="XF">netweaver-solution-info-disc(91093)</ref>
      <ref url="http://secunia.com/advisories/56942" source="SECUNIA" adv="1">56942</ref>
      <ref url="http://scn.sap.com/docs/DOC-8218" source="CONFIRM">http://scn.sap.com/docs/DOC-8218</ref>
      <ref url="http://erpscan.com/advisories/erpscan-14-004-sap-netweaver-solution-manager-missing-authorization-check-information-disclosure/" source="MISC">http://erpscan.com/advisories/erpscan-14-004-sap-netweaver-solution-manager-missing-authorization-check-information-disclosure/</ref>
    </refs>
    <vuln_soft>
      <prod vendor="sap" name="netweaver">
        <vers num="-"/>
      </prod>
      <prod vendor="sap" name="netweaver_solution_manager">
        <vers num="7.0"/>
        <vers num="7.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1961" published="2014-02-14" name="CVE-2014-1961" modified="2014-02-21" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:N/A:N)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">Unspecified vulnerability in the Portal WebDynPro in SAP NetWeaver allows remote attackers to obtain sensitive path information via unknown attack vectors.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://service.sap.com/sap/support/notes/1852146" source="CONFIRM">https://service.sap.com/sap/support/notes/1852146</ref>
      <ref url="http://xforce.iss.net/xforce/xfdb/91096" source="XF">netweaver-webdyn-path-disclosure(91096)</ref>
      <ref url="http://secunia.com/advisories/56947" source="SECUNIA" adv="1">56947</ref>
      <ref url="http://scn.sap.com/docs/DOC-8218" source="CONFIRM">http://scn.sap.com/docs/DOC-8218</ref>
      <ref url="http://erpscan.com/advisories/erpscan-14-002-sap-portal-webdynpro-path-disclosure/" source="MISC">http://erpscan.com/advisories/erpscan-14-002-sap-portal-webdynpro-path-disclosure/</ref>
    </refs>
    <vuln_soft>
      <prod vendor="sap" name="netweaver">
        <vers num="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1962" published="2014-02-14" name="CVE-2014-1962" modified="2014-02-21" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:N/A:N)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">Gwsync in SAP CRM 7.02 EHP 2 allows remote attackers to obtain sensitive information via unspecified vectors, related to an XML External Entity (XXE) issue.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://service.sap.com/sap/support/notes/1917054" source="CONFIRM">https://service.sap.com/sap/support/notes/1917054</ref>
      <ref url="http://xforce.iss.net/xforce/xfdb/91098" source="XF">sap-crm-info-disc(91098)</ref>
      <ref url="http://secunia.com/advisories/56944" source="SECUNIA" adv="1">56944</ref>
      <ref url="http://scn.sap.com/docs/DOC-8218" source="CONFIRM">http://scn.sap.com/docs/DOC-8218</ref>
      <ref url="http://erpscan.com/advisories/erpscan-14-003-sap-crm-gwsync-xxe/" source="MISC">http://erpscan.com/advisories/erpscan-14-003-sap-crm-gwsync-xxe/</ref>
    </refs>
    <vuln_soft>
      <prod vendor="sap" name="customer_relationship_management">
        <vers num="7.02" edition="ehp2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1963" published="2014-02-14" name="CVE-2014-1963" modified="2014-02-21" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:P)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">Unspecified vulnerability in Message Server in SAP NetWeaver 7.20 allows remote attackers to cause a denial of service via unknown attack vectors.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://service.sap.com/sap/support/notes/1773912" source="CONFIRM">https://service.sap.com/sap/support/notes/1773912</ref>
      <ref url="http://xforce.iss.net/xforce/xfdb/91097" source="XF">netweaver-message-server-dos(91097)</ref>
      <ref url="http://secunia.com/advisories/56947" source="SECUNIA" adv="1">56947</ref>
      <ref url="http://scn.sap.com/docs/DOC-8218" source="CONFIRM">http://scn.sap.com/docs/DOC-8218</ref>
      <ref url="http://erpscan.com/advisories/erpscan-14-001-sap-netweaver-message-server-dos/" source="MISC">http://erpscan.com/advisories/erpscan-14-001-sap-netweaver-message-server-dos/</ref>
    </refs>
    <vuln_soft>
      <prod vendor="sap" name="netweaver">
        <vers num="7.20"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1964" published="2014-02-14" name="CVE-2014-1964" modified="2014-02-21" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in the Integration Repository in the SAP Exchange Infrastructure (BC-XI) component in SAP NetWeaver allows remote attackers to inject arbitrary web script or HTML via vectors related to the ESR application and a DIR error.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="https://service.sap.com/sap/support/notes/1788080" source="CONFIRM">https://service.sap.com/sap/support/notes/1788080</ref>
      <ref url="http://xforce.iss.net/xforce/xfdb/91095" source="XF">netweaver-dir-xss(91095)</ref>
      <ref url="http://secunia.com/advisories/56947" source="SECUNIA">56947</ref>
      <ref url="http://scn.sap.com/docs/DOC-8218" source="CONFIRM">http://scn.sap.com/docs/DOC-8218</ref>
      <ref url="http://erpscan.com/advisories/erpscan-14-005-sap-netweaver-dir-error-xss/" source="MISC">http://erpscan.com/advisories/erpscan-14-005-sap-netweaver-dir-error-xss/</ref>
    </refs>
    <vuln_soft>
      <prod vendor="sap" name="netweaver">
        <vers num="-"/>
      </prod>
      <prod vendor="sap" name="netweaver_exchange_infrastructure_(bc-xi)">
        <vers num="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1965" published="2014-02-14" name="CVE-2014-1965" modified="2014-02-21" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in ISpeakAdapter in the Integration Repository in the SAP Exchange Infrastructure (BC-XI) component 3.0, 7.00 through 7.02, and 7.10 through 7.11 for SAP NetWeaver allows remote attackers to inject arbitrary web script or HTML via vectors related to PIP.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="https://service.sap.com/sap/support/notes/1442517" source="CONFIRM">https://service.sap.com/sap/support/notes/1442517</ref>
      <ref url="http://xforce.iss.net/xforce/xfdb/91094" source="XF">netweaver-ispeakadapter-xss(91094)</ref>
      <ref url="http://www.stechno.net/sap-notes.html?view=sapnote&amp;id=1442517" source="MISC">http://www.stechno.net/sap-notes.html?view=sapnote&amp;id=1442517</ref>
      <ref url="http://secunia.com/advisories/56947" source="SECUNIA" adv="1">56947</ref>
      <ref url="http://erpscan.com/advisories/erpscan-14-006-sap-netweaver-pip-xss/" source="MISC">http://erpscan.com/advisories/erpscan-14-006-sap-netweaver-pip-xss/</ref>
    </refs>
    <vuln_soft>
      <prod vendor="sap" name="netweaver">
        <vers num="3.0"/>
        <vers num="7.0"/>
        <vers num="7.01"/>
        <vers num="7.02"/>
        <vers num="7.10"/>
        <vers num="7.11"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1966" published="2014-02-23" name="CVE-2014-1966" modified="2014-02-24" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:C)" CVSS_score="7.8" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="10.0" CVSS_base_score="7.8">
    <desc>
      <descript source="cve">The SNMP implementation in Siemens RuggedCom ROS before 3.11, ROS 3.11 for RS950G, ROS 3.12 before 3.12.4, and ROS 4.0 for RSG2488 allows remote attackers to cause a denial of service (device outage) via crafted packets.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://ics-cert.us-cert.gov/advisories/ICSA-14-051-03" source="MISC">http://ics-cert.us-cert.gov/advisories/ICSA-14-051-03</ref>
      <ref url="http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-892342.pdf" source="CONFIRM" adv="1">http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-892342.pdf</ref>
    </refs>
    <vuln_soft>
      <prod vendor="siemens" name="ruggedcom_rugged_operating_system">
        <vers num="3.12"/>
        <vers num="3.12.1"/>
        <vers num="3.12.2"/>
        <vers num="3.2.5"/>
        <vers num="3.3.6"/>
        <vers num="3.4.9"/>
        <vers num="3.5.4"/>
        <vers num="3.6.6"/>
        <vers num="3.7.9"/>
        <vers num="3.8.5"/>
        <vers num="3.9.3"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1967" published="2014-02-26" name="CVE-2014-1967" modified="2014-02-27" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:N)" CVSS_score="5.8" CVSS_impact_subscore="4.9" CVSS_exploit_subscore="8.6" CVSS_base_score="5.8">
    <desc>
      <descript source="cve">The Denny's application before 2.0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.</descript>
    </desc>
    <loss_types>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://play.google.com/store/apps/details?id=jp.denimoba" source="CONFIRM">https://play.google.com/store/apps/details?id=jp.denimoba</ref>
      <ref url="http://jvndb.jvn.jp/jvndb/JVNDB-2014-000022" source="JVNDB">JVNDB-2014-000022</ref>
      <ref url="http://jvn.jp/en/jp/JVN48810179/index.html" source="JVN">JVN#48810179</ref>
    </refs>
    <vuln_soft>
      <prod vendor="7andi-fs.co" name="denny's">
        <vers num="1.0.1" edition=":~~~android~~"/>
        <vers num="1.0.2" edition=":~~~android~~"/>
        <vers prev="1" num="2.0.0" edition=":~~~android~~"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1968" published="2014-02-26" name="CVE-2014-1968" modified="2014-02-27" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in the XooNIps module 3.47 and earlier for XOOPS allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://xoonips.sourceforge.jp" source="CONFIRM" patch="1">http://xoonips.sourceforge.jp</ref>
      <ref url="http://jvndb.jvn.jp/jvndb/JVNDB-2014-000025" source="JVNDB">JVNDB-2014-000025</ref>
      <ref url="http://jvn.jp/en/jp/JVN87797318/index.html" source="JVN">JVN#87797318</ref>
    </refs>
    <vuln_soft>
      <prod vendor="riken" name="xoonips">
        <vers num="3.40" edition=":~~~xoops~~"/>
        <vers num="3.41" edition=":~~~xoops~~"/>
        <vers num="3.42" edition=":~~~xoops~~"/>
        <vers num="3.43" edition=":~~~xoops~~"/>
        <vers num="3.44" edition=":~~~xoops~~"/>
        <vers num="3.45" edition=":~~~xoops~~"/>
        <vers num="3.46" edition=":~~~xoops~~"/>
        <vers prev="1" num="3.47" edition=":~~~xoops~~"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1969" published="2014-04-11" name="CVE-2014-1969" modified="2014-04-14" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:P)" CVSS_score="5.8" CVSS_impact_subscore="4.9" CVSS_exploit_subscore="8.6" CVSS_base_score="5.8">
    <desc>
      <descript source="cve">Directory traversal vulnerability in the apps4u@android SD Card Manager application before 20140224 for Android allows attackers to overwrite or create arbitrary files via a crafted filename.</descript>
    </desc>
    <loss_types>
      <avail/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://jvndb.jvn.jp/jvndb/JVNDB-2014-000035" source="JVNDB">JVNDB-2014-000035</ref>
      <ref url="http://jvn.jp/en/jp/JVN47386847/index.html" source="JVN">JVN#47386847</ref>
    </refs>
    <vuln_soft>
      <prod vendor="apps4u@android" name="sd_card_manager">
        <vers prev="1" num="20140223" edition=":~~~android~~"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1970" published="2014-03-20" name="CVE-2014-1970" modified="2014-03-20" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:P)" CVSS_score="5.8" CVSS_impact_subscore="4.9" CVSS_exploit_subscore="8.6" CVSS_base_score="5.8">
    <desc>
      <descript source="cve">Directory traversal vulnerability in the ES File Explorer File Manager application before 3.0.4 for Android allows remote attackers to overwrite or create arbitrary files via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <avail/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://jvndb.jvn.jp/jvndb/JVNDB-2014-000033" source="JVNDB">JVNDB-2014-000033</ref>
      <ref url="http://jvn.jp/en/jp/JVN70029459/index.html" source="JVN">JVN#70029459</ref>
    </refs>
    <vuln_soft>
      <prod vendor="estrongs" name="es_file_explorer">
        <vers num="1.6.0.2" edition=":~~~android~~"/>
        <vers num="1.6.1.1" edition=":~~~android~~"/>
        <vers prev="1" num="3.0.0" edition=":~~~android~~"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1971" published="2014-03-20" name="CVE-2014-1971" modified="2014-03-20" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in Silex before 2.0.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="https://github.com/silexlabs/Silex/blob/master/docs/change-log.md" source="MISC">https://github.com/silexlabs/Silex/blob/master/docs/change-log.md</ref>
      <ref url="http://jvndb.jvn.jp/jvndb/JVNDB-2014-000032" source="JVNDB">JVNDB-2014-000032</ref>
      <ref url="http://jvn.jp/en/jp/JVN14282890/index.html" source="JVN">JVN#14282890</ref>
    </refs>
    <vuln_soft>
      <prod vendor="silexlabs" name="silex">
        <vers prev="1" num="2.0.0" edition="alpha5"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1974" published="2014-04-19" name="CVE-2014-1974" modified="2014-04-24" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:P/A:P)" CVSS_score="6.4" CVSS_impact_subscore="4.9" CVSS_exploit_subscore="10.0" CVSS_base_score="6.4">
    <desc>
      <descript source="cve">Directory traversal vulnerability in the LYSESOFT AndExplorer application before 20140403 and AndExplorerPro application before 20140405 for Android allows attackers to overwrite or create arbitrary files via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <avail/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://play.google.com/store/apps/details?id=lysesoft.andexplorerpro" source="CONFIRM">https://play.google.com/store/apps/details?id=lysesoft.andexplorerpro</ref>
      <ref url="https://play.google.com/store/apps/details?id=lysesoft.andexplorer" source="CONFIRM">https://play.google.com/store/apps/details?id=lysesoft.andexplorer</ref>
      <ref url="http://jvndb.jvn.jp/jvndb/JVNDB-2014-000037" source="JVNDB">JVNDB-2014-000037</ref>
      <ref url="http://jvn.jp/en/jp/JVN22670349/index.html" source="JVN">JVN#22670349</ref>
    </refs>
    <vuln_soft>
      <prod vendor="lyesoft" name="andexplorer">
        <vers num="1.0" edition=":~~professional~android~~"/>
        <vers num="1.0" edition=":~~~android~~"/>
        <vers num="1.1" edition=":~~professional~android~~"/>
        <vers num="1.1" edition=":~~~android~~"/>
        <vers num="1.2" edition=":~~professional~android~~"/>
        <vers num="1.2" edition=":~~~android~~"/>
        <vers num="1.3" edition=":~~professional~android~~"/>
        <vers num="1.3" edition=":~~~android~~"/>
        <vers num="1.4" edition=":~~~android~~"/>
        <vers num="1.4" edition=":~~professional~android~~"/>
        <vers num="1.5" edition=":~~professional~android~~"/>
        <vers num="1.5" edition=":~~~android~~"/>
        <vers num="1.6" edition=":~~professional~android~~"/>
        <vers num="1.6" edition=":~~~android~~"/>
        <vers num="1.7" edition=":~~professional~android~~"/>
        <vers num="1.7" edition=":~~~android~~"/>
        <vers num="1.8" edition=":~~professional~android~~"/>
        <vers num="1.8" edition=":~~~android~~"/>
        <vers num="1.9" edition=":~~professional~android~~"/>
        <vers num="1.9" edition=":~~~android~~"/>
        <vers num="2.0" edition=":~~professional~android~~"/>
        <vers num="2.1" edition=":~~~android~~"/>
        <vers num="2.1" edition=":~~professional~android~~"/>
        <vers num="2.2" edition=":~~~android~~"/>
        <vers num="2.2" edition=":~~professional~android~~"/>
        <vers num="2.3" edition=":~~~android~~"/>
        <vers num="2.3" edition=":~~professional~android~~"/>
        <vers num="2.4" edition=":~~~android~~"/>
        <vers num="2.4" edition=":~~professional~android~~"/>
        <vers num="2.5" edition=":~~~android~~"/>
        <vers num="3.0" edition=":~~~android~~"/>
        <vers num="3.0" edition=":~~professional~android~~"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1975" published="2014-03-18" name="CVE-2014-1975" modified="2014-03-18" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:P)" CVSS_score="5.8" CVSS_impact_subscore="4.9" CVSS_exploit_subscore="8.6" CVSS_base_score="5.8">
    <desc>
      <descript source="cve">Directory traversal vulnerability in the R-Company Unzipper application 1.0.1 and earlier for Android allows remote attackers to overwrite or create arbitrary files via a crafted filename.</descript>
    </desc>
    <loss_types>
      <avail/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="https://play.google.com/store/apps/details?id=org.rhorita777.unzipper" source="CONFIRM">https://play.google.com/store/apps/details?id=org.rhorita777.unzipper</ref>
      <ref url="http://jvndb.jvn.jp/jvndb/JVNDB-2014-000031" source="JVNDB">JVNDB-2014-000031</ref>
      <ref url="http://jvn.jp/en/jp/JVN38227002/index.html" source="JVN">JVN#38227002</ref>
      <ref url="http://jvn.jp/en/jp/JVN38227002/995495/index.html" source="CONFIRM">http://jvn.jp/en/jp/JVN38227002/995495/index.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="r-company" name="unzipper">
        <vers num="1.0.0" edition=":~~~android~~"/>
        <vers prev="1" num="1.0.1" edition=":~~~android~~"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1976" published="2014-03-18" name="CVE-2014-1976" modified="2014-03-18" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:N)" CVSS_score="5.8" CVSS_impact_subscore="4.9" CVSS_exploit_subscore="8.6" CVSS_base_score="5.8">
    <desc>
      <descript source="cve">The Demaecan application 2.1.0 and earlier for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.</descript>
    </desc>
    <loss_types>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://play.google.com/store/apps/details?id=com.demaecan.androidapp" source="MISC">https://play.google.com/store/apps/details?id=com.demaecan.androidapp</ref>
      <ref url="http://jvndb.jvn.jp/jvndb/JVNDB-2014-000030" source="JVNDB">JVNDB-2014-000030</ref>
      <ref url="http://jvn.jp/en/jp/JVN16263849/index.html" source="JVN">JVN#16263849</ref>
    </refs>
    <vuln_soft>
      <prod vendor="yumenomachi" name="demaecan">
        <vers num="2.0.0" edition=":~~~android~~"/>
        <vers prev="1" num="2.1.0" edition=":~~~android~~"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1977" published="2014-03-19" name="CVE-2014-1977" modified="2014-03-20" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:N/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">The NTT DOCOMO sp mode mail application 6300 and earlier for Android 4.0.x and 6700 and earlier for Android 4.1 through 4.4 uses weak permissions for attachments during processing of incoming e-mail messages, which allows attackers to obtain sensitive information via a crafted application.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://jvndb.jvn.jp/jvndb/JVNDB-2014-000027" source="JVNDB">JVNDB-2014-000027</ref>
      <ref url="http://jvn.jp/en/jp/JVN81739241/index.html" source="JVN">JVN#81739241</ref>
    </refs>
    <vuln_soft>
      <prod vendor="nttdocomo" name="spmode_mail_android">
        <vers num="2546"/>
        <vers num="2631"/>
        <vers num="3000"/>
        <vers num="3100"/>
        <vers num="3200"/>
        <vers num="3300"/>
        <vers num="3400"/>
        <vers num="4000"/>
        <vers num="4200"/>
        <vers num="4300"/>
        <vers num="4400"/>
        <vers num="4500"/>
        <vers num="4600"/>
        <vers num="4700"/>
        <vers num="4800"/>
        <vers num="4900"/>
        <vers num="5000"/>
        <vers num="5100"/>
        <vers num="5200"/>
        <vers num="5300"/>
        <vers num="5400"/>
        <vers num="5500"/>
        <vers num="5550"/>
        <vers prev="1" num="6300" edition=":~~~android~~"/>
        <vers prev="1" num="6700" edition=":~~~android~~"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1978" published="2014-03-19" name="CVE-2014-1978" modified="2014-03-20" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:N/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">The application link interface in the NTT DOCOMO sp mode mail application 6100 through 6300 for Android 4.0.x and 6130 through 6700 for Android 4.1 through 4.4 writes message content to the SD card during e-mail composition, which allows attackers to obtain sensitive information via a crafted application.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://jvndb.jvn.jp/jvndb/JVNDB-2014-000028" source="JVNDB">JVNDB-2014-000028</ref>
      <ref url="http://jvn.jp/en/jp/JVN05951929/index.html" source="JVN">JVN#05951929</ref>
    </refs>
    <vuln_soft>
      <prod vendor="nttdocomo" name="spmode_mail_android">
        <vers num="6100" edition=":~~~android~~"/>
        <vers num="6130" edition=":~~~android~~"/>
        <vers num="6300" edition=":~~~android~~"/>
        <vers num="6700" edition=":~~~android~~"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1979" published="2014-03-19" name="CVE-2014-1979" modified="2014-03-20" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:P)" CVSS_score="6.8" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.6" CVSS_base_score="6.8">
    <desc>
      <descript source="cve">The NTT DOCOMO sp mode mail application 5900 through 6300 for Android 4.0.x and 6000 through 6620 for Android 4.1 through 4.4 allows remote attackers to execute arbitrary Java methods via Deco-mail emoticon POP data in an e-mail message.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://jvndb.jvn.jp/jvndb/JVNDB-2014-000029" source="JVNDB">JVNDB-2014-000029</ref>
      <ref url="http://jvn.jp/en/jp/JVN89260331/index.html" source="JVN">JVN#89260331</ref>
    </refs>
    <vuln_soft>
      <prod vendor="nttdocomo" name="spmode_mail_android">
        <vers num="5900" edition=":~~~android~~"/>
        <vers num="6000" edition=":~~~android~~"/>
        <vers num="6200" edition=":~~~android~~"/>
        <vers num="6300" edition=":~~~android~~"/>
        <vers num="6620" edition=":~~~android~~"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1982" published="2014-03-31" name="CVE-2014-1982" modified="2014-03-31" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:C/I:C/A:C)" CVSS_score="10.0" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="10.0" CVSS_base_score="10.0">
    <desc>
      <descript source="cve">The administrative interface in Allied Telesis AT-RG634A ADSL Broadband router 3.3+, iMG624A firmware 3.5, iMG616LH firmware 2.4, and iMG646BD firmware 3.5 allows remote attackers to gain privileges and execute arbitrary commands via a direct request to cli.html.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.exploit-db.com/exploits/32545" source="EXPLOIT-DB">32545</ref>
      <ref url="http://seclists.org/fulldisclosure/2014/Mar/340" source="FULLDISC">20140326 [GTA-2014-01] - Allied Telesis AT-RG634A ADSL Broadband router hidden administrative unauthenticated webshell.</ref>
    </refs>
    <vuln_soft>
      <prod vendor="alliedtelesis" name="at-rg634a">
        <vers num="-"/>
      </prod>
      <prod vendor="alliedtelesis" name="img616lh">
        <vers num="-"/>
      </prod>
      <prod vendor="alliedtelesis" name="img624a">
        <vers num="-"/>
      </prod>
      <prod vendor="alliedtelesis" name="img646bd">
        <vers num="-"/>
      </prod>
      <prod vendor="alliedtelesis" name="at-rg634a_firmware">
        <vers num="3.3+"/>
      </prod>
      <prod vendor="alliedtelesis" name="img616lh_firmware">
        <vers num="+2.4"/>
      </prod>
      <prod vendor="alliedtelesis" name="img624a_firmware">
        <vers num="3.5"/>
      </prod>
      <prod vendor="alliedtelesis" name="img646bd_firmware">
        <vers num="3.5"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-1983" published="2014-04-19" name="CVE-2014-1983" modified="2014-04-21" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:C)" CVSS_score="7.8" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="10.0" CVSS_base_score="7.8">
    <desc>
      <descript source="cve">Unspecified vulnerability in Cybozu Remote Service Manager through 2.3.0 and 3.x before 3.1.1 allows remote attackers to cause a denial of service (CPU consumption) via unknown vectors.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://cs.cybozu.co.jp/information/20130317notice01.php" source="CONFIRM" patch="1" adv="1">http://cs.cybozu.co.jp/information/20130317notice01.php</ref>
      <ref url="http://jvndb.jvn.jp/jvndb/JVNDB-2014-000039" source="JVNDB">JVNDB-2014-000039</ref>
      <ref url="http://jvn.jp/en/jp/JVN10319260/index.html" source="JVN">JVN#10319260</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cybozu" name="remote_service_manager">
        <vers prev="1" num="2.3.0"/>
        <vers prev="1" num="3.1.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1984" published="2014-04-19" name="CVE-2014-1984" modified="2014-04-21" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:P)" CVSS_score="6.8" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.6" CVSS_base_score="6.8">
    <desc>
      <descript source="cve">Session fixation vulnerability in the management screen in Cybozu Remote Service Manager through 2.3.0 and 3.x before 3.1.1 allows remote attackers to hijack web sessions via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://cs.cybozu.co.jp/information/20130317notice02.php" source="CONFIRM" patch="1" adv="1">http://cs.cybozu.co.jp/information/20130317notice02.php</ref>
      <ref url="http://jvndb.jvn.jp/jvndb/JVNDB-2014-000040" source="JVNDB">JVNDB-2014-000040</ref>
      <ref url="http://jvn.jp/en/jp/JVN00058727/index.html" source="JVN">JVN#00058727</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cybozu" name="remote_service_manager">
        <vers prev="1" num="2.3.0"/>
        <vers prev="1" num="3.1.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1985" published="2014-04-11" name="CVE-2014-1985" modified="2014-04-14" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:N)" CVSS_score="5.8" CVSS_impact_subscore="4.9" CVSS_exploit_subscore="8.6" CVSS_base_score="5.8">
    <desc>
      <descript source="cve">Open redirect vulnerability in the redirect_back_or_default function in app/controllers/application_controller.rb in Redmine before 2.4.5 and 2.5.x before 2.5.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the back url (back_url parameter).</descript>
    </desc>
    <loss_types>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://www.redmine.org/projects/redmine/wiki/Security_Advisories" source="CONFIRM" patch="1">http://www.redmine.org/projects/redmine/wiki/Security_Advisories</ref>
      <ref url="https://github.com/redmine/redmine/commit/7567c3d8b21fe67e5f04e6839c1fce061600f2f3" source="CONFIRM">https://github.com/redmine/redmine/commit/7567c3d8b21fe67e5f04e6839c1fce061600f2f3</ref>
      <ref url="http://www.redmine.org/projects/redmine/wiki/Changelog_2_4" source="CONFIRM">http://www.redmine.org/projects/redmine/wiki/Changelog_2_4</ref>
      <ref url="http://www.redmine.org/projects/redmine/wiki/Changelog" source="CONFIRM">http://www.redmine.org/projects/redmine/wiki/Changelog</ref>
      <ref url="http://secunia.com/advisories/57524" source="SECUNIA" adv="1">57524</ref>
      <ref url="http://seclists.org/oss-sec/2014/q2/84" source="MLIST">[oss-security] 20140410 Re: CVE request: redmine open redirector</ref>
    </refs>
    <vuln_soft>
      <prod vendor="redmine" name="redmine">
        <vers num="2.4.0"/>
        <vers num="2.4.1"/>
        <vers num="2.4.2"/>
        <vers num="2.4.3"/>
        <vers prev="1" num="2.4.4"/>
        <vers num="2.5.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1986" published="2014-04-15" name="CVE-2014-1986" modified="2014-04-19" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:N)" CVSS_score="5.8" CVSS_impact_subscore="4.9" CVSS_exploit_subscore="8.6" CVSS_base_score="5.8">
    <desc>
      <descript source="cve">The Content Provider in the KOKUYO CamiApp application 1.21.1 and earlier for Android allows attackers to bypass intended access restrictions and read database information via a crafted application.</descript>
    </desc>
    <loss_types>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://play.google.com/store/apps/details?id=jp.co.kokuyost.CamiApp" source="CONFIRM">https://play.google.com/store/apps/details?id=jp.co.kokuyost.CamiApp</ref>
      <ref url="http://jvndb.jvn.jp/jvndb/JVNDB-2014-000036" source="JVNDB">JVNDB-2014-000036</ref>
      <ref url="http://jvn.jp/en/jp/JVN55438786/index.html" source="JVN">JVN#55438786</ref>
    </refs>
    <vuln_soft>
      <prod vendor="kokuyo" name="camiapp">
        <vers prev="1" num="1.21.1" edition=":~~~android~~"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-1988" published="2014-05-02" name="CVE-2014-1988" modified="2014-05-02" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:S/C:N/I:N/A:P)" CVSS_score="3.5" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="6.8" CVSS_base_score="3.5">
    <desc>
      <descript source="cve">The Phone Messages feature in Cybozu Garoon 2.0.0 through 3.7 SP2 allows remote authenticated users to cause a denial of service (resource consumption) via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://support.cybozu.com/ja-jp/article/8105" source="CONFIRM" adv="1">https://support.cybozu.com/ja-jp/article/8105</ref>
      <ref url="http://jvndb.jvn.jp/jvndb/JVNDB-2014-000042" source="JVNDB">JVNDB-2014-000042</ref>
      <ref url="http://jvn.jp/en/jp/JVN90519014/index.html" source="JVN">JVN#90519014</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cybozu" name="garoon">
        <vers num="2.0.0"/>
        <vers num="2.1.0"/>
        <vers num="2.1.1"/>
        <vers num="2.1.2"/>
        <vers num="2.1.3"/>
        <vers num="2.5.0"/>
        <vers num="2.5.1"/>
        <vers num="2.5.2"/>
        <vers num="2.5.3"/>
        <vers num="2.5.4"/>
        <vers num="3.0.0"/>
        <vers num="3.0.1"/>
        <vers num="3.0.2"/>
        <vers num="3.0.3"/>
        <vers num="3.1.0"/>
        <vers num="3.1.1"/>
        <vers num="3.1.2"/>
        <vers num="3.1.3"/>
        <vers num="3.5.0"/>
        <vers num="3.5.1"/>
        <vers num="3.5.2"/>
        <vers num="3.5.3"/>
        <vers num="3.5.4"/>
        <vers num="3.5.5"/>
        <vers num="3.7" edition="sp1"/>
        <vers num="3.7" edition="sp2"/>
        <vers num="3.7.0"/>
        <vers num="3.7.1"/>
        <vers num="3.7.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1989" published="2014-05-02" name="CVE-2014-1989" modified="2014-05-02" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:S/C:P/I:P/A:P)" CVSS_score="6.0" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="6.8" CVSS_base_score="6.0">
    <desc>
      <descript source="cve">Cybozu Garoon 3.0 through 3.7 SP3 allows remote authenticated users to bypass intended access restrictions and delete schedule information via unspecified API calls.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://support.cybozu.com/ja/article/5264" source="CONFIRM" adv="1">https://support.cybozu.com/ja/article/5264</ref>
      <ref url="http://jvndb.jvn.jp/jvndb/JVNDB-2014-000043" source="JVNDB">JVNDB-2014-000043</ref>
      <ref url="http://jvn.jp/en/jp/JVN31230946/index.html" source="JVN">JVN#31230946</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cybozu" name="garoon">
        <vers num="3.0.0"/>
        <vers num="3.0.1"/>
        <vers num="3.0.2"/>
        <vers num="3.0.3"/>
        <vers num="3.1.0"/>
        <vers num="3.1.1"/>
        <vers num="3.1.2"/>
        <vers num="3.1.3"/>
        <vers num="3.5.0"/>
        <vers num="3.5.1"/>
        <vers num="3.5.2"/>
        <vers num="3.5.3"/>
        <vers num="3.5.4"/>
        <vers num="3.5.5"/>
        <vers num="3.7" edition="sp1"/>
        <vers num="3.7" edition="sp2"/>
        <vers num="3.7" edition="sp3"/>
        <vers num="3.7.0"/>
        <vers num="3.7.1"/>
        <vers num="3.7.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-1990" published="2014-04-19" name="CVE-2014-1990" modified="2014-04-21" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:P)" CVSS_score="6.8" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.6" CVSS_base_score="6.8">
    <desc>
      <descript source="cve">Cross-site request forgery (CSRF) vulnerability in TopAccess (aka the web-based management utility) on TOSHIBA TEC e-Studio 232, 233, 282, and 283 devices allows remote attackers to hijack the authentication of administrators for requests that change passwords.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://www.toshibatec.co.jp/page.jsp?id=4224" source="CONFIRM">http://www.toshibatec.co.jp/page.jsp?id=4224</ref>
      <ref url="http://jvndb.jvn.jp/jvndb/JVNDB-2014-000038" source="JVNDB">JVNDB-2014-000038</ref>
      <ref url="http://jvn.jp/en/jp/JVN13313061/index.html" source="JVN">JVN#13313061</ref>
    </refs>
    <vuln_soft>
      <prod vendor="toshibatec" name="e-studio-232">
        <vers num="-"/>
      </prod>
      <prod vendor="toshibatec" name="e-studio-233">
        <vers num="-"/>
      </prod>
      <prod vendor="toshibatec" name="e-studio-282">
        <vers num="-"/>
      </prod>
      <prod vendor="toshibatec" name="e-studio-283">
        <vers num="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2013" published="2014-03-03" name="CVE-2014-2013" modified="2014-03-07" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">Stack-based buffer overflow in the xps_parse_color function in xps/xps-common.c in MuPDF 1.3 and earlier allows remote attackers to execute arbitrary code via a large number of entries in the ContextColor value of the Fill attribute in a Path element.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.hdwsec.fr/blog/mupdf.html" source="MISC">http://www.hdwsec.fr/blog/mupdf.html</ref>
      <ref url="http://seclists.org/oss-sec/2014/q1/375" source="MLIST">[oss-security] 20140218 Re: CVE request: MuPDF Stack-based Buffer Overflow in xps_parse_color()</ref>
      <ref url="http://seclists.org/fulldisclosure/2014/Jan/130" source="FULLDISC">20140120 0day - MuPDF Stack-based Buffer Overflow in xps_parse_color()</ref>
      <ref url="http://lists.opensuse.org/opensuse-updates/2014-02/msg00088.html" source="SUSE">openSUSE-SU-2014:0309</ref>
      <ref url="http://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=60dabde18d7fe12b19da8b509bdfee9cc886aafc" source="CONFIRM">http://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=60dabde18d7fe12b19da8b509bdfee9cc886aafc</ref>
      <ref url="http://bugs.ghostscript.com/show_bug.cgi?id=694957" source="CONFIRM">http://bugs.ghostscript.com/show_bug.cgi?id=694957</ref>
    </refs>
    <vuln_soft>
      <prod vendor="artifex" name="mupdf">
        <vers num="1.0"/>
        <vers num="1.1"/>
        <vers num="1.2"/>
        <vers prev="1" num="1.3"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2014" published="2014-04-18" name="CVE-2014-2014" modified="2014-04-21" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:N/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">imapsync before 1.584, when running with the --tls option, attempts a cleartext login when a certificate verification failure occurs, which allows remote attackers to obtain credentials by sniffing the network.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://seclists.org/oss-sec/2014/q1/378" source="MLIST" patch="1">[oss-security] 20140218 Re: CVE request: "imapsync ignores the --tls switch and sends my authentication plaintext."</ref>
      <ref url="https://lists.fedoraproject.org/pipermail/package-announce/2014-February/128293.html" source="FEDORA">FEDORA-2014-2505</ref>
      <ref url="https://github.com/imapsync/imapsync/issues/15" source="CONFIRM">https://github.com/imapsync/imapsync/issues/15</ref>
      <ref url="https://bugs.mageia.org/show_bug.cgi?id=12770" source="CONFIRM">https://bugs.mageia.org/show_bug.cgi?id=12770</ref>
      <ref url="http://www.mandriva.com/security/advisories?name=MDVSA-2014:060" source="MANDRIVA">MDVSA-2014:060</ref>
      <ref url="http://www.linux-france.org/prj/imapsync_list/msg01910.html" source="MLIST">[imapsync_list] 20140122 Re: [imapsync] Upon certificate issues STARTTLS is ignored and the password sent in plaintext (#15)</ref>
      <ref url="http://www.linux-france.org/prj/imapsync_list/msg01907.html" source="MLIST">[imapsync_list] 20140120 Re: [imapsync] STARTTLS support (#15)</ref>
      <ref url="http://seclists.org/oss-sec/2014/q1/367" source="MLIST">[oss-security] 20140217 CVE request: "imapsync ignores the --tls switch and sends my authentication plaintext."</ref>
    </refs>
    <vuln_soft>
      <prod vendor="gilles_lamiral" name="imapsync">
        <vers num="1.500"/>
        <vers num="1.504"/>
        <vers num="1.508"/>
        <vers num="1.516"/>
        <vers num="1.518"/>
        <vers num="1.525"/>
        <vers num="1.53"/>
        <vers num="1.542"/>
        <vers num="1.547"/>
        <vers num="1.554"/>
        <vers num="1.558"/>
        <vers num="1.564"/>
        <vers num="1.567"/>
        <vers num="1.569"/>
        <vers prev="1" num="1.580"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2016" published="2014-03-25" name="CVE-2014-2016" modified="2014-03-26" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Multiple cross-site scripting (XSS) vulnerabilities in OXID eShop Professional and Community Edition 4.6.8 and earlier, 4.7.x before 4.7.11, and 4.8.x before 4.8.4, and Enterprise Edition 4.6.8 and earlier, 5.0.x before 5.0.11 and 5.1.x before 5.1.4 allow remote attackers to inject arbitrary web script or HTML via the searchtag parameter to the getTag function in (1) application/controllers/details.php or (2) application/controllers/tag.php.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://wiki.oxidforge.org/Security_bulletins/2014-001" source="CONFIRM" adv="1">http://wiki.oxidforge.org/Security_bulletins/2014-001</ref>
      <ref url="http://secunia.com/advisories/57438" source="SECUNIA" adv="1">57438</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oxid-esales" name="eshop">
        <vers num="4.6.0" edition=":professional"/>
        <vers num="4.6.0" edition=":community"/>
        <vers num="4.6.0" edition=":enterprise"/>
        <vers num="4.6.1" edition=":professional"/>
        <vers num="4.6.1" edition=":community"/>
        <vers num="4.6.1" edition=":enterprise"/>
        <vers num="4.6.2" edition=":community"/>
        <vers num="4.6.2" edition=":enterprise"/>
        <vers num="4.6.2" edition=":professional"/>
        <vers num="4.6.3" edition=":community"/>
        <vers num="4.6.3" edition=":enterprise"/>
        <vers num="4.6.3" edition=":professional"/>
        <vers num="4.6.4" edition=":community"/>
        <vers num="4.6.4" edition=":professional"/>
        <vers num="4.6.4" edition=":enterprise"/>
        <vers num="4.6.5" edition=":community"/>
        <vers num="4.6.5" edition=":professional"/>
        <vers num="4.6.5" edition=":enterprise"/>
        <vers num="4.6.6" edition=":community"/>
        <vers num="4.6.6" edition=":professional"/>
        <vers num="4.6.6" edition=":enterprise"/>
        <vers num="4.6.7" edition=":community"/>
        <vers num="4.6.7" edition=":professional"/>
        <vers num="4.6.7" edition=":enterprise"/>
        <vers prev="1" num="4.6.8" edition=":professional"/>
        <vers prev="1" num="4.6.8" edition=":enterprise"/>
        <vers num="4.7.0" edition="-:professional"/>
        <vers num="4.7.0" edition="-:community"/>
        <vers num="4.7.1" edition="-:professional"/>
        <vers num="4.7.1" edition="-:community"/>
        <vers num="4.7.10" edition=":professional"/>
        <vers num="4.7.10" edition=":community"/>
        <vers num="4.7.2" edition="-:professional"/>
        <vers num="4.7.2" edition="-:community"/>
        <vers num="4.7.3" edition="-:professional"/>
        <vers num="4.7.3" edition="-:community"/>
        <vers num="4.7.4" edition="-:professional"/>
        <vers num="4.7.4" edition="-:community"/>
        <vers num="4.7.5" edition="-:professional"/>
        <vers num="4.7.5" edition="-:community"/>
        <vers num="4.7.6" edition="-:professional"/>
        <vers num="4.7.6" edition="-:community"/>
        <vers num="4.7.7" edition="-:professional"/>
        <vers num="4.7.7" edition="-:community"/>
        <vers prev="1" num="4.7.8" edition=":community"/>
        <vers prev="1" num="4.7.8" edition="-:professional"/>
        <vers prev="1" num="4.7.8" edition="-:community"/>
        <vers num="4.7.9" edition=":professional"/>
        <vers num="4.7.9" edition=":community"/>
        <vers num="4.8.0" edition=":community"/>
        <vers num="4.8.0" edition=":professional"/>
        <vers num="4.8.1" edition=":community"/>
        <vers num="4.8.1" edition=":professional"/>
        <vers num="4.8.2" edition=":community"/>
        <vers num="4.8.2" edition=":professional"/>
        <vers num="4.8.3" edition=":community"/>
        <vers num="4.8.3" edition=":professional"/>
        <vers num="5.0.0" edition=":enterprise"/>
        <vers num="5.0.1" edition=":enterprise"/>
        <vers num="5.0.10" edition=":enterprise"/>
        <vers num="5.0.2" edition=":enterprise"/>
        <vers num="5.0.3" edition=":enterprise"/>
        <vers num="5.0.4" edition=":enterprise"/>
        <vers num="5.0.5" edition=":enterprise"/>
        <vers num="5.0.6" edition=":enterprise"/>
        <vers num="5.0.7" edition=":enterprise"/>
        <vers num="5.0.8" edition=":enterprise"/>
        <vers num="5.0.9" edition=":enterprise"/>
        <vers num="5.1.0" edition=":enterprise"/>
        <vers num="5.1.1" edition=":enterprise"/>
        <vers num="5.1.2" edition=":enterprise"/>
        <vers num="5.1.3" edition=":enterprise"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2018" published="2014-02-17" name="CVE-2014-2018" modified="2014-02-18" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in Mozilla Thunderbird 17.x through 17.0.8, Thunderbird ESR 17.x through 17.0.10, and SeaMonkey before 2.20 allows user-assisted remote attackers to inject arbitrary web script or HTML via an e-mail message containing a data: URL in a (1) OBJECT or (2) EMBED element, a related issue to CVE-2013-6674.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://www.kb.cert.org/vuls/id/863369" source="CERT-VN">VU#863369</ref>
      <ref url="https://bugzilla.mozilla.org/show_bug.cgi?id=875818" source="CONFIRM" adv="1">https://bugzilla.mozilla.org/show_bug.cgi?id=875818</ref>
      <ref url="http://www.vulnerability-lab.com/get_content.php?id=953" source="MISC">http://www.vulnerability-lab.com/get_content.php?id=953</ref>
      <ref url="http://www.mozilla.org/security/announce/2014/mfsa2014-14.html" source="CONFIRM" adv="1">http://www.mozilla.org/security/announce/2014/mfsa2014-14.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="mozilla" name="seamonkey">
        <vers num="1.0" edition="alpha"/>
        <vers num="1.0" edition="beta"/>
        <vers num="1.0.1"/>
        <vers num="1.0.2"/>
        <vers num="1.0.3"/>
        <vers num="1.0.4"/>
        <vers num="1.0.5"/>
        <vers num="1.0.6"/>
        <vers num="1.0.7"/>
        <vers num="1.0.8"/>
        <vers num="1.0.9"/>
        <vers num="1.1" edition="alpha"/>
        <vers num="1.1" edition="beta"/>
        <vers num="1.1.1"/>
        <vers num="1.1.10"/>
        <vers num="1.1.11"/>
        <vers num="1.1.12"/>
        <vers num="1.1.13"/>
        <vers num="1.1.14"/>
        <vers num="1.1.15"/>
        <vers num="1.1.16"/>
        <vers num="1.1.17"/>
        <vers num="1.1.18"/>
        <vers num="1.1.19"/>
        <vers num="1.1.2"/>
        <vers num="1.1.3"/>
        <vers num="1.1.4"/>
        <vers num="1.1.5"/>
        <vers num="1.1.6"/>
        <vers num="1.1.7"/>
        <vers num="1.1.8"/>
        <vers num="1.1.9"/>
        <vers num="1.5.0.10"/>
        <vers num="1.5.0.8"/>
        <vers num="1.5.0.9"/>
        <vers num="2.0" edition="alpha_1"/>
        <vers num="2.0" edition="alpha_2"/>
        <vers num="2.0" edition="alpha_3"/>
        <vers num="2.0" edition="beta_1"/>
        <vers num="2.0" edition="beta_2"/>
        <vers num="2.0" edition="rc1"/>
        <vers num="2.0" edition="rc2"/>
        <vers num="2.0.1"/>
        <vers num="2.0.10"/>
        <vers num="2.0.11"/>
        <vers num="2.0.12"/>
        <vers num="2.0.13"/>
        <vers num="2.0.14"/>
        <vers num="2.0.2"/>
        <vers num="2.0.3"/>
        <vers num="2.0.4"/>
        <vers num="2.0.5"/>
        <vers num="2.0.6"/>
        <vers num="2.0.7"/>
        <vers num="2.0.8"/>
        <vers num="2.0.9"/>
        <vers num="2.1" edition="alpha1"/>
        <vers num="2.1" edition="alpha2"/>
        <vers num="2.1" edition="alpha3"/>
        <vers num="2.1" edition="beta1"/>
        <vers num="2.1" edition="beta2"/>
        <vers num="2.1" edition="beta3"/>
        <vers num="2.1" edition="rc1"/>
        <vers num="2.1" edition="rc2"/>
        <vers num="2.10" edition="beta1"/>
        <vers num="2.10" edition="beta2"/>
        <vers num="2.10" edition="beta3"/>
        <vers num="2.10.1"/>
        <vers num="2.11" edition="beta1"/>
        <vers num="2.11" edition="beta2"/>
        <vers num="2.11" edition="beta3"/>
        <vers num="2.11" edition="beta4"/>
        <vers num="2.11" edition="beta5"/>
        <vers num="2.11" edition="beta6"/>
        <vers num="2.12" edition="beta1"/>
        <vers num="2.12" edition="beta2"/>
        <vers num="2.12" edition="beta3"/>
        <vers num="2.12" edition="beta4"/>
        <vers num="2.12" edition="beta5"/>
        <vers num="2.12" edition="beta6"/>
        <vers num="2.12.1"/>
        <vers num="2.13" edition="beta1"/>
        <vers num="2.13" edition="beta2"/>
        <vers num="2.13" edition="beta3"/>
        <vers num="2.13" edition="beta4"/>
        <vers num="2.13" edition="beta5"/>
        <vers num="2.13" edition="beta6"/>
        <vers num="2.13.1"/>
        <vers num="2.13.2"/>
        <vers num="2.14" edition="beta1"/>
        <vers num="2.14" edition="beta2"/>
        <vers num="2.14" edition="beta3"/>
        <vers num="2.14" edition="beta4"/>
        <vers num="2.14" edition="beta5"/>
        <vers num="2.15" edition="beta1"/>
        <vers num="2.15" edition="beta2"/>
        <vers num="2.15" edition="beta3"/>
        <vers num="2.15" edition="beta4"/>
        <vers num="2.15" edition="beta5"/>
        <vers num="2.15" edition="beta6"/>
        <vers num="2.15.1"/>
        <vers num="2.15.2"/>
        <vers num="2.16" edition="beta1"/>
        <vers num="2.16" edition="beta2"/>
        <vers num="2.16" edition="beta3"/>
        <vers num="2.16" edition="beta4"/>
        <vers num="2.16" edition="beta5"/>
        <vers num="2.16.1"/>
        <vers num="2.16.2"/>
        <vers num="2.17" edition="beta1"/>
        <vers num="2.17" edition="beta2"/>
        <vers num="2.17" edition="beta3"/>
        <vers num="2.17" edition="beta4"/>
        <vers num="2.17.1"/>
        <vers num="2.18" edition="beta1"/>
        <vers num="2.18" edition="beta2"/>
        <vers num="2.18" edition="beta3"/>
        <vers num="2.18" edition="beta4"/>
        <vers prev="1" num="2.19" edition="beta1"/>
        <vers prev="1" num="2.19" edition="beta2"/>
      </prod>
      <prod vendor="mozilla" name="thunderbird">
        <vers num="17.0"/>
        <vers num="17.0.1"/>
        <vers num="17.0.2"/>
        <vers num="17.0.3"/>
        <vers num="17.0.4"/>
        <vers num="17.0.5"/>
        <vers num="17.0.6"/>
        <vers num="17.0.7"/>
        <vers num="17.0.8"/>
      </prod>
      <prod vendor="mozilla" name="thunderbird_esr">
        <vers num="17.0"/>
        <vers num="17.0.1"/>
        <vers num="17.0.10"/>
        <vers num="17.0.2"/>
        <vers num="17.0.3"/>
        <vers num="17.0.4"/>
        <vers num="17.0.5"/>
        <vers num="17.0.6"/>
        <vers num="17.0.7"/>
        <vers num="17.0.8"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2019" published="2014-02-18" name="CVE-2014-2019" modified="2014-03-16" CVSS_version="2.0" CVSS_vector="(AV:L/AC:L/Au:N/C:N/I:C/A:N)" CVSS_score="4.9" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="3.9" CVSS_base_score="4.9">
    <desc>
      <descript source="cve">The iCloud subsystem in Apple iOS before 7.1 allows physically proximate attackers to bypass an intended password requirement, and turn off the Find My iPhone service or complete a Delete Account action and then associate this service with a different Apple ID account, by entering an arbitrary iCloud Account Password value and a blank iCloud Account Description value.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="http://www.youtube.com/watch?v=QnPk4RRWjic" source="MISC">http://www.youtube.com/watch?v=QnPk4RRWjic</ref>
      <ref url="http://support.apple.com/kb/HT6162" source="CONFIRM">http://support.apple.com/kb/HT6162</ref>
      <ref url="http://news.softpedia.com/news/Major-iOS-7-Security-Flaw-Discovered-Video-425011.shtml" source="MISC">http://news.softpedia.com/news/Major-iOS-7-Security-Flaw-Discovered-Video-425011.shtml</ref>
    </refs>
    <vuln_soft>
      <prod vendor="apple" name="iphone_os">
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="7.0.2"/>
        <vers num="7.0.3"/>
        <vers prev="1" num="7.0.4"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2020" published="2014-02-18" name="CVE-2014-2020" modified="2014-03-08" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:N/A:N)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">ext/gd/gd.c in PHP 5.5.x before 5.5.9 does not check data types, which might allow remote attackers to obtain sensitive information by using a (1) string or (2) array data type in place of a numeric data type, as demonstrated by an imagecrop function call with a string for the x dimension value, a different vulnerability than CVE-2013-7226.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://github.com/php/php-src/commit/2938329ce19cb8c4197dec146c3ec887c6f61d01" source="CONFIRM" adv="1">https://github.com/php/php-src/commit/2938329ce19cb8c4197dec146c3ec887c6f61d01</ref>
      <ref url="https://bugs.php.net/bug.php?id=66356" source="CONFIRM" adv="1">https://bugs.php.net/bug.php?id=66356</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2126-1" source="UBUNTU">USN-2126-1</ref>
    </refs>
    <vuln_soft>
      <prod vendor="php" name="php">
        <vers num="5.5.0" edition="alpha1"/>
        <vers num="5.5.0" edition="alpha2"/>
        <vers num="5.5.0" edition="alpha3"/>
        <vers num="5.5.0" edition="alpha4"/>
        <vers num="5.5.0" edition="alpha5"/>
        <vers num="5.5.0" edition="alpha6"/>
        <vers num="5.5.0" edition="beta1"/>
        <vers num="5.5.0" edition="beta2"/>
        <vers num="5.5.0" edition="beta3"/>
        <vers num="5.5.0" edition="beta4"/>
        <vers num="5.5.0" edition="rc1"/>
        <vers num="5.5.0" edition="rc2"/>
        <vers num="5.5.1"/>
        <vers num="5.5.2"/>
        <vers num="5.5.3"/>
        <vers num="5.5.4"/>
        <vers num="5.5.5"/>
        <vers num="5.5.6"/>
        <vers num="5.5.7"/>
        <vers prev="1" num="5.5.8"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2024" published="2014-03-14" name="CVE-2014-2024" modified="2014-03-25" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in classes/controller/error.php in Open Classifieds 2 before 2.1.3 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to shared-apartments-rooms/.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="https://github.com/open-classifieds/openclassifieds2/commit/45ee8fb601a91b8a4238229580a32a4fd8d96ef9" source="CONFIRM" patch="1">https://github.com/open-classifieds/openclassifieds2/commit/45ee8fb601a91b8a4238229580a32a4fd8d96ef9</ref>
      <ref url="https://www.htbridge.com/advisory/HTB23204" source="MISC">https://www.htbridge.com/advisory/HTB23204</ref>
      <ref url="https://github.com/open-classifieds/openclassifieds2/issues/556" source="CONFIRM">https://github.com/open-classifieds/openclassifieds2/issues/556</ref>
      <ref url="http://www.securityfocus.com/archive/1/archive/1/531428/100/0/threaded" source="BUGTRAQ">20140312 Cross-Site Scripting (XSS) in Open Classifieds</ref>
    </refs>
    <vuln_soft>
      <prod vendor="openclassifieds" name="open_classifieds_2">
        <vers num="2.0"/>
        <vers num="2.0.1"/>
        <vers num="2.0.2"/>
        <vers num="2.0.3"/>
        <vers num="2.0.4"/>
        <vers num="2.0.5"/>
        <vers num="2.0.6"/>
        <vers num="2.0.7"/>
        <vers num="2.0.8"/>
        <vers num="2.1"/>
        <vers num="2.1.1"/>
        <vers prev="1" num="2.1.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2033" published="2014-03-02" name="CVE-2014-2033" modified="2014-03-03" CVSS_version="2.0" CVSS_vector="(AV:A/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="7.9" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="5.5" CVSS_base_score="7.9">
    <desc>
      <descript source="cve">The caching feature in SGOS in Blue Coat ProxySG 5.5 through 5.5.11.3, 6.1 through 6.1.6.3, 6.2 through 6.2.15.3, 6.4 through 6.4.6.1, and 6.3 and 6.5 before 6.5.4 allows remote authenticated users to bypass intended access restrictions during a time window after account deletion or modification by leveraging knowledge of previously valid credentials.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <local_network/>
    </range>
    <refs>
      <ref url="http://www.kb.cert.org/vuls/id/221620" source="CERT-VN">VU#221620</ref>
      <ref url="https://kb.bluecoat.com/index?page=content&amp;id=SA77" source="CONFIRM" adv="1">https://kb.bluecoat.com/index?page=content&amp;id=SA77</ref>
    </refs>
    <vuln_soft>
      <prod vendor="bluecoat" name="proxysgos">
        <vers num="5.5"/>
        <vers prev="1" num="5.5.11"/>
        <vers num="6.1"/>
        <vers prev="1" num="6.1.6.3"/>
        <vers num="6.2"/>
        <vers prev="1" num="6.2.15.3"/>
        <vers num="6.3"/>
        <vers num="6.4"/>
        <vers prev="1" num="6.4.6.1"/>
        <vers prev="1" num="6.5"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2034" published="2014-03-31" name="CVE-2014-2034" modified="2014-04-01" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">Unspecified vulnerability in Sonatype Nexus OSS and Pro 2.4.0 through 2.7.1 allows attackers to create arbitrary user accounts via unknown vectors related to "an unauthenticated execution path."</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://support.sonatype.com/entries/42374566-CVE-2014-2034-Nexus-Security-Advisory-REST-API" source="CONFIRM" adv="1">https://support.sonatype.com/entries/42374566-CVE-2014-2034-Nexus-Security-Advisory-REST-API</ref>
      <ref url="http://www.sonatype.org/advisories/archive/2014-03-03-Nexus" source="CONFIRM" adv="1">http://www.sonatype.org/advisories/archive/2014-03-03-Nexus</ref>
      <ref url="http://www.securityfocus.com/bid/65956" source="BID">65956</ref>
      <ref url="http://www.osvdb.org/104049" source="OSVDB">104049</ref>
      <ref url="http://secunia.com/advisories/57142" source="SECUNIA" adv="1">57142</ref>
    </refs>
    <vuln_soft>
      <prod vendor="sonatype" name="nexus">
        <vers num="2.4.0" edition=":~~open_source~~~"/>
        <vers num="2.4.0" edition=":~~professional~~~"/>
        <vers num="2.5.0" edition=":~~professional~~~"/>
        <vers num="2.5.0" edition=":~~open_source~~~"/>
        <vers num="2.6.0" edition=":~~open_source~~~"/>
        <vers num="2.6.0" edition=":~~professional~~~"/>
        <vers num="2.6.1" edition=":~~professional~~~"/>
        <vers num="2.6.1" edition=":~~open_source~~~"/>
        <vers num="2.6.2" edition=":~~open_source~~~"/>
        <vers num="2.6.2" edition=":~~professional~~~"/>
        <vers num="2.6.3" edition=":~~open_source~~~"/>
        <vers num="2.6.3" edition=":~~professional~~~"/>
        <vers num="2.6.4" edition=":~~open_source~~~"/>
        <vers num="2.6.4" edition=":~~professional~~~"/>
        <vers num="2.6.5" edition=":~~professional~~~"/>
        <vers num="2.7.0" edition=":~~professional~~~"/>
        <vers num="2.7.0" edition=":~~open_source~~~"/>
        <vers num="2.7.1" edition=":~~professional~~~"/>
        <vers num="2.7.1" edition=":~~open_source~~~"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2035" published="2014-02-27" name="CVE-2014-2035" modified="2014-02-28" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in xhr.php in InterWorx Web Control Panel (aka InterWorx Hosting Control Panel and InterWorx-CP) before 5.0.13 build 574 allows remote attackers to inject arbitrary web script or HTML via the i parameter.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://www.securityfocus.com/archive/1/archive/1/531191/100/0/threaded" source="BUGTRAQ">20140220 [CVE-2014-2035] XSS in InterWorx Web Control Panel &lt;= 5.0.12</ref>
      <ref url="http://www.interworx.com/developers/changelog/version-5-0-13-build-574-2014-02-19" source="CONFIRM">http://www.interworx.com/developers/changelog/version-5-0-13-build-574-2014-02-19</ref>
    </refs>
    <vuln_soft>
      <prod vendor="interworx" name="web_control_panel">
        <vers num="5.0"/>
        <vers num="5.0.10"/>
        <vers num="5.0.11"/>
        <vers num="5.0.12"/>
        <vers prev="1" num="5.0.13"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-2038" published="2014-02-28" name="CVE-2014-2038" modified="2014-03-16" CVSS_version="2.0" CVSS_vector="(AV:L/AC:H/Au:N/C:P/I:P/A:P)" CVSS_score="3.7" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="1.9" CVSS_base_score="3.7">
    <desc>
      <descript source="cve">The nfs_can_extend_write function in fs/nfs/write.c in the Linux kernel before 3.13.3 relies on a write delegation to extend a write operation without a certain up-to-date verification, which allows local users to obtain sensitive information from kernel memory in opportunistic circumstances by writing to a file in an NFS filesystem and then reading the same file.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="https://github.com/torvalds/linux/commit/263b4509ec4d47e0da3e753f85a39ea12d1eff24" source="CONFIRM" patch="1">https://github.com/torvalds/linux/commit/263b4509ec4d47e0da3e753f85a39ea12d1eff24</ref>
      <ref url="http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=263b4509ec4d47e0da3e753f85a39ea12d1eff24" source="CONFIRM" patch="1">http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=263b4509ec4d47e0da3e753f85a39ea12d1eff24</ref>
      <ref url="https://bugzilla.redhat.com/show_bug.cgi?id=1066939" source="CONFIRM">https://bugzilla.redhat.com/show_bug.cgi?id=1066939</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2140-1" source="UBUNTU">USN-2140-1</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2137-1" source="UBUNTU">USN-2137-1</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/02/20/16" source="MLIST">[oss-security] 20140221 Re: Re: CVE request: Linux kernel: nfs: information leakage</ref>
      <ref url="http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.13.3" source="CONFIRM">http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.13.3</ref>
    </refs>
    <vuln_soft>
      <prod vendor="linux" name="linux_kernel">
        <vers num="3.0" edition="rc1"/>
        <vers num="3.0" edition="rc2"/>
        <vers num="3.0" edition="rc3"/>
        <vers num="3.0" edition="rc4"/>
        <vers num="3.0" edition="rc5"/>
        <vers num="3.0" edition="rc6"/>
        <vers num="3.0" edition="rc7"/>
        <vers num="3.0.1"/>
        <vers num="3.0.10"/>
        <vers num="3.0.11"/>
        <vers num="3.0.12"/>
        <vers num="3.0.13"/>
        <vers num="3.0.14"/>
        <vers num="3.0.15"/>
        <vers num="3.0.16"/>
        <vers num="3.0.17"/>
        <vers num="3.0.18"/>
        <vers num="3.0.19"/>
        <vers num="3.0.2"/>
        <vers num="3.0.20"/>
        <vers num="3.0.21"/>
        <vers num="3.0.22"/>
        <vers num="3.0.23"/>
        <vers num="3.0.24"/>
        <vers num="3.0.25"/>
        <vers num="3.0.26"/>
        <vers num="3.0.27"/>
        <vers num="3.0.28"/>
        <vers num="3.0.29"/>
        <vers num="3.0.3"/>
        <vers num="3.0.30"/>
        <vers num="3.0.31"/>
        <vers num="3.0.32"/>
        <vers num="3.0.33"/>
        <vers num="3.0.34"/>
        <vers num="3.0.35"/>
        <vers num="3.0.36"/>
        <vers num="3.0.37"/>
        <vers num="3.0.38"/>
        <vers num="3.0.39"/>
        <vers num="3.0.4"/>
        <vers num="3.0.40"/>
        <vers num="3.0.41"/>
        <vers num="3.0.42"/>
        <vers num="3.0.43"/>
        <vers num="3.0.44"/>
        <vers num="3.0.45"/>
        <vers num="3.0.46"/>
        <vers num="3.0.47"/>
        <vers num="3.0.48"/>
        <vers num="3.0.49"/>
        <vers num="3.0.5"/>
        <vers num="3.0.50"/>
        <vers num="3.0.51"/>
        <vers num="3.0.52"/>
        <vers num="3.0.53"/>
        <vers num="3.0.54"/>
        <vers num="3.0.55"/>
        <vers num="3.0.56"/>
        <vers num="3.0.57"/>
        <vers num="3.0.58"/>
        <vers num="3.0.59"/>
        <vers num="3.0.6"/>
        <vers num="3.0.60"/>
        <vers num="3.0.61"/>
        <vers num="3.0.62"/>
        <vers num="3.0.63"/>
        <vers num="3.0.64"/>
        <vers num="3.0.65"/>
        <vers num="3.0.66"/>
        <vers num="3.0.67"/>
        <vers num="3.0.68"/>
        <vers num="3.0.7"/>
        <vers num="3.0.8"/>
        <vers num="3.0.9"/>
        <vers num="3.1" edition="rc1"/>
        <vers num="3.1" edition="rc2"/>
        <vers num="3.1" edition="rc3"/>
        <vers num="3.1" edition="rc4"/>
        <vers num="3.1.1"/>
        <vers num="3.1.10"/>
        <vers num="3.1.2"/>
        <vers num="3.1.3"/>
        <vers num="3.1.4"/>
        <vers num="3.1.5"/>
        <vers num="3.1.6"/>
        <vers num="3.1.7"/>
        <vers num="3.1.8"/>
        <vers num="3.1.9"/>
        <vers num="3.10"/>
        <vers num="3.10.1"/>
        <vers num="3.10.10"/>
        <vers num="3.10.11"/>
        <vers num="3.10.12"/>
        <vers num="3.10.13"/>
        <vers num="3.10.14"/>
        <vers num="3.10.15"/>
        <vers num="3.10.16"/>
        <vers num="3.10.17"/>
        <vers num="3.10.18"/>
        <vers num="3.10.19"/>
        <vers num="3.10.2"/>
        <vers num="3.10.20"/>
        <vers num="3.10.21"/>
        <vers num="3.10.22"/>
        <vers num="3.10.23"/>
        <vers num="3.10.24"/>
        <vers num="3.10.25"/>
        <vers num="3.10.26"/>
        <vers num="3.10.27"/>
        <vers num="3.10.28"/>
        <vers num="3.10.29"/>
        <vers num="3.10.3"/>
        <vers num="3.10.4"/>
        <vers num="3.10.5"/>
        <vers num="3.10.6"/>
        <vers num="3.10.7"/>
        <vers num="3.10.8"/>
        <vers num="3.10.9"/>
        <vers num="3.11"/>
        <vers num="3.11.1"/>
        <vers num="3.11.10"/>
        <vers num="3.11.2"/>
        <vers num="3.11.3"/>
        <vers num="3.11.4"/>
        <vers num="3.11.5"/>
        <vers num="3.11.6"/>
        <vers num="3.11.7"/>
        <vers num="3.11.8"/>
        <vers num="3.11.9"/>
        <vers num="3.12"/>
        <vers num="3.12.1"/>
        <vers num="3.12.10"/>
        <vers num="3.12.11"/>
        <vers num="3.12.12"/>
        <vers num="3.12.13"/>
        <vers num="3.12.2"/>
        <vers num="3.12.3"/>
        <vers num="3.12.4"/>
        <vers num="3.12.5"/>
        <vers num="3.12.6"/>
        <vers num="3.12.7"/>
        <vers num="3.12.8"/>
        <vers num="3.12.9"/>
        <vers num="3.13"/>
        <vers num="3.13.1"/>
        <vers prev="1" num="3.13.2"/>
        <vers num="3.2" edition="rc2"/>
        <vers num="3.2" edition="rc3"/>
        <vers num="3.2" edition="rc4"/>
        <vers num="3.2" edition="rc5"/>
        <vers num="3.2" edition="rc6"/>
        <vers num="3.2" edition="rc7"/>
        <vers num="3.2.1"/>
        <vers num="3.2.10"/>
        <vers num="3.2.11"/>
        <vers num="3.2.12"/>
        <vers num="3.2.13"/>
        <vers num="3.2.14"/>
        <vers num="3.2.15"/>
        <vers num="3.2.16"/>
        <vers num="3.2.17"/>
        <vers num="3.2.18"/>
        <vers num="3.2.19"/>
        <vers num="3.2.2"/>
        <vers num="3.2.20"/>
        <vers num="3.2.21"/>
        <vers num="3.2.22"/>
        <vers num="3.2.23"/>
        <vers num="3.2.24"/>
        <vers num="3.2.25"/>
        <vers num="3.2.26"/>
        <vers num="3.2.27"/>
        <vers num="3.2.28"/>
        <vers num="3.2.29"/>
        <vers num="3.2.3"/>
        <vers num="3.2.30"/>
        <vers num="3.2.4"/>
        <vers num="3.2.5"/>
        <vers num="3.2.6"/>
        <vers num="3.2.7"/>
        <vers num="3.2.8"/>
        <vers num="3.2.9"/>
        <vers num="3.3" edition="rc1"/>
        <vers num="3.3" edition="rc2"/>
        <vers num="3.3" edition="rc3"/>
        <vers num="3.3" edition="rc4"/>
        <vers num="3.3" edition="rc5"/>
        <vers num="3.3" edition="rc6"/>
        <vers num="3.3" edition="rc7"/>
        <vers num="3.3.1"/>
        <vers num="3.3.2"/>
        <vers num="3.3.3"/>
        <vers num="3.3.4"/>
        <vers num="3.3.5"/>
        <vers num="3.3.6"/>
        <vers num="3.3.7"/>
        <vers num="3.3.8"/>
        <vers num="3.4" edition="rc1"/>
        <vers num="3.4" edition="rc2"/>
        <vers num="3.4" edition="rc3"/>
        <vers num="3.4" edition="rc4"/>
        <vers num="3.4" edition="rc5"/>
        <vers num="3.4" edition="rc6"/>
        <vers num="3.4" edition="rc7"/>
        <vers num="3.4.1"/>
        <vers num="3.4.10"/>
        <vers num="3.4.11"/>
        <vers num="3.4.12"/>
        <vers num="3.4.13"/>
        <vers num="3.4.14"/>
        <vers num="3.4.15"/>
        <vers num="3.4.16"/>
        <vers num="3.4.17"/>
        <vers num="3.4.18"/>
        <vers num="3.4.19"/>
        <vers num="3.4.2"/>
        <vers num="3.4.20"/>
        <vers num="3.4.21"/>
        <vers num="3.4.22"/>
        <vers num="3.4.23"/>
        <vers num="3.4.24"/>
        <vers num="3.4.25"/>
        <vers num="3.4.26"/>
        <vers num="3.4.27"/>
        <vers num="3.4.28"/>
        <vers num="3.4.29"/>
        <vers num="3.4.3"/>
        <vers num="3.4.30"/>
        <vers num="3.4.31"/>
        <vers num="3.4.32"/>
        <vers num="3.4.33"/>
        <vers num="3.4.34"/>
        <vers num="3.4.35"/>
        <vers num="3.4.36"/>
        <vers num="3.4.37"/>
        <vers num="3.4.38"/>
        <vers num="3.4.39"/>
        <vers num="3.4.4"/>
        <vers num="3.4.40"/>
        <vers num="3.4.41"/>
        <vers num="3.4.42"/>
        <vers num="3.4.43"/>
        <vers num="3.4.44"/>
        <vers num="3.4.45"/>
        <vers num="3.4.46"/>
        <vers num="3.4.47"/>
        <vers num="3.4.48"/>
        <vers num="3.4.49"/>
        <vers num="3.4.5"/>
        <vers num="3.4.50"/>
        <vers num="3.4.51"/>
        <vers num="3.4.52"/>
        <vers num="3.4.53"/>
        <vers num="3.4.54"/>
        <vers num="3.4.55"/>
        <vers num="3.4.56"/>
        <vers num="3.4.57"/>
        <vers num="3.4.58"/>
        <vers num="3.4.59"/>
        <vers num="3.4.6"/>
        <vers num="3.4.60"/>
        <vers num="3.4.61"/>
        <vers num="3.4.62"/>
        <vers num="3.4.63"/>
        <vers num="3.4.64"/>
        <vers num="3.4.65"/>
        <vers num="3.4.66"/>
        <vers num="3.4.67"/>
        <vers num="3.4.68"/>
        <vers num="3.4.69"/>
        <vers num="3.4.7"/>
        <vers num="3.4.70"/>
        <vers num="3.4.71"/>
        <vers num="3.4.72"/>
        <vers num="3.4.73"/>
        <vers num="3.4.74"/>
        <vers num="3.4.75"/>
        <vers num="3.4.76"/>
        <vers num="3.4.77"/>
        <vers num="3.4.78"/>
        <vers num="3.4.79"/>
        <vers num="3.4.8"/>
        <vers num="3.4.9"/>
        <vers num="3.5.1"/>
        <vers num="3.5.2"/>
        <vers num="3.5.3"/>
        <vers num="3.5.4"/>
        <vers num="3.5.5"/>
        <vers num="3.5.6"/>
        <vers num="3.5.7"/>
        <vers num="3.6"/>
        <vers num="3.6.1"/>
        <vers num="3.6.10"/>
        <vers num="3.6.11"/>
        <vers num="3.6.2"/>
        <vers num="3.6.3"/>
        <vers num="3.6.4"/>
        <vers num="3.6.5"/>
        <vers num="3.6.6"/>
        <vers num="3.6.7"/>
        <vers num="3.6.8"/>
        <vers num="3.6.9"/>
        <vers num="3.7"/>
        <vers num="3.7.1"/>
        <vers num="3.7.10"/>
        <vers num="3.7.2"/>
        <vers num="3.7.3"/>
        <vers num="3.7.4"/>
        <vers num="3.7.5"/>
        <vers num="3.7.6"/>
        <vers num="3.7.7"/>
        <vers num="3.7.8"/>
        <vers num="3.7.9"/>
        <vers num="3.8.0"/>
        <vers num="3.8.1"/>
        <vers num="3.8.10"/>
        <vers num="3.8.11"/>
        <vers num="3.8.12"/>
        <vers num="3.8.13"/>
        <vers num="3.8.2"/>
        <vers num="3.8.3"/>
        <vers num="3.8.4"/>
        <vers num="3.8.5"/>
        <vers num="3.8.6"/>
        <vers num="3.8.7"/>
        <vers num="3.8.8"/>
        <vers num="3.8.9"/>
        <vers num="3.9" edition="rc1"/>
        <vers num="3.9" edition="rc2"/>
        <vers num="3.9" edition="rc3"/>
        <vers num="3.9" edition="rc4"/>
        <vers num="3.9" edition="rc5"/>
        <vers num="3.9" edition="rc6"/>
        <vers num="3.9" edition="rc7"/>
        <vers num="3.9.0"/>
        <vers num="3.9.1"/>
        <vers num="3.9.10"/>
        <vers num="3.9.11"/>
        <vers num="3.9.2"/>
        <vers num="3.9.3"/>
        <vers num="3.9.4"/>
        <vers num="3.9.5"/>
        <vers num="3.9.6"/>
        <vers num="3.9.7"/>
        <vers num="3.9.8"/>
        <vers num="3.9.9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2039" published="2014-02-28" name="CVE-2014-2039" modified="2014-02-28" CVSS_version="2.0" CVSS_vector="(AV:L/AC:L/Au:N/C:N/I:N/A:C)" CVSS_score="4.9" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="3.9" CVSS_base_score="4.9">
    <desc>
      <descript source="cve">arch/s390/kernel/head64.S in the Linux kernel before 3.13.5 on the s390 platform does not properly handle attempted use of the linkage stack, which allows local users to cause a denial of service (system crash) by executing a crafted instruction.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="https://github.com/torvalds/linux/commit/8d7f6690cedb83456edd41c9bd583783f0703bf0" source="CONFIRM" patch="1">https://github.com/torvalds/linux/commit/8d7f6690cedb83456edd41c9bd583783f0703bf0</ref>
      <ref url="http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=8d7f6690cedb83456edd41c9bd583783f0703bf0" source="CONFIRM" patch="1">http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=8d7f6690cedb83456edd41c9bd583783f0703bf0</ref>
      <ref url="https://bugzilla.redhat.com/show_bug.cgi?id=1067558" source="CONFIRM">https://bugzilla.redhat.com/show_bug.cgi?id=1067558</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/02/20/14" source="MLIST">[oss-security] 20140220 Re: CVE Request: Linux kernel: s390: crash due to linkage stack instruction</ref>
      <ref url="http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.13.5" source="CONFIRM">http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.13.5</ref>
    </refs>
    <vuln_soft>
      <prod vendor="linux" name="linux_kernel">
        <vers num="3.0" edition="rc1"/>
        <vers num="3.0" edition="rc2"/>
        <vers num="3.0" edition="rc3"/>
        <vers num="3.0" edition="rc4"/>
        <vers num="3.0" edition="rc5"/>
        <vers num="3.0" edition="rc6"/>
        <vers num="3.0" edition="rc7"/>
        <vers num="3.0.1"/>
        <vers num="3.0.10"/>
        <vers num="3.0.11"/>
        <vers num="3.0.12"/>
        <vers num="3.0.13"/>
        <vers num="3.0.14"/>
        <vers num="3.0.15"/>
        <vers num="3.0.16"/>
        <vers num="3.0.17"/>
        <vers num="3.0.18"/>
        <vers num="3.0.19"/>
        <vers num="3.0.2"/>
        <vers num="3.0.20"/>
        <vers num="3.0.21"/>
        <vers num="3.0.22"/>
        <vers num="3.0.23"/>
        <vers num="3.0.24"/>
        <vers num="3.0.25"/>
        <vers num="3.0.26"/>
        <vers num="3.0.27"/>
        <vers num="3.0.28"/>
        <vers num="3.0.29"/>
        <vers num="3.0.3"/>
        <vers num="3.0.30"/>
        <vers num="3.0.31"/>
        <vers num="3.0.32"/>
        <vers num="3.0.33"/>
        <vers num="3.0.34"/>
        <vers num="3.0.35"/>
        <vers num="3.0.36"/>
        <vers num="3.0.37"/>
        <vers num="3.0.38"/>
        <vers num="3.0.39"/>
        <vers num="3.0.4"/>
        <vers num="3.0.40"/>
        <vers num="3.0.41"/>
        <vers num="3.0.42"/>
        <vers num="3.0.43"/>
        <vers num="3.0.44"/>
        <vers num="3.0.45"/>
        <vers num="3.0.46"/>
        <vers num="3.0.47"/>
        <vers num="3.0.48"/>
        <vers num="3.0.49"/>
        <vers num="3.0.5"/>
        <vers num="3.0.50"/>
        <vers num="3.0.51"/>
        <vers num="3.0.52"/>
        <vers num="3.0.53"/>
        <vers num="3.0.54"/>
        <vers num="3.0.55"/>
        <vers num="3.0.56"/>
        <vers num="3.0.57"/>
        <vers num="3.0.58"/>
        <vers num="3.0.59"/>
        <vers num="3.0.6"/>
        <vers num="3.0.60"/>
        <vers num="3.0.61"/>
        <vers num="3.0.62"/>
        <vers num="3.0.63"/>
        <vers num="3.0.64"/>
        <vers num="3.0.65"/>
        <vers num="3.0.66"/>
        <vers num="3.0.67"/>
        <vers num="3.0.68"/>
        <vers num="3.0.7"/>
        <vers num="3.0.8"/>
        <vers num="3.0.9"/>
        <vers num="3.1" edition="rc1"/>
        <vers num="3.1" edition="rc2"/>
        <vers num="3.1" edition="rc3"/>
        <vers num="3.1" edition="rc4"/>
        <vers num="3.1.1"/>
        <vers num="3.1.10"/>
        <vers num="3.1.2"/>
        <vers num="3.1.3"/>
        <vers num="3.1.4"/>
        <vers num="3.1.5"/>
        <vers num="3.1.6"/>
        <vers num="3.1.7"/>
        <vers num="3.1.8"/>
        <vers num="3.1.9"/>
        <vers num="3.10"/>
        <vers num="3.10.1"/>
        <vers num="3.10.10"/>
        <vers num="3.10.11"/>
        <vers num="3.10.12"/>
        <vers num="3.10.13"/>
        <vers num="3.10.14"/>
        <vers num="3.10.15"/>
        <vers num="3.10.16"/>
        <vers num="3.10.17"/>
        <vers num="3.10.18"/>
        <vers num="3.10.19"/>
        <vers num="3.10.2"/>
        <vers num="3.10.20"/>
        <vers num="3.10.21"/>
        <vers num="3.10.22"/>
        <vers num="3.10.23"/>
        <vers num="3.10.24"/>
        <vers num="3.10.25"/>
        <vers num="3.10.26"/>
        <vers num="3.10.27"/>
        <vers num="3.10.28"/>
        <vers num="3.10.29"/>
        <vers num="3.10.3"/>
        <vers num="3.10.4"/>
        <vers num="3.10.5"/>
        <vers num="3.10.6"/>
        <vers num="3.10.7"/>
        <vers num="3.10.8"/>
        <vers num="3.10.9"/>
        <vers num="3.11"/>
        <vers num="3.11.1"/>
        <vers num="3.11.10"/>
        <vers num="3.11.2"/>
        <vers num="3.11.3"/>
        <vers num="3.11.4"/>
        <vers num="3.11.5"/>
        <vers num="3.11.6"/>
        <vers num="3.11.7"/>
        <vers num="3.11.8"/>
        <vers num="3.11.9"/>
        <vers num="3.12"/>
        <vers num="3.12.1"/>
        <vers num="3.12.10"/>
        <vers num="3.12.11"/>
        <vers num="3.12.12"/>
        <vers num="3.12.13"/>
        <vers num="3.12.2"/>
        <vers num="3.12.3"/>
        <vers num="3.12.4"/>
        <vers num="3.12.5"/>
        <vers num="3.12.6"/>
        <vers num="3.12.7"/>
        <vers num="3.12.8"/>
        <vers num="3.12.9"/>
        <vers num="3.13"/>
        <vers num="3.13.1"/>
        <vers num="3.13.2"/>
        <vers num="3.13.3"/>
        <vers prev="1" num="3.13.4"/>
        <vers num="3.2" edition="rc2"/>
        <vers num="3.2" edition="rc3"/>
        <vers num="3.2" edition="rc4"/>
        <vers num="3.2" edition="rc5"/>
        <vers num="3.2" edition="rc6"/>
        <vers num="3.2" edition="rc7"/>
        <vers num="3.2.1"/>
        <vers num="3.2.10"/>
        <vers num="3.2.11"/>
        <vers num="3.2.12"/>
        <vers num="3.2.13"/>
        <vers num="3.2.14"/>
        <vers num="3.2.15"/>
        <vers num="3.2.16"/>
        <vers num="3.2.17"/>
        <vers num="3.2.18"/>
        <vers num="3.2.19"/>
        <vers num="3.2.2"/>
        <vers num="3.2.20"/>
        <vers num="3.2.21"/>
        <vers num="3.2.22"/>
        <vers num="3.2.23"/>
        <vers num="3.2.24"/>
        <vers num="3.2.25"/>
        <vers num="3.2.26"/>
        <vers num="3.2.27"/>
        <vers num="3.2.28"/>
        <vers num="3.2.29"/>
        <vers num="3.2.3"/>
        <vers num="3.2.30"/>
        <vers num="3.2.4"/>
        <vers num="3.2.5"/>
        <vers num="3.2.6"/>
        <vers num="3.2.7"/>
        <vers num="3.2.8"/>
        <vers num="3.2.9"/>
        <vers num="3.3" edition="rc1"/>
        <vers num="3.3" edition="rc2"/>
        <vers num="3.3" edition="rc3"/>
        <vers num="3.3" edition="rc4"/>
        <vers num="3.3" edition="rc5"/>
        <vers num="3.3" edition="rc6"/>
        <vers num="3.3" edition="rc7"/>
        <vers num="3.3.1"/>
        <vers num="3.3.2"/>
        <vers num="3.3.3"/>
        <vers num="3.3.4"/>
        <vers num="3.3.5"/>
        <vers num="3.3.6"/>
        <vers num="3.3.7"/>
        <vers num="3.3.8"/>
        <vers num="3.4" edition="rc1"/>
        <vers num="3.4" edition="rc2"/>
        <vers num="3.4" edition="rc3"/>
        <vers num="3.4" edition="rc4"/>
        <vers num="3.4" edition="rc5"/>
        <vers num="3.4" edition="rc6"/>
        <vers num="3.4" edition="rc7"/>
        <vers num="3.4.1"/>
        <vers num="3.4.10"/>
        <vers num="3.4.11"/>
        <vers num="3.4.12"/>
        <vers num="3.4.13"/>
        <vers num="3.4.14"/>
        <vers num="3.4.15"/>
        <vers num="3.4.16"/>
        <vers num="3.4.17"/>
        <vers num="3.4.18"/>
        <vers num="3.4.19"/>
        <vers num="3.4.2"/>
        <vers num="3.4.20"/>
        <vers num="3.4.21"/>
        <vers num="3.4.22"/>
        <vers num="3.4.23"/>
        <vers num="3.4.24"/>
        <vers num="3.4.25"/>
        <vers num="3.4.26"/>
        <vers num="3.4.27"/>
        <vers num="3.4.28"/>
        <vers num="3.4.29"/>
        <vers num="3.4.3"/>
        <vers num="3.4.30"/>
        <vers num="3.4.31"/>
        <vers num="3.4.32"/>
        <vers num="3.4.33"/>
        <vers num="3.4.34"/>
        <vers num="3.4.35"/>
        <vers num="3.4.36"/>
        <vers num="3.4.37"/>
        <vers num="3.4.38"/>
        <vers num="3.4.39"/>
        <vers num="3.4.4"/>
        <vers num="3.4.40"/>
        <vers num="3.4.41"/>
        <vers num="3.4.42"/>
        <vers num="3.4.43"/>
        <vers num="3.4.44"/>
        <vers num="3.4.45"/>
        <vers num="3.4.46"/>
        <vers num="3.4.47"/>
        <vers num="3.4.48"/>
        <vers num="3.4.49"/>
        <vers num="3.4.5"/>
        <vers num="3.4.50"/>
        <vers num="3.4.51"/>
        <vers num="3.4.52"/>
        <vers num="3.4.53"/>
        <vers num="3.4.54"/>
        <vers num="3.4.55"/>
        <vers num="3.4.56"/>
        <vers num="3.4.57"/>
        <vers num="3.4.58"/>
        <vers num="3.4.59"/>
        <vers num="3.4.6"/>
        <vers num="3.4.60"/>
        <vers num="3.4.61"/>
        <vers num="3.4.62"/>
        <vers num="3.4.63"/>
        <vers num="3.4.64"/>
        <vers num="3.4.65"/>
        <vers num="3.4.66"/>
        <vers num="3.4.67"/>
        <vers num="3.4.68"/>
        <vers num="3.4.69"/>
        <vers num="3.4.7"/>
        <vers num="3.4.70"/>
        <vers num="3.4.71"/>
        <vers num="3.4.72"/>
        <vers num="3.4.73"/>
        <vers num="3.4.74"/>
        <vers num="3.4.75"/>
        <vers num="3.4.76"/>
        <vers num="3.4.77"/>
        <vers num="3.4.78"/>
        <vers num="3.4.79"/>
        <vers num="3.4.8"/>
        <vers num="3.4.9"/>
        <vers num="3.5.1"/>
        <vers num="3.5.2"/>
        <vers num="3.5.3"/>
        <vers num="3.5.4"/>
        <vers num="3.5.5"/>
        <vers num="3.5.6"/>
        <vers num="3.5.7"/>
        <vers num="3.6"/>
        <vers num="3.6.1"/>
        <vers num="3.6.10"/>
        <vers num="3.6.11"/>
        <vers num="3.6.2"/>
        <vers num="3.6.3"/>
        <vers num="3.6.4"/>
        <vers num="3.6.5"/>
        <vers num="3.6.6"/>
        <vers num="3.6.7"/>
        <vers num="3.6.8"/>
        <vers num="3.6.9"/>
        <vers num="3.7"/>
        <vers num="3.7.1"/>
        <vers num="3.7.10"/>
        <vers num="3.7.2"/>
        <vers num="3.7.3"/>
        <vers num="3.7.4"/>
        <vers num="3.7.5"/>
        <vers num="3.7.6"/>
        <vers num="3.7.7"/>
        <vers num="3.7.8"/>
        <vers num="3.7.9"/>
        <vers num="3.8.0"/>
        <vers num="3.8.1"/>
        <vers num="3.8.10"/>
        <vers num="3.8.11"/>
        <vers num="3.8.12"/>
        <vers num="3.8.13"/>
        <vers num="3.8.2"/>
        <vers num="3.8.3"/>
        <vers num="3.8.4"/>
        <vers num="3.8.5"/>
        <vers num="3.8.6"/>
        <vers num="3.8.7"/>
        <vers num="3.8.8"/>
        <vers num="3.8.9"/>
        <vers num="3.9" edition="rc1"/>
        <vers num="3.9" edition="rc2"/>
        <vers num="3.9" edition="rc3"/>
        <vers num="3.9" edition="rc4"/>
        <vers num="3.9" edition="rc5"/>
        <vers num="3.9" edition="rc6"/>
        <vers num="3.9" edition="rc7"/>
        <vers num="3.9.0"/>
        <vers num="3.9.1"/>
        <vers num="3.9.10"/>
        <vers num="3.9.11"/>
        <vers num="3.9.2"/>
        <vers num="3.9.3"/>
        <vers num="3.9.4"/>
        <vers num="3.9.5"/>
        <vers num="3.9.6"/>
        <vers num="3.9.7"/>
        <vers num="3.9.8"/>
        <vers num="3.9.9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-2040" published="2014-03-03" name="CVE-2014-2040" modified="2014-03-07" CVSS_version="2.0" CVSS_vector="(AV:N/AC:H/Au:S/C:N/I:P/A:N)" CVSS_score="2.1" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="3.9" CVSS_base_score="2.1">
    <desc>
      <descript source="cve">Multiple cross-site scripting (XSS) vulnerabilities in the (1) callback_multicheck, (2) callback_radio, and (3) callback_wysiwygin functions in mfrh_class.settings-api.php in the Media File Renamer plugin 1.7.0 for WordPress allow remote authenticated users with permissions to add media or edit media to inject arbitrary web script or HTML via unspecified parameters, as demonstrated by the title of an uploaded file.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://www.vapid.dhs.org/advisories/wordpress/plugins/MediaFileRenamer-1.7.0/index.html" source="MISC">http://www.vapid.dhs.org/advisories/wordpress/plugins/MediaFileRenamer-1.7.0/index.html</ref>
      <ref url="http://www.securityfocus.com/bid/65715" source="BID">65715</ref>
      <ref url="http://www.securityfocus.com/archive/1/archive/1/531270/100/0/threaded" source="BUGTRAQ">20140226 Persistent XSS in Media File Renamer V1.7.0 wordpress plugin</ref>
    </refs>
    <vuln_soft>
      <prod vendor="jordy_meow" name="media_file_renamer">
        <vers num="1.7.0" edition=":~~~wordpress~~"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2042" published="2014-04-28" name="CVE-2014-2042" modified="2014-04-29" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">Unrestricted file upload vulnerability in the Manage Project functionality in Livetecs Timelive before 6.5.1 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in a predictable directory in Uploads/.</descript>
      <descript source="nvd">Per: http://cwe.mitre.org/data/definitions/434.html

"CWE-434: Unrestricted Upload of File with Dangerous Type"</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.securityfocus.com/archive/1/archive/1/531914/100/0/threaded" source="BUGTRAQ">20140423 CVE-2014-2042 - Unrestricted file upload in Livetecs Timelive</ref>
      <ref url="http://seclists.org/fulldisclosure/2014/Apr/260" source="FULLDISC">20140423 CVE-2014-2042 - Unrestricted file upload in Livetecs Timelive</ref>
    </refs>
    <vuln_soft>
      <prod vendor="livetecs" name="timeline">
        <vers num="2.81"/>
        <vers num="2.91"/>
        <vers num="2.94"/>
        <vers num="3.0.1"/>
        <vers num="3.0.3"/>
        <vers num="3.0.5"/>
        <vers num="3.1.1"/>
        <vers num="3.2.1"/>
        <vers num="3.5.1"/>
        <vers num="3.6.1"/>
        <vers num="3.7.1"/>
        <vers num="3.8.1"/>
        <vers num="4.2.1"/>
        <vers num="4.3.1"/>
        <vers num="4.9.1"/>
        <vers num="5.2.1"/>
        <vers num="6.0.1"/>
        <vers num="6.2.1"/>
        <vers num="6.2.3"/>
        <vers num="6.2.4"/>
        <vers num="6.2.6"/>
        <vers num="6.2.7"/>
        <vers num="6.2.71"/>
        <vers prev="1" num="6.2.8"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2043" published="2014-03-13" name="CVE-2014-2043" modified="2014-03-13" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:P/I:P/A:P)" CVSS_score="6.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.0" CVSS_base_score="6.5">
    <desc>
      <descript source="cve">SQL injection vulnerability in Resources/System/Templates/Data.aspx in Procentia IntelliPen before 1.1.18.1658 allows remote authenticated users to execute arbitrary SQL commands via the value parameter.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-2043" source="MISC">https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-2043</ref>
      <ref url="http://www.securityfocus.com/archive/1/archive/1/531426/100/0/threaded" source="BUGTRAQ">20140312 CVE-2014-2043 - SQL Injection in Procentia IntelliPen</ref>
      <ref url="http://www.exploit-db.com/exploits/32212" source="EXPLOIT-DB">32212</ref>
    </refs>
    <vuln_soft>
      <prod vendor="procentia" name="intellipen">
        <vers prev="1" num="1.1.12.1520"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2047" published="2014-03-14" name="CVE-2014-2047" modified="2014-03-25" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:P)" CVSS_score="6.8" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.6" CVSS_base_score="6.8">
    <desc>
      <descript source="cve">Session fixation vulnerability in ownCloud before 6.0.2, when PHP is configured to accept session parameters through a GET request, allows remote attackers to hijack web sessions via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://owncloud.org/about/security/advisories/oC-SA-2014-001/" source="CONFIRM" patch="1" adv="1">http://owncloud.org/about/security/advisories/oC-SA-2014-001/</ref>
    </refs>
    <vuln_soft>
      <prod vendor="owncloud" name="owncloud">
        <vers num="6.0.0"/>
        <vers prev="1" num="6.0.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2049" published="2014-03-14" name="CVE-2014-2049" modified="2014-03-25" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:N/A:N)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">The default Flash Cross Domain policies in ownCloud before 5.0.15 and 6.x before 6.0.2 allows remote attackers to access user files via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://owncloud.org/about/security/advisories/oC-SA-2014-003/" source="CONFIRM" patch="1" adv="1">http://owncloud.org/about/security/advisories/oC-SA-2014-003/</ref>
    </refs>
    <vuln_soft>
      <prod vendor="owncloud" name="owncloud">
        <vers num="3.0.0"/>
        <vers num="3.0.1"/>
        <vers num="3.0.2"/>
        <vers num="3.0.3"/>
        <vers num="4.0.0"/>
        <vers num="4.0.1"/>
        <vers num="4.0.10"/>
        <vers num="4.0.11"/>
        <vers num="4.0.12"/>
        <vers num="4.0.13"/>
        <vers num="4.0.14"/>
        <vers num="4.0.15"/>
        <vers num="4.0.16"/>
        <vers num="4.0.2"/>
        <vers num="4.0.3"/>
        <vers num="4.0.4"/>
        <vers num="4.0.5"/>
        <vers num="4.0.6"/>
        <vers num="4.0.7"/>
        <vers num="4.0.8"/>
        <vers num="4.0.9"/>
        <vers num="4.5.0"/>
        <vers num="4.5.1"/>
        <vers num="4.5.10"/>
        <vers num="4.5.11"/>
        <vers num="4.5.12"/>
        <vers num="4.5.13"/>
        <vers num="4.5.2"/>
        <vers num="4.5.3"/>
        <vers num="4.5.4"/>
        <vers num="4.5.5"/>
        <vers num="4.5.6"/>
        <vers num="4.5.7"/>
        <vers num="4.5.8"/>
        <vers num="4.5.9"/>
        <vers num="5.0.0"/>
        <vers num="5.0.1"/>
        <vers num="5.0.10"/>
        <vers num="5.0.11"/>
        <vers num="5.0.12"/>
        <vers num="5.0.13"/>
        <vers prev="1" num="5.0.14"/>
        <vers num="5.0.2"/>
        <vers num="5.0.3"/>
        <vers num="5.0.4"/>
        <vers num="5.0.5"/>
        <vers num="5.0.6"/>
        <vers num="5.0.7"/>
        <vers num="5.0.8"/>
        <vers num="5.0.9"/>
        <vers num="6.0.0"/>
        <vers num="6.0.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2057" published="2014-03-24" name="CVE-2014-2057" modified="2014-03-24" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 6.0.2 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://owncloud.org/about/security/advisories/oC-SA-2014-007/" source="CONFIRM" adv="1">http://owncloud.org/about/security/advisories/oC-SA-2014-007/</ref>
    </refs>
    <vuln_soft>
      <prod vendor="owncloud" name="owncloud">
        <vers num="3.0.0"/>
        <vers num="3.0.1"/>
        <vers num="3.0.2"/>
        <vers num="3.0.3"/>
        <vers num="4.0.0"/>
        <vers num="4.0.1"/>
        <vers num="4.0.10"/>
        <vers num="4.0.11"/>
        <vers num="4.0.12"/>
        <vers num="4.0.13"/>
        <vers num="4.0.14"/>
        <vers num="4.0.15"/>
        <vers num="4.0.16"/>
        <vers num="4.0.2"/>
        <vers num="4.0.3"/>
        <vers num="4.0.4"/>
        <vers num="4.0.5"/>
        <vers num="4.0.6"/>
        <vers num="4.0.7"/>
        <vers num="4.0.8"/>
        <vers num="4.0.9"/>
        <vers num="4.5.0"/>
        <vers num="4.5.1"/>
        <vers num="4.5.10"/>
        <vers num="4.5.11"/>
        <vers num="4.5.12"/>
        <vers num="4.5.13"/>
        <vers num="4.5.2"/>
        <vers num="4.5.3"/>
        <vers num="4.5.4"/>
        <vers num="4.5.5"/>
        <vers num="4.5.6"/>
        <vers num="4.5.7"/>
        <vers num="4.5.8"/>
        <vers num="4.5.9"/>
        <vers num="5.0.0"/>
        <vers num="5.0.1"/>
        <vers num="5.0.10"/>
        <vers num="5.0.11"/>
        <vers num="5.0.12"/>
        <vers num="5.0.13"/>
        <vers num="5.0.14" edition="a"/>
        <vers num="5.0.2"/>
        <vers num="5.0.3"/>
        <vers num="5.0.4"/>
        <vers num="5.0.5"/>
        <vers num="5.0.6"/>
        <vers num="5.0.7"/>
        <vers num="5.0.8"/>
        <vers num="5.0.9"/>
        <vers num="6.0.0"/>
        <vers prev="1" num="6.0.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2059" published="2014-02-28" name="CVE-2014-2059" modified="2014-03-04" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:P/I:P/A:P)" CVSS_score="6.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.0" CVSS_base_score="6.5">
    <desc>
      <descript source="cve">Directory traversal vulnerability in the CLI job creation (hudson/cli/CreateJobCommand.java) in CloudBees Jenkins before 1.551 and LTS before 1.532.2 allows remote authenticated users to overwrite arbitrary files via the job name.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://github.com/jenkinsci/jenkins/commit/ad38d8480f20ce3cbf8fec3e2003bc83efda4f7d" source="CONFIRM" patch="1">https://github.com/jenkinsci/jenkins/commit/ad38d8480f20ce3cbf8fec3e2003bc83efda4f7d</ref>
      <ref url="https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-02-14" source="CONFIRM" adv="1">https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-02-14</ref>
      <ref url="http://xforce.iss.net/xforce/xfdb/91346" source="XF">jenkins-cve20142059-dir-trav(91346)</ref>
      <ref url="http://seclists.org/oss-sec/2014/q1/421" source="MLIST">[oss-security] 20140220 Re: Possible CVE Requests: several issues fixed in Jenkins (Advisory 2014-02-14)</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cloudbees" name="jenkins">
        <vers num="1.301"/>
        <vers num="1.302"/>
        <vers num="1.303"/>
        <vers num="1.304"/>
        <vers num="1.305"/>
        <vers num="1.306"/>
        <vers num="1.307"/>
        <vers num="1.308"/>
        <vers num="1.309"/>
        <vers num="1.310"/>
        <vers num="1.311"/>
        <vers num="1.312"/>
        <vers num="1.313"/>
        <vers num="1.314"/>
        <vers num="1.315"/>
        <vers num="1.316"/>
        <vers num="1.317"/>
        <vers num="1.318"/>
        <vers num="1.319"/>
        <vers num="1.320"/>
        <vers num="1.321"/>
        <vers num="1.322"/>
        <vers num="1.323"/>
        <vers num="1.324"/>
        <vers num="1.325"/>
        <vers num="1.326"/>
        <vers num="1.327"/>
        <vers num="1.328"/>
        <vers num="1.329"/>
        <vers num="1.330"/>
        <vers num="1.331"/>
        <vers num="1.332"/>
        <vers num="1.333"/>
        <vers num="1.334"/>
        <vers num="1.335"/>
        <vers num="1.336"/>
        <vers num="1.337"/>
        <vers num="1.338"/>
        <vers num="1.339"/>
        <vers num="1.340"/>
        <vers num="1.341"/>
        <vers num="1.342"/>
        <vers num="1.343"/>
        <vers num="1.344"/>
        <vers num="1.345"/>
        <vers num="1.346"/>
        <vers num="1.347"/>
        <vers num="1.348"/>
        <vers num="1.349"/>
        <vers num="1.350"/>
        <vers num="1.351"/>
        <vers num="1.352"/>
        <vers num="1.353"/>
        <vers num="1.354"/>
        <vers num="1.355"/>
        <vers num="1.356"/>
        <vers num="1.357"/>
        <vers num="1.358"/>
        <vers num="1.359"/>
        <vers num="1.360"/>
        <vers num="1.361"/>
        <vers num="1.362"/>
        <vers num="1.363"/>
        <vers num="1.364"/>
        <vers num="1.365"/>
        <vers num="1.366"/>
        <vers num="1.367"/>
        <vers num="1.368"/>
        <vers num="1.369"/>
        <vers num="1.370"/>
        <vers num="1.371"/>
        <vers num="1.372"/>
        <vers num="1.373"/>
        <vers num="1.374"/>
        <vers num="1.375"/>
        <vers num="1.376"/>
        <vers num="1.377"/>
        <vers num="1.378"/>
        <vers num="1.379"/>
        <vers num="1.380"/>
        <vers num="1.382"/>
        <vers num="1.383"/>
        <vers num="1.384"/>
        <vers num="1.386"/>
        <vers num="1.387"/>
        <vers num="1.388"/>
        <vers num="1.389"/>
        <vers num="1.390"/>
        <vers num="1.391"/>
        <vers num="1.392"/>
        <vers num="1.393"/>
        <vers num="1.394"/>
        <vers num="1.395"/>
        <vers num="1.396"/>
        <vers num="1.397"/>
        <vers num="1.398"/>
        <vers num="1.399"/>
        <vers num="1.400" edition=":lts"/>
        <vers num="1.400" edition="-:lts"/>
        <vers num="1.400.0.12" edition=":lts"/>
        <vers num="1.401"/>
        <vers num="1.402"/>
        <vers num="1.403"/>
        <vers num="1.404"/>
        <vers num="1.405"/>
        <vers num="1.406"/>
        <vers num="1.407"/>
        <vers num="1.408"/>
        <vers num="1.409"/>
        <vers num="1.409.1" edition=":lts"/>
        <vers num="1.409.1" edition="-:lts"/>
        <vers num="1.409.2" edition=":lts"/>
        <vers num="1.409.2" edition="-:lts"/>
        <vers num="1.409.3" edition="-:lts"/>
        <vers num="1.410"/>
        <vers num="1.411"/>
        <vers num="1.412"/>
        <vers num="1.413"/>
        <vers num="1.414"/>
        <vers num="1.415"/>
        <vers num="1.416"/>
        <vers num="1.417"/>
        <vers num="1.418"/>
        <vers num="1.419"/>
        <vers num="1.420"/>
        <vers num="1.421"/>
        <vers num="1.422"/>
        <vers num="1.423"/>
        <vers num="1.424" edition="-:lts"/>
        <vers num="1.424.1" edition="-:lts"/>
        <vers num="1.424.2" edition="-:lts"/>
        <vers num="1.424.3" edition="-:lts"/>
        <vers num="1.424.4" edition="-:lts"/>
        <vers num="1.424.5" edition="-:lts"/>
        <vers num="1.424.6" edition="-:lts"/>
        <vers num="1.425"/>
        <vers num="1.426"/>
        <vers num="1.427"/>
        <vers num="1.428"/>
        <vers num="1.429"/>
        <vers num="1.430"/>
        <vers num="1.431"/>
        <vers num="1.432"/>
        <vers num="1.433"/>
        <vers num="1.434"/>
        <vers num="1.435"/>
        <vers num="1.436"/>
        <vers num="1.437"/>
        <vers num="1.447" edition="-:lts"/>
        <vers num="1.447.1" edition="-:lts"/>
        <vers num="1.447.2" edition="-:lts"/>
        <vers num="1.466.1" edition="-:lts"/>
        <vers num="1.466.2" edition="-:lts"/>
        <vers num="1.480.1" edition="-:lts"/>
        <vers num="1.480.2" edition="-:lts"/>
        <vers num="1.480.3" edition="-:lts"/>
        <vers num="1.480.3.1"/>
        <vers num="1.509.1" edition="-:lts"/>
        <vers num="1.509.2" edition="-:lts"/>
        <vers num="1.509.3" edition="-:lts"/>
        <vers num="1.509.4" edition="-:lts"/>
        <vers num="1.523"/>
        <vers num="1.524"/>
        <vers num="1.525"/>
        <vers num="1.526"/>
        <vers num="1.527"/>
        <vers num="1.528"/>
        <vers num="1.529"/>
        <vers num="1.530"/>
        <vers num="1.531"/>
        <vers num="1.532"/>
        <vers prev="1" num="1.532.1" edition="-:lts"/>
        <vers num="1.533"/>
        <vers num="1.534"/>
        <vers num="1.535"/>
        <vers num="1.536"/>
        <vers num="1.537"/>
        <vers num="1.538"/>
        <vers num="1.539"/>
        <vers num="1.540"/>
        <vers num="1.541"/>
        <vers num="1.542"/>
        <vers num="1.543"/>
        <vers num="1.544"/>
        <vers num="1.545"/>
        <vers num="1.546"/>
        <vers num="1.547"/>
        <vers num="1.548"/>
        <vers num="1.549"/>
        <vers prev="1" num="1.550"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-2067" published="2014-02-28" name="CVE-2014-2067" modified="2014-03-03" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:S/C:N/I:P/A:N)" CVSS_score="3.5" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="6.8" CVSS_base_score="3.5">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in java/hudson/model/Cause.java in CloudBees Jenkins before 1.551 and LTS before 1.532.2 allows remote authenticated users to inject arbitrary web script or HTML via a "remote cause note."</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-02-14" source="CONFIRM" adv="1">https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-02-14</ref>
      <ref url="https://github.com/jenkinsci/jenkins/commit/5d57c855f3147bfc5e7fda9252317b428a700014" source="CONFIRM">https://github.com/jenkinsci/jenkins/commit/5d57c855f3147bfc5e7fda9252317b428a700014</ref>
      <ref url="http://xforce.iss.net/xforce/xfdb/91354" source="XF">jenkins-cve20142067-xss(91354)</ref>
      <ref url="http://seclists.org/oss-sec/2014/q1/421" source="MLIST">[oss-security] 20140220 Re: Possible CVE Requests: several issues fixed in Jenkins (Advisory 2014-02-14)</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cloudbees" name="jenkins">
        <vers num="1.301"/>
        <vers num="1.302"/>
        <vers num="1.303"/>
        <vers num="1.304"/>
        <vers num="1.305"/>
        <vers num="1.306"/>
        <vers num="1.307"/>
        <vers num="1.308"/>
        <vers num="1.309"/>
        <vers num="1.310"/>
        <vers num="1.311"/>
        <vers num="1.312"/>
        <vers num="1.313"/>
        <vers num="1.314"/>
        <vers num="1.315"/>
        <vers num="1.316"/>
        <vers num="1.317"/>
        <vers num="1.318"/>
        <vers num="1.319"/>
        <vers num="1.320"/>
        <vers num="1.321"/>
        <vers num="1.322"/>
        <vers num="1.323"/>
        <vers num="1.324"/>
        <vers num="1.325"/>
        <vers num="1.326"/>
        <vers num="1.327"/>
        <vers num="1.328"/>
        <vers num="1.329"/>
        <vers num="1.330"/>
        <vers num="1.331"/>
        <vers num="1.332"/>
        <vers num="1.333"/>
        <vers num="1.334"/>
        <vers num="1.335"/>
        <vers num="1.336"/>
        <vers num="1.337"/>
        <vers num="1.338"/>
        <vers num="1.339"/>
        <vers num="1.340"/>
        <vers num="1.341"/>
        <vers num="1.342"/>
        <vers num="1.343"/>
        <vers num="1.344"/>
        <vers num="1.345"/>
        <vers num="1.346"/>
        <vers num="1.347"/>
        <vers num="1.348"/>
        <vers num="1.349"/>
        <vers num="1.350"/>
        <vers num="1.351"/>
        <vers num="1.352"/>
        <vers num="1.353"/>
        <vers num="1.354"/>
        <vers num="1.355"/>
        <vers num="1.356"/>
        <vers num="1.357"/>
        <vers num="1.358"/>
        <vers num="1.359"/>
        <vers num="1.360"/>
        <vers num="1.361"/>
        <vers num="1.362"/>
        <vers num="1.363"/>
        <vers num="1.364"/>
        <vers num="1.365"/>
        <vers num="1.366"/>
        <vers num="1.367"/>
        <vers num="1.368"/>
        <vers num="1.369"/>
        <vers num="1.370"/>
        <vers num="1.371"/>
        <vers num="1.372"/>
        <vers num="1.373"/>
        <vers num="1.374"/>
        <vers num="1.375"/>
        <vers num="1.376"/>
        <vers num="1.377"/>
        <vers num="1.378"/>
        <vers num="1.379"/>
        <vers num="1.380"/>
        <vers num="1.382"/>
        <vers num="1.383"/>
        <vers num="1.384"/>
        <vers num="1.386"/>
        <vers num="1.387"/>
        <vers num="1.388"/>
        <vers num="1.389"/>
        <vers num="1.390"/>
        <vers num="1.391"/>
        <vers num="1.392"/>
        <vers num="1.393"/>
        <vers num="1.394"/>
        <vers num="1.395"/>
        <vers num="1.396"/>
        <vers num="1.397"/>
        <vers num="1.398"/>
        <vers num="1.399"/>
        <vers num="1.400" edition=":lts"/>
        <vers num="1.400" edition="-:lts"/>
        <vers num="1.400.0.12" edition=":lts"/>
        <vers num="1.401"/>
        <vers num="1.402"/>
        <vers num="1.403"/>
        <vers num="1.404"/>
        <vers num="1.405"/>
        <vers num="1.406"/>
        <vers num="1.407"/>
        <vers num="1.408"/>
        <vers num="1.409"/>
        <vers num="1.409.1" edition=":lts"/>
        <vers num="1.409.1" edition="-:lts"/>
        <vers num="1.409.2" edition=":lts"/>
        <vers num="1.409.2" edition="-:lts"/>
        <vers num="1.409.3" edition="-:lts"/>
        <vers num="1.410"/>
        <vers num="1.411"/>
        <vers num="1.412"/>
        <vers num="1.413"/>
        <vers num="1.414"/>
        <vers num="1.415"/>
        <vers num="1.416"/>
        <vers num="1.417"/>
        <vers num="1.418"/>
        <vers num="1.419"/>
        <vers num="1.420"/>
        <vers num="1.421"/>
        <vers num="1.422"/>
        <vers num="1.423"/>
        <vers num="1.424" edition="-:lts"/>
        <vers num="1.424.1" edition="-:lts"/>
        <vers num="1.424.2" edition="-:lts"/>
        <vers num="1.424.3" edition="-:lts"/>
        <vers num="1.424.4" edition="-:lts"/>
        <vers num="1.424.5" edition="-:lts"/>
        <vers num="1.424.6" edition="-:lts"/>
        <vers num="1.425"/>
        <vers num="1.426"/>
        <vers num="1.427"/>
        <vers num="1.428"/>
        <vers num="1.429"/>
        <vers num="1.430"/>
        <vers num="1.431"/>
        <vers num="1.432"/>
        <vers num="1.433"/>
        <vers num="1.434"/>
        <vers num="1.435"/>
        <vers num="1.436"/>
        <vers num="1.437"/>
        <vers num="1.447" edition="-:lts"/>
        <vers num="1.447.1" edition="-:lts"/>
        <vers num="1.447.2" edition="-:lts"/>
        <vers num="1.466.1" edition="-:lts"/>
        <vers num="1.466.2" edition="-:lts"/>
        <vers num="1.480.1" edition="-:lts"/>
        <vers num="1.480.2" edition="-:lts"/>
        <vers num="1.480.3" edition="-:lts"/>
        <vers num="1.480.3.1"/>
        <vers num="1.509.1" edition="-:lts"/>
        <vers num="1.509.2" edition="-:lts"/>
        <vers num="1.509.3" edition="-:lts"/>
        <vers num="1.509.4" edition="-:lts"/>
        <vers num="1.523"/>
        <vers num="1.524"/>
        <vers num="1.525"/>
        <vers num="1.526"/>
        <vers num="1.527"/>
        <vers num="1.528"/>
        <vers num="1.529"/>
        <vers num="1.530"/>
        <vers num="1.531"/>
        <vers num="1.532"/>
        <vers prev="1" num="1.532.1" edition="-:lts"/>
        <vers num="1.533"/>
        <vers num="1.534"/>
        <vers num="1.535"/>
        <vers num="1.536"/>
        <vers num="1.537"/>
        <vers num="1.538"/>
        <vers num="1.539"/>
        <vers num="1.540"/>
        <vers num="1.541"/>
        <vers num="1.542"/>
        <vers num="1.543"/>
        <vers num="1.544"/>
        <vers num="1.545"/>
        <vers num="1.546"/>
        <vers num="1.547"/>
        <vers num="1.548"/>
        <vers num="1.549"/>
        <vers prev="1" num="1.550"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2075" published="2014-02-27" name="CVE-2014-2075" modified="2014-02-27" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:C/I:C/A:C)" CVSS_score="10.0" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="10.0" CVSS_base_score="10.0">
    <desc>
      <descript source="cve">TIBCO Enterprise Administrator 1.0.0 and Enterprise Administrator SDK 1.0.0 do not properly enforce administrative authentication requirements, which allows remote attackers to execute arbitrary commands via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.tibco.com/multimedia/enterprise_administator_advisory_20140226_tcm8-20533.txt" source="CONFIRM" adv="1">http://www.tibco.com/multimedia/enterprise_administator_advisory_20140226_tcm8-20533.txt</ref>
      <ref url="http://www.tibco.com/mk/advisory.jsp" source="CONFIRM" adv="1">http://www.tibco.com/mk/advisory.jsp</ref>
    </refs>
    <vuln_soft>
      <prod vendor="tibco" name="enterprise_administrator">
        <vers num="1.0.0"/>
      </prod>
      <prod vendor="tibco" name="enterprise_administrator_sdk">
        <vers num="1.0.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2077" published="2014-03-20" name="CVE-2014-2077" modified="2014-03-24" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in the frontend in Open-Xchange (OX) AppSuite 7.4.1 before 7.4.1-rev10 and 7.4.2 before 7.4.2-rev8 allows remote attackers to inject arbitrary web script or HTML via the subject of an email, involving 'the aria "tags" for screenreaders at the top bar'.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://secunia.com/advisories/57290" source="SECUNIA" adv="1">57290</ref>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-03/0108.html" source="BUGTRAQ">20140317 Open-Xchange Security Advisory 2014-03-17</ref>
    </refs>
    <vuln_soft>
      <prod vendor="open-xchange" name="open-xchange_appsuite">
        <vers num="7.4.1"/>
        <vers num="7.4.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2080" published="2014-02-28" name="CVE-2014-2080" modified="2014-03-03" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in manager/templates/default/header.tpl in ModX Evolution before 2.2.11 allows remote attackers to inject arbitrary web script or HTML via the "a" parameter.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="https://github.com/modxcms/revolution/commit/77463eb6a8090f474b04fdc1b72225cb93c558ea" source="CONFIRM" patch="1">https://github.com/modxcms/revolution/commit/77463eb6a8090f474b04fdc1b72225cb93c558ea</ref>
      <ref url="http://modx.com/blog/2014/01/21/revolution-2.2.11%E2%80%94security-fixes-and-prevent-change-loss" source="CONFIRM" patch="1" adv="1">http://modx.com/blog/2014/01/21/revolution-2.2.11%E2%80%94security-fixes-and-prevent-change-loss</ref>
      <ref url="http://secunia.com/advisories/57038" source="SECUNIA" adv="1">57038</ref>
      <ref url="http://seclists.org/oss-sec/2014/q1/431" source="MLIST">[oss-security] 20140224 Re: CVE request: XSS in MODX Revolution before 2.2.11</ref>
    </refs>
    <vuln_soft>
      <prod vendor="modx" name="modx_revolution">
        <vers num="2.0.0"/>
        <vers num="2.0.1"/>
        <vers num="2.0.2"/>
        <vers num="2.0.3"/>
        <vers num="2.0.4"/>
        <vers num="2.0.5"/>
        <vers num="2.0.6"/>
        <vers num="2.0.7"/>
        <vers num="2.0.8"/>
        <vers num="2.1.0"/>
        <vers num="2.1.1"/>
        <vers num="2.1.2"/>
        <vers num="2.1.3"/>
        <vers num="2.1.4"/>
        <vers num="2.1.5"/>
        <vers num="2.2.0"/>
        <vers num="2.2.1"/>
        <vers prev="1" num="2.2.10"/>
        <vers num="2.2.2"/>
        <vers num="2.2.3"/>
        <vers num="2.2.4"/>
        <vers num="2.2.5"/>
        <vers num="2.2.6"/>
        <vers num="2.2.7"/>
        <vers num="2.2.8"/>
        <vers num="2.2.9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2087" published="2014-03-18" name="CVE-2014-2087" modified="2014-03-19" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">Stack-based buffer overflow in the CDownloads_Deleted::UpdateDownload function in Downloads_Deleted.cpp in Free Download Manager 3.9.3 build 1360, 3.8 build 1173, 3.0 build 852, and earlier allows user-assisted remote attackers to execute arbitrary code via a long file name, which is then deleted from the download queue by the user.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="https://www.rcesecurity.com/2014/03/cve-2014-2087-free-download-manager-cdownloads_deleted-updatedownload-remote-code-execution" source="MISC">https://www.rcesecurity.com/2014/03/cve-2014-2087-free-download-manager-cdownloads_deleted-updatedownload-remote-code-execution</ref>
      <ref url="http://www.securityfocus.com/bid/66211" source="BID">66211</ref>
    </refs>
    <vuln_soft>
      <prod vendor="freedownloadmanager" name="free_download_manager">
        <vers num="3.8"/>
        <vers num="3.9.3"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2088" published="2014-03-02" name="CVE-2014-2088" modified="2014-03-03" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:P/I:P/A:P)" CVSS_score="6.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.0" CVSS_base_score="6.5">
    <desc>
      <descript source="cve">Unrestricted file upload vulnerability in ilias.php in ILIAS 4.4.1 allows remote authenticated users to execute arbitrary PHP code by using a .php filename in an upload_files action to the uploadFiles command, and then accessing the .php file via a direct request to a certain client_id pathname.</descript>
      <descript source="nvd">Per: http://cwe.mitre.org/data/definitions/434.html

"CWE-434: Unrestricted Upload of File with Dangerous Type"</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://packetstormsecurity.com/files/125350/ILIAS-4.4.1-Cross-Site-Scripting-Shell-Upload.html" source="MISC">http://packetstormsecurity.com/files/125350/ILIAS-4.4.1-Cross-Site-Scripting-Shell-Upload.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="ilias" name="ilias">
        <vers num="4.4.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2089" published="2014-03-02" name="CVE-2014-2089" modified="2014-03-03" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:P)" CVSS_score="6.8" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.6" CVSS_base_score="6.8">
    <desc>
      <descript source="cve">ILIAS 4.4.1 allows remote attackers to execute arbitrary PHP code via an e-mail attachment that leads to creation of a .php file with a certain client_id pathname.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://packetstormsecurity.com/files/125350/ILIAS-4.4.1-Cross-Site-Scripting-Shell-Upload.html" source="MISC">http://packetstormsecurity.com/files/125350/ILIAS-4.4.1-Cross-Site-Scripting-Shell-Upload.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="ilias" name="ilias">
        <vers num="4.4.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-2090" published="2014-03-02" name="CVE-2014-2090" modified="2014-03-03" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:S/C:N/I:P/A:N)" CVSS_score="3.5" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="6.8" CVSS_base_score="3.5">
    <desc>
      <descript source="cve">Multiple cross-site scripting (XSS) vulnerabilities in ilias.php in ILIAS 4.4.1 allow remote authenticated users to inject arbitrary web script or HTML via the (1) tar, (2) tar_val, or (3) title parameter.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://packetstormsecurity.com/files/125350/ILIAS-4.4.1-Cross-Site-Scripting-Shell-Upload.html" source="MISC">http://packetstormsecurity.com/files/125350/ILIAS-4.4.1-Cross-Site-Scripting-Shell-Upload.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="ilias" name="ilias">
        <vers num="4.4.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-2091" published="2014-03-02" name="CVE-2014-2091" modified="2014-03-03" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:S/C:N/I:P/A:N)" CVSS_score="3.5" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="6.8" CVSS_base_score="3.5">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in mods/_standard/forums/admin/forum_add.php in ATutor 2.1.1 allows remote authenticated administrators to inject arbitrary web script or HTML via the title parameter in an add_forum action.  NOTE: the original disclosure also reported issues that may not cross privilege boundaries.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://packetstormsecurity.com/files/125348/ATutor-2.1.1-Cross-Site-Scripting.html" source="MISC">http://packetstormsecurity.com/files/125348/ATutor-2.1.1-Cross-Site-Scripting.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="atutor" name="atutor">
        <vers num="2.1.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2092" published="2014-03-02" name="CVE-2014-2092" modified="2014-03-03" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in lib/filemanager/ImageManager/editorFrame.php in CMS Made Simple 1.11.10 allows remote attackers to inject arbitrary web script or HTML via the action parameter, a different issue than CVE-2014-0334.  NOTE: the original disclosure also reported issues that may not cross privilege boundaries.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://packetstormsecurity.com/files/125353/CMSMadeSimple-1.11.10-Cross-Site-Scripting.html" source="MISC">http://packetstormsecurity.com/files/125353/CMSMadeSimple-1.11.10-Cross-Site-Scripting.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cmsmadesimple" name="cms_made_simple">
        <vers num="1.11.10"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2093" published="2014-02-26" name="CVE-2014-2093" modified="2014-03-11" CVSS_version="2.0" CVSS_vector="(AV:L/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="4.6" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="3.9" CVSS_base_score="4.6">
    <desc>
      <descript source="cve">Untrusted search path vulnerability in Catfish through 0.4.0.3 allows local users to gain privileges via a Trojan horse catfish.py in the current working directory.</descript>
      <descript source="nvd">Per: http://cwe.mitre.org/data/definitions/426.html

"CWE-426: Untrusted Search Path"</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="https://bugzilla.redhat.com/show_bug.cgi?id=1069396" source="CONFIRM">https://bugzilla.redhat.com/show_bug.cgi?id=1069396</ref>
      <ref url="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=739958" source="CONFIRM">https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=739958</ref>
      <ref url="http://openwall.com/lists/oss-security/2014/02/25/4" source="MLIST">[oss-security] 20140225 Re: CVE request for catfish program</ref>
      <ref url="http://openwall.com/lists/oss-security/2014/02/25/2" source="MLIST">[oss-security] 20140225 Re: CVE request for catfish program</ref>
    </refs>
    <vuln_soft>
      <prod vendor="catfish_project" name="catfish">
        <vers num="0.4.0"/>
        <vers num="0.4.0.1"/>
        <vers num="0.4.0.2"/>
        <vers num="0.4.0.3"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2094" published="2014-02-26" name="CVE-2014-2094" modified="2014-03-11" CVSS_version="2.0" CVSS_vector="(AV:L/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="4.6" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="3.9" CVSS_base_score="4.6">
    <desc>
      <descript source="cve">Untrusted search path vulnerability in Catfish through 0.4.0.3, when a Fedora package such as 0.4.0.2-2 is not used, allows local users to gain privileges via a Trojan horse catfish.pyc in the current working directory.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="https://bugzilla.redhat.com/show_bug.cgi?id=1069396" source="CONFIRM">https://bugzilla.redhat.com/show_bug.cgi?id=1069396</ref>
      <ref url="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=739958" source="CONFIRM">https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=739958</ref>
      <ref url="http://openwall.com/lists/oss-security/2014/02/25/4" source="MLIST">[oss-security] 20140225 Re: CVE request for catfish program</ref>
      <ref url="http://openwall.com/lists/oss-security/2014/02/25/2" source="MLIST">[oss-security] 20140225 Re: CVE request for catfish program</ref>
    </refs>
    <vuln_soft>
      <prod vendor="catfish_project" name="catfish">
        <vers num="0.4.0"/>
        <vers num="0.4.0.1"/>
        <vers num="0.4.0.2"/>
        <vers num="0.4.0.3"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2095" published="2014-02-26" name="CVE-2014-2095" modified="2014-03-11" CVSS_version="2.0" CVSS_vector="(AV:L/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="4.6" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="3.9" CVSS_base_score="4.6">
    <desc>
      <descript source="cve">Untrusted search path vulnerability in Catfish 0.6.0 through 1.0.0, when a Fedora package such as 0.8.2-1 is not used, allows local users to gain privileges via a Trojan horse bin/catfish.pyc under the current working directory.</descript>
      <descript source="nvd">Per: http://cwe.mitre.org/data/definitions/426.html

"CWE-426: Untrusted Search Path"</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="https://bugzilla.redhat.com/show_bug.cgi?id=1069396" source="CONFIRM">https://bugzilla.redhat.com/show_bug.cgi?id=1069396</ref>
      <ref url="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=739958" source="CONFIRM">https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=739958</ref>
      <ref url="http://openwall.com/lists/oss-security/2014/02/25/4" source="MLIST">[oss-security] 20140225 Re: CVE request for catfish program</ref>
      <ref url="http://openwall.com/lists/oss-security/2014/02/25/2" source="MLIST">[oss-security] 20140225 Re: CVE request for catfish program</ref>
    </refs>
    <vuln_soft>
      <prod vendor="catfish_project" name="catfish">
        <vers num="0.6.0"/>
        <vers num="0.6.1"/>
        <vers num="0.6.2"/>
        <vers num="0.6.3"/>
        <vers num="0.6.4"/>
        <vers num="0.8.0"/>
        <vers num="0.8.1"/>
        <vers num="0.8.2"/>
        <vers num="1.0.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2096" published="2014-02-26" name="CVE-2014-2096" modified="2014-03-11" CVSS_version="2.0" CVSS_vector="(AV:L/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="4.6" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="3.9" CVSS_base_score="4.6">
    <desc>
      <descript source="cve">Untrusted search path vulnerability in Catfish 0.6.0 through 1.0.0 allows local users to gain privileges via a Trojan horse bin/catfish.py under the current working directory.</descript>
      <descript source="nvd">Per: http://cwe.mitre.org/data/definitions/426.html

"CWE-426: Untrusted Search Path"</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="https://bugzilla.redhat.com/show_bug.cgi?id=1069396" source="CONFIRM">https://bugzilla.redhat.com/show_bug.cgi?id=1069396</ref>
      <ref url="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=739958" source="CONFIRM">https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=739958</ref>
      <ref url="http://openwall.com/lists/oss-security/2014/02/25/4" source="MLIST">[oss-security] 20140225 Re: CVE request for catfish program</ref>
      <ref url="http://openwall.com/lists/oss-security/2014/02/25/2" source="MLIST">[oss-security] 20140225 Re: CVE request for catfish program</ref>
    </refs>
    <vuln_soft>
      <prod vendor="catfish_project" name="catfish">
        <vers num="0.6.0"/>
        <vers num="0.6.1"/>
        <vers num="0.6.2"/>
        <vers num="0.6.3"/>
        <vers num="0.6.4"/>
        <vers num="0.8.0"/>
        <vers num="0.8.1"/>
        <vers num="0.8.2"/>
        <vers num="1.0.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2097" published="2014-03-01" name="CVE-2014-2097" modified="2014-03-03" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:P)" CVSS_score="6.8" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.6" CVSS_base_score="6.8">
    <desc>
      <descript source="cve">The tak_decode_frame function in libavcodec/takdec.c in FFmpeg before 2.1.4 does not properly validate a certain bits-per-sample value, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted TAK (aka Tom's lossless Audio Kompressor) data.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://git.videolan.org/?p=ffmpeg.git;a=commit;h=f58eab151214d2d35ff0973f2b3e51c5eb372da4" source="CONFIRM" patch="1">http://git.videolan.org/?p=ffmpeg.git;a=commit;h=f58eab151214d2d35ff0973f2b3e51c5eb372da4</ref>
    </refs>
    <vuln_soft>
      <prod vendor="ffmpeg" name="ffmpeg">
        <vers num="2.0"/>
        <vers num="2.0.1"/>
        <vers num="2.0.2"/>
        <vers num="2.0.3"/>
        <vers num="2.1"/>
        <vers num="2.1.1"/>
        <vers num="2.1.2"/>
        <vers prev="1" num="2.1.3"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2098" published="2014-03-01" name="CVE-2014-2098" modified="2014-03-03" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:P)" CVSS_score="6.8" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.6" CVSS_base_score="6.8">
    <desc>
      <descript source="cve">libavcodec/wmalosslessdec.c in FFmpeg before 2.1.4 uses an incorrect data-structure size for certain coefficients, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via crafted WMA data.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://git.videolan.org/?p=ffmpeg.git;a=commit;h=ec9578d54d09b64bf112c2bf7a34b1ef3b93dbd3" source="CONFIRM" patch="1">http://git.videolan.org/?p=ffmpeg.git;a=commit;h=ec9578d54d09b64bf112c2bf7a34b1ef3b93dbd3</ref>
    </refs>
    <vuln_soft>
      <prod vendor="ffmpeg" name="ffmpeg">
        <vers num="2.0"/>
        <vers num="2.0.1"/>
        <vers num="2.0.2"/>
        <vers num="2.0.3"/>
        <vers num="2.1"/>
        <vers num="2.1.1"/>
        <vers num="2.1.2"/>
        <vers prev="1" num="2.1.3"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2099" published="2014-03-01" name="CVE-2014-2099" modified="2014-03-03" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:P)" CVSS_score="6.8" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.6" CVSS_base_score="6.8">
    <desc>
      <descript source="cve">The msrle_decode_frame function in libavcodec/msrle.c in FFmpeg before 2.1.4 does not properly calculate line sizes, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted Microsoft RLE video data.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://git.videolan.org/?p=ffmpeg.git;a=commit;h=c919e1ca2ecfc47d796382973ba0e48b8f6f92a2" source="CONFIRM" patch="1">http://git.videolan.org/?p=ffmpeg.git;a=commit;h=c919e1ca2ecfc47d796382973ba0e48b8f6f92a2</ref>
    </refs>
    <vuln_soft>
      <prod vendor="ffmpeg" name="ffmpeg">
        <vers num="2.0"/>
        <vers num="2.0.1"/>
        <vers num="2.0.2"/>
        <vers num="2.0.3"/>
        <vers num="2.1"/>
        <vers num="2.1.1"/>
        <vers num="2.1.2"/>
        <vers prev="1" num="2.1.3"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2102" published="2014-02-26" name="CVE-2014-2102" modified="2014-02-27" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:P/I:N/A:N)" CVSS_score="4.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.0" CVSS_base_score="4.0">
    <desc>
      <descript source="cve">Cisco Unified Contact Center Express (Unified CCX) does not properly restrict the content of the CCMConfig page, which allows remote authenticated users to obtain sensitive information by examining this content, aka Bug ID CSCum95575.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2102" source="CISCO" adv="1">20140225 Cisco Unified Contact Center Express CCMConfig Sensitive Information Disclosure Vulnerability</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="unified_contact_center_express_editor_software">
        <vers num="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2103" published="2014-02-27" name="CVE-2014-2103" modified="2014-02-28" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:N/I:N/A:C)" CVSS_score="6.8" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="8.0" CVSS_base_score="6.8">
    <desc>
      <descript source="cve">Cisco Intrusion Prevention System (IPS) Software allows remote attackers to cause a denial of service (MainApp process outage) via malformed SNMP packets, aka Bug IDs CSCum52355 and CSCul49309.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2103" source="CISCO" adv="1">20140227 Cisco IPS MainApp SNMP Denial of Service Vulnerability</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="intrusion_prevention_system">
        <vers num="5.1"/>
        <vers num="6.0"/>
        <vers num="6.0.2.0"/>
        <vers num="7.0"/>
        <vers num="7.0(1)e3"/>
        <vers num="7.0(2)e3"/>
        <vers num="7.0(2)e4"/>
        <vers num="7.0(3)e4"/>
        <vers num="7.0(4)e4"/>
        <vers num="7.0(5a)e4"/>
        <vers num="7.0(6)e4"/>
        <vers num="7.0(7)e4"/>
        <vers num="7.0(8)e4"/>
        <vers num="7.0(9)e4"/>
        <vers num="7.1"/>
      </prod>
      <prod vendor="cisco" name="intrusion_prevention_system">
        <vers num=""/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2104" published="2014-03-01" name="CVE-2014-2104" modified="2014-03-03" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Multiple cross-site scripting (XSS) vulnerabilities in the Business Voice Services Manager (BVSM) page in Cisco Unified Communications Domain Manager 9.0(.1) allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug IDs CSCum78536, CSCum78526, CSCum69809, and CSCum63113.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/viewAlert.x?alertId=33111" source="CONFIRM" adv="1">http://tools.cisco.com/security/center/viewAlert.x?alertId=33111</ref>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2104" source="CISCO" adv="1">20140227 Cisco Unified Communications Domain Manager Cross-Site Scripting Vulnerability</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="unified_communications_domain_manager">
        <vers num="9.0(.1)"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2106" published="2014-03-27" name="CVE-2014-2106" modified="2014-03-28" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:C)" CVSS_score="7.8" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="10.0" CVSS_base_score="7.8">
    <desc>
      <descript source="cve">Cisco IOS 15.3M before 15.3(3)M2 and IOS XE 3.10.xS before 3.10.2S allow remote attackers to cause a denial of service (device reload) via crafted SIP messages, aka Bug ID CSCug45898.</descript>
    </desc>
    <impacts>
      <impact source="nvd">Per: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140326-sip

"The following Cisco IOS Software and Cisco IOS XE Software releases are affected by this vulnerability:

    Cisco IOS Software release 15.3(3)M and 15.3(3)M1
    Cisco IOS XE Software release 3.10.0S and 3.10.1S1"</impact>
    </impacts>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140326-sip" source="CISCO" adv="1">20140326 Cisco IOS Software Session Initiation Protocol Denial of Service Vulnerability</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="ios">
        <vers num="15.3(3)m"/>
        <vers num="15.3(3)m1"/>
      </prod>
      <prod vendor="cisco" name="ios_xe">
        <vers num="3.10.0s"/>
        <vers num="3.10.1s1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2107" published="2014-03-27" name="CVE-2014-2107" modified="2014-03-28" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:N/A:C)" CVSS_score="7.1" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="8.6" CVSS_base_score="7.1">
    <desc>
      <descript source="cve">Cisco IOS 12.2 and 15.0 through 15.3, when used with the Kailash FPGA before 2.6 on RSP720-3C-10GE and RSP720-3CXL-10GE devices, allows remote attackers to cause a denial of service (route switch processor outage) via crafted IP packets, aka Bug ID CSCug84789.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140326-RSP72010GE" source="CISCO" adv="1">20140326 Cisco 7600 Series Route Switch Processor 720 with 10 Gigabit Ethernet Uplinks Denial of Service Vulnerability</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="ios">
        <vers num="12.2"/>
        <vers num="15.0"/>
        <vers num="15.0(1)se"/>
        <vers num="15.1"/>
        <vers num="15.2"/>
        <vers num="15.3"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2108" published="2014-03-27" name="CVE-2014-2108" modified="2014-03-28" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:C)" CVSS_score="7.8" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="10.0" CVSS_base_score="7.8">
    <desc>
      <descript source="cve">Cisco IOS 12.2 and 15.0 through 15.3 and IOS XE 3.2 through 3.7 before 3.7.5S and 3.8 through 3.10 before 3.10.1S allow remote attackers to cause a denial of service (device reload) via a malformed IKEv2 packet, aka Bug ID CSCui88426.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140326-ikev2" source="CISCO" adv="1">20140326 Cisco IOS Software Internet Key Exchange Version 2 Denial of Service Vulnerability</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="ios">
        <vers num="12.2"/>
        <vers num="15.0"/>
        <vers num="15.0(1)se"/>
        <vers num="15.1"/>
        <vers num="15.2"/>
        <vers num="15.3"/>
      </prod>
      <prod vendor="cisco" name="ios_xe">
        <vers num="3.10"/>
        <vers num="3.2.0s"/>
        <vers num="3.2.0sg"/>
        <vers num="3.2.0xo"/>
        <vers num="3.2.1s"/>
        <vers num="3.2.1sg"/>
        <vers num="3.2.2s"/>
        <vers num="3.2.2sg"/>
        <vers num="3.2.3sg"/>
        <vers num="3.2.4sg"/>
        <vers num="3.2s(.0)"/>
        <vers num="3.2s(.1)"/>
        <vers num="3.2s(.2)"/>
        <vers num="3.3.0s"/>
        <vers num="3.3.0sg"/>
        <vers num="3.3.1s"/>
        <vers num="3.3.1sg"/>
        <vers num="3.3.2s"/>
        <vers num="3.3.3s"/>
        <vers num="3.3s(.0)"/>
        <vers num="3.3s(.1)"/>
        <vers num="3.3s(.2)"/>
        <vers num="3.4.0as"/>
        <vers num="3.4.0s"/>
        <vers num="3.4.1s"/>
        <vers num="3.4.2s"/>
        <vers num="3.4.3s"/>
        <vers num="3.4.4s"/>
        <vers num="3.4.5s"/>
        <vers num="3.4.xs"/>
        <vers num="3.4s(.0)"/>
        <vers num="3.4s(.1)"/>
        <vers num="3.4s(.2)"/>
        <vers num="3.4s(.3)"/>
        <vers num="3.4s(.4)"/>
        <vers num="3.4s(.5)"/>
        <vers num="3.4s(.6)"/>
        <vers num="3.5.0s"/>
        <vers num="3.5.1s"/>
        <vers num="3.5.2s"/>
        <vers num="3.5.xs"/>
        <vers num="3.5s(.0)"/>
        <vers num="3.5s(.1)"/>
        <vers num="3.5s(.2)"/>
        <vers num="3.6.0s"/>
        <vers num="3.6.1s"/>
        <vers num="3.6.2s"/>
        <vers num="3.6s(.0)"/>
        <vers num="3.6s(.1)"/>
        <vers num="3.6s(.2)"/>
        <vers num="3.7.0s"/>
        <vers num="3.7.1s"/>
        <vers num="3.7.2s"/>
        <vers num="3.7s(.0)"/>
        <vers num="3.7s(.1)"/>
        <vers num="3.8.0s"/>
        <vers num="3.8s(.0)"/>
        <vers num="3.8s(.1)"/>
        <vers num="3.8s(.2)"/>
        <vers num="3.9.0s"/>
        <vers num="3.9.1s"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2109" published="2014-03-27" name="CVE-2014-2109" modified="2014-03-28" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:C)" CVSS_score="7.8" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="10.0" CVSS_base_score="7.8">
    <desc>
      <descript source="cve">The TCP Input module in Cisco IOS 12.2 through 12.4 and 15.0 through 15.4, when NAT is used, allows remote attackers to cause a denial of service (memory consumption or device reload) via crafted TCP packets, aka Bug IDs CSCuh33843 and CSCuj41494.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140326-nat" source="CISCO" adv="1">20140326 Cisco IOS Software Network Address Translation Vulnerabilities</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="ios">
        <vers num="12.2"/>
        <vers num="12.3"/>
        <vers num="12.4"/>
        <vers num="15.0"/>
        <vers num="15.1"/>
        <vers num="15.2"/>
        <vers num="15.3"/>
        <vers num="15.4"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2111" published="2014-03-27" name="CVE-2014-2111" modified="2014-03-28" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:N/A:C)" CVSS_score="7.1" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="8.6" CVSS_base_score="7.1">
    <desc>
      <descript source="cve">The Application Layer Gateway (ALG) module in Cisco IOS 12.2 through 12.4 and 15.0 through 15.4, when NAT is used, allows remote attackers to cause a denial of service (device reload) via crafted DNS packets, aka Bug ID CSCue00996.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140326-nat" source="CISCO" adv="1">20140326 Cisco IOS Software Network Address Translation Vulnerabilities</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="ios">
        <vers num="12.2"/>
        <vers num="12.3"/>
        <vers num="12.4"/>
        <vers num="15.0"/>
        <vers num="15.1"/>
        <vers num="15.2"/>
        <vers num="15.3"/>
        <vers num="15.4"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2112" published="2014-03-27" name="CVE-2014-2112" modified="2014-03-28" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:C)" CVSS_score="7.8" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="10.0" CVSS_base_score="7.8">
    <desc>
      <descript source="cve">The SSL VPN (aka WebVPN) feature in Cisco IOS 15.1 through 15.4 allows remote attackers to cause a denial of service (memory consumption) via crafted HTTP requests, aka Bug ID CSCuf51357.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140326-ios-sslvpn" source="CISCO" adv="1">20140326 Cisco IOS Software SSL VPN Denial of Service Vulnerability</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="ios">
        <vers num="15.1"/>
        <vers num="15.2"/>
        <vers num="15.3"/>
        <vers num="15.4"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2113" published="2014-03-27" name="CVE-2014-2113" modified="2014-03-28" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:C)" CVSS_score="7.8" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="10.0" CVSS_base_score="7.8">
    <desc>
      <descript source="cve">Cisco IOS 15.1 through 15.3 and IOS XE 3.3 and 3.5 before 3.5.2E; 3.7 before 3.7.5S; and 3.8, 3.9, and 3.10 before 3.10.2S allow remote attackers to cause a denial of service (I/O memory consumption and device reload) via a malformed IPv6 packet, aka Bug ID CSCui59540.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140326-ipv6" source="CISCO" adv="1">20140326 Cisco IOS Software Crafted IPv6 Packet Denial of Service Vulnerability</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="ios">
        <vers num="15.1"/>
        <vers num="15.2"/>
        <vers num="15.3"/>
      </prod>
      <prod vendor="cisco" name="ios_xe">
        <vers num="3.10"/>
        <vers num="3.10.0s"/>
        <vers num="3.10.1s"/>
        <vers num="3.10.1s1"/>
        <vers num="3.3.0s"/>
        <vers num="3.3.0sg"/>
        <vers num="3.3.1s"/>
        <vers num="3.3.1sg"/>
        <vers num="3.3.2s"/>
        <vers num="3.3.3s"/>
        <vers num="3.3s(.0)"/>
        <vers num="3.3s(.1)"/>
        <vers num="3.3s(.2)"/>
        <vers num="3.5.0s"/>
        <vers num="3.5.1s"/>
        <vers num="3.5.xs"/>
        <vers num="3.5s(.0)"/>
        <vers num="3.5s(.1)"/>
        <vers num="3.5s(.2)"/>
        <vers num="3.7.0s"/>
        <vers num="3.7.1s"/>
        <vers num="3.7.2s"/>
        <vers num="3.7s(.0)"/>
        <vers num="3.7s(.1)"/>
        <vers num="3.8.0s"/>
        <vers num="3.8s(.0)"/>
        <vers num="3.8s(.1)"/>
        <vers num="3.8s(.2)"/>
        <vers num="3.9.0s"/>
        <vers num="3.9.1s"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2114" published="2014-04-04" name="CVE-2014-2114" modified="2014-04-04" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in UserServlet in Cisco Emergency Responder (ER) 8.6 and earlier allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCun24384.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/viewAlert.x?alertId=33644" source="CONFIRM" adv="1">http://tools.cisco.com/security/center/viewAlert.x?alertId=33644</ref>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2114" source="CISCO" adv="1">20140403 Cisco Emergency Responder Cross-Site Scripting Vulnerability</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="emergency_responder">
        <vers prev="1" num="8.6"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2115" published="2014-04-04" name="CVE-2014-2115" modified="2014-04-04" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:P)" CVSS_score="6.8" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.6" CVSS_base_score="6.8">
    <desc>
      <descript source="cve">Multiple cross-site request forgery (CSRF) vulnerabilities in CERUserServlet pages in Cisco Emergency Responder (ER) 8.6 and earlier allow remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCun24250.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/viewAlert.x?alertId=33643" source="CONFIRM" adv="1">http://tools.cisco.com/security/center/viewAlert.x?alertId=33643</ref>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2115" source="CISCO" adv="1">20140403 Cisco Emergency Responder Cross-Site Request Forgery Vulnerability</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="emergency_responder">
        <vers prev="1" num="8.6"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2116" published="2014-04-04" name="CVE-2014-2116" modified="2014-04-04" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Cisco Emergency Responder (ER) 8.6 and earlier allows remote attackers to inject web pages and modify dynamic content via unspecified parameters, aka Bug ID CSCun37882.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/viewAlert.x?alertId=33641" source="CONFIRM" adv="1">http://tools.cisco.com/security/center/viewAlert.x?alertId=33641</ref>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2116" source="CISCO" adv="1">20140403 Cisco Emergency Responder Dynamic Content Modification Vulnerability</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="emergency_responder">
        <vers prev="1" num="8.6"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2117" published="2014-04-04" name="CVE-2014-2117" modified="2014-04-04" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Multiple open redirect vulnerabilities in Cisco Emergency Responder (ER) 8.6 and earlier allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified parameters, aka Bug ID CSCun37909.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/viewAlert.x?alertId=33642" source="CONFIRM" adv="1">http://tools.cisco.com/security/center/viewAlert.x?alertId=33642</ref>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2117" source="CISCO" adv="1">20140403 Cisco Emergency Responder Open Redirect Vulnerability</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="emergency_responder">
        <vers prev="1" num="8.6"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2118" published="2014-03-27" name="CVE-2014-2118" modified="2014-03-28" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Multiple cross-site scripting (XSS) vulnerabilities in dashboard-related HTML documents in Cisco Prime Security Manager (aka PRSM) 9.2(.1-2) and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug ID CSCun50687.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/viewAlert.x?alertId=33542" source="CONFIRM" adv="1">http://tools.cisco.com/security/center/viewAlert.x?alertId=33542</ref>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2118" source="CISCO" adv="1">20140327 Cisco Prime Security Manager Cross-Site Scripting Vulnerability</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="prime_security_manager">
        <vers num="9.0"/>
        <vers num="9.1"/>
        <vers num="9.1.2-29"/>
        <vers num="9.1.2-42"/>
        <vers num="9.1.3-10"/>
        <vers num="9.1.3-13"/>
        <vers num="9.1.3-8"/>
        <vers num="9.2"/>
        <vers num="9.2.1-1"/>
        <vers prev="1" num="9.2.1-2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2119" published="2014-03-20" name="CVE-2014-2119" modified="2014-03-21" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:S/C:C/I:C/A:C)" CVSS_score="8.5" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="6.8" CVSS_base_score="8.5">
    <desc>
      <descript source="cve">The End User Safelist/Blocklist (aka SLBL) service in Cisco AsyncOS Software for Email Security Appliance (ESA) before 7.6.3-023 and 8.x before 8.0.1-023 and Cisco Content Security Management Appliance (SMA) before 7.9.1-110 and 8.x before 8.1.1-013 allows remote authenticated users to execute arbitrary code with root privileges via an FTP session that uploads a modified SLBL database file, aka Bug IDs CSCug79377 and CSCug80118.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140319-asyncos" source="CISCO" adv="1">20140319 Cisco AsyncOS Software Code Execution Vulnerability</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="content_security_management_appliance">
        <vers num="-"/>
      </prod>
      <prod vendor="cisco" name="email_security_appliance">
        <vers num="-"/>
      </prod>
      <prod vendor="cisco" name="ironport_asyncos">
        <vers prev="1" num="7.6.2-201"/>
        <vers prev="1" num="7.9.1-039"/>
        <vers num="8.0"/>
        <vers num="8.0.1"/>
        <vers num="8.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2120" published="2014-03-18" name="CVE-2014-2120" modified="2014-03-19" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in the WebVPN login page in Cisco Adaptive Security Appliance (ASA) Software allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCun19025.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2120" source="CISCO" adv="1">20140318 Cisco Adaptive Security Appliance WebVPN Login Page Cross-Site Scripting Vulnerability</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="adaptive_security_appliance_software">
        <vers num="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2121" published="2014-03-18" name="CVE-2014-2121" modified="2014-04-01" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:P)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">The Java-based software in Cisco Hosted Collaboration Solution (HCS) allows remote attackers to cause a denial of service (closing of TCP ports) via unspecified vectors, aka Bug IDs CSCug77633, CSCug77667, CSCug78266, CSCug82795, and CSCuh58643.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.securitytracker.com/id/1029933" source="SECTRACK">1029933</ref>
      <ref url="http://www.securityfocus.com/bid/66283" source="BID">66283</ref>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2121" source="CISCO" adv="1">20140318 Cisco Hosted Collaboration Solution Denial of Service Vulnerability</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="hosted_collaboration_solution">
        <vers num="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2122" published="2014-03-18" name="CVE-2014-2122" modified="2014-04-01" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:P)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">Memory leak in the GUI in the Impact server in Cisco Hosted Collaboration Solution (HCS) allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors, aka Bug ID CSCub58999.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/91907" source="XF">cisco-hosted-cve20142122-dos(91907)</ref>
      <ref url="http://www.securitytracker.com/id/1029936" source="SECTRACK">1029936</ref>
      <ref url="http://www.securityfocus.com/bid/66293" source="BID">66293</ref>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2122" source="CISCO" adv="1">20140318 Cisco Hosted Collaboration Solution Memory Leak Vulnerability</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="hosted_collaboration_solution">
        <vers num="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2124" published="2014-03-20" name="CVE-2014-2124" modified="2014-04-01" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:N/A:C)" CVSS_score="7.1" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="8.6" CVSS_base_score="7.1">
    <desc>
      <descript source="cve">Cisco IOS 15.1(2)SY3 and earlier, when used with Supervisor Engine 2T (aka Sup2T) on Catalyst 6500 devices, allows remote attackers to cause a denial of service (device crash) via crafted multicast packets, aka Bug ID CSCuf60783.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/91904" source="XF">ciscoios-cve20142124-dos(91904)</ref>
      <ref url="http://www.securitytracker.com/id/1029942" source="SECTRACK">1029942</ref>
      <ref url="http://www.securityfocus.com/bid/66301" source="BID">66301</ref>
      <ref url="http://tools.cisco.com/security/center/viewAlert.x?alertId=33413" source="CONFIRM" adv="1">http://tools.cisco.com/security/center/viewAlert.x?alertId=33413</ref>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2124" source="CISCO" adv="1">20140319 Cisco IOS Software Sup2T Denial of Service Vulnerability</ref>
      <ref url="http://secunia.com/advisories/57515" source="SECUNIA">57515</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="catalyst_6500">
        <vers num=""/>
      </prod>
      <prod vendor="cisco" name="ios">
        <vers prev="1" num="15.1(2)sy3"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2125" published="2014-04-01" name="CVE-2014-2125" modified="2014-04-02" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in the Web Inbox in Cisco Unity Connection 8.6(2a)SU3 and earlier allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCui33028.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/viewAlert.x?alertId=33603" source="CONFIRM" adv="1">http://tools.cisco.com/security/center/viewAlert.x?alertId=33603</ref>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2125" source="CISCO" adv="1">20140401 Cisco Unity Connection Cross-Site Scripting Vulnerability</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="unity_connection">
        <vers prev="1" num="8.6" edition="(1)"/>
        <vers prev="1" num="8.6" edition="(2)"/>
        <vers prev="1" num="8.6" edition="(2a)su1"/>
        <vers prev="1" num="8.6" edition="(2a)su2"/>
        <vers prev="1" num="8.6" edition="(2a)su3"/>
        <vers num="8.6(1a)"/>
        <vers num="8.6(2a)"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2126" published="2014-04-10" name="CVE-2014-2126" modified="2014-04-10" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:S/C:C/I:C/A:C)" CVSS_score="8.5" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="6.8" CVSS_base_score="8.5">
    <desc>
      <descript source="cve">Cisco Adaptive Security Appliance (ASA) Software 8.2 before 8.2(5.47), 8.4 before 8.4(7.5), 8.7 before 8.7(1.11), 9.0 before 9.0(3.10), and 9.1 before 9.1(3.4) allows remote authenticated users to gain privileges by leveraging level-0 ASDM access, aka Bug ID CSCuj33496.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140409-asa" source="CISCO" adv="1">20140409 Multiple Vulnerabilities in Cisco ASA Software</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="adaptive_security_appliance_software">
        <vers num="8.2"/>
        <vers num="8.4"/>
        <vers num="8.7"/>
        <vers num="9.0"/>
        <vers num="9.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2127" published="2014-04-10" name="CVE-2014-2127" modified="2014-04-10" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:S/C:C/I:C/A:C)" CVSS_score="8.5" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="6.8" CVSS_base_score="8.5">
    <desc>
      <descript source="cve">Cisco Adaptive Security Appliance (ASA) Software 8.x before 8.2(5.48), 8.3 before 8.3(2.40), 8.4 before 8.4(7.9), 8.6 before 8.6(1.13), 9.0 before 9.0(4.1), and 9.1 before 9.1(4.3) does not properly process management-session information during privilege validation for SSL VPN portal connections, which allows remote authenticated users to gain privileges by establishing a Clientless SSL VPN session and entering crafted URLs, aka Bug ID CSCul70099.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140409-asa" source="CISCO" adv="1">20140409 Multiple Vulnerabilities in Cisco ASA Software</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="adaptive_security_appliance_software">
        <vers num="8.0"/>
        <vers num="8.1"/>
        <vers num="8.2"/>
        <vers num="8.3(1)"/>
        <vers num="8.4"/>
        <vers num="8.6"/>
        <vers num="9.0"/>
        <vers num="9.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2128" published="2014-04-10" name="CVE-2014-2128" modified="2014-04-10" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:N/A:N)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">The SSL VPN implementation in Cisco Adaptive Security Appliance (ASA) Software 8.2 before 8.2(5.47, 8.3 before 8.3(2.40), 8.4 before 8.4(7.3), 8.6 before 8.6(1.13), 9.0 before 9.0(3.8), and 9.1 before 9.1(3.2) allows remote attackers to bypass authentication via (1) a crafted cookie value within modified HTTP POST data or (2) a crafted URL, aka Bug ID CSCua85555.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140409-asa" source="CISCO" adv="1">20140409 Multiple Vulnerabilities in Cisco ASA Software</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="adaptive_security_appliance_software">
        <vers num="8.2"/>
        <vers num="8.3(1)"/>
        <vers num="8.4"/>
        <vers num="8.6"/>
        <vers num="9.0"/>
        <vers num="9.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2129" published="2014-04-10" name="CVE-2014-2129" modified="2014-04-10" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:N/A:C)" CVSS_score="7.1" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="8.6" CVSS_base_score="7.1">
    <desc>
      <descript source="cve">The SIP inspection engine in Cisco Adaptive Security Appliance (ASA) Software 8.2 before 8.2(5.48), 8.4 before 8.4(6.5), 9.0 before 9.0(3.1), and 9.1 before 9.1(2.5) allows remote attackers to cause a denial of service (memory consumption or device reload) via crafted SIP packets, aka Bug ID CSCuh44052.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140409-asa" source="CISCO" adv="1">20140409 Multiple Vulnerabilities in Cisco ASA Software</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="adaptive_security_appliance_software">
        <vers num="8.2"/>
        <vers num="8.4"/>
        <vers num="9.0"/>
        <vers num="9.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2131" published="2014-03-28" name="CVE-2014-2131" modified="2014-03-31" CVSS_version="2.0" CVSS_vector="(AV:A/AC:L/Au:N/C:N/I:N/A:C)" CVSS_score="6.1" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="6.5" CVSS_base_score="6.1">
    <desc>
      <descript source="cve">The packet driver in Cisco IOS allows remote attackers to cause a denial of service (device reload) via a series of (1) Virtual Switching Systems (VSS) or (2) Bidirectional Forwarding Detection (BFD) packets, aka Bug IDs CSCug41049 and CSCue61890.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <local_network/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2131" source="CISCO" adv="1">20140328 Cisco IOS Software High Priority Queue Denial of Service Vulnerability</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="ios">
        <vers num="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2137" published="2014-04-01" name="CVE-2014-2137" modified="2014-04-02" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">CRLF injection vulnerability in the web framework in Cisco Web Security Appliance (WSA) 7.7 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct redirection attacks via a crafted URL, aka Bug ID CSCuj61002.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/viewAlert.x?alertId=33608" source="CONFIRM" adv="1">http://tools.cisco.com/security/center/viewAlert.x?alertId=33608</ref>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2137" source="CISCO" adv="1">20140401 Cisco WSA HTTP Header Injection Vulnerability</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="web_security_virtual_appliance">
        <vers num="7.1.0"/>
        <vers num="7.1.1"/>
        <vers num="7.1.2"/>
        <vers num="7.1.3"/>
        <vers num="7.1.4"/>
        <vers num="7.5.0"/>
        <vers num="7.5.1"/>
        <vers prev="1" num="7.7"/>
      </prod>
      <prod vendor="cisco" name="web_security_appliance">
        <vers num="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2138" published="2014-04-01" name="CVE-2014-2138" modified="2014-04-02" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">CRLF injection vulnerability in the web framework in Cisco Security Manager 4.2 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct redirection attacks via a crafted URL, aka Bug ID CSCun82349.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/viewAlert.x?alertId=33607" source="CONFIRM" adv="1">http://tools.cisco.com/security/center/viewAlert.x?alertId=33607</ref>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2138" source="CISCO" adv="1">20140401 Cisco Security Manager HTTP Header Redirection Vulnerability</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="security_manager">
        <vers num="3.0.2"/>
        <vers num="3.1"/>
        <vers num="3.1.1" edition="sp3"/>
        <vers num="3.2" edition="sp1"/>
        <vers num="3.2" edition="sp2"/>
        <vers num="3.2.1" edition="sp1"/>
        <vers num="3.2.2" edition="-"/>
        <vers num="3.2.2" edition="sp1"/>
        <vers num="3.2.2" edition="sp2"/>
        <vers num="3.2.2" edition="sp3"/>
        <vers num="3.2.2" edition="sp4"/>
        <vers num="3.3" edition="-"/>
        <vers num="3.3" edition="sp1"/>
        <vers num="3.3" edition="sp2"/>
        <vers num="3.3.1" edition="-"/>
        <vers num="3.3.1" edition="sp1"/>
        <vers num="3.3.1" edition="sp2"/>
        <vers num="3.3.1" edition="sp3"/>
        <vers num="3.3.1" edition="sp4"/>
        <vers num="4.0" edition="-"/>
        <vers num="4.0" edition="sp1"/>
        <vers num="4.0.1" edition="-"/>
        <vers num="4.0.1" edition="sp1"/>
        <vers num="4.0.1" edition="sp2"/>
        <vers num="4.1" edition="sp1"/>
        <vers num="4.1" edition="sp2"/>
        <vers prev="1" num="4.2" edition="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2139" published="2014-04-12" name="CVE-2014-2139" modified="2014-04-14" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:P)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">Cisco ONS 15454 controller cards with software 9.6 and earlier allow remote attackers to cause a denial of service (flash write outage) via a TCP FIN attack that triggers file-descriptor exhaustion, aka Bug ID CSCug97315.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/viewAlert.x?alertId=33681" source="CONFIRM" adv="1">http://tools.cisco.com/security/center/viewAlert.x?alertId=33681</ref>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2139" source="CISCO" adv="1">20140407 Cisco ONS 15454 Controller Card Denial of Service Vulnerability</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="ons_15454">
        <vers num=""/>
      </prod>
      <prod vendor="cisco" name="cisco_ons_15454_system_software">
        <vers num="9.0"/>
        <vers num="9.1"/>
        <vers num="9.2"/>
        <vers num="9.2.1"/>
        <vers num="9.2.2"/>
        <vers num="9.3"/>
        <vers num="9.4"/>
        <vers prev="1" num="9.6"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2140" published="2014-04-12" name="CVE-2014-2140" modified="2014-04-14" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:P)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">Cisco ONS 15454 controller cards with software 9.6 and earlier allow remote attackers to cause a denial of service (card reset) via a TCP FIN attack that triggers file-descriptor exhaustion and a failure to open a CAL pipe, aka Bug ID CSCug97348.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/viewAlert.x?alertId=33680" source="CONFIRM" adv="1">http://tools.cisco.com/security/center/viewAlert.x?alertId=33680</ref>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2140" source="CISCO" adv="1">20140407 Cisco ONS 15454 Controller Card Denial of Service Vulnerability</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="ons_15454">
        <vers num=""/>
      </prod>
      <prod vendor="cisco" name="cisco_ons_15454_system_software">
        <vers num="9.0"/>
        <vers num="9.1"/>
        <vers num="9.2"/>
        <vers num="9.2.1"/>
        <vers num="9.2.2"/>
        <vers num="9.3"/>
        <vers num="9.4"/>
        <vers prev="1" num="9.6"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2141" published="2014-04-10" name="CVE-2014-2141" modified="2014-04-10" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:N/I:N/A:P)" CVSS_score="4.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.0" CVSS_base_score="4.0">
    <desc>
      <descript source="cve">The session-termination functionality on Cisco ONS 15454 controller cards with software 9.6 and earlier does not initialize an unspecified pointer, which allows remote authenticated users to cause a denial of service (card reset) via crafted session-close actions, aka Bug ID CSCug97416.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/viewAlert.x?alertId=33682" source="CONFIRM" adv="1">http://tools.cisco.com/security/center/viewAlert.x?alertId=33682</ref>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2141" source="CISCO" adv="1">20140407 Cisco ONS 15454 Controller Card Denial of Service Vulnerability</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="ons_15454">
        <vers num=""/>
      </prod>
      <prod vendor="cisco" name="cisco_ons_15454_system_software">
        <vers num="9.0"/>
        <vers num="9.1"/>
        <vers num="9.2"/>
        <vers num="9.2.1"/>
        <vers num="9.2.2"/>
        <vers num="9.3"/>
        <vers num="9.4"/>
        <vers prev="1" num="9.6"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2142" published="2014-04-12" name="CVE-2014-2142" modified="2014-04-14" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:P)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">Cisco ONS 15454 controller cards with software 10.0 and earlier allow remote attackers to cause a denial of service (card reload) via a crafted HTTP URI, aka Bug ID CSCun06870.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/viewAlert.x?alertId=33679" source="CONFIRM" adv="1">http://tools.cisco.com/security/center/viewAlert.x?alertId=33679</ref>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2142" source="CISCO" adv="1">20140407 Cisco ONS 15454 Controller Card Denial of Service Vulnerability</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="ons_15454">
        <vers num=""/>
      </prod>
      <prod vendor="cisco" name="cisco_ons_15454_system_software">
        <vers num="9.0"/>
        <vers num="9.1"/>
        <vers num="9.2"/>
        <vers num="9.2.1"/>
        <vers num="9.2.2"/>
        <vers num="9.3"/>
        <vers num="9.4"/>
        <vers num="9.6"/>
      </prod>
      <prod vendor="cisco" name="ons_15454_system_software">
        <vers prev="1" num="10.0"/>
        <vers num="9.8"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2143" published="2014-04-04" name="CVE-2014-2143" modified="2014-04-04" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:P)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">The IKE implementation in Cisco IOS 15.4(1)T and earlier and IOS XE allows remote attackers to cause a denial of service (security-association drop) via crafted Main Mode packets, aka Bug ID CSCun31021.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/viewAlert.x?alertId=33639" source="CONFIRM" adv="1">http://tools.cisco.com/security/center/viewAlert.x?alertId=33639</ref>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2143" source="CISCO" adv="1">20140403 Cisco IOS Software IKE Main Mode Vulnerability</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="ios">
        <vers num="15.0"/>
        <vers num="15.0(1)se"/>
        <vers num="15.1"/>
        <vers num="15.2"/>
        <vers num="15.3"/>
        <vers num="15.3(2)s"/>
        <vers num="15.3(3)m"/>
        <vers num="15.3(3)m1"/>
        <vers num="15.3(3)m2"/>
        <vers num="15.3(3)s"/>
        <vers num="15.3s"/>
        <vers num="15.4"/>
        <vers prev="1" num="15.4(1)t"/>
      </prod>
      <prod vendor="cisco" name="ios_xe">
        <vers num="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2144" published="2014-04-05" name="CVE-2014-2144" modified="2014-04-07" CVSS_version="2.0" CVSS_vector="(AV:A/AC:L/Au:N/C:N/I:N/A:C)" CVSS_score="6.1" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="6.5" CVSS_base_score="6.1">
    <desc>
      <descript source="cve">Cisco IOS XR does not properly throttle ICMPv6 redirect packets, which allows remote attackers to cause a denial of service (IPv4 and IPv6 transit outage) via crafted redirect messages, aka Bug ID CSCum14266.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <local_network/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2144" source="CISCO" adv="1">20140404 Cisco IOS XR Software ICMPv6 Redirect Vulnerability</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="ios_xr">
        <vers num=""/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2145" published="2014-04-05" name="CVE-2014-2145" modified="2014-04-07" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:P/I:N/A:N)" CVSS_score="4.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.0" CVSS_base_score="4.0">
    <desc>
      <descript source="cve">Directory traversal vulnerability in the messaging API in Cisco Unity Connection allows remote authenticated users to read arbitrary files via vectors related to unenforced access constraints for .wav files and the audio/x-wav MIME type, aka Bug ID CSCun91071.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2145" source="CISCO" adv="1">20140404 Cisco Unity Connection Directory Traversal Vulnerability</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="unity_connection">
        <vers num="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2154" published="2014-04-23" name="CVE-2014-2154" modified="2014-04-24" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:P)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">Memory leak in the SIP inspection engine in Cisco Adaptive Security Appliance (ASA) Software allows remote attackers to cause a denial of service (memory consumption and instability) via crafted SIP packets, aka Bug ID CSCuf67469.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2154" source="CISCO" adv="1">20140422 Cisco ASA SIP Inspection Memory Leak Vulnerability</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="adaptive_security_appliance_software">
        <vers num="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2155" published="2014-04-19" name="CVE-2014-2155" modified="2014-04-21" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:P)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">The DHCPv6 server module in Cisco CNS Network Registrar 7.1 allows remote attackers to cause a denial of service (daemon reload) via a malformed DHCPv6 packet, aka Bug ID CSCuo07437.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/viewAlert.x?alertId=33850" source="CONFIRM" adv="1">http://tools.cisco.com/security/center/viewAlert.x?alertId=33850</ref>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2155" source="CISCO" adv="1">20140417 Cisco Network Registrar DHCPv6 Denial of Service Vulnerability</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="cns_network_registrar">
        <vers num="7.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2156" published="2014-05-02" name="CVE-2014-2156" modified="2014-05-02" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:N/A:C)" CVSS_score="7.1" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="8.6" CVSS_base_score="7.1">
    <desc>
      <descript source="cve">Cisco TelePresence System MXP Series Software before F9.3.1 allows remote attackers to cause a denial of service (device reload) via crafted SIP packets, aka Bug ID CSCty45739.</descript>
    </desc>
    <impacts>
      <impact source="nvd">Per: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140430-mxp

" Vulnerable Products
The following products running a version of Cisco TelePresence System MXP Series Software prior to F9.3.1 are affected by the vulnerabilities described in this advisory:

    Cisco TelePresence System 1700 MXP
    Cisco TelePresence System 1000 MXP
    Cisco TelePresence System Edge 75 MXP
    Cisco TelePresence System Edge 85 MXP
    Cisco TelePresence System Edge 95 MXP
    Cisco TelePresence System Codec 3000 MXP
    Cisco TelePresence System Codec 6000 MXP
    Tandberg 550 MXP
    Tandberg 770 MXP
    Tandberg 880 MXP
    Tandberg 990 MXP
    Tandberg 2000 MXP"
</impact>
    </impacts>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140430-mxp" source="CISCO" adv="1">20140430 Multiple Vulnerabilities in Cisco TelePresence System MXP Series</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="telepresence_system_software">
        <vers num="f9.0.1"/>
        <vers num="f9.0.2"/>
        <vers num="f9.1.0"/>
        <vers num="f9.1.1"/>
        <vers num="f9.1.2"/>
        <vers prev="1" num="f9.3"/>
        <vers num="fnc9.1.0"/>
        <vers num="fnc9.1.1"/>
        <vers num="fnc9.1.2"/>
        <vers num="fnc9.3"/>
      </prod>
      <prod vendor="cisco" name="tandberg_2000_mxp">
        <vers num="-"/>
      </prod>
      <prod vendor="cisco" name="tandberg_550_mxp">
        <vers num="-"/>
      </prod>
      <prod vendor="cisco" name="tandberg_770_mxp">
        <vers num="-"/>
      </prod>
      <prod vendor="cisco" name="tandberg_880_mxp">
        <vers num="-"/>
      </prod>
      <prod vendor="cisco" name="tandberg_990_mxp">
        <vers num="-"/>
      </prod>
      <prod vendor="cisco" name="telepresence_system_1000_mxp">
        <vers num="-"/>
      </prod>
      <prod vendor="cisco" name="telepresence_system_1700_mxp">
        <vers num="-"/>
      </prod>
      <prod vendor="cisco" name="telepresence_system_codec_3000_mxp">
        <vers num="-"/>
      </prod>
      <prod vendor="cisco" name="telepresence_system_codec_6000_mxp">
        <vers num="-"/>
      </prod>
      <prod vendor="cisco" name="telepresence_system_edge_75_mxp">
        <vers num="-"/>
      </prod>
      <prod vendor="cisco" name="telepresence_system_edge_85_mxp">
        <vers num="-"/>
      </prod>
      <prod vendor="cisco" name="telepresence_system_edge_95_mxp">
        <vers num="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2157" published="2014-05-02" name="CVE-2014-2157" modified="2014-05-02" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:N/A:C)" CVSS_score="7.1" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="8.6" CVSS_base_score="7.1">
    <desc>
      <descript source="cve">Cisco TelePresence System MXP Series Software before F9.3.1 allows remote attackers to cause a denial of service (device reload) via crafted SIP packets, aka Bug ID CSCty45733.</descript>
    </desc>
    <impacts>
      <impact source="nvd">Per: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140430-mxp

" Vulnerable Products
The following products running a version of Cisco TelePresence System MXP Series Software prior to F9.3.1 are affected by the vulnerabilities described in this advisory:

    Cisco TelePresence System 1700 MXP
    Cisco TelePresence System 1000 MXP
    Cisco TelePresence System Edge 75 MXP
    Cisco TelePresence System Edge 85 MXP
    Cisco TelePresence System Edge 95 MXP
    Cisco TelePresence System Codec 3000 MXP
    Cisco TelePresence System Codec 6000 MXP
    Tandberg 550 MXP
    Tandberg 770 MXP
    Tandberg 880 MXP
    Tandberg 990 MXP
    Tandberg 2000 MXP"</impact>
    </impacts>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140430-mxp" source="CISCO" adv="1">20140430 Multiple Vulnerabilities in Cisco TelePresence System MXP Series</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="telepresence_system_software">
        <vers num="f9.0.1"/>
        <vers num="f9.0.2"/>
        <vers num="f9.1.0"/>
        <vers num="f9.1.1"/>
        <vers num="f9.1.2"/>
        <vers prev="1" num="f9.3"/>
        <vers num="fnc9.1.0"/>
        <vers num="fnc9.1.1"/>
        <vers num="fnc9.1.2"/>
        <vers num="fnc9.3"/>
      </prod>
      <prod vendor="cisco" name="tandberg_2000_mxp">
        <vers num="-"/>
      </prod>
      <prod vendor="cisco" name="tandberg_550_mxp">
        <vers num="-"/>
      </prod>
      <prod vendor="cisco" name="tandberg_770_mxp">
        <vers num="-"/>
      </prod>
      <prod vendor="cisco" name="tandberg_880_mxp">
        <vers num="-"/>
      </prod>
      <prod vendor="cisco" name="tandberg_990_mxp">
        <vers num="-"/>
      </prod>
      <prod vendor="cisco" name="telepresence_system_1000_mxp">
        <vers num="-"/>
      </prod>
      <prod vendor="cisco" name="telepresence_system_1700_mxp">
        <vers num="-"/>
      </prod>
      <prod vendor="cisco" name="telepresence_system_codec_3000_mxp">
        <vers num="-"/>
      </prod>
      <prod vendor="cisco" name="telepresence_system_codec_6000_mxp">
        <vers num="-"/>
      </prod>
      <prod vendor="cisco" name="telepresence_system_edge_75_mxp">
        <vers num="-"/>
      </prod>
      <prod vendor="cisco" name="telepresence_system_edge_85_mxp">
        <vers num="-"/>
      </prod>
      <prod vendor="cisco" name="telepresence_system_edge_95_mxp">
        <vers num="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2158" published="2014-05-02" name="CVE-2014-2158" modified="2014-05-02" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:C)" CVSS_score="7.8" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="10.0" CVSS_base_score="7.8">
    <desc>
      <descript source="cve">Cisco TelePresence System MXP Series Software before F9.3.1 allows remote attackers to cause a denial of service (device reload) via crafted SIP packets, aka Bug ID CSCty45720.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140430-mxp" source="CISCO" adv="1">20140430 Multiple Vulnerabilities in Cisco TelePresence System MXP Series</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="telepresence_system_software">
        <vers num="f9.0.1"/>
        <vers num="f9.0.2"/>
        <vers num="f9.1.0"/>
        <vers num="f9.1.1"/>
        <vers num="f9.1.2"/>
        <vers prev="1" num="f9.3"/>
        <vers num="fnc9.1.0"/>
        <vers num="fnc9.1.1"/>
        <vers num="fnc9.1.2"/>
        <vers num="fnc9.3"/>
      </prod>
      <prod vendor="cisco" name="tandberg_2000_mxp">
        <vers num="-"/>
      </prod>
      <prod vendor="cisco" name="tandberg_550_mxp">
        <vers num="-"/>
      </prod>
      <prod vendor="cisco" name="tandberg_770_mxp">
        <vers num="-"/>
      </prod>
      <prod vendor="cisco" name="tandberg_880_mxp">
        <vers num="-"/>
      </prod>
      <prod vendor="cisco" name="tandberg_990_mxp">
        <vers num="-"/>
      </prod>
      <prod vendor="cisco" name="telepresence_system_1000_mxp">
        <vers num="-"/>
      </prod>
      <prod vendor="cisco" name="telepresence_system_1700_mxp">
        <vers num="-"/>
      </prod>
      <prod vendor="cisco" name="telepresence_system_codec_3000_mxp">
        <vers num="-"/>
      </prod>
      <prod vendor="cisco" name="telepresence_system_codec_6000_mxp">
        <vers num="-"/>
      </prod>
      <prod vendor="cisco" name="telepresence_system_edge_75_mxp">
        <vers num="-"/>
      </prod>
      <prod vendor="cisco" name="telepresence_system_edge_85_mxp">
        <vers num="-"/>
      </prod>
      <prod vendor="cisco" name="telepresence_system_edge_95_mxp">
        <vers num="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2159" published="2014-05-02" name="CVE-2014-2159" modified="2014-05-02" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:C)" CVSS_score="7.8" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="10.0" CVSS_base_score="7.8">
    <desc>
      <descript source="cve">The H.225 subsystem in Cisco TelePresence System MXP Series Software before F9.3.1 allows remote attackers to cause a denial of service (device reload) via crafted packets, aka Bug ID CSCtq78722.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140430-mxp" source="CISCO" adv="1">20140430 Multiple Vulnerabilities in Cisco TelePresence System MXP Series</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="telepresence_system_software">
        <vers num="f9.0.1"/>
        <vers num="f9.0.2"/>
        <vers num="f9.1.0"/>
        <vers num="f9.1.1"/>
        <vers num="f9.1.2"/>
        <vers prev="1" num="f9.3"/>
        <vers num="fnc9.1.0"/>
        <vers num="fnc9.1.1"/>
        <vers num="fnc9.1.2"/>
        <vers num="fnc9.3"/>
      </prod>
      <prod vendor="cisco" name="tandberg_2000_mxp">
        <vers num="-"/>
      </prod>
      <prod vendor="cisco" name="tandberg_550_mxp">
        <vers num="-"/>
      </prod>
      <prod vendor="cisco" name="tandberg_770_mxp">
        <vers num="-"/>
      </prod>
      <prod vendor="cisco" name="tandberg_880_mxp">
        <vers num="-"/>
      </prod>
      <prod vendor="cisco" name="tandberg_990_mxp">
        <vers num="-"/>
      </prod>
      <prod vendor="cisco" name="telepresence_system_1000_mxp">
        <vers num="-"/>
      </prod>
      <prod vendor="cisco" name="telepresence_system_1700_mxp">
        <vers num="-"/>
      </prod>
      <prod vendor="cisco" name="telepresence_system_codec_3000_mxp">
        <vers num="-"/>
      </prod>
      <prod vendor="cisco" name="telepresence_system_codec_6000_mxp">
        <vers num="-"/>
      </prod>
      <prod vendor="cisco" name="telepresence_system_edge_75_mxp">
        <vers num="-"/>
      </prod>
      <prod vendor="cisco" name="telepresence_system_edge_85_mxp">
        <vers num="-"/>
      </prod>
      <prod vendor="cisco" name="telepresence_system_edge_95_mxp">
        <vers num="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2160" published="2014-05-02" name="CVE-2014-2160" modified="2014-05-02" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:C)" CVSS_score="7.8" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="10.0" CVSS_base_score="7.8">
    <desc>
      <descript source="cve">The H.225 subsystem in Cisco TelePresence System MXP Series Software before F9.3.1 allows remote attackers to cause a denial of service (device reload) via crafted packets, aka Bug ID CSCty45745.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140430-mxp" source="CISCO" adv="1">20140430 Multiple Vulnerabilities in Cisco TelePresence System MXP Series</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="telepresence_system_software">
        <vers num="f9.0.1"/>
        <vers num="f9.0.2"/>
        <vers num="f9.1.0"/>
        <vers num="f9.1.1"/>
        <vers num="f9.1.2"/>
        <vers prev="1" num="f9.3"/>
        <vers num="fnc9.1.0"/>
        <vers num="fnc9.1.1"/>
        <vers num="fnc9.1.2"/>
        <vers num="fnc9.3"/>
      </prod>
      <prod vendor="cisco" name="tandberg_2000_mxp">
        <vers num="-"/>
      </prod>
      <prod vendor="cisco" name="tandberg_550_mxp">
        <vers num="-"/>
      </prod>
      <prod vendor="cisco" name="tandberg_770_mxp">
        <vers num="-"/>
      </prod>
      <prod vendor="cisco" name="tandberg_880_mxp">
        <vers num="-"/>
      </prod>
      <prod vendor="cisco" name="tandberg_990_mxp">
        <vers num="-"/>
      </prod>
      <prod vendor="cisco" name="telepresence_system_1000_mxp">
        <vers num="-"/>
      </prod>
      <prod vendor="cisco" name="telepresence_system_1700_mxp">
        <vers num="-"/>
      </prod>
      <prod vendor="cisco" name="telepresence_system_codec_3000_mxp">
        <vers num="-"/>
      </prod>
      <prod vendor="cisco" name="telepresence_system_codec_6000_mxp">
        <vers num="-"/>
      </prod>
      <prod vendor="cisco" name="telepresence_system_edge_75_mxp">
        <vers num="-"/>
      </prod>
      <prod vendor="cisco" name="telepresence_system_edge_85_mxp">
        <vers num="-"/>
      </prod>
      <prod vendor="cisco" name="telepresence_system_edge_95_mxp">
        <vers num="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2161" published="2014-05-02" name="CVE-2014-2161" modified="2014-05-02" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:C)" CVSS_score="7.8" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="10.0" CVSS_base_score="7.8">
    <desc>
      <descript source="cve">The H.225 subsystem in Cisco TelePresence System MXP Series Software before F9.3.1 allows remote attackers to cause a denial of service (device reload) via crafted packets, aka Bug ID CSCty45731.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140430-mxp" source="CISCO" adv="1">20140430 Multiple Vulnerabilities in Cisco TelePresence System MXP Series</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="telepresence_system_software">
        <vers num="f9.0.1"/>
        <vers num="f9.0.2"/>
        <vers num="f9.1.0"/>
        <vers num="f9.1.1"/>
        <vers num="f9.1.2"/>
        <vers prev="1" num="f9.3"/>
        <vers num="fnc9.1.0"/>
        <vers num="fnc9.1.1"/>
        <vers num="fnc9.1.2"/>
        <vers num="fnc9.3"/>
      </prod>
      <prod vendor="cisco" name="tandberg_2000_mxp">
        <vers num="-"/>
      </prod>
      <prod vendor="cisco" name="tandberg_550_mxp">
        <vers num="-"/>
      </prod>
      <prod vendor="cisco" name="tandberg_770_mxp">
        <vers num="-"/>
      </prod>
      <prod vendor="cisco" name="tandberg_880_mxp">
        <vers num="-"/>
      </prod>
      <prod vendor="cisco" name="tandberg_990_mxp">
        <vers num="-"/>
      </prod>
      <prod vendor="cisco" name="telepresence_system_1000_mxp">
        <vers num="-"/>
      </prod>
      <prod vendor="cisco" name="telepresence_system_1700_mxp">
        <vers num="-"/>
      </prod>
      <prod vendor="cisco" name="telepresence_system_codec_3000_mxp">
        <vers num="-"/>
      </prod>
      <prod vendor="cisco" name="telepresence_system_codec_6000_mxp">
        <vers num="-"/>
      </prod>
      <prod vendor="cisco" name="telepresence_system_edge_75_mxp">
        <vers num="-"/>
      </prod>
      <prod vendor="cisco" name="telepresence_system_edge_85_mxp">
        <vers num="-"/>
      </prod>
      <prod vendor="cisco" name="telepresence_system_edge_95_mxp">
        <vers num="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2162" published="2014-05-02" name="CVE-2014-2162" modified="2014-05-02" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:C)" CVSS_score="7.8" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="10.0" CVSS_base_score="7.8">
    <desc>
      <descript source="cve">The SIP implementation in Cisco TelePresence TC Software 4.x and 5.x and TE Software 4.x and 6.0 allows remote attackers to cause a denial of service (device reload) via crafted SIP packets, aka Bug ID CSCud29566.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140430-tcte" source="CISCO" adv="1">20140430 Multiple Vulnerabilities in Cisco TelePresence TC and TE Software</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="telepresence_tc_software">
        <vers num="4.0.0"/>
        <vers num="4.0.1"/>
        <vers num="4.0.4"/>
        <vers num="4.1.1"/>
        <vers num="4.1.2"/>
        <vers num="4.2.0"/>
        <vers num="4.2.1"/>
        <vers num="4.2.2"/>
        <vers num="4.2.3"/>
        <vers num="4.2.4"/>
        <vers num="5.0.0"/>
        <vers num="5.0.1"/>
        <vers num="5.0.2"/>
        <vers num="5.1.0"/>
        <vers num="5.1.1"/>
        <vers num="5.1.2"/>
        <vers num="5.1.3"/>
        <vers num="5.1.4"/>
        <vers num="5.1.5"/>
        <vers num="5.1.6"/>
        <vers num="5.1.7"/>
      </prod>
      <prod vendor="cisco" name="telepresence_te_software">
        <vers num="4.1.0"/>
        <vers num="4.1.1"/>
        <vers num="4.1.2"/>
        <vers num="4.1.3"/>
        <vers num="6.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2163" published="2014-05-02" name="CVE-2014-2163" modified="2014-05-02" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:C)" CVSS_score="7.8" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="10.0" CVSS_base_score="7.8">
    <desc>
      <descript source="cve">The SIP implementation in Cisco TelePresence TC Software 4.x and 5.x and TE Software 4.x allows remote attackers to cause a denial of service (device reload) via crafted SIP packets, aka Bug ID CSCua64961.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140430-tcte" source="CISCO" adv="1">20140430 Multiple Vulnerabilities in Cisco TelePresence TC and TE Software</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="telepresence_tc_software">
        <vers num="4.0.0"/>
        <vers num="4.0.1"/>
        <vers num="4.0.4"/>
        <vers num="4.1.1"/>
        <vers num="4.1.2"/>
        <vers num="4.2.0"/>
        <vers num="4.2.1"/>
        <vers num="4.2.2"/>
        <vers num="4.2.3"/>
        <vers num="4.2.4"/>
        <vers num="5.0.0"/>
        <vers num="5.0.1"/>
        <vers num="5.0.2"/>
        <vers num="5.1.0"/>
        <vers num="5.1.1"/>
        <vers num="5.1.2"/>
        <vers num="5.1.3"/>
        <vers num="5.1.4"/>
        <vers num="5.1.5"/>
        <vers num="5.1.6"/>
        <vers num="5.1.7"/>
      </prod>
      <prod vendor="cisco" name="telepresence_te_software">
        <vers num="4.1.0"/>
        <vers num="4.1.1"/>
        <vers num="4.1.2"/>
        <vers num="4.1.3"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2164" published="2014-05-02" name="CVE-2014-2164" modified="2014-05-02" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:C)" CVSS_score="7.8" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="10.0" CVSS_base_score="7.8">
    <desc>
      <descript source="cve">The SIP implementation in Cisco TelePresence TC Software 4.x and 5.x and TE Software 4.x and 6.0 allows remote attackers to cause a denial of service (device reload) via crafted SIP packets, aka Bug ID CSCuj94651.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140430-tcte" source="CISCO" adv="1">20140430 Multiple Vulnerabilities in Cisco TelePresence TC and TE Software</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="telepresence_tc_software">
        <vers num="4.0.0"/>
        <vers num="4.0.1"/>
        <vers num="4.0.4"/>
        <vers num="4.1.1"/>
        <vers num="4.1.2"/>
        <vers num="4.2.0"/>
        <vers num="4.2.1"/>
        <vers num="4.2.2"/>
        <vers num="4.2.3"/>
        <vers num="4.2.4"/>
        <vers num="5.0.0"/>
        <vers num="5.0.1"/>
        <vers num="5.0.2"/>
        <vers num="5.1.0"/>
        <vers num="5.1.1"/>
        <vers num="5.1.2"/>
        <vers num="5.1.3"/>
        <vers num="5.1.4"/>
        <vers num="5.1.5"/>
        <vers num="5.1.6"/>
        <vers num="5.1.7"/>
      </prod>
      <prod vendor="cisco" name="telepresence_te_software">
        <vers num="4.1.0"/>
        <vers num="4.1.1"/>
        <vers num="4.1.2"/>
        <vers num="4.1.3"/>
        <vers num="6.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2165" published="2014-05-02" name="CVE-2014-2165" modified="2014-05-02" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:C)" CVSS_score="7.8" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="10.0" CVSS_base_score="7.8">
    <desc>
      <descript source="cve">The SIP implementation in Cisco TelePresence TC Software 4.x and 5.x and TE Software 4.x and 6.0 allows remote attackers to cause a denial of service (device reload) via crafted SIP packets, aka Bug ID CSCtq72699.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140430-tcte" source="CISCO" adv="1">20140430 Multiple Vulnerabilities in Cisco TelePresence TC and TE Software</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="telepresence_tc_software">
        <vers num="4.0.0"/>
        <vers num="4.0.1"/>
        <vers num="4.0.4"/>
        <vers num="4.1.1"/>
        <vers num="4.1.2"/>
        <vers num="4.2.0"/>
        <vers num="4.2.1"/>
        <vers num="4.2.2"/>
        <vers num="4.2.3"/>
        <vers num="4.2.4"/>
        <vers num="5.0.0"/>
        <vers num="5.0.1"/>
        <vers num="5.0.2"/>
        <vers num="5.1.0"/>
        <vers num="5.1.1"/>
        <vers num="5.1.2"/>
        <vers num="5.1.3"/>
        <vers num="5.1.4"/>
        <vers num="5.1.5"/>
        <vers num="5.1.6"/>
        <vers num="5.1.7"/>
      </prod>
      <prod vendor="cisco" name="telepresence_te_software">
        <vers num="4.1.0"/>
        <vers num="4.1.1"/>
        <vers num="4.1.2"/>
        <vers num="4.1.3"/>
        <vers num="6.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2166" published="2014-05-02" name="CVE-2014-2166" modified="2014-05-02" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:C)" CVSS_score="7.8" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="10.0" CVSS_base_score="7.8">
    <desc>
      <descript source="cve">The SIP implementation in Cisco TelePresence TC Software 4.x and TE Software 4.x allows remote attackers to cause a denial of service (device reload) via crafted SIP packets, aka Bug ID CSCto70562.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140430-tcte" source="CISCO" adv="1">20140430 Multiple Vulnerabilities in Cisco TelePresence TC and TE Software</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="telepresence_tc_software">
        <vers num="4.0.0"/>
        <vers num="4.0.1"/>
        <vers num="4.0.4"/>
        <vers num="4.1.1"/>
        <vers num="4.1.2"/>
        <vers num="4.2.0"/>
        <vers num="4.2.1"/>
        <vers num="4.2.2"/>
        <vers num="4.2.3"/>
        <vers num="4.2.4"/>
      </prod>
      <prod vendor="cisco" name="telepresence_te_software">
        <vers num="4.1.0"/>
        <vers num="4.1.1"/>
        <vers num="4.1.2"/>
        <vers num="4.1.3"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2167" published="2014-05-02" name="CVE-2014-2167" modified="2014-05-02" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:C)" CVSS_score="7.8" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="10.0" CVSS_base_score="7.8">
    <desc>
      <descript source="cve">The SIP implementation in Cisco TelePresence TC Software 4.x and 5.x and TE Software 4.x and 6.0 allows remote attackers to cause a denial of service (device reload) via crafted SIP packets, aka Bug ID CSCua86589.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140430-tcte" source="CISCO" adv="1">20140430 Multiple Vulnerabilities in Cisco TelePresence TC and TE Software</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="telepresence_tc_software">
        <vers num="4.0.0"/>
        <vers num="4.0.1"/>
        <vers num="4.0.4"/>
        <vers num="4.1.1"/>
        <vers num="4.1.2"/>
        <vers num="4.2.0"/>
        <vers num="4.2.1"/>
        <vers num="4.2.2"/>
        <vers num="4.2.3"/>
        <vers num="4.2.4"/>
        <vers num="5.0.0"/>
        <vers num="5.0.1"/>
        <vers num="5.0.2"/>
        <vers num="5.1.0"/>
        <vers num="5.1.1"/>
        <vers num="5.1.2"/>
        <vers num="5.1.3"/>
        <vers num="5.1.4"/>
        <vers num="5.1.5"/>
        <vers num="5.1.6"/>
        <vers num="5.1.7"/>
      </prod>
      <prod vendor="cisco" name="telepresence_te_software">
        <vers num="4.1.0"/>
        <vers num="4.1.1"/>
        <vers num="4.1.2"/>
        <vers num="4.1.3"/>
        <vers num="6.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2168" published="2014-05-02" name="CVE-2014-2168" modified="2014-05-02" CVSS_version="2.0" CVSS_vector="(AV:N/AC:H/Au:N/C:C/I:C/A:C)" CVSS_score="7.6" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="4.9" CVSS_base_score="7.6">
    <desc>
      <descript source="cve">Buffer overflow in Cisco TelePresence TC Software 4.x and 5.x and TE Software 4.x and 6.0 allows remote attackers to execute arbitrary code via crafted DNS response packets, aka Bug ID CSCty44804.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140430-tcte" source="CISCO" adv="1">20140430 Multiple Vulnerabilities in Cisco TelePresence TC and TE Software</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="telepresence_tc_software">
        <vers num="4.0.0"/>
        <vers num="4.0.1"/>
        <vers num="4.0.4"/>
        <vers num="4.1.1"/>
        <vers num="4.1.2"/>
        <vers num="4.2.0"/>
        <vers num="4.2.1"/>
        <vers num="4.2.2"/>
        <vers num="4.2.3"/>
        <vers num="4.2.4"/>
        <vers num="5.0.0"/>
        <vers num="5.0.1"/>
        <vers num="5.0.2"/>
        <vers num="5.1.0"/>
        <vers num="5.1.1"/>
        <vers num="5.1.2"/>
        <vers num="5.1.3"/>
        <vers num="5.1.4"/>
        <vers num="5.1.5"/>
        <vers num="5.1.6"/>
        <vers num="5.1.7"/>
      </prod>
      <prod vendor="cisco" name="telepresence_te_software">
        <vers num="4.1.0"/>
        <vers num="4.1.1"/>
        <vers num="4.1.2"/>
        <vers num="4.1.3"/>
        <vers num="6.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2169" published="2014-05-02" name="CVE-2014-2169" modified="2014-05-02" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:C/I:C/A:C)" CVSS_score="9.0" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.0" CVSS_base_score="9.0">
    <desc>
      <descript source="cve">Cisco TelePresence TC Software 4.x through 6.x before 6.2.0 and TE Software 4.x and 6.0 allow remote authenticated users to execute arbitrary commands by using the commands as arguments to internal system scripts, aka Bug ID CSCue60211.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140430-tcte" source="CISCO" adv="1">20140430 Multiple Vulnerabilities in Cisco TelePresence TC and TE Software</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="telepresence_tc_software">
        <vers num="4.0.0"/>
        <vers num="4.0.1"/>
        <vers num="4.0.4"/>
        <vers num="4.1.1"/>
        <vers num="4.1.2"/>
        <vers num="4.2.0"/>
        <vers num="4.2.1"/>
        <vers num="4.2.2"/>
        <vers num="4.2.3"/>
        <vers num="4.2.4"/>
        <vers num="5.0.0"/>
        <vers num="5.0.1"/>
        <vers num="5.0.2"/>
        <vers num="5.1.0"/>
        <vers num="5.1.1"/>
        <vers num="5.1.2"/>
        <vers num="5.1.3"/>
        <vers num="5.1.4"/>
        <vers num="5.1.5"/>
        <vers num="5.1.6"/>
        <vers num="5.1.7"/>
        <vers num="6.0.0"/>
        <vers num="6.0.1"/>
        <vers num="6.1.0"/>
        <vers num="6.1.1"/>
        <vers num="6.1.2"/>
      </prod>
      <prod vendor="cisco" name="telepresence_te_software">
        <vers num="4.1.0"/>
        <vers num="4.1.1"/>
        <vers num="4.1.2"/>
        <vers num="4.1.3"/>
        <vers num="6.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2170" published="2014-05-02" name="CVE-2014-2170" modified="2014-05-02" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:C/I:C/A:C)" CVSS_score="9.0" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.0" CVSS_base_score="9.0">
    <desc>
      <descript source="cve">Cisco TelePresence TC Software 4.x and 5.x before 5.1.7 and 6.x before 6.0.1 and TE Software 4.x and 6.0 allow remote authenticated users to execute arbitrary commands by using the commands as arguments to tshell (aka tcsh) scripts, aka Bug ID CSCue60202.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140430-tcte" source="CISCO" adv="1">20140430 Multiple Vulnerabilities in Cisco TelePresence TC and TE Software</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="telepresence_tc_software">
        <vers num="4.0.0"/>
        <vers num="4.0.1"/>
        <vers num="4.0.4"/>
        <vers num="4.1.1"/>
        <vers num="4.1.2"/>
        <vers num="4.2.0"/>
        <vers num="4.2.1"/>
        <vers num="4.2.2"/>
        <vers num="4.2.3"/>
        <vers num="4.2.4"/>
        <vers num="5.0.0"/>
        <vers num="5.0.1"/>
        <vers num="5.0.2"/>
        <vers num="5.1.0"/>
        <vers num="5.1.1"/>
        <vers num="5.1.2"/>
        <vers num="5.1.3"/>
        <vers num="5.1.4"/>
        <vers num="5.1.5"/>
        <vers num="5.1.6"/>
        <vers num="6.0.0"/>
      </prod>
      <prod vendor="cisco" name="telepresence_te_software">
        <vers num="4.1.0"/>
        <vers num="4.1.1"/>
        <vers num="4.1.2"/>
        <vers num="4.1.3"/>
        <vers num="6.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2171" published="2014-05-02" name="CVE-2014-2171" modified="2014-05-02" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:C/I:C/A:C)" CVSS_score="10.0" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="10.0" CVSS_base_score="10.0">
    <desc>
      <descript source="cve">Heap-based buffer overflow in Cisco TelePresence TC Software 4.x through 6.x before 6.0.1 and TE Software 4.x and 6.0.x before 6.0.2 allows remote attackers to execute arbitrary code via crafted SIP packets, aka Bug ID CSCud81796.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140430-tcte" source="CISCO" adv="1">20140430 Multiple Vulnerabilities in Cisco TelePresence TC and TE Software</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="telepresence_tc_software">
        <vers num="4.0.0"/>
        <vers num="4.0.1"/>
        <vers num="4.0.4"/>
        <vers num="4.1.1"/>
        <vers num="4.1.2"/>
        <vers num="4.2.0"/>
        <vers num="4.2.1"/>
        <vers num="4.2.2"/>
        <vers num="4.2.3"/>
        <vers num="4.2.4"/>
        <vers num="5.0.0"/>
        <vers num="5.0.1"/>
        <vers num="5.0.2"/>
        <vers num="5.1.0"/>
        <vers num="5.1.1"/>
        <vers num="5.1.2"/>
        <vers num="5.1.3"/>
        <vers num="5.1.4"/>
        <vers num="5.1.5"/>
        <vers num="5.1.6"/>
        <vers num="5.1.7"/>
        <vers num="6.0.0"/>
      </prod>
      <prod vendor="cisco" name="telepresence_te_software">
        <vers num="4.1.0"/>
        <vers num="4.1.1"/>
        <vers num="4.1.2"/>
        <vers num="4.1.3"/>
        <vers num="6.0"/>
        <vers num="6.0.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2172" published="2014-05-02" name="CVE-2014-2172" modified="2014-05-02" CVSS_version="2.0" CVSS_vector="(AV:L/AC:M/Au:S/C:C/I:C/A:C)" CVSS_score="6.6" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="2.7" CVSS_base_score="6.6">
    <desc>
      <descript source="cve">Buffer overflow in Cisco TelePresence TC Software 4.x and 5.x and TE Software 4.x and 6.0 allows local users to gain privileges by leveraging improper handling of the u-boot compiler flag for internal executable files, aka Bug ID CSCub67693.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140430-tcte" source="CISCO" adv="1">20140430 Multiple Vulnerabilities in Cisco TelePresence TC and TE Software</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="telepresence_tc_software">
        <vers num="4.0.0"/>
        <vers num="4.0.1"/>
        <vers num="4.0.4"/>
        <vers num="4.1.1"/>
        <vers num="4.1.2"/>
        <vers num="4.2.0"/>
        <vers num="4.2.1"/>
        <vers num="4.2.2"/>
        <vers num="4.2.3"/>
        <vers num="4.2.4"/>
        <vers num="5.0.0"/>
        <vers num="5.0.1"/>
        <vers num="5.0.2"/>
        <vers num="5.1.0"/>
        <vers num="5.1.1"/>
        <vers num="5.1.2"/>
        <vers num="5.1.3"/>
        <vers num="5.1.4"/>
        <vers num="5.1.5"/>
        <vers num="5.1.6"/>
        <vers num="5.1.7"/>
      </prod>
      <prod vendor="cisco" name="telepresence_te_software">
        <vers num="4.1.0"/>
        <vers num="4.1.1"/>
        <vers num="4.1.2"/>
        <vers num="4.1.3"/>
        <vers num="6.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2173" published="2014-05-02" name="CVE-2014-2173" modified="2014-05-02" CVSS_version="2.0" CVSS_vector="(AV:L/AC:L/Au:N/C:C/I:C/A:C)" CVSS_score="7.2" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="3.9" CVSS_base_score="7.2">
    <desc>
      <descript source="cve">Cisco TelePresence TC Software 4.x and 5.x and TE Software 4.x and 6.0 do not properly restrict access to the serial port, which allows local users to gain privileges via unspecified commands, aka Bug ID CSCub67692.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140430-tcte" source="CISCO" adv="1">20140430 Multiple Vulnerabilities in Cisco TelePresence TC and TE Software</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="telepresence_tc_software">
        <vers num="4.0.0"/>
        <vers num="4.0.1"/>
        <vers num="4.0.4"/>
        <vers num="4.1.1"/>
        <vers num="4.1.2"/>
        <vers num="4.2.0"/>
        <vers num="4.2.1"/>
        <vers num="4.2.2"/>
        <vers num="4.2.3"/>
        <vers num="4.2.4"/>
        <vers num="5.0.0"/>
        <vers num="5.0.1"/>
        <vers num="5.0.2"/>
        <vers num="5.1.0"/>
        <vers num="5.1.1"/>
        <vers num="5.1.2"/>
        <vers num="5.1.3"/>
        <vers num="5.1.4"/>
        <vers num="5.1.5"/>
        <vers num="5.1.6"/>
        <vers num="5.1.7"/>
      </prod>
      <prod vendor="cisco" name="telepresence_te_software">
        <vers num="4.1.0"/>
        <vers num="4.1.1"/>
        <vers num="4.1.2"/>
        <vers num="4.1.3"/>
        <vers num="6.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2175" published="2014-05-02" name="CVE-2014-2175" modified="2014-05-02" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:C)" CVSS_score="7.8" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="10.0" CVSS_base_score="7.8">
    <desc>
      <descript source="cve">Cisco TelePresence TC Software 4.x and 5.x and TE Software 4.x and 6.0 allow remote attackers to cause a denial of service (memory consumption) via crafted H.225 packets, aka Bug ID CSCtq78849.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140430-tcte" source="CISCO" adv="1">20140430 Multiple Vulnerabilities in Cisco TelePresence TC and TE Software</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="telepresence_tc_software">
        <vers num="4.0.0"/>
        <vers num="4.0.1"/>
        <vers num="4.0.4"/>
        <vers num="4.1.1"/>
        <vers num="4.1.2"/>
        <vers num="4.2.0"/>
        <vers num="4.2.1"/>
        <vers num="4.2.2"/>
        <vers num="4.2.3"/>
        <vers num="4.2.4"/>
        <vers num="5.0.0"/>
        <vers num="5.0.1"/>
        <vers num="5.0.2"/>
        <vers num="5.1.0"/>
        <vers num="5.1.1"/>
        <vers num="5.1.2"/>
        <vers num="5.1.3"/>
        <vers num="5.1.4"/>
        <vers num="5.1.5"/>
        <vers num="5.1.6"/>
        <vers num="5.1.7"/>
      </prod>
      <prod vendor="cisco" name="telepresence_te_software">
        <vers num="4.1.0"/>
        <vers num="4.1.1"/>
        <vers num="4.1.2"/>
        <vers num="4.1.3"/>
        <vers num="6.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2180" published="2014-04-29" name="CVE-2014-2180" modified="2014-04-29" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:N/I:P/A:N)" CVSS_score="4.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.0" CVSS_base_score="4.0">
    <desc>
      <descript source="cve">The Document Management component in Cisco Unified Contact Center Express does not properly validate a parameter, which allows remote authenticated users to upload files to arbitrary pathnames via a crafted HTTP request, aka Bug ID CSCun74133.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2180" source="CISCO" adv="1">20140428 Cisco Unified Contact Center Express Arbitrary File Upload Vulnerability</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="unified_contact_center_enterprise">
        <vers num=""/>
      </prod>
      <prod vendor="cisco" name="unified_contact_center_express_editor_software">
        <vers num="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2182" published="2014-04-29" name="CVE-2014-2182" modified="2014-04-29" CVSS_version="2.0" CVSS_vector="(AV:A/AC:L/Au:N/C:N/I:N/A:C)" CVSS_score="6.1" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="6.5" CVSS_base_score="6.1">
    <desc>
      <descript source="cve">Cisco Adaptive Security Appliance (ASA) Software, when DHCPv6 replay is configured, allows remote attackers to cause a denial of service (device reload) via a crafted DHCPv6 packet, aka Bug ID CSCun45520.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <local_network/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2182" source="CISCO" adv="1">20140428 Cisco ASA DHCPv6 Denial of Service Vulnerability</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="adaptive_security_appliance_software">
        <vers num="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2183" published="2014-04-29" name="CVE-2014-2183" modified="2014-04-29" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:S/C:N/I:N/A:C)" CVSS_score="6.3" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="6.8" CVSS_base_score="6.3">
    <desc>
      <descript source="cve">The L2TP module in Cisco IOS XE 3.10S(.2) and earlier on ASR 1000 routers allows remote authenticated users to cause a denial of service (ESP card reload) via a malformed L2TP packet, aka Bug ID CSCun09973.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/viewAlert.x?alertId=33971" source="CONFIRM" adv="1">http://tools.cisco.com/security/center/viewAlert.x?alertId=33971</ref>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2183" source="CISCO" adv="1">20140428 Cisco IOS XE Software Malformed L2TP Packet Vulnerability</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="asr_1001_router">
        <vers num="-"/>
      </prod>
      <prod vendor="cisco" name="asr_1002-x_router">
        <vers num="-"/>
      </prod>
      <prod vendor="cisco" name="asr_1002_fixed_router">
        <vers num="-"/>
      </prod>
      <prod vendor="cisco" name="asr_1002_router">
        <vers num="-"/>
      </prod>
      <prod vendor="cisco" name="asr_1004_router">
        <vers num="-"/>
      </prod>
      <prod vendor="cisco" name="asr_1006_router">
        <vers num="-"/>
      </prod>
      <prod vendor="cisco" name="asr_1013_router">
        <vers num="-"/>
      </prod>
      <prod vendor="cisco" name="asr_1023_router">
        <vers num="-"/>
      </prod>
      <prod vendor="cisco" name="ios_xe">
        <vers num="3.10"/>
        <vers num="3.10.0s"/>
        <vers num="3.10.1s"/>
        <vers num="3.10.1s1"/>
        <vers prev="1" num="3.10.2s"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2184" published="2014-04-29" name="CVE-2014-2184" modified="2014-04-29" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:N/A:N)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">The IP Manager Assistant (IPMA) component in Cisco Unified Communications Manager (Unified CM) allows remote attackers to obtain sensitive information via a crafted URL, aka Bug ID CSCun74352.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2184" source="CISCO" adv="1">20140428 Cisco Unified Communications Manager Sensitive Information Disclosure Vulnerability</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="unified_communications_manager">
        <vers num=""/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2185" published="2014-04-29" name="CVE-2014-2185" modified="2014-04-29" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:P/I:N/A:N)" CVSS_score="4.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.0" CVSS_base_score="4.0">
    <desc>
      <descript source="cve">The Call Detail Records (CDR) Management component in Cisco Unified Communications Manager (Unified CM) allows remote authenticated users to obtain sensitive information by reading extraneous fields in an HTML document, aka Bug ID CSCun74374.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2185" source="CISCO" adv="1">20140428 Cisco Unified Communications Manager CDR Management Vulnerability</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="unified_communications_manager">
        <vers num=""/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2186" published="2014-04-30" name="CVE-2014-2186" modified="2014-04-30" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:P)" CVSS_score="6.8" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.6" CVSS_base_score="6.8">
    <desc>
      <descript source="cve">Cross-site request forgery (CSRF) vulnerability in the web framework in Cisco WebEx Meetings Server allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuj81777.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2186" source="CISCO" adv="1">20140429 Cisco WebEx Meetings Server Cross-Site Request Forgery Vulnerability</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cisco" name="webex_meetings_server">
        <vers num="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2205" published="2014-02-26" name="CVE-2014-2205" modified="2014-03-05" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:S/C:C/I:N/A:N)" CVSS_score="6.3" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="6.8" CVSS_base_score="6.3">
    <desc>
      <descript source="cve">The Import and Export Framework in McAfee ePolicy Orchestrator (ePO) before 4.6.7 Hotfix 940148 allows remote authenticated users with permissions to add dashboards to read arbitrary files by importing a crafted XML file, related to an XML External Entity (XXE) issue.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://www.redteam-pentesting.de/advisories/rt-sa-2014-001.txt" source="MISC">https://www.redteam-pentesting.de/advisories/rt-sa-2014-001.txt</ref>
      <ref url="https://kc.mcafee.com/corporate/index?page=content&amp;id=SB10065" source="CONFIRM" adv="1">https://kc.mcafee.com/corporate/index?page=content&amp;id=SB10065</ref>
      <ref url="http://www.securityfocus.com/bid/65771" source="BID">65771</ref>
      <ref url="http://www.securityfocus.com/archive/1/archive/1/531255/100/0/threaded" source="BUGTRAQ">20140225 [RT-SA-2014-001] McAfee ePolicy Orchestrator: XML External Entity Expansion in Dashboard</ref>
      <ref url="http://secunia.com/advisories/57114" source="SECUNIA" adv="1">57114</ref>
    </refs>
    <vuln_soft>
      <prod vendor="mcafee" name="epolicy_orchestrator">
        <vers num="4.6.0"/>
        <vers num="4.6.1"/>
        <vers num="4.6.2"/>
        <vers num="4.6.3"/>
        <vers num="4.6.4"/>
        <vers num="4.6.5"/>
        <vers num="4.6.6"/>
        <vers prev="1" num="4.6.7"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2206" published="2014-03-05" name="CVE-2014-2206" modified="2014-03-05" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:C/I:C/A:C)" CVSS_score="10.0" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="10.0" CVSS_base_score="10.0">
    <desc>
      <descript source="cve">Stack-based buffer overflow in GetGo Download Manager 4.9.0.1982, 4.8.2.1346, 4.4.5.502, and earlier allows remote attackers to cause a denial of service (crash) and execute arbitrary code via a long HTTP Response Header.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.securityfocus.com/bid/65913" source="BID">65913</ref>
      <ref url="http://www.securityfocus.com/archive/1/archive/1/531326/100/0/threaded" source="BUGTRAQ">20140302 [CVE-2014-2206] GetGo Download Manager HTTP Response Header Buffer Overflow Remote Code Execution</ref>
      <ref url="http://www.rcesecurity.com/2014/03/cve-2014-2206-getgo-download-manager-http-response-header-buffer-overflow-remote-code-execution" source="MISC">http://www.rcesecurity.com/2014/03/cve-2014-2206-getgo-download-manager-http-response-header-buffer-overflow-remote-code-execution</ref>
    </refs>
    <vuln_soft>
      <prod vendor="getgosoft" name="getgo_download_manager">
        <vers prev="1" num="4.4.5.502"/>
        <vers num="4.8.2.1346"/>
        <vers num="4.9.0.1982"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2210" published="2014-04-04" name="CVE-2014-2210" modified="2014-04-04" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">Multiple directory traversal vulnerabilities in CA ERwin Web Portal 9.5 allow remote attackers to obtain sensitive information, bypass intended access restrictions, cause a denial of service, or possibly execute arbitrary code via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=%7B7F968A14-7407-4BCF-9EB1-EFE9F0E6D663%7D" source="CONFIRM" patch="1" adv="1">https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=%7B7F968A14-7407-4BCF-9EB1-EFE9F0E6D663%7D</ref>
    </refs>
    <vuln_soft>
      <prod vendor="ca" name="erwin_web_portal">
        <vers num="9.5"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2211" published="2014-03-03" name="CVE-2014-2211" modified="2014-03-07" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">SQL injection vulnerability in portal/addtoapplication.php in POSH (aka Posh portal or Portaneo) 3.0 before 3.3.0 allows remote attackers to execute arbitrary SQL commands via the rssurl parameter.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.sysdream.com/CVE-2014-2211_2214" source="MISC" patch="1">http://www.sysdream.com/CVE-2014-2211_2214</ref>
      <ref url="http://www.sysdream.com/system/files/POSH-3.2.1-advisory_0.pdf" source="MISC">http://www.sysdream.com/system/files/POSH-3.2.1-advisory_0.pdf</ref>
      <ref url="http://www.securityfocus.com/bid/65817" source="BID">65817</ref>
      <ref url="http://sourceforge.net/p/posh/svn/3540/" source="CONFIRM">http://sourceforge.net/p/posh/svn/3540/</ref>
      <ref url="http://seclists.org/oss-sec/2014/q1/444" source="MLIST">[oss-security] 20140227 [CVE assignment notification] Multiple vulnerabilities in POSH</ref>
    </refs>
    <vuln_soft>
      <prod vendor="posh_project" name="posh">
        <vers num="3.0"/>
        <vers num="3.0.1"/>
        <vers num="3.0.2"/>
        <vers num="3.0.3"/>
        <vers num="3.0.4"/>
        <vers num="3.1.0"/>
        <vers num="3.1.1"/>
        <vers num="3.1.2"/>
        <vers prev="1" num="3.2.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2212" published="2014-04-01" name="CVE-2014-2212" modified="2014-04-02" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:N/A:N)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">The remember me feature in portal/scr_authentif.php in POSH (aka Posh portal or Portaneo) 3.0, 3.2.1, 3.3.0, and earlier stores the username and MD5 digest of the password in cleartext in a cookie, which allows attackers to obtain sensitive information by reading this cookie.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.sysdream.com/system/files/POSH-3.2.1-advisory_0.pdf" source="MISC">http://www.sysdream.com/system/files/POSH-3.2.1-advisory_0.pdf</ref>
      <ref url="http://www.sysdream.com/CVE-2014-2211_2214" source="MISC">http://www.sysdream.com/CVE-2014-2211_2214</ref>
      <ref url="http://seclists.org/oss-sec/2014/q1/444" source="MLIST">[oss-security] 20140227 [CVE assignment notification] Multiple vulnerabilities in POSH</ref>
    </refs>
    <vuln_soft>
      <prod vendor="posh_project" name="posh">
        <vers num="1.0.1"/>
        <vers num="1.1.0"/>
        <vers num="1.2.0"/>
        <vers num="1.3.0"/>
        <vers num="1.3.2"/>
        <vers num="1.4.2"/>
        <vers num="1.5" edition="-"/>
        <vers num="1.5" edition="beta"/>
        <vers num="1.5" edition="beta2"/>
        <vers num="1.5" edition="rc"/>
        <vers num="1.5.1"/>
        <vers num="2.0" edition="-"/>
        <vers num="2.0" edition="beta"/>
        <vers num="2.0" edition="beta2"/>
        <vers num="2.0" edition="p1"/>
        <vers num="2.0" edition="rc"/>
        <vers num="2.1" edition="-"/>
        <vers num="2.1" edition="b"/>
        <vers num="2.1" edition="p1"/>
        <vers num="2.1" edition="p2"/>
        <vers num="2.1" edition="rc"/>
        <vers num="2.2" edition="-"/>
        <vers num="2.2" edition="beta"/>
        <vers num="2.2" edition="rc"/>
        <vers num="2.2.1"/>
        <vers num="2.2.3"/>
        <vers num="2.3"/>
        <vers num="3.0" edition="-"/>
        <vers num="3.0" edition="beta"/>
        <vers num="3.0.1"/>
        <vers num="3.0.2"/>
        <vers num="3.0.3"/>
        <vers num="3.0.4"/>
        <vers num="3.1.0"/>
        <vers num="3.1.1"/>
        <vers num="3.1.2"/>
        <vers num="3.2.1"/>
        <vers prev="1" num="3.3.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2219" published="2014-03-20" name="CVE-2014-2219" modified="2014-03-24" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in whizzywig/wb.php in CMSimple Classic 3.54 and earlier, possibly as downloaded before February 26, 2014, allows remote attackers to inject arbitrary web script or HTML via the d parameter.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="https://www.htbridge.com/advisory/HTB23205" source="MISC">https://www.htbridge.com/advisory/HTB23205</ref>
      <ref url="http://www.securityfocus.com/archive/1/archive/1/531527/100/0/threaded" source="BUGTRAQ">20140319 Cross-Site Scripting (XSS) in CMSimple</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cmsimple" name="cmsimple_classic">
        <vers prev="1" num="3.5.4"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2231" published="2014-02-27" name="CVE-2014-2231" modified="2014-02-28" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in the API in synetics i-doit pro before 1.2.5 allows remote attackers to inject arbitrary web script or HTML via a property title.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://www.i-doit.com/en/company/news/single-news/?tx_ttnews%5Btt_news%5D=141" source="CONFIRM">http://www.i-doit.com/en/company/news/single-news/?tx_ttnews%5Btt_news%5D=141</ref>
      <ref url="http://secunia.com/advisories/56931" source="SECUNIA" adv="1">56931</ref>
    </refs>
    <vuln_soft>
      <prod vendor="i-doit" name="i-doit">
        <vers num="1.0" edition=":~~pro~~~"/>
        <vers num="1.0.2" edition=":~~pro~~~"/>
        <vers num="1.1.1" edition=":~~pro~~~"/>
        <vers num="1.1.2" edition=":~~pro~~~"/>
        <vers num="1.2.1" edition=":~~pro~~~"/>
        <vers num="1.2.2" edition=":~~pro~~~"/>
        <vers num="1.2.3" edition=":~~pro~~~"/>
        <vers prev="1" num="1.2.4" edition=":~~pro~~~"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2234" published="2014-03-05" name="CVE-2014-2234" modified="2014-03-05" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:N)" CVSS_score="6.4" CVSS_impact_subscore="4.9" CVSS_exploit_subscore="10.0" CVSS_base_score="6.4">
    <desc>
      <descript source="cve">A certain Apple patch for OpenSSL in Apple OS X 10.9.2 and earlier uses a Trust Evaluation Agent (TEA) feature without terminating certain TLS/SSL handshakes as specified in the SSL_CTX_set_verify callback function's documentation, which allows remote attackers to bypass extra verification within a custom application via a crafted certificate chain that is acceptable to TEA but not acceptable to that application.</descript>
    </desc>
    <loss_types>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://hynek.me/articles/apple-openssl-verification-surprises/" source="MISC">https://hynek.me/articles/apple-openssl-verification-surprises/</ref>
    </refs>
    <vuln_soft>
      <prod vendor="apple" name="mac_os_x">
        <vers prev="1" num="10.9.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2235" published="2014-03-05" name="CVE-2014-2235" modified="2014-03-05" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in Askbot before 0.7.49 allows remote attackers to inject arbitrary web script or HTML via vectors related to the question search form.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="https://github.com/ASKBOT/askbot-devel/commit/876e3662ff6b78cc6241338c15e3a0cb49edf4e2" source="CONFIRM" patch="1">https://github.com/ASKBOT/askbot-devel/commit/876e3662ff6b78cc6241338c15e3a0cb49edf4e2</ref>
      <ref url="https://bugzilla.redhat.com/show_bug.cgi?id=1070852" source="CONFIRM">https://bugzilla.redhat.com/show_bug.cgi?id=1070852</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/02/28/8" source="MLIST">[oss-security] 20140228 Re: CVE request: askbot xss</ref>
      <ref url="http://secunia.com/advisories/57163" source="SECUNIA" adv="1">57163</ref>
    </refs>
    <vuln_soft>
      <prod vendor="askbot" name="askbot">
        <vers prev="1" num="0.7.48"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2236" published="2014-03-05" name="CVE-2014-2236" modified="2014-03-07" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Multiple cross-site scripting (XSS) vulnerabilities in Askbot before 0.7.49 allow remote attackers to inject arbitrary web script or HTML via vectors related to the (1) tag or (2) user search forms.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="https://github.com/ASKBOT/askbot-devel/commit/a676a86b6b7a5737d4da4f59f71e037406f88d29" source="CONFIRM" patch="1">https://github.com/ASKBOT/askbot-devel/commit/a676a86b6b7a5737d4da4f59f71e037406f88d29</ref>
      <ref url="https://github.com/ASKBOT/askbot-devel/commit/876e3662ff6b78cc6241338c15e3a0cb49edf4e2#diff-b693b4c02739be4b3231bece15b0eb87" source="CONFIRM" patch="1">https://github.com/ASKBOT/askbot-devel/commit/876e3662ff6b78cc6241338c15e3a0cb49edf4e2#diff-b693b4c02739be4b3231bece15b0eb87</ref>
      <ref url="https://bugzilla.redhat.com/show_bug.cgi?id=1070852" source="CONFIRM">https://bugzilla.redhat.com/show_bug.cgi?id=1070852</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/02/28/8" source="MLIST">[oss-security] 20140228 Re: CVE request: askbot xss</ref>
      <ref url="http://secunia.com/advisories/57163" source="SECUNIA" adv="1">57163</ref>
    </refs>
    <vuln_soft>
      <prod vendor="askbot" name="askbot">
        <vers num="0.7.40"/>
        <vers num="0.7.41"/>
        <vers num="0.7.42"/>
        <vers num="0.7.43"/>
        <vers num="0.7.44"/>
        <vers num="0.7.45"/>
        <vers num="0.7.46"/>
        <vers num="0.7.47"/>
        <vers prev="1" num="0.7.48"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2237" published="2014-04-01" name="CVE-2014-2237" modified="2014-04-01" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:P/A:N)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">The memcache token backend in OpenStack Identity (Keystone) 2013.1 through 2.013.1.4, 2013.2 through 2013.2.2, and icehouse before icehouse-3, when issuing a trust token with impersonation enabled, does not include this token in the trustee's token-index-list, which prevents the token from being invalidated by bulk token revocation and allows the trustee to bypass intended access restrictions.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://bugs.launchpad.net/keystone/+bug/1260080" source="CONFIRM">https://bugs.launchpad.net/keystone/+bug/1260080</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/03/04/16" source="MLIST">[oss-security] 20140304 [OSSA 2014-006] Trustee token revocation does not work with memcache  backend (CVE-2014-2237)</ref>
    </refs>
    <vuln_soft>
      <prod vendor="openstack" name="keystone">
        <vers num="2013.1"/>
        <vers num="2013.1.1"/>
        <vers num="2013.1.2"/>
        <vers num="2013.1.3"/>
        <vers num="2013.1.4"/>
        <vers num="2013.2.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2238" published="2014-03-05" name="CVE-2014-2238" modified="2014-03-07" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:P/I:P/A:P)" CVSS_score="6.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.0" CVSS_base_score="6.5">
    <desc>
      <descript source="cve">SQL injection vulnerability in the manage configuration page (adm_config_report.php) in MantisBT 1.2.13 through 1.2.16 allows remote authenticated administrators to execute arbitrary SQL commands via the filter_config_id parameter.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://seclists.org/oss-sec/2014/q1/490" source="MLIST" patch="1">[oss-security] 20140304 Re: CVE request: MantisBT 1.2.13 SQL injection vulnerability</ref>
      <ref url="http://www.securityfocus.com/bid/65903" source="BID">65903</ref>
      <ref url="http://www.mantisbt.org/blog/?p=288" source="CONFIRM">http://www.mantisbt.org/blog/?p=288</ref>
      <ref url="http://seclists.org/oss-sec/2014/q1/456" source="MLIST">[oss-security] 20140228 CVE request: MantisBT 1.2.13 SQL injection vulnerability</ref>
      <ref url="http://mantisbt.domainunion.de/bugs/view.php?id=17055" source="CONFIRM">http://mantisbt.domainunion.de/bugs/view.php?id=17055</ref>
    </refs>
    <vuln_soft>
      <prod vendor="mantisbt" name="mantisbt">
        <vers num="1.2.13"/>
        <vers num="1.2.14"/>
        <vers num="1.2.15"/>
        <vers num="1.2.16"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2240" published="2014-03-12" name="CVE-2014-2240" modified="2014-04-01" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">Stack-based buffer overflow in the cf2_hintmap_build function in cff/cf2hints.c in FreeType before 2.5.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large number of stem hints in a font file.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.freetype.org/index.html" source="CONFIRM" patch="1" adv="1">http://www.freetype.org/index.html</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2148-1" source="UBUNTU">USN-2148-1</ref>
      <ref url="http://www.securitytracker.com/id/1029895" source="SECTRACK">1029895</ref>
      <ref url="http://www.securityfocus.com/bid/66074" source="BID">66074</ref>
      <ref url="http://sourceforge.net/projects/freetype/files/freetype2/2.5.3" source="CONFIRM">http://sourceforge.net/projects/freetype/files/freetype2/2.5.3</ref>
      <ref url="http://secunia.com/advisories/57447" source="SECUNIA">57447</ref>
      <ref url="http://secunia.com/advisories/57291" source="SECUNIA" adv="1">57291</ref>
      <ref url="http://savannah.nongnu.org/bugs/?41697" source="CONFIRM">http://savannah.nongnu.org/bugs/?41697</ref>
    </refs>
    <vuln_soft>
      <prod vendor="freetype" name="freetype">
        <vers num="1.3.1"/>
        <vers num="2.0"/>
        <vers num="2.0.1"/>
        <vers num="2.0.2"/>
        <vers num="2.0.3"/>
        <vers num="2.0.4"/>
        <vers num="2.0.5"/>
        <vers num="2.0.6"/>
        <vers num="2.0.7"/>
        <vers num="2.0.8"/>
        <vers num="2.0.9"/>
        <vers num="2.1"/>
        <vers num="2.1.10"/>
        <vers num="2.1.3"/>
        <vers num="2.1.4"/>
        <vers num="2.1.5"/>
        <vers num="2.1.6"/>
        <vers num="2.1.7"/>
        <vers num="2.1.8" edition="rc1"/>
        <vers num="2.1.8_rc1"/>
        <vers num="2.1.9"/>
        <vers num="2.2"/>
        <vers num="2.2.1"/>
        <vers num="2.3.0"/>
        <vers num="2.3.1"/>
        <vers num="2.3.10"/>
        <vers num="2.3.11"/>
        <vers num="2.3.12"/>
        <vers num="2.3.2"/>
        <vers num="2.3.3"/>
        <vers num="2.3.4"/>
        <vers num="2.3.5"/>
        <vers num="2.3.6"/>
        <vers num="2.3.7"/>
        <vers num="2.3.8"/>
        <vers num="2.3.9"/>
        <vers num="2.4.0"/>
        <vers num="2.4.1"/>
        <vers num="2.4.10"/>
        <vers num="2.4.11"/>
        <vers num="2.4.12"/>
        <vers num="2.4.2"/>
        <vers num="2.4.3"/>
        <vers num="2.4.4"/>
        <vers num="2.4.5"/>
        <vers num="2.4.6"/>
        <vers num="2.4.7"/>
        <vers num="2.4.8"/>
        <vers num="2.4.9"/>
        <vers num="2.5"/>
        <vers num="2.5.1"/>
        <vers prev="1" num="2.5.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2241" published="2014-03-18" name="CVE-2014-2241" modified="2014-04-01" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:P)" CVSS_score="6.8" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.6" CVSS_base_score="6.8">
    <desc>
      <descript source="cve">The (1) cf2_initLocalRegionBuffer and (2) cf2_initGlobalRegionBuffer functions in cff/cf2ft.c in FreeType before 2.5.3 do not properly check if a subroutine exists, which allows remote attackers to cause a denial of service (assertion failure), as demonstrated by a crafted ttf file.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=135c3faebb96f8f550bd4f318716f2e1e095a969" source="CONFIRM" patch="1">http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=135c3faebb96f8f550bd4f318716f2e1e095a969</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2148-1" source="UBUNTU">USN-2148-1</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/03/12/4" source="MLIST">[oss-security] 20140312 Re: Two stack-based issues in freetype [NOT a request]</ref>
      <ref url="http://secunia.com/advisories/57447" source="SECUNIA">57447</ref>
      <ref url="http://savannah.nongnu.org/bugs/?41697" source="CONFIRM">http://savannah.nongnu.org/bugs/?41697</ref>
    </refs>
    <vuln_soft>
      <prod vendor="freetype" name="freetype">
        <vers num="2.5"/>
        <vers num="2.5.1"/>
        <vers prev="1" num="2.5.2"/>
      </prod>
      <prod vendor="canonical" name="ubuntu_linux">
        <vers num="13.10"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2242" published="2014-03-01" name="CVE-2014-2242" modified="2014-03-03" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">includes/upload/UploadBase.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 does not prevent use of invalid namespaces in SVG files, which allows remote attackers to conduct cross-site scripting (XSS) attacks via an SVG upload, as demonstrated by use of a W3C XHTML namespace in conjunction with an IFRAME element.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-February/000141.html" source="MLIST" patch="1" adv="1">[mediawiki-announce] 20140228 MediaWiki Security and Maintenance Releases: 1.22.3, 1.21.6 and 1.19.12</ref>
      <ref url="https://gerrit.wikimedia.org/r/#/q/7d923a6b53f7fbcb0cbc3a19797d741bf6f440eb,n,z" source="CONFIRM">https://gerrit.wikimedia.org/r/#/q/7d923a6b53f7fbcb0cbc3a19797d741bf6f440eb,n,z</ref>
      <ref url="https://bugzilla.wikimedia.org/show_bug.cgi?id=60771" source="CONFIRM" adv="1">https://bugzilla.wikimedia.org/show_bug.cgi?id=60771</ref>
      <ref url="https://bugzilla.redhat.com/show_bug.cgi?id=1071135" source="CONFIRM">https://bugzilla.redhat.com/show_bug.cgi?id=1071135</ref>
      <ref url="http://openwall.com/lists/oss-security/2014/03/01/2" source="MLIST">[oss-security] 20140301 Re: CVE requests: MediaWiki 1.22.3, 1.21.6 and 1.19.12 release</ref>
      <ref url="http://openwall.com/lists/oss-security/2014/02/28/1" source="MLIST">[oss-security] 20140228 CVE requests: MediaWiki 1.22.3, 1.21.6 and 1.19.12 release</ref>
    </refs>
    <vuln_soft>
      <prod vendor="mediawiki" name="mediawiki">
        <vers num="1.1.0"/>
        <vers num="1.10.0" edition="rc1"/>
        <vers num="1.10.0" edition="rc2"/>
        <vers num="1.10.1"/>
        <vers num="1.10.2"/>
        <vers num="1.10.3"/>
        <vers num="1.10.4"/>
        <vers num="1.11"/>
        <vers num="1.11.0" edition="rc1"/>
        <vers num="1.11.1"/>
        <vers num="1.11.2"/>
        <vers num="1.12.0" edition="rc1"/>
        <vers num="1.12.1"/>
        <vers num="1.12.2"/>
        <vers num="1.12.3"/>
        <vers num="1.12.4"/>
        <vers num="1.13.0" edition="rc1"/>
        <vers num="1.13.0" edition="rc2"/>
        <vers num="1.13.1"/>
        <vers num="1.13.2"/>
        <vers num="1.13.3"/>
        <vers num="1.13.4"/>
        <vers num="1.14.0" edition="rc1"/>
        <vers num="1.14.1"/>
        <vers num="1.15.0" edition="rc1"/>
        <vers num="1.15.1"/>
        <vers num="1.15.2"/>
        <vers num="1.15.3"/>
        <vers num="1.15.4"/>
        <vers num="1.15.5"/>
        <vers num="1.16.0" edition="beta1"/>
        <vers num="1.16.0" edition="beta2"/>
        <vers num="1.16.0" edition="beta3"/>
        <vers num="1.16.1"/>
        <vers num="1.16.2"/>
        <vers num="1.17" edition="beta_1"/>
        <vers num="1.17.0" edition="rc1"/>
        <vers num="1.17.1"/>
        <vers num="1.17.2"/>
        <vers num="1.17.3"/>
        <vers num="1.17.4"/>
        <vers num="1.18" edition="beta_1"/>
        <vers num="1.18.0" edition="rc1"/>
        <vers num="1.18.1"/>
        <vers num="1.18.2"/>
        <vers num="1.18.3"/>
        <vers num="1.19" edition="beta_1"/>
        <vers num="1.19" edition="beta_2"/>
        <vers num="1.19.0"/>
        <vers num="1.19.1"/>
        <vers num="1.19.10"/>
        <vers prev="1" num="1.19.11"/>
        <vers num="1.19.2"/>
        <vers num="1.19.3"/>
        <vers num="1.19.4"/>
        <vers num="1.19.5"/>
        <vers num="1.19.6"/>
        <vers num="1.19.7"/>
        <vers num="1.19.8"/>
        <vers num="1.19.9"/>
        <vers num="1.20"/>
        <vers num="1.20.1"/>
        <vers num="1.20.2"/>
        <vers num="1.20.3"/>
        <vers num="1.20.4"/>
        <vers num="1.20.5"/>
        <vers num="1.20.6"/>
        <vers num="1.20.7"/>
        <vers num="1.20.8"/>
        <vers num="1.21"/>
        <vers num="1.21.1"/>
        <vers num="1.21.2"/>
        <vers num="1.21.3"/>
        <vers num="1.21.4"/>
        <vers num="1.21.5"/>
        <vers num="1.22.0"/>
        <vers num="1.22.1"/>
        <vers num="1.22.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2243" published="2014-03-01" name="CVE-2014-2243" modified="2014-03-03" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:N)" CVSS_score="5.8" CVSS_impact_subscore="4.9" CVSS_exploit_subscore="8.6" CVSS_base_score="5.8">
    <desc>
      <descript source="cve">includes/User.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 terminates validation of a user token upon encountering the first incorrect character, which makes it easier for remote attackers to obtain access via a brute-force attack that relies on timing differences in responses to incorrect token guesses.</descript>
    </desc>
    <loss_types>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-February/000141.html" source="MLIST" patch="1" adv="1">[mediawiki-announce] 20140228 MediaWiki Security and Maintenance Releases: 1.22.3, 1.21.6 and 1.19.12</ref>
      <ref url="https://gerrit.wikimedia.org/r/#/q/I2a9e89120f7092015495e638c6fa9f67adc9b84f,n,z" source="CONFIRM">https://gerrit.wikimedia.org/r/#/q/I2a9e89120f7092015495e638c6fa9f67adc9b84f,n,z</ref>
      <ref url="https://bugzilla.wikimedia.org/show_bug.cgi?id=61346" source="CONFIRM" adv="1">https://bugzilla.wikimedia.org/show_bug.cgi?id=61346</ref>
      <ref url="https://bugzilla.redhat.com/show_bug.cgi?id=1071136" source="CONFIRM">https://bugzilla.redhat.com/show_bug.cgi?id=1071136</ref>
      <ref url="http://openwall.com/lists/oss-security/2014/03/01/2" source="MLIST">[oss-security] 20140301 Re: CVE requests: MediaWiki 1.22.3, 1.21.6 and 1.19.12 release</ref>
      <ref url="http://openwall.com/lists/oss-security/2014/02/28/1" source="MLIST">[oss-security] 20140228 CVE requests: MediaWiki 1.22.3, 1.21.6 and 1.19.12 release</ref>
    </refs>
    <vuln_soft>
      <prod vendor="mediawiki" name="mediawiki">
        <vers num="1.1.0"/>
        <vers num="1.10.0" edition="rc1"/>
        <vers num="1.10.0" edition="rc2"/>
        <vers num="1.10.1"/>
        <vers num="1.10.2"/>
        <vers num="1.10.3"/>
        <vers num="1.10.4"/>
        <vers num="1.11"/>
        <vers num="1.11.0" edition="rc1"/>
        <vers num="1.11.1"/>
        <vers num="1.11.2"/>
        <vers num="1.12.0" edition="rc1"/>
        <vers num="1.12.1"/>
        <vers num="1.12.2"/>
        <vers num="1.12.3"/>
        <vers num="1.12.4"/>
        <vers num="1.13.0" edition="rc1"/>
        <vers num="1.13.0" edition="rc2"/>
        <vers num="1.13.1"/>
        <vers num="1.13.2"/>
        <vers num="1.13.3"/>
        <vers num="1.13.4"/>
        <vers num="1.14.0" edition="rc1"/>
        <vers num="1.14.1"/>
        <vers num="1.15.0" edition="rc1"/>
        <vers num="1.15.1"/>
        <vers num="1.15.2"/>
        <vers num="1.15.3"/>
        <vers num="1.15.4"/>
        <vers num="1.15.5"/>
        <vers num="1.16.0" edition="beta1"/>
        <vers num="1.16.0" edition="beta2"/>
        <vers num="1.16.0" edition="beta3"/>
        <vers num="1.16.1"/>
        <vers num="1.16.2"/>
        <vers num="1.17" edition="beta_1"/>
        <vers num="1.17.0" edition="rc1"/>
        <vers num="1.17.1"/>
        <vers num="1.17.2"/>
        <vers num="1.17.3"/>
        <vers num="1.17.4"/>
        <vers num="1.18" edition="beta_1"/>
        <vers num="1.18.0" edition="rc1"/>
        <vers num="1.18.1"/>
        <vers num="1.18.2"/>
        <vers num="1.18.3"/>
        <vers num="1.19" edition="beta_1"/>
        <vers num="1.19" edition="beta_2"/>
        <vers num="1.19.0"/>
        <vers num="1.19.1"/>
        <vers num="1.19.10"/>
        <vers prev="1" num="1.19.11"/>
        <vers num="1.19.2"/>
        <vers num="1.19.3"/>
        <vers num="1.19.4"/>
        <vers num="1.19.5"/>
        <vers num="1.19.6"/>
        <vers num="1.19.7"/>
        <vers num="1.19.8"/>
        <vers num="1.19.9"/>
        <vers num="1.20"/>
        <vers num="1.20.1"/>
        <vers num="1.20.2"/>
        <vers num="1.20.3"/>
        <vers num="1.20.4"/>
        <vers num="1.20.5"/>
        <vers num="1.20.6"/>
        <vers num="1.20.7"/>
        <vers num="1.20.8"/>
        <vers num="1.21"/>
        <vers num="1.21.1"/>
        <vers num="1.21.2"/>
        <vers num="1.21.3"/>
        <vers num="1.21.4"/>
        <vers num="1.21.5"/>
        <vers num="1.22.0"/>
        <vers num="1.22.1"/>
        <vers num="1.22.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2244" published="2014-03-01" name="CVE-2014-2244" modified="2014-03-03" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in the formatHTML function in includes/api/ApiFormatBase.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 allows remote attackers to inject arbitrary web script or HTML via a crafted string located after http:// in the text parameter to api.php.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-February/000141.html" source="MLIST" patch="1" adv="1">[mediawiki-announce] 20140228 MediaWiki Security and Maintenance Releases: 1.22.3, 1.21.6 and 1.19.12</ref>
      <ref url="https://gerrit.wikimedia.org/r/#/q/Idf985e4e69c2f11778a8a90503914678441cb3fb,n,z" source="CONFIRM">https://gerrit.wikimedia.org/r/#/q/Idf985e4e69c2f11778a8a90503914678441cb3fb,n,z</ref>
      <ref url="https://bugzilla.wikimedia.org/show_bug.cgi?id=61362" source="CONFIRM" adv="1">https://bugzilla.wikimedia.org/show_bug.cgi?id=61362</ref>
      <ref url="https://bugzilla.redhat.com/show_bug.cgi?id=1071139" source="CONFIRM">https://bugzilla.redhat.com/show_bug.cgi?id=1071139</ref>
      <ref url="http://openwall.com/lists/oss-security/2014/03/01/2" source="MLIST">[oss-security] 20140301 Re: CVE requests: MediaWiki 1.22.3, 1.21.6 and 1.19.12 release</ref>
      <ref url="http://openwall.com/lists/oss-security/2014/02/28/1" source="MLIST">[oss-security] 20140228 CVE requests: MediaWiki 1.22.3, 1.21.6 and 1.19.12 release</ref>
    </refs>
    <vuln_soft>
      <prod vendor="mediawiki" name="mediawiki">
        <vers num="1.1.0"/>
        <vers num="1.10.0" edition="rc1"/>
        <vers num="1.10.0" edition="rc2"/>
        <vers num="1.10.1"/>
        <vers num="1.10.2"/>
        <vers num="1.10.3"/>
        <vers num="1.10.4"/>
        <vers num="1.11"/>
        <vers num="1.11.0" edition="rc1"/>
        <vers num="1.11.1"/>
        <vers num="1.11.2"/>
        <vers num="1.12.0" edition="rc1"/>
        <vers num="1.12.1"/>
        <vers num="1.12.2"/>
        <vers num="1.12.3"/>
        <vers num="1.12.4"/>
        <vers num="1.13.0" edition="rc1"/>
        <vers num="1.13.0" edition="rc2"/>
        <vers num="1.13.1"/>
        <vers num="1.13.2"/>
        <vers num="1.13.3"/>
        <vers num="1.13.4"/>
        <vers num="1.14.0" edition="rc1"/>
        <vers num="1.14.1"/>
        <vers num="1.15.0" edition="rc1"/>
        <vers num="1.15.1"/>
        <vers num="1.15.2"/>
        <vers num="1.15.3"/>
        <vers num="1.15.4"/>
        <vers num="1.15.5"/>
        <vers num="1.16.0" edition="beta1"/>
        <vers num="1.16.0" edition="beta2"/>
        <vers num="1.16.0" edition="beta3"/>
        <vers num="1.16.1"/>
        <vers num="1.16.2"/>
        <vers num="1.17" edition="beta_1"/>
        <vers num="1.17.0" edition="rc1"/>
        <vers num="1.17.1"/>
        <vers num="1.17.2"/>
        <vers num="1.17.3"/>
        <vers num="1.17.4"/>
        <vers num="1.18" edition="beta_1"/>
        <vers num="1.18.0" edition="rc1"/>
        <vers num="1.18.1"/>
        <vers num="1.18.2"/>
        <vers num="1.18.3"/>
        <vers num="1.19" edition="beta_1"/>
        <vers num="1.19" edition="beta_2"/>
        <vers num="1.19.0"/>
        <vers num="1.19.1"/>
        <vers num="1.19.10"/>
        <vers prev="1" num="1.19.11"/>
        <vers num="1.19.2"/>
        <vers num="1.19.3"/>
        <vers num="1.19.4"/>
        <vers num="1.19.5"/>
        <vers num="1.19.6"/>
        <vers num="1.19.7"/>
        <vers num="1.19.8"/>
        <vers num="1.19.9"/>
        <vers num="1.20"/>
        <vers num="1.20.1"/>
        <vers num="1.20.2"/>
        <vers num="1.20.3"/>
        <vers num="1.20.4"/>
        <vers num="1.20.5"/>
        <vers num="1.20.6"/>
        <vers num="1.20.7"/>
        <vers num="1.20.8"/>
        <vers num="1.21"/>
        <vers num="1.21.1"/>
        <vers num="1.21.2"/>
        <vers num="1.21.3"/>
        <vers num="1.21.4"/>
        <vers num="1.21.5"/>
        <vers num="1.22.0"/>
        <vers num="1.22.1"/>
        <vers num="1.22.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2245" published="2014-03-05" name="CVE-2014-2245" modified="2014-03-07" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:S/C:P/I:P/A:P)" CVSS_score="6.0" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="6.8" CVSS_base_score="6.0">
    <desc>
      <descript source="cve">SQL injection vulnerability in the News module in CMS Made Simple (CMSMS) before 1.11.10 allows remote authenticated users with the "Modify News" permission to execute arbitrary SQL commands via the sortby parameter to admin/moduleinterface.php.  NOTE: some of these details are obtained from third party information.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.securityfocus.com/bid/65953" source="BID">65953</ref>
      <ref url="http://secunia.com/advisories/56996" source="SECUNIA" adv="1">56996</ref>
      <ref url="http://seclists.org/oss-sec/2014/q1/467" source="MLIST">[oss-security] 20140301 Re: CVE request: CMS Made Simple SQL injection fixed in 1.11.10</ref>
      <ref url="http://dev.cmsmadesimple.org/project/changelog/4602" source="CONFIRM" adv="1">http://dev.cmsmadesimple.org/project/changelog/4602</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cmsmadesimple" name="cms_made_simple">
        <vers num="0.1"/>
        <vers num="0.10"/>
        <vers num="0.10.1"/>
        <vers num="0.10.2"/>
        <vers num="0.10.3"/>
        <vers num="0.10.4"/>
        <vers num="0.11"/>
        <vers num="0.11.1"/>
        <vers num="0.11.2"/>
        <vers num="0.12"/>
        <vers num="0.12.1"/>
        <vers num="0.12.2"/>
        <vers num="0.13"/>
        <vers num="0.2"/>
        <vers num="0.2.1"/>
        <vers num="0.3"/>
        <vers num="0.3.1"/>
        <vers num="0.3.2"/>
        <vers num="0.4"/>
        <vers num="0.4.1"/>
        <vers num="0.5"/>
        <vers num="0.5.1"/>
        <vers num="0.6"/>
        <vers num="0.6.1"/>
        <vers num="0.6.2"/>
        <vers num="0.6.3"/>
        <vers num="0.7"/>
        <vers num="0.7.1"/>
        <vers num="0.7.2"/>
        <vers num="0.7.3"/>
        <vers num="0.8"/>
        <vers num="0.8.1"/>
        <vers num="0.8.2"/>
        <vers num="0.9"/>
        <vers num="0.9.1"/>
        <vers num="0.9.2"/>
        <vers num="1.0"/>
        <vers num="1.0.1"/>
        <vers num="1.0.2"/>
        <vers num="1.0.3"/>
        <vers num="1.0.4"/>
        <vers num="1.0.5"/>
        <vers num="1.0.6"/>
        <vers num="1.1"/>
        <vers num="1.1.1"/>
        <vers num="1.1.2"/>
        <vers num="1.1.3"/>
        <vers num="1.1.3.1"/>
        <vers num="1.1.4"/>
        <vers num="1.10"/>
        <vers num="1.10.1"/>
        <vers num="1.10.2"/>
        <vers num="1.10.3"/>
        <vers num="1.11"/>
        <vers num="1.11.1"/>
        <vers num="1.11.2"/>
        <vers num="1.11.2.1"/>
        <vers num="1.11.3"/>
        <vers num="1.11.4"/>
        <vers num="1.11.5"/>
        <vers num="1.11.6"/>
        <vers num="1.11.7"/>
        <vers num="1.11.8"/>
        <vers prev="1" num="1.11.9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2246" published="2014-03-16" name="CVE-2014-2246" modified="2014-03-25" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in the integrated web server on Siemens SIMATIC S7-1500 CPU PLC devices with firmware before 1.5.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://ics-cert.us-cert.gov/advisories/ICSA-14-073-01" source="MISC">http://ics-cert.us-cert.gov/advisories/ICSA-14-073-01</ref>
      <ref url="http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-456423.pdf" source="CONFIRM" patch="1" adv="1">http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-456423.pdf</ref>
    </refs>
    <vuln_soft>
      <prod vendor="siemens" name="simatic_s7-1500_cpu_firmware">
        <vers num="1.0.1"/>
        <vers num="1.1.0"/>
        <vers num="1.1.1"/>
        <vers prev="1" num="1.1.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2247" published="2014-03-16" name="CVE-2014-2247" modified="2014-03-25" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:P)" CVSS_score="5.8" CVSS_impact_subscore="4.9" CVSS_exploit_subscore="8.6" CVSS_base_score="5.8">
    <desc>
      <descript source="cve">The integrated web server on Siemens SIMATIC S7-1500 CPU PLC devices with firmware before 1.5.0 allows remote attackers to inject headers via unspecified vectors.</descript>
      <descript source="nvd">CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)</descript>
    </desc>
    <loss_types>
      <avail/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://ics-cert.us-cert.gov/advisories/ICSA-14-073-01" source="MISC">http://ics-cert.us-cert.gov/advisories/ICSA-14-073-01</ref>
      <ref url="http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-456423.pdf" source="CONFIRM" patch="1" adv="1">http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-456423.pdf</ref>
    </refs>
    <vuln_soft>
      <prod vendor="siemens" name="simatic_s7-1500_cpu_firmware">
        <vers num="1.0.1"/>
        <vers num="1.1.0"/>
        <vers num="1.1.1"/>
        <vers prev="1" num="1.1.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2248" published="2014-03-16" name="CVE-2014-2248" modified="2014-03-25" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Open redirect vulnerability in the integrated web server on Siemens SIMATIC S7-1500 CPU PLC devices with firmware before 1.5.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.</descript>
      <descript source="nvd">CWE-601: URL Redirection to Untrusted Site (“Open Redirect”)</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://ics-cert.us-cert.gov/advisories/ICSA-14-073-01" source="MISC">http://ics-cert.us-cert.gov/advisories/ICSA-14-073-01</ref>
      <ref url="http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-456423.pdf" source="CONFIRM" patch="1" adv="1">http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-456423.pdf</ref>
    </refs>
    <vuln_soft>
      <prod vendor="siemens" name="simatic_s7-1500_cpu_firmware">
        <vers num="1.0.1"/>
        <vers num="1.1.0"/>
        <vers num="1.1.1"/>
        <vers prev="1" num="1.1.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2249" published="2014-03-16" name="CVE-2014-2249" modified="2014-03-26" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:P)" CVSS_score="5.8" CVSS_impact_subscore="4.9" CVSS_exploit_subscore="8.6" CVSS_base_score="5.8">
    <desc>
      <descript source="cve">Cross-site request forgery (CSRF) vulnerability on Siemens SIMATIC S7-1500 CPU PLC devices with firmware before 1.5.0 and SIMATIC S7-1200 CPU PLC devices with firmware before 4.0 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.</descript>
    </desc>
    <loss_types>
      <avail/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://ics-cert.us-cert.gov/advisories/ICSA-14-079-02" source="MISC">http://ics-cert.us-cert.gov/advisories/ICSA-14-079-02</ref>
      <ref url="http://ics-cert.us-cert.gov/advisories/ICSA-14-073-01" source="MISC">http://ics-cert.us-cert.gov/advisories/ICSA-14-073-01</ref>
      <ref url="http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-456423.pdf" source="CONFIRM" patch="1" adv="1">http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-456423.pdf</ref>
      <ref url="http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-654382.pdf" source="CONFIRM">http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-654382.pdf</ref>
    </refs>
    <vuln_soft>
      <prod vendor="siemens" name="simatic_s7-1500_cpu_firmware">
        <vers num="1.0.1"/>
        <vers num="1.1.0"/>
        <vers num="1.1.1"/>
        <vers prev="1" num="1.1.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2250" published="2014-03-24" name="CVE-2014-2250" modified="2014-03-24" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:C)" CVSS_score="8.3" CVSS_impact_subscore="8.5" CVSS_exploit_subscore="8.6" CVSS_base_score="8.3">
    <desc>
      <descript source="cve">The random-number generator on Siemens SIMATIC S7-1200 CPU PLC devices with firmware before 4.0 does not have sufficient entropy, which makes it easier for remote attackers to defeat cryptographic protection mechanisms and hijack sessions via unspecified vectors, a different vulnerability than CVE-2014-2251.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://ics-cert.us-cert.gov/advisories/ICSA-14-079-02" source="MISC">http://ics-cert.us-cert.gov/advisories/ICSA-14-079-02</ref>
      <ref url="http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-654382.pdf" source="CONFIRM" adv="1">http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-654382.pdf</ref>
    </refs>
    <vuln_soft>
      <prod vendor="siemens" name="simatic_s7_cpu-1211c">
        <vers num="-"/>
      </prod>
      <prod vendor="siemens" name="simatic_s7_cpu_1212c">
        <vers num="-"/>
      </prod>
      <prod vendor="siemens" name="simatic_s7_cpu_1214c">
        <vers num="-"/>
      </prod>
      <prod vendor="siemens" name="simatic_s7_cpu_1215c">
        <vers num="-"/>
      </prod>
      <prod vendor="siemens" name="simatic_s7_cpu_1217c">
        <vers num="-"/>
      </prod>
      <prod vendor="siemens" name="simatic_s7_cpu_1200_firmware">
        <vers num="3.0"/>
        <vers prev="1" num="3.0.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2251" published="2014-03-16" name="CVE-2014-2251" modified="2014-03-25" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:C)" CVSS_score="8.3" CVSS_impact_subscore="8.5" CVSS_exploit_subscore="8.6" CVSS_base_score="8.3">
    <desc>
      <descript source="cve">The random-number generator on Siemens SIMATIC S7-1500 CPU PLC devices with firmware before 1.5.0 does not have sufficient entropy, which makes it easier for remote attackers to defeat cryptographic protection mechanisms and hijack sessions via unspecified vectors.</descript>
      <descript source="nvd">CWE-331: Insufficient Entropy</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://ics-cert.us-cert.gov/advisories/ICSA-14-073-01" source="MISC">http://ics-cert.us-cert.gov/advisories/ICSA-14-073-01</ref>
      <ref url="http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-456423.pdf" source="CONFIRM" patch="1" adv="1">http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-456423.pdf</ref>
    </refs>
    <vuln_soft>
      <prod vendor="siemens" name="simatic_s7-1500_cpu_firmware">
        <vers num="1.0.1"/>
        <vers num="1.1.0"/>
        <vers num="1.1.1"/>
        <vers prev="1" num="1.1.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2252" published="2014-03-24" name="CVE-2014-2252" modified="2014-03-24" CVSS_version="2.0" CVSS_vector="(AV:A/AC:L/Au:N/C:N/I:N/A:C)" CVSS_score="6.1" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="6.5" CVSS_base_score="6.1">
    <desc>
      <descript source="cve">Siemens SIMATIC S7-1200 CPU PLC devices with firmware before 4.0 allow remote attackers to cause a denial of service (defect-mode transition) via crafted PROFINET packets, a different vulnerability than CVE-2014-2253.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <local_network/>
    </range>
    <refs>
      <ref url="http://ics-cert.us-cert.gov/advisories/ICSA-14-079-02" source="MISC">http://ics-cert.us-cert.gov/advisories/ICSA-14-079-02</ref>
      <ref url="http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-654382.pdf" source="CONFIRM" adv="1">http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-654382.pdf</ref>
    </refs>
    <vuln_soft>
      <prod vendor="siemens" name="simatic_s7_cpu-1211c">
        <vers num="-"/>
      </prod>
      <prod vendor="siemens" name="simatic_s7_cpu_1212c">
        <vers num="-"/>
      </prod>
      <prod vendor="siemens" name="simatic_s7_cpu_1214c">
        <vers num="-"/>
      </prod>
      <prod vendor="siemens" name="simatic_s7_cpu_1215c">
        <vers num="-"/>
      </prod>
      <prod vendor="siemens" name="simatic_s7_cpu_1217c">
        <vers num="-"/>
      </prod>
      <prod vendor="siemens" name="simatic_s7_cpu_1200_firmware">
        <vers num="3.0"/>
        <vers prev="1" num="3.0.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2253" published="2014-03-16" name="CVE-2014-2253" modified="2014-03-25" CVSS_version="2.0" CVSS_vector="(AV:A/AC:L/Au:N/C:N/I:N/A:C)" CVSS_score="6.1" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="6.5" CVSS_base_score="6.1">
    <desc>
      <descript source="cve">Siemens SIMATIC S7-1500 CPU PLC devices with firmware before 1.5.0 allow remote attackers to cause a denial of service (defect-mode transition) via crafted Profinet packets.</descript>
      <descript source="nvd">CWE-404: Improper Resource Shutdown or Release</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <local_network/>
    </range>
    <refs>
      <ref url="http://ics-cert.us-cert.gov/advisories/ICSA-14-073-01" source="MISC">http://ics-cert.us-cert.gov/advisories/ICSA-14-073-01</ref>
      <ref url="http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-456423.pdf" source="CONFIRM" patch="1" adv="1">http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-456423.pdf</ref>
    </refs>
    <vuln_soft>
      <prod vendor="siemens" name="simatic_s7-1500_cpu_firmware">
        <vers num="1.0.1"/>
        <vers num="1.1.0"/>
        <vers num="1.1.1"/>
        <vers prev="1" num="1.1.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2254" published="2014-03-24" name="CVE-2014-2254" modified="2014-03-24" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:C)" CVSS_score="7.8" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="10.0" CVSS_base_score="7.8">
    <desc>
      <descript source="cve">Siemens SIMATIC S7-1200 CPU PLC devices with firmware before 4.0 allow remote attackers to cause a denial of service (defect-mode transition) via crafted HTTP packets, a different vulnerability than CVE-2014-2255.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://ics-cert.us-cert.gov/advisories/ICSA-14-079-02" source="MISC">http://ics-cert.us-cert.gov/advisories/ICSA-14-079-02</ref>
      <ref url="http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-654382.pdf" source="CONFIRM" adv="1">http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-654382.pdf</ref>
    </refs>
    <vuln_soft>
      <prod vendor="siemens" name="simatic_s7_cpu-1211c">
        <vers num="-"/>
      </prod>
      <prod vendor="siemens" name="simatic_s7_cpu_1212c">
        <vers num="-"/>
      </prod>
      <prod vendor="siemens" name="simatic_s7_cpu_1214c">
        <vers num="-"/>
      </prod>
      <prod vendor="siemens" name="simatic_s7_cpu_1215c">
        <vers num="-"/>
      </prod>
      <prod vendor="siemens" name="simatic_s7_cpu_1217c">
        <vers num="-"/>
      </prod>
      <prod vendor="siemens" name="simatic_s7_cpu_1200_firmware">
        <vers num="3.0"/>
        <vers prev="1" num="3.0.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2255" published="2014-03-16" name="CVE-2014-2255" modified="2014-03-25" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:C)" CVSS_score="7.8" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="10.0" CVSS_base_score="7.8">
    <desc>
      <descript source="cve">Siemens SIMATIC S7-1500 CPU PLC devices with firmware before 1.5.0 allow remote attackers to cause a denial of service (defect-mode transition) via crafted HTTP packets.</descript>
      <descript source="nvd">CWE-404: Improper Resource Shutdown or Release</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://ics-cert.us-cert.gov/advisories/ICSA-14-073-01" source="MISC">http://ics-cert.us-cert.gov/advisories/ICSA-14-073-01</ref>
      <ref url="http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-456423.pdf" source="CONFIRM" patch="1" adv="1">http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-456423.pdf</ref>
    </refs>
    <vuln_soft>
      <prod vendor="siemens" name="simatic_s7-1500_cpu_firmware">
        <vers num="1.0.1"/>
        <vers num="1.1.0"/>
        <vers num="1.1.1"/>
        <vers prev="1" num="1.1.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2256" published="2014-03-24" name="CVE-2014-2256" modified="2014-03-24" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:C)" CVSS_score="7.8" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="10.0" CVSS_base_score="7.8">
    <desc>
      <descript source="cve">Siemens SIMATIC S7-1200 CPU PLC devices with firmware before 4.0 allow remote attackers to cause a denial of service (defect-mode transition) via crafted ISO-TSAP packets, a different vulnerability than CVE-2014-2257.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://ics-cert.us-cert.gov/advisories/ICSA-14-079-02" source="MISC">http://ics-cert.us-cert.gov/advisories/ICSA-14-079-02</ref>
      <ref url="http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-654382.pdf" source="CONFIRM" adv="1">http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-654382.pdf</ref>
    </refs>
    <vuln_soft>
      <prod vendor="siemens" name="simatic_s7_cpu-1211c">
        <vers num="-"/>
      </prod>
      <prod vendor="siemens" name="simatic_s7_cpu_1212c">
        <vers num="-"/>
      </prod>
      <prod vendor="siemens" name="simatic_s7_cpu_1214c">
        <vers num="-"/>
      </prod>
      <prod vendor="siemens" name="simatic_s7_cpu_1215c">
        <vers num="-"/>
      </prod>
      <prod vendor="siemens" name="simatic_s7_cpu_1217c">
        <vers num="-"/>
      </prod>
      <prod vendor="siemens" name="simatic_s7_cpu_1200_firmware">
        <vers num="3.0"/>
        <vers prev="1" num="3.0.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2257" published="2014-03-16" name="CVE-2014-2257" modified="2014-03-25" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:C)" CVSS_score="7.8" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="10.0" CVSS_base_score="7.8">
    <desc>
      <descript source="cve">Siemens SIMATIC S7-1500 CPU PLC devices with firmware before 1.5.0 allow remote attackers to cause a denial of service (defect-mode transition) via crafted ISO-TSAP packets.</descript>
      <descript source="nvd">CWE-404: Improper Resource Shutdown or Release</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://ics-cert.us-cert.gov/advisories/ICSA-14-073-01" source="MISC">http://ics-cert.us-cert.gov/advisories/ICSA-14-073-01</ref>
      <ref url="http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-456423.pdf" source="CONFIRM" patch="1" adv="1">http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-456423.pdf</ref>
    </refs>
    <vuln_soft>
      <prod vendor="siemens" name="simatic_s7-1500_cpu_firmware">
        <vers num="1.0.1"/>
        <vers num="1.1.0"/>
        <vers num="1.1.1"/>
        <vers prev="1" num="1.1.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2258" published="2014-03-24" name="CVE-2014-2258" modified="2014-03-24" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:C)" CVSS_score="7.8" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="10.0" CVSS_base_score="7.8">
    <desc>
      <descript source="cve">Siemens SIMATIC S7-1200 CPU PLC devices with firmware before 4.0 allow remote attackers to cause a denial of service (defect-mode transition) via crafted HTTPS packets, a different vulnerability than CVE-2014-2259.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://ics-cert.us-cert.gov/advisories/ICSA-14-079-02" source="MISC">http://ics-cert.us-cert.gov/advisories/ICSA-14-079-02</ref>
      <ref url="http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-654382.pdf" source="CONFIRM" adv="1">http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-654382.pdf</ref>
    </refs>
    <vuln_soft>
      <prod vendor="siemens" name="simatic_s7_cpu-1211c">
        <vers num="-"/>
      </prod>
      <prod vendor="siemens" name="simatic_s7_cpu_1212c">
        <vers num="-"/>
      </prod>
      <prod vendor="siemens" name="simatic_s7_cpu_1214c">
        <vers num="-"/>
      </prod>
      <prod vendor="siemens" name="simatic_s7_cpu_1215c">
        <vers num="-"/>
      </prod>
      <prod vendor="siemens" name="simatic_s7_cpu_1217c">
        <vers num="-"/>
      </prod>
      <prod vendor="siemens" name="simatic_s7_cpu_1200_firmware">
        <vers num="3.0"/>
        <vers prev="1" num="3.0.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2259" published="2014-03-16" name="CVE-2014-2259" modified="2014-03-25" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:C)" CVSS_score="7.8" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="10.0" CVSS_base_score="7.8">
    <desc>
      <descript source="cve">Siemens SIMATIC S7-1500 CPU PLC devices with firmware before 1.5.0 allow remote attackers to cause a denial of service (defect-mode transition) via crafted HTTPS packets.</descript>
      <descript source="nvd">CWE-404: Improper Resource Shutdown or Release</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://ics-cert.us-cert.gov/advisories/ICSA-14-073-01" source="MISC">http://ics-cert.us-cert.gov/advisories/ICSA-14-073-01</ref>
      <ref url="http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-456423.pdf" source="CONFIRM" patch="1" adv="1">http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-456423.pdf</ref>
    </refs>
    <vuln_soft>
      <prod vendor="siemens" name="simatic_s7-1500_cpu_firmware">
        <vers num="1.0.1"/>
        <vers num="1.1.0"/>
        <vers num="1.1.1"/>
        <vers prev="1" num="1.1.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-2260" published="2014-04-30" name="CVE-2014-2260" modified="2014-05-01" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:S/C:N/I:P/A:N)" CVSS_score="3.5" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="6.8" CVSS_base_score="3.5">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in plugins/main/content/js/ajenti.coffee in Eugene Pankov Ajenti 1.2.13 allows remote authenticated users to inject arbitrary web script or HTML via the command field in the Cron functionality.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="https://github.com/Eugeny/ajenti/commit/3270fd1d78391bb847b4c9ce37cf921f485b1310" source="MISC" patch="1">https://github.com/Eugeny/ajenti/commit/3270fd1d78391bb847b4c9ce37cf921f485b1310</ref>
      <ref url="https://github.com/Eugeny/ajenti/issues/233" source="CONFIRM">https://github.com/Eugeny/ajenti/issues/233</ref>
      <ref url="http://www.securityfocus.com/bid/64982" source="BID">64982</ref>
      <ref url="http://www.osvdb.org/102174" source="OSVDB">102174</ref>
      <ref url="http://packetstormsecurity.com/files/124804/Ajenti-1.2.13-Cross-Site-Scripting.html" source="MISC">http://packetstormsecurity.com/files/124804/Ajenti-1.2.13-Cross-Site-Scripting.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="ajenti" name="ajenti">
        <vers num="1.2.13"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2262" published="2014-02-28" name="CVE-2014-2262" modified="2014-03-03" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">Buffer overflow in the client application in Base SAS 9.2 TS2M3, SAS 9.3 TS1M1 and TS1M2, and SAS 9.4 TS1M0 allows user-assisted remote attackers to execute arbitrary code via a crafted SAS program.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140227-0_SAS_Buffer_overflow_v10.txt" source="MISC">https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140227-0_SAS_Buffer_overflow_v10.txt</ref>
      <ref url="http://www.securityfocus.com/bid/65853" source="BID">65853</ref>
      <ref url="http://www.securityfocus.com/archive/1/archive/1/531283/100/0/threaded" source="BUGTRAQ">20140227 SEC Consult SA-20140227-0 :: Local Buffer Overflow vulnerability in SAS for Windows (Statistical Analysis System)</ref>
      <ref url="http://support.sas.com/kb/51/701.html" source="CONFIRM" adv="1">http://support.sas.com/kb/51/701.html</ref>
      <ref url="http://secunia.com/advisories/57029" source="SECUNIA" adv="1">57029</ref>
    </refs>
    <vuln_soft>
      <prod vendor="sas" name="base_sas">
        <vers num="9.2" edition="ts2m"/>
        <vers num="9.3" edition="ts1m1"/>
        <vers num="9.3" edition="ts1m2"/>
        <vers num="9.4" edition="ts1m0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2263" published="2014-02-28" name="CVE-2014-2263" modified="2014-03-03" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">The mpegts_write_pmt function in the MPEG2 transport stream (aka DVB) muxer (libavformat/mpegtsenc.c) in FFmpeg, possibly 2.1 and earlier, allows remote attackers to have unspecified impact and vectors, which trigger an out-of-bounds write.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://git.videolan.org/?p=ffmpeg.git;a=commit;h=842b6c14bc" source="CONFIRM" patch="1">http://git.videolan.org/?p=ffmpeg.git;a=commit;h=842b6c14bc</ref>
      <ref url="http://xforce.iss.net/xforce/xfdb/91174" source="XF">ffmpeg-mpegtswritepmt-bo(91174)</ref>
      <ref url="http://www.securityfocus.com/bid/65560" source="BID">65560</ref>
      <ref url="http://secunia.com/advisories/56971" source="SECUNIA" adv="1">56971</ref>
    </refs>
    <vuln_soft>
      <prod vendor="ffmpeg" name="ffmpeg">
        <vers num="2.0"/>
        <vers num="2.0.1"/>
        <vers num="2.0.2"/>
        <vers num="2.0.3"/>
        <vers prev="1" num="2.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2264" published="2014-03-02" name="CVE-2014-2264" modified="2014-03-03" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:C/I:N/A:N)" CVSS_score="7.8" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="10.0" CVSS_base_score="7.8">
    <desc>
      <descript source="cve">The OpenVPN module in Synology DiskStation Manager (DSM) 4.3-3810 update 1 has a hardcoded root password of synopass, which makes it easier for remote attackers to obtain access via a VPN session.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.kb.cert.org/vuls/id/534284" source="CERT-VN">VU#534284</ref>
      <ref url="http://forum.synology.com/enu/viewtopic.php?f=173&amp;t=77644" source="MISC">http://forum.synology.com/enu/viewtopic.php?f=173&amp;t=77644</ref>
    </refs>
    <vuln_soft>
      <prod vendor="synology" name="diskstation_manager">
        <vers num="4.3-3810" edition="1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2265" published="2014-03-14" name="CVE-2014-2265" modified="2014-04-09" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:P/A:N)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">Rock Lobster Contact Form 7 before 3.7.2 allows remote attackers to bypass the CAPTCHA protection mechanism and submit arbitrary form data by omitting the _wpcf7_captcha_challenge_captcha-719 parameter.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://contactform7.com/2014/02/26/contact-form-7-372/" source="CONFIRM" patch="1" adv="1">http://contactform7.com/2014/02/26/contact-form-7-372/</ref>
      <ref url="http://www.hedgehogsecurity.co.uk/2014/02/26/contactform7-vulnerability/" source="MISC">http://www.hedgehogsecurity.co.uk/2014/02/26/contactform7-vulnerability/</ref>
      <ref url="http://wordpress.org/plugins/contact-form-7/changelog" source="CONFIRM">http://wordpress.org/plugins/contact-form-7/changelog</ref>
    </refs>
    <vuln_soft>
      <prod vendor="rocklobster" name="contact_form_7">
        <vers num="3.6" edition=":~~~wordpress~~"/>
        <vers num="3.7" edition=":~~~wordpress~~"/>
        <vers prev="1" num="3.7.1" edition=":~~~wordpress~~"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2269" published="2014-04-22" name="CVE-2014-2269" modified="2014-04-22" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:P/A:P)" CVSS_score="6.4" CVSS_impact_subscore="4.9" CVSS_exploit_subscore="10.0" CVSS_base_score="6.4">
    <desc>
      <descript source="cve">modules/Users/ForgotPassword.php in vTiger 6.0 before Security Patch 2 allows remote attackers to reset the password for arbitrary users via a request containing the username, password, and confirmPassword parameters.</descript>
    </desc>
    <loss_types>
      <avail/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://vtiger-crm.2324883.n4.nabble.com/Vtigercrm-developers-IMP-forgot-password-and-re-installation-security-fix-tt9786.html" source="MLIST" patch="1">[Vtigercrm-developers] 20140316 IMP: forgot password and re-installation security fix</ref>
      <ref url="http://www.securityfocus.com/bid/66758" source="BID">66758</ref>
    </refs>
    <vuln_soft>
      <prod vendor="vtiger" name="vtiger_crm">
        <vers num="6.0.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2270" published="2014-03-14" name="CVE-2014-2270" modified="2014-04-19" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:N/A:P)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">softmagic.c in file before 5.17 and libmagic allows context-dependent attackers to cause a denial of service (out-of-bounds memory access and crash) via crafted offsets in the softmagic of a PE executable.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://github.com/file/file/commit/447558595a3650db2886cd2f416ad0beba965801" source="CONFIRM" patch="1">https://github.com/file/file/commit/447558595a3650db2886cd2f416ad0beba965801</ref>
      <ref url="http://bugs.gw.com/view.php?id=313" source="CONFIRM" patch="1">http://bugs.gw.com/view.php?id=313</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2163-1" source="UBUNTU">USN-2163-1</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2162-1" source="UBUNTU">USN-2162-1</ref>
      <ref url="http://www.php.net/ChangeLog-5.php" source="CONFIRM">http://www.php.net/ChangeLog-5.php</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2873" source="DEBIAN">DSA-2873</ref>
      <ref url="http://seclists.org/oss-sec/2014/q1/505" source="MLIST">[oss-security] 20140305 Re: CVE Request: file: crashes when checking softmagic for some corrupt PE executables</ref>
      <ref url="http://seclists.org/oss-sec/2014/q1/504" source="MLIST">[oss-security] 20140305 Re: CVE Request: file: crashes when checking softmagic for some corrupt PE executables</ref>
      <ref url="http://seclists.org/oss-sec/2014/q1/473" source="MLIST">[oss-security] 20140303 CVE Request: file: crashes when checking softmagic for some corrupt PE executables</ref>
      <ref url="http://lists.opensuse.org/opensuse-updates/2014-03/msg00084.html" source="SUSE">openSUSE-SU-2014:0435</ref>
      <ref url="http://lists.opensuse.org/opensuse-updates/2014-03/msg00037.html" source="SUSE">openSUSE-SU-2014:0367</ref>
      <ref url="http://lists.opensuse.org/opensuse-updates/2014-03/msg00034.html" source="SUSE">openSUSE-SU-2014:0364</ref>
    </refs>
    <vuln_soft>
      <prod vendor="christos_zoulas" name="file">
        <vers num="5.00"/>
        <vers num="5.01"/>
        <vers num="5.02"/>
        <vers num="5.03"/>
        <vers num="5.04"/>
        <vers num="5.05"/>
        <vers num="5.06"/>
        <vers num="5.07"/>
        <vers num="5.08"/>
        <vers num="5.09"/>
        <vers num="5.10"/>
        <vers num="5.11"/>
        <vers num="5.12"/>
        <vers num="5.13"/>
        <vers num="5.14"/>
        <vers num="5.15"/>
        <vers prev="1" num="5.16"/>
      </prod>
      <prod vendor="tim_robbins" name="libmagic">
        <vers num="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2276" published="2014-03-21" name="CVE-2014-2276" modified="2014-04-01" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:N/A:N)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">The FileUploadController servlet in EMC Connectrix Manager Converged Network Edition (CMCNE) before 12.1.5 does not properly restrict additions to the Connectrix Manager repository, which allows remote attackers to obtain sensitive information by importing a crafted firmware file.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/91987" source="XF">connectrix-cve20142276-info-disc(91987)</ref>
      <ref url="http://www.securitytracker.com/id/1029939" source="SECTRACK">1029939</ref>
      <ref url="http://www.securityfocus.com/bid/66308" source="BID">66308</ref>
      <ref url="http://secunia.com/advisories/57513" source="SECUNIA">57513</ref>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-03/0115.html" source="BUGTRAQ">20140318 ESA-2014-018: EMC Connectrix Manager Converged Network Edition Information Disclosure Vulnerability</ref>
    </refs>
    <vuln_soft>
      <prod vendor="emc" name="connectrix_manager">
        <vers prev="1" num="12.1.2" edition="-:~-~converged_network_edition~~~"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2280" published="2014-03-20" name="CVE-2014-2280" modified="2014-03-24" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in the search feature in SeedDMS (formerly LetoDMS and MyDMS) before 4.3.4 allows remote attackers to inject arbitrary web script or HTML via the query parameter.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/91830" source="XF">seeddms-cve20142280-xss(91830)</ref>
      <ref url="http://sourceforge.net/p/seeddms/code/ci/master/tree/CHANGELOG" source="CONFIRM">http://sourceforge.net/p/seeddms/code/ci/master/tree/CHANGELOG</ref>
      <ref url="http://secunia.com/advisories/57475" source="SECUNIA" adv="1">57475</ref>
      <ref url="http://packetstormsecurity.com/files/125726" source="MISC">http://packetstormsecurity.com/files/125726</ref>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-03/0101.html" source="BUGTRAQ">20140314 Multiple Vulnerabilities in SeedDMS &lt; = 4.3.3</ref>
    </refs>
    <vuln_soft>
      <prod vendor="seeddms" name="seeddms">
        <vers num="3.3.12"/>
        <vers num="3.4.3"/>
        <vers prev="1" num="4.2.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2281" published="2014-03-11" name="CVE-2014-2281" modified="2014-04-19" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:N/A:P)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">The nfs_name_snoop_add_name function in epan/dissectors/packet-nfs.c in the NFS dissector in Wireshark 1.8.x before 1.8.13 and 1.10.x before 1.10.6 does not validate a certain length value, which allows remote attackers to cause a denial of service (memory corruption and application crash) via a crafted NFS packet.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9672" source="CONFIRM" patch="1">https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9672</ref>
      <ref url="http://anonsvn.wireshark.org/viewvc?view=revision&amp;revision=54875" source="CONFIRM" patch="1">http://anonsvn.wireshark.org/viewvc?view=revision&amp;revision=54875</ref>
      <ref url="http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-nfs.c?r1=54875&amp;r2=54874&amp;pathrev=54875" source="CONFIRM" patch="1">http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-nfs.c?r1=54875&amp;r2=54874&amp;pathrev=54875</ref>
      <ref url="http://www.wireshark.org/security/wnpa-sec-2014-01.html" source="CONFIRM" adv="1">http://www.wireshark.org/security/wnpa-sec-2014-01.html</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2871" source="DEBIAN">DSA-2871</ref>
      <ref url="http://secunia.com/advisories/57489" source="SECUNIA">57489</ref>
      <ref url="http://secunia.com/advisories/57480" source="SECUNIA">57480</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0342.html" source="REDHAT">RHSA-2014:0342</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0341.html" source="REDHAT">RHSA-2014:0341</ref>
      <ref url="http://lists.opensuse.org/opensuse-updates/2014-03/msg00047.html" source="SUSE">openSUSE-SU-2014:0383</ref>
      <ref url="http://lists.opensuse.org/opensuse-updates/2014-03/msg00046.html" source="SUSE">openSUSE-SU-2014:0382</ref>
    </refs>
    <vuln_soft>
      <prod vendor="wireshark" name="wireshark">
        <vers num="1.10.0"/>
        <vers num="1.10.1"/>
        <vers num="1.10.2"/>
        <vers num="1.10.3"/>
        <vers num="1.10.4"/>
        <vers num="1.10.5"/>
        <vers num="1.8.0"/>
        <vers num="1.8.1"/>
        <vers num="1.8.10"/>
        <vers num="1.8.11"/>
        <vers num="1.8.12"/>
        <vers num="1.8.2"/>
        <vers num="1.8.3"/>
        <vers num="1.8.4"/>
        <vers num="1.8.5"/>
        <vers num="1.8.6"/>
        <vers num="1.8.7"/>
        <vers num="1.8.8"/>
        <vers num="1.8.9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2282" published="2014-03-11" name="CVE-2014-2282" modified="2014-04-01" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:N/A:P)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">The dissect_protocol_data_parameter function in epan/dissectors/packet-m3ua.c in the M3UA dissector in Wireshark 1.10.x before 1.10.6 does not properly allocate memory, which allows remote attackers to cause a denial of service (application crash) via a crafted SS7 MTP3 packet.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://anonsvn.wireshark.org/viewvc?view=revision&amp;revision=51608" source="CONFIRM" patch="1">http://anonsvn.wireshark.org/viewvc?view=revision&amp;revision=51608</ref>
      <ref url="http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-m3ua.c?r1=51608&amp;r2=51607&amp;pathrev=51608" source="CONFIRM" patch="1">http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-m3ua.c?r1=51608&amp;r2=51607&amp;pathrev=51608</ref>
      <ref url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9699" source="CONFIRM">https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9699</ref>
      <ref url="http://www.wireshark.org/security/wnpa-sec-2014-02.html" source="CONFIRM" adv="1">http://www.wireshark.org/security/wnpa-sec-2014-02.html</ref>
      <ref url="http://secunia.com/advisories/57480" source="SECUNIA">57480</ref>
      <ref url="http://lists.opensuse.org/opensuse-updates/2014-03/msg00046.html" source="SUSE">openSUSE-SU-2014:0382</ref>
    </refs>
    <vuln_soft>
      <prod vendor="wireshark" name="wireshark">
        <vers num="1.10.0"/>
        <vers num="1.10.1"/>
        <vers num="1.10.2"/>
        <vers num="1.10.3"/>
        <vers num="1.10.4"/>
        <vers num="1.10.5"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2283" published="2014-03-11" name="CVE-2014-2283" modified="2014-04-19" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:N/A:P)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">epan/dissectors/packet-rlc in the RLC dissector in Wireshark 1.8.x before 1.8.13 and 1.10.x before 1.10.6 uses inconsistent memory-management approaches, which allows remote attackers to cause a denial of service (use-after-free error and application crash) via a crafted UMTS Radio Link Control packet.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=217293ba4a0353bf5d657e74fe8623dd3c86fe08" source="CONFIRM" patch="1">https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=217293ba4a0353bf5d657e74fe8623dd3c86fe08</ref>
      <ref url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9802" source="CONFIRM">https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9802</ref>
      <ref url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9730" source="CONFIRM">https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9730</ref>
      <ref url="http://www.wireshark.org/security/wnpa-sec-2014-03.html" source="CONFIRM" adv="1">http://www.wireshark.org/security/wnpa-sec-2014-03.html</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2871" source="DEBIAN">DSA-2871</ref>
      <ref url="http://secunia.com/advisories/57489" source="SECUNIA">57489</ref>
      <ref url="http://secunia.com/advisories/57480" source="SECUNIA">57480</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0342.html" source="REDHAT">RHSA-2014:0342</ref>
      <ref url="http://lists.opensuse.org/opensuse-updates/2014-03/msg00047.html" source="SUSE">openSUSE-SU-2014:0383</ref>
      <ref url="http://lists.opensuse.org/opensuse-updates/2014-03/msg00046.html" source="SUSE">openSUSE-SU-2014:0382</ref>
    </refs>
    <vuln_soft>
      <prod vendor="wireshark" name="wireshark">
        <vers num="1.10.0"/>
        <vers num="1.10.1"/>
        <vers num="1.10.2"/>
        <vers num="1.10.3"/>
        <vers num="1.10.4"/>
        <vers num="1.10.5"/>
        <vers num="1.8.0"/>
        <vers num="1.8.1"/>
        <vers num="1.8.10"/>
        <vers num="1.8.11"/>
        <vers num="1.8.12"/>
        <vers num="1.8.2"/>
        <vers num="1.8.3"/>
        <vers num="1.8.4"/>
        <vers num="1.8.5"/>
        <vers num="1.8.6"/>
        <vers num="1.8.7"/>
        <vers num="1.8.8"/>
        <vers num="1.8.9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2284" published="2014-03-24" name="CVE-2014-2284" modified="2014-04-24" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:P)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">The Linux implementation of the ICMP-MIB in Net-SNMP 5.5 before 5.5.2.1, 5.6.x before 5.6.2.1, and 5.7.x before 5.7.2.1 does not properly validate input, which allows remote attackers to cause a denial of service via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.ubuntu.com/usn/USN-2166-1" source="UBUNTU">USN-2166-1</ref>
      <ref url="http://sourceforge.net/p/net-snmp/code/ci/a1fd64716f6794c55c34d77e618210238a73bfa1/" source="MLIST">[net-snmp-announce] 20140225 Multiple Security-fix Net-SNMP Releases: 5.5.2.1, 5.6.2.1, and 5.7.2.1</ref>
      <ref url="http://secunia.com/advisories/57870" source="SECUNIA">57870</ref>
      <ref url="http://secunia.com/advisories/57583" source="SECUNIA">57583</ref>
      <ref url="http://secunia.com/advisories/57526" source="SECUNIA" adv="1">57526</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0321.html" source="REDHAT">RHSA-2014:0321</ref>
      <ref url="http://lists.opensuse.org/opensuse-updates/2014-03/msg00061.html" source="SUSE">openSUSE-SU-2014:0399</ref>
      <ref url="http://lists.opensuse.org/opensuse-updates/2014-03/msg00060.html" source="SUSE">openSUSE-SU-2014:0398</ref>
      <ref url="http://comments.gmane.org/gmane.comp.security.oss.general/12284" source="MLIST">[oss-security] 20140305 CVE request for two net-snmp remote DoS flaws</ref>
    </refs>
    <vuln_soft>
      <prod vendor="net-snmp" name="net-snmp">
        <vers num="5.5"/>
        <vers num="5.5.0.1"/>
        <vers num="5.5.0.2"/>
        <vers num="5.5.1"/>
        <vers num="5.5.1.1"/>
        <vers num="5.5.2"/>
        <vers num="5.6"/>
        <vers num="5.6.1.1"/>
        <vers num="5.6.2"/>
        <vers num="5.7"/>
        <vers num="5.7.1"/>
        <vers num="5.7.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2285" published="2014-04-27" name="CVE-2014-2285" modified="2014-04-28" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:N/A:P)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">The perl_trapd_handler function in perl/TrapReceiver/TrapReceiver.xs in Net-SNMP 5.7.3.pre3 and earlier, when using certain Perl versions, allows remote attackers to cause a denial of service (snmptrapd crash) via an empty community string in an SNMP trap, which triggers a NULL pointer dereference within the newSVpv function in Perl.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://bugzilla.redhat.com/show_bug.cgi?id=1072778" source="CONFIRM">https://bugzilla.redhat.com/show_bug.cgi?id=1072778</ref>
      <ref url="https://bugzilla.redhat.com/show_bug.cgi?id=1072044" source="CONFIRM" adv="1">https://bugzilla.redhat.com/show_bug.cgi?id=1072044</ref>
      <ref url="http://www.nntp.perl.org/group/perl.perl5.porters/2006/09/msg116250.html" source="MISC">http://www.nntp.perl.org/group/perl.perl5.porters/2006/09/msg116250.html</ref>
      <ref url="http://sourceforge.net/p/net-snmp/patches/1275/" source="CONFIRM">http://sourceforge.net/p/net-snmp/patches/1275/</ref>
      <ref url="http://lists.opensuse.org/opensuse-updates/2014-03/msg00061.html" source="SUSE">openSUSE-SU-2014:0399</ref>
      <ref url="http://lists.opensuse.org/opensuse-updates/2014-03/msg00060.html" source="SUSE">openSUSE-SU-2014:0398</ref>
      <ref url="http://comments.gmane.org/gmane.comp.security.oss.general/12284" source="MLIST">[oss-security] 20140305 CVE request for two net-snmp remote DoS flaws</ref>
    </refs>
    <vuln_soft>
      <prod vendor="net-snmp" name="net-snmp">
        <vers prev="1" num="5.7.3" edition="pre1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2286" published="2014-04-18" name="CVE-2014-2286" modified="2014-04-21" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">main/http.c in Asterisk Open Source 1.8.x before 1.8.26.1, 11.8.x before 11.8.1, and 12.1.x before 12.1.1, and Certified Asterisk 1.8.x before 1.8.15-cert5 and 11.6 before 11.6-cert2, allows remote attackers to cause a denial of service (stack consumption) and possibly execute arbitrary code via an HTTP request with a large number of Cookie headers.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://downloads.asterisk.org/pub/security/AST-2014-001.html" source="CONFIRM" patch="1" adv="1">http://downloads.asterisk.org/pub/security/AST-2014-001.html</ref>
      <ref url="http://downloads.asterisk.org/pub/security/AST-2014-001-1.8.diff" source="MISC" patch="1">http://downloads.asterisk.org/pub/security/AST-2014-001-1.8.diff</ref>
      <ref url="https://issues.asterisk.org/jira/browse/ASTERISK-23340" source="CONFIRM">https://issues.asterisk.org/jira/browse/ASTERISK-23340</ref>
      <ref url="http://www.securityfocus.com/bid/66093" source="BID">66093</ref>
      <ref url="http://www.mandriva.com/security/advisories?name=MDVSA-2014:078" source="MANDRIVA">MDVSA-2014:078</ref>
      <ref url="http://lists.fedoraproject.org/pipermail/package-announce/2014-March/130426.html" source="FEDORA">FEDORA-2014-3762</ref>
      <ref url="http://lists.fedoraproject.org/pipermail/package-announce/2014-March/130400.html" source="FEDORA">FEDORA-2014-3779</ref>
    </refs>
    <vuln_soft>
      <prod vendor="digium" name="asterisk">
        <vers num="1.8.0" edition="beta1"/>
        <vers num="1.8.0" edition="beta2"/>
        <vers num="1.8.0" edition="beta3"/>
        <vers num="1.8.0" edition="beta4"/>
        <vers num="1.8.0" edition="beta5"/>
        <vers num="1.8.0" edition="rc2"/>
        <vers num="1.8.0" edition="rc3"/>
        <vers num="1.8.0" edition="rc4"/>
        <vers num="1.8.0" edition="rc5"/>
        <vers num="1.8.1" edition="rc1"/>
        <vers num="1.8.1.1"/>
        <vers num="1.8.1.2"/>
        <vers num="1.8.10.0" edition="-"/>
        <vers num="1.8.10.0" edition="rc1"/>
        <vers num="1.8.10.0" edition="rc2"/>
        <vers num="1.8.10.0" edition="rc3"/>
        <vers num="1.8.10.0" edition="rc4"/>
        <vers num="1.8.10.1"/>
        <vers num="1.8.11.0" edition="-"/>
        <vers num="1.8.11.0" edition="patch"/>
        <vers num="1.8.11.0" edition="rc2"/>
        <vers num="1.8.11.0" edition="rc3"/>
        <vers num="1.8.11.1" edition="-"/>
        <vers num="1.8.11.1" edition="patch"/>
        <vers num="1.8.12"/>
        <vers num="1.8.12.0" edition="-"/>
        <vers num="1.8.12.0" edition="rc1"/>
        <vers num="1.8.12.0" edition="rc2"/>
        <vers num="1.8.12.0" edition="rc3"/>
        <vers num="1.8.12.1"/>
        <vers num="1.8.12.2"/>
        <vers num="1.8.13.0" edition="rc1"/>
        <vers num="1.8.13.0" edition="rc2"/>
        <vers num="1.8.13.1"/>
        <vers num="1.8.14.0" edition="-"/>
        <vers num="1.8.14.0" edition="patch"/>
        <vers num="1.8.14.0" edition="rc1"/>
        <vers num="1.8.14.0" edition="rc2"/>
        <vers num="1.8.14.1" edition="-"/>
        <vers num="1.8.14.1" edition="patch"/>
        <vers num="1.8.15.0" edition="-"/>
        <vers num="1.8.15.0" edition="rc1"/>
        <vers num="1.8.15.1"/>
        <vers num="1.8.16.0" edition="-"/>
        <vers num="1.8.16.0" edition="rc1"/>
        <vers num="1.8.16.0" edition="rc2"/>
        <vers num="1.8.17.0" edition="-"/>
        <vers num="1.8.17.0" edition="patch"/>
        <vers num="1.8.17.0" edition="rc1"/>
        <vers num="1.8.17.0" edition="rc2"/>
        <vers num="1.8.17.0" edition="rc3"/>
        <vers num="1.8.18.0" edition="-"/>
        <vers num="1.8.18.0" edition="rc1"/>
        <vers num="1.8.18.1"/>
        <vers num="1.8.19.0" edition="-"/>
        <vers num="1.8.19.0" edition="rc1"/>
        <vers num="1.8.19.0" edition="rc3"/>
        <vers num="1.8.19.1"/>
        <vers num="1.8.2"/>
        <vers num="1.8.2.1"/>
        <vers num="1.8.2.2"/>
        <vers num="1.8.2.3"/>
        <vers num="1.8.2.4"/>
        <vers num="1.8.20.0" edition="-"/>
        <vers num="1.8.20.0" edition="patch"/>
        <vers num="1.8.20.0" edition="rc1"/>
        <vers num="1.8.20.0" edition="rc2"/>
        <vers num="1.8.20.1" edition="-"/>
        <vers num="1.8.20.1" edition="patch"/>
        <vers num="1.8.20.2" edition="-"/>
        <vers num="1.8.20.2" edition="patch"/>
        <vers num="1.8.21.0" edition="-"/>
        <vers num="1.8.21.0" edition="rc1"/>
        <vers num="1.8.21.0" edition="rc2"/>
        <vers num="1.8.22.0" edition="-"/>
        <vers num="1.8.22.0" edition="rc1"/>
        <vers num="1.8.22.0" edition="rc2"/>
        <vers num="1.8.23.0" edition="-"/>
        <vers num="1.8.23.0" edition="patch"/>
        <vers num="1.8.23.0" edition="rc1"/>
        <vers num="1.8.23.0" edition="rc2"/>
        <vers num="1.8.23.1"/>
        <vers num="1.8.24.0" edition="-"/>
        <vers num="1.8.24.0" edition="rc1"/>
        <vers num="1.8.24.0" edition="rc2"/>
        <vers num="1.8.24.1"/>
        <vers num="1.8.25.0" edition="-"/>
        <vers num="1.8.25.0" edition="rc1"/>
        <vers num="1.8.25.0" edition="rc2"/>
        <vers num="1.8.26.0" edition="-"/>
        <vers num="1.8.26.0" edition="rc1"/>
        <vers num="1.8.3" edition="rc1"/>
        <vers num="1.8.3" edition="rc2"/>
        <vers num="1.8.3" edition="rc3"/>
        <vers num="1.8.3.1"/>
        <vers num="1.8.3.2"/>
        <vers num="1.8.3.3"/>
        <vers num="1.8.4" edition="rc1"/>
        <vers num="1.8.4" edition="rc2"/>
        <vers num="1.8.4" edition="rc3"/>
        <vers num="1.8.4.1"/>
        <vers num="1.8.4.2"/>
        <vers num="1.8.4.3"/>
        <vers num="1.8.4.4"/>
        <vers num="1.8.5" edition="rc1"/>
        <vers num="1.8.5.0"/>
        <vers num="1.8.6.0" edition="rc1"/>
        <vers num="1.8.6.0" edition="rc2"/>
        <vers num="1.8.6.0" edition="rc3"/>
        <vers num="1.8.7.0" edition="rc1"/>
        <vers num="1.8.7.0" edition="rc2"/>
        <vers num="1.8.7.1"/>
        <vers num="1.8.8.0" edition="-"/>
        <vers num="1.8.8.0" edition="patch"/>
        <vers num="1.8.8.0" edition="rc1"/>
        <vers num="1.8.8.0" edition="rc2"/>
        <vers num="1.8.8.0" edition="rc3"/>
        <vers num="1.8.8.0" edition="rc4"/>
        <vers num="1.8.8.0" edition="rc5"/>
        <vers num="1.8.8.1"/>
        <vers num="1.8.8.2"/>
        <vers num="1.8.9.0" edition="-"/>
        <vers num="1.8.9.0" edition="rc1"/>
        <vers num="1.8.9.0" edition="rc2"/>
        <vers num="1.8.9.0" edition="rc3"/>
        <vers num="1.8.9.1"/>
        <vers num="1.8.9.2"/>
        <vers num="1.8.9.3"/>
        <vers num="11.8.0" edition="-"/>
        <vers num="11.8.0" edition="rc1"/>
        <vers num="11.8.0" edition="rc2"/>
        <vers num="11.8.0" edition="rc3"/>
        <vers num="12.1.0" edition="-"/>
        <vers num="12.1.0" edition="rc1"/>
        <vers num="12.1.0" edition="rc2"/>
        <vers num="12.1.0" edition="rc3"/>
      </prod>
      <prod vendor="digium" name="certified_asterisk">
        <vers num="1.8.0.0" edition="-"/>
        <vers num="1.8.0.0" edition="beta1"/>
        <vers num="1.8.0.0" edition="beta2"/>
        <vers num="1.8.0.0" edition="beta3"/>
        <vers num="1.8.0.0" edition="beta4"/>
        <vers num="1.8.0.0" edition="beta5"/>
        <vers num="1.8.0.0" edition="rc1"/>
        <vers num="1.8.0.0" edition="rc2"/>
        <vers num="1.8.0.0" edition="rc3"/>
        <vers num="1.8.0.0" edition="rc4"/>
        <vers num="1.8.0.0" edition="rc5"/>
        <vers num="1.8.1.0" edition="-"/>
        <vers num="1.8.1.0" edition="rc1"/>
        <vers num="1.8.10.0" edition="-"/>
        <vers num="1.8.10.0" edition="rc1"/>
        <vers num="1.8.10.0" edition="rc2"/>
        <vers num="1.8.10.0" edition="rc3"/>
        <vers num="1.8.10.0" edition="rc4"/>
        <vers num="1.8.11.0" edition="-"/>
        <vers num="1.8.11.0" edition="rc1"/>
        <vers num="1.8.11.0" edition="rc2"/>
        <vers num="1.8.11.0" edition="rc3"/>
        <vers num="1.8.12.0" edition="-"/>
        <vers num="1.8.12.0" edition="rc1"/>
        <vers num="1.8.12.0" edition="rc2"/>
        <vers num="1.8.12.0" edition="rc3"/>
        <vers num="1.8.13.0" edition="-"/>
        <vers num="1.8.13.0" edition="rc1"/>
        <vers num="1.8.13.0" edition="rc2"/>
        <vers num="1.8.14.0" edition="rc1"/>
        <vers num="1.8.14.0" edition="rc2"/>
        <vers num="1.8.15" edition="-"/>
        <vers num="1.8.15" edition="cert1"/>
        <vers num="1.8.15" edition="cert1_rc1"/>
        <vers num="1.8.15" edition="cert1_rc2"/>
        <vers num="1.8.15" edition="cert1_rc3"/>
        <vers num="1.8.15" edition="cert2"/>
        <vers num="1.8.15" edition="cert3"/>
        <vers num="1.8.15" edition="cert4"/>
        <vers num="1.8.2.0" edition="-"/>
        <vers num="1.8.2.0" edition="rc1"/>
        <vers num="1.8.3.0" edition="-"/>
        <vers num="1.8.3.0" edition="rc1"/>
        <vers num="1.8.3.0" edition="rc2"/>
        <vers num="1.8.3.0" edition="rc3"/>
        <vers num="1.8.4.0" edition="-"/>
        <vers num="1.8.4.0" edition="rc1"/>
        <vers num="1.8.4.0" edition="rc2"/>
        <vers num="1.8.4.0" edition="rc3"/>
        <vers num="1.8.5.0" edition="-"/>
        <vers num="1.8.5.0" edition="rc1"/>
        <vers num="1.8.6.0" edition="-"/>
        <vers num="1.8.6.0" edition="rc1"/>
        <vers num="1.8.6.0" edition="rc2"/>
        <vers num="1.8.6.0" edition="rc3"/>
        <vers num="1.8.7.0" edition="-"/>
        <vers num="1.8.7.0" edition="rc1"/>
        <vers num="1.8.7.0" edition="rc2"/>
        <vers num="1.8.8.0" edition="-"/>
        <vers num="1.8.8.0" edition="rc1"/>
        <vers num="1.8.8.0" edition="rc2"/>
        <vers num="1.8.8.0" edition="rc3"/>
        <vers num="1.8.8.0" edition="rc4"/>
        <vers num="1.8.8.0" edition="rc5"/>
        <vers num="1.8.9.0" edition="-"/>
        <vers num="1.8.9.0" edition="rc1"/>
        <vers num="1.8.9.0" edition="rc2"/>
        <vers num="1.8.9.0" edition="rc3"/>
        <vers num="11.6" edition="cert1"/>
        <vers num="11.6" edition="cert1_rc1"/>
        <vers num="11.6" edition="cert1_rc2"/>
        <vers num="11.6.0" edition="-"/>
        <vers num="11.6.0" edition="rc1"/>
        <vers num="11.6.0" edition="rc2"/>
      </prod>
      <prod vendor="fedoraproject" name="fedora">
        <vers num="19"/>
        <vers num="20"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-2287" published="2014-04-18" name="CVE-2014-2287" modified="2014-04-21" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:S/C:N/I:N/A:P)" CVSS_score="3.5" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="6.8" CVSS_base_score="3.5">
    <desc>
      <descript source="cve">channels/chan_sip.c in Asterisk Open Source 1.8.x before 1.8.26.1, 11.8.x before 11.8.1, and 12.1.x before 12.1.1, and Certified Asterisk 1.8.15 before 1.8.15-cert5 and 11.6 before 11.6-cert2, when chan_sip has a certain configuration, allows remote authenticated users to cause a denial of service (channel and file descriptor consumption) via an INVITE request with a (1) Session-Expires or (2) Min-SE header with a malformed or invalid value.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://downloads.asterisk.org/pub/security/AST-2014-002.html" source="CONFIRM" patch="1" adv="1">http://downloads.asterisk.org/pub/security/AST-2014-002.html</ref>
      <ref url="http://downloads.asterisk.org/pub/security/AST-2014-002-1.8.diff" source="MISC" patch="1">http://downloads.asterisk.org/pub/security/AST-2014-002-1.8.diff</ref>
      <ref url="https://issues.asterisk.org/jira/browse/ASTERISK-23373" source="CONFIRM">https://issues.asterisk.org/jira/browse/ASTERISK-23373</ref>
      <ref url="http://www.securityfocus.com/bid/66094" source="BID">66094</ref>
      <ref url="http://www.mandriva.com/security/advisories?name=MDVSA-2014:078" source="MANDRIVA">MDVSA-2014:078</ref>
      <ref url="http://lists.fedoraproject.org/pipermail/package-announce/2014-March/130426.html" source="FEDORA">FEDORA-2014-3762</ref>
      <ref url="http://lists.fedoraproject.org/pipermail/package-announce/2014-March/130400.html" source="FEDORA">FEDORA-2014-3779</ref>
    </refs>
    <vuln_soft>
      <prod vendor="digium" name="asterisk">
        <vers num="1.8.0" edition="beta1"/>
        <vers num="1.8.0" edition="beta2"/>
        <vers num="1.8.0" edition="beta3"/>
        <vers num="1.8.0" edition="beta4"/>
        <vers num="1.8.0" edition="beta5"/>
        <vers num="1.8.0" edition="rc2"/>
        <vers num="1.8.0" edition="rc3"/>
        <vers num="1.8.0" edition="rc4"/>
        <vers num="1.8.0" edition="rc5"/>
        <vers num="1.8.1" edition="rc1"/>
        <vers num="1.8.1.1"/>
        <vers num="1.8.1.2"/>
        <vers num="1.8.10.0" edition="-"/>
        <vers num="1.8.10.0" edition="rc1"/>
        <vers num="1.8.10.0" edition="rc2"/>
        <vers num="1.8.10.0" edition="rc3"/>
        <vers num="1.8.10.0" edition="rc4"/>
        <vers num="1.8.10.1"/>
        <vers num="1.8.11.0" edition="-"/>
        <vers num="1.8.11.0" edition="patch"/>
        <vers num="1.8.11.0" edition="rc2"/>
        <vers num="1.8.11.0" edition="rc3"/>
        <vers num="1.8.11.1" edition="-"/>
        <vers num="1.8.11.1" edition="patch"/>
        <vers num="1.8.12"/>
        <vers num="1.8.12.0" edition="-"/>
        <vers num="1.8.12.0" edition="rc1"/>
        <vers num="1.8.12.0" edition="rc2"/>
        <vers num="1.8.12.0" edition="rc3"/>
        <vers num="1.8.12.1"/>
        <vers num="1.8.12.2"/>
        <vers num="1.8.13.0" edition="rc1"/>
        <vers num="1.8.13.0" edition="rc2"/>
        <vers num="1.8.13.1"/>
        <vers num="1.8.14.0" edition="-"/>
        <vers num="1.8.14.0" edition="patch"/>
        <vers num="1.8.14.0" edition="rc1"/>
        <vers num="1.8.14.0" edition="rc2"/>
        <vers num="1.8.14.1" edition="-"/>
        <vers num="1.8.14.1" edition="patch"/>
        <vers num="1.8.15.0" edition="-"/>
        <vers num="1.8.15.0" edition="rc1"/>
        <vers num="1.8.15.1"/>
        <vers num="1.8.16.0" edition="-"/>
        <vers num="1.8.16.0" edition="rc1"/>
        <vers num="1.8.16.0" edition="rc2"/>
        <vers num="1.8.17.0" edition="-"/>
        <vers num="1.8.17.0" edition="patch"/>
        <vers num="1.8.17.0" edition="rc1"/>
        <vers num="1.8.17.0" edition="rc2"/>
        <vers num="1.8.17.0" edition="rc3"/>
        <vers num="1.8.18.0" edition="-"/>
        <vers num="1.8.18.0" edition="rc1"/>
        <vers num="1.8.18.1"/>
        <vers num="1.8.19.0" edition="-"/>
        <vers num="1.8.19.0" edition="rc1"/>
        <vers num="1.8.19.0" edition="rc3"/>
        <vers num="1.8.19.1"/>
        <vers num="1.8.2"/>
        <vers num="1.8.2.1"/>
        <vers num="1.8.2.2"/>
        <vers num="1.8.2.3"/>
        <vers num="1.8.2.4"/>
        <vers num="1.8.20.0" edition="-"/>
        <vers num="1.8.20.0" edition="patch"/>
        <vers num="1.8.20.0" edition="rc1"/>
        <vers num="1.8.20.0" edition="rc2"/>
        <vers num="1.8.20.1" edition="-"/>
        <vers num="1.8.20.1" edition="patch"/>
        <vers num="1.8.20.2" edition="-"/>
        <vers num="1.8.20.2" edition="patch"/>
        <vers num="1.8.21.0" edition="-"/>
        <vers num="1.8.21.0" edition="rc1"/>
        <vers num="1.8.21.0" edition="rc2"/>
        <vers num="1.8.22.0" edition="-"/>
        <vers num="1.8.22.0" edition="rc1"/>
        <vers num="1.8.22.0" edition="rc2"/>
        <vers num="1.8.23.0" edition="-"/>
        <vers num="1.8.23.0" edition="patch"/>
        <vers num="1.8.23.0" edition="rc1"/>
        <vers num="1.8.23.0" edition="rc2"/>
        <vers num="1.8.23.1"/>
        <vers num="1.8.24.0" edition="-"/>
        <vers num="1.8.24.0" edition="rc1"/>
        <vers num="1.8.24.0" edition="rc2"/>
        <vers num="1.8.24.1"/>
        <vers num="1.8.25.0" edition="-"/>
        <vers num="1.8.25.0" edition="rc1"/>
        <vers num="1.8.25.0" edition="rc2"/>
        <vers num="1.8.26.0" edition="-"/>
        <vers num="1.8.26.0" edition="rc1"/>
        <vers num="1.8.3" edition="rc1"/>
        <vers num="1.8.3" edition="rc2"/>
        <vers num="1.8.3" edition="rc3"/>
        <vers num="1.8.3.1"/>
        <vers num="1.8.3.2"/>
        <vers num="1.8.3.3"/>
        <vers num="1.8.4" edition="rc1"/>
        <vers num="1.8.4" edition="rc2"/>
        <vers num="1.8.4" edition="rc3"/>
        <vers num="1.8.4.1"/>
        <vers num="1.8.4.2"/>
        <vers num="1.8.4.3"/>
        <vers num="1.8.4.4"/>
        <vers num="1.8.5" edition="rc1"/>
        <vers num="1.8.5.0"/>
        <vers num="1.8.6.0" edition="rc1"/>
        <vers num="1.8.6.0" edition="rc2"/>
        <vers num="1.8.6.0" edition="rc3"/>
        <vers num="1.8.7.0" edition="rc1"/>
        <vers num="1.8.7.0" edition="rc2"/>
        <vers num="1.8.7.1"/>
        <vers num="1.8.8.0" edition="-"/>
        <vers num="1.8.8.0" edition="patch"/>
        <vers num="1.8.8.0" edition="rc1"/>
        <vers num="1.8.8.0" edition="rc2"/>
        <vers num="1.8.8.0" edition="rc3"/>
        <vers num="1.8.8.0" edition="rc4"/>
        <vers num="1.8.8.0" edition="rc5"/>
        <vers num="1.8.8.1"/>
        <vers num="1.8.8.2"/>
        <vers num="1.8.9.0" edition="-"/>
        <vers num="1.8.9.0" edition="rc1"/>
        <vers num="1.8.9.0" edition="rc2"/>
        <vers num="1.8.9.0" edition="rc3"/>
        <vers num="1.8.9.1"/>
        <vers num="1.8.9.2"/>
        <vers num="1.8.9.3"/>
        <vers num="11.8.0" edition="-"/>
        <vers num="11.8.0" edition="rc1"/>
        <vers num="11.8.0" edition="rc2"/>
        <vers num="11.8.0" edition="rc3"/>
        <vers num="12.1.0" edition="-"/>
        <vers num="12.1.0" edition="rc1"/>
        <vers num="12.1.0" edition="rc2"/>
        <vers num="12.1.0" edition="rc3"/>
      </prod>
      <prod vendor="digium" name="certified_asterisk">
        <vers num="1.8.0.0" edition="-"/>
        <vers num="1.8.0.0" edition="beta1"/>
        <vers num="1.8.0.0" edition="beta2"/>
        <vers num="1.8.0.0" edition="beta3"/>
        <vers num="1.8.0.0" edition="beta4"/>
        <vers num="1.8.0.0" edition="beta5"/>
        <vers num="1.8.0.0" edition="rc1"/>
        <vers num="1.8.0.0" edition="rc2"/>
        <vers num="1.8.0.0" edition="rc3"/>
        <vers num="1.8.0.0" edition="rc4"/>
        <vers num="1.8.0.0" edition="rc5"/>
        <vers num="1.8.1.0" edition="-"/>
        <vers num="1.8.1.0" edition="rc1"/>
        <vers num="1.8.10.0" edition="-"/>
        <vers num="1.8.10.0" edition="rc1"/>
        <vers num="1.8.10.0" edition="rc2"/>
        <vers num="1.8.10.0" edition="rc3"/>
        <vers num="1.8.10.0" edition="rc4"/>
        <vers num="1.8.11.0" edition="-"/>
        <vers num="1.8.11.0" edition="rc1"/>
        <vers num="1.8.11.0" edition="rc2"/>
        <vers num="1.8.11.0" edition="rc3"/>
        <vers num="1.8.12.0" edition="-"/>
        <vers num="1.8.12.0" edition="rc1"/>
        <vers num="1.8.12.0" edition="rc2"/>
        <vers num="1.8.12.0" edition="rc3"/>
        <vers num="1.8.13.0" edition="-"/>
        <vers num="1.8.13.0" edition="rc1"/>
        <vers num="1.8.13.0" edition="rc2"/>
        <vers num="1.8.14.0" edition="rc1"/>
        <vers num="1.8.14.0" edition="rc2"/>
        <vers num="1.8.15" edition="-"/>
        <vers num="1.8.15" edition="cert1"/>
        <vers num="1.8.15" edition="cert1_rc1"/>
        <vers num="1.8.15" edition="cert1_rc2"/>
        <vers num="1.8.15" edition="cert1_rc3"/>
        <vers num="1.8.15" edition="cert2"/>
        <vers num="1.8.15" edition="cert3"/>
        <vers num="1.8.15" edition="cert4"/>
        <vers num="1.8.2.0" edition="-"/>
        <vers num="1.8.2.0" edition="rc1"/>
        <vers num="1.8.3.0" edition="-"/>
        <vers num="1.8.3.0" edition="rc1"/>
        <vers num="1.8.3.0" edition="rc2"/>
        <vers num="1.8.3.0" edition="rc3"/>
        <vers num="1.8.4.0" edition="-"/>
        <vers num="1.8.4.0" edition="rc1"/>
        <vers num="1.8.4.0" edition="rc2"/>
        <vers num="1.8.4.0" edition="rc3"/>
        <vers num="1.8.5.0" edition="-"/>
        <vers num="1.8.5.0" edition="rc1"/>
        <vers num="1.8.6.0" edition="-"/>
        <vers num="1.8.6.0" edition="rc1"/>
        <vers num="1.8.6.0" edition="rc2"/>
        <vers num="1.8.6.0" edition="rc3"/>
        <vers num="1.8.7.0" edition="-"/>
        <vers num="1.8.7.0" edition="rc1"/>
        <vers num="1.8.7.0" edition="rc2"/>
        <vers num="1.8.8.0" edition="-"/>
        <vers num="1.8.8.0" edition="rc1"/>
        <vers num="1.8.8.0" edition="rc2"/>
        <vers num="1.8.8.0" edition="rc3"/>
        <vers num="1.8.8.0" edition="rc4"/>
        <vers num="1.8.8.0" edition="rc5"/>
        <vers num="1.8.9.0" edition="-"/>
        <vers num="1.8.9.0" edition="rc1"/>
        <vers num="1.8.9.0" edition="rc2"/>
        <vers num="1.8.9.0" edition="rc3"/>
        <vers num="11.6" edition="cert1"/>
        <vers num="11.6" edition="cert1_rc1"/>
        <vers num="11.6" edition="cert1_rc2"/>
        <vers num="11.6.0" edition="-"/>
        <vers num="11.6.0" edition="rc1"/>
        <vers num="11.6.0" edition="rc2"/>
      </prod>
      <prod vendor="fedoraproject" name="fedora">
        <vers num="19"/>
        <vers num="20"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2288" published="2014-04-18" name="CVE-2014-2288" modified="2014-04-21" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:N/A:P)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">The PJSIP channel driver in Asterisk Open Source 12.x before 12.1.1, when qualify_frequency "is enabled on an AOR and the remote SIP server challenges for authentication of the resulting OPTIONS request," allows remote attackers to cause a denial of service (crash) via a PJSIP endpoint that does not have an associated outgoing request.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://downloads.asterisk.org/pub/security/AST-2014-003-12.diff" source="MISC" patch="1">http://downloads.asterisk.org/pub/security/AST-2014-003-12.diff</ref>
      <ref url="https://issues.asterisk.org/jira/browse/ASTERISK-23210" source="CONFIRM">https://issues.asterisk.org/jira/browse/ASTERISK-23210</ref>
      <ref url="http://lists.fedoraproject.org/pipermail/package-announce/2014-March/130426.html" source="FEDORA">FEDORA-2014-3762</ref>
      <ref url="http://lists.fedoraproject.org/pipermail/package-announce/2014-March/130400.html" source="FEDORA">FEDORA-2014-3779</ref>
      <ref url="http://downloads.asterisk.org/pub/security/AST-2014-003.html" source="CONFIRM" adv="1">http://downloads.asterisk.org/pub/security/AST-2014-003.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="digium" name="asterisk">
        <vers num="12.0.0"/>
        <vers num="12.1.0" edition="-"/>
        <vers num="12.1.0" edition="rc1"/>
        <vers num="12.1.0" edition="rc2"/>
        <vers num="12.1.0" edition="rc3"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-2289" published="2014-04-18" name="CVE-2014-2289" modified="2014-04-21" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:S/C:N/I:N/A:P)" CVSS_score="3.5" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="6.8" CVSS_base_score="3.5">
    <desc>
      <descript source="cve">res/res_pjsip_exten_state.c in the PJSIP channel driver in Asterisk Open Source 12.x before 12.1.0 allows remote authenticated users to cause a denial of service (crash) via a SUBSCRIBE request without any Accept headers, which triggers an invalid pointer dereference.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://downloads.asterisk.org/pub/security/AST-2014-004.html" source="CONFIRM" patch="1" adv="1">http://downloads.asterisk.org/pub/security/AST-2014-004.html</ref>
      <ref url="http://downloads.asterisk.org/pub/security/AST-2014-004-12.diff" source="MISC" patch="1">http://downloads.asterisk.org/pub/security/AST-2014-004-12.diff</ref>
      <ref url="https://issues.asterisk.org/jira/browse/ASTERISK-23139" source="CONFIRM">https://issues.asterisk.org/jira/browse/ASTERISK-23139</ref>
      <ref url="http://lists.fedoraproject.org/pipermail/package-announce/2014-March/130426.html" source="FEDORA">FEDORA-2014-3762</ref>
      <ref url="http://lists.fedoraproject.org/pipermail/package-announce/2014-March/130400.html" source="FEDORA">FEDORA-2014-3779</ref>
    </refs>
    <vuln_soft>
      <prod vendor="digium" name="asterisk">
        <vers num="12.0.0"/>
        <vers num="12.1.0" edition="rc1"/>
        <vers num="12.1.0" edition="rc2"/>
        <vers num="12.1.0" edition="rc3"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-2291" published="2014-03-14" name="CVE-2014-2291" modified="2014-04-01" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:S/C:N/I:P/A:N)" CVSS_score="3.5" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="6.8" CVSS_base_score="3.5">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in the Pulse Collaboration (Secure Meeting) user pages in Juniper Junos Pulse Secure Access Service (aka SSL VPN) with IVE OS before 7.1r18, 7.3 before 7.3r10, 7.4 before 7.4r8, and 8.0 before 8.0r1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="https://kb.juniper.net/InfoCenter/index?page=content&amp;id=JSA10617" source="CONFIRM" adv="1">https://kb.juniper.net/InfoCenter/index?page=content&amp;id=JSA10617</ref>
      <ref url="http://xforce.iss.net/xforce/xfdb/91770" source="XF">juniper-junos-cve20142291-xss(91770)</ref>
      <ref url="http://secunia.com/advisories/57375" source="SECUNIA">57375</ref>
    </refs>
    <vuln_soft>
      <prod vendor="juniper" name="ive_os">
        <vers num="7.1"/>
        <vers num="7.3"/>
        <vers num="7.4"/>
        <vers num="8.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2292" published="2014-03-14" name="CVE-2014-2292" modified="2014-03-17" CVSS_version="2.0" CVSS_vector="(AV:L/AC:L/Au:N/C:C/I:C/A:C)" CVSS_score="7.2" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="3.9" CVSS_base_score="7.2">
    <desc>
      <descript source="cve">Unspecified vulnerability in the Linux Network Connect client in Juniper Junos Pulse Secure Access Service (aka SSL VPN) with IVE OS before 7.1r18, 7.3 before 7.3r10, 7.4 before 7.4r8, and 8.0 before 8.0r1 allows local users to gain privileges via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="https://kb.juniper.net/InfoCenter/index?page=content&amp;id=JSA10616" source="CONFIRM" adv="1">https://kb.juniper.net/InfoCenter/index?page=content&amp;id=JSA10616</ref>
    </refs>
    <vuln_soft>
      <prod vendor="juniper" name="ive_os">
        <vers num="7.1"/>
        <vers num="7.3"/>
        <vers num="7.4"/>
        <vers num="8.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2299" published="2014-03-11" name="CVE-2014-2299" modified="2014-04-19" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">Buffer overflow in the mpeg_read function in wiretap/mpeg.c in the MPEG parser in Wireshark 1.8.x before 1.8.13 and 1.10.x before 1.10.6 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a large record in MPEG data.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=f567435ac7140c96a5de56dbce3d5e7659af4d09" source="CONFIRM" patch="1">https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=f567435ac7140c96a5de56dbce3d5e7659af4d09</ref>
      <ref url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9843" source="CONFIRM">https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9843</ref>
      <ref url="http://www.wireshark.org/security/wnpa-sec-2014-04.html" source="CONFIRM" adv="1">http://www.wireshark.org/security/wnpa-sec-2014-04.html</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2871" source="DEBIAN">DSA-2871</ref>
      <ref url="http://secunia.com/advisories/57489" source="SECUNIA">57489</ref>
      <ref url="http://secunia.com/advisories/57480" source="SECUNIA">57480</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0342.html" source="REDHAT">RHSA-2014:0342</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0341.html" source="REDHAT">RHSA-2014:0341</ref>
      <ref url="http://lists.opensuse.org/opensuse-updates/2014-03/msg00047.html" source="SUSE">openSUSE-SU-2014:0383</ref>
      <ref url="http://lists.opensuse.org/opensuse-updates/2014-03/msg00046.html" source="SUSE">openSUSE-SU-2014:0382</ref>
    </refs>
    <vuln_soft>
      <prod vendor="wireshark" name="wireshark">
        <vers num="1.10.0"/>
        <vers num="1.10.1"/>
        <vers num="1.10.2"/>
        <vers num="1.10.3"/>
        <vers num="1.10.4"/>
        <vers num="1.10.5"/>
        <vers num="1.8.0"/>
        <vers num="1.8.1"/>
        <vers num="1.8.10"/>
        <vers num="1.8.11"/>
        <vers num="1.8.12"/>
        <vers num="1.8.2"/>
        <vers num="1.8.3"/>
        <vers num="1.8.4"/>
        <vers num="1.8.5"/>
        <vers num="1.8.6"/>
        <vers num="1.8.7"/>
        <vers num="1.8.8"/>
        <vers num="1.8.9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2309" published="2014-03-11" name="CVE-2014-2309" modified="2014-04-01" CVSS_version="2.0" CVSS_vector="(AV:A/AC:L/Au:N/C:N/I:N/A:C)" CVSS_score="6.1" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="6.5" CVSS_base_score="6.1">
    <desc>
      <descript source="cve">The ip6_route_add function in net/ipv6/route.c in the Linux kernel through 3.13.6 does not properly count the addition of routes, which allows remote attackers to cause a denial of service (memory consumption) via a flood of ICMPv6 Router Advertisement packets.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <local_network/>
    </range>
    <refs>
      <ref url="http://git.kernel.org/cgit/linux/kernel/git/davem/net.git/commit/?id=c88507fbad8055297c1d1e21e599f46960cbee39" source="CONFIRM" patch="1">http://git.kernel.org/cgit/linux/kernel/git/davem/net.git/commit/?id=c88507fbad8055297c1d1e21e599f46960cbee39</ref>
      <ref url="http://www.securitytracker.com/id/1029894" source="SECTRACK">1029894</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/03/08/1" source="MLIST">[oss-security] 20140307 Re: CVE Request: Linux kernel: IPv6: crash due to router advertisement flooding</ref>
      <ref url="http://secunia.com/advisories/57250" source="SECUNIA">57250</ref>
    </refs>
    <vuln_soft>
      <prod vendor="linux" name="linux_kernel">
        <vers num="3.0" edition="rc1"/>
        <vers num="3.0" edition="rc2"/>
        <vers num="3.0" edition="rc3"/>
        <vers num="3.0" edition="rc4"/>
        <vers num="3.0" edition="rc5"/>
        <vers num="3.0" edition="rc6"/>
        <vers num="3.0" edition="rc7"/>
        <vers num="3.0.1"/>
        <vers num="3.0.10"/>
        <vers num="3.0.11"/>
        <vers num="3.0.12"/>
        <vers num="3.0.13"/>
        <vers num="3.0.14"/>
        <vers num="3.0.15"/>
        <vers num="3.0.16"/>
        <vers num="3.0.17"/>
        <vers num="3.0.18"/>
        <vers num="3.0.19"/>
        <vers num="3.0.2"/>
        <vers num="3.0.20"/>
        <vers num="3.0.21"/>
        <vers num="3.0.22"/>
        <vers num="3.0.23"/>
        <vers num="3.0.24"/>
        <vers num="3.0.25"/>
        <vers num="3.0.26"/>
        <vers num="3.0.27"/>
        <vers num="3.0.28"/>
        <vers num="3.0.29"/>
        <vers num="3.0.3"/>
        <vers num="3.0.30"/>
        <vers num="3.0.31"/>
        <vers num="3.0.32"/>
        <vers num="3.0.33"/>
        <vers num="3.0.34"/>
        <vers num="3.0.35"/>
        <vers num="3.0.36"/>
        <vers num="3.0.37"/>
        <vers num="3.0.38"/>
        <vers num="3.0.39"/>
        <vers num="3.0.4"/>
        <vers num="3.0.40"/>
        <vers num="3.0.41"/>
        <vers num="3.0.42"/>
        <vers num="3.0.43"/>
        <vers num="3.0.44"/>
        <vers num="3.0.45"/>
        <vers num="3.0.46"/>
        <vers num="3.0.47"/>
        <vers num="3.0.48"/>
        <vers num="3.0.49"/>
        <vers num="3.0.5"/>
        <vers num="3.0.50"/>
        <vers num="3.0.51"/>
        <vers num="3.0.52"/>
        <vers num="3.0.53"/>
        <vers num="3.0.54"/>
        <vers num="3.0.55"/>
        <vers num="3.0.56"/>
        <vers num="3.0.57"/>
        <vers num="3.0.58"/>
        <vers num="3.0.59"/>
        <vers num="3.0.6"/>
        <vers num="3.0.60"/>
        <vers num="3.0.61"/>
        <vers num="3.0.62"/>
        <vers num="3.0.63"/>
        <vers num="3.0.64"/>
        <vers num="3.0.65"/>
        <vers num="3.0.66"/>
        <vers num="3.0.67"/>
        <vers num="3.0.68"/>
        <vers num="3.0.7"/>
        <vers num="3.0.8"/>
        <vers num="3.0.9"/>
        <vers num="3.1" edition="rc1"/>
        <vers num="3.1" edition="rc2"/>
        <vers num="3.1" edition="rc3"/>
        <vers num="3.1" edition="rc4"/>
        <vers num="3.1.1"/>
        <vers num="3.1.10"/>
        <vers num="3.1.2"/>
        <vers num="3.1.3"/>
        <vers num="3.1.4"/>
        <vers num="3.1.5"/>
        <vers num="3.1.6"/>
        <vers num="3.1.7"/>
        <vers num="3.1.8"/>
        <vers num="3.1.9"/>
        <vers num="3.10"/>
        <vers num="3.10.1"/>
        <vers num="3.10.10"/>
        <vers num="3.10.11"/>
        <vers num="3.10.12"/>
        <vers num="3.10.13"/>
        <vers num="3.10.14"/>
        <vers num="3.10.15"/>
        <vers num="3.10.16"/>
        <vers num="3.10.17"/>
        <vers num="3.10.18"/>
        <vers num="3.10.19"/>
        <vers num="3.10.2"/>
        <vers num="3.10.20"/>
        <vers num="3.10.21"/>
        <vers num="3.10.22"/>
        <vers num="3.10.23"/>
        <vers num="3.10.24"/>
        <vers num="3.10.25"/>
        <vers num="3.10.26"/>
        <vers num="3.10.27"/>
        <vers num="3.10.28"/>
        <vers num="3.10.29"/>
        <vers num="3.10.3"/>
        <vers num="3.10.4"/>
        <vers num="3.10.5"/>
        <vers num="3.10.6"/>
        <vers num="3.10.7"/>
        <vers num="3.10.8"/>
        <vers num="3.10.9"/>
        <vers num="3.11"/>
        <vers num="3.11.1"/>
        <vers num="3.11.10"/>
        <vers num="3.11.2"/>
        <vers num="3.11.3"/>
        <vers num="3.11.4"/>
        <vers num="3.11.5"/>
        <vers num="3.11.6"/>
        <vers num="3.11.7"/>
        <vers num="3.11.8"/>
        <vers num="3.11.9"/>
        <vers num="3.12"/>
        <vers num="3.12.1"/>
        <vers num="3.12.10"/>
        <vers num="3.12.11"/>
        <vers num="3.12.12"/>
        <vers num="3.12.13"/>
        <vers num="3.12.2"/>
        <vers num="3.12.3"/>
        <vers num="3.12.4"/>
        <vers num="3.12.5"/>
        <vers num="3.12.6"/>
        <vers num="3.12.7"/>
        <vers num="3.12.8"/>
        <vers num="3.12.9"/>
        <vers num="3.13"/>
        <vers num="3.13.1"/>
        <vers num="3.13.2"/>
        <vers num="3.13.3"/>
        <vers num="3.13.4"/>
        <vers num="3.13.5"/>
        <vers prev="1" num="3.13.6"/>
        <vers num="3.2" edition="rc2"/>
        <vers num="3.2" edition="rc3"/>
        <vers num="3.2" edition="rc4"/>
        <vers num="3.2" edition="rc5"/>
        <vers num="3.2" edition="rc6"/>
        <vers num="3.2" edition="rc7"/>
        <vers num="3.2.1"/>
        <vers num="3.2.10"/>
        <vers num="3.2.11"/>
        <vers num="3.2.12"/>
        <vers num="3.2.13"/>
        <vers num="3.2.14"/>
        <vers num="3.2.15"/>
        <vers num="3.2.16"/>
        <vers num="3.2.17"/>
        <vers num="3.2.18"/>
        <vers num="3.2.19"/>
        <vers num="3.2.2"/>
        <vers num="3.2.20"/>
        <vers num="3.2.21"/>
        <vers num="3.2.22"/>
        <vers num="3.2.23"/>
        <vers num="3.2.24"/>
        <vers num="3.2.25"/>
        <vers num="3.2.26"/>
        <vers num="3.2.27"/>
        <vers num="3.2.28"/>
        <vers num="3.2.29"/>
        <vers num="3.2.3"/>
        <vers num="3.2.30"/>
        <vers num="3.2.4"/>
        <vers num="3.2.5"/>
        <vers num="3.2.6"/>
        <vers num="3.2.7"/>
        <vers num="3.2.8"/>
        <vers num="3.2.9"/>
        <vers num="3.3" edition="rc1"/>
        <vers num="3.3" edition="rc2"/>
        <vers num="3.3" edition="rc3"/>
        <vers num="3.3" edition="rc4"/>
        <vers num="3.3" edition="rc5"/>
        <vers num="3.3" edition="rc6"/>
        <vers num="3.3" edition="rc7"/>
        <vers num="3.3.1"/>
        <vers num="3.3.2"/>
        <vers num="3.3.3"/>
        <vers num="3.3.4"/>
        <vers num="3.3.5"/>
        <vers num="3.3.6"/>
        <vers num="3.3.7"/>
        <vers num="3.3.8"/>
        <vers num="3.4" edition="rc1"/>
        <vers num="3.4" edition="rc2"/>
        <vers num="3.4" edition="rc3"/>
        <vers num="3.4" edition="rc4"/>
        <vers num="3.4" edition="rc5"/>
        <vers num="3.4" edition="rc6"/>
        <vers num="3.4" edition="rc7"/>
        <vers num="3.4.1"/>
        <vers num="3.4.10"/>
        <vers num="3.4.11"/>
        <vers num="3.4.12"/>
        <vers num="3.4.13"/>
        <vers num="3.4.14"/>
        <vers num="3.4.15"/>
        <vers num="3.4.16"/>
        <vers num="3.4.17"/>
        <vers num="3.4.18"/>
        <vers num="3.4.19"/>
        <vers num="3.4.2"/>
        <vers num="3.4.20"/>
        <vers num="3.4.21"/>
        <vers num="3.4.22"/>
        <vers num="3.4.23"/>
        <vers num="3.4.24"/>
        <vers num="3.4.25"/>
        <vers num="3.4.26"/>
        <vers num="3.4.27"/>
        <vers num="3.4.28"/>
        <vers num="3.4.29"/>
        <vers num="3.4.3"/>
        <vers num="3.4.30"/>
        <vers num="3.4.31"/>
        <vers num="3.4.32"/>
        <vers num="3.4.33"/>
        <vers num="3.4.34"/>
        <vers num="3.4.35"/>
        <vers num="3.4.36"/>
        <vers num="3.4.37"/>
        <vers num="3.4.38"/>
        <vers num="3.4.39"/>
        <vers num="3.4.4"/>
        <vers num="3.4.40"/>
        <vers num="3.4.41"/>
        <vers num="3.4.42"/>
        <vers num="3.4.43"/>
        <vers num="3.4.44"/>
        <vers num="3.4.45"/>
        <vers num="3.4.46"/>
        <vers num="3.4.47"/>
        <vers num="3.4.48"/>
        <vers num="3.4.49"/>
        <vers num="3.4.5"/>
        <vers num="3.4.50"/>
        <vers num="3.4.51"/>
        <vers num="3.4.52"/>
        <vers num="3.4.53"/>
        <vers num="3.4.54"/>
        <vers num="3.4.55"/>
        <vers num="3.4.56"/>
        <vers num="3.4.57"/>
        <vers num="3.4.58"/>
        <vers num="3.4.59"/>
        <vers num="3.4.6"/>
        <vers num="3.4.60"/>
        <vers num="3.4.61"/>
        <vers num="3.4.62"/>
        <vers num="3.4.63"/>
        <vers num="3.4.64"/>
        <vers num="3.4.65"/>
        <vers num="3.4.66"/>
        <vers num="3.4.67"/>
        <vers num="3.4.68"/>
        <vers num="3.4.69"/>
        <vers num="3.4.7"/>
        <vers num="3.4.70"/>
        <vers num="3.4.71"/>
        <vers num="3.4.72"/>
        <vers num="3.4.73"/>
        <vers num="3.4.74"/>
        <vers num="3.4.75"/>
        <vers num="3.4.76"/>
        <vers num="3.4.77"/>
        <vers num="3.4.78"/>
        <vers num="3.4.79"/>
        <vers num="3.4.8"/>
        <vers num="3.4.9"/>
        <vers num="3.5.1"/>
        <vers num="3.5.2"/>
        <vers num="3.5.3"/>
        <vers num="3.5.4"/>
        <vers num="3.5.5"/>
        <vers num="3.5.6"/>
        <vers num="3.5.7"/>
        <vers num="3.6"/>
        <vers num="3.6.1"/>
        <vers num="3.6.10"/>
        <vers num="3.6.11"/>
        <vers num="3.6.2"/>
        <vers num="3.6.3"/>
        <vers num="3.6.4"/>
        <vers num="3.6.5"/>
        <vers num="3.6.6"/>
        <vers num="3.6.7"/>
        <vers num="3.6.8"/>
        <vers num="3.6.9"/>
        <vers num="3.7"/>
        <vers num="3.7.1"/>
        <vers num="3.7.10"/>
        <vers num="3.7.2"/>
        <vers num="3.7.3"/>
        <vers num="3.7.4"/>
        <vers num="3.7.5"/>
        <vers num="3.7.6"/>
        <vers num="3.7.7"/>
        <vers num="3.7.8"/>
        <vers num="3.7.9"/>
        <vers num="3.8.0"/>
        <vers num="3.8.1"/>
        <vers num="3.8.10"/>
        <vers num="3.8.11"/>
        <vers num="3.8.12"/>
        <vers num="3.8.13"/>
        <vers num="3.8.2"/>
        <vers num="3.8.3"/>
        <vers num="3.8.4"/>
        <vers num="3.8.5"/>
        <vers num="3.8.6"/>
        <vers num="3.8.7"/>
        <vers num="3.8.8"/>
        <vers num="3.8.9"/>
        <vers num="3.9" edition="rc1"/>
        <vers num="3.9" edition="rc2"/>
        <vers num="3.9" edition="rc3"/>
        <vers num="3.9" edition="rc4"/>
        <vers num="3.9" edition="rc5"/>
        <vers num="3.9" edition="rc6"/>
        <vers num="3.9" edition="rc7"/>
        <vers num="3.9.0"/>
        <vers num="3.9.1"/>
        <vers num="3.9.10"/>
        <vers num="3.9.11"/>
        <vers num="3.9.2"/>
        <vers num="3.9.3"/>
        <vers num="3.9.4"/>
        <vers num="3.9.5"/>
        <vers num="3.9.6"/>
        <vers num="3.9.7"/>
        <vers num="3.9.8"/>
        <vers num="3.9.9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2310" published="2014-04-17" name="CVE-2014-2310" modified="2014-04-18" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:P)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">The AgentX subagent in Net-SNMP before 5.4.4 allows remote attackers to cause a denial of service (hang) by sending a multi-object request with an Object ID (OID) containing more subids than previous requests, a different vulnerability than CVE-2012-6151.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=684388" source="CONFIRM">https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=684388</ref>
      <ref url="http://ubuntu.com/usn/usn-2166-1" source="UBUNTU">USN-2166-1</ref>
      <ref url="http://sourceforge.net/p/net-snmp/patches/1113/" source="CONFIRM">http://sourceforge.net/p/net-snmp/patches/1113/</ref>
      <ref url="http://sourceforge.net/p/net-snmp/code/ci/eb816330a1887798d844d2fd5dc6482002123cbd/" source="CONFIRM">http://sourceforge.net/p/net-snmp/code/ci/eb816330a1887798d844d2fd5dc6482002123cbd/</ref>
      <ref url="http://secunia.com/advisories/57870" source="SECUNIA" adv="1">57870</ref>
      <ref url="http://seclists.org/oss-sec/2014/q1/527" source="MLIST">[oss-security] 20140307 Re: CVE request: net-snmp agentx incorrect handling of multi-object requests DoS</ref>
      <ref url="http://seclists.org/oss-sec/2014/q1/513" source="MLIST">[oss-security] 20140306 CVE request: net-snmp agentx incorrect handling of multi-object requests DoS</ref>
    </refs>
    <vuln_soft>
      <prod vendor="net-snmp" name="net-snmp">
        <vers prev="1" num="5.4"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2311" published="2014-03-11" name="CVE-2014-2311" modified="2014-03-12" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">SQL injection vulnerability in modx.class.php in MODX Revolution 2.0.0 before 2.2.13 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.openwall.com/lists/oss-security/2014/03/09/3" source="MLIST">[oss-security] 20140308 Re: CVE request: SQL injection in MODX Revolution before 2.2.13</ref>
      <ref url="http://modx.com/blog/2014/03/07/revolution-2.2.13/" source="CONFIRM" adv="1">http://modx.com/blog/2014/03/07/revolution-2.2.13/</ref>
      <ref url="http://forums.modx.com/thread/89486/modx-revolution-2-x-sql-injection" source="CONFIRM">http://forums.modx.com/thread/89486/modx-revolution-2-x-sql-injection</ref>
    </refs>
    <vuln_soft>
      <prod vendor="modx" name="modx_revolution">
        <vers num="2.0.0"/>
        <vers num="2.0.1"/>
        <vers num="2.0.2" edition="pl1"/>
        <vers num="2.0.3"/>
        <vers num="2.0.4"/>
        <vers num="2.0.5"/>
        <vers num="2.0.6"/>
        <vers num="2.0.7"/>
        <vers num="2.0.8"/>
        <vers num="2.1.0"/>
        <vers num="2.1.1"/>
        <vers num="2.1.2"/>
        <vers num="2.1.3"/>
        <vers num="2.1.4"/>
        <vers num="2.1.5"/>
        <vers num="2.2.0"/>
        <vers num="2.2.1"/>
        <vers num="2.2.10"/>
        <vers num="2.2.11"/>
        <vers num="2.2.12"/>
        <vers num="2.2.2"/>
        <vers num="2.2.3"/>
        <vers num="2.2.4"/>
        <vers num="2.2.5"/>
        <vers num="2.2.6"/>
        <vers num="2.2.7"/>
        <vers num="2.2.8"/>
        <vers num="2.2.9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2313" published="2014-03-09" name="CVE-2014-2313" modified="2014-03-10" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Directory traversal vulnerability in the Importers plugin in Atlassian JIRA before 6.0.5 allows remote attackers to create arbitrary files via unspecified vectors.</descript>
    </desc>
    <sols>
      <sol source="nvd">Per: https://confluence.atlassian.com/display/JIRA/JIRA+Security+Advisory+2014-02-26

"Issue 2: Path traversal in JIRA Importers plugin (Windows only)"</sol>
    </sols>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://confluence.atlassian.com/display/JIRA/JIRA+Security+Advisory+2014-02-26" source="CONFIRM" adv="1">https://confluence.atlassian.com/display/JIRA/JIRA+Security+Advisory+2014-02-26</ref>
    </refs>
    <vuln_soft>
      <prod vendor="atlassian" name="jira">
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers num="6.0.2"/>
        <vers num="6.0.3"/>
        <vers prev="1" num="6.0.4"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2314" published="2014-03-09" name="CVE-2014-2314" modified="2014-03-10" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Directory traversal vulnerability in the Issue Collector plugin in Atlassian JIRA before 6.0.4 allows remote attackers to create arbitrary files via unspecified vectors.</descript>
    </desc>
    <sols>
      <sol source="nvd">Per: https://confluence.atlassian.com/display/JIRA/JIRA+Security+Advisory+2014-02-26

"Issue 1: Path traversal in JIRA Issue Collector plugin (Windows only)"</sol>
    </sols>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://confluence.atlassian.com/display/JIRA/JIRA+Security+Advisory+2014-02-26" source="CONFIRM" adv="1">https://confluence.atlassian.com/display/JIRA/JIRA+Security+Advisory+2014-02-26</ref>
    </refs>
    <vuln_soft>
      <prod vendor="atlassian" name="jira">
        <vers num="6.0"/>
        <vers num="6.0.1"/>
        <vers num="6.0.2"/>
        <vers prev="1" num="6.0.3"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2315" published="2014-03-09" name="CVE-2014-2315" modified="2014-03-10" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Multiple cross-site scripting (XSS) vulnerabilities in the Thank You Counter Button plugin 1.8.7 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) thanks_caption, (2) thanks_caption_style, or (3) thanks_style parameter to wp-admin/options.php.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/91474" source="XF">thanks-you-wordpress-xss(91474)</ref>
      <ref url="http://packetstormsecurity.com/files/125397" source="MISC">http://packetstormsecurity.com/files/125397</ref>
    </refs>
    <vuln_soft>
      <prod vendor="shinephp" name="thank_you_counter_button">
        <vers num="1.8.7" edition=":~~~wordpress~~"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2316" published="2014-03-09" name="CVE-2014-2316" modified="2014-03-10" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">SQL injection vulnerability in se_search_default in the Search Everything plugin before 7.0.3 for WordPress allows remote attackers to execute arbitrary SQL commands via the s parameter to index.php. NOTE: some of these details are obtained from third party information.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://wordpress.org/plugins/search-everything/changelog/" source="CONFIRM">http://wordpress.org/plugins/search-everything/changelog/</ref>
      <ref url="http://secunia.com/advisories/56820" source="SECUNIA" adv="1">56820</ref>
    </refs>
    <vuln_soft>
      <prod vendor="zemanta" name="search_everything">
        <vers num="7.0.2" edition=":~~~wordpress~~"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2317" published="2014-03-09" name="CVE-2014-2317" modified="2014-03-10" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:P)" CVSS_score="6.8" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.6" CVSS_base_score="6.8">
    <desc>
      <descript source="cve">SQL injection vulnerability in ajax_udf.php in OpenDocMan before 1.2.7.2 allows remote attackers to execute arbitrary SQL commands via the table parameter.  NOTE: some of these details are obtained from third party information.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.opendocman.com/opendocman-v1-2-7-2-released" source="MISC" patch="1" adv="1">http://www.opendocman.com/opendocman-v1-2-7-2-released</ref>
      <ref url="http://www.securityfocus.com/bid/65775" source="BID">65775</ref>
      <ref url="http://secunia.com/advisories/56189" source="SECUNIA" adv="1">56189</ref>
    </refs>
    <vuln_soft>
      <prod vendor="opendocman" name="opendocman">
        <vers num="1.2.6.2" edition="-"/>
        <vers num="1.2.6.2" edition="a"/>
        <vers num="1.2.6.2" edition="b"/>
        <vers num="1.2.6.3" edition="-"/>
        <vers num="1.2.6.3" edition="a"/>
        <vers num="1.2.6.5"/>
        <vers num="1.2.6.6"/>
        <vers num="1.2.6.7" edition="-"/>
        <vers num="1.2.6.7" edition="beta"/>
        <vers num="1.2.6.8"/>
        <vers num="1.2.7"/>
        <vers prev="1" num="1.2.7.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2318" published="2014-03-11" name="CVE-2014-2318" modified="2014-03-11" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">SQL injection vulnerability in ATCOM Netvolution 3 allows remote attackers to execute arbitrary SQL commands via the m parameter.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/91543" source="XF">netvolution-m-sql-injection(91543)</ref>
      <ref url="http://www.securityfocus.com/bid/65942" source="BID">65942</ref>
      <ref url="http://packetstormsecurity.com/files/125507" source="MISC">http://packetstormsecurity.com/files/125507</ref>
    </refs>
    <vuln_soft>
      <prod vendor="atcom" name="netvolution">
        <vers num="3.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2319" published="2014-03-14" name="CVE-2014-2319" modified="2014-03-14" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:N/A:N)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">The Encrypt Files feature in ConeXware PowerArchiver before 14.02.05 uses legacy ZIP encryption even if the AES 256-bit selection is chosen, which makes it easier for context-dependent attackers to obtain sensitive information via a known-plaintext attack.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.powerarchiver.com/2014/03/12/powerarchiver-2013-14-02-05-released/" source="CONFIRM" adv="1">http://www.powerarchiver.com/2014/03/12/powerarchiver-2013-14-02-05-released/</ref>
      <ref url="http://int21.de/cve/CVE-2014-2319-powerarchiver.html" source="MISC">http://int21.de/cve/CVE-2014-2319-powerarchiver.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="powerarchiver" name="powerarchiver">
        <vers num="14.00"/>
        <vers num="14.01"/>
        <vers num="14.02"/>
        <vers prev="1" num="14.02.03"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2321" published="2014-03-11" name="CVE-2014-2321" modified="2014-03-11" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:C/I:C/A:C)" CVSS_score="10.0" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="10.0" CVSS_base_score="10.0">
    <desc>
      <descript source="cve">web_shell_cmd.gch on ZTE F460 and F660 cable modems allows remote attackers to obtain administrative access via sendcmd requests, as demonstrated by using "set TelnetCfg" commands to enable a TELNET service with specified credentials.</descript>
    </desc>
    <sols>
      <sol source="nvd">Per: http://www.kb.cert.org/vuls/id/600724

" It has been reported that the web_shell_cmd.gch script is sometimes accessible from the WAN interface making exploitation of this backdoor from the Internet possible in certain cases. "</sol>
    </sols>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.kb.cert.org/vuls/id/600724" source="CERT-VN">VU#600724</ref>
      <ref url="https://community.rapid7.com/community/infosec/blog/2014/03/03/disclosure-r7-2013-18-zte-f460-and-zte-f660-webshellcmdgch-backdoor" source="MISC">https://community.rapid7.com/community/infosec/blog/2014/03/03/disclosure-r7-2013-18-zte-f460-and-zte-f660-webshellcmdgch-backdoor</ref>
      <ref url="http://www.myxzy.com/post-411.html" source="MISC">http://www.myxzy.com/post-411.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="zte" name="f460">
        <vers num="-"/>
      </prod>
      <prod vendor="zte" name="f660">
        <vers num="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" seq="2014-2322" published="2014-05-02" name="CVE-2014-2322" modified="2014-05-02">
    <desc>
      <descript source="cve">lib/string_utf_support.rb in the Arabic Prawn 0.0.1 gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) downloaded_file or (2) url variable.</descript>
    </desc>
    <refs>
      <ref url="http://www.vapid.dhs.org/advisories/arabic-ruby-gem.html" source="MISC">http://www.vapid.dhs.org/advisories/arabic-ruby-gem.html</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/03/12/6" source="MLIST">[oss-security] 20140312 Re: Remote Command Injection in Arabic Prawn 0.0.1 Ruby Gem</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/03/10/8" source="MLIST">[oss-security] 20140310 Remote Command Injection in Arabic Prawn 0.0.1 Ruby Gem</ref>
    </refs>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2323" published="2014-03-14" name="CVE-2014-2323" modified="2014-04-19" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">SQL injection vulnerability in mod_mysql_vhost.c in lighttpd before 1.4.35 allows remote attackers to execute arbitrary SQL commands via the host name, related to request_check_hostname.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.lighttpd.net/2014/3/12/1.4.35/" source="CONFIRM" patch="1" adv="1">http://www.lighttpd.net/2014/3/12/1.4.35/</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2877" source="DEBIAN">DSA-2877</ref>
      <ref url="http://secunia.com/advisories/57514" source="SECUNIA">57514</ref>
      <ref url="http://secunia.com/advisories/57404" source="SECUNIA">57404</ref>
      <ref url="http://seclists.org/oss-sec/2014/q1/564" source="MLIST">[oss-security] 20140312 Re: lighttpd 1.4.34 SQL injection and path traversal CVE request</ref>
      <ref url="http://seclists.org/oss-sec/2014/q1/561" source="MLIST">[oss-security] 20140312 lighttpd 1.4.34 SQL injection and path traversal CVE request</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00006.html" source="SUSE">openSUSE-SU-2014:0496</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00002.html" source="SUSE">SUSE-SU-2014:0474</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00023.html" source="SUSE">openSUSE-SU-2014:0449</ref>
      <ref url="http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2014_01.txt" source="CONFIRM" adv="1">http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2014_01.txt</ref>
    </refs>
    <vuln_soft>
      <prod vendor="lighttpd" name="lighttpd">
        <vers num="1.3.16"/>
        <vers num="1.4.10"/>
        <vers num="1.4.11"/>
        <vers num="1.4.12"/>
        <vers num="1.4.13"/>
        <vers num="1.4.14"/>
        <vers num="1.4.15"/>
        <vers num="1.4.16"/>
        <vers num="1.4.17"/>
        <vers num="1.4.18"/>
        <vers num="1.4.19"/>
        <vers num="1.4.20"/>
        <vers num="1.4.21"/>
        <vers num="1.4.22"/>
        <vers num="1.4.23"/>
        <vers num="1.4.24"/>
        <vers num="1.4.25"/>
        <vers num="1.4.26"/>
        <vers num="1.4.27"/>
        <vers num="1.4.28"/>
        <vers num="1.4.29"/>
        <vers num="1.4.3"/>
        <vers num="1.4.30"/>
        <vers num="1.4.31"/>
        <vers num="1.4.32"/>
        <vers num="1.4.33"/>
        <vers prev="1" num="1.4.34"/>
        <vers num="1.4.4"/>
        <vers num="1.4.5"/>
        <vers num="1.4.6"/>
        <vers num="1.4.7"/>
        <vers num="1.4.8"/>
        <vers num="1.4.9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2324" published="2014-03-14" name="CVE-2014-2324" modified="2014-04-19" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:N/A:N)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">Multiple directory traversal vulnerabilities in (1) mod_evhost and (2) mod_simple_vhost in lighttpd before 1.4.35 allow remote attackers to read arbitrary files via a .. (dot dot) in the host name, related to request_check_hostname.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.lighttpd.net/2014/3/12/1.4.35/" source="CONFIRM" patch="1" adv="1">http://www.lighttpd.net/2014/3/12/1.4.35/</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2877" source="DEBIAN">DSA-2877</ref>
      <ref url="http://secunia.com/advisories/57514" source="SECUNIA">57514</ref>
      <ref url="http://secunia.com/advisories/57404" source="SECUNIA">57404</ref>
      <ref url="http://seclists.org/oss-sec/2014/q1/564" source="MLIST">[oss-security] 20140312 Re: lighttpd 1.4.34 SQL injection and path traversal CVE request</ref>
      <ref url="http://seclists.org/oss-sec/2014/q1/561" source="MLIST">[oss-security] 20140312 lighttpd 1.4.34 SQL injection and path traversal CVE request</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00006.html" source="SUSE">openSUSE-SU-2014:0496</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00002.html" source="SUSE">SUSE-SU-2014:0474</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00023.html" source="SUSE">openSUSE-SU-2014:0449</ref>
      <ref url="http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2014_01.txt" source="CONFIRM" adv="1">http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2014_01.txt</ref>
    </refs>
    <vuln_soft>
      <prod vendor="lighttpd" name="lighttpd">
        <vers num="1.3.16"/>
        <vers num="1.4.10"/>
        <vers num="1.4.11"/>
        <vers num="1.4.12"/>
        <vers num="1.4.13"/>
        <vers num="1.4.14"/>
        <vers num="1.4.15"/>
        <vers num="1.4.16"/>
        <vers num="1.4.17"/>
        <vers num="1.4.18"/>
        <vers num="1.4.19"/>
        <vers num="1.4.20"/>
        <vers num="1.4.21"/>
        <vers num="1.4.22"/>
        <vers num="1.4.23"/>
        <vers num="1.4.24"/>
        <vers num="1.4.25"/>
        <vers num="1.4.26"/>
        <vers num="1.4.27"/>
        <vers num="1.4.28"/>
        <vers num="1.4.29"/>
        <vers num="1.4.3"/>
        <vers num="1.4.30"/>
        <vers num="1.4.31"/>
        <vers num="1.4.32"/>
        <vers num="1.4.33"/>
        <vers prev="1" num="1.4.34"/>
        <vers num="1.4.4"/>
        <vers num="1.4.5"/>
        <vers num="1.4.6"/>
        <vers num="1.4.7"/>
        <vers num="1.4.8"/>
        <vers num="1.4.9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2325" published="2014-03-14" name="CVE-2014-2325" modified="2014-03-25" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Multiple cross-site scripting (XSS) vulnerabilities in Proxmox Mail Gateway before 3.1-5829 allow remote attackers to inject arbitrary web script or HTML via the (1) state parameter to objects/who/index.htm or (2) User email address to quarantine/spam/manage.htm.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://proxmox.com/news/archive/view/listid-1-proxmox-newsletter/mailid-48-proxmox-newsletter-march-2014-proxmox-ve-3-2-released/tmpl-component" source="CONFIRM" patch="1" adv="1">http://proxmox.com/news/archive/view/listid-1-proxmox-newsletter/mailid-48-proxmox-newsletter-march-2014-proxmox-ve-3-2-released/tmpl-component</ref>
      <ref url="http://www.securityfocus.com/bid/66169" source="BID">66169</ref>
      <ref url="http://seclists.org/fulldisclosure/2014/Mar/110" source="FULLDISC">20140312 Multiplus XSS in Proxmox Mail Gateway 3.1 (CVE-2014-2325)</ref>
    </refs>
    <vuln_soft>
      <prod vendor="proxmox" name="mail_gateway">
        <vers num="3.0"/>
        <vers num="3.1"/>
        <vers num="3.1-5670"/>
        <vers num="3.1-5673"/>
        <vers prev="1" num="3.1-5741"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2326" published="2014-03-27" name="CVE-2014-2326" modified="2014-03-27" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in Cacti 0.8.7g allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://www.securityfocus.com/bid/66390" source="BID">66390</ref>
      <ref url="http://packetstormsecurity.com/files/125849/Deutsche-Telekom-CERT-Advisory-DTC-A-20140324-001.html" source="MISC">http://packetstormsecurity.com/files/125849/Deutsche-Telekom-CERT-Advisory-DTC-A-20140324-001.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cacti" name="cacti">
        <vers num="0.8.7g"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2327" published="2014-04-23" name="CVE-2014-2327" modified="2014-04-24" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:P)" CVSS_score="6.8" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.6" CVSS_base_score="6.8">
    <desc>
      <descript source="cve">Cross-site request forgery (CSRF) vulnerability in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to hijack the authentication of users for unspecified commands, as demonstrated by requests that (1) modify binary files, (2) modify configurations, or (3) add arbitrary users.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=742768" source="CONFIRM">https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=742768</ref>
      <ref url="http://www.securityfocus.com/bid/66392" source="BID">66392</ref>
      <ref url="http://www.securityfocus.com/archive/1/531588" source="BUGTRAQ">20140324 Deutsche Telekom CERT Advisory [DTC-A-20140324-001] vulnerabilities in cacti</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cacti" name="cacti">
        <vers num="0.8.7"/>
        <vers num="0.8.7a"/>
        <vers num="0.8.7b"/>
        <vers num="0.8.7c"/>
        <vers num="0.8.7d"/>
        <vers num="0.8.7e"/>
        <vers num="0.8.7f"/>
        <vers prev="1" num="0.8.7g"/>
        <vers num="0.8.8"/>
        <vers num="0.8.8a"/>
        <vers prev="1" num="0.8.8b"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2328" published="2014-04-23" name="CVE-2014-2328" modified="2014-04-24" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:P/I:P/A:P)" CVSS_score="6.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.0" CVSS_base_score="6.5">
    <desc>
      <descript source="cve">lib/graph_export.php in Cacti 0.8.7g, 0.8.8b, and earlier allows remote authenticated users to execute arbitrary commands via shell metacharacters in unspecified vectors.</descript>
      <descript source="nvd">Per: https://cwe.mitre.org/data/definitions/77.html

"CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')"</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://svn.cacti.net/viewvc?view=rev&amp;revision=7442" source="CONFIRM" patch="1">http://svn.cacti.net/viewvc?view=rev&amp;revision=7442</ref>
      <ref url="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=742768" source="CONFIRM">https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=742768</ref>
      <ref url="http://www.securityfocus.com/bid/66387" source="BID">66387</ref>
      <ref url="http://www.securityfocus.com/archive/1/531588" source="BUGTRAQ">20140324 Deutsche Telekom CERT Advisory [DTC-A-20140324-001] vulnerabilities in cacti</ref>
      <ref url="http://lists.fedoraproject.org/pipermail/package-announce/2014-April/131842.html" source="FEDORA">FEDORA-2014-4892</ref>
      <ref url="http://lists.fedoraproject.org/pipermail/package-announce/2014-April/131821.html" source="FEDORA">FEDORA-2014-4928</ref>
      <ref url="http://bugs.cacti.net/view.php?id=2433" source="CONFIRM">http://bugs.cacti.net/view.php?id=2433</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cacti" name="cacti">
        <vers num="0.8.7"/>
        <vers num="0.8.7a"/>
        <vers num="0.8.7b"/>
        <vers num="0.8.7c"/>
        <vers num="0.8.7d"/>
        <vers num="0.8.7e"/>
        <vers num="0.8.7f"/>
        <vers prev="1" num="0.8.7g"/>
        <vers num="0.8.8"/>
        <vers num="0.8.8a"/>
        <vers prev="1" num="0.8.8b"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-2333" published="2014-04-11" name="CVE-2014-2333" modified="2014-04-14" CVSS_version="2.0" CVSS_vector="(AV:N/AC:H/Au:N/C:N/I:P/A:N)" CVSS_score="2.6" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="4.9" CVSS_base_score="2.6">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in the Lazyest Gallery plugin before 1.1.21 for WordPress allows remote attackers to inject arbitrary web script or HTML via an EXIF tag.  NOTE: some of these details are obtained from third party information.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://www.securityfocus.com/bid/66756" source="BID">66756</ref>
      <ref url="http://wordpress.org/plugins/lazyest-gallery/changelog" source="CONFIRM">http://wordpress.org/plugins/lazyest-gallery/changelog</ref>
      <ref url="http://secunia.com/advisories/57746" source="SECUNIA" adv="1">57746</ref>
    </refs>
    <vuln_soft>
      <prod vendor="marcel_brinkkemper" name="lazyest-gallery">
        <vers num="1.1" edition=":~~~wordpress~~"/>
        <vers num="1.1.1" edition=":~~~wordpress~~"/>
        <vers num="1.1.1.1" edition=":~~~wordpress~~"/>
        <vers num="1.1.10" edition=":~~~wordpress~~"/>
        <vers num="1.1.10.1" edition=":~~~wordpress~~"/>
        <vers num="1.1.11" edition=":~~~wordpress~~"/>
        <vers num="1.1.12" edition=":~~~wordpress~~"/>
        <vers num="1.1.13" edition=":~~~wordpress~~"/>
        <vers num="1.1.14" edition=":~~~wordpress~~"/>
        <vers num="1.1.15" edition=":~~~wordpress~~"/>
        <vers num="1.1.16" edition=":~~~wordpress~~"/>
        <vers num="1.1.17.1" edition=":~~~wordpress~~"/>
        <vers num="1.1.17.2" edition=":~~~wordpress~~"/>
        <vers num="1.1.17.4" edition=":~~~wordpress~~"/>
        <vers num="1.1.18" edition=":~~~wordpress~~"/>
        <vers num="1.1.19" edition=":~~~wordpress~~"/>
        <vers num="1.1.19.1" edition=":~~~wordpress~~"/>
        <vers num="1.1.2.1" edition=":~~~wordpress~~"/>
        <vers prev="1" num="1.1.20" edition=":~~~wordpress~~"/>
        <vers num="1.1.3" edition=":~~~wordpress~~"/>
        <vers num="1.1.3.1" edition=":~~~wordpress~~"/>
        <vers num="1.1.3.2" edition=":~~~wordpress~~"/>
        <vers num="1.1.3.3" edition=":~~~wordpress~~"/>
        <vers num="1.1.4" edition=":~~~wordpress~~"/>
        <vers num="1.1.5" edition=":~~~wordpress~~"/>
        <vers num="1.1.6" edition=":~~~wordpress~~"/>
        <vers num="1.1.7" edition=":~~~wordpress~~"/>
        <vers num="1.1.7.1" edition=":~~~wordpress~~"/>
        <vers num="1.1.8" edition=":~~~wordpress~~"/>
        <vers num="1.1.8.1" edition=":~~~wordpress~~"/>
        <vers num="1.1.9" edition=":~~~wordpress~~"/>
        <vers num="1.1.9.1" edition=":~~~wordpress~~"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2338" published="2014-04-16" name="CVE-2014-2338" modified="2014-04-24" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:N)" CVSS_score="6.4" CVSS_impact_subscore="4.9" CVSS_exploit_subscore="10.0" CVSS_base_score="6.4">
    <desc>
      <descript source="cve">IKEv2 in strongSwan 4.0.7 before 5.1.3 allows remote attackers to bypass authentication by rekeying an IKE_SA during (1) initiation or (2) re-authentication, which triggers the IKE_SA state to be set to established.</descript>
    </desc>
    <loss_types>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.strongswan.org/blog/2014/04/14/strongswan-authentication-bypass-vulnerability-%28cve-2014-2338%29.html" source="CONFIRM" adv="1">http://www.strongswan.org/blog/2014/04/14/strongswan-authentication-bypass-vulnerability-%28cve-2014-2338%29.html</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2903" source="DEBIAN">DSA-2903</ref>
      <ref url="http://secunia.com/advisories/57823" source="SECUNIA">57823</ref>
      <ref url="http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00010.html" source="SUSE">SUSE-SU-2014:0529</ref>
    </refs>
    <vuln_soft>
      <prod vendor="strongswan" name="strongswan">
        <vers num="4.0.7"/>
        <vers num="4.1.0"/>
        <vers num="4.1.1"/>
        <vers num="4.1.10"/>
        <vers num="4.1.11"/>
        <vers num="4.1.2"/>
        <vers num="4.1.3"/>
        <vers num="4.1.4"/>
        <vers num="4.1.5"/>
        <vers num="4.1.6"/>
        <vers num="4.1.7"/>
        <vers num="4.1.8"/>
        <vers num="4.1.9"/>
        <vers num="4.2.0"/>
        <vers num="4.2.1"/>
        <vers num="4.2.10"/>
        <vers num="4.2.11"/>
        <vers num="4.2.12"/>
        <vers num="4.2.13"/>
        <vers num="4.2.14"/>
        <vers num="4.2.15"/>
        <vers num="4.2.16"/>
        <vers num="4.2.2"/>
        <vers num="4.2.3"/>
        <vers num="4.2.4"/>
        <vers num="4.2.5"/>
        <vers num="4.2.6"/>
        <vers num="4.2.7"/>
        <vers num="4.2.8"/>
        <vers num="4.2.9"/>
        <vers num="4.3.0"/>
        <vers num="4.3.1"/>
        <vers num="4.3.2"/>
        <vers num="4.3.3"/>
        <vers num="4.3.4"/>
        <vers num="4.3.5"/>
        <vers num="4.3.6"/>
        <vers num="4.3.7"/>
        <vers num="4.4.0"/>
        <vers num="4.4.1"/>
        <vers num="4.5.0"/>
        <vers num="4.5.1"/>
        <vers num="4.5.2"/>
        <vers num="4.5.3"/>
        <vers num="4.6.0"/>
        <vers num="4.6.1"/>
        <vers num="4.6.2"/>
        <vers num="4.6.3"/>
        <vers num="4.6.4"/>
        <vers num="5.0.0"/>
        <vers num="5.0.1"/>
        <vers num="5.0.2"/>
        <vers num="5.0.3"/>
        <vers num="5.0.4"/>
        <vers num="5.1.0"/>
        <vers num="5.1.1"/>
        <vers num="5.1.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2339" published="2014-03-19" name="CVE-2014-2339" modified="2014-03-20" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:P/I:P/A:P)" CVSS_score="6.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.0" CVSS_base_score="6.5">
    <desc>
      <descript source="cve">Multiple SQL injection vulnerabilities in bbs/ajax.autosave.php in GNUboard 5.x and possibly earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) subject or (2) content parameter.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/91814" source="XF">gnuboard-cve20142339-sql-injection(91814)</ref>
      <ref url="http://www.securityfocus.com/bid/66228" source="BID">66228</ref>
      <ref url="http://seclists.org/fulldisclosure/2014/Mar/299" source="FULLDISC">20140317 [CVE-2014-2339] GNUboard SQL Injection Vulnerability</ref>
    </refs>
    <vuln_soft>
      <prod vendor="sir" name="gnuboard">
        <vers num="4.31.3"/>
        <vers num="4.31.4"/>
        <vers num="4.33.2"/>
        <vers num="4.34.20"/>
        <vers num="4.34.21"/>
        <vers prev="1" num="5.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2340" published="2014-04-03" name="CVE-2014-2340" modified="2014-04-19" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:P)" CVSS_score="6.8" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.6" CVSS_base_score="6.8">
    <desc>
      <descript source="cve">Cross-site request forgery (CSRF) vulnerability in the XCloner plugin before 3.1.1 for WordPress allows remote attackers to hijack the authentication of administrators for requests that create website backups via a request to wp-admin/plugins.php.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="https://www.htbridge.com/advisory/HTB23206" source="MISC">https://www.htbridge.com/advisory/HTB23206</ref>
      <ref url="http://www.securityfocus.com/bid/66280" source="BID">66280</ref>
      <ref url="http://www.securityfocus.com/archive/1/archive/1/531712/100/0/threaded" source="BUGTRAQ">20140402 &amp;ETH;&amp;iexcl;ross-Site Request Forgery (CSRF) in XCloner Wordpress Plugin</ref>
      <ref url="http://www.exploit-db.com/exploits/32701" source="EXPLOIT-DB">32701</ref>
      <ref url="http://wordpress.org/plugins/xcloner-backup-and-restore/changelog/" source="CONFIRM">http://wordpress.org/plugins/xcloner-backup-and-restore/changelog/</ref>
      <ref url="http://secunia.com/advisories/57362" source="SECUNIA" adv="1">57362</ref>
    </refs>
    <vuln_soft>
      <prod vendor="xcloner" name="xcloner">
        <vers num="2.1" edition=":~~~wordpress~~"/>
        <vers num="2.1.2" edition=":~~~wordpress~~"/>
        <vers num="2.2.1" edition=":~~~wordpress~~"/>
        <vers num="3.0" edition=":~~~wordpress~~"/>
        <vers num="3.0.1" edition=":~~~wordpress~~"/>
        <vers num="3.0.2" edition=":~~~wordpress~~"/>
        <vers num="3.0.3" edition=":~~~wordpress~~"/>
        <vers num="3.0.4" edition=":~~~wordpress~~"/>
        <vers num="3.0.5" edition=":~~~wordpress~~"/>
        <vers num="3.0.6" edition=":~~~wordpress~~"/>
        <vers num="3.0.7" edition=":~~~wordpress~~"/>
        <vers num="3.0.8" edition=":~~~wordpress~~"/>
        <vers prev="1" num="3.1.0" edition=":~~~wordpress~~"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2341" published="2014-04-22" name="CVE-2014-2341" modified="2014-04-22" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:P)" CVSS_score="6.8" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.6" CVSS_base_score="6.8">
    <desc>
      <descript source="cve">Session fixation vulnerability in CubeCart before 5.2.9 allows remote attackers to hijack web sessions via the PHPSESSID parameter.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/92526" source="XF">cubecart-cve20142341-session-hijacking(92526)</ref>
      <ref url="http://www.securitytracker.com/id/1030086" source="SECTRACK">1030086</ref>
      <ref url="http://www.securityfocus.com/bid/66805" source="BID">66805</ref>
      <ref url="http://www.osvdb.org/105784" source="OSVDB">105784</ref>
      <ref url="http://www.exploit-db.com/exploits/32830" source="EXPLOIT-DB">32830</ref>
      <ref url="http://secunia.com/advisories/57856" source="SECUNIA">57856</ref>
      <ref url="http://forums.cubecart.com/topic/48427-cubecart-529-relased/" source="CONFIRM">http://forums.cubecart.com/topic/48427-cubecart-529-relased/</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cubecart" name="cubecart">
        <vers num="5.2.0"/>
        <vers num="5.2.1"/>
        <vers num="5.2.2"/>
        <vers num="5.2.3"/>
        <vers num="5.2.4"/>
        <vers num="5.2.5"/>
        <vers num="5.2.6"/>
        <vers num="5.2.7"/>
        <vers prev="1" num="5.2.8"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2383" published="2014-04-28" name="CVE-2014-2383" modified="2014-04-29" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:N/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">dompdf.php in dompdf before 0.6.1, when DOMPDF_ENABLE_PHP is enabled, allows context-dependent attackers to bypass chroot protections and read arbitrary files via a PHP protocol and wrappers in the input_file parameter, as demonstrated by a php://filter/read=convert.base64-encode/resource in the input_file parameter.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-2383/" source="MISC">https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-2383/</ref>
      <ref url="https://github.com/dompdf/dompdf/commit/23a693993299e669306929e3d49a4a1f7b3fb028" source="CONFIRM">https://github.com/dompdf/dompdf/commit/23a693993299e669306929e3d49a4a1f7b3fb028</ref>
      <ref url="http://www.securityfocus.com/archive/1/archive/1/531912/100/0/threaded" source="BUGTRAQ">20140423 CVE-2014-2383 - Arbitrary file read in dompdf</ref>
      <ref url="http://seclists.org/fulldisclosure/2014/Apr/258" source="FULLDISC">20140423 CVE-2014-2383 - Arbitrary file read in dompdf</ref>
    </refs>
    <vuln_soft>
      <prod vendor="dompdf" name="dompdf">
        <vers prev="1" num="0.6.0" edition="beta3"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2384" published="2014-04-15" name="CVE-2014-2384" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:L/AC:L/Au:N/C:N/I:N/A:C)" CVSS_score="4.9" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="3.9" CVSS_base_score="4.9">
    <desc>
      <descript source="cve">vmx86.sys in VMware Workstation 10.0.1 build 1379776 and VMware Player 6.0.1 build 1379776 on Windows might allow local users to cause a denial of service (read access violation and system crash) via a crafted buffer in an IOCTL call.  NOTE: the researcher reports "Vendor rated issue as non-exploitable."</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-2384/" source="MISC">https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-2384/</ref>
      <ref url="http://seclists.org/fulldisclosure/2014/Apr/163" source="FULLDISC">20140411 CVE-2014-2384 - Invalid Pointer Dereference in VMware Workstation and Player</ref>
    </refs>
    <vuln_soft>
      <prod vendor="vmware" name="player">
        <vers num="6.0.1_build_1379776"/>
      </prod>
      <prod vendor="vmware" name="workstation">
        <vers num="10.0.1_build_1379776"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2386" published="2014-03-25" name="CVE-2014-2386" modified="2014-03-25" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:P)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">Multiple off-by-one errors in Icinga, possibly 1.10.2 and earlier, allow remote attackers to cause a denial of service (crash) via unspecified vectors to the (1) display_nav_table, (2) print_export_link, (3) page_num_selector, or (4) page_limit_selector function in cgi/cgiutils.c or (5) status_page_num_selector function in cgi/status.c, which triggers a stack-based buffer overflow.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://git.icinga.org/?p=icinga-core.git;a=commitdiff;h=73285093b71a5551abdaab0a042d3d6bae093b0d" source="CONFIRM" patch="1">https://git.icinga.org/?p=icinga-core.git;a=commitdiff;h=73285093b71a5551abdaab0a042d3d6bae093b0d</ref>
      <ref url="https://dev.icinga.org/issues/5663" source="CONFIRM">https://dev.icinga.org/issues/5663</ref>
      <ref url="http://lists.opensuse.org/opensuse-updates/2014-03/msg00072.html" source="SUSE">openSUSE-SU-2014:0420</ref>
      <ref url="http://comments.gmane.org/gmane.comp.security.oss.general/12355" source="MLIST">[oss-security] 20140313 CVE request for icinga 1 byte \0 overflows</ref>
    </refs>
    <vuln_soft>
      <prod vendor="icinga" name="icinga">
        <vers num="1.10.0"/>
        <vers num="1.10.1"/>
        <vers prev="1" num="1.10.2"/>
      </prod>
      <prod vendor="novell" name="opensuse">
        <vers num="12.3"/>
        <vers num="13.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2389" published="2014-04-12" name="CVE-2014-2389" modified="2014-04-14" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">Stack-based buffer overflow in a certain decryption function in qconnDoor on Blackberry Z10 devices with software 10.1.0.2312, when developer-mode has been previously enabled, allows remote attackers to execute arbitrary code via a crafted packet in a TCP session on a wireless network.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-04/0036.html" source="BUGTRAQ">20140408 BlackBerry Z 10 - Buffer Overflow in qconnDoor [MZ-13-05]</ref>
    </refs>
    <vuln_soft>
      <prod vendor="blackberry" name="blackberry_z10">
        <vers num="-"/>
      </prod>
      <prod vendor="blackberry" name="blackberry_os">
        <vers num="10.1.0.2312"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2391" published="2014-04-24" name="CVE-2014-2391" modified="2014-04-24" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:N/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">The password recovery service in Open-Xchange AppSuite before 7.2.2-rev20, 7.4.1 before 7.4.1-rev11, and 7.4.2 before 7.4.2-rev13 makes an improper decision about the sensitivity of a string representing a previously used but currently invalid password, which allows remote attackers to obtain potentially useful password-pattern information by reading (1) a web-server access log, (2) a web-server Referer log, or (3) browser history that contains this string because of its presence in a GET request.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.securityfocus.com/archive/1/531762" source="BUGTRAQ">20140408 Open-Xchange Security Advisory 2014-04-08</ref>
    </refs>
    <vuln_soft>
      <prod vendor="open-xchange" name="open-xchange_appsuite">
        <vers num="7.2.0"/>
        <vers num="7.2.1"/>
        <vers prev="1" num="7.2.2"/>
        <vers num="7.4.1"/>
        <vers num="7.4.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2392" published="2014-04-24" name="CVE-2014-2392" modified="2014-04-24" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:N/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">The E-Mail autoconfiguration feature in Open-Xchange AppSuite before 7.2.2-rev20, 7.4.1 before 7.4.1-rev11, and 7.4.2 before 7.4.2-rev13 places a password in a GET request, which allows remote attackers to obtain sensitive information by reading (1) web-server access logs, (2) web-server Referer logs, or (3) the browser history.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.securityfocus.com/archive/1/531762" source="BUGTRAQ">20140408 Open-Xchange Security Advisory 2014-04-08</ref>
    </refs>
    <vuln_soft>
      <prod vendor="open-xchange" name="open-xchange_appsuite">
        <vers num="7.2.0"/>
        <vers num="7.2.1"/>
        <vers prev="1" num="7.2.2"/>
        <vers num="7.4.1"/>
        <vers num="7.4.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2393" published="2014-04-24" name="CVE-2014-2393" modified="2014-04-24" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in Open-Xchange AppSuite 7.4.1 before 7.4.1-rev11 and 7.4.2 before 7.4.2-rev13 allows remote attackers to inject arbitrary web script or HTML via a Drive filename that is not properly handled during use of the composer to add an e-mail attachment.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://www.securityfocus.com/archive/1/531762" source="BUGTRAQ">20140408 Open-Xchange Security Advisory 2014-04-08</ref>
    </refs>
    <vuln_soft>
      <prod vendor="open-xchange" name="open-xchange_appsuite">
        <vers num="7.2.0"/>
        <vers num="7.2.1"/>
        <vers prev="1" num="7.2.2"/>
        <vers num="7.4.1"/>
        <vers num="7.4.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2397" published="2014-04-15" name="CVE-2014-2397" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">Unspecified vulnerability in Oracle Java SE 7u51 and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="jdk">
        <vers num="1.7.0" edition="update_51"/>
        <vers num="1.8.0"/>
      </prod>
      <prod vendor="oracle" name="jre">
        <vers num="1.7.0" edition="update_51"/>
        <vers num="1.8.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-2398" published="2014-04-15" name="CVE-2014-2398" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:S/C:N/I:P/A:N)" CVSS_score="3.5" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="6.8" CVSS_base_score="3.5">
    <desc>
      <descript source="cve">Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JavaFX 2.2.51; and JRockit R27.8.1 and R28.3.1 allows remote authenticated users to affect integrity via unknown vectors related to Javadoc.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="javafx">
        <vers num="2.2.51"/>
      </prod>
      <prod vendor="oracle" name="jdk">
        <vers num="1.5.0" edition="update_61"/>
        <vers num="1.6.0" edition="update_71"/>
        <vers num="1.7.0" edition="update_51"/>
        <vers num="1.8.0"/>
      </prod>
      <prod vendor="oracle" name="jre">
        <vers num="1.5.0" edition="update_61"/>
        <vers num="1.6.0" edition="update_71"/>
        <vers num="1.7.0" edition="update_51"/>
        <vers num="1.8.0"/>
      </prod>
      <prod vendor="oracle" name="jrockit">
        <vers num="r27.8.1"/>
        <vers num="r28.3.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2399" published="2014-04-15" name="CVE-2014-2399" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Unspecified vulnerability in the Oracle Endeca Server component in Oracle Fusion Middleware 2.2.2 allows remote attackers to affect integrity via unknown vectors related to Oracle Endeca Information Discovery (Formerly Latitude), a different vulnerability than CVE-2014-2400.</descript>
      <descript source="nvd">Per: http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html

"Please refer to My Oracle Support Note 1629648.1 for instructions on how to address this issue."</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="fusion_middleware">
        <vers num="2.2.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2400" published="2014-04-15" name="CVE-2014-2400" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Unspecified vulnerability in the Oracle Endeca Server component in Oracle Fusion Middleware 2.2.2 allows remote attackers to affect integrity via unknown vectors related to Oracle Endeca Information Discovery (Formerly Latitude), a different vulnerability than CVE-2014-2399.</descript>
      <descript source="nvd">Per: http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html

"Please refer to My Oracle Support Note 1629648.1 for instructions on how to address this issue."</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="fusion_middleware">
        <vers num="2.2.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2401" published="2014-04-15" name="CVE-2014-2401" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:P/A:N)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JavaFX 2.2.51; and Java SE Embedded 7u51 allows remote attackers to affect confidentiality via unknown vectors related to 2D.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="javafx">
        <vers num="2.2.51"/>
      </prod>
      <prod vendor="oracle" name="jdk">
        <vers num="1.5.0" edition="update_61"/>
        <vers num="1.6.0" edition="update_71"/>
        <vers num="1.7.0" edition="update_51"/>
        <vers num="1.8.0"/>
      </prod>
      <prod vendor="oracle" name="jre">
        <vers num="1.5.0" edition="update_61"/>
        <vers num="1.6.0" edition="update_71"/>
        <vers num="1.7.0" edition="update_51"/>
        <vers num="1.8.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2402" published="2014-04-15" name="CVE-2014-2402" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">Unspecified vulnerability in Oracle Java SE 7u51 and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2014-0432 and CVE-2014-0455.</descript>
      <descript source="nvd">per: http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html


Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="jdk">
        <vers num="1.7.0" edition="update_51"/>
        <vers num="1.8.0"/>
      </prod>
      <prod vendor="oracle" name="jre">
        <vers num="1.7.0" edition="update_51"/>
        <vers num="1.8.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2403" published="2014-04-15" name="CVE-2014-2403" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:N/A:N)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality via vectors related to JAXP.</descript>
      <descript source="nvd">per: http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html


Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="jdk">
        <vers num="1.6.0" edition="update_71"/>
        <vers num="1.7.0" edition="update_51"/>
        <vers num="1.8.0"/>
      </prod>
      <prod vendor="oracle" name="jre">
        <vers num="1.6.0" edition="update_71"/>
        <vers num="1.7.0" edition="update_51"/>
        <vers num="1.8.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2404" published="2014-04-15" name="CVE-2014-2404" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:P/I:N/A:N)" CVSS_score="4.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.0" CVSS_base_score="4.0">
    <desc>
      <descript source="cve">Unspecified vulnerability in the Oracle Access Manager component in Oracle Fusion Middleware 10.1.4.3, 11.1.1.3.0, 11.1.1.5.0, 11.1.1.7.0, 11.1.2.0.0, 11.1.2.1.0, and 11.1.2.2.0 allows remote authenticated users to affect confidentiality via unknown vectors related to WebGate.</descript>
      <descript source="nvd">Per: http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html

"Please refer to My Oracle Support Note 1643382.1 for instructions on how to address this issue."</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="fusion_middleware">
        <vers num="10.1.4.3"/>
        <vers num="11.1.1.3.0"/>
        <vers num="11.1.1.5.0"/>
        <vers num="11.1.1.7.0"/>
        <vers num="11.1.2.0"/>
        <vers num="11.1.2.1.0"/>
        <vers num="11.1.2.2.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2406" published="2014-04-15" name="CVE-2014-2406" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:S/C:C/I:C/A:C)" CVSS_score="8.5" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="6.8" CVSS_base_score="8.5">
    <desc>
      <descript source="cve">Unspecified vulnerability in the Core RDBMS component in Oracle Database Server 11.1.0.7, 11.2.0.3, 11.2.0.4, and 12.1.0.1 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors related to "Advisor" and "Select Any Dictionary" privileges.</descript>
      <descript source="nvd">Per: http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html

"The CVSS Base Score is 8.5 only for Windows. For Linux, Unix and other platforms, the CVSS Base Score is 6.0, and the impacts for Confidentiality, Integrity and Availability are Partial+."</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="database_server">
        <vers num="11.1.0.7"/>
        <vers num="11.2.0.3"/>
        <vers num="11.2.0.4"/>
        <vers num="12.1.0.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2407" published="2014-04-15" name="CVE-2014-2407" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:P)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">Unspecified vulnerability in the Oracle Data Integrator component in Oracle Fusion Middleware 11.1.1.3.0 allows remote attackers to affect availability via unknown vectors related to Data Quality, a different vulnerability than CVE-2014-2415, CVE-2014-2416, CVE-2014-2417, and CVE-2014-2418.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="fusion_middleware">
        <vers num="11.1.1.3.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2408" published="2014-04-15" name="CVE-2014-2408" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:H/Au:S/C:C/I:C/A:N)" CVSS_score="6.6" CVSS_impact_subscore="9.2" CVSS_exploit_subscore="3.9" CVSS_base_score="6.6">
    <desc>
      <descript source="cve">Unspecified vulnerability in the Core RDBMS component in Oracle Database Server 11.1.0.7, 11.2.0.3, 11.2.0.4, and 12.1.0.1 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to the "Grant Any Object Privilege."</descript>
    </desc>
    <loss_types>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="database_server">
        <vers num="11.1.0.7"/>
        <vers num="11.2.0.3"/>
        <vers num="11.2.0.4"/>
        <vers num="12.1.0.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2409" published="2014-04-15" name="CVE-2014-2409" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:N)" CVSS_score="6.4" CVSS_impact_subscore="4.9" CVSS_exploit_subscore="10.0" CVSS_base_score="6.4">
    <desc>
      <descript source="cve">Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality and integrity via unknown vectors related to Deployment.</descript>
    </desc>
    <loss_types>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="jdk">
        <vers num="1.6.0" edition="update_71"/>
        <vers num="1.7.0" edition="update_51"/>
        <vers num="1.8.0"/>
      </prod>
      <prod vendor="oracle" name="jre">
        <vers num="1.6.0" edition="update_71"/>
        <vers num="1.7.0" edition="update_51"/>
        <vers num="1.8.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2410" published="2014-04-15" name="CVE-2014-2410" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">Unspecified vulnerability in Oracle Java SE 8 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to JavaFX.</descript>
      <descript source="nvd">per: http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html

Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="jdk">
        <vers num="1.8.0"/>
      </prod>
      <prod vendor="oracle" name="jre">
        <vers num="1.8.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2411" published="2014-04-15" name="CVE-2014-2411" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:P/I:P/A:P)" CVSS_score="6.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.0" CVSS_base_score="6.5">
    <desc>
      <descript source="cve">Unspecified vulnerability in the Oracle Identity Analytics component in Oracle Fusion Middleware Oracle Identity Analytics 11.1.1.5 and Sun Role Manager 5.0 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors related to Security.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="identity_analytics">
        <vers num="11.1.1.5"/>
      </prod>
      <prod vendor="oracle" name="sun_role_manager">
        <vers num="5.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2412" published="2014-04-15" name="CVE-2014-2412" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, SE 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT, a different vulnerability than CVE-2014-0451.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="jdk">
        <vers num="1.5.0" edition="update_61"/>
        <vers num="1.6.0" edition="update_71"/>
        <vers num="1.7.0" edition="update_51"/>
        <vers num="1.8.0"/>
      </prod>
      <prod vendor="oracle" name="jre">
        <vers num="1.5.0" edition="update_61"/>
        <vers num="1.6.0" edition="update_71"/>
        <vers num="1.7.0" edition="update_51"/>
        <vers num="1.8.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2413" published="2014-04-15" name="CVE-2014-2413" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Unspecified vulnerability in Oracle Java SE 7u51 and 8, and Java SE Embedded 7u51, allows remote attackers to affect integrity via unknown vectors related to Libraries.</descript>
      <descript source="nvd">per: http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html


Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets.
</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="jdk">
        <vers num="1.7.0" edition="update_51"/>
        <vers num="1.8.0"/>
      </prod>
      <prod vendor="oracle" name="jre">
        <vers num="1.7.0" edition="update_51"/>
        <vers num="1.8.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2414" published="2014-04-15" name="CVE-2014-2414" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JAXB.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="jdk">
        <vers num="1.6.0" edition="update_71"/>
        <vers num="1.7.0" edition="update_51"/>
        <vers num="1.8.0"/>
      </prod>
      <prod vendor="oracle" name="jre">
        <vers num="1.6.0" edition="update_71"/>
        <vers num="1.7.0" edition="update_51"/>
        <vers num="1.8.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2415" published="2014-04-15" name="CVE-2014-2415" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:P)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">Unspecified vulnerability in the Oracle Data Integrator component in Oracle Fusion Middleware 11.1.1.3.0 allows remote attackers to affect availability via unknown vectors related to Data Quality, a different vulnerability than CVE-2014-2407, CVE-2014-2416, CVE-2014-2417, and CVE-2014-2418.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="fusion_middleware">
        <vers num="11.1.1.3.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2416" published="2014-04-15" name="CVE-2014-2416" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:P)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">Unspecified vulnerability in the Oracle Data Integrator component in Oracle Fusion Middleware 11.1.1.3.0 allows remote attackers to affect availability via unknown vectors related to Data Quality, a different vulnerability than CVE-2014-2407, CVE-2014-2415, CVE-2014-2417, and CVE-2014-2418.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="fusion_middleware">
        <vers num="11.1.1.3.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2417" published="2014-04-15" name="CVE-2014-2417" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:P)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">Unspecified vulnerability in the Oracle Data Integrator component in Oracle Fusion Middleware 11.1.1.3.0 allows remote attackers to affect availability via unknown vectors related to Data Quality, a different vulnerability than CVE-2014-2407, CVE-2014-2415, CVE-2014-2416, and CVE-2014-2418.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="fusion_middleware">
        <vers num="11.1.1.3.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2418" published="2014-04-15" name="CVE-2014-2418" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:P)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">Unspecified vulnerability in the Oracle Data Integrator component in Oracle Fusion Middleware 11.1.1.3.0 allows remote attackers to affect availability via unknown vectors related to Data Quality, a different vulnerability than CVE-2014-2407, CVE-2014-2415, CVE-2014-2416, and CVE-2014-2417.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="fusion_middleware">
        <vers num="11.1.1.3.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2419" published="2014-04-15" name="CVE-2014-2419" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:N/I:N/A:P)" CVSS_score="4.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.0" CVSS_base_score="4.0">
    <desc>
      <descript source="cve">Unspecified vulnerability in Oracle MySQL Server 5.5.35 and earlier and 5.6.15 and earlier allows remote authenticated users to affect availability via unknown vectors related to Partition.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="mysql" name="mysql">
        <vers num="5.5.0"/>
        <vers num="5.5.1"/>
        <vers num="5.5.2"/>
        <vers num="5.5.3"/>
        <vers num="5.5.4"/>
        <vers num="5.5.5"/>
        <vers num="5.5.6"/>
        <vers num="5.5.7"/>
        <vers num="5.5.8"/>
        <vers num="5.5.9"/>
      </prod>
      <prod vendor="oracle" name="mysql">
        <vers num="5.5.10"/>
        <vers num="5.5.11"/>
        <vers num="5.5.12"/>
        <vers num="5.5.13"/>
        <vers num="5.5.14"/>
        <vers num="5.5.15"/>
        <vers num="5.5.16"/>
        <vers num="5.5.17"/>
        <vers num="5.5.18"/>
        <vers num="5.5.19"/>
        <vers num="5.5.20"/>
        <vers num="5.5.21"/>
        <vers num="5.5.22"/>
        <vers num="5.5.23"/>
        <vers num="5.5.24"/>
        <vers num="5.5.25" edition="a"/>
        <vers num="5.5.26"/>
        <vers num="5.5.27"/>
        <vers num="5.5.28"/>
        <vers num="5.5.29"/>
        <vers num="5.5.30"/>
        <vers num="5.5.31"/>
        <vers num="5.5.32"/>
        <vers num="5.5.33"/>
        <vers num="5.5.34"/>
        <vers prev="1" num="5.5.35"/>
        <vers num="5.6.0"/>
        <vers num="5.6.1"/>
        <vers num="5.6.10"/>
        <vers num="5.6.11"/>
        <vers num="5.6.12"/>
        <vers num="5.6.13"/>
        <vers num="5.6.14"/>
        <vers prev="1" num="5.6.15"/>
        <vers num="5.6.2"/>
        <vers num="5.6.3"/>
        <vers num="5.6.4"/>
        <vers num="5.6.5"/>
        <vers num="5.6.6"/>
        <vers num="5.6.7"/>
        <vers num="5.6.8"/>
        <vers num="5.6.9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-2420" published="2014-04-15" name="CVE-2014-2420" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:H/Au:N/C:N/I:P/A:N)" CVSS_score="2.6" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="4.9" CVSS_base_score="2.6">
    <desc>
      <descript source="cve">Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect integrity via unknown vectors related to Deployment.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="jdk">
        <vers num="1.6.0" edition="update_71"/>
        <vers num="1.7.0" edition="update_51"/>
        <vers num="1.8.0"/>
      </prod>
      <prod vendor="oracle" name="jre">
        <vers num="1.6.0" edition="update_71"/>
        <vers num="1.7.0" edition="update_51"/>
        <vers num="1.8.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2421" published="2014-04-15" name="CVE-2014-2421" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:C/I:C/A:C)" CVSS_score="10.0" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="10.0" CVSS_base_score="10.0">
    <desc>
      <descript source="cve">Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JavaFX 2.2.51; and Java SE Embedded 7u51 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="javafx">
        <vers num="2.2.51"/>
      </prod>
      <prod vendor="oracle" name="jdk">
        <vers num="1.5.0" edition="update_61"/>
        <vers num="1.6.0" edition="update_71"/>
        <vers num="1.7.0" edition="update_51"/>
        <vers num="1.8.0"/>
      </prod>
      <prod vendor="oracle" name="jre">
        <vers num="1.5.0" edition="update_61"/>
        <vers num="1.6.0" edition="update_71"/>
        <vers num="1.7.0" edition="update_51"/>
        <vers num="1.8.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2422" published="2014-04-15" name="CVE-2014-2422" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:P)" CVSS_score="6.8" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.6" CVSS_base_score="6.8">
    <desc>
      <descript source="cve">Unspecified vulnerability in Oracle Java SE 7u51 and 8, and JavaFX 2.2.51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.</descript>
      <descript source="nvd">per: http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html

Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="javafx">
        <vers num="2.2.51"/>
      </prod>
      <prod vendor="oracle" name="jdk">
        <vers num="1.7.0" edition="update_51"/>
        <vers num="1.8.0"/>
      </prod>
      <prod vendor="oracle" name="jre">
        <vers num="1.7.0" edition="update_51"/>
        <vers num="1.8.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2423" published="2014-04-15" name="CVE-2014-2423" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JAX-WS, a different vulnerability than CVE-2014-0452 and CVE-2014-0458.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="jdk">
        <vers num="1.6.0" edition="update_71"/>
        <vers num="1.7.0" edition="update_51"/>
        <vers num="1.8.0"/>
      </prod>
      <prod vendor="oracle" name="jre">
        <vers num="1.6.0" edition="update_71"/>
        <vers num="1.7.0" edition="update_51"/>
        <vers num="1.8.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2424" published="2014-04-15" name="CVE-2014-2424" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:N/I:P/A:N)" CVSS_score="4.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.0" CVSS_base_score="4.0">
    <desc>
      <descript source="cve">Unspecified vulnerability in the Oracle Event Processing component in Oracle Fusion Middleware 11.1.1.7.0 allows remote authenticated users to affect integrity via vectors related to CEP system.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="fusion_middleware">
        <vers num="11.1.1.7.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2425" published="2014-04-15" name="CVE-2014-2425" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:P/I:N/A:N)" CVSS_score="4.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.0" CVSS_base_score="4.0">
    <desc>
      <descript source="cve">Unspecified vulnerability in the Oracle OpenSSO component in Oracle Fusion Middleware 8.0 Update 2 Patch 5 allows remote authenticated users to affect confidentiality via unknown vectors.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="fusion_middleware">
        <vers num="8.0" edition="update2_patch5"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2426" published="2014-04-15" name="CVE-2014-2426" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:S/C:N/I:P/A:P)" CVSS_score="4.9" CVSS_impact_subscore="4.9" CVSS_exploit_subscore="6.8" CVSS_base_score="4.9">
    <desc>
      <descript source="cve">Unspecified vulnerability in the Oracle OpenSSO component in Oracle Fusion Middleware 8.0 Update 2 Patch 5 allows remote authenticated users to affect integrity and availability via unknown vectors related to Admin Console.</descript>
    </desc>
    <loss_types>
      <avail/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="fusion_middleware">
        <vers num="8.0" edition="update2_patch5"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2427" published="2014-04-15" name="CVE-2014-2427" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Sound.</descript>
      <descript source="nvd">per: http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html


Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="jdk">
        <vers num="1.5.0" edition="update_61"/>
        <vers num="1.6.0" edition="update_71"/>
        <vers num="1.7.0" edition="update_51"/>
        <vers num="1.8.0"/>
      </prod>
      <prod vendor="oracle" name="jre">
        <vers num="1.5.0" edition="update_61"/>
        <vers num="1.6.0" edition="update_71"/>
        <vers num="1.7.0" edition="update_51"/>
        <vers num="1.8.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2428" published="2014-04-15" name="CVE-2014-2428" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:H/Au:N/C:C/I:C/A:C)" CVSS_score="7.6" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="4.9" CVSS_base_score="7.6">
    <desc>
      <descript source="cve">Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="jdk">
        <vers num="1.6.0" edition="update_71"/>
        <vers num="1.7.0" edition="update_51"/>
        <vers num="1.8.0"/>
      </prod>
      <prod vendor="oracle" name="jre">
        <vers num="1.6.0" edition="update_71"/>
        <vers num="1.7.0" edition="update_51"/>
        <vers num="1.8.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2429" published="2014-04-15" name="CVE-2014-2429" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:P/I:N/A:N)" CVSS_score="4.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.0" CVSS_base_score="4.0">
    <desc>
      <descript source="cve">Unspecified vulnerability in the PeopleSoft Enterprise CS Campus Self Service component in Oracle PeopleSoft Products 9.0 allows remote authenticated users to affect confidentiality via unknown vectors related to Campus Mobile.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="peoplesoft_products">
        <vers num="9.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-2430" published="2014-04-15" name="CVE-2014-2430" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:S/C:N/I:N/A:P)" CVSS_score="3.5" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="6.8" CVSS_base_score="3.5">
    <desc>
      <descript source="cve">Unspecified vulnerability in Oracle MySQL Server 5.5.36 and earlier and 5.6.16 and earlier allows remote authenticated users to affect availability via unknown vectors related to Performance Schema.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="mysql" name="mysql">
        <vers num="5.5.0"/>
        <vers num="5.5.1"/>
        <vers num="5.5.2"/>
        <vers num="5.5.3"/>
        <vers num="5.5.4"/>
        <vers num="5.5.5"/>
        <vers num="5.5.6"/>
        <vers num="5.5.7"/>
        <vers num="5.5.8"/>
        <vers num="5.5.9"/>
      </prod>
      <prod vendor="oracle" name="mysql">
        <vers num="5.5.10"/>
        <vers num="5.5.11"/>
        <vers num="5.5.12"/>
        <vers num="5.5.13"/>
        <vers num="5.5.14"/>
        <vers num="5.5.15"/>
        <vers num="5.5.16"/>
        <vers num="5.5.17"/>
        <vers num="5.5.18"/>
        <vers num="5.5.19"/>
        <vers num="5.5.20"/>
        <vers num="5.5.21"/>
        <vers num="5.5.22"/>
        <vers num="5.5.23"/>
        <vers num="5.5.24"/>
        <vers num="5.5.25" edition="a"/>
        <vers num="5.5.26"/>
        <vers num="5.5.27"/>
        <vers num="5.5.28"/>
        <vers num="5.5.29"/>
        <vers num="5.5.30"/>
        <vers num="5.5.31"/>
        <vers num="5.5.32"/>
        <vers num="5.5.33"/>
        <vers num="5.5.34"/>
        <vers num="5.5.35"/>
        <vers prev="1" num="5.5.36"/>
        <vers num="5.6.0"/>
        <vers num="5.6.1"/>
        <vers num="5.6.10"/>
        <vers num="5.6.11"/>
        <vers num="5.6.12"/>
        <vers num="5.6.13"/>
        <vers num="5.6.14"/>
        <vers num="5.6.15"/>
        <vers prev="1" num="5.6.16"/>
        <vers num="5.6.2"/>
        <vers num="5.6.3"/>
        <vers num="5.6.4"/>
        <vers num="5.6.5"/>
        <vers num="5.6.6"/>
        <vers num="5.6.7"/>
        <vers num="5.6.8"/>
        <vers num="5.6.9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-2431" published="2014-04-15" name="CVE-2014-2431" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:H/Au:N/C:N/I:N/A:P)" CVSS_score="2.6" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="4.9" CVSS_base_score="2.6">
    <desc>
      <descript source="cve">Unspecified vulnerability in Oracle MySQL Server 5.5.36 and earlier and 5.6.16 and earlier allows remote attackers to affect availability via unknown vectors related to Options.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="mysql" name="mysql">
        <vers num="5.5.0"/>
        <vers num="5.5.1"/>
        <vers num="5.5.2"/>
        <vers num="5.5.3"/>
        <vers num="5.5.4"/>
        <vers num="5.5.5"/>
        <vers num="5.5.6"/>
        <vers num="5.5.7"/>
        <vers num="5.5.8"/>
        <vers num="5.5.9"/>
      </prod>
      <prod vendor="oracle" name="mysql">
        <vers num="5.5.10"/>
        <vers num="5.5.11"/>
        <vers num="5.5.12"/>
        <vers num="5.5.13"/>
        <vers num="5.5.14"/>
        <vers num="5.5.15"/>
        <vers num="5.5.16"/>
        <vers num="5.5.17"/>
        <vers num="5.5.18"/>
        <vers num="5.5.19"/>
        <vers num="5.5.20"/>
        <vers num="5.5.21"/>
        <vers num="5.5.22"/>
        <vers num="5.5.23"/>
        <vers num="5.5.24"/>
        <vers num="5.5.25" edition="a"/>
        <vers num="5.5.26"/>
        <vers num="5.5.27"/>
        <vers num="5.5.28"/>
        <vers num="5.5.29"/>
        <vers num="5.5.30"/>
        <vers num="5.5.31"/>
        <vers num="5.5.32"/>
        <vers num="5.5.33"/>
        <vers num="5.5.34"/>
        <vers num="5.5.35"/>
        <vers prev="1" num="5.5.36"/>
        <vers num="5.6.0"/>
        <vers num="5.6.1"/>
        <vers num="5.6.10"/>
        <vers num="5.6.11"/>
        <vers num="5.6.12"/>
        <vers num="5.6.13"/>
        <vers num="5.6.14"/>
        <vers num="5.6.15"/>
        <vers prev="1" num="5.6.16"/>
        <vers num="5.6.2"/>
        <vers num="5.6.3"/>
        <vers num="5.6.4"/>
        <vers num="5.6.5"/>
        <vers num="5.6.6"/>
        <vers num="5.6.7"/>
        <vers num="5.6.8"/>
        <vers num="5.6.9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-2432" published="2014-04-15" name="CVE-2014-2432" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:M/C:N/I:N/A:P)" CVSS_score="2.8" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="5.5" CVSS_base_score="2.8">
    <desc>
      <descript source="cve">Unspecified vulnerability Oracle the MySQL Server component 5.5.35 and earlier and 5.6.15 and earlier allows remote authenticated users to affect availability via unknown vectors related to Federated.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="mysql" name="mysql">
        <vers num="5.5.0"/>
        <vers num="5.5.1"/>
        <vers num="5.5.2"/>
        <vers num="5.5.3"/>
        <vers num="5.5.4"/>
        <vers num="5.5.5"/>
        <vers num="5.5.6"/>
        <vers num="5.5.7"/>
        <vers num="5.5.8"/>
        <vers num="5.5.9"/>
      </prod>
      <prod vendor="oracle" name="mysql">
        <vers num="5.5.10"/>
        <vers num="5.5.11"/>
        <vers num="5.5.12"/>
        <vers num="5.5.13"/>
        <vers num="5.5.14"/>
        <vers num="5.5.15"/>
        <vers num="5.5.16"/>
        <vers num="5.5.17"/>
        <vers num="5.5.18"/>
        <vers num="5.5.19"/>
        <vers num="5.5.20"/>
        <vers num="5.5.21"/>
        <vers num="5.5.22"/>
        <vers num="5.5.23"/>
        <vers num="5.5.24"/>
        <vers num="5.5.25" edition="a"/>
        <vers num="5.5.26"/>
        <vers num="5.5.27"/>
        <vers num="5.5.28"/>
        <vers num="5.5.29"/>
        <vers num="5.5.30"/>
        <vers num="5.5.31"/>
        <vers num="5.5.32"/>
        <vers num="5.5.33"/>
        <vers num="5.5.34"/>
        <vers prev="1" num="5.5.35"/>
        <vers num="5.6.0"/>
        <vers num="5.6.1"/>
        <vers num="5.6.10"/>
        <vers num="5.6.11"/>
        <vers num="5.6.12"/>
        <vers num="5.6.13"/>
        <vers num="5.6.14"/>
        <vers prev="1" num="5.6.15"/>
        <vers num="5.6.2"/>
        <vers num="5.6.3"/>
        <vers num="5.6.4"/>
        <vers num="5.6.5"/>
        <vers num="5.6.6"/>
        <vers num="5.6.7"/>
        <vers num="5.6.8"/>
        <vers num="5.6.9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2433" published="2014-04-15" name="CVE-2014-2433" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:P)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">Unspecified vulnerability in the PeopleSoft Enterprise PT PeopleTools component in Oracle PeopleSoft Products 8.53 allows remote attackers to affect availability via unknown vectors related to Integration Broker.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="peoplesoft_products">
        <vers num="8.53"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2434" published="2014-04-15" name="CVE-2014-2434" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:N/I:N/A:P)" CVSS_score="4.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.0" CVSS_base_score="4.0">
    <desc>
      <descript source="cve">Unspecified vulnerability in Oracle MySQL Server 5.6.15 and earlier allows remote authenticated users to affect availability via vectors related to DML.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="mysql">
        <vers num="5.6.0"/>
        <vers num="5.6.1"/>
        <vers num="5.6.10"/>
        <vers num="5.6.11"/>
        <vers num="5.6.12"/>
        <vers num="5.6.13"/>
        <vers num="5.6.14"/>
        <vers prev="1" num="5.6.15"/>
        <vers num="5.6.2"/>
        <vers num="5.6.3"/>
        <vers num="5.6.4"/>
        <vers num="5.6.5"/>
        <vers num="5.6.6"/>
        <vers num="5.6.7"/>
        <vers num="5.6.8"/>
        <vers num="5.6.9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2435" published="2014-04-15" name="CVE-2014-2435" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:N/I:N/A:P)" CVSS_score="4.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.0" CVSS_base_score="4.0">
    <desc>
      <descript source="cve">Unspecified vulnerability in Oracle MySQL Server 5.6.16 and earlier allows remote authenticated users to affect availability via unknown vectors related to InnoDB.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="mysql">
        <vers num="5.6.0"/>
        <vers num="5.6.1"/>
        <vers num="5.6.10"/>
        <vers num="5.6.11"/>
        <vers num="5.6.12"/>
        <vers num="5.6.13"/>
        <vers num="5.6.14"/>
        <vers prev="1" num="5.6.15"/>
        <vers num="5.6.2"/>
        <vers num="5.6.3"/>
        <vers num="5.6.4"/>
        <vers num="5.6.5"/>
        <vers num="5.6.6"/>
        <vers num="5.6.7"/>
        <vers num="5.6.8"/>
        <vers num="5.6.9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2436" published="2014-04-15" name="CVE-2014-2436" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:S/C:P/I:P/A:P)" CVSS_score="6.0" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="6.8" CVSS_base_score="6.0">
    <desc>
      <descript source="cve">Unspecified vulnerability in Oracle MySQL Server 5.5.36 and earlier and 5.6.16 and earlier allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to RBR.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="mysql" name="mysql">
        <vers num="5.5.0"/>
        <vers num="5.5.1"/>
        <vers num="5.5.2"/>
        <vers num="5.5.3"/>
        <vers num="5.5.4"/>
        <vers num="5.5.5"/>
        <vers num="5.5.6"/>
        <vers num="5.5.7"/>
        <vers num="5.5.8"/>
        <vers num="5.5.9"/>
      </prod>
      <prod vendor="oracle" name="mysql">
        <vers num="5.5.10"/>
        <vers num="5.5.11"/>
        <vers num="5.5.12"/>
        <vers num="5.5.13"/>
        <vers num="5.5.14"/>
        <vers num="5.5.15"/>
        <vers num="5.5.16"/>
        <vers num="5.5.17"/>
        <vers num="5.5.18"/>
        <vers num="5.5.19"/>
        <vers num="5.5.20"/>
        <vers num="5.5.21"/>
        <vers num="5.5.22"/>
        <vers num="5.5.23"/>
        <vers num="5.5.24"/>
        <vers num="5.5.25" edition="a"/>
        <vers num="5.5.26"/>
        <vers num="5.5.27"/>
        <vers num="5.5.28"/>
        <vers num="5.5.29"/>
        <vers num="5.5.30"/>
        <vers num="5.5.31"/>
        <vers num="5.5.32"/>
        <vers num="5.5.33"/>
        <vers num="5.5.34"/>
        <vers num="5.5.35"/>
        <vers prev="1" num="5.5.36"/>
        <vers num="5.6.0"/>
        <vers num="5.6.1"/>
        <vers num="5.6.10"/>
        <vers num="5.6.11"/>
        <vers num="5.6.12"/>
        <vers num="5.6.13"/>
        <vers num="5.6.14"/>
        <vers num="5.6.15"/>
        <vers prev="1" num="5.6.16"/>
        <vers num="5.6.2"/>
        <vers num="5.6.3"/>
        <vers num="5.6.4"/>
        <vers num="5.6.5"/>
        <vers num="5.6.6"/>
        <vers num="5.6.7"/>
        <vers num="5.6.8"/>
        <vers num="5.6.9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2437" published="2014-04-15" name="CVE-2014-2437" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:N/A:N)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">Unspecified vulnerability in the PeopleSoft Enterprise PT PeopleTools component in Oracle PeopleSoft Products 8.52 and 8.53 allows remote attackers to affect confidentiality via unknown vectors related to Integration Broker, a different vulnerability than CVE-2014-2447.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="peoplesoft_products">
        <vers num="8.52"/>
        <vers num="8.53"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-2438" published="2014-04-15" name="CVE-2014-2438" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:S/C:N/I:N/A:P)" CVSS_score="3.5" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="6.8" CVSS_base_score="3.5">
    <desc>
      <descript source="cve">Unspecified vulnerability in Oracle MySQL Server 5.5.35 and earlier and 5.6.15 and earlier allows remote authenticated users to affect availability via unknown vectors related to Replication.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="mysql" name="mysql">
        <vers num="5.5.0"/>
        <vers num="5.5.1"/>
        <vers num="5.5.2"/>
        <vers num="5.5.3"/>
        <vers num="5.5.4"/>
        <vers num="5.5.5"/>
        <vers num="5.5.6"/>
        <vers num="5.5.7"/>
        <vers num="5.5.8"/>
        <vers num="5.5.9"/>
      </prod>
      <prod vendor="oracle" name="mysql">
        <vers num="5.5.10"/>
        <vers num="5.5.11"/>
        <vers num="5.5.12"/>
        <vers num="5.5.13"/>
        <vers num="5.5.14"/>
        <vers num="5.5.15"/>
        <vers num="5.5.16"/>
        <vers num="5.5.17"/>
        <vers num="5.5.18"/>
        <vers num="5.5.19"/>
        <vers num="5.5.20"/>
        <vers num="5.5.21"/>
        <vers num="5.5.22"/>
        <vers num="5.5.23"/>
        <vers num="5.5.24"/>
        <vers num="5.5.25" edition="a"/>
        <vers num="5.5.26"/>
        <vers num="5.5.27"/>
        <vers num="5.5.28"/>
        <vers num="5.5.29"/>
        <vers num="5.5.30"/>
        <vers num="5.5.31"/>
        <vers num="5.5.32"/>
        <vers num="5.5.33"/>
        <vers num="5.5.34"/>
        <vers prev="1" num="5.5.35"/>
        <vers num="5.6.0"/>
        <vers num="5.6.1"/>
        <vers num="5.6.10"/>
        <vers num="5.6.11"/>
        <vers num="5.6.12"/>
        <vers num="5.6.13"/>
        <vers num="5.6.14"/>
        <vers prev="1" num="5.6.15"/>
        <vers num="5.6.2"/>
        <vers num="5.6.3"/>
        <vers num="5.6.4"/>
        <vers num="5.6.5"/>
        <vers num="5.6.6"/>
        <vers num="5.6.7"/>
        <vers num="5.6.8"/>
        <vers num="5.6.9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2439" published="2014-04-15" name="CVE-2014-2439" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:N)" CVSS_score="6.4" CVSS_impact_subscore="4.9" CVSS_exploit_subscore="10.0" CVSS_base_score="6.4">
    <desc>
      <descript source="cve">Unspecified vulnerability in the Oracle Secure Global Desktop (SGD) component in Oracle Virtualization 5.0 and 5.1 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Workspace Web Application.</descript>
    </desc>
    <loss_types>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="virtualization">
        <vers num="5.0"/>
        <vers num="5.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2440" published="2014-04-15" name="CVE-2014-2440" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:H/Au:N/C:P/I:P/A:P)" CVSS_score="5.1" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="4.9" CVSS_base_score="5.1">
    <desc>
      <descript source="cve">Unspecified vulnerability in the MySQL Client component in Oracle MySQL 5.5.36 and earlier and 5.6.16 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="mysql" name="mysql">
        <vers num="5.5.0"/>
        <vers num="5.5.1"/>
        <vers num="5.5.2"/>
        <vers num="5.5.3"/>
        <vers num="5.5.4"/>
        <vers num="5.5.5"/>
        <vers num="5.5.6"/>
        <vers num="5.5.7"/>
        <vers num="5.5.8"/>
        <vers num="5.5.9"/>
      </prod>
      <prod vendor="oracle" name="mysql">
        <vers num="5.5.10"/>
        <vers num="5.5.11"/>
        <vers num="5.5.12"/>
        <vers num="5.5.13"/>
        <vers num="5.5.14"/>
        <vers num="5.5.15"/>
        <vers num="5.5.16"/>
        <vers num="5.5.17"/>
        <vers num="5.5.18"/>
        <vers num="5.5.19"/>
        <vers num="5.5.20"/>
        <vers num="5.5.21"/>
        <vers num="5.5.22"/>
        <vers num="5.5.23"/>
        <vers num="5.5.24"/>
        <vers num="5.5.25" edition="a"/>
        <vers num="5.5.26"/>
        <vers num="5.5.27"/>
        <vers num="5.5.28"/>
        <vers num="5.5.29"/>
        <vers num="5.5.30"/>
        <vers num="5.5.31"/>
        <vers num="5.5.32"/>
        <vers num="5.5.33"/>
        <vers num="5.5.34"/>
        <vers num="5.5.35"/>
        <vers prev="1" num="5.5.36"/>
        <vers num="5.6.0"/>
        <vers num="5.6.1"/>
        <vers num="5.6.10"/>
        <vers num="5.6.11"/>
        <vers num="5.6.12"/>
        <vers num="5.6.13"/>
        <vers num="5.6.14"/>
        <vers num="5.6.15"/>
        <vers prev="1" num="5.6.16"/>
        <vers num="5.6.2"/>
        <vers num="5.6.3"/>
        <vers num="5.6.4"/>
        <vers num="5.6.5"/>
        <vers num="5.6.6"/>
        <vers num="5.6.7"/>
        <vers num="5.6.8"/>
        <vers num="5.6.9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2441" published="2014-04-15" name="CVE-2014-2441" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:L/AC:M/Au:N/C:P/I:P/A:P)" CVSS_score="4.4" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="3.4" CVSS_base_score="4.4">
    <desc>
      <descript source="cve">Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox before 4.1.32, 4.2.24, and 4.3.10 allows local users to affect confidentiality, integrity, and availability via vectors related to Graphics driver (WDDM) for Windows guests.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="vm_virtualbox">
        <vers num="4.1.0"/>
        <vers num="4.1.10"/>
        <vers num="4.1.12"/>
        <vers num="4.1.14"/>
        <vers num="4.1.16"/>
        <vers num="4.1.18"/>
        <vers num="4.1.2"/>
        <vers num="4.1.20"/>
        <vers num="4.1.22"/>
        <vers num="4.1.24"/>
        <vers num="4.1.26"/>
        <vers num="4.1.28"/>
        <vers prev="1" num="4.1.30"/>
        <vers num="4.1.4"/>
        <vers num="4.1.6"/>
        <vers num="4.1.8"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2442" published="2014-04-15" name="CVE-2014-2442" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:N/I:N/A:P)" CVSS_score="4.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.0" CVSS_base_score="4.0">
    <desc>
      <descript source="cve">Unspecified vulnerability in Oracle MySQL Server 5.6.15 and earlier allows remote authenticated users to affect availability via vectors related to MyISAM.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="mysql">
        <vers num="5.6.0"/>
        <vers num="5.6.1"/>
        <vers num="5.6.10"/>
        <vers num="5.6.11"/>
        <vers num="5.6.12"/>
        <vers num="5.6.13"/>
        <vers num="5.6.14"/>
        <vers prev="1" num="5.6.15"/>
        <vers num="5.6.2"/>
        <vers num="5.6.3"/>
        <vers num="5.6.4"/>
        <vers num="5.6.5"/>
        <vers num="5.6.6"/>
        <vers num="5.6.7"/>
        <vers num="5.6.8"/>
        <vers num="5.6.9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2443" published="2014-04-15" name="CVE-2014-2443" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Unspecified vulnerability in the PeopleSoft Enterprise PT PeopleTools component in Oracle PeopleSoft Products 8.52 and 8.53 allows remote attackers to affect integrity via vectors related to PIA Core Technology.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="peoplesoft_products">
        <vers num="8.52"/>
        <vers num="8.53"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2444" published="2014-04-15" name="CVE-2014-2444" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:P/I:P/A:P)" CVSS_score="6.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.0" CVSS_base_score="6.5">
    <desc>
      <descript source="cve">Unspecified vulnerability in Oracle MySQL Server 5.6.15 and earlier allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors related to InnoDB.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="mysql">
        <vers num="5.6.0"/>
        <vers num="5.6.1"/>
        <vers num="5.6.10"/>
        <vers num="5.6.11"/>
        <vers num="5.6.12"/>
        <vers num="5.6.13"/>
        <vers num="5.6.14"/>
        <vers prev="1" num="5.6.15"/>
        <vers num="5.6.2"/>
        <vers num="5.6.3"/>
        <vers num="5.6.4"/>
        <vers num="5.6.5"/>
        <vers num="5.6.6"/>
        <vers num="5.6.7"/>
        <vers num="5.6.8"/>
        <vers num="5.6.9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-2445" published="2014-04-15" name="CVE-2014-2445" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:S/C:N/I:P/A:N)" CVSS_score="3.5" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="6.8" CVSS_base_score="3.5">
    <desc>
      <descript source="cve">Unspecified vulnerability in the Oracle Agile PLM Framework component in Oracle Supply Chain Products Suite 9.3.3 allows remote authenticated users to affect integrity via unknown vectors related to Security, a different vulnerability than CVE-2014-2467.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="supply_chain_products_suite">
        <vers num="9.3.3"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2446" published="2014-04-15" name="CVE-2014-2446" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:P/I:N/A:N)" CVSS_score="4.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.0" CVSS_base_score="4.0">
    <desc>
      <descript source="cve">Unspecified vulnerability in the PeopleSoft Enterprise PT PeopleTools component in Oracle PeopleSoft Products 8.52 and 8.53 allows remote authenticated users to affect confidentiality via vectors related to QAS.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="peoplesoft_products">
        <vers num="8.52"/>
        <vers num="8.53"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2447" published="2014-04-15" name="CVE-2014-2447" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:N/A:N)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">Unspecified vulnerability in the PeopleSoft Enterprise PT PeopleTools component in Oracle PeopleSoft Products 8.52 and 8.53 allows remote attackers to affect confidentiality via unknown vectors related to Integration Broker, a different vulnerability than CVE-2014-2437.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="peoplesoft_products">
        <vers num="8.52"/>
        <vers num="8.53"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2448" published="2014-04-15" name="CVE-2014-2448" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:N/A:N)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">Unspecified vulnerability in the PeopleSoft Enterprise PT PeopleTools component in Oracle PeopleSoft Products 8.52 and 8.53 allows remote attackers to affect confidentiality via unknown vectors related to Install and Packaging.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="peoplesoft_products">
        <vers num="8.52"/>
        <vers num="8.53"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2449" published="2014-04-15" name="CVE-2014-2449" modified="2014-04-24" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:P/I:N/A:N)" CVSS_score="4.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.0" CVSS_base_score="4.0">
    <desc>
      <descript source="cve">Unspecified vulnerability in the PeopleSoft Enterprise HRMS Talent Acquisition Manager component in Oracle PeopleSoft Products 9.0, 9.1, and 9.2 allows remote authenticated users to affect confidentiality via unknown vectors related to Security.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="peoplesoft_products">
        <vers num="9.0"/>
        <vers num="9.1"/>
        <vers num="9.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2450" published="2014-04-15" name="CVE-2014-2450" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:N/I:N/A:P)" CVSS_score="4.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.0" CVSS_base_score="4.0">
    <desc>
      <descript source="cve">Unspecified vulnerability in Oracle MySQL Server 5.6.15 and earlier allows remote authenticated users to affect availability via unknown vectors related to Optimizer.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="mysql">
        <vers num="5.6.0"/>
        <vers num="5.6.1"/>
        <vers num="5.6.10"/>
        <vers num="5.6.11"/>
        <vers num="5.6.12"/>
        <vers num="5.6.13"/>
        <vers num="5.6.14"/>
        <vers prev="1" num="5.6.15"/>
        <vers num="5.6.2"/>
        <vers num="5.6.3"/>
        <vers num="5.6.4"/>
        <vers num="5.6.5"/>
        <vers num="5.6.6"/>
        <vers num="5.6.7"/>
        <vers num="5.6.8"/>
        <vers num="5.6.9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-2451" published="2014-04-15" name="CVE-2014-2451" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:S/C:N/I:N/A:P)" CVSS_score="3.5" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="6.8" CVSS_base_score="3.5">
    <desc>
      <descript source="cve">Unspecified vulnerability in Oracle MySQL Server 5.6.15 and earlier allows remote authenticated users to affect availability via unknown vectors related to Privileges.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="mysql">
        <vers num="5.6.0"/>
        <vers num="5.6.1"/>
        <vers num="5.6.10"/>
        <vers num="5.6.11"/>
        <vers num="5.6.12"/>
        <vers num="5.6.13"/>
        <vers num="5.6.14"/>
        <vers prev="1" num="5.6.15"/>
        <vers num="5.6.2"/>
        <vers num="5.6.3"/>
        <vers num="5.6.4"/>
        <vers num="5.6.5"/>
        <vers num="5.6.6"/>
        <vers num="5.6.7"/>
        <vers num="5.6.8"/>
        <vers num="5.6.9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2452" published="2014-04-15" name="CVE-2014-2452" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:N/I:N/A:P)" CVSS_score="4.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.0" CVSS_base_score="4.0">
    <desc>
      <descript source="cve">Unspecified vulnerability in the Oracle Access Manager component in Oracle Fusion Middleware 11.1.1.5 allows remote authenticated users to affect availability via unknown vectors related to Webserver Plugin.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="fusion_middleware">
        <vers num="11.1.1.5.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2453" published="2014-04-15" name="CVE-2014-2453" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Unspecified vulnerability in the Hyperion Common Admin component in Oracle Hyperion 11.1.2.2 and 11.1.2.3 allows remote attackers to affect integrity via unknown vectors related to User Interface.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="hyperion">
        <vers num="11.1.2.2"/>
        <vers num="11.1.2.3"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2454" published="2014-04-15" name="CVE-2014-2454" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Unspecified vulnerability in the Hyperion Common Admin component in Oracle Hyperion 11.1.2.2 and 11.1.2.3 allows remote attackers to affect confidentiality via unknown vectors related to User Interface.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="hyperion">
        <vers num="11.1.2.2"/>
        <vers num="11.1.2.3"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2455" published="2014-04-15" name="CVE-2014-2455" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:S/C:P/I:P/A:P)" CVSS_score="6.0" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="6.8" CVSS_base_score="6.0">
    <desc>
      <descript source="cve">Unspecified vulnerability in the Hyperion Common Admin component in Oracle Hyperion 11.1.2.2 and 11.1.2.3 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors related to User Interface.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="hyperion">
        <vers num="11.1.2.2"/>
        <vers num="11.1.2.3"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2457" published="2014-04-15" name="CVE-2014-2457" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Unspecified vulnerability in the Oracle Agile Product Lifecycle component in Oracle Supply Chain Products Suite 6.0 and 6.1.0 allows remote attackers to affect integrity via unknown vectors related to Install.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="supply_chain_products_suite">
        <vers num="6.0.0"/>
        <vers num="6.1.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2458" published="2014-04-15" name="CVE-2014-2458" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Unspecified vulnerability in the Oracle Agile Product Lifecycle component in Oracle Supply Chain Products Suite 6.1.0.3 and 6.1.1.3 allows remote attackers to affect integrity via unknown vectors related to Install.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="supply_chain_products_suite">
        <vers num="6.1.0.3"/>
        <vers num="6.1.1.3"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-2459" published="2014-04-15" name="CVE-2014-2459" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:L/AC:H/Au:N/C:P/I:P/A:P)" CVSS_score="3.7" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="1.9" CVSS_base_score="3.7">
    <desc>
      <descript source="cve">Unspecified vulnerability in the Oracle Transportation Management component in Oracle Supply Chain Products Suite 6.3.2 and 6.3.3 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Security.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="supply_chain_products_suite">
        <vers num="6.3.2"/>
        <vers num="6.3.3"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2460" published="2014-04-15" name="CVE-2014-2460" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:P/I:N/A:N)" CVSS_score="4.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.0" CVSS_base_score="4.0">
    <desc>
      <descript source="cve">Unspecified vulnerability in the Oracle Transportation Management component in Oracle Supply Chain Products Suite 5.5.06, 6.0, 6.1, 6.2, 6.3, 6.3.1, 6.3.2, and 6.3.3 allows remote authenticated users to affect confidentiality via vectors related to CSV Management.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="supply_chain_products_suite">
        <vers num="5.5.06"/>
        <vers num="6.0.0"/>
        <vers num="6.1.0"/>
        <vers num="6.1.2.0"/>
        <vers num="6.3.0"/>
        <vers num="6.3.1"/>
        <vers num="6.3.2"/>
        <vers num="6.3.3"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2461" published="2014-04-15" name="CVE-2014-2461" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:N/A:N)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">Unspecified vulnerability in the Oracle Transportation Management component in Oracle Supply Chain Products Suite 5.5.06, 6.0, 6.1, 6.2, 6.3, 6.3.1, 6.3.2, and 6.3.3 allows remote attackers to affect confidentiality via unknown vectors related to Security.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="supply_chain_products_suite">
        <vers num="5.5.06"/>
        <vers num="6.0.0"/>
        <vers num="6.1.0"/>
        <vers num="6.1.2.0"/>
        <vers num="6.3.0"/>
        <vers num="6.3.1"/>
        <vers num="6.3.2"/>
        <vers num="6.3.3"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2463" published="2014-04-15" name="CVE-2014-2463" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Unspecified vulnerability in the Oracle Secure Global Desktop (SGD) component in Oracle Virtualization 4.63, 4.71, 5.0, and 5.1 allows remote attackers to affect integrity via unknown vectors related to Workspace Web Application.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="virtualization">
        <vers num="4.63"/>
        <vers num="4.71"/>
        <vers num="5.0"/>
        <vers num="5.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-2464" published="2014-04-15" name="CVE-2014-2464" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:S/C:P/I:N/A:N)" CVSS_score="3.5" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="6.8" CVSS_base_score="3.5">
    <desc>
      <descript source="cve">Unspecified vulnerability in the Oracle Agile PLM Framework component in Oracle Supply Chain Products Suite 9.3.3.0 allows remote authenticated users to affect confidentiality via unknown vectors related to Security.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="supply_chain_products_suite">
        <vers num="9.3.3"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2465" published="2014-04-15" name="CVE-2014-2465" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Unspecified vulnerability in the Oracle Agile PLM Framework component in Oracle Supply Chain Products Suite 9.3.3 allows remote attackers to affect integrity via unknown vectors related to Security.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="supply_chain_products_suite">
        <vers num="9.3.3"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-2466" published="2014-04-15" name="CVE-2014-2466" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:H/Au:S/C:P/I:N/A:N)" CVSS_score="2.1" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="3.9" CVSS_base_score="2.1">
    <desc>
      <descript source="cve">Unspecified vulnerability in the Oracle Agile PLM Framework component in Oracle Supply Chain Products Suite 9.3.3 allows remote authenticated users to affect confidentiality via unknown vectors related to Security.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="supply_chain_products_suite">
        <vers num="9.3.3"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-2467" published="2014-04-15" name="CVE-2014-2467" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:S/C:N/I:P/A:N)" CVSS_score="3.5" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="6.8" CVSS_base_score="3.5">
    <desc>
      <descript source="cve">Unspecified vulnerability in the Oracle Agile PLM Framework component in Oracle Supply Chain Products Suite 9.3.3 allows remote authenticated users to affect integrity via unknown vectors related to Security, a different vulnerability than CVE-2014-2445.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="supply_chain_products_suite">
        <vers num="9.3.3"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2468" published="2014-04-15" name="CVE-2014-2468" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Unspecified vulnerability in the Siebel UI Framework component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect integrity via vectors related to Open_UI.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="siebel_crm">
        <vers num="8.1.1"/>
        <vers num="8.2.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2469" published="2014-04-17" name="CVE-2014-2469" modified="2014-04-18" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:P)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">Unspecified vulnerability in Lighthttpd in Oracle Solaris 11.1 allows attackers to cause a denial of service via unknown vectors.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://blogs.oracle.com/sunsecurity/entry/cve_2014_2469_denial_of" source="CONFIRM">https://blogs.oracle.com/sunsecurity/entry/cve_2014_2469_denial_of</ref>
      <ref url="http://www.securityfocus.com/bid/66599" source="BID">66599</ref>
      <ref url="http://www.osvdb.org/105298" source="OSVDB">105298</ref>
      <ref url="http://securitytracker.com/id?1029999" source="SECTRACK">1029999</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="sunos">
        <vers num="5.11.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2470" published="2014-04-15" name="CVE-2014-2470" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.0.2.0, 10.3.6.0, 12.1.1.0, and 12.1.2.0 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to WLS Security.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="fusion_middleware">
        <vers num="10.0.2"/>
        <vers num="10.3.6"/>
        <vers num="12.1.1"/>
        <vers num="12.1.2.0.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2471" published="2014-04-15" name="CVE-2014-2471" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Unspecified vulnerability in the Oracle iLearning component in Oracle iLearning 6.0 and 6.1 allows remote attackers to affect integrity via unknown vectors related to Learner Pages.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html" source="CONFIRM" adv="1">http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="ilearning">
        <vers num="6.0"/>
        <vers num="6.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2497" published="2014-03-21" name="CVE-2014-2497" modified="2014-03-27" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:N/A:P)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">The gdImageCreateFromXpm function in gdxpm.c in libgd, as used in PHP 5.4.26 and earlier, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted color table in an XPM file.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://bugzilla.redhat.com/show_bug.cgi?id=1076676" source="CONFIRM">https://bugzilla.redhat.com/show_bug.cgi?id=1076676</ref>
      <ref url="https://bugs.php.net/bug.php?id=66901" source="CONFIRM">https://bugs.php.net/bug.php?id=66901</ref>
    </refs>
    <vuln_soft>
      <prod vendor="php" name="php">
        <vers num="5.0.0" edition="beta1"/>
        <vers num="5.0.0" edition="beta2"/>
        <vers num="5.0.0" edition="beta3"/>
        <vers num="5.0.0" edition="beta4"/>
        <vers num="5.0.0" edition="rc1"/>
        <vers num="5.0.0" edition="rc2"/>
        <vers num="5.0.0" edition="rc3"/>
        <vers num="5.0.1"/>
        <vers num="5.0.2"/>
        <vers num="5.0.3"/>
        <vers num="5.0.4"/>
        <vers num="5.0.5"/>
        <vers num="5.1.0"/>
        <vers num="5.1.1"/>
        <vers num="5.1.2"/>
        <vers num="5.1.3"/>
        <vers num="5.1.4"/>
        <vers num="5.1.5"/>
        <vers num="5.1.6"/>
        <vers num="5.2.0"/>
        <vers num="5.2.1"/>
        <vers num="5.2.10"/>
        <vers num="5.2.11"/>
        <vers num="5.2.12"/>
        <vers num="5.2.13"/>
        <vers num="5.2.14"/>
        <vers num="5.2.15"/>
        <vers num="5.2.16"/>
        <vers num="5.2.17"/>
        <vers num="5.2.2"/>
        <vers num="5.2.3"/>
        <vers num="5.2.4"/>
        <vers num="5.2.5"/>
        <vers num="5.2.6"/>
        <vers num="5.2.7"/>
        <vers num="5.2.8"/>
        <vers num="5.2.9"/>
        <vers num="5.3.0"/>
        <vers num="5.3.1"/>
        <vers num="5.3.10"/>
        <vers num="5.3.11"/>
        <vers num="5.3.12"/>
        <vers num="5.3.13"/>
        <vers num="5.3.14"/>
        <vers num="5.3.15"/>
        <vers num="5.3.16"/>
        <vers num="5.3.17"/>
        <vers num="5.3.18"/>
        <vers num="5.3.19"/>
        <vers num="5.3.2"/>
        <vers num="5.3.20"/>
        <vers num="5.3.21"/>
        <vers num="5.3.22"/>
        <vers num="5.3.23"/>
        <vers num="5.3.24"/>
        <vers num="5.3.25"/>
        <vers num="5.3.26"/>
        <vers num="5.3.27"/>
        <vers num="5.3.3"/>
        <vers num="5.3.4"/>
        <vers num="5.3.5"/>
        <vers num="5.3.6"/>
        <vers num="5.3.7"/>
        <vers num="5.3.8"/>
        <vers num="5.3.9"/>
        <vers num="5.4.0"/>
        <vers num="5.4.1"/>
        <vers num="5.4.10"/>
        <vers num="5.4.11"/>
        <vers num="5.4.12" edition="rc1"/>
        <vers num="5.4.12" edition="rc2"/>
        <vers num="5.4.13" edition="rc1"/>
        <vers num="5.4.14" edition="rc1"/>
        <vers num="5.4.15" edition="rc1"/>
        <vers num="5.4.16" edition="rc1"/>
        <vers num="5.4.17"/>
        <vers num="5.4.18"/>
        <vers num="5.4.19"/>
        <vers num="5.4.2"/>
        <vers num="5.4.20"/>
        <vers num="5.4.21"/>
        <vers num="5.4.22"/>
        <vers num="5.4.23"/>
        <vers num="5.4.24"/>
        <vers num="5.4.25"/>
        <vers prev="1" num="5.4.26"/>
        <vers num="5.4.3"/>
        <vers num="5.4.4"/>
        <vers num="5.4.5"/>
        <vers num="5.4.6"/>
        <vers num="5.4.7"/>
        <vers num="5.4.8"/>
        <vers num="5.4.9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2522" published="2014-04-18" name="CVE-2014-2522" modified="2014-04-21" CVSS_version="2.0" CVSS_vector="(AV:N/AC:H/Au:N/C:P/I:P/A:N)" CVSS_score="4.0" CVSS_impact_subscore="4.9" CVSS_exploit_subscore="4.9" CVSS_base_score="4.0">
    <desc>
      <descript source="cve">curl and libcurl 7.27.0 through 7.35.0, when runnning on Windows and using the SChannel/Winssl TLS backend, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate when accessing a URL that uses a numerical IP address, which allows man-in-the-middle attackers to spoof servers via an arbitrary valid certificate.</descript>
    </desc>
    <loss_types>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://curl.haxx.se/docs/adv_20140326D.html" source="CONFIRM" patch="1" adv="1">http://curl.haxx.se/docs/adv_20140326D.html</ref>
      <ref url="http://www.securityfocus.com/bid/66296" source="BID">66296</ref>
      <ref url="http://www.getchef.com/blog/2014/04/09/enterprise-chef-11-1-3-release/" source="CONFIRM">http://www.getchef.com/blog/2014/04/09/enterprise-chef-11-1-3-release/</ref>
      <ref url="http://www.getchef.com/blog/2014/04/09/enterprise-chef-1-4-9-release/" source="CONFIRM">http://www.getchef.com/blog/2014/04/09/enterprise-chef-1-4-9-release/</ref>
      <ref url="http://www.getchef.com/blog/2014/04/09/chef-server-11-0-12-release/" source="CONFIRM">http://www.getchef.com/blog/2014/04/09/chef-server-11-0-12-release/</ref>
      <ref url="http://secunia.com/advisories/57968" source="SECUNIA" adv="1">57968</ref>
      <ref url="http://secunia.com/advisories/57966" source="SECUNIA" adv="1">57966</ref>
      <ref url="http://secunia.com/advisories/57836" source="SECUNIA" adv="1">57836</ref>
      <ref url="http://seclists.org/oss-sec/2014/q1/586" source="MLIST">[oss-security] 20140317 Re: CVE request: flaw in curl's Windows SSL backend</ref>
      <ref url="http://seclists.org/oss-sec/2014/q1/585" source="MLIST">[oss-security] 20140317 CVE request: flaw in curl's Windows SSL backend</ref>
    </refs>
    <vuln_soft>
      <prod vendor="haxx" name="curl">
        <vers num="7.27.0"/>
        <vers num="7.28.0"/>
        <vers num="7.28.1"/>
        <vers num="7.29.0"/>
        <vers num="7.30.0"/>
        <vers num="7.31.0"/>
        <vers num="7.32.0"/>
        <vers num="7.33.0"/>
        <vers num="7.34.0"/>
        <vers num="7.35.0"/>
      </prod>
      <prod vendor="haxx" name="libcurl">
        <vers num="7.27.0"/>
        <vers num="7.28.0"/>
        <vers num="7.28.1"/>
        <vers num="7.29.0"/>
        <vers num="7.30.0"/>
        <vers num="7.31.0"/>
        <vers num="7.32.0"/>
        <vers num="7.33.0"/>
        <vers num="7.34.0"/>
        <vers num="7.35.0"/>
        <vers num="7.36.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2523" published="2014-03-24" name="CVE-2014-2523" modified="2014-04-01" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:C/I:C/A:C)" CVSS_score="10.0" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="10.0" CVSS_base_score="10.0">
    <desc>
      <descript source="cve">net/netfilter/nf_conntrack_proto_dccp.c in the Linux kernel through 3.13.6 uses a DCCP header pointer incorrectly, which allows remote attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a DCCP packet that triggers a call to the (1) dccp_new, (2) dccp_packet, or (3) dccp_error function.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://github.com/torvalds/linux/commit/b22f5126a24b3b2f15448c3f2a254fc10cbc2b92" source="CONFIRM">https://github.com/torvalds/linux/commit/b22f5126a24b3b2f15448c3f2a254fc10cbc2b92</ref>
      <ref url="https://bugzilla.redhat.com/show_bug.cgi?id=1077343" source="CONFIRM">https://bugzilla.redhat.com/show_bug.cgi?id=1077343</ref>
      <ref url="http://xforce.iss.net/xforce/xfdb/91910" source="XF">linux-kernel-cve20142523-code-exec(91910)</ref>
      <ref url="http://www.securitytracker.com/id/1029945" source="SECTRACK">1029945</ref>
      <ref url="http://www.securityfocus.com/bid/66279" source="BID">66279</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/03/17/7" source="MLIST">[oss-security] 20140317 Re: CVE Request: netfilter: remote memory corruption in nf_conntrack_proto_dccp.c</ref>
      <ref url="http://twitter.com/grsecurity/statuses/445496197399461888" source="MISC" adv="1">http://twitter.com/grsecurity/statuses/445496197399461888</ref>
      <ref url="http://secunia.com/advisories/57446" source="SECUNIA">57446</ref>
      <ref url="http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=b22f5126a24b3b2f15448c3f2a254fc10cbc2b92" source="CONFIRM">http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=b22f5126a24b3b2f15448c3f2a254fc10cbc2b92</ref>
    </refs>
    <vuln_soft>
      <prod vendor="linux" name="linux_kernel">
        <vers num="3.0" edition="rc1"/>
        <vers num="3.0" edition="rc2"/>
        <vers num="3.0" edition="rc3"/>
        <vers num="3.0" edition="rc4"/>
        <vers num="3.0" edition="rc5"/>
        <vers num="3.0" edition="rc6"/>
        <vers num="3.0" edition="rc7"/>
        <vers num="3.0.1"/>
        <vers num="3.0.10"/>
        <vers num="3.0.11"/>
        <vers num="3.0.12"/>
        <vers num="3.0.13"/>
        <vers num="3.0.14"/>
        <vers num="3.0.15"/>
        <vers num="3.0.16"/>
        <vers num="3.0.17"/>
        <vers num="3.0.18"/>
        <vers num="3.0.19"/>
        <vers num="3.0.2"/>
        <vers num="3.0.20"/>
        <vers num="3.0.21"/>
        <vers num="3.0.22"/>
        <vers num="3.0.23"/>
        <vers num="3.0.24"/>
        <vers num="3.0.25"/>
        <vers num="3.0.26"/>
        <vers num="3.0.27"/>
        <vers num="3.0.28"/>
        <vers num="3.0.29"/>
        <vers num="3.0.3"/>
        <vers num="3.0.30"/>
        <vers num="3.0.31"/>
        <vers num="3.0.32"/>
        <vers num="3.0.33"/>
        <vers num="3.0.34"/>
        <vers num="3.0.35"/>
        <vers num="3.0.36"/>
        <vers num="3.0.37"/>
        <vers num="3.0.38"/>
        <vers num="3.0.39"/>
        <vers num="3.0.4"/>
        <vers num="3.0.40"/>
        <vers num="3.0.41"/>
        <vers num="3.0.42"/>
        <vers num="3.0.43"/>
        <vers num="3.0.44"/>
        <vers num="3.0.45"/>
        <vers num="3.0.46"/>
        <vers num="3.0.47"/>
        <vers num="3.0.48"/>
        <vers num="3.0.49"/>
        <vers num="3.0.5"/>
        <vers num="3.0.50"/>
        <vers num="3.0.51"/>
        <vers num="3.0.52"/>
        <vers num="3.0.53"/>
        <vers num="3.0.54"/>
        <vers num="3.0.55"/>
        <vers num="3.0.56"/>
        <vers num="3.0.57"/>
        <vers num="3.0.58"/>
        <vers num="3.0.59"/>
        <vers num="3.0.6"/>
        <vers num="3.0.60"/>
        <vers num="3.0.61"/>
        <vers num="3.0.62"/>
        <vers num="3.0.63"/>
        <vers num="3.0.64"/>
        <vers num="3.0.65"/>
        <vers num="3.0.66"/>
        <vers num="3.0.67"/>
        <vers num="3.0.68"/>
        <vers num="3.0.7"/>
        <vers num="3.0.8"/>
        <vers num="3.0.9"/>
        <vers num="3.1" edition="rc1"/>
        <vers num="3.1" edition="rc2"/>
        <vers num="3.1" edition="rc3"/>
        <vers num="3.1" edition="rc4"/>
        <vers num="3.1.1"/>
        <vers num="3.1.10"/>
        <vers num="3.1.2"/>
        <vers num="3.1.3"/>
        <vers num="3.1.4"/>
        <vers num="3.1.5"/>
        <vers num="3.1.6"/>
        <vers num="3.1.7"/>
        <vers num="3.1.8"/>
        <vers num="3.1.9"/>
        <vers num="3.10"/>
        <vers num="3.10.1"/>
        <vers num="3.10.10"/>
        <vers num="3.10.11"/>
        <vers num="3.10.12"/>
        <vers num="3.10.13"/>
        <vers num="3.10.14"/>
        <vers num="3.10.15"/>
        <vers num="3.10.16"/>
        <vers num="3.10.17"/>
        <vers num="3.10.18"/>
        <vers num="3.10.19"/>
        <vers num="3.10.2"/>
        <vers num="3.10.20"/>
        <vers num="3.10.21"/>
        <vers num="3.10.22"/>
        <vers num="3.10.23"/>
        <vers num="3.10.24"/>
        <vers num="3.10.25"/>
        <vers num="3.10.26"/>
        <vers num="3.10.27"/>
        <vers num="3.10.28"/>
        <vers num="3.10.29"/>
        <vers num="3.10.3"/>
        <vers num="3.10.4"/>
        <vers num="3.10.5"/>
        <vers num="3.10.6"/>
        <vers num="3.10.7"/>
        <vers num="3.10.8"/>
        <vers num="3.10.9"/>
        <vers num="3.11"/>
        <vers num="3.11.1"/>
        <vers num="3.11.10"/>
        <vers num="3.11.2"/>
        <vers num="3.11.3"/>
        <vers num="3.11.4"/>
        <vers num="3.11.5"/>
        <vers num="3.11.6"/>
        <vers num="3.11.7"/>
        <vers num="3.11.8"/>
        <vers num="3.11.9"/>
        <vers num="3.12"/>
        <vers num="3.12.1"/>
        <vers num="3.12.10"/>
        <vers num="3.12.11"/>
        <vers num="3.12.12"/>
        <vers num="3.12.13"/>
        <vers num="3.12.2"/>
        <vers num="3.12.3"/>
        <vers num="3.12.4"/>
        <vers num="3.12.5"/>
        <vers num="3.12.6"/>
        <vers num="3.12.7"/>
        <vers num="3.12.8"/>
        <vers num="3.12.9"/>
        <vers num="3.13"/>
        <vers num="3.13.1"/>
        <vers num="3.13.2"/>
        <vers num="3.13.3"/>
        <vers num="3.13.4"/>
        <vers num="3.13.5"/>
        <vers prev="1" num="3.13.6"/>
        <vers num="3.2" edition="rc2"/>
        <vers num="3.2" edition="rc3"/>
        <vers num="3.2" edition="rc4"/>
        <vers num="3.2" edition="rc5"/>
        <vers num="3.2" edition="rc6"/>
        <vers num="3.2" edition="rc7"/>
        <vers num="3.2.1"/>
        <vers num="3.2.10"/>
        <vers num="3.2.11"/>
        <vers num="3.2.12"/>
        <vers num="3.2.13"/>
        <vers num="3.2.14"/>
        <vers num="3.2.15"/>
        <vers num="3.2.16"/>
        <vers num="3.2.17"/>
        <vers num="3.2.18"/>
        <vers num="3.2.19"/>
        <vers num="3.2.2"/>
        <vers num="3.2.20"/>
        <vers num="3.2.21"/>
        <vers num="3.2.22"/>
        <vers num="3.2.23"/>
        <vers num="3.2.24"/>
        <vers num="3.2.25"/>
        <vers num="3.2.26"/>
        <vers num="3.2.27"/>
        <vers num="3.2.28"/>
        <vers num="3.2.29"/>
        <vers num="3.2.3"/>
        <vers num="3.2.30"/>
        <vers num="3.2.4"/>
        <vers num="3.2.5"/>
        <vers num="3.2.6"/>
        <vers num="3.2.7"/>
        <vers num="3.2.8"/>
        <vers num="3.2.9"/>
        <vers num="3.3" edition="rc1"/>
        <vers num="3.3" edition="rc2"/>
        <vers num="3.3" edition="rc3"/>
        <vers num="3.3" edition="rc4"/>
        <vers num="3.3" edition="rc5"/>
        <vers num="3.3" edition="rc6"/>
        <vers num="3.3" edition="rc7"/>
        <vers num="3.3.1"/>
        <vers num="3.3.2"/>
        <vers num="3.3.3"/>
        <vers num="3.3.4"/>
        <vers num="3.3.5"/>
        <vers num="3.3.6"/>
        <vers num="3.3.7"/>
        <vers num="3.3.8"/>
        <vers num="3.4" edition="rc1"/>
        <vers num="3.4" edition="rc2"/>
        <vers num="3.4" edition="rc3"/>
        <vers num="3.4" edition="rc4"/>
        <vers num="3.4" edition="rc5"/>
        <vers num="3.4" edition="rc6"/>
        <vers num="3.4" edition="rc7"/>
        <vers num="3.4.1"/>
        <vers num="3.4.10"/>
        <vers num="3.4.11"/>
        <vers num="3.4.12"/>
        <vers num="3.4.13"/>
        <vers num="3.4.14"/>
        <vers num="3.4.15"/>
        <vers num="3.4.16"/>
        <vers num="3.4.17"/>
        <vers num="3.4.18"/>
        <vers num="3.4.19"/>
        <vers num="3.4.2"/>
        <vers num="3.4.20"/>
        <vers num="3.4.21"/>
        <vers num="3.4.22"/>
        <vers num="3.4.23"/>
        <vers num="3.4.24"/>
        <vers num="3.4.25"/>
        <vers num="3.4.26"/>
        <vers num="3.4.27"/>
        <vers num="3.4.28"/>
        <vers num="3.4.29"/>
        <vers num="3.4.3"/>
        <vers num="3.4.30"/>
        <vers num="3.4.31"/>
        <vers num="3.4.32"/>
        <vers num="3.4.33"/>
        <vers num="3.4.34"/>
        <vers num="3.4.35"/>
        <vers num="3.4.36"/>
        <vers num="3.4.37"/>
        <vers num="3.4.38"/>
        <vers num="3.4.39"/>
        <vers num="3.4.4"/>
        <vers num="3.4.40"/>
        <vers num="3.4.41"/>
        <vers num="3.4.42"/>
        <vers num="3.4.43"/>
        <vers num="3.4.44"/>
        <vers num="3.4.45"/>
        <vers num="3.4.46"/>
        <vers num="3.4.47"/>
        <vers num="3.4.48"/>
        <vers num="3.4.49"/>
        <vers num="3.4.5"/>
        <vers num="3.4.50"/>
        <vers num="3.4.51"/>
        <vers num="3.4.52"/>
        <vers num="3.4.53"/>
        <vers num="3.4.54"/>
        <vers num="3.4.55"/>
        <vers num="3.4.56"/>
        <vers num="3.4.57"/>
        <vers num="3.4.58"/>
        <vers num="3.4.59"/>
        <vers num="3.4.6"/>
        <vers num="3.4.60"/>
        <vers num="3.4.61"/>
        <vers num="3.4.62"/>
        <vers num="3.4.63"/>
        <vers num="3.4.64"/>
        <vers num="3.4.65"/>
        <vers num="3.4.66"/>
        <vers num="3.4.67"/>
        <vers num="3.4.68"/>
        <vers num="3.4.69"/>
        <vers num="3.4.7"/>
        <vers num="3.4.70"/>
        <vers num="3.4.71"/>
        <vers num="3.4.72"/>
        <vers num="3.4.73"/>
        <vers num="3.4.74"/>
        <vers num="3.4.75"/>
        <vers num="3.4.76"/>
        <vers num="3.4.77"/>
        <vers num="3.4.78"/>
        <vers num="3.4.79"/>
        <vers num="3.4.8"/>
        <vers num="3.4.9"/>
        <vers num="3.5.1"/>
        <vers num="3.5.2"/>
        <vers num="3.5.3"/>
        <vers num="3.5.4"/>
        <vers num="3.5.5"/>
        <vers num="3.5.6"/>
        <vers num="3.5.7"/>
        <vers num="3.6"/>
        <vers num="3.6.1"/>
        <vers num="3.6.10"/>
        <vers num="3.6.11"/>
        <vers num="3.6.2"/>
        <vers num="3.6.3"/>
        <vers num="3.6.4"/>
        <vers num="3.6.5"/>
        <vers num="3.6.6"/>
        <vers num="3.6.7"/>
        <vers num="3.6.8"/>
        <vers num="3.6.9"/>
        <vers num="3.7"/>
        <vers num="3.7.1"/>
        <vers num="3.7.10"/>
        <vers num="3.7.2"/>
        <vers num="3.7.3"/>
        <vers num="3.7.4"/>
        <vers num="3.7.5"/>
        <vers num="3.7.6"/>
        <vers num="3.7.7"/>
        <vers num="3.7.8"/>
        <vers num="3.7.9"/>
        <vers num="3.8.0"/>
        <vers num="3.8.1"/>
        <vers num="3.8.10"/>
        <vers num="3.8.11"/>
        <vers num="3.8.12"/>
        <vers num="3.8.13"/>
        <vers num="3.8.2"/>
        <vers num="3.8.3"/>
        <vers num="3.8.4"/>
        <vers num="3.8.5"/>
        <vers num="3.8.6"/>
        <vers num="3.8.7"/>
        <vers num="3.8.8"/>
        <vers num="3.8.9"/>
        <vers num="3.9" edition="rc1"/>
        <vers num="3.9" edition="rc2"/>
        <vers num="3.9" edition="rc3"/>
        <vers num="3.9" edition="rc4"/>
        <vers num="3.9" edition="rc5"/>
        <vers num="3.9" edition="rc6"/>
        <vers num="3.9" edition="rc7"/>
        <vers num="3.9.0"/>
        <vers num="3.9.1"/>
        <vers num="3.9.10"/>
        <vers num="3.9.11"/>
        <vers num="3.9.2"/>
        <vers num="3.9.3"/>
        <vers num="3.9.4"/>
        <vers num="3.9.5"/>
        <vers num="3.9.6"/>
        <vers num="3.9.7"/>
        <vers num="3.9.8"/>
        <vers num="3.9.9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2525" published="2014-03-28" name="CVE-2014-2525" modified="2014-04-24" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:P)" CVSS_score="6.8" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.6" CVSS_base_score="6.8">
    <desc>
      <descript source="cve">Heap-based buffer overflow in the yaml_parser_scan_uri_escapes function in LibYAML before 0.1.6 allows context-dependent attackers to execute arbitrary code via a long sequence of percent-encoded characters in a URI in a YAML file.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.ocert.org/advisories/ocert-2014-003.html" source="MISC">http://www.ocert.org/advisories/ocert-2014-003.html</ref>
      <ref url="https://bitbucket.org/xi/libyaml/commits/bce8b60f0b9af69fa9fab3093d0a41ba243de048" source="CONFIRM" patch="1">https://bitbucket.org/xi/libyaml/commits/bce8b60f0b9af69fa9fab3093d0a41ba243de048</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2160-1" source="UBUNTU">USN-2160-1</ref>
      <ref url="http://www.getchef.com/blog/2014/04/09/enterprise-chef-11-1-3-release/" source="CONFIRM">http://www.getchef.com/blog/2014/04/09/enterprise-chef-11-1-3-release/</ref>
      <ref url="http://www.getchef.com/blog/2014/04/09/enterprise-chef-1-4-9-release/" source="CONFIRM">http://www.getchef.com/blog/2014/04/09/enterprise-chef-1-4-9-release/</ref>
      <ref url="http://www.getchef.com/blog/2014/04/09/chef-server-11-0-12-release/" source="CONFIRM">http://www.getchef.com/blog/2014/04/09/chef-server-11-0-12-release/</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2885" source="DEBIAN">DSA-2885</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2884" source="DEBIAN">DSA-2884</ref>
      <ref url="http://secunia.com/advisories/57968" source="SECUNIA">57968</ref>
      <ref url="http://secunia.com/advisories/57966" source="SECUNIA">57966</ref>
      <ref url="http://secunia.com/advisories/57836" source="SECUNIA">57836</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0355.html" source="REDHAT">RHSA-2014:0355</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0354.html" source="REDHAT">RHSA-2014:0354</ref>
      <ref url="http://rhn.redhat.com/errata/RHSA-2014-0353.html" source="REDHAT">RHSA-2014:0353</ref>
      <ref url="http://lists.opensuse.org/opensuse-updates/2014-04/msg00022.html" source="SUSE">openSUSE-SU-2014:0500</ref>
    </refs>
    <vuln_soft>
      <prod vendor="pyyaml" name="libyaml">
        <vers num="0.0.1"/>
        <vers num="0.1.1"/>
        <vers num="0.1.2"/>
        <vers num="0.1.3"/>
        <vers num="0.1.4"/>
        <vers prev="1" num="0.1.5"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2526" published="2014-03-25" name="CVE-2014-2526" modified="2014-03-26" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Multiple cross-site scripting (XSS) vulnerabilities in BarracudaDrive before 6.7 allow remote attackers to inject arbitrary web script or HTML via the (1) sForumName or (2) sDescription parameter to Forum/manage/ForumManager.lsp; (3) sHint, (4) sWord, or (5) nId parameter to Forum/manage/hangman.lsp; (6) user parameter to rtl/protected/admin/wizard/setuser.lsp; (7) name or (8) email parameter to feedback.lsp; (9) lname or (10) url parameter to private/manage/PageManager.lsp; (11) cmd parameter to fs; (12) newname, (13) description, (14) firstname, (15) lastname, or (16) id parameter to rtl/protected/mail/manage/list.lsp; or (17) PATH_INFO to fs/.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/91920" source="XF">barracudadrive-multiple-scripts-xss(91920)</ref>
      <ref url="http://secunia.com/advisories/57451" source="SECUNIA" adv="1">57451</ref>
      <ref url="http://secpod.org/blog/?p=2158" source="MISC">http://secpod.org/blog/?p=2158</ref>
      <ref url="http://secpod.org/advisories/SecPod_BarracudaDrive_Mult_XSS_Vuln.txt" source="MISC">http://secpod.org/advisories/SecPod_BarracudaDrive_Mult_XSS_Vuln.txt</ref>
      <ref url="http://packetstormsecurity.com/files/125766" source="MISC">http://packetstormsecurity.com/files/125766</ref>
      <ref url="http://barracudadrive.com/readme.txt" source="CONFIRM">http://barracudadrive.com/readme.txt</ref>
    </refs>
    <vuln_soft>
      <prod vendor="barracudadrive" name="barracudadrive">
        <vers num="3.4"/>
        <vers num="3.5"/>
        <vers num="3.6"/>
        <vers num="3.7"/>
        <vers num="3.7.2"/>
        <vers num="3.8"/>
        <vers num="3.9"/>
        <vers num="4.0"/>
        <vers num="4.0.1"/>
        <vers num="4.0.2"/>
        <vers num="4.1"/>
        <vers num="4.2"/>
        <vers num="4.3"/>
        <vers num="4.4"/>
        <vers num="4.4.1"/>
        <vers num="4.4.2"/>
        <vers num="4.4.3"/>
        <vers num="4.4.4"/>
        <vers num="4.4.5"/>
        <vers num="4.4.6"/>
        <vers num="4.4.7"/>
        <vers num="4.4.8"/>
        <vers num="4.5"/>
        <vers num="4.5.1"/>
        <vers num="4.5.2"/>
        <vers num="4.5.3"/>
        <vers num="4.5.4"/>
        <vers num="4.5.5"/>
        <vers num="4.6"/>
        <vers num="4.6.1"/>
        <vers num="4.7"/>
        <vers num="4.8"/>
        <vers num="4.8.4"/>
        <vers num="4.9"/>
        <vers num="4.9.1"/>
        <vers num="4.9.2"/>
        <vers num="5.0"/>
        <vers num="5.1"/>
        <vers num="5.2"/>
        <vers num="5.3"/>
        <vers num="6.0"/>
        <vers num="6.1"/>
        <vers num="6.2"/>
        <vers num="6.3"/>
        <vers num="6.4"/>
        <vers num="6.5"/>
        <vers prev="1" num="6.6"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2532" published="2014-03-18" name="CVE-2014-2532" modified="2014-04-19" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:N)" CVSS_score="5.8" CVSS_impact_subscore="4.9" CVSS_exploit_subscore="8.6" CVSS_base_score="5.8">
    <desc>
      <descript source="cve">sshd in OpenSSH before 6.6 does not properly support wildcards on AcceptEnv lines in sshd_config, which allows remote attackers to bypass intended environment restrictions by using a substring located before a wildcard character.</descript>
    </desc>
    <loss_types>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/91986" source="XF">openssh-cve20142532-sec-bypass(91986)</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2155-1" source="UBUNTU">USN-2155-1</ref>
      <ref url="http://www.securitytracker.com/id/1029925" source="SECTRACK">1029925</ref>
      <ref url="http://www.securityfocus.com/bid/66355" source="BID">66355</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2894" source="DEBIAN">DSA-2894</ref>
      <ref url="http://secunia.com/advisories/57574" source="SECUNIA">57574</ref>
      <ref url="http://secunia.com/advisories/57488" source="SECUNIA">57488</ref>
      <ref url="http://marc.info/?l=openbsd-security-announce&amp;m=139492048027313&amp;w=2" source="MLIST">[security-announce] 20140315 Announce: OpenSSH 6.6 released</ref>
    </refs>
    <vuln_soft>
      <prod vendor="openbsd" name="openssh">
        <vers num="6.0"/>
        <vers num="6.1"/>
        <vers num="6.2"/>
        <vers num="6.3"/>
        <vers num="6.4"/>
        <vers prev="1" num="6.5"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2533" published="2014-03-18" name="CVE-2014-2533" modified="2014-04-01" CVSS_version="2.0" CVSS_vector="(AV:L/AC:L/Au:N/C:C/I:C/A:C)" CVSS_score="7.2" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="3.9" CVSS_base_score="7.2">
    <desc>
      <descript source="cve">/sbin/ifwatchd in BlackBerry QNX Neutrino RTOS 6.4.x and 6.5.x allows local users to gain privileges by providing an arbitrary program name as a command-line argument.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="http://www.exploit-db.com/exploits/32153/" source="EXPLOIT-DB">32153</ref>
      <ref url="http://seclists.org/fulldisclosure/2014/Mar/98" source="FULLDISC">20140312 Medium severity flaw in BlackBerry QNX Neutrino RTOS</ref>
      <ref url="http://seclists.org/fulldisclosure/2014/Mar/124" source="FULLDISC">20140313 Re: Medium severity flaw in BlackBerry QNX Neutrino RTOS</ref>
      <ref url="http://seclists.org/bugtraq/2014/Mar/88" source="BUGTRAQ">20140313 Re: Medium severity flaw in BlackBerry QNX Neutrino RTOS</ref>
      <ref url="http://seclists.org/bugtraq/2014/Mar/66" source="BUGTRAQ">20140311 Medium severity flaw in BlackBerry QNX Neutrino RTOS</ref>
    </refs>
    <vuln_soft>
      <prod vendor="blackberry" name="qnx_neutrino_rtos">
        <vers num="6.4.1"/>
        <vers num="6.5.0" edition="sp1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2534" published="2014-03-18" name="CVE-2014-2534" modified="2014-04-01" CVSS_version="2.0" CVSS_vector="(AV:L/AC:L/Au:N/C:C/I:N/A:N)" CVSS_score="4.9" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="3.9" CVSS_base_score="4.9">
    <desc>
      <descript source="cve">/sbin/pppoectl in BlackBerry QNX Neutrino RTOS 6.4.x and 6.5.x allows local users to obtain sensitive information by reading "bad parameter" lines in error messages, as demonstrated by reading the root password hash in /etc/shadow.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="http://www.exploit-db.com/exploits/32156/" source="EXPLOIT-DB">32156</ref>
      <ref url="http://seclists.org/fulldisclosure/2014/Mar/98" source="FULLDISC">20140312 Medium severity flaw in BlackBerry QNX Neutrino RTOS</ref>
      <ref url="http://seclists.org/fulldisclosure/2014/Mar/124" source="FULLDISC">20140313 Re: Medium severity flaw in BlackBerry QNX Neutrino RTOS</ref>
      <ref url="http://seclists.org/bugtraq/2014/Mar/88" source="BUGTRAQ">20140313 Re: Medium severity flaw in BlackBerry QNX Neutrino RTOS</ref>
      <ref url="http://seclists.org/bugtraq/2014/Mar/66" source="BUGTRAQ">20140311 Medium severity flaw in BlackBerry QNX Neutrino RTOS</ref>
    </refs>
    <vuln_soft>
      <prod vendor="blackberry" name="qnx_neutrino_rtos">
        <vers num="6.4.1"/>
        <vers num="6.5.0" edition="sp1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2535" published="2014-03-18" name="CVE-2014-2535" modified="2014-04-01" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:P/I:N/A:N)" CVSS_score="4.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.0" CVSS_base_score="4.0">
    <desc>
      <descript source="cve">Directory traversal vulnerability in McAfee Web Gateway (MWG) 7.4.x before 7.4.1, 7.3.x before 7.3.2.6, and 7.2.0.9 and earlier allows remote authenticated users to read arbitrary files via a crafted request to the web filtering port.</descript>
    </desc>
    <impacts>
      <impact source="nvd">Per: https://kc.mcafee.com/corporate/index?page=content&amp;id=SB10063

"Affected versions

    MWG 7.4.0 (and earlier)
    MWG 7.3.2.4 (and earlier)
    MWG 7.2.0.9 (and earlier)"
</impact>
    </impacts>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://kc.mcafee.com/corporate/index?page=content&amp;id=SB10063" source="CONFIRM" adv="1">https://kc.mcafee.com/corporate/index?page=content&amp;id=SB10063</ref>
      <ref url="http://xforce.iss.net/xforce/xfdb/91772" source="XF">mcafee-gateway-filtering-dir-traversal(91772)</ref>
      <ref url="http://www.securityfocus.com/bid/66193" source="BID">66193</ref>
      <ref url="http://secunia.com/advisories/56958" source="SECUNIA" adv="1">56958</ref>
    </refs>
    <vuln_soft>
      <prod vendor="mcafee" name="web_gateway">
        <vers prev="1" num="7.2.0.9"/>
        <vers prev="1" num="7.3.2.4"/>
        <vers prev="1" num="7.4.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2536" published="2014-03-18" name="CVE-2014-2536" modified="2014-04-01" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:N/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Directory traversal vulnerability in McAfee Cloud Identity Manager 3.0, 3.1, and 3.5.1, McAfee Cloud Single Sign On (MCSSO) before 4.0.1, and Intel Expressway Cloud Access 360-SSO 2.1 and 2.5 allows remote authenticated users to read an unspecified file containing a hash of the administrator password via unknown vectors.</descript>
    </desc>
    <impacts>
      <impact source="nvd">Per: https://kc.mcafee.com/corporate/index?page=content&amp;id=SB10066

"Affected Versions:

    Intel Expressway Cloud Access 360-SSO 2.1, 2.5
    McAfee Cloud Identity Manager 3.0, 3.1, 3.5.1
    McAfee Cloud Single Sign On 4.0.0"</impact>
    </impacts>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://kc.mcafee.com/corporate/index?page=content&amp;id=SB10066" source="CONFIRM" adv="1">https://kc.mcafee.com/corporate/index?page=content&amp;id=SB10066</ref>
      <ref url="http://www.securityfocus.com/bid/66181" source="BID">66181</ref>
      <ref url="http://secunia.com/advisories/57381" source="SECUNIA" adv="1">57381</ref>
      <ref url="http://secunia.com/advisories/57368" source="SECUNIA" adv="1">57368</ref>
    </refs>
    <vuln_soft>
      <prod vendor="intel" name="expressway_cloud_access_360">
        <vers num="2.1"/>
        <vers num="2.5"/>
      </prod>
      <prod vendor="mcafee" name="cloud_identity_manager">
        <vers num="3.0"/>
        <vers num="3.1"/>
        <vers num="3.5.1"/>
      </prod>
      <prod vendor="mcafee" name="cloud_single_sign_on">
        <vers num="4.0.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2537" published="2014-03-18" name="CVE-2014-2537" modified="2014-04-01" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:C)" CVSS_score="7.8" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="10.0" CVSS_base_score="7.8">
    <desc>
      <descript source="cve">Memory leak in the TCP stack in the kernel in Sophos UTM before 9.109 allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://blogs.sophos.com/2014/02/20/utm-up2date-9-109/" source="CONFIRM" patch="1" adv="1">http://blogs.sophos.com/2014/02/20/utm-up2date-9-109/</ref>
      <ref url="http://www.securitytracker.com/id/1029920" source="SECTRACK">1029920</ref>
      <ref url="http://www.securityfocus.com/bid/66231" source="BID">66231</ref>
      <ref url="http://secunia.com/advisories/57344" source="SECUNIA" adv="1">57344</ref>
    </refs>
    <vuln_soft>
      <prod vendor="sophos" name="unified_threat_management_software">
        <vers num="8.3"/>
        <vers num="9.007"/>
        <vers num="9.107"/>
        <vers prev="1" num="9.108"/>
      </prod>
      <prod vendor="sophos" name="unified_threat_management">
        <vers num="110"/>
        <vers num="120"/>
        <vers num="220"/>
        <vers num="320"/>
        <vers num="425"/>
        <vers num="525"/>
        <vers num="625"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2538" published="2014-03-25" name="CVE-2014-2538" modified="2014-04-19" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in lib/rack/ssl.rb in the rack-ssl gem before 1.4.0 for Ruby allows remote attackers to inject arbitrary web script or HTML via a URI, which might not be properly handled by third-party adapters such as JRuby-Rack.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="https://github.com/josh/rack-ssl/commit/9d7d7300b907e496db68d89d07fbc2e0df0b487b" source="CONFIRM" patch="1">https://github.com/josh/rack-ssl/commit/9d7d7300b907e496db68d89d07fbc2e0df0b487b</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/03/19/20" source="MLIST">[oss-security] 20140319 Re: CVE Request: rack-ssl rubygem: XSS in error page</ref>
      <ref url="http://secunia.com/advisories/57466" source="SECUNIA" adv="1">57466</ref>
      <ref url="http://lists.opensuse.org/opensuse-updates/2014-04/msg00032.html" source="SUSE">openSUSE-SU-2014:0515</ref>
    </refs>
    <vuln_soft>
      <prod vendor="joshua_peek" name="rack-ssl">
        <vers num="1.0.0" edition=":~~~ruby~~"/>
        <vers num="1.1.0" edition=":~~~ruby~~"/>
        <vers num="1.2.0" edition=":~~~ruby~~"/>
        <vers num="1.3.0" edition=":~~~ruby~~"/>
        <vers num="1.3.1" edition=":~~~ruby~~"/>
        <vers num="1.3.2" edition=":~~~ruby~~"/>
        <vers num="1.3.3" edition=":~~~ruby~~"/>
        <vers prev="1" num="1.3.4" edition=":~~~ruby~~"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2540" published="2014-04-11" name="CVE-2014-2540" modified="2014-04-14" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">SQL injection vulnerability in OrbitScripts Orbit Open Ad Server before 1.1.1 allows remote attackers to execute arbitrary SQL commands via the site_directory_sort_field parameter to guest/site_directory.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://www.htbridge.com/advisory/HTB23208" source="MISC">https://www.htbridge.com/advisory/HTB23208</ref>
      <ref url="http://www.securityfocus.com/bid/66667" source="BID">66667</ref>
      <ref url="http://www.securityfocus.com/archive/1/archive/1/531781/100/0/threaded" source="BUGTRAQ">20140409 SQL Injection in Orbit Open Ad Server</ref>
      <ref url="http://www.exploit-db.com/exploits/32792" source="EXPLOIT-DB">32792</ref>
    </refs>
    <vuln_soft>
      <prod vendor="orbitscripts" name="orbit_open_ad_server">
        <vers prev="1" num="1.1.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2541" published="2014-04-08" name="CVE-2014-2541" modified="2014-04-09" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:N/A:N)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">The Rendezvous Daemon (rvd), Rendezvous Routing Daemon (rvrd), Rendezvous Secure Daemon (rvsd), and Rendezvous Secure Routing Daemon (rvsrd) in TIBCO Rendezvous before 8.4.2, Messaging Appliance before 8.7.1, and Substation ES before 2.8.1 do not properly implement access control, which allows remote attackers to obtain sensitive information or modify transmitted information via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.tibco.com/multimedia/rendezvous_advisory_20140408_tcm8-20763.txt" source="CONFIRM" adv="1">http://www.tibco.com/multimedia/rendezvous_advisory_20140408_tcm8-20763.txt</ref>
      <ref url="http://www.tibco.com/mk/advisory.jsp" source="CONFIRM" adv="1">http://www.tibco.com/mk/advisory.jsp</ref>
    </refs>
    <vuln_soft>
      <prod vendor="tibco" name="rendezvous">
        <vers num="7.4.11"/>
        <vers num="7.5.1"/>
        <vers num="7.5.2"/>
        <vers num="7.5.3"/>
        <vers num="7.5.4"/>
        <vers num="8.10"/>
        <vers num="8.2.1"/>
        <vers num="8.3.0"/>
        <vers num="8.3.1"/>
        <vers prev="1" num="8.4.1"/>
      </prod>
      <prod vendor="tibco" name="substantiation_es">
        <vers prev="1" num="2.8.0"/>
      </prod>
      <prod vendor="tibco" name="messaging_appliance">
        <vers prev="1" num="8.7.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2542" published="2014-04-08" name="CVE-2014-2542" modified="2014-04-09" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in the Rendezvous Daemon (rvd), Rendezvous Routing Daemon (rvrd), Rendezvous Secure Daemon (rvsd), and Rendezvous Secure Routing Daemon (rvsrd) in TIBCO Rendezvous before 8.4.2, Messaging Appliance before 8.7.1, and Substation ES before 2.8.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://www.tibco.com/multimedia/rendezvous_advisory_20140408_tcm8-20763.txt" source="CONFIRM" adv="1">http://www.tibco.com/multimedia/rendezvous_advisory_20140408_tcm8-20763.txt</ref>
      <ref url="http://www.tibco.com/mk/advisory.jsp" source="CONFIRM" adv="1">http://www.tibco.com/mk/advisory.jsp</ref>
    </refs>
    <vuln_soft>
      <prod vendor="tibco" name="rendezvous">
        <vers num="7.4.11"/>
        <vers num="7.5.1"/>
        <vers num="7.5.2"/>
        <vers num="7.5.3"/>
        <vers num="7.5.4"/>
        <vers num="8.10"/>
        <vers num="8.2.1"/>
        <vers num="8.3.0"/>
        <vers num="8.3.1"/>
        <vers prev="1" num="8.4.1"/>
      </prod>
      <prod vendor="tibco" name="substantiation_es">
        <vers prev="1" num="2.8.0"/>
      </prod>
      <prod vendor="tibco" name="messaging_appliance">
        <vers prev="1" num="8.7.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2543" published="2014-04-08" name="CVE-2014-2543" modified="2014-04-09" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">Buffer overflow in the Rendezvous Daemon (rvd), Rendezvous Routing Daemon (rvrd), Rendezvous Secure Daemon (rvsd), and Rendezvous Secure Routing Daemon (rvsrd) in TIBCO Rendezvous before 8.4.2, Messaging Appliance before 8.7.1, and Substation ES before 2.8.1 allows remote attackers to execute arbitrary code by leveraging access to a directly connected client and transmitting crafted data.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.tibco.com/multimedia/rendezvous_advisory_20140408_tcm8-20763.txt" source="CONFIRM" adv="1">http://www.tibco.com/multimedia/rendezvous_advisory_20140408_tcm8-20763.txt</ref>
      <ref url="http://www.tibco.com/mk/advisory.jsp" source="CONFIRM" adv="1">http://www.tibco.com/mk/advisory.jsp</ref>
    </refs>
    <vuln_soft>
      <prod vendor="tibco" name="rendezvous">
        <vers num="7.4.11"/>
        <vers num="7.5.1"/>
        <vers num="7.5.2"/>
        <vers num="7.5.3"/>
        <vers num="7.5.4"/>
        <vers num="8.10"/>
        <vers num="8.2.1"/>
        <vers num="8.3.0"/>
        <vers num="8.3.1"/>
        <vers prev="1" num="8.4.1"/>
      </prod>
      <prod vendor="tibco" name="substantiation_es">
        <vers prev="1" num="2.8.0"/>
      </prod>
      <prod vendor="tibco" name="messaging_appliance">
        <vers prev="1" num="8.7.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2544" published="2014-04-09" name="CVE-2014-2544" modified="2014-04-10" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">Unspecified vulnerability in Spotfire Web Player Engine, Spotfire Desktop, and Spotfire Server Authentication Module in TIBCO Spotfire Server 3.3.x before 3.3.4, 4.5.x before 4.5.1, 5.0.x before 5.0.2, 5.5.x before 5.5.1, and 6.x before 6.0.2; Spotfire Professional 4.0.x before 4.0.4, 4.5.x before 4.5.2, 5.0.x before 5.0.2, 5.5.x before 5.5.1, and 6.x before 6.0.1; Spotfire Web Player 4.0.x before 4.0.4, 4.5.x before 4.5.2, 5.0.x before 5.0.2, 5.5.x before 5.5.1, and 6.x before 6.0.1; Spotfire Automation Services 4.0.x before 4.0.4, 4.5.x before 4.5.2, 5.0.x before 5.0.2, 5.5.x before 5.5.1, and 6.x before 6.0.1; Spotfire Deployment Kit 4.0.x before 4.0.4, 4.5.x before 4.5.2, 5.0.x before 5.0.2, 5.5.x before 5.5.1, and 6.x before 6.0.1; Spotfire Desktop 6.x before 6.0.1; and Spotfire Analyst 6.x before 6.0.1 allows remote attackers to execute arbitrary code via unknown vectors.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.tibco.com/multimedia/spotfire_advisory_20140409_tcm8-20764.txt" source="CONFIRM" adv="1">http://www.tibco.com/multimedia/spotfire_advisory_20140409_tcm8-20764.txt</ref>
      <ref url="http://www.tibco.com/mk/advisory.jsp" source="CONFIRM" adv="1">http://www.tibco.com/mk/advisory.jsp</ref>
    </refs>
    <vuln_soft>
      <prod vendor="tibco" name="analyst">
        <vers prev="1" num="6.0.0"/>
      </prod>
      <prod vendor="tibco" name="automation_services">
        <vers prev="1" num="4.0.3"/>
        <vers num="4.5.0"/>
        <vers num="4.5.1"/>
        <vers num="5.0.0"/>
        <vers num="5.0.1"/>
        <vers num="5.5.0"/>
        <vers num="6.0.0"/>
      </prod>
      <prod vendor="tibco" name="deployment_kit">
        <vers prev="1" num="4.0.3"/>
        <vers num="4.5.0"/>
        <vers num="4.5.1"/>
        <vers num="5.0.0"/>
        <vers num="5.0.1"/>
        <vers num="5.5.0"/>
        <vers num="6.0.0"/>
      </prod>
      <prod vendor="tibco" name="desktop">
        <vers prev="1" num="6.0.0"/>
      </prod>
      <prod vendor="tibco" name="spotfire_professional">
        <vers prev="1" num="4.0.3"/>
        <vers num="4.5.0"/>
        <vers num="4.5.1"/>
        <vers num="5.0.0"/>
        <vers num="5.0.1"/>
        <vers num="5.5.0"/>
        <vers num="6.0.0"/>
      </prod>
      <prod vendor="tibco" name="spotfire_server">
        <vers prev="1" num="3.3.3"/>
        <vers num="4.5.0"/>
        <vers num="5.0.0"/>
        <vers num="5.0.1"/>
        <vers num="5.5.0"/>
        <vers num="6.0.0"/>
        <vers num="6.0.1"/>
      </prod>
      <prod vendor="tibco" name="web_player">
        <vers prev="1" num="4.0.3"/>
        <vers num="4.5.0"/>
        <vers num="4.5.1"/>
        <vers num="5.0.0"/>
        <vers num="5.0.1"/>
        <vers num="5.5.0"/>
        <vers num="6.0.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2545" published="2014-04-30" name="CVE-2014-2545" modified="2014-05-01" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:N/A:N)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">TIBCO Managed File Transfer Internet Server before 7.2.2, Managed File Transfer Command Center before 7.2.2, Slingshot before 1.9.1, and Vault before 1.0.1 allow remote attackers to obtain sensitive information via a crafted HTTP request.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.tibco.com/multimedia/mft_advisory_20140429_tcm8-21013.txt" source="CONFIRM" adv="1">http://www.tibco.com/multimedia/mft_advisory_20140429_tcm8-21013.txt</ref>
      <ref url="http://www.tibco.com/mk/advisory.jsp" source="CONFIRM" adv="1">http://www.tibco.com/mk/advisory.jsp</ref>
    </refs>
    <vuln_soft>
      <prod vendor="tibco" name="managed_file_transfer_command_center">
        <vers num="6.7"/>
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="7.1.0"/>
        <vers num="7.2.0"/>
        <vers prev="1" num="7.2.1"/>
      </prod>
      <prod vendor="tibco" name="managed_file_transfer_internet_server">
        <vers num="6.7"/>
        <vers num="7.0"/>
        <vers num="7.0.1"/>
        <vers num="7.1.0"/>
        <vers num="7.2.0"/>
        <vers prev="1" num="7.2.1"/>
      </prod>
      <prod vendor="tibco" name="slingshot">
        <vers num="1.7.0"/>
        <vers num="1.8.0"/>
        <vers num="1.8.1"/>
        <vers prev="1" num="1.9.0"/>
      </prod>
      <prod vendor="tibco" name="vault">
        <vers prev="1" num="1.0.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-2553" published="2014-04-02" name="CVE-2014-2553" modified="2014-04-02" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:S/C:N/I:P/A:N)" CVSS_score="3.5" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="6.8" CVSS_base_score="3.5">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) 3.1.x before 3.1.21, 3.2.x before 3.2.16, and 3.3.x before 3.3.6 allows remote authenticated users to inject arbitrary web script or HTML via vectors related to dynamic fields.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="https://www.otrs.com/security-advisory-2014-04-xss-issue" source="CONFIRM" adv="1">https://www.otrs.com/security-advisory-2014-04-xss-issue</ref>
      <ref url="http://secunia.com/advisories/57616" source="SECUNIA" adv="1">57616</ref>
    </refs>
    <vuln_soft>
      <prod vendor="otrs" name="otrs">
        <vers num="3.1.0"/>
        <vers num="3.1.1"/>
        <vers num="3.1.10"/>
        <vers num="3.1.11"/>
        <vers num="3.1.13"/>
        <vers num="3.1.14"/>
        <vers num="3.1.15"/>
        <vers num="3.1.16"/>
        <vers num="3.1.17"/>
        <vers num="3.1.18"/>
        <vers num="3.1.19"/>
        <vers num="3.1.2"/>
        <vers num="3.1.20"/>
        <vers num="3.1.3"/>
        <vers num="3.1.4"/>
        <vers num="3.1.5"/>
        <vers num="3.1.6"/>
        <vers num="3.1.7"/>
        <vers num="3.1.8"/>
        <vers num="3.1.9"/>
        <vers num="3.2.0" edition="beta1"/>
        <vers num="3.2.0" edition="beta2"/>
        <vers num="3.2.0" edition="beta3"/>
        <vers num="3.2.0" edition="beta4"/>
        <vers num="3.2.0" edition="beta5"/>
        <vers num="3.2.0" edition="rc1"/>
        <vers num="3.2.1"/>
        <vers num="3.2.10"/>
        <vers num="3.2.11"/>
        <vers num="3.2.12"/>
        <vers num="3.2.13"/>
        <vers num="3.2.14"/>
        <vers num="3.2.15"/>
        <vers num="3.2.2"/>
        <vers num="3.2.3"/>
        <vers num="3.2.4"/>
        <vers num="3.2.5"/>
        <vers num="3.2.6"/>
        <vers num="3.2.7"/>
        <vers num="3.2.8"/>
        <vers num="3.2.9"/>
        <vers num="3.3.0" edition="beta1"/>
        <vers num="3.3.0" edition="beta2"/>
        <vers num="3.3.0" edition="beta3"/>
        <vers num="3.3.0" edition="beta4"/>
        <vers num="3.3.0" edition="beta5"/>
        <vers num="3.3.0" edition="rc1"/>
        <vers num="3.3.1"/>
        <vers num="3.3.2"/>
        <vers num="3.3.3"/>
        <vers num="3.3.4"/>
        <vers num="3.3.5"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2554" published="2014-04-23" name="CVE-2014-2554" modified="2014-04-24" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">OTRS 3.1.x before 3.1.21, 3.2.x before 3.2.16, and 3.3.x before 3.3.6 allows remote attackers to conduct clickjacking attacks via an IFRAME element.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://www.otrs.com/security-advisory-2014-05-clickjacking-issue/" source="CONFIRM" adv="1">http://www.otrs.com/security-advisory-2014-05-clickjacking-issue/</ref>
      <ref url="http://lists.opensuse.org/opensuse-updates/2014-04/msg00062.html" source="SUSE">openSUSE-SU-2014:0561</ref>
    </refs>
    <vuln_soft>
      <prod vendor="otrs" name="otrs">
        <vers num="3.1.0"/>
        <vers num="3.1.1"/>
        <vers num="3.1.10"/>
        <vers num="3.1.11"/>
        <vers num="3.1.13"/>
        <vers num="3.1.14"/>
        <vers num="3.1.15"/>
        <vers num="3.1.16"/>
        <vers num="3.1.17"/>
        <vers num="3.1.18"/>
        <vers num="3.1.19"/>
        <vers num="3.1.2"/>
        <vers num="3.1.20"/>
        <vers num="3.1.3"/>
        <vers num="3.1.4"/>
        <vers num="3.1.5"/>
        <vers num="3.1.6"/>
        <vers num="3.1.7"/>
        <vers num="3.1.8"/>
        <vers num="3.2.0" edition="beta1"/>
        <vers num="3.2.0" edition="beta2"/>
        <vers num="3.2.0" edition="beta3"/>
        <vers num="3.2.0" edition="beta4"/>
        <vers num="3.2.0" edition="beta5"/>
        <vers num="3.2.0" edition="rc1"/>
        <vers num="3.2.1"/>
        <vers num="3.2.10"/>
        <vers num="3.2.11"/>
        <vers num="3.2.12"/>
        <vers num="3.2.13"/>
        <vers num="3.2.14"/>
        <vers num="3.2.15"/>
        <vers num="3.2.2"/>
        <vers num="3.2.3"/>
        <vers num="3.2.4"/>
        <vers num="3.2.5"/>
        <vers num="3.2.6"/>
        <vers num="3.3.0" edition="beta1"/>
        <vers num="3.3.0" edition="beta2"/>
        <vers num="3.3.0" edition="beta3"/>
        <vers num="3.3.0" edition="beta4"/>
        <vers num="3.3.0" edition="beta5"/>
        <vers num="3.3.0" edition="rc1"/>
        <vers num="3.3.1"/>
        <vers num="3.3.2"/>
        <vers num="3.3.3"/>
        <vers num="3.3.4"/>
        <vers num="3.3.5"/>
      </prod>
      <prod vendor="novell" name="opensuse">
        <vers num="12.3"/>
        <vers num="13.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2565" published="2014-04-30" name="CVE-2014-2565" modified="2014-05-01" CVSS_version="2.0" CVSS_vector="(AV:A/AC:H/Au:S/C:C/I:C/A:C)" CVSS_score="6.5" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="2.5" CVSS_base_score="6.5">
    <desc>
      <descript source="cve">The commandline interface in Blue Coat Content Analysis System (CAS) 1.1 before 1.1.4.2 allows remote administrators to execute arbitrary commands via unspecified vectors, related to "command injection."</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <local_network/>
    </range>
    <refs>
      <ref url="https://kb.bluecoat.com/index?page=content&amp;id=SA78&amp;actp=LIST" source="CONFIRM" adv="1">https://kb.bluecoat.com/index?page=content&amp;id=SA78&amp;actp=LIST</ref>
    </refs>
    <vuln_soft>
      <prod vendor="bluecoat" name="content_analysis_system_software">
        <vers num="1.1"/>
        <vers num="1.1.1.1"/>
        <vers prev="1" num="1.1.2.1"/>
      </prod>
      <prod vendor="bluecoat" name="content_analysis_system">
        <vers num="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2567" published="2014-03-21" name="CVE-2014-2567" modified="2014-03-25" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">The OpenConnectionTask::handleStateHelper function in Imap/Tasks/OpenConnectionTask.cpp in Trojita before 0.4.1 allows man-in-the-middle attackers to trigger use of cleartext for saving a message into a (1) sent or (2) draft folder via a PREAUTH response that prevents later use of the STARTTLS command.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="https://github.com/jktjkt/trojita/commit/25fffa3e25cbad85bbca804193ad336b090a9ce1" source="CONFIRM">https://github.com/jktjkt/trojita/commit/25fffa3e25cbad85bbca804193ad336b090a9ce1</ref>
      <ref url="http://jkt.flaska.net/blog/Trojita_0_4_1__a_security_update_for_CVE_2014_2567.html" source="CONFIRM" adv="1">http://jkt.flaska.net/blog/Trojita_0_4_1__a_security_update_for_CVE_2014_2567.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="trojita_project" name="trojita">
        <vers num="0.1"/>
        <vers num="0.2"/>
        <vers num="0.2.9"/>
        <vers num="0.2.9.1"/>
        <vers num="0.2.9.2"/>
        <vers num="0.2.9.3"/>
        <vers num="0.2.9.4"/>
        <vers num="0.3"/>
        <vers num="0.3.90"/>
        <vers num="0.3.91"/>
        <vers num="0.3.92"/>
        <vers num="0.3.93"/>
        <vers num="0.3.96"/>
        <vers prev="1" num="0.4"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-2568" published="2014-03-24" name="CVE-2014-2568" modified="2014-04-01" CVSS_version="2.0" CVSS_vector="(AV:A/AC:M/Au:N/C:P/I:N/A:N)" CVSS_score="2.9" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="5.5" CVSS_base_score="2.9">
    <desc>
      <descript source="cve">Use-after-free vulnerability in the nfqnl_zcopy function in net/netfilter/nfnetlink_queue_core.c in the Linux kernel through 3.13.6 allows attackers to obtain sensitive information from kernel memory by leveraging the absence of a certain orphaning operation. NOTE: the affected code was moved to the skb_zerocopy function in net/core/skbuff.c before the vulnerability was announced.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <local_network/>
    </range>
    <refs>
      <ref url="http://www.openwall.com/lists/oss-security/2014/03/20/16" source="MLIST" patch="1">[oss-security] 20140320 Re: CVE request -- kernel: net: potential information leak when ubuf backed skbs are skb_zerocopy()ied</ref>
      <ref url="https://lkml.org/lkml/2014/3/20/421" source="MLIST">[linux-kernel] 20140320 [PATCH v3] core, nfqueue, openvswitch: Orphan frags in skb_zerocopy and handle errors</ref>
      <ref url="https://bugzilla.redhat.com/show_bug.cgi?id=1079012" source="CONFIRM">https://bugzilla.redhat.com/show_bug.cgi?id=1079012</ref>
      <ref url="http://xforce.iss.net/xforce/xfdb/91922" source="XF">linux-kernel-cve20142568-info-disclosure(91922)</ref>
      <ref url="http://www.securityfocus.com/bid/66348" source="BID">66348</ref>
      <ref url="http://seclists.org/oss-sec/2014/q1/627" source="MLIST">[oss-sec] 20140320 CVE request -- kernel: net: potential information leak when ubuf backed skbs are skb_zerocopy()ied</ref>
    </refs>
    <vuln_soft>
      <prod vendor="linux" name="linux_kernel">
        <vers num="3.0" edition="rc1"/>
        <vers num="3.0" edition="rc2"/>
        <vers num="3.0" edition="rc3"/>
        <vers num="3.0" edition="rc4"/>
        <vers num="3.0" edition="rc5"/>
        <vers num="3.0" edition="rc6"/>
        <vers num="3.0" edition="rc7"/>
        <vers num="3.0.1"/>
        <vers num="3.0.10"/>
        <vers num="3.0.11"/>
        <vers num="3.0.12"/>
        <vers num="3.0.13"/>
        <vers num="3.0.14"/>
        <vers num="3.0.15"/>
        <vers num="3.0.16"/>
        <vers num="3.0.17"/>
        <vers num="3.0.18"/>
        <vers num="3.0.19"/>
        <vers num="3.0.2"/>
        <vers num="3.0.20"/>
        <vers num="3.0.21"/>
        <vers num="3.0.22"/>
        <vers num="3.0.23"/>
        <vers num="3.0.24"/>
        <vers num="3.0.25"/>
        <vers num="3.0.26"/>
        <vers num="3.0.27"/>
        <vers num="3.0.28"/>
        <vers num="3.0.29"/>
        <vers num="3.0.3"/>
        <vers num="3.0.30"/>
        <vers num="3.0.31"/>
        <vers num="3.0.32"/>
        <vers num="3.0.33"/>
        <vers num="3.0.34"/>
        <vers num="3.0.35"/>
        <vers num="3.0.36"/>
        <vers num="3.0.37"/>
        <vers num="3.0.38"/>
        <vers num="3.0.39"/>
        <vers num="3.0.4"/>
        <vers num="3.0.40"/>
        <vers num="3.0.41"/>
        <vers num="3.0.42"/>
        <vers num="3.0.43"/>
        <vers num="3.0.44"/>
        <vers num="3.0.45"/>
        <vers num="3.0.46"/>
        <vers num="3.0.47"/>
        <vers num="3.0.48"/>
        <vers num="3.0.49"/>
        <vers num="3.0.5"/>
        <vers num="3.0.50"/>
        <vers num="3.0.51"/>
        <vers num="3.0.52"/>
        <vers num="3.0.53"/>
        <vers num="3.0.54"/>
        <vers num="3.0.55"/>
        <vers num="3.0.56"/>
        <vers num="3.0.57"/>
        <vers num="3.0.58"/>
        <vers num="3.0.59"/>
        <vers num="3.0.6"/>
        <vers num="3.0.60"/>
        <vers num="3.0.61"/>
        <vers num="3.0.62"/>
        <vers num="3.0.63"/>
        <vers num="3.0.64"/>
        <vers num="3.0.65"/>
        <vers num="3.0.66"/>
        <vers num="3.0.67"/>
        <vers num="3.0.68"/>
        <vers num="3.0.7"/>
        <vers num="3.0.8"/>
        <vers num="3.0.9"/>
        <vers num="3.1" edition="rc1"/>
        <vers num="3.1" edition="rc2"/>
        <vers num="3.1" edition="rc3"/>
        <vers num="3.1" edition="rc4"/>
        <vers num="3.1.1"/>
        <vers num="3.1.10"/>
        <vers num="3.1.2"/>
        <vers num="3.1.3"/>
        <vers num="3.1.4"/>
        <vers num="3.1.5"/>
        <vers num="3.1.6"/>
        <vers num="3.1.7"/>
        <vers num="3.1.8"/>
        <vers num="3.1.9"/>
        <vers num="3.10"/>
        <vers num="3.10.1"/>
        <vers num="3.10.10"/>
        <vers num="3.10.11"/>
        <vers num="3.10.12"/>
        <vers num="3.10.13"/>
        <vers num="3.10.14"/>
        <vers num="3.10.15"/>
        <vers num="3.10.16"/>
        <vers num="3.10.17"/>
        <vers num="3.10.18"/>
        <vers num="3.10.19"/>
        <vers num="3.10.2"/>
        <vers num="3.10.20"/>
        <vers num="3.10.21"/>
        <vers num="3.10.22"/>
        <vers num="3.10.23"/>
        <vers num="3.10.24"/>
        <vers num="3.10.25"/>
        <vers num="3.10.26"/>
        <vers num="3.10.27"/>
        <vers num="3.10.28"/>
        <vers num="3.10.29"/>
        <vers num="3.10.3"/>
        <vers num="3.10.4"/>
        <vers num="3.10.5"/>
        <vers num="3.10.6"/>
        <vers num="3.10.7"/>
        <vers num="3.10.8"/>
        <vers num="3.10.9"/>
        <vers num="3.11"/>
        <vers num="3.11.1"/>
        <vers num="3.11.10"/>
        <vers num="3.11.2"/>
        <vers num="3.11.3"/>
        <vers num="3.11.4"/>
        <vers num="3.11.5"/>
        <vers num="3.11.6"/>
        <vers num="3.11.7"/>
        <vers num="3.11.8"/>
        <vers num="3.11.9"/>
        <vers num="3.12"/>
        <vers num="3.12.1"/>
        <vers num="3.12.10"/>
        <vers num="3.12.11"/>
        <vers num="3.12.12"/>
        <vers num="3.12.13"/>
        <vers num="3.12.2"/>
        <vers num="3.12.3"/>
        <vers num="3.12.4"/>
        <vers num="3.12.5"/>
        <vers num="3.12.6"/>
        <vers num="3.12.7"/>
        <vers num="3.12.8"/>
        <vers num="3.12.9"/>
        <vers num="3.13"/>
        <vers num="3.13.1"/>
        <vers num="3.13.2"/>
        <vers num="3.13.3"/>
        <vers num="3.13.4"/>
        <vers num="3.13.5"/>
        <vers prev="1" num="3.13.6"/>
        <vers num="3.2" edition="rc2"/>
        <vers num="3.2" edition="rc3"/>
        <vers num="3.2" edition="rc4"/>
        <vers num="3.2" edition="rc5"/>
        <vers num="3.2" edition="rc6"/>
        <vers num="3.2" edition="rc7"/>
        <vers num="3.2.1"/>
        <vers num="3.2.10"/>
        <vers num="3.2.11"/>
        <vers num="3.2.12"/>
        <vers num="3.2.13"/>
        <vers num="3.2.14"/>
        <vers num="3.2.15"/>
        <vers num="3.2.16"/>
        <vers num="3.2.17"/>
        <vers num="3.2.18"/>
        <vers num="3.2.19"/>
        <vers num="3.2.2"/>
        <vers num="3.2.20"/>
        <vers num="3.2.21"/>
        <vers num="3.2.22"/>
        <vers num="3.2.23"/>
        <vers num="3.2.24"/>
        <vers num="3.2.25"/>
        <vers num="3.2.26"/>
        <vers num="3.2.27"/>
        <vers num="3.2.28"/>
        <vers num="3.2.29"/>
        <vers num="3.2.3"/>
        <vers num="3.2.30"/>
        <vers num="3.2.4"/>
        <vers num="3.2.5"/>
        <vers num="3.2.6"/>
        <vers num="3.2.7"/>
        <vers num="3.2.8"/>
        <vers num="3.2.9"/>
        <vers num="3.3" edition="rc1"/>
        <vers num="3.3" edition="rc2"/>
        <vers num="3.3" edition="rc3"/>
        <vers num="3.3" edition="rc4"/>
        <vers num="3.3" edition="rc5"/>
        <vers num="3.3" edition="rc6"/>
        <vers num="3.3" edition="rc7"/>
        <vers num="3.3.1"/>
        <vers num="3.3.2"/>
        <vers num="3.3.3"/>
        <vers num="3.3.4"/>
        <vers num="3.3.5"/>
        <vers num="3.3.6"/>
        <vers num="3.3.7"/>
        <vers num="3.3.8"/>
        <vers num="3.4" edition="rc1"/>
        <vers num="3.4" edition="rc2"/>
        <vers num="3.4" edition="rc3"/>
        <vers num="3.4" edition="rc4"/>
        <vers num="3.4" edition="rc5"/>
        <vers num="3.4" edition="rc6"/>
        <vers num="3.4" edition="rc7"/>
        <vers num="3.4.1"/>
        <vers num="3.4.10"/>
        <vers num="3.4.11"/>
        <vers num="3.4.12"/>
        <vers num="3.4.13"/>
        <vers num="3.4.14"/>
        <vers num="3.4.15"/>
        <vers num="3.4.16"/>
        <vers num="3.4.17"/>
        <vers num="3.4.18"/>
        <vers num="3.4.19"/>
        <vers num="3.4.2"/>
        <vers num="3.4.20"/>
        <vers num="3.4.21"/>
        <vers num="3.4.22"/>
        <vers num="3.4.23"/>
        <vers num="3.4.24"/>
        <vers num="3.4.25"/>
        <vers num="3.4.26"/>
        <vers num="3.4.27"/>
        <vers num="3.4.28"/>
        <vers num="3.4.29"/>
        <vers num="3.4.3"/>
        <vers num="3.4.30"/>
        <vers num="3.4.31"/>
        <vers num="3.4.32"/>
        <vers num="3.4.33"/>
        <vers num="3.4.34"/>
        <vers num="3.4.35"/>
        <vers num="3.4.36"/>
        <vers num="3.4.37"/>
        <vers num="3.4.38"/>
        <vers num="3.4.39"/>
        <vers num="3.4.4"/>
        <vers num="3.4.40"/>
        <vers num="3.4.41"/>
        <vers num="3.4.42"/>
        <vers num="3.4.43"/>
        <vers num="3.4.44"/>
        <vers num="3.4.45"/>
        <vers num="3.4.46"/>
        <vers num="3.4.47"/>
        <vers num="3.4.48"/>
        <vers num="3.4.49"/>
        <vers num="3.4.5"/>
        <vers num="3.4.50"/>
        <vers num="3.4.51"/>
        <vers num="3.4.52"/>
        <vers num="3.4.53"/>
        <vers num="3.4.54"/>
        <vers num="3.4.55"/>
        <vers num="3.4.56"/>
        <vers num="3.4.57"/>
        <vers num="3.4.58"/>
        <vers num="3.4.59"/>
        <vers num="3.4.6"/>
        <vers num="3.4.60"/>
        <vers num="3.4.61"/>
        <vers num="3.4.62"/>
        <vers num="3.4.63"/>
        <vers num="3.4.64"/>
        <vers num="3.4.65"/>
        <vers num="3.4.66"/>
        <vers num="3.4.67"/>
        <vers num="3.4.68"/>
        <vers num="3.4.69"/>
        <vers num="3.4.7"/>
        <vers num="3.4.70"/>
        <vers num="3.4.71"/>
        <vers num="3.4.72"/>
        <vers num="3.4.73"/>
        <vers num="3.4.74"/>
        <vers num="3.4.75"/>
        <vers num="3.4.76"/>
        <vers num="3.4.77"/>
        <vers num="3.4.78"/>
        <vers num="3.4.79"/>
        <vers num="3.4.8"/>
        <vers num="3.4.9"/>
        <vers num="3.5.1"/>
        <vers num="3.5.2"/>
        <vers num="3.5.3"/>
        <vers num="3.5.4"/>
        <vers num="3.5.5"/>
        <vers num="3.5.6"/>
        <vers num="3.5.7"/>
        <vers num="3.6"/>
        <vers num="3.6.1"/>
        <vers num="3.6.10"/>
        <vers num="3.6.11"/>
        <vers num="3.6.2"/>
        <vers num="3.6.3"/>
        <vers num="3.6.4"/>
        <vers num="3.6.5"/>
        <vers num="3.6.6"/>
        <vers num="3.6.7"/>
        <vers num="3.6.8"/>
        <vers num="3.6.9"/>
        <vers num="3.7"/>
        <vers num="3.7.1"/>
        <vers num="3.7.10"/>
        <vers num="3.7.2"/>
        <vers num="3.7.3"/>
        <vers num="3.7.4"/>
        <vers num="3.7.5"/>
        <vers num="3.7.6"/>
        <vers num="3.7.7"/>
        <vers num="3.7.8"/>
        <vers num="3.7.9"/>
        <vers num="3.8.0"/>
        <vers num="3.8.1"/>
        <vers num="3.8.10"/>
        <vers num="3.8.11"/>
        <vers num="3.8.12"/>
        <vers num="3.8.13"/>
        <vers num="3.8.2"/>
        <vers num="3.8.3"/>
        <vers num="3.8.4"/>
        <vers num="3.8.5"/>
        <vers num="3.8.6"/>
        <vers num="3.8.7"/>
        <vers num="3.8.8"/>
        <vers num="3.8.9"/>
        <vers num="3.9" edition="rc1"/>
        <vers num="3.9" edition="rc2"/>
        <vers num="3.9" edition="rc3"/>
        <vers num="3.9" edition="rc4"/>
        <vers num="3.9" edition="rc5"/>
        <vers num="3.9" edition="rc6"/>
        <vers num="3.9" edition="rc7"/>
        <vers num="3.9.0"/>
        <vers num="3.9.1"/>
        <vers num="3.9.10"/>
        <vers num="3.9.11"/>
        <vers num="3.9.2"/>
        <vers num="3.9.3"/>
        <vers num="3.9.4"/>
        <vers num="3.9.5"/>
        <vers num="3.9.6"/>
        <vers num="3.9.7"/>
        <vers num="3.9.8"/>
        <vers num="3.9.9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-2571" published="2014-03-24" name="CVE-2014-2571" modified="2014-03-24" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:S/C:N/I:P/A:N)" CVSS_score="3.5" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="6.8" CVSS_base_score="3.5">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in the quiz_question_tostring function in mod/quiz/editlib.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 allows remote authenticated users to inject arbitrary web script or HTML via a quiz question.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="https://moodle.org/mod/forum/discuss.php?d=256416" source="CONFIRM" adv="1">https://moodle.org/mod/forum/discuss.php?d=256416</ref>
      <ref url="http://openwall.com/lists/oss-security/2014/03/17/1" source="MLIST">[oss-security] 20140317 Moodle security notifications public</ref>
      <ref url="http://git.moodle.org/gw?p=moodle.git&amp;a=search&amp;h=HEAD&amp;st=commit&amp;s=MDL-43690" source="CONFIRM">http://git.moodle.org/gw?p=moodle.git&amp;a=search&amp;h=HEAD&amp;st=commit&amp;s=MDL-43690</ref>
    </refs>
    <vuln_soft>
      <prod vendor="moodle" name="moodle">
        <vers num="2.0"/>
        <vers num="2.0.1"/>
        <vers num="2.0.2"/>
        <vers num="2.0.3"/>
        <vers num="2.0.4"/>
        <vers num="2.0.5"/>
        <vers num="2.0.6"/>
        <vers num="2.0.7"/>
        <vers num="2.0.8"/>
        <vers num="2.0.9"/>
        <vers num="2.1"/>
        <vers num="2.1.1"/>
        <vers num="2.1.10"/>
        <vers num="2.1.2"/>
        <vers num="2.1.3"/>
        <vers num="2.1.4"/>
        <vers num="2.1.5"/>
        <vers num="2.1.6"/>
        <vers num="2.1.7"/>
        <vers num="2.1.8"/>
        <vers num="2.1.9"/>
        <vers num="2.2"/>
        <vers num="2.2.1"/>
        <vers num="2.2.10"/>
        <vers num="2.2.11"/>
        <vers num="2.2.2"/>
        <vers num="2.2.3"/>
        <vers num="2.2.4"/>
        <vers num="2.2.5"/>
        <vers num="2.2.6"/>
        <vers num="2.2.7"/>
        <vers num="2.2.8"/>
        <vers num="2.2.9"/>
        <vers num="2.3"/>
        <vers num="2.3.1"/>
        <vers num="2.3.10"/>
        <vers prev="1" num="2.3.11"/>
        <vers num="2.3.2"/>
        <vers num="2.3.3"/>
        <vers num="2.3.4"/>
        <vers num="2.3.5"/>
        <vers num="2.3.6"/>
        <vers num="2.3.7"/>
        <vers num="2.3.8"/>
        <vers num="2.3.9"/>
        <vers num="2.4"/>
        <vers num="2.4.1"/>
        <vers num="2.4.2"/>
        <vers num="2.4.3"/>
        <vers num="2.4.4"/>
        <vers num="2.4.5"/>
        <vers num="2.4.6"/>
        <vers num="2.4.7"/>
        <vers num="2.4.8"/>
        <vers num="2.5"/>
        <vers num="2.5.1"/>
        <vers num="2.5.2"/>
        <vers num="2.5.3"/>
        <vers num="2.5.4"/>
        <vers num="2.6"/>
        <vers num="2.6.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2572" published="2014-03-24" name="CVE-2014-2572" modified="2014-03-24" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:N/I:P/A:N)" CVSS_score="4.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.0" CVSS_base_score="4.0">
    <desc>
      <descript source="cve">mod/assign/externallib.php in Moodle 2.6.x before 2.6.2 does not properly handle assignment web-service parameters, which might allow remote authenticated users to modify grade metadata via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://moodle.org/mod/forum/discuss.php?d=256425" source="CONFIRM" adv="1">https://moodle.org/mod/forum/discuss.php?d=256425</ref>
      <ref url="http://openwall.com/lists/oss-security/2014/03/17/1" source="MLIST">[oss-security] 20140317 Moodle security notifications public</ref>
      <ref url="http://git.moodle.org/gw?p=moodle.git&amp;a=search&amp;h=HEAD&amp;st=commit&amp;s=MDL-43468" source="CONFIRM">http://git.moodle.org/gw?p=moodle.git&amp;a=search&amp;h=HEAD&amp;st=commit&amp;s=MDL-43468</ref>
    </refs>
    <vuln_soft>
      <prod vendor="moodle" name="moodle">
        <vers num="2.6"/>
        <vers num="2.6.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-2573" published="2014-03-25" name="CVE-2014-2573" modified="2014-03-26" CVSS_version="2.0" CVSS_vector="(AV:A/AC:M/Au:S/C:N/I:N/A:P)" CVSS_score="2.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="4.4" CVSS_base_score="2.3">
    <desc>
      <descript source="cve">The VMWare driver in OpenStack Compute (Nova) 2013.2 through 2013.2.2 does not properly put VMs into RESCUE status, which allows remote authenticated users to bypass the quota limit and cause a denial of service (resource consumption) by requesting the VM be put into rescue and then deleting the image.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <local_network/>
    </range>
    <refs>
      <ref url="https://bugs.launchpad.net/nova/+bug/1269418" source="CONFIRM">https://bugs.launchpad.net/nova/+bug/1269418</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/03/21/2" source="MLIST">[oss-security] 20140321 Re: CVE request for vulnerability in OpenStack Nova</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/03/21/1" source="MLIST">[oss-security] 20140321 CVE request for vulnerability in OpenStack Nova</ref>
      <ref url="http://secunia.com/advisories/57498" source="SECUNIA" adv="1">57498</ref>
    </refs>
    <vuln_soft>
      <prod vendor="openstack" name="compute">
        <vers num="2013.2"/>
        <vers num="2013.2.1"/>
        <vers num="2013.2.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2578" published="2014-04-02" name="CVE-2014-2578" modified="2014-04-02" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in Splunk Web in Splunk before 5.0.8 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/92126" source="XF">splunk-cve20142578-xss(92126)</ref>
      <ref url="http://www.splunk.com/view/SP-CAAAKQX" source="CONFIRM" adv="1">http://www.splunk.com/view/SP-CAAAKQX</ref>
      <ref url="http://www.securitytracker.com/id/1029966" source="SECTRACK">1029966</ref>
      <ref url="http://secunia.com/advisories/57554" source="SECUNIA" adv="1">57554</ref>
    </refs>
    <vuln_soft>
      <prod vendor="splunk" name="splunk">
        <vers num="5.0"/>
        <vers num="5.0.1"/>
        <vers num="5.0.2"/>
        <vers num="5.0.3"/>
        <vers num="5.0.4"/>
        <vers num="5.0.5"/>
        <vers num="5.0.6"/>
        <vers prev="1" num="5.0.7"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2579" published="2014-04-25" name="CVE-2014-2579" modified="2014-04-28" CVSS_version="2.0" CVSS_vector="(AV:N/AC:H/Au:N/C:C/I:C/A:C)" CVSS_score="7.6" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="4.9" CVSS_base_score="7.6">
    <desc>
      <descript source="cve">Multiple cross-site request forgery (CSRF) vulnerabilities in XCloner Standalone 3.5 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) change the administrator password via the config task to index2.php or (2) when the enable_db_backup and sql_mem options are enabled, access the database backup functionality via the dbbackup_comp parameter in the generate action to index2.php.  NOTE: vector 2 might be a duplicate of CVE-2014-2340, which is for the XCloner Wordpress plugin.  NOTE: remote attackers can leverage CVE-2014-2996 with vector 2 to execute arbitrary commands.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://www.htbridge.com/advisory/HTB23207" source="MISC">https://www.htbridge.com/advisory/HTB23207</ref>
      <ref url="http://www.securityfocus.com/archive/1/archive/1/531780/100/0/threaded" source="BUGTRAQ">20140409 &amp;ETH;&amp;iexcl;ross-Site Request Forgery (CSRF) in XCloner Standalone</ref>
      <ref url="http://www.exploit-db.com/exploits/32790" source="EXPLOIT-DB">32790</ref>
    </refs>
    <vuln_soft>
      <prod vendor="xcloner" name="xcloner">
        <vers prev="1" num="3.5" edition=":standalone"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2580" published="2014-04-15" name="CVE-2014-2580" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:L/AC:M/Au:S/C:N/I:N/A:C)" CVSS_score="4.4" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="2.7" CVSS_base_score="4.4">
    <desc>
      <descript source="cve">The netback driver in Xen, when using certain Linux versions that do not allow sleeping in softirq context, allows local guest administrators to cause a denial of service ("scheduling while atomic" error and host crash) via a malformed packet, which causes a mutex to be taken when trying to disable the interface.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="http://xenbits.xen.org/xsa/advisory-90.html" source="CONFIRM" patch="1" adv="1">http://xenbits.xen.org/xsa/advisory-90.html</ref>
      <ref url="http://www.securitytracker.com/id/1029949" source="SECTRACK">1029949</ref>
      <ref url="http://www.securityfocus.com/bid/66386" source="BID">66386</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/03/24/8" source="MLIST">[oss-security] 20140324 Re: Xen Security Advisory 90 - Linux netback crash trying to disable due to malformed packet</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/03/24/6" source="MLIST">[oss-security] 20140324 Xen Security Advisory 90 - Linux netback crash trying to disable due to malformed packet</ref>
    </refs>
    <vuln_soft>
      <prod vendor="xen" name="xen">
        <vers num="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2583" published="2014-04-10" name="CVE-2014-2583" modified="2014-04-11" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:N)" CVSS_score="5.8" CVSS_impact_subscore="4.9" CVSS_exploit_subscore="8.6" CVSS_base_score="5.8">
    <desc>
      <descript source="cve">Multiple directory traversal vulnerabilities in pam_timestamp.c in the pam_timestamp module for Linux-PAM (aka pam) 1.1.8 allow local users to create aribitrary files or possibly bypass authentication via a .. (dot dot) in the (1) PAM_RUSER value to the get_ruser function or (2) PAM_TTY value to the check_tty funtion, which is used by the format_timestamp_name function.</descript>
    </desc>
    <loss_types>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://git.fedorahosted.org/cgit/linux-pam.git/commit/?id=Linux-PAM-1_1_8-32-g9dcead8" source="CONFIRM" patch="1">https://git.fedorahosted.org/cgit/linux-pam.git/commit/?id=Linux-PAM-1_1_8-32-g9dcead8</ref>
      <ref url="http://www.securityfocus.com/bid/66493" source="BID">66493</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/03/31/6" source="MLIST">[oss-security] 20140331 Re: pam_timestamp internals</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/03/26/10" source="MLIST">[oss-security] 20140326 Re: pam_timestamp internals</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/03/24/5" source="MLIST">[oss-security] 20140324 pam_timestamp internals</ref>
      <ref url="http://secunia.com/advisories/57317" source="SECUNIA" adv="1">57317</ref>
    </refs>
    <vuln_soft>
      <prod vendor="kernel" name="linux-pam">
        <vers num="1.1.8"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2585" published="2014-03-24" name="CVE-2014-2585" modified="2014-03-24" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:S/C:P/I:P/A:N)" CVSS_score="4.9" CVSS_impact_subscore="4.9" CVSS_exploit_subscore="6.8" CVSS_base_score="4.9">
    <desc>
      <descript source="cve">ownCloud before 5.0.15 and 6.x before 6.0.2, when the file_external app is enabled, allows remote authenticated users to mount the local filesystem in the user's ownCloud via the mount configuration.</descript>
    </desc>
    <loss_types>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://owncloud.org/about/security/advisories/oC-SA-2014-008/" source="CONFIRM" adv="1">http://owncloud.org/about/security/advisories/oC-SA-2014-008/</ref>
    </refs>
    <vuln_soft>
      <prod vendor="owncloud" name="owncloud">
        <vers num="5.0.0"/>
        <vers num="5.0.1"/>
        <vers num="5.0.10"/>
        <vers num="5.0.11"/>
        <vers num="5.0.12"/>
        <vers num="5.0.13"/>
        <vers prev="1" num="5.0.14" edition="a"/>
        <vers num="5.0.2"/>
        <vers num="5.0.3"/>
        <vers num="5.0.4"/>
        <vers num="5.0.5"/>
        <vers num="5.0.6"/>
        <vers num="5.0.7"/>
        <vers num="5.0.8"/>
        <vers num="5.0.9"/>
        <vers num="6.0.0"/>
        <vers num="6.0.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2586" published="2014-03-24" name="CVE-2014-2586" modified="2014-03-24" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in the login audit form in McAfee Cloud Single Sign On (SSO) allows remote attackers to inject arbitrary web script or HTML via a crafted password.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="https://twitter.com/BrandonPrry/status/445969380656943104" source="MISC">https://twitter.com/BrandonPrry/status/445969380656943104</ref>
      <ref url="http://www.securityfocus.com/bid/66302" source="BID">66302</ref>
      <ref url="http://www.exploit-db.com/exploits/32368" source="EXPLOIT-DB">32368</ref>
      <ref url="http://seclists.org/fulldisclosure/2014/Mar/325" source="FULLDISC">20140318 McAfee Cloud SSO and McAfee Asset Manager vulns</ref>
      <ref url="http://packetstormsecurity.com/files/125775/McAfee-Cloud-SSO-Asset-Manager-Issues.html" source="MISC">http://packetstormsecurity.com/files/125775/McAfee-Cloud-SSO-Asset-Manager-Issues.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="mcafee" name="cloud_single_sign_on">
        <vers num="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2587" published="2014-03-24" name="CVE-2014-2587" modified="2014-04-01" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:P/I:P/A:P)" CVSS_score="6.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.0" CVSS_base_score="6.5">
    <desc>
      <descript source="cve">SQL injection vulnerability in jsp/reports/ReportsAudit.jsp in McAfee Asset Manager 6.6 allows remote authenticated users to execute arbitrary SQL commands via the username of an audit report (aka user parameter).</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/91929" source="XF">mcafee-asset-reportsaudit-sql-injection(91929)</ref>
      <ref url="http://www.securitytracker.com/id/1029927" source="SECTRACK">1029927</ref>
      <ref url="http://www.securityfocus.com/bid/66302" source="BID">66302</ref>
      <ref url="http://www.osvdb.org/104634" source="OSVDB">104634</ref>
      <ref url="http://www.exploit-db.com/exploits/32368" source="EXPLOIT-DB">32368</ref>
      <ref url="http://seclists.org/fulldisclosure/2014/Mar/325" source="FULLDISC">20140318 McAfee Cloud SSO and McAfee Asset Manager vulns</ref>
      <ref url="http://packetstormsecurity.com/files/125775/McAfee-Cloud-SSO-Asset-Manager-Issues.html" source="MISC">http://packetstormsecurity.com/files/125775/McAfee-Cloud-SSO-Asset-Manager-Issues.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="mcafee" name="asset_manager">
        <vers num="6.6"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2588" published="2014-03-24" name="CVE-2014-2588" modified="2014-04-01" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:P/I:N/A:N)" CVSS_score="4.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.0" CVSS_base_score="4.0">
    <desc>
      <descript source="cve">Directory traversal vulnerability in servlet/downloadReport in McAfee Asset Manager 6.6 allows remote authenticated users to read arbitrary files via a .. (dot dot) in the reportFileName parameter.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/91930" source="XF">mcafee-asset-dir-traversal(91930)</ref>
      <ref url="http://www.securitytracker.com/id/1029927" source="SECTRACK">1029927</ref>
      <ref url="http://www.securityfocus.com/bid/66302" source="BID">66302</ref>
      <ref url="http://www.osvdb.org/104633" source="OSVDB">104633</ref>
      <ref url="http://www.exploit-db.com/exploits/32368" source="EXPLOIT-DB">32368</ref>
      <ref url="http://seclists.org/fulldisclosure/2014/Mar/325" source="FULLDISC">20140318 McAfee Cloud SSO and McAfee Asset Manager vulns</ref>
      <ref url="http://packetstormsecurity.com/files/125775/McAfee-Cloud-SSO-Asset-Manager-Issues.html" source="MISC">http://packetstormsecurity.com/files/125775/McAfee-Cloud-SSO-Asset-Manager-Issues.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="mcafee" name="asset_manager">
        <vers num="6.6"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2589" published="2014-03-24" name="CVE-2014-2589" modified="2014-03-24" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in the Dashboard Backend service (stats/dashboard.jsp) in SonicWall Network Security Appliance (NSA) 2400 allows remote attackers to inject arbitrary web script or HTML via the sn parameter.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/91766" source="XF">sonicwall-nsa-dashboard-xss(91766)</ref>
      <ref url="http://www.vulnerability-lab.com/get_content.php?id=1100" source="MISC">http://www.vulnerability-lab.com/get_content.php?id=1100</ref>
      <ref url="http://www.securitytracker.com/id/1029884" source="SECTRACK">1029884</ref>
      <ref url="http://www.securityfocus.com/bid/66042" source="BID">66042</ref>
      <ref url="http://www.securityfocus.com/archive/1/archive/1/531364/100/0/threaded" source="BUGTRAQ">20140306 SonicWall Dashboard Backend Server - Client Side Cross Site Scripting Web Vulnerability</ref>
      <ref url="http://www.osvdb.org/104089" source="OSVDB">104089</ref>
      <ref url="http://secunia.com/advisories/57275" source="SECUNIA" adv="1">57275</ref>
    </refs>
    <vuln_soft>
      <prod vendor="dell" name="sonicwall_network_security_appliance_2400">
        <vers num="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2590" published="2014-04-01" name="CVE-2014-2590" modified="2014-04-01" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:P)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">The web management interface in Siemens RuggedCom ROS before 3.11, ROS 3.11 before 3.11.5 for RS950G, ROS 3.12, and ROS 4.0 for RSG2488 allows remote attackers to cause a denial of service (interface outage) via crafted HTTP packets.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://ics-cert.us-cert.gov/advisories/ICSA-14-087-01" source="MISC">http://ics-cert.us-cert.gov/advisories/ICSA-14-087-01</ref>
      <ref url="http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-831997.pdf" source="CONFIRM" adv="1">http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-831997.pdf</ref>
    </refs>
    <vuln_soft>
      <prod vendor="siemens" name="ruggedcom_rugged_operating_system">
        <vers num="3.10.1"/>
        <vers num="3.11" edition=":~~~~rs950g~"/>
        <vers num="3.12"/>
        <vers num="3.2.5"/>
        <vers num="3.3.6"/>
        <vers num="3.4.9"/>
        <vers num="3.5.4"/>
        <vers num="3.6.6"/>
        <vers num="3.7.9"/>
        <vers num="3.8.5"/>
        <vers num="3.9.3"/>
        <vers num="4.0" edition=":~~~~rsg2488~"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2597" published="2014-04-18" name="CVE-2014-2597" modified="2014-04-21" CVSS_version="2.0" CVSS_vector="(AV:L/AC:L/Au:N/C:N/I:N/A:C)" CVSS_score="4.9" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="3.9" CVSS_base_score="4.9">
    <desc>
      <descript source="cve">PCNetSoftware RAC Server 4.0.4 and 4.0.5 allows local users to cause a denial of service (disabled keyboard or crash) via a large input buffer to unspecified IOCTL requests in RACDriver.sys, which triggers a buffer over-read.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-2597/" source="MISC">https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-2597/</ref>
      <ref url="http://secunia.com/advisories/58090" source="SECUNIA" adv="1">58090</ref>
      <ref url="http://seclists.org/fulldisclosure/2014/Apr/221" source="FULLDISC">20140416 CVE-2014-2597 - Denial of Service in PCNetSoftware RAC Server</ref>
    </refs>
    <vuln_soft>
      <prod vendor="remote-rac" name="rac_server">
        <vers num="4.0.4"/>
        <vers num="4.0.5"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2599" published="2014-03-28" name="CVE-2014-2599" modified="2014-03-31" CVSS_version="2.0" CVSS_vector="(AV:L/AC:L/Au:N/C:N/I:N/A:C)" CVSS_score="4.9" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="3.9" CVSS_base_score="4.9">
    <desc>
      <descript source="cve">The HVMOP_set_mem_access HVM control operations in Xen 4.1.x for 32-bit and 4.1.x through 4.4.x for 64-bit allow local guest administrators to cause a denial of service (CPU consumption) by leveraging access to certain service domains for HVM guests and a large input.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="http://xenbits.xen.org/xsa/advisory-89.html" source="CONFIRM" patch="1" adv="1">http://xenbits.xen.org/xsa/advisory-89.html</ref>
      <ref url="http://www.securitytracker.com/id/1029956" source="SECTRACK">1029956</ref>
      <ref url="http://www.securityfocus.com/bid/66407" source="BID">66407</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/03/25/2" source="MLIST">[oss-security] 20140325 Re: Xen Security Advisory 89 - HVMOP_set_mem_access is not preemptible</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/03/25/1" source="MLIST">[oss-security] 20140325 Xen Security Advisory 89 - HVMOP_set_mem_access is not preemptible</ref>
    </refs>
    <vuln_soft>
      <prod vendor="xen" name="xen">
        <vers num="4.1.0" edition=":~~x86~~~"/>
        <vers num="4.1.1" edition=":~~x86~~~"/>
        <vers num="4.1.2" edition=":~~x86~~~"/>
        <vers num="4.1.3" edition=":~~x86~~~"/>
        <vers num="4.1.4" edition=":~~x86~~~"/>
        <vers num="4.1.5" edition=":~~x86~~~"/>
        <vers num="4.1.6.1" edition=":~~x86~~~"/>
        <vers num="4.2.0"/>
        <vers num="4.2.1"/>
        <vers num="4.2.2"/>
        <vers num="4.2.3"/>
        <vers num="4.3.0"/>
        <vers num="4.3.1"/>
        <vers num="4.3.2"/>
        <vers num="4.4.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2600" published="2014-04-05" name="CVE-2014-2600" modified="2014-04-07" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:N/I:N/A:P)" CVSS_score="4.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.0" CVSS_base_score="4.0">
    <desc>
      <descript source="cve">Unspecified vulnerability in HP IceWall Identity Manager 4.0 through SP1 and 5.0 and IceWall SSO 10.0 Password Reset Option, when Apache Commons FileUpload is used, allows remote authenticated users to cause a denial of service via unknown vectors.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://h20565.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?docId=emr_na-c04214298" source="HP" adv="1">SSRT101450</ref>
      <ref url="http://h20565.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?docId=emr_na-c04214298" source="HP" adv="1">HPSBGN02986</ref>
    </refs>
    <vuln_soft>
      <prod vendor="hp" name="icewall_identity_manager">
        <vers num="4.0" edition="sp1"/>
        <vers num="5.0"/>
      </prod>
      <prod vendor="hp" name="icewall_sso_password_reset_option">
        <vers num="10.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2601" published="2014-04-24" name="CVE-2014-2601" modified="2014-04-25" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:C)" CVSS_score="7.8" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="10.0" CVSS_base_score="7.8">
    <desc>
      <descript source="cve">The server in HP Integrated Lights-Out 2 (aka iLO 2) 2.23 and earlier allows remote attackers to cause a denial of service via crafted HTTPS traffic, as demonstrated by traffic from a CVE-2014-0160 vulnerability-assessment tool.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04244787" source="HP" patch="1" adv="1">SSRT101509</ref>
      <ref url="https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04244787" source="HP" patch="1" adv="1">HPSBHF03006</ref>
    </refs>
    <vuln_soft>
      <prod vendor="hp" name="integrated_lights-out_2_firmware">
        <vers num="1.00"/>
        <vers num="1.10"/>
        <vers num="1.20"/>
        <vers num="1.30"/>
        <vers num="1.70"/>
        <vers num="1.75"/>
        <vers num="2.12"/>
        <vers num="2.15"/>
        <vers num="2.20"/>
        <vers num="2.22"/>
        <vers prev="1" num="2.23"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2653" published="2014-03-27" name="CVE-2014-2653" modified="2014-04-19" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:N)" CVSS_score="5.8" CVSS_impact_subscore="4.9" CVSS_exploit_subscore="8.6" CVSS_base_score="5.8">
    <desc>
      <descript source="cve">The verify_host_key function in sshconnect.c in the client in OpenSSH 6.6 and earlier allows remote servers to trigger the skipping of SSHFP DNS RR checking by presenting an unacceptable HostCertificate.</descript>
    </desc>
    <loss_types>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=742513" source="CONFIRM">https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=742513</ref>
      <ref url="http://www.ubuntu.com/usn/USN-2164-1" source="UBUNTU">USN-2164-1</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2894" source="DEBIAN">DSA-2894</ref>
      <ref url="http://openwall.com/lists/oss-security/2014/03/26/7" source="MLIST">[oss-security] 20140326 CVE request: openssh client does not check SSHFP if server offers certificate</ref>
    </refs>
    <vuln_soft>
      <prod vendor="openbsd" name="openssh">
        <vers num="6.0"/>
        <vers num="6.1"/>
        <vers num="6.2"/>
        <vers num="6.3"/>
        <vers num="6.4"/>
        <vers num="6.5"/>
        <vers prev="1" num="6.6"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2654" published="2014-04-22" name="CVE-2014-2654" modified="2014-04-23" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:P/I:P/A:P)" CVSS_score="6.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.0" CVSS_base_score="6.5">
    <desc>
      <descript source="cve">Multiple SQL injection vulnerabilities in MobFox mAdserve 2.0 and earlier allow remote authenticated users to execute arbitrary SQL commands via the id parameter to (1) edit_ad_unit.php, (2) view_adunits.php, or (3) edit_campaign.php in www/cp/.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://www.htbridge.com/advisory/HTB23209" source="MISC">https://www.htbridge.com/advisory/HTB23209</ref>
      <ref url="http://xforce.iss.net/xforce/xfdb/92545" source="XF">madserve-cve20142654-sql-injection(92545)</ref>
      <ref url="http://www.securityfocus.com/bid/66661" source="BID">66661</ref>
      <ref url="http://www.securityfocus.com/archive/1/archive/1/531848/100/0/threaded" source="BUGTRAQ">20140416 SQL Injection in mAdserve</ref>
      <ref url="http://secunia.com/advisories/58003" source="SECUNIA" adv="1">58003</ref>
    </refs>
    <vuln_soft>
      <prod vendor="mobfox" name="madserve">
        <vers prev="1" num="2.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2655" published="2014-04-02" name="CVE-2014-2655" modified="2014-04-19" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:P/I:P/A:P)" CVSS_score="6.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.0" CVSS_base_score="6.5">
    <desc>
      <descript source="cve">SQL injection vulnerability in the gen_show_status function in functions.inc.php in Postfix Admin (aka postfixadmin) before 2.3.7 allows remote authenticated users to execute arbitrary SQL commands via a new alias.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://sourceforge.net/p/postfixadmin/code/1650" source="CONFIRM" patch="1">http://sourceforge.net/p/postfixadmin/code/1650</ref>
      <ref url="http://www.securityfocus.com/bid/66455" source="BID">66455</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/03/26/6" source="MLIST">[oss-security] 20140326 CVE request: postfixadmin SQL injection vulnerability</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/03/26/11" source="MLIST">[oss-security] 20140326 Re: CVE request: postfixadmin SQL injection vulnerability</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2889" source="DEBIAN">DSA-2889</ref>
    </refs>
    <vuln_soft>
      <prod vendor="postfix_admin_project" name="postfix_admin">
        <vers num="2.2.1.1"/>
        <vers num="2.3"/>
        <vers num="2.3.1"/>
        <vers num="2.3.2"/>
        <vers num="2.3.3"/>
        <vers num="2.3.4"/>
        <vers num="2.3.5"/>
        <vers prev="1" num="2.3.6"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2657" published="2014-04-28" name="CVE-2014-2657" modified="2014-04-29" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">Unspecified vulnerability in the print release functionality in PaperCut MF 14.1 (Build 26983) has unknown impact and remote vectors, related to embedded MFPs.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/92650" source="XF">papercut-cve20142657-unspec(92650)</ref>
      <ref url="http://www.papercut-mf.com/release-history/" source="CONFIRM" adv="1">http://www.papercut-mf.com/release-history/</ref>
    </refs>
    <vuln_soft>
      <prod vendor="papercut" name="papercut_mf">
        <vers num="14.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2658" published="2014-04-28" name="CVE-2014-2658" modified="2014-04-29" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:P)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">Unspecified vulnerability in Papercut MF and NG before 14.1 (Build 26983) allows attacker to cause a denial of service via unknown vectors.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/92649" source="XF">papercut-cve20142658-dos(92649)</ref>
      <ref url="http://www.papercut.com/release-history/" source="CONFIRM" adv="1">http://www.papercut.com/release-history/</ref>
      <ref url="http://www.papercut-mf.com/release-history/" source="CONFIRM" adv="1">http://www.papercut-mf.com/release-history/</ref>
      <ref url="http://secunia.com/advisories/58037" source="SECUNIA" adv="1">58037</ref>
    </refs>
    <vuln_soft>
      <prod vendor="papercut" name="papercut_mf">
        <vers num="12.0"/>
        <vers num="12.1"/>
        <vers num="12.2"/>
        <vers num="12.3"/>
        <vers num="12.4"/>
        <vers num="12.5"/>
        <vers num="13.0"/>
        <vers num="13.1"/>
        <vers num="13.2"/>
        <vers num="13.3"/>
        <vers num="13.4"/>
        <vers num="13.5"/>
        <vers num="14.0"/>
        <vers prev="1" num="14.1"/>
      </prod>
      <prod vendor="papercut" name="papercut_ng">
        <vers num="12.0"/>
        <vers num="12.1"/>
        <vers num="12.2"/>
        <vers num="12.3"/>
        <vers num="12.4"/>
        <vers num="12.5"/>
        <vers num="13.0"/>
        <vers num="13.1"/>
        <vers num="13.2"/>
        <vers num="13.3"/>
        <vers num="13.4"/>
        <vers num="13.5"/>
        <vers num="14.0"/>
        <vers prev="1" num="14.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2659" published="2014-04-22" name="CVE-2014-2659" modified="2014-04-23" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:P)" CVSS_score="6.8" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.6" CVSS_base_score="6.8">
    <desc>
      <descript source="cve">Cross-site request forgery (CSRF) vulnerability in the admin UI in Papercut MF and NG before 14.1 (Build 26983) allows remote attackers to hijack the authentication of administrators via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/92648" source="XF">papercut-cve20142659-csrf(92648)</ref>
      <ref url="http://www.papercut.com/release-history/" source="CONFIRM">http://www.papercut.com/release-history/</ref>
      <ref url="http://www.papercut-mf.com/release-history/" source="CONFIRM">http://www.papercut-mf.com/release-history/</ref>
      <ref url="http://secunia.com/advisories/58037" source="SECUNIA" adv="1">58037</ref>
    </refs>
    <vuln_soft>
      <prod vendor="papercut" name="papercut_mf">
        <vers num="12.0"/>
        <vers num="12.1"/>
        <vers num="12.2"/>
        <vers num="12.3"/>
        <vers num="12.4"/>
        <vers num="12.5"/>
        <vers num="13.0"/>
        <vers num="13.1"/>
        <vers num="13.2"/>
        <vers num="13.3"/>
        <vers num="13.4"/>
        <vers num="13.5"/>
        <vers num="14.0"/>
        <vers prev="1" num="14.1"/>
      </prod>
      <prod vendor="papercut" name="papercut_ng">
        <vers num="12.0"/>
        <vers num="12.1"/>
        <vers num="12.2"/>
        <vers num="12.3"/>
        <vers num="12.4"/>
        <vers num="12.5"/>
        <vers num="13.0"/>
        <vers num="13.1"/>
        <vers num="13.2"/>
        <vers num="13.3"/>
        <vers num="13.4"/>
        <vers num="13.5"/>
        <vers num="14.0"/>
        <vers prev="1" num="14.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2665" published="2014-04-19" name="CVE-2014-2665" modified="2014-04-24" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:P/I:N/A:N)" CVSS_score="4.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.0" CVSS_base_score="4.0">
    <desc>
      <descript source="cve">includes/specials/SpecialChangePassword.php in MediaWiki before 1.19.14, 1.20.x and 1.21.x before 1.21.8, and 1.22.x before 1.22.5 does not properly handle a correctly authenticated but unintended login attempt, which makes it easier for remote authenticated users to obtain sensitive information by arranging for a victim to login to the attacker's account, as demonstrated by tracking the victim's activity, related to a "login CSRF" issue.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://gerrit.wikimedia.org/r/#/c/121517/1/includes/specials/SpecialChangePassword.php" source="CONFIRM" patch="1">https://gerrit.wikimedia.org/r/#/c/121517/1/includes/specials/SpecialChangePassword.php</ref>
      <ref url="http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-March/000145.html" source="MLIST" patch="1" adv="1">[mediawiki-announce] 20140328 MediaWiki Security and Maintenance Releases: 1.22.5, 1.21.8 and 1.19.14</ref>
      <ref url="https://bugzilla.wikimedia.org/show_bug.cgi?id=62497" source="CONFIRM">https://bugzilla.wikimedia.org/show_bug.cgi?id=62497</ref>
      <ref url="http://openwall.com/lists/oss-security/2014/04/01/7" source="MLIST">[oss-security] 20140401 Re: CVE request: MediaWiki 1.22.5 login csrf</ref>
      <ref url="http://openwall.com/lists/oss-security/2014/03/28/1" source="MLIST">[oss-security] 20140327 CVE request: MediaWiki 1.22.5 login csrf</ref>
    </refs>
    <vuln_soft>
      <prod vendor="mediawiki" name="mediawiki">
        <vers num="1.19" edition="beta_1"/>
        <vers num="1.19" edition="beta_2"/>
        <vers num="1.19.0"/>
        <vers num="1.19.1"/>
        <vers num="1.19.10"/>
        <vers num="1.19.11"/>
        <vers num="1.19.12"/>
        <vers prev="1" num="1.19.13"/>
        <vers num="1.19.2"/>
        <vers num="1.19.3"/>
        <vers num="1.19.4"/>
        <vers num="1.19.5"/>
        <vers num="1.19.6"/>
        <vers num="1.19.7"/>
        <vers num="1.19.8"/>
        <vers num="1.19.9"/>
        <vers num="1.20"/>
        <vers num="1.20.1"/>
        <vers num="1.20.2"/>
        <vers num="1.20.3"/>
        <vers num="1.20.4"/>
        <vers num="1.20.5"/>
        <vers num="1.20.6"/>
        <vers num="1.20.7"/>
        <vers num="1.20.8"/>
        <vers num="1.21"/>
        <vers num="1.21.1"/>
        <vers num="1.21.2"/>
        <vers num="1.21.3"/>
        <vers num="1.21.4"/>
        <vers num="1.21.5"/>
        <vers num="1.21.6"/>
        <vers num="1.21.7"/>
        <vers num="1.22.0"/>
        <vers num="1.22.1"/>
        <vers num="1.22.2"/>
        <vers num="1.22.3"/>
        <vers num="1.22.4"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2668" published="2014-03-28" name="CVE-2014-2668" modified="2014-04-19" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:P)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">Apache CouchDB 1.5.0 and earlier allows remote attackers to cause a denial of service (CPU and memory consumption) via the count parameter to /_uuids.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/92161" source="XF">apache-couchdb-cve20142668-dos(92161)</ref>
      <ref url="http://www.securitytracker.com/id/1029967" source="SECTRACK">1029967</ref>
      <ref url="http://www.securityfocus.com/bid/66474" source="BID">66474</ref>
      <ref url="http://www.exploit-db.com/exploits/32519" source="EXPLOIT-DB">32519</ref>
      <ref url="http://secunia.com/advisories/57572" source="SECUNIA" adv="1">57572</ref>
      <ref url="http://packetstormsecurity.com/files/125889" source="MISC">http://packetstormsecurity.com/files/125889</ref>
    </refs>
    <vuln_soft>
      <prod vendor="apache" name="couchdb">
        <vers prev="1" num="1.5.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2669" published="2014-03-31" name="CVE-2014-2669" modified="2014-03-31" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:P/I:P/A:P)" CVSS_score="6.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.0" CVSS_base_score="6.5">
    <desc>
      <descript source="cve">Multiple integer overflows in contrib/hstore/hstore_io.c in PostgreSQL 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allow remote authenticated users to have unspecified impact via vectors related to the (1) hstore_recv, (2) hstore_from_arrays, and (3) hstore_from_array functions in contrib/hstore/hstore_io.c; and the (4) hstoreArrayToPairs function in contrib/hstore/hstore_op.c, which triggers a buffer overflow.  NOTE: this issue was SPLIT from CVE-2014-0064 because it has a different set of affected versions.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://github.com/postgres/postgres/commit/31400a673325147e1205326008e32135a78b4d8a" source="CONFIRM">https://github.com/postgres/postgres/commit/31400a673325147e1205326008e32135a78b4d8a</ref>
      <ref url="http://www.postgresql.org/support/security/" source="CONFIRM">http://www.postgresql.org/support/security/</ref>
      <ref url="http://www.postgresql.org/about/news/1506/" source="CONFIRM" adv="1">http://www.postgresql.org/about/news/1506/</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2865" source="DEBIAN">DSA-2865</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2864" source="DEBIAN">DSA-2864</ref>
      <ref url="http://wiki.postgresql.org/wiki/20140220securityrelease" source="CONFIRM" adv="1">http://wiki.postgresql.org/wiki/20140220securityrelease</ref>
    </refs>
    <vuln_soft>
      <prod vendor="postgresql" name="postgresql">
        <vers num="9.0"/>
        <vers num="9.0.1"/>
        <vers num="9.0.10"/>
        <vers num="9.0.11"/>
        <vers num="9.0.12"/>
        <vers num="9.0.13"/>
        <vers num="9.0.14"/>
        <vers num="9.0.15"/>
        <vers num="9.0.2"/>
        <vers num="9.0.3"/>
        <vers num="9.0.4"/>
        <vers num="9.0.5"/>
        <vers num="9.0.6"/>
        <vers num="9.0.7"/>
        <vers num="9.0.8"/>
        <vers num="9.0.9"/>
        <vers num="9.1"/>
        <vers num="9.1.1"/>
        <vers num="9.1.10"/>
        <vers num="9.1.11"/>
        <vers num="9.1.2"/>
        <vers num="9.1.3"/>
        <vers num="9.1.4"/>
        <vers num="9.1.5"/>
        <vers num="9.1.6"/>
        <vers num="9.1.7"/>
        <vers num="9.1.8"/>
        <vers num="9.1.9"/>
        <vers num="9.2"/>
        <vers num="9.2.1"/>
        <vers num="9.2.2"/>
        <vers num="9.2.3"/>
        <vers num="9.2.4"/>
        <vers num="9.2.5"/>
        <vers num="9.3"/>
        <vers num="9.3.1"/>
        <vers num="9.3.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-2670" published="2014-03-29" name="CVE-2014-2670" modified="2014-03-31" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:S/C:N/I:P/A:N)" CVSS_score="3.5" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="6.8" CVSS_base_score="3.5">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in Properties.do in ZOHO ManageEngine OpStor before build 8500 allows remote authenticated users to inject arbitrary web script or HTML via the name parameter, a different vulnerability than CVE-2014-0344.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://www.kb.cert.org/vuls/id/140886" source="CERT-VN">VU#140886</ref>
    </refs>
    <vuln_soft>
      <prod vendor="zohocorp" name="manageengine_opstor">
        <vers prev="1" num="8.3"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2671" published="2014-03-31" name="CVE-2014-2671" modified="2014-04-14" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:P)" CVSS_score="6.8" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.6" CVSS_base_score="6.8">
    <desc>
      <descript source="cve">Microsoft Windows Media Player (WMP) 11.0.5721.5230 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted WAV file.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/92080" source="XF">ms-media-player-wav-code-exec(92080)</ref>
      <ref url="http://www.securityfocus.com/bid/66403" source="BID">66403</ref>
      <ref url="http://www.exploit-db.com/exploits/32477/" source="EXPLOIT-DB">32477</ref>
      <ref url="http://packetstormsecurity.com/files/125834" source="MISC">http://packetstormsecurity.com/files/125834</ref>
    </refs>
    <vuln_soft>
      <prod vendor="microsoft" name="windows_media_player">
        <vers num="11.0.5721.5230"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2672" published="2014-04-01" name="CVE-2014-2672" modified="2014-04-19" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:N/A:C)" CVSS_score="7.1" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="8.6" CVSS_base_score="7.1">
    <desc>
      <descript source="cve">Race condition in the ath_tx_aggr_sleep function in drivers/net/wireless/ath/ath9k/xmit.c in the Linux kernel before 3.13.7 allows remote attackers to cause a denial of service (system crash) via a large amount of network traffic that triggers certain list deletions.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://github.com/torvalds/linux/commit/21f8aaee0c62708654988ce092838aa7df4d25d8" source="CONFIRM" patch="1">https://github.com/torvalds/linux/commit/21f8aaee0c62708654988ce092838aa7df4d25d8</ref>
      <ref url="http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=21f8aaee0c62708654988ce092838aa7df4d25d8" source="CONFIRM" patch="1">http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=21f8aaee0c62708654988ce092838aa7df4d25d8</ref>
      <ref url="https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.12.15" source="CONFIRM">https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.12.15</ref>
      <ref url="https://bugzilla.kernel.org/show_bug.cgi?id=70551" source="CONFIRM">https://bugzilla.kernel.org/show_bug.cgi?id=70551</ref>
      <ref url="http://www.securityfocus.com/bid/66492" source="BID">66492</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/03/30/5" source="MLIST">[oss-security] 20140330 Re: CVE request: Linux Kernel, two security issues</ref>
      <ref url="http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.13.7" source="CONFIRM">http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.13.7</ref>
      <ref url="http://secunia.com/advisories/57468" source="SECUNIA">57468</ref>
    </refs>
    <vuln_soft>
      <prod vendor="linux" name="linux_kernel">
        <vers num="3.0" edition="rc1"/>
        <vers num="3.0" edition="rc2"/>
        <vers num="3.0" edition="rc3"/>
        <vers num="3.0" edition="rc4"/>
        <vers num="3.0" edition="rc5"/>
        <vers num="3.0" edition="rc6"/>
        <vers num="3.0" edition="rc7"/>
        <vers num="3.0.1"/>
        <vers num="3.0.10"/>
        <vers num="3.0.11"/>
        <vers num="3.0.12"/>
        <vers num="3.0.13"/>
        <vers num="3.0.14"/>
        <vers num="3.0.15"/>
        <vers num="3.0.16"/>
        <vers num="3.0.17"/>
        <vers num="3.0.18"/>
        <vers num="3.0.19"/>
        <vers num="3.0.2"/>
        <vers num="3.0.20"/>
        <vers num="3.0.21"/>
        <vers num="3.0.22"/>
        <vers num="3.0.23"/>
        <vers num="3.0.24"/>
        <vers num="3.0.25"/>
        <vers num="3.0.26"/>
        <vers num="3.0.27"/>
        <vers num="3.0.28"/>
        <vers num="3.0.29"/>
        <vers num="3.0.3"/>
        <vers num="3.0.30"/>
        <vers num="3.0.31"/>
        <vers num="3.0.32"/>
        <vers num="3.0.33"/>
        <vers num="3.0.34"/>
        <vers num="3.0.35"/>
        <vers num="3.0.36"/>
        <vers num="3.0.37"/>
        <vers num="3.0.38"/>
        <vers num="3.0.39"/>
        <vers num="3.0.4"/>
        <vers num="3.0.40"/>
        <vers num="3.0.41"/>
        <vers num="3.0.42"/>
        <vers num="3.0.43"/>
        <vers num="3.0.44"/>
        <vers num="3.0.45"/>
        <vers num="3.0.46"/>
        <vers num="3.0.47"/>
        <vers num="3.0.48"/>
        <vers num="3.0.49"/>
        <vers num="3.0.5"/>
        <vers num="3.0.50"/>
        <vers num="3.0.51"/>
        <vers num="3.0.52"/>
        <vers num="3.0.53"/>
        <vers num="3.0.54"/>
        <vers num="3.0.55"/>
        <vers num="3.0.56"/>
        <vers num="3.0.57"/>
        <vers num="3.0.58"/>
        <vers num="3.0.59"/>
        <vers num="3.0.6"/>
        <vers num="3.0.60"/>
        <vers num="3.0.61"/>
        <vers num="3.0.62"/>
        <vers num="3.0.63"/>
        <vers num="3.0.64"/>
        <vers num="3.0.65"/>
        <vers num="3.0.66"/>
        <vers num="3.0.67"/>
        <vers num="3.0.68"/>
        <vers num="3.0.7"/>
        <vers num="3.0.8"/>
        <vers num="3.0.9"/>
        <vers num="3.1" edition="rc1"/>
        <vers num="3.1" edition="rc2"/>
        <vers num="3.1" edition="rc3"/>
        <vers num="3.1" edition="rc4"/>
        <vers num="3.1.1"/>
        <vers num="3.1.10"/>
        <vers num="3.1.2"/>
        <vers num="3.1.3"/>
        <vers num="3.1.4"/>
        <vers num="3.1.5"/>
        <vers num="3.1.6"/>
        <vers num="3.1.7"/>
        <vers num="3.1.8"/>
        <vers num="3.1.9"/>
        <vers num="3.10"/>
        <vers num="3.10.1"/>
        <vers num="3.10.10"/>
        <vers num="3.10.11"/>
        <vers num="3.10.12"/>
        <vers num="3.10.13"/>
        <vers num="3.10.14"/>
        <vers num="3.10.15"/>
        <vers num="3.10.16"/>
        <vers num="3.10.17"/>
        <vers num="3.10.18"/>
        <vers num="3.10.19"/>
        <vers num="3.10.2"/>
        <vers num="3.10.20"/>
        <vers num="3.10.21"/>
        <vers num="3.10.22"/>
        <vers num="3.10.23"/>
        <vers num="3.10.24"/>
        <vers num="3.10.25"/>
        <vers num="3.10.26"/>
        <vers num="3.10.27"/>
        <vers num="3.10.28"/>
        <vers num="3.10.29"/>
        <vers num="3.10.3"/>
        <vers num="3.10.4"/>
        <vers num="3.10.5"/>
        <vers num="3.10.6"/>
        <vers num="3.10.7"/>
        <vers num="3.10.8"/>
        <vers num="3.10.9"/>
        <vers num="3.11"/>
        <vers num="3.11.1"/>
        <vers num="3.11.10"/>
        <vers num="3.11.2"/>
        <vers num="3.11.3"/>
        <vers num="3.11.4"/>
        <vers num="3.11.5"/>
        <vers num="3.11.6"/>
        <vers num="3.11.7"/>
        <vers num="3.11.8"/>
        <vers num="3.11.9"/>
        <vers num="3.12"/>
        <vers num="3.12.1"/>
        <vers num="3.12.10"/>
        <vers num="3.12.11"/>
        <vers num="3.12.12"/>
        <vers num="3.12.13"/>
        <vers num="3.12.2"/>
        <vers num="3.12.3"/>
        <vers num="3.12.4"/>
        <vers num="3.12.5"/>
        <vers num="3.12.6"/>
        <vers num="3.12.7"/>
        <vers num="3.12.8"/>
        <vers num="3.12.9"/>
        <vers num="3.13"/>
        <vers num="3.13.1"/>
        <vers num="3.13.2"/>
        <vers num="3.13.3"/>
        <vers num="3.13.4"/>
        <vers num="3.13.5"/>
        <vers prev="1" num="3.13.6"/>
        <vers num="3.2" edition="rc2"/>
        <vers num="3.2" edition="rc3"/>
        <vers num="3.2" edition="rc4"/>
        <vers num="3.2" edition="rc5"/>
        <vers num="3.2" edition="rc6"/>
        <vers num="3.2" edition="rc7"/>
        <vers num="3.2.1"/>
        <vers num="3.2.10"/>
        <vers num="3.2.11"/>
        <vers num="3.2.12"/>
        <vers num="3.2.13"/>
        <vers num="3.2.14"/>
        <vers num="3.2.15"/>
        <vers num="3.2.16"/>
        <vers num="3.2.17"/>
        <vers num="3.2.18"/>
        <vers num="3.2.19"/>
        <vers num="3.2.2"/>
        <vers num="3.2.20"/>
        <vers num="3.2.21"/>
        <vers num="3.2.22"/>
        <vers num="3.2.23"/>
        <vers num="3.2.24"/>
        <vers num="3.2.25"/>
        <vers num="3.2.26"/>
        <vers num="3.2.27"/>
        <vers num="3.2.28"/>
        <vers num="3.2.29"/>
        <vers num="3.2.3"/>
        <vers num="3.2.30"/>
        <vers num="3.2.4"/>
        <vers num="3.2.5"/>
        <vers num="3.2.6"/>
        <vers num="3.2.7"/>
        <vers num="3.2.8"/>
        <vers num="3.2.9"/>
        <vers num="3.3" edition="rc1"/>
        <vers num="3.3" edition="rc2"/>
        <vers num="3.3" edition="rc3"/>
        <vers num="3.3" edition="rc4"/>
        <vers num="3.3" edition="rc5"/>
        <vers num="3.3" edition="rc6"/>
        <vers num="3.3" edition="rc7"/>
        <vers num="3.3.1"/>
        <vers num="3.3.2"/>
        <vers num="3.3.3"/>
        <vers num="3.3.4"/>
        <vers num="3.3.5"/>
        <vers num="3.3.6"/>
        <vers num="3.3.7"/>
        <vers num="3.3.8"/>
        <vers num="3.4" edition="rc1"/>
        <vers num="3.4" edition="rc2"/>
        <vers num="3.4" edition="rc3"/>
        <vers num="3.4" edition="rc4"/>
        <vers num="3.4" edition="rc5"/>
        <vers num="3.4" edition="rc6"/>
        <vers num="3.4" edition="rc7"/>
        <vers num="3.4.1"/>
        <vers num="3.4.10"/>
        <vers num="3.4.11"/>
        <vers num="3.4.12"/>
        <vers num="3.4.13"/>
        <vers num="3.4.14"/>
        <vers num="3.4.15"/>
        <vers num="3.4.16"/>
        <vers num="3.4.17"/>
        <vers num="3.4.18"/>
        <vers num="3.4.19"/>
        <vers num="3.4.2"/>
        <vers num="3.4.20"/>
        <vers num="3.4.21"/>
        <vers num="3.4.22"/>
        <vers num="3.4.23"/>
        <vers num="3.4.24"/>
        <vers num="3.4.25"/>
        <vers num="3.4.26"/>
        <vers num="3.4.27"/>
        <vers num="3.4.28"/>
        <vers num="3.4.29"/>
        <vers num="3.4.3"/>
        <vers num="3.4.30"/>
        <vers num="3.4.31"/>
        <vers num="3.4.32"/>
        <vers num="3.4.33"/>
        <vers num="3.4.34"/>
        <vers num="3.4.35"/>
        <vers num="3.4.36"/>
        <vers num="3.4.37"/>
        <vers num="3.4.38"/>
        <vers num="3.4.39"/>
        <vers num="3.4.4"/>
        <vers num="3.4.40"/>
        <vers num="3.4.41"/>
        <vers num="3.4.42"/>
        <vers num="3.4.43"/>
        <vers num="3.4.44"/>
        <vers num="3.4.45"/>
        <vers num="3.4.46"/>
        <vers num="3.4.47"/>
        <vers num="3.4.48"/>
        <vers num="3.4.49"/>
        <vers num="3.4.5"/>
        <vers num="3.4.50"/>
        <vers num="3.4.51"/>
        <vers num="3.4.52"/>
        <vers num="3.4.53"/>
        <vers num="3.4.54"/>
        <vers num="3.4.55"/>
        <vers num="3.4.56"/>
        <vers num="3.4.57"/>
        <vers num="3.4.58"/>
        <vers num="3.4.59"/>
        <vers num="3.4.6"/>
        <vers num="3.4.60"/>
        <vers num="3.4.61"/>
        <vers num="3.4.62"/>
        <vers num="3.4.63"/>
        <vers num="3.4.64"/>
        <vers num="3.4.65"/>
        <vers num="3.4.66"/>
        <vers num="3.4.67"/>
        <vers num="3.4.68"/>
        <vers num="3.4.69"/>
        <vers num="3.4.7"/>
        <vers num="3.4.70"/>
        <vers num="3.4.71"/>
        <vers num="3.4.72"/>
        <vers num="3.4.73"/>
        <vers num="3.4.74"/>
        <vers num="3.4.75"/>
        <vers num="3.4.76"/>
        <vers num="3.4.77"/>
        <vers num="3.4.78"/>
        <vers num="3.4.79"/>
        <vers num="3.4.8"/>
        <vers num="3.4.9"/>
        <vers num="3.5.1"/>
        <vers num="3.5.2"/>
        <vers num="3.5.3"/>
        <vers num="3.5.4"/>
        <vers num="3.5.5"/>
        <vers num="3.5.6"/>
        <vers num="3.5.7"/>
        <vers num="3.6"/>
        <vers num="3.6.1"/>
        <vers num="3.6.10"/>
        <vers num="3.6.11"/>
        <vers num="3.6.2"/>
        <vers num="3.6.3"/>
        <vers num="3.6.4"/>
        <vers num="3.6.5"/>
        <vers num="3.6.6"/>
        <vers num="3.6.7"/>
        <vers num="3.6.8"/>
        <vers num="3.6.9"/>
        <vers num="3.7"/>
        <vers num="3.7.1"/>
        <vers num="3.7.10"/>
        <vers num="3.7.2"/>
        <vers num="3.7.3"/>
        <vers num="3.7.4"/>
        <vers num="3.7.5"/>
        <vers num="3.7.6"/>
        <vers num="3.7.7"/>
        <vers num="3.7.8"/>
        <vers num="3.7.9"/>
        <vers num="3.8.0"/>
        <vers num="3.8.1"/>
        <vers num="3.8.10"/>
        <vers num="3.8.11"/>
        <vers num="3.8.12"/>
        <vers num="3.8.13"/>
        <vers num="3.8.2"/>
        <vers num="3.8.3"/>
        <vers num="3.8.4"/>
        <vers num="3.8.5"/>
        <vers num="3.8.6"/>
        <vers num="3.8.7"/>
        <vers num="3.8.8"/>
        <vers num="3.8.9"/>
        <vers num="3.9" edition="rc1"/>
        <vers num="3.9" edition="rc2"/>
        <vers num="3.9" edition="rc3"/>
        <vers num="3.9" edition="rc4"/>
        <vers num="3.9" edition="rc5"/>
        <vers num="3.9" edition="rc6"/>
        <vers num="3.9" edition="rc7"/>
        <vers num="3.9.0"/>
        <vers num="3.9.1"/>
        <vers num="3.9.10"/>
        <vers num="3.9.11"/>
        <vers num="3.9.2"/>
        <vers num="3.9.3"/>
        <vers num="3.9.4"/>
        <vers num="3.9.5"/>
        <vers num="3.9.6"/>
        <vers num="3.9.7"/>
        <vers num="3.9.8"/>
        <vers num="3.9.9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2673" published="2014-04-01" name="CVE-2014-2673" modified="2014-04-19" CVSS_version="2.0" CVSS_vector="(AV:L/AC:M/Au:N/C:N/I:N/A:C)" CVSS_score="4.7" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="3.4" CVSS_base_score="4.7">
    <desc>
      <descript source="cve">The arch_dup_task_struct function in the Transactional Memory (TM) implementation in arch/powerpc/kernel/process.c in the Linux kernel before 3.13.7 on the powerpc platform does not properly interact with the clone and fork system calls, which allows local users to cause a denial of service (Program Check and system crash) via certain instructions that are executed with the processor in the Transactional state.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="https://github.com/torvalds/linux/commit/621b5060e823301d0cba4cb52a7ee3491922d291" source="CONFIRM" patch="1">https://github.com/torvalds/linux/commit/621b5060e823301d0cba4cb52a7ee3491922d291</ref>
      <ref url="http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=621b5060e823301d0cba4cb52a7ee3491922d291" source="CONFIRM" patch="1">http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=621b5060e823301d0cba4cb52a7ee3491922d291</ref>
      <ref url="https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.12.15" source="CONFIRM">https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.12.15</ref>
      <ref url="http://xforce.iss.net/xforce/xfdb/92113" source="XF">linux-kernel-cve20142673-dos(92113)</ref>
      <ref url="http://www.securityfocus.com/bid/66477" source="BID">66477</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/03/30/5" source="MLIST">[oss-security] 20140330 Re: CVE request: Linux Kernel, two security issues</ref>
      <ref url="http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.13.7" source="CONFIRM">http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.13.7</ref>
      <ref url="http://secunia.com/advisories/57436" source="SECUNIA">57436</ref>
    </refs>
    <vuln_soft>
      <prod vendor="linux" name="linux_kernel">
        <vers num="3.0" edition="rc1"/>
        <vers num="3.0" edition="rc2"/>
        <vers num="3.0" edition="rc3"/>
        <vers num="3.0" edition="rc4"/>
        <vers num="3.0" edition="rc5"/>
        <vers num="3.0" edition="rc6"/>
        <vers num="3.0" edition="rc7"/>
        <vers num="3.0.1"/>
        <vers num="3.0.10"/>
        <vers num="3.0.11"/>
        <vers num="3.0.12"/>
        <vers num="3.0.13"/>
        <vers num="3.0.14"/>
        <vers num="3.0.15"/>
        <vers num="3.0.16"/>
        <vers num="3.0.17"/>
        <vers num="3.0.18"/>
        <vers num="3.0.19"/>
        <vers num="3.0.2"/>
        <vers num="3.0.20"/>
        <vers num="3.0.21"/>
        <vers num="3.0.22"/>
        <vers num="3.0.23"/>
        <vers num="3.0.24"/>
        <vers num="3.0.25"/>
        <vers num="3.0.26"/>
        <vers num="3.0.27"/>
        <vers num="3.0.28"/>
        <vers num="3.0.29"/>
        <vers num="3.0.3"/>
        <vers num="3.0.30"/>
        <vers num="3.0.31"/>
        <vers num="3.0.32"/>
        <vers num="3.0.33"/>
        <vers num="3.0.34"/>
        <vers num="3.0.35"/>
        <vers num="3.0.36"/>
        <vers num="3.0.37"/>
        <vers num="3.0.38"/>
        <vers num="3.0.39"/>
        <vers num="3.0.4"/>
        <vers num="3.0.40"/>
        <vers num="3.0.41"/>
        <vers num="3.0.42"/>
        <vers num="3.0.43"/>
        <vers num="3.0.44"/>
        <vers num="3.0.45"/>
        <vers num="3.0.46"/>
        <vers num="3.0.47"/>
        <vers num="3.0.48"/>
        <vers num="3.0.49"/>
        <vers num="3.0.5"/>
        <vers num="3.0.50"/>
        <vers num="3.0.51"/>
        <vers num="3.0.52"/>
        <vers num="3.0.53"/>
        <vers num="3.0.54"/>
        <vers num="3.0.55"/>
        <vers num="3.0.56"/>
        <vers num="3.0.57"/>
        <vers num="3.0.58"/>
        <vers num="3.0.59"/>
        <vers num="3.0.6"/>
        <vers num="3.0.60"/>
        <vers num="3.0.61"/>
        <vers num="3.0.62"/>
        <vers num="3.0.63"/>
        <vers num="3.0.64"/>
        <vers num="3.0.65"/>
        <vers num="3.0.66"/>
        <vers num="3.0.67"/>
        <vers num="3.0.68"/>
        <vers num="3.0.7"/>
        <vers num="3.0.8"/>
        <vers num="3.0.9"/>
        <vers num="3.1" edition="rc1"/>
        <vers num="3.1" edition="rc2"/>
        <vers num="3.1" edition="rc3"/>
        <vers num="3.1" edition="rc4"/>
        <vers num="3.1.1"/>
        <vers num="3.1.10"/>
        <vers num="3.1.2"/>
        <vers num="3.1.3"/>
        <vers num="3.1.4"/>
        <vers num="3.1.5"/>
        <vers num="3.1.6"/>
        <vers num="3.1.7"/>
        <vers num="3.1.8"/>
        <vers num="3.1.9"/>
        <vers num="3.10"/>
        <vers num="3.10.1"/>
        <vers num="3.10.10"/>
        <vers num="3.10.11"/>
        <vers num="3.10.12"/>
        <vers num="3.10.13"/>
        <vers num="3.10.14"/>
        <vers num="3.10.15"/>
        <vers num="3.10.16"/>
        <vers num="3.10.17"/>
        <vers num="3.10.18"/>
        <vers num="3.10.19"/>
        <vers num="3.10.2"/>
        <vers num="3.10.20"/>
        <vers num="3.10.21"/>
        <vers num="3.10.22"/>
        <vers num="3.10.23"/>
        <vers num="3.10.24"/>
        <vers num="3.10.25"/>
        <vers num="3.10.26"/>
        <vers num="3.10.27"/>
        <vers num="3.10.28"/>
        <vers num="3.10.29"/>
        <vers num="3.10.3"/>
        <vers num="3.10.4"/>
        <vers num="3.10.5"/>
        <vers num="3.10.6"/>
        <vers num="3.10.7"/>
        <vers num="3.10.8"/>
        <vers num="3.10.9"/>
        <vers num="3.11"/>
        <vers num="3.11.1"/>
        <vers num="3.11.10"/>
        <vers num="3.11.2"/>
        <vers num="3.11.3"/>
        <vers num="3.11.4"/>
        <vers num="3.11.5"/>
        <vers num="3.11.6"/>
        <vers num="3.11.7"/>
        <vers num="3.11.8"/>
        <vers num="3.11.9"/>
        <vers num="3.12"/>
        <vers num="3.12.1"/>
        <vers num="3.12.10"/>
        <vers num="3.12.11"/>
        <vers num="3.12.12"/>
        <vers num="3.12.13"/>
        <vers num="3.12.2"/>
        <vers num="3.12.3"/>
        <vers num="3.12.4"/>
        <vers num="3.12.5"/>
        <vers num="3.12.6"/>
        <vers num="3.12.7"/>
        <vers num="3.12.8"/>
        <vers num="3.12.9"/>
        <vers num="3.13"/>
        <vers num="3.13.1"/>
        <vers num="3.13.2"/>
        <vers num="3.13.3"/>
        <vers num="3.13.4"/>
        <vers num="3.13.5"/>
        <vers prev="1" num="3.13.6"/>
        <vers num="3.2" edition="rc2"/>
        <vers num="3.2" edition="rc3"/>
        <vers num="3.2" edition="rc4"/>
        <vers num="3.2" edition="rc5"/>
        <vers num="3.2" edition="rc6"/>
        <vers num="3.2" edition="rc7"/>
        <vers num="3.2.1"/>
        <vers num="3.2.10"/>
        <vers num="3.2.11"/>
        <vers num="3.2.12"/>
        <vers num="3.2.13"/>
        <vers num="3.2.14"/>
        <vers num="3.2.15"/>
        <vers num="3.2.16"/>
        <vers num="3.2.17"/>
        <vers num="3.2.18"/>
        <vers num="3.2.19"/>
        <vers num="3.2.2"/>
        <vers num="3.2.20"/>
        <vers num="3.2.21"/>
        <vers num="3.2.22"/>
        <vers num="3.2.23"/>
        <vers num="3.2.24"/>
        <vers num="3.2.25"/>
        <vers num="3.2.26"/>
        <vers num="3.2.27"/>
        <vers num="3.2.28"/>
        <vers num="3.2.29"/>
        <vers num="3.2.3"/>
        <vers num="3.2.30"/>
        <vers num="3.2.4"/>
        <vers num="3.2.5"/>
        <vers num="3.2.6"/>
        <vers num="3.2.7"/>
        <vers num="3.2.8"/>
        <vers num="3.2.9"/>
        <vers num="3.3" edition="rc1"/>
        <vers num="3.3" edition="rc2"/>
        <vers num="3.3" edition="rc3"/>
        <vers num="3.3" edition="rc4"/>
        <vers num="3.3" edition="rc5"/>
        <vers num="3.3" edition="rc6"/>
        <vers num="3.3" edition="rc7"/>
        <vers num="3.3.1"/>
        <vers num="3.3.2"/>
        <vers num="3.3.3"/>
        <vers num="3.3.4"/>
        <vers num="3.3.5"/>
        <vers num="3.3.6"/>
        <vers num="3.3.7"/>
        <vers num="3.3.8"/>
        <vers num="3.4" edition="rc1"/>
        <vers num="3.4" edition="rc2"/>
        <vers num="3.4" edition="rc3"/>
        <vers num="3.4" edition="rc4"/>
        <vers num="3.4" edition="rc5"/>
        <vers num="3.4" edition="rc6"/>
        <vers num="3.4" edition="rc7"/>
        <vers num="3.4.1"/>
        <vers num="3.4.10"/>
        <vers num="3.4.11"/>
        <vers num="3.4.12"/>
        <vers num="3.4.13"/>
        <vers num="3.4.14"/>
        <vers num="3.4.15"/>
        <vers num="3.4.16"/>
        <vers num="3.4.17"/>
        <vers num="3.4.18"/>
        <vers num="3.4.19"/>
        <vers num="3.4.2"/>
        <vers num="3.4.20"/>
        <vers num="3.4.21"/>
        <vers num="3.4.22"/>
        <vers num="3.4.23"/>
        <vers num="3.4.24"/>
        <vers num="3.4.25"/>
        <vers num="3.4.26"/>
        <vers num="3.4.27"/>
        <vers num="3.4.28"/>
        <vers num="3.4.29"/>
        <vers num="3.4.3"/>
        <vers num="3.4.30"/>
        <vers num="3.4.31"/>
        <vers num="3.4.32"/>
        <vers num="3.4.33"/>
        <vers num="3.4.34"/>
        <vers num="3.4.35"/>
        <vers num="3.4.36"/>
        <vers num="3.4.37"/>
        <vers num="3.4.38"/>
        <vers num="3.4.39"/>
        <vers num="3.4.4"/>
        <vers num="3.4.40"/>
        <vers num="3.4.41"/>
        <vers num="3.4.42"/>
        <vers num="3.4.43"/>
        <vers num="3.4.44"/>
        <vers num="3.4.45"/>
        <vers num="3.4.46"/>
        <vers num="3.4.47"/>
        <vers num="3.4.48"/>
        <vers num="3.4.49"/>
        <vers num="3.4.5"/>
        <vers num="3.4.50"/>
        <vers num="3.4.51"/>
        <vers num="3.4.52"/>
        <vers num="3.4.53"/>
        <vers num="3.4.54"/>
        <vers num="3.4.55"/>
        <vers num="3.4.56"/>
        <vers num="3.4.57"/>
        <vers num="3.4.58"/>
        <vers num="3.4.59"/>
        <vers num="3.4.6"/>
        <vers num="3.4.60"/>
        <vers num="3.4.61"/>
        <vers num="3.4.62"/>
        <vers num="3.4.63"/>
        <vers num="3.4.64"/>
        <vers num="3.4.65"/>
        <vers num="3.4.66"/>
        <vers num="3.4.67"/>
        <vers num="3.4.68"/>
        <vers num="3.4.69"/>
        <vers num="3.4.7"/>
        <vers num="3.4.70"/>
        <vers num="3.4.71"/>
        <vers num="3.4.72"/>
        <vers num="3.4.73"/>
        <vers num="3.4.74"/>
        <vers num="3.4.75"/>
        <vers num="3.4.76"/>
        <vers num="3.4.77"/>
        <vers num="3.4.78"/>
        <vers num="3.4.79"/>
        <vers num="3.4.8"/>
        <vers num="3.4.9"/>
        <vers num="3.5.1"/>
        <vers num="3.5.2"/>
        <vers num="3.5.3"/>
        <vers num="3.5.4"/>
        <vers num="3.5.5"/>
        <vers num="3.5.6"/>
        <vers num="3.5.7"/>
        <vers num="3.6"/>
        <vers num="3.6.1"/>
        <vers num="3.6.10"/>
        <vers num="3.6.11"/>
        <vers num="3.6.2"/>
        <vers num="3.6.3"/>
        <vers num="3.6.4"/>
        <vers num="3.6.5"/>
        <vers num="3.6.6"/>
        <vers num="3.6.7"/>
        <vers num="3.6.8"/>
        <vers num="3.6.9"/>
        <vers num="3.7"/>
        <vers num="3.7.1"/>
        <vers num="3.7.10"/>
        <vers num="3.7.2"/>
        <vers num="3.7.3"/>
        <vers num="3.7.4"/>
        <vers num="3.7.5"/>
        <vers num="3.7.6"/>
        <vers num="3.7.7"/>
        <vers num="3.7.8"/>
        <vers num="3.7.9"/>
        <vers num="3.8.0"/>
        <vers num="3.8.1"/>
        <vers num="3.8.10"/>
        <vers num="3.8.11"/>
        <vers num="3.8.12"/>
        <vers num="3.8.13"/>
        <vers num="3.8.2"/>
        <vers num="3.8.3"/>
        <vers num="3.8.4"/>
        <vers num="3.8.5"/>
        <vers num="3.8.6"/>
        <vers num="3.8.7"/>
        <vers num="3.8.8"/>
        <vers num="3.8.9"/>
        <vers num="3.9" edition="rc1"/>
        <vers num="3.9" edition="rc2"/>
        <vers num="3.9" edition="rc3"/>
        <vers num="3.9" edition="rc4"/>
        <vers num="3.9" edition="rc5"/>
        <vers num="3.9" edition="rc6"/>
        <vers num="3.9" edition="rc7"/>
        <vers num="3.9.0"/>
        <vers num="3.9.1"/>
        <vers num="3.9.10"/>
        <vers num="3.9.11"/>
        <vers num="3.9.2"/>
        <vers num="3.9.3"/>
        <vers num="3.9.4"/>
        <vers num="3.9.5"/>
        <vers num="3.9.6"/>
        <vers num="3.9.7"/>
        <vers num="3.9.8"/>
        <vers num="3.9.9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2678" published="2014-04-01" name="CVE-2014-2678" modified="2014-04-19" CVSS_version="2.0" CVSS_vector="(AV:L/AC:M/Au:N/C:N/I:N/A:C)" CVSS_score="4.7" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="3.4" CVSS_base_score="4.7">
    <desc>
      <descript source="cve">The rds_iw_laddr_check function in net/rds/iw.c in the Linux kernel through 3.14 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a bind system call for an RDS socket on a system that lacks RDS transports.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="https://lkml.org/lkml/2014/3/29/188" source="MLIST">[linux-kernel] 20140329 [PATCH v2] rds: prevent dereference of a NULL device in rds_iw_laddr_check</ref>
      <ref url="http://www.securityfocus.com/bid/66543" source="BID">66543</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/03/31/10" source="MLIST">[oss-security] 20140331 CVE-2013-7348 CVE-2014-2678 Linux kernel aio and rds issues</ref>
      <ref url="http://lists.fedoraproject.org/pipermail/package-announce/2014-April/131276.html" source="FEDORA">FEDORA-2014-4844</ref>
    </refs>
    <vuln_soft>
      <prod vendor="linux" name="linux_kernel">
        <vers num="3.0" edition="rc1"/>
        <vers num="3.0" edition="rc2"/>
        <vers num="3.0" edition="rc3"/>
        <vers num="3.0" edition="rc4"/>
        <vers num="3.0" edition="rc5"/>
        <vers num="3.0" edition="rc6"/>
        <vers num="3.0" edition="rc7"/>
        <vers num="3.0.1"/>
        <vers num="3.0.10"/>
        <vers num="3.0.11"/>
        <vers num="3.0.12"/>
        <vers num="3.0.13"/>
        <vers num="3.0.14"/>
        <vers num="3.0.15"/>
        <vers num="3.0.16"/>
        <vers num="3.0.17"/>
        <vers num="3.0.18"/>
        <vers num="3.0.19"/>
        <vers num="3.0.2"/>
        <vers num="3.0.20"/>
        <vers num="3.0.21"/>
        <vers num="3.0.22"/>
        <vers num="3.0.23"/>
        <vers num="3.0.24"/>
        <vers num="3.0.25"/>
        <vers num="3.0.26"/>
        <vers num="3.0.27"/>
        <vers num="3.0.28"/>
        <vers num="3.0.29"/>
        <vers num="3.0.3"/>
        <vers num="3.0.30"/>
        <vers num="3.0.31"/>
        <vers num="3.0.32"/>
        <vers num="3.0.33"/>
        <vers num="3.0.34"/>
        <vers num="3.0.35"/>
        <vers num="3.0.36"/>
        <vers num="3.0.37"/>
        <vers num="3.0.38"/>
        <vers num="3.0.39"/>
        <vers num="3.0.4"/>
        <vers num="3.0.40"/>
        <vers num="3.0.41"/>
        <vers num="3.0.42"/>
        <vers num="3.0.43"/>
        <vers num="3.0.44"/>
        <vers num="3.0.45"/>
        <vers num="3.0.46"/>
        <vers num="3.0.47"/>
        <vers num="3.0.48"/>
        <vers num="3.0.49"/>
        <vers num="3.0.5"/>
        <vers num="3.0.50"/>
        <vers num="3.0.51"/>
        <vers num="3.0.52"/>
        <vers num="3.0.53"/>
        <vers num="3.0.54"/>
        <vers num="3.0.55"/>
        <vers num="3.0.56"/>
        <vers num="3.0.57"/>
        <vers num="3.0.58"/>
        <vers num="3.0.59"/>
        <vers num="3.0.6"/>
        <vers num="3.0.60"/>
        <vers num="3.0.61"/>
        <vers num="3.0.62"/>
        <vers num="3.0.63"/>
        <vers num="3.0.64"/>
        <vers num="3.0.65"/>
        <vers num="3.0.66"/>
        <vers num="3.0.67"/>
        <vers num="3.0.68"/>
        <vers num="3.0.7"/>
        <vers num="3.0.8"/>
        <vers num="3.0.9"/>
        <vers num="3.1" edition="rc1"/>
        <vers num="3.1" edition="rc2"/>
        <vers num="3.1" edition="rc3"/>
        <vers num="3.1" edition="rc4"/>
        <vers num="3.1.1"/>
        <vers num="3.1.10"/>
        <vers num="3.1.2"/>
        <vers num="3.1.3"/>
        <vers num="3.1.4"/>
        <vers num="3.1.5"/>
        <vers num="3.1.6"/>
        <vers num="3.1.7"/>
        <vers num="3.1.8"/>
        <vers num="3.1.9"/>
        <vers num="3.10"/>
        <vers num="3.10.1"/>
        <vers num="3.10.10"/>
        <vers num="3.10.11"/>
        <vers num="3.10.12"/>
        <vers num="3.10.13"/>
        <vers num="3.10.14"/>
        <vers num="3.10.15"/>
        <vers num="3.10.16"/>
        <vers num="3.10.17"/>
        <vers num="3.10.18"/>
        <vers num="3.10.19"/>
        <vers num="3.10.2"/>
        <vers num="3.10.20"/>
        <vers num="3.10.21"/>
        <vers num="3.10.22"/>
        <vers num="3.10.23"/>
        <vers num="3.10.24"/>
        <vers num="3.10.25"/>
        <vers num="3.10.26"/>
        <vers num="3.10.27"/>
        <vers num="3.10.28"/>
        <vers num="3.10.29"/>
        <vers num="3.10.3"/>
        <vers num="3.10.4"/>
        <vers num="3.10.5"/>
        <vers num="3.10.6"/>
        <vers num="3.10.7"/>
        <vers num="3.10.8"/>
        <vers num="3.10.9"/>
        <vers num="3.11"/>
        <vers num="3.11.1"/>
        <vers num="3.11.10"/>
        <vers num="3.11.2"/>
        <vers num="3.11.3"/>
        <vers num="3.11.4"/>
        <vers num="3.11.5"/>
        <vers num="3.11.6"/>
        <vers num="3.11.7"/>
        <vers num="3.11.8"/>
        <vers num="3.11.9"/>
        <vers num="3.12"/>
        <vers num="3.12.1"/>
        <vers num="3.12.10"/>
        <vers num="3.12.11"/>
        <vers num="3.12.12"/>
        <vers num="3.12.13"/>
        <vers num="3.12.2"/>
        <vers num="3.12.3"/>
        <vers num="3.12.4"/>
        <vers num="3.12.5"/>
        <vers num="3.12.6"/>
        <vers num="3.12.7"/>
        <vers num="3.12.8"/>
        <vers num="3.12.9"/>
        <vers num="3.13"/>
        <vers num="3.13.1"/>
        <vers num="3.13.2"/>
        <vers num="3.13.3"/>
        <vers num="3.13.4"/>
        <vers num="3.13.5"/>
        <vers num="3.13.6"/>
        <vers num="3.13.7"/>
        <vers num="3.13.8"/>
        <vers prev="1" num="3.14"/>
        <vers num="3.2" edition="rc2"/>
        <vers num="3.2" edition="rc3"/>
        <vers num="3.2" edition="rc4"/>
        <vers num="3.2" edition="rc5"/>
        <vers num="3.2" edition="rc6"/>
        <vers num="3.2" edition="rc7"/>
        <vers num="3.2.1"/>
        <vers num="3.2.10"/>
        <vers num="3.2.11"/>
        <vers num="3.2.12"/>
        <vers num="3.2.13"/>
        <vers num="3.2.14"/>
        <vers num="3.2.15"/>
        <vers num="3.2.16"/>
        <vers num="3.2.17"/>
        <vers num="3.2.18"/>
        <vers num="3.2.19"/>
        <vers num="3.2.2"/>
        <vers num="3.2.20"/>
        <vers num="3.2.21"/>
        <vers num="3.2.22"/>
        <vers num="3.2.23"/>
        <vers num="3.2.24"/>
        <vers num="3.2.25"/>
        <vers num="3.2.26"/>
        <vers num="3.2.27"/>
        <vers num="3.2.28"/>
        <vers num="3.2.29"/>
        <vers num="3.2.3"/>
        <vers num="3.2.30"/>
        <vers num="3.2.4"/>
        <vers num="3.2.5"/>
        <vers num="3.2.6"/>
        <vers num="3.2.7"/>
        <vers num="3.2.8"/>
        <vers num="3.2.9"/>
        <vers num="3.3" edition="rc1"/>
        <vers num="3.3" edition="rc2"/>
        <vers num="3.3" edition="rc3"/>
        <vers num="3.3" edition="rc4"/>
        <vers num="3.3" edition="rc5"/>
        <vers num="3.3" edition="rc6"/>
        <vers num="3.3" edition="rc7"/>
        <vers num="3.3.1"/>
        <vers num="3.3.2"/>
        <vers num="3.3.3"/>
        <vers num="3.3.4"/>
        <vers num="3.3.5"/>
        <vers num="3.3.6"/>
        <vers num="3.3.7"/>
        <vers num="3.3.8"/>
        <vers num="3.4" edition="rc1"/>
        <vers num="3.4" edition="rc2"/>
        <vers num="3.4" edition="rc3"/>
        <vers num="3.4" edition="rc4"/>
        <vers num="3.4" edition="rc5"/>
        <vers num="3.4" edition="rc6"/>
        <vers num="3.4" edition="rc7"/>
        <vers num="3.4.1"/>
        <vers num="3.4.10"/>
        <vers num="3.4.11"/>
        <vers num="3.4.12"/>
        <vers num="3.4.13"/>
        <vers num="3.4.14"/>
        <vers num="3.4.15"/>
        <vers num="3.4.16"/>
        <vers num="3.4.17"/>
        <vers num="3.4.18"/>
        <vers num="3.4.19"/>
        <vers num="3.4.2"/>
        <vers num="3.4.20"/>
        <vers num="3.4.21"/>
        <vers num="3.4.22"/>
        <vers num="3.4.23"/>
        <vers num="3.4.24"/>
        <vers num="3.4.25"/>
        <vers num="3.4.26"/>
        <vers num="3.4.27"/>
        <vers num="3.4.28"/>
        <vers num="3.4.29"/>
        <vers num="3.4.3"/>
        <vers num="3.4.30"/>
        <vers num="3.4.31"/>
        <vers num="3.4.32"/>
        <vers num="3.4.33"/>
        <vers num="3.4.34"/>
        <vers num="3.4.35"/>
        <vers num="3.4.36"/>
        <vers num="3.4.37"/>
        <vers num="3.4.38"/>
        <vers num="3.4.39"/>
        <vers num="3.4.4"/>
        <vers num="3.4.40"/>
        <vers num="3.4.41"/>
        <vers num="3.4.42"/>
        <vers num="3.4.43"/>
        <vers num="3.4.44"/>
        <vers num="3.4.45"/>
        <vers num="3.4.46"/>
        <vers num="3.4.47"/>
        <vers num="3.4.48"/>
        <vers num="3.4.49"/>
        <vers num="3.4.5"/>
        <vers num="3.4.50"/>
        <vers num="3.4.51"/>
        <vers num="3.4.52"/>
        <vers num="3.4.53"/>
        <vers num="3.4.54"/>
        <vers num="3.4.55"/>
        <vers num="3.4.56"/>
        <vers num="3.4.57"/>
        <vers num="3.4.58"/>
        <vers num="3.4.59"/>
        <vers num="3.4.6"/>
        <vers num="3.4.60"/>
        <vers num="3.4.61"/>
        <vers num="3.4.62"/>
        <vers num="3.4.63"/>
        <vers num="3.4.64"/>
        <vers num="3.4.65"/>
        <vers num="3.4.66"/>
        <vers num="3.4.67"/>
        <vers num="3.4.68"/>
        <vers num="3.4.69"/>
        <vers num="3.4.7"/>
        <vers num="3.4.70"/>
        <vers num="3.4.71"/>
        <vers num="3.4.72"/>
        <vers num="3.4.73"/>
        <vers num="3.4.74"/>
        <vers num="3.4.75"/>
        <vers num="3.4.76"/>
        <vers num="3.4.77"/>
        <vers num="3.4.78"/>
        <vers num="3.4.79"/>
        <vers num="3.4.8"/>
        <vers num="3.4.9"/>
        <vers num="3.5.1"/>
        <vers num="3.5.2"/>
        <vers num="3.5.3"/>
        <vers num="3.5.4"/>
        <vers num="3.5.5"/>
        <vers num="3.5.6"/>
        <vers num="3.5.7"/>
        <vers num="3.6"/>
        <vers num="3.6.1"/>
        <vers num="3.6.10"/>
        <vers num="3.6.11"/>
        <vers num="3.6.2"/>
        <vers num="3.6.3"/>
        <vers num="3.6.4"/>
        <vers num="3.6.5"/>
        <vers num="3.6.6"/>
        <vers num="3.6.7"/>
        <vers num="3.6.8"/>
        <vers num="3.6.9"/>
        <vers num="3.7"/>
        <vers num="3.7.1"/>
        <vers num="3.7.10"/>
        <vers num="3.7.2"/>
        <vers num="3.7.3"/>
        <vers num="3.7.4"/>
        <vers num="3.7.5"/>
        <vers num="3.7.6"/>
        <vers num="3.7.7"/>
        <vers num="3.7.8"/>
        <vers num="3.7.9"/>
        <vers num="3.8.0"/>
        <vers num="3.8.1"/>
        <vers num="3.8.10"/>
        <vers num="3.8.11"/>
        <vers num="3.8.12"/>
        <vers num="3.8.13"/>
        <vers num="3.8.2"/>
        <vers num="3.8.3"/>
        <vers num="3.8.4"/>
        <vers num="3.8.5"/>
        <vers num="3.8.6"/>
        <vers num="3.8.7"/>
        <vers num="3.8.8"/>
        <vers num="3.8.9"/>
        <vers num="3.9" edition="rc1"/>
        <vers num="3.9" edition="rc2"/>
        <vers num="3.9" edition="rc3"/>
        <vers num="3.9" edition="rc4"/>
        <vers num="3.9" edition="rc5"/>
        <vers num="3.9" edition="rc6"/>
        <vers num="3.9" edition="rc7"/>
        <vers num="3.9.0"/>
        <vers num="3.9.1"/>
        <vers num="3.9.10"/>
        <vers num="3.9.11"/>
        <vers num="3.9.2"/>
        <vers num="3.9.3"/>
        <vers num="3.9.4"/>
        <vers num="3.9.5"/>
        <vers num="3.9.6"/>
        <vers num="3.9.7"/>
        <vers num="3.9.8"/>
        <vers num="3.9.9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-2690" published="2014-04-15" name="CVE-2014-2690" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:L/AC:L/Au:N/C:P/I:N/A:N)" CVSS_score="2.1" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="3.9" CVSS_base_score="2.1">
    <desc>
      <descript source="cve">Citrix VDI-in-a-Box 5.3.x before 5.3.6 and 5.4.x before 5.4.3 allows local users to obtain administrator credentials by reading the log.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="http://www.securitytracker.com/id/1030068" source="SECTRACK">1030068</ref>
      <ref url="http://support.citrix.com/article/CTX140106" source="CONFIRM" adv="1">http://support.citrix.com/article/CTX140106</ref>
      <ref url="http://secunia.com/advisories/57734" source="SECUNIA" adv="1">57734</ref>
    </refs>
    <vuln_soft>
      <prod vendor="citrix" name="vdi-in-a-box">
        <vers num="5.3.0"/>
        <vers num="5.3.1"/>
        <vers num="5.3.2"/>
        <vers num="5.3.3"/>
        <vers num="5.3.4"/>
        <vers num="5.3.5"/>
        <vers num="5.4.0"/>
        <vers num="5.4.1"/>
        <vers num="5.4.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2706" published="2014-04-14" name="CVE-2014-2706" modified="2014-04-15" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:N/A:C)" CVSS_score="7.1" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="8.6" CVSS_base_score="7.1">
    <desc>
      <descript source="cve">Race condition in the mac80211 subsystem in the Linux kernel before 3.13.7 allows remote attackers to cause a denial of service (system crash) via network traffic that improperly interacts with the WLAN_STA_PS_STA state (aka power-save mode), related to sta_info.c and tx.c.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://github.com/torvalds/linux/commit/1d147bfa64293b2723c4fec50922168658e613ba" source="CONFIRM" patch="1">https://github.com/torvalds/linux/commit/1d147bfa64293b2723c4fec50922168658e613ba</ref>
      <ref url="http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=1d147bfa64293b2723c4fec50922168658e613ba" source="CONFIRM" patch="1">http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=1d147bfa64293b2723c4fec50922168658e613ba</ref>
      <ref url="https://bugzilla.redhat.com/show_bug.cgi?id=1083512" source="CONFIRM">https://bugzilla.redhat.com/show_bug.cgi?id=1083512</ref>
      <ref url="https://bugzilla.kernel.org/show_bug.cgi?id=70551#c18" source="CONFIRM">https://bugzilla.kernel.org/show_bug.cgi?id=70551#c18</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/04/01/8" source="MLIST">[oss-security] 20140401 Re: CVE request: Linux Kernel, two security issues</ref>
      <ref url="http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.13.7" source="CONFIRM">http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.13.7</ref>
    </refs>
    <vuln_soft>
      <prod vendor="linux" name="linux_kernel">
        <vers num="3.0" edition="rc1"/>
        <vers num="3.0" edition="rc2"/>
        <vers num="3.0" edition="rc3"/>
        <vers num="3.0" edition="rc4"/>
        <vers num="3.0" edition="rc5"/>
        <vers num="3.0" edition="rc6"/>
        <vers num="3.0" edition="rc7"/>
        <vers num="3.0.1"/>
        <vers num="3.0.10"/>
        <vers num="3.0.11"/>
        <vers num="3.0.12"/>
        <vers num="3.0.13"/>
        <vers num="3.0.14"/>
        <vers num="3.0.15"/>
        <vers num="3.0.16"/>
        <vers num="3.0.17"/>
        <vers num="3.0.18"/>
        <vers num="3.0.19"/>
        <vers num="3.0.2"/>
        <vers num="3.0.20"/>
        <vers num="3.0.21"/>
        <vers num="3.0.22"/>
        <vers num="3.0.23"/>
        <vers num="3.0.24"/>
        <vers num="3.0.25"/>
        <vers num="3.0.26"/>
        <vers num="3.0.27"/>
        <vers num="3.0.28"/>
        <vers num="3.0.29"/>
        <vers num="3.0.3"/>
        <vers num="3.0.30"/>
        <vers num="3.0.31"/>
        <vers num="3.0.32"/>
        <vers num="3.0.33"/>
        <vers num="3.0.34"/>
        <vers num="3.0.35"/>
        <vers num="3.0.36"/>
        <vers num="3.0.37"/>
        <vers num="3.0.38"/>
        <vers num="3.0.39"/>
        <vers num="3.0.4"/>
        <vers num="3.0.40"/>
        <vers num="3.0.41"/>
        <vers num="3.0.42"/>
        <vers num="3.0.43"/>
        <vers num="3.0.44"/>
        <vers num="3.0.45"/>
        <vers num="3.0.46"/>
        <vers num="3.0.47"/>
        <vers num="3.0.48"/>
        <vers num="3.0.49"/>
        <vers num="3.0.5"/>
        <vers num="3.0.50"/>
        <vers num="3.0.51"/>
        <vers num="3.0.52"/>
        <vers num="3.0.53"/>
        <vers num="3.0.54"/>
        <vers num="3.0.55"/>
        <vers num="3.0.56"/>
        <vers num="3.0.57"/>
        <vers num="3.0.58"/>
        <vers num="3.0.59"/>
        <vers num="3.0.6"/>
        <vers num="3.0.60"/>
        <vers num="3.0.61"/>
        <vers num="3.0.62"/>
        <vers num="3.0.63"/>
        <vers num="3.0.64"/>
        <vers num="3.0.65"/>
        <vers num="3.0.66"/>
        <vers num="3.0.67"/>
        <vers num="3.0.68"/>
        <vers num="3.0.7"/>
        <vers num="3.0.8"/>
        <vers num="3.0.9"/>
        <vers num="3.1" edition="rc1"/>
        <vers num="3.1" edition="rc2"/>
        <vers num="3.1" edition="rc3"/>
        <vers num="3.1" edition="rc4"/>
        <vers num="3.1.1"/>
        <vers num="3.1.10"/>
        <vers num="3.1.2"/>
        <vers num="3.1.3"/>
        <vers num="3.1.4"/>
        <vers num="3.1.5"/>
        <vers num="3.1.6"/>
        <vers num="3.1.7"/>
        <vers num="3.1.8"/>
        <vers num="3.1.9"/>
        <vers num="3.10"/>
        <vers num="3.10.1"/>
        <vers num="3.10.10"/>
        <vers num="3.10.11"/>
        <vers num="3.10.12"/>
        <vers num="3.10.13"/>
        <vers num="3.10.14"/>
        <vers num="3.10.15"/>
        <vers num="3.10.16"/>
        <vers num="3.10.17"/>
        <vers num="3.10.18"/>
        <vers num="3.10.19"/>
        <vers num="3.10.2"/>
        <vers num="3.10.20"/>
        <vers num="3.10.21"/>
        <vers num="3.10.22"/>
        <vers num="3.10.23"/>
        <vers num="3.10.24"/>
        <vers num="3.10.25"/>
        <vers num="3.10.26"/>
        <vers num="3.10.27"/>
        <vers num="3.10.28"/>
        <vers num="3.10.29"/>
        <vers num="3.10.3"/>
        <vers num="3.10.4"/>
        <vers num="3.10.5"/>
        <vers num="3.10.6"/>
        <vers num="3.10.7"/>
        <vers num="3.10.8"/>
        <vers num="3.10.9"/>
        <vers num="3.11"/>
        <vers num="3.11.1"/>
        <vers num="3.11.10"/>
        <vers num="3.11.2"/>
        <vers num="3.11.3"/>
        <vers num="3.11.4"/>
        <vers num="3.11.5"/>
        <vers num="3.11.6"/>
        <vers num="3.11.7"/>
        <vers num="3.11.8"/>
        <vers num="3.11.9"/>
        <vers num="3.12"/>
        <vers num="3.12.1"/>
        <vers num="3.12.10"/>
        <vers num="3.12.11"/>
        <vers num="3.12.12"/>
        <vers num="3.12.13"/>
        <vers num="3.12.14"/>
        <vers num="3.12.15"/>
        <vers num="3.12.16"/>
        <vers num="3.12.17"/>
        <vers num="3.12.2"/>
        <vers num="3.12.3"/>
        <vers num="3.12.4"/>
        <vers num="3.12.5"/>
        <vers num="3.12.6"/>
        <vers num="3.12.7"/>
        <vers num="3.12.8"/>
        <vers num="3.12.9"/>
        <vers num="3.13"/>
        <vers num="3.13.1"/>
        <vers num="3.13.2"/>
        <vers num="3.13.3"/>
        <vers num="3.13.4"/>
        <vers num="3.13.5"/>
        <vers prev="1" num="3.13.6"/>
        <vers num="3.2" edition="rc2"/>
        <vers num="3.2" edition="rc3"/>
        <vers num="3.2" edition="rc4"/>
        <vers num="3.2" edition="rc5"/>
        <vers num="3.2" edition="rc6"/>
        <vers num="3.2" edition="rc7"/>
        <vers num="3.2.1"/>
        <vers num="3.2.10"/>
        <vers num="3.2.11"/>
        <vers num="3.2.12"/>
        <vers num="3.2.13"/>
        <vers num="3.2.14"/>
        <vers num="3.2.15"/>
        <vers num="3.2.16"/>
        <vers num="3.2.17"/>
        <vers num="3.2.18"/>
        <vers num="3.2.19"/>
        <vers num="3.2.2"/>
        <vers num="3.2.20"/>
        <vers num="3.2.21"/>
        <vers num="3.2.22"/>
        <vers num="3.2.23"/>
        <vers num="3.2.24"/>
        <vers num="3.2.25"/>
        <vers num="3.2.26"/>
        <vers num="3.2.27"/>
        <vers num="3.2.28"/>
        <vers num="3.2.29"/>
        <vers num="3.2.3"/>
        <vers num="3.2.30"/>
        <vers num="3.2.4"/>
        <vers num="3.2.5"/>
        <vers num="3.2.6"/>
        <vers num="3.2.7"/>
        <vers num="3.2.8"/>
        <vers num="3.2.9"/>
        <vers num="3.3" edition="rc1"/>
        <vers num="3.3" edition="rc2"/>
        <vers num="3.3" edition="rc3"/>
        <vers num="3.3" edition="rc4"/>
        <vers num="3.3" edition="rc5"/>
        <vers num="3.3" edition="rc6"/>
        <vers num="3.3" edition="rc7"/>
        <vers num="3.3.1"/>
        <vers num="3.3.2"/>
        <vers num="3.3.3"/>
        <vers num="3.3.4"/>
        <vers num="3.3.5"/>
        <vers num="3.3.6"/>
        <vers num="3.3.7"/>
        <vers num="3.3.8"/>
        <vers num="3.4" edition="rc1"/>
        <vers num="3.4" edition="rc2"/>
        <vers num="3.4" edition="rc3"/>
        <vers num="3.4" edition="rc4"/>
        <vers num="3.4" edition="rc5"/>
        <vers num="3.4" edition="rc6"/>
        <vers num="3.4" edition="rc7"/>
        <vers num="3.4.1"/>
        <vers num="3.4.10"/>
        <vers num="3.4.11"/>
        <vers num="3.4.12"/>
        <vers num="3.4.13"/>
        <vers num="3.4.14"/>
        <vers num="3.4.15"/>
        <vers num="3.4.16"/>
        <vers num="3.4.17"/>
        <vers num="3.4.18"/>
        <vers num="3.4.19"/>
        <vers num="3.4.2"/>
        <vers num="3.4.20"/>
        <vers num="3.4.21"/>
        <vers num="3.4.22"/>
        <vers num="3.4.23"/>
        <vers num="3.4.24"/>
        <vers num="3.4.25"/>
        <vers num="3.4.26"/>
        <vers num="3.4.27"/>
        <vers num="3.4.28"/>
        <vers num="3.4.29"/>
        <vers num="3.4.3"/>
        <vers num="3.4.30"/>
        <vers num="3.4.31"/>
        <vers num="3.4.32"/>
        <vers num="3.4.33"/>
        <vers num="3.4.34"/>
        <vers num="3.4.35"/>
        <vers num="3.4.36"/>
        <vers num="3.4.37"/>
        <vers num="3.4.38"/>
        <vers num="3.4.39"/>
        <vers num="3.4.4"/>
        <vers num="3.4.40"/>
        <vers num="3.4.41"/>
        <vers num="3.4.42"/>
        <vers num="3.4.43"/>
        <vers num="3.4.44"/>
        <vers num="3.4.45"/>
        <vers num="3.4.46"/>
        <vers num="3.4.47"/>
        <vers num="3.4.48"/>
        <vers num="3.4.49"/>
        <vers num="3.4.5"/>
        <vers num="3.4.50"/>
        <vers num="3.4.51"/>
        <vers num="3.4.52"/>
        <vers num="3.4.53"/>
        <vers num="3.4.54"/>
        <vers num="3.4.55"/>
        <vers num="3.4.56"/>
        <vers num="3.4.57"/>
        <vers num="3.4.58"/>
        <vers num="3.4.59"/>
        <vers num="3.4.6"/>
        <vers num="3.4.60"/>
        <vers num="3.4.61"/>
        <vers num="3.4.62"/>
        <vers num="3.4.63"/>
        <vers num="3.4.64"/>
        <vers num="3.4.65"/>
        <vers num="3.4.66"/>
        <vers num="3.4.67"/>
        <vers num="3.4.68"/>
        <vers num="3.4.69"/>
        <vers num="3.4.7"/>
        <vers num="3.4.70"/>
        <vers num="3.4.71"/>
        <vers num="3.4.72"/>
        <vers num="3.4.73"/>
        <vers num="3.4.74"/>
        <vers num="3.4.75"/>
        <vers num="3.4.76"/>
        <vers num="3.4.77"/>
        <vers num="3.4.78"/>
        <vers num="3.4.79"/>
        <vers num="3.4.8"/>
        <vers num="3.4.9"/>
        <vers num="3.5.1"/>
        <vers num="3.5.2"/>
        <vers num="3.5.3"/>
        <vers num="3.5.4"/>
        <vers num="3.5.5"/>
        <vers num="3.5.6"/>
        <vers num="3.5.7"/>
        <vers num="3.6"/>
        <vers num="3.6.1"/>
        <vers num="3.6.10"/>
        <vers num="3.6.11"/>
        <vers num="3.6.2"/>
        <vers num="3.6.3"/>
        <vers num="3.6.4"/>
        <vers num="3.6.5"/>
        <vers num="3.6.6"/>
        <vers num="3.6.7"/>
        <vers num="3.6.8"/>
        <vers num="3.6.9"/>
        <vers num="3.7"/>
        <vers num="3.7.1"/>
        <vers num="3.7.10"/>
        <vers num="3.7.2"/>
        <vers num="3.7.3"/>
        <vers num="3.7.4"/>
        <vers num="3.7.5"/>
        <vers num="3.7.6"/>
        <vers num="3.7.7"/>
        <vers num="3.7.8"/>
        <vers num="3.7.9"/>
        <vers num="3.8.0"/>
        <vers num="3.8.1"/>
        <vers num="3.8.10"/>
        <vers num="3.8.11"/>
        <vers num="3.8.12"/>
        <vers num="3.8.13"/>
        <vers num="3.8.2"/>
        <vers num="3.8.3"/>
        <vers num="3.8.4"/>
        <vers num="3.8.5"/>
        <vers num="3.8.6"/>
        <vers num="3.8.7"/>
        <vers num="3.8.8"/>
        <vers num="3.8.9"/>
        <vers num="3.9" edition="rc1"/>
        <vers num="3.9" edition="rc2"/>
        <vers num="3.9" edition="rc3"/>
        <vers num="3.9" edition="rc4"/>
        <vers num="3.9" edition="rc5"/>
        <vers num="3.9" edition="rc6"/>
        <vers num="3.9" edition="rc7"/>
        <vers num="3.9.0"/>
        <vers num="3.9.1"/>
        <vers num="3.9.10"/>
        <vers num="3.9.11"/>
        <vers num="3.9.2"/>
        <vers num="3.9.3"/>
        <vers num="3.9.4"/>
        <vers num="3.9.5"/>
        <vers num="3.9.6"/>
        <vers num="3.9.7"/>
        <vers num="3.9.8"/>
        <vers num="3.9.9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2707" published="2014-04-17" name="CVE-2014-2707" modified="2014-04-18" CVSS_version="2.0" CVSS_vector="(AV:A/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="5.8" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="6.5" CVSS_base_score="5.8">
    <desc>
      <descript source="cve">cups-browsed in cups-filters 1.0.41 before 1.0.51 in allows remote IPP printers to execute arbitrary commands via shell metacharacters in the (1) model or (2) PDL, related to "System V interface scripts generated for queues."</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <local_network/>
    </range>
    <refs>
      <ref url="https://bugzilla.redhat.com/show_bug.cgi?id=1083326" source="CONFIRM">https://bugzilla.redhat.com/show_bug.cgi?id=1083326</ref>
      <ref url="http://secunia.com/advisories/57530" source="SECUNIA" adv="1">57530</ref>
      <ref url="http://seclists.org/oss-sec/2014/q2/13" source="MLIST">[oss-security] 20140402 Re: cups-browsed remote exploit</ref>
      <ref url="http://lists.fedoraproject.org/pipermail/package-announce/2014-April/131485.html" source="FEDORA">FEDORA-2014-4708</ref>
      <ref url="http://bzr.linuxfoundation.org/loggerhead/openprinting/cups-filters/revision/7188#NEWS" source="CONFIRM">http://bzr.linuxfoundation.org/loggerhead/openprinting/cups-filters/revision/7188#NEWS</ref>
    </refs>
    <vuln_soft>
      <prod vendor="linuxfoundation" name="cups-filters">
        <vers num="1.0.41"/>
        <vers num="1.0.42"/>
        <vers num="1.0.43"/>
        <vers num="1.0.44"/>
        <vers num="1.0.45"/>
        <vers num="1.0.46"/>
        <vers num="1.0.47"/>
        <vers num="1.0.48"/>
        <vers num="1.0.49"/>
        <vers num="1.0.50"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2708" published="2014-04-10" name="CVE-2014-2708" modified="2014-04-11" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">SQL injection vulnerability in graph_xport.php in Cacti 0.8.8b allows remote attackers to execute arbitrary SQL commands via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://svn.cacti.net/viewvc?view=rev&amp;revision=7439" source="CONFIRM" patch="1">http://svn.cacti.net/viewvc?view=rev&amp;revision=7439</ref>
      <ref url="https://bugzilla.redhat.com/show_bug.cgi?id=1084258" source="CONFIRM">https://bugzilla.redhat.com/show_bug.cgi?id=1084258</ref>
      <ref url="http://xforce.iss.net/xforce/xfdb/92278" source="XF">cacti-cve20142708-sql-injection(92278)</ref>
      <ref url="http://www.securityfocus.com/bid/66555" source="BID">66555</ref>
      <ref url="http://seclists.org/oss-sec/2014/q2/2" source="MLIST">[oss-security] 20140401 CVE request: cacti "bug#0002405: SQL injection in graph_xport.php"</ref>
      <ref url="http://seclists.org/oss-sec/2014/q2/15" source="MLIST">[oss-security] 20140403 Re: CVE request: cacti "bug#0002405: SQL injection in graph_xport.php"</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cacti" name="cacti">
        <vers num="0.8.8b"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2709" published="2014-04-23" name="CVE-2014-2709" modified="2014-04-24" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">lib/rrd.php in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in unspecified parameters.</descript>
      <descript source="nvd">Per: https://cwe.mitre.org/data/definitions/77.html

"CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')"</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://svn.cacti.net/viewvc?view=rev&amp;revision=7439" source="CONFIRM" patch="1">http://svn.cacti.net/viewvc?view=rev&amp;revision=7439</ref>
      <ref url="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=742768" source="CONFIRM">https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=742768</ref>
      <ref url="http://www.securityfocus.com/bid/66630" source="BID">66630</ref>
      <ref url="http://secunia.com/advisories/57647" source="SECUNIA" adv="1">57647</ref>
      <ref url="http://seclists.org/oss-sec/2014/q2/15" source="MLIST">[oss-security] 20140403 Re: CVE request: cacti "bug#0002405: SQL injection in graph_xport.php"</ref>
      <ref url="http://lists.fedoraproject.org/pipermail/package-announce/2014-April/131842.html" source="FEDORA">FEDORA-2014-4892</ref>
      <ref url="http://lists.fedoraproject.org/pipermail/package-announce/2014-April/131821.html" source="FEDORA">FEDORA-2014-4928</ref>
    </refs>
    <vuln_soft>
      <prod vendor="cacti" name="cacti">
        <vers num="0.8.7"/>
        <vers num="0.8.7a"/>
        <vers num="0.8.7b"/>
        <vers num="0.8.7c"/>
        <vers num="0.8.7d"/>
        <vers num="0.8.7e"/>
        <vers num="0.8.7f"/>
        <vers prev="1" num="0.8.7g"/>
        <vers num="0.8.8"/>
        <vers num="0.8.8a"/>
        <vers prev="1" num="0.8.8b"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2711" published="2014-04-14" name="CVE-2014-2711" modified="2014-04-19" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in J-Web in Juniper Junos before 11.4R11, 11.4X27 before 11.4X27.62 (BBE), 12.1 before 12.1R9, 12.1X44 before 12.1X44-D35, 12.1X45 before 12.1X45-D25, 12.1X46 before 12.1X46-D20, 12.2 before 12.2R7, 12.3 before 12.3R6, 13.1 before 13.1R4, 13.2 before 13.2R3, and 13.3 before 13.3R1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://kb.juniper.net/InfoCenter/index?page=content&amp;id=JSA10619" source="CONFIRM" adv="1">http://kb.juniper.net/InfoCenter/index?page=content&amp;id=JSA10619</ref>
    </refs>
    <vuln_soft>
      <prod vendor="juniper" name="junos">
        <vers num="11.4"/>
        <vers num="11.4x27"/>
        <vers num="12.1"/>
        <vers num="12.1x44"/>
        <vers num="12.1x45"/>
        <vers num="12.1x46"/>
        <vers num="12.2"/>
        <vers num="12.3"/>
        <vers num="13.1"/>
        <vers num="13.2"/>
        <vers num="13.3"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2712" published="2014-04-14" name="CVE-2014-2712" modified="2014-04-19" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in J-Web in Juniper Junos before 10.0S25, 10.4 before 10.4R10, 11.4 before 11.4R11, 12.1 before 12.1R9, 12.1X44 before 12.1X44-D30, 12.1X45 before 12.1X45-D20, 12.1X46 before 12.1X46-D10, and 12.2 before 12.2R1 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters to index.php.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://kb.juniper.net/InfoCenter/index?page=content&amp;id=JSA10521" source="CONFIRM" adv="1">http://kb.juniper.net/InfoCenter/index?page=content&amp;id=JSA10521</ref>
    </refs>
    <vuln_soft>
      <prod vendor="juniper" name="junos">
        <vers num="10.0"/>
        <vers num="10.4"/>
        <vers num="11.4"/>
        <vers num="12.1"/>
        <vers num="12.1x44"/>
        <vers num="12.1x45"/>
        <vers num="12.1x46"/>
        <vers num="12.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2713" published="2014-04-14" name="CVE-2014-2713" modified="2014-04-15" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:P)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">Juniper Junos before 11.4R11, 12.1 before 12.1R9, 12.2 before 12.2R7, 12.3R4 before 12.3R4-S3, 13.1 before 13.1R4, 13.2 before 13.2R2, and 13.3 before 13.3R1, as used in MX Series and T4000 routers, allows remote attackers to cause a denial of service (PFE restart) via a crafted IP packet to certain (1) Trio or (2) Cassis-based Packet Forwarding Engine (PFE) modules.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://kb.juniper.net/InfoCenter/index?page=content&amp;id=JSA10621" source="CONFIRM" adv="1">http://kb.juniper.net/InfoCenter/index?page=content&amp;id=JSA10621</ref>
    </refs>
    <vuln_soft>
      <prod vendor="juniper" name="junos">
        <vers num="11.4"/>
        <vers num="12.1"/>
        <vers num="12.2"/>
        <vers num="12.3"/>
        <vers num="13.1"/>
        <vers num="13.2"/>
        <vers num="13.3"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2714" published="2014-04-14" name="CVE-2014-2714" modified="2014-04-15" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:N/A:C)" CVSS_score="7.1" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="8.6" CVSS_base_score="7.1">
    <desc>
      <descript source="cve">The Enhanced Web Filtering (EWF) in Juniper Junos before 10.4R15, 11.4 before 11.4R9, 12.1 before 12.1R7, 12.1X44 before 12.1X44-D20, 12.1X45 before 12.1X45-D10, and 12.1X46 before 12.1X46-D10, as used in the SRX Series services gateways, allows remote attackers to cause a denial of service (flow daemon crash and restart) via a crafted URL.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.securityfocus.com/bid/66760" source="BID">66760</ref>
      <ref url="http://securitytracker.com/id?1030060" source="SECTRACK">1030060</ref>
      <ref url="http://secunia.com/advisories/57835" source="SECUNIA" adv="1">57835</ref>
      <ref url="http://kb.juniper.net/InfoCenter/index?page=content&amp;id=JSA10622" source="CONFIRM" adv="1">http://kb.juniper.net/InfoCenter/index?page=content&amp;id=JSA10622</ref>
    </refs>
    <vuln_soft>
      <prod vendor="juniper" name="junos">
        <vers num="10.4"/>
        <vers num="11.4"/>
        <vers num="12.1"/>
        <vers num="12.1x44"/>
        <vers num="12.1x45"/>
        <vers num="12.1x46"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2715" published="2014-04-28" name="CVE-2014-2715" modified="2014-04-29" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Multiple cross-site scripting (XSS) vulnerabilities in vwrooms\templates\logout.tpl.php in the VideoWhisper Webcam plugins for Drupal 7.x allow remote attackers to inject arbitrary web script or HTML via the (1) module or (2) message parameter to index.php.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://www.securityfocus.com/archive/1/archive/1/531935/100/0/threaded" source="BUGTRAQ">20140425 [CVE-2014-2715] Cross-site scripting (XSS) vulnerability in Videowhisper</ref>
    </refs>
    <vuln_soft>
      <prod vendor="videowhisper" name="videowhisper">
        <vers num="7.x-1.0" edition=":~~~drupal~~"/>
        <vers num="7.x-1.1" edition=":~~~drupal~~"/>
        <vers num="7.x-1.3" edition=":~~~drupal~~"/>
        <vers num="7.x-1.x" edition="dev:~~~drupal~~"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2719" published="2014-04-22" name="CVE-2014-2719" modified="2014-04-22" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:S/C:C/I:N/A:N)" CVSS_score="6.3" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="6.8" CVSS_base_score="6.3">
    <desc>
      <descript source="cve">Advanced_System_Content.asp in the ASUS RT series routers with firmware before 3.0.0.4.374.5517, when an administrator session is active, allows remote authenticated users to obtain the administrator user name and password by reading the source code.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://support.asus.com/download.aspx?m=RT-N66U+%28VER.B1%29" source="CONFIRM">http://support.asus.com/download.aspx?m=RT-N66U+%28VER.B1%29</ref>
      <ref url="http://seclists.org/fulldisclosure/2014/Apr/225" source="FULLDISC">20140416 ASUS RT-XXXX SOHO routers expose admin password, fixed in 3.0.0.4.374.5517</ref>
      <ref url="http://dnlongen.blogspot.com/2014/04/CVE-2014-2719-Asus-RT-Password-Disclosure.html" source="MISC">http://dnlongen.blogspot.com/2014/04/CVE-2014-2719-Asus-RT-Password-Disclosure.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="asus" name="rt-ac68u">
        <vers num="-"/>
      </prod>
      <prod vendor="asus" name="rt-ac66u_firmware">
        <vers num="3.0.0.4.140"/>
        <vers num="3.0.0.4.220"/>
        <vers num="3.0.0.4.246"/>
        <vers num="3.0.0.4.260"/>
        <vers num="3.0.0.4.270"/>
        <vers num="3.0.0.4.354"/>
      </prod>
      <prod vendor="asus" name="rt-ac68u_firmware">
        <vers num="3.0.0.4.374.4755"/>
        <vers num="3.0.0.4.374_4561"/>
        <vers num="3.0.0.4.374_4887"/>
      </prod>
      <prod vendor="asus" name="rt-n10e_firmware">
        <vers num="2.0.0.10"/>
        <vers num="2.0.0.16"/>
        <vers num="2.0.0.19"/>
        <vers num="2.0.0.20"/>
        <vers num="2.0.0.24"/>
        <vers num="2.0.0.25"/>
        <vers num="2.0.0.7"/>
      </prod>
      <prod vendor="asus" name="rt-n14u_firmware">
        <vers num="3.0.0.4.322"/>
        <vers num="3.0.0.4.356"/>
      </prod>
      <prod vendor="asus" name="rt-n16_firmware">
        <vers num="1.0.1.9"/>
        <vers num="1.0.2.3"/>
        <vers num="3.0.0.3.108"/>
        <vers num="3.0.0.3.162"/>
        <vers num="3.0.0.3.178"/>
        <vers num="3.0.0.4.220"/>
        <vers num="3.0.0.4.246"/>
        <vers num="3.0.0.4.260"/>
        <vers num="3.0.0.4.354"/>
        <vers num="7.0.2.38b"/>
      </prod>
      <prod vendor="asus" name="rt-n56u_firmware">
        <vers num="1.0.1.4"/>
        <vers num="1.0.1.4o"/>
        <vers num="1.0.1.7c"/>
        <vers num="1.0.1.7f"/>
        <vers num="1.0.1.8j"/>
        <vers num="1.0.1.8l"/>
        <vers num="1.0.1.8n"/>
        <vers num="3.0.0.4.318"/>
        <vers num="3.0.0.4.334"/>
        <vers num="3.0.0.4.342"/>
        <vers num="3.0.0.4.360"/>
        <vers num="7.0.1.21"/>
        <vers num="7.0.1.32"/>
        <vers num="8.1.1.4"/>
      </prod>
      <prod vendor="asus" name="rt-n65u_firmware">
        <vers num="3.0.0.3.134"/>
        <vers num="3.0.0.3.176"/>
        <vers num="3.0.0.4.260"/>
        <vers num="3.0.0.4.334"/>
        <vers num="3.0.0.4.342"/>
        <vers num="3.0.0.4.346"/>
      </prod>
      <prod vendor="asus" name="rt-n66u_firmware">
        <vers num="3.0.0.4.272"/>
        <vers num="3.0.0.4.370"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-2729" published="2014-04-25" name="CVE-2014-2729" modified="2014-04-25" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:S/C:N/I:P/A:N)" CVSS_score="3.5" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="6.8" CVSS_base_score="3.5">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in content.aspx in Ektron CMS 8.7 before 8.7.0.055 allows remote authenticated users to inject arbitrary web script or HTML via the category0 parameter, which is not properly handled when displaying the Subjects tab in the View Properties menu option.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://www.securityfocus.com/archive/1/archive/1/531853/100/0/threaded" source="BUGTRAQ">20140416 [SECURITY] Stored Cross Site Scripting in Ektron CMS 8.7</ref>
      <ref url="http://www.securityfocus.com/archive/1/archive/1/531852/100/0/threaded" source="BUGTRAQ">20140416 [Security Advisory] Stored Cross Site Scripting in Ektron CMS 8.7</ref>
      <ref url="http://packetstormsecurity.com/files/126187/Ektron-CMS-8.7-Cross-Site-Scripting.html" source="MISC">http://packetstormsecurity.com/files/126187/Ektron-CMS-8.7-Cross-Site-Scripting.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="ektron" name="ektron_content_management_system">
        <vers num="8.7.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2730" published="2014-04-05" name="CVE-2014-2730" modified="2014-04-07" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:P)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">The XML parser in Microsoft Office 2007 SP3, 2010 SP1 and SP2, and 2013, and Office for Mac 2011, does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory consumption and persistent application hang) via a crafted XML document containing a large number of nested entity references, as demonstrated by a crafted text/plain e-mail message to Outlook, a similar issue to CVE-2003-1564.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.securityfocus.com/archive/1/archive/1/531722/100/0/threaded" source="BUGTRAQ">20140403 [softScheck] Denial of Service in Microsoft Office 2007-2013</ref>
    </refs>
    <vuln_soft>
      <prod vendor="microsoft" name="office">
        <vers num="2007" edition="sp3"/>
        <vers num="2010" edition="sp1:x64"/>
        <vers num="2010" edition="sp1:x86"/>
        <vers num="2010" edition="sp2:x64"/>
        <vers num="2010" edition="sp2:x86"/>
        <vers num="2011" edition=":mac"/>
        <vers num="2013" edition="-:~-~-~-~x64~"/>
        <vers num="2013" edition="-:~-~-~-~x86~"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2731" published="2014-04-19" name="CVE-2014-2731" modified="2014-04-21" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="9.3" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="8.6" CVSS_base_score="9.3">
    <desc>
      <descript source="cve">Multiple unspecified vulnerabilities in the integrated web server in Siemens SINEMA Server before 12 SP1 allow remote attackers to execute arbitrary code via HTTP traffic to port (1) 4999 or (2) 80.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://ics-cert.us-cert.gov/advisories/ICSA-14-107-01" source="MISC">http://ics-cert.us-cert.gov/advisories/ICSA-14-107-01</ref>
      <ref url="http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-364879.pdf" source="CONFIRM" adv="1">http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-364879.pdf</ref>
    </refs>
    <vuln_soft>
      <prod vendor="siemens" name="sinema_server">
        <vers prev="1" num="12.0" edition="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2732" published="2014-04-19" name="CVE-2014-2732" modified="2014-04-21" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:N/A:N)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">Multiple directory traversal vulnerabilities in the integrated web server in Siemens SINEMA Server before 12 SP1 allow remote attackers to access arbitrary files via HTTP traffic to port (1) 4999 or (2) 80.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://ics-cert.us-cert.gov/advisories/ICSA-14-107-01" source="MISC">http://ics-cert.us-cert.gov/advisories/ICSA-14-107-01</ref>
      <ref url="http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-364879.pdf" source="CONFIRM" adv="1">http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-364879.pdf</ref>
    </refs>
    <vuln_soft>
      <prod vendor="siemens" name="sinema_server">
        <vers prev="1" num="12.0" edition="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2733" published="2014-04-19" name="CVE-2014-2733" modified="2014-04-21" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:P)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">Siemens SINEMA Server before 12 SP1 allows remote attackers to cause a denial of service (web-interface outage) via crafted HTTP requests to port (1) 4999 or (2) 80.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://ics-cert.us-cert.gov/advisories/ICSA-14-107-01" source="MISC">http://ics-cert.us-cert.gov/advisories/ICSA-14-107-01</ref>
      <ref url="http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-364879.pdf" source="CONFIRM" adv="1">http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-364879.pdf</ref>
    </refs>
    <vuln_soft>
      <prod vendor="siemens" name="sinema_server">
        <vers prev="1" num="12.0" edition="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2734" published="2014-04-24" name="CVE-2014-2734" modified="2014-04-25" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:N)" CVSS_score="5.8" CVSS_impact_subscore="4.9" CVSS_exploit_subscore="8.6" CVSS_base_score="5.8">
    <desc>
      <descript source="cve">The openssl extension in Ruby 2.x does not properly maintain the state of process memory after a file is reopened, which allows remote attackers to spoof signatures within the context of a Ruby script that attempts signature verification after performing a certain sequence of filesystem operations.</descript>
    </desc>
    <loss_types>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://gist.github.com/10446549" source="MISC">https://gist.github.com/10446549</ref>
      <ref url="http://seclists.org/fulldisclosure/2014/Apr/231" source="FULLDISC">20140416 Ruby OpenSSL private key spoofing ~ CVE-2014-2734 with PoC</ref>
      <ref url="http://packetstormsecurity.com/files/126218/Ruby-OpenSSL-Private-Key-Spoofing.html" source="MISC">http://packetstormsecurity.com/files/126218/Ruby-OpenSSL-Private-Key-Spoofing.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="ruby-lang" name="ruby">
        <vers num="2.0"/>
        <vers num="2.0.0" edition="p0"/>
        <vers num="2.0.0" edition="p195"/>
        <vers num="2.0.0" edition="p247"/>
        <vers num="2.0.0" edition="preview1"/>
        <vers num="2.0.0" edition="preview2"/>
        <vers num="2.0.0" edition="rc1"/>
        <vers num="2.0.0" edition="rc2"/>
        <vers num="2.1" edition="-"/>
        <vers num="2.1" edition="preview1"/>
        <vers num="2.1.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2735" published="2014-04-22" name="CVE-2014-2735" modified="2014-04-22" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:N)" CVSS_score="5.8" CVSS_impact_subscore="4.9" CVSS_exploit_subscore="8.6" CVSS_base_score="5.8">
    <desc>
      <descript source="cve">WinSCP before 5.5.3, when FTP with TLS is used, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.</descript>
    </desc>
    <loss_types>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.securityfocus.com/archive/1/archive/1/531847/100/0/threaded" source="BUGTRAQ">20140416 CVE-2014-2735 - WinSCP: missing X.509 validation</ref>
      <ref url="http://winscp.net/tracker/show_bug.cgi?id=1152" source="CONFIRM">http://winscp.net/tracker/show_bug.cgi?id=1152</ref>
      <ref url="http://winscp.net/eng/docs/history" source="CONFIRM">http://winscp.net/eng/docs/history</ref>
    </refs>
    <vuln_soft>
      <prod vendor="winscp" name="winscp">
        <vers num="5.5"/>
        <vers num="5.5.1"/>
        <vers prev="1" num="5.5.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2736" published="2014-04-24" name="CVE-2014-2736" modified="2014-04-24" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">Multiple SQL injection vulnerabilities in MODX Revolution before 2.2.14 allow remote attackers to execute arbitrary SQL commands via the (1) session ID (PHPSESSID) to index.php or remote authenticated users to execute arbitrary SQL commands via the (2) user parameter to connectors/security/message.php or (3) id parameter to manager/index.php.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.securityfocus.com/bid/66990" source="BID">66990</ref>
      <ref url="http://secunia.com/advisories/58036" source="SECUNIA" adv="1">58036</ref>
      <ref url="http://forums.modx.com/thread/90173/modx-revolution-2-2-13-and-prior-blind-sql-injection" source="CONFIRM" adv="1">http://forums.modx.com/thread/90173/modx-revolution-2-2-13-and-prior-blind-sql-injection</ref>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/2014-04/0124.html" source="BUGTRAQ">20140419 Multiple Vulnerabilities in MODX Revolution &lt; = MODX 2.2.13-pl</ref>
    </refs>
    <vuln_soft>
      <prod vendor="modx" name="modx_revolution">
        <vers num="2.0.0"/>
        <vers num="2.0.1"/>
        <vers num="2.0.2" edition="pl1"/>
        <vers num="2.0.3"/>
        <vers num="2.0.4"/>
        <vers num="2.0.5"/>
        <vers num="2.0.6"/>
        <vers num="2.0.7"/>
        <vers num="2.0.8"/>
        <vers num="2.1.0"/>
        <vers num="2.1.1"/>
        <vers num="2.1.2"/>
        <vers num="2.1.3"/>
        <vers num="2.1.4"/>
        <vers num="2.1.5"/>
        <vers num="2.2.0"/>
        <vers num="2.2.1"/>
        <vers num="2.2.10"/>
        <vers num="2.2.11"/>
        <vers num="2.2.12"/>
        <vers prev="1" num="2.2.13"/>
        <vers num="2.2.2"/>
        <vers num="2.2.3"/>
        <vers num="2.2.4"/>
        <vers num="2.2.5"/>
        <vers num="2.2.6"/>
        <vers num="2.2.7"/>
        <vers num="2.2.8"/>
        <vers num="2.2.9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2737" published="2014-04-22" name="CVE-2014-2737" modified="2014-04-23" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">SQL injection vulnerability in the get_active_session function in the KTAPI_UserSession class in webservice/clienttools/services/mdownload.php in KnowledgeTree 3.7.0.2 and earlier allows remote attackers to execute arbitrary SQL commands via the u parameter, related to the getFileName function.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.securityfocus.com/archive/1/archive/1/531886/100/0/threaded" source="BUGTRAQ">20140419 Blind SQL Injection Vulnerability in KnowledgeTree &lt;= 3.7.0.2</ref>
    </refs>
    <vuln_soft>
      <prod vendor="knowledgetree" name="knowledgetree">
        <vers num="3.7"/>
        <vers num="3.7.0.1"/>
        <vers prev="1" num="3.7.0.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2739" published="2014-04-14" name="CVE-2014-2739" modified="2014-04-24" CVSS_version="2.0" CVSS_vector="(AV:A/AC:H/Au:N/C:N/I:N/A:C)" CVSS_score="4.6" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="3.2" CVSS_base_score="4.6">
    <desc>
      <descript source="cve">The cma_req_handler function in drivers/infiniband/core/cma.c in the Linux kernel 3.14.x through 3.14.1 attempts to resolve an RDMA over Converged Ethernet (aka RoCE) address that is properly resolved within a different module, which allows remote attackers to cause a denial of service (incorrect pointer dereference and system crash) via crafted network traffic.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <local_network/>
    </range>
    <refs>
      <ref url="http://www.openwall.com/lists/oss-security/2014/04/10/9" source="MLIST" patch="1">[oss-security] 20140410 Re: CVE request Linux kernel: IB/core: crash while resolving passive side RoCE L2 address in cma_req_handler</ref>
      <ref url="http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=b2853fd6c2d0f383dbdf7427e263eb576a633867" source="CONFIRM" patch="1">http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=b2853fd6c2d0f383dbdf7427e263eb576a633867</ref>
      <ref url="https://github.com/torvalds/linux/commit/b2853fd6c2d0f383dbdf7427e263eb576a633867" source="CONFIRM">https://github.com/torvalds/linux/commit/b2853fd6c2d0f383dbdf7427e263eb576a633867</ref>
      <ref url="https://bugzilla.redhat.com/show_bug.cgi?id=1085415" source="CONFIRM">https://bugzilla.redhat.com/show_bug.cgi?id=1085415</ref>
      <ref url="http://www.securityfocus.com/bid/66716" source="BID">66716</ref>
    </refs>
    <vuln_soft>
      <prod vendor="linux" name="linux_kernel">
        <vers num="3.14" edition="rc1"/>
        <vers num="3.14" edition="rc2"/>
        <vers num="3.14" edition="rc3"/>
        <vers num="3.14" edition="rc4"/>
        <vers num="3.14" edition="rc5"/>
        <vers num="3.14" edition="rc6"/>
        <vers num="3.14" edition="rc7"/>
        <vers num="3.14" edition="rc8"/>
        <vers num="3.14.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2741" published="2014-04-10" name="CVE-2014-2741" modified="2014-04-11" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:C)" CVSS_score="7.8" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="10.0" CVSS_base_score="7.8">
    <desc>
      <descript source="cve">Ignite Realtime Openfire before 3.9.2 does not properly restrict the processing of compressed XML elements, which allows remote attackers to cause a denial of service (resource consumption) via a crafted XMPP stream, aka an "xmppbomb" attack.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://xmpp.org/resources/security-notices/uncontrolled-resource-consumption-with-highly-compressed-xmpp-stanzas/" source="MISC">http://xmpp.org/resources/security-notices/uncontrolled-resource-consumption-with-highly-compressed-xmpp-stanzas/</ref>
      <ref url="http://openwall.com/lists/oss-security/2014/04/09/1" source="MLIST">[oss-security] 20140408 Re: (Openfire M-Link Metronome Prosody Tigase) Possible CVE Request: Uncontrolled Resource Consumption with XMPP-Layer Compression</ref>
      <ref url="http://openwall.com/lists/oss-security/2014/04/07/7" source="MLIST">[oss-security] 20140407 Re: Possible CVE Request: Uncontrolled Resource Consumption with XMPP-Layer Compression</ref>
    </refs>
    <vuln_soft>
      <prod vendor="igniterealtime" name="openfire">
        <vers prev="1" num="3.9.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2742" published="2014-04-10" name="CVE-2014-2742" modified="2014-04-11" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:C)" CVSS_score="7.8" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="10.0" CVSS_base_score="7.8">
    <desc>
      <descript source="cve">Isode M-Link before 16.0v7 does not properly restrict the processing of compressed XML elements, which allows remote attackers to cause a denial of service (resource consumption) via a crafted XMPP stream, aka an "xmppbomb" attack.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://xmpp.org/resources/security-notices/uncontrolled-resource-consumption-with-highly-compressed-xmpp-stanzas/" source="MISC">http://xmpp.org/resources/security-notices/uncontrolled-resource-consumption-with-highly-compressed-xmpp-stanzas/</ref>
      <ref url="http://openwall.com/lists/oss-security/2014/04/09/1" source="MLIST">[oss-security] 20140408 Re: (Openfire M-Link Metronome Prosody Tigase) Possible CVE Request: Uncontrolled Resource Consumption with XMPP-Layer Compression</ref>
      <ref url="http://openwall.com/lists/oss-security/2014/04/07/7" source="MLIST">[oss-security] 20140407 Re: Possible CVE Request: Uncontrolled Resource Consumption with XMPP-Layer Compression</ref>
    </refs>
    <vuln_soft>
      <prod vendor="isode" name="m-link">
        <vers num="14.6"/>
        <vers num="14.6.14"/>
        <vers num="15.1"/>
        <vers num="15.1.10"/>
        <vers num="16.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2743" published="2014-04-10" name="CVE-2014-2743" modified="2014-04-11" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:C)" CVSS_score="7.8" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="10.0" CVSS_base_score="7.8">
    <desc>
      <descript source="cve">plugins/mod_compression.lua in Lightwitch Metronome through 3.4 does not properly restrict the processing of compressed XML elements, which allows remote attackers to cause a denial of service (resource consumption) via a crafted XMPP stream, aka an "xmppbomb" attack.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://code.lightwitch.org/metronome/rev/49f47277a411" source="CONFIRM" patch="1">http://code.lightwitch.org/metronome/rev/49f47277a411</ref>
      <ref url="http://xmpp.org/resources/security-notices/uncontrolled-resource-consumption-with-highly-compressed-xmpp-stanzas/" source="MISC">http://xmpp.org/resources/security-notices/uncontrolled-resource-consumption-with-highly-compressed-xmpp-stanzas/</ref>
      <ref url="http://openwall.com/lists/oss-security/2014/04/09/1" source="MLIST">[oss-security] 20140408 Re: (Openfire M-Link Metronome Prosody Tigase) Possible CVE Request: Uncontrolled Resource Consumption with XMPP-Layer Compression</ref>
      <ref url="http://openwall.com/lists/oss-security/2014/04/07/7" source="MLIST">[oss-security] 20140407 Re: Possible CVE Request: Uncontrolled Resource Consumption with XMPP-Layer Compression</ref>
    </refs>
    <vuln_soft>
      <prod vendor="lightwitch" name="metronome">
        <vers prev="1" num="3.4"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2744" published="2014-04-10" name="CVE-2014-2744" modified="2014-04-19" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:C)" CVSS_score="7.8" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="10.0" CVSS_base_score="7.8">
    <desc>
      <descript source="cve">plugins/mod_compression.lua in (1) Prosody before 0.9.4 and (2) Lightwitch Metronome through 3.4 negotiates stream compression while a session is unauthenticated, which allows remote attackers to cause a denial of service (resource consumption) via compressed XML elements in an XMPP stream, aka an "xmppbomb" attack.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://hg.prosody.im/0.9/rev/b3b1c9da38fb" source="CONFIRM" patch="1">http://hg.prosody.im/0.9/rev/b3b1c9da38fb</ref>
      <ref url="http://code.lightwitch.org/metronome/rev/49f47277a411" source="CONFIRM" patch="1">http://code.lightwitch.org/metronome/rev/49f47277a411</ref>
      <ref url="http://xmpp.org/resources/security-notices/uncontrolled-resource-consumption-with-highly-compressed-xmpp-stanzas/" source="MISC">http://xmpp.org/resources/security-notices/uncontrolled-resource-consumption-with-highly-compressed-xmpp-stanzas/</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2895" source="DEBIAN">DSA-2895</ref>
      <ref url="http://secunia.com/advisories/57710" source="SECUNIA">57710</ref>
      <ref url="http://openwall.com/lists/oss-security/2014/04/09/1" source="MLIST">[oss-security] 20140408 Re: (Openfire M-Link Metronome Prosody Tigase) Possible CVE Request: Uncontrolled Resource Consumption with XMPP-Layer Compression</ref>
      <ref url="http://openwall.com/lists/oss-security/2014/04/07/7" source="MLIST">[oss-security] 20140407 Re: Possible CVE Request: Uncontrolled Resource Consumption with XMPP-Layer Compression</ref>
      <ref url="http://blog.prosody.im/prosody-0-9-4-released/" source="CONFIRM" adv="1">http://blog.prosody.im/prosody-0-9-4-released/</ref>
    </refs>
    <vuln_soft>
      <prod vendor="lightwitch" name="metronome">
        <vers prev="1" num="3.4"/>
      </prod>
      <prod vendor="prosody" name="prosody">
        <vers num="0.1.0"/>
        <vers num="0.2.0"/>
        <vers num="0.3.0"/>
        <vers num="0.4.0"/>
        <vers num="0.4.1"/>
        <vers num="0.4.2"/>
        <vers num="0.5.0"/>
        <vers num="0.5.1"/>
        <vers num="0.5.2"/>
        <vers num="0.6.0"/>
        <vers num="0.6.1"/>
        <vers num="0.6.2"/>
        <vers num="0.7.0"/>
        <vers num="0.8.0"/>
        <vers num="0.8.1"/>
        <vers num="0.8.2"/>
        <vers num="0.9.0"/>
        <vers num="0.9.1"/>
        <vers num="0.9.2"/>
        <vers prev="1" num="0.9.3"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2745" published="2014-04-10" name="CVE-2014-2745" modified="2014-04-19" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:C)" CVSS_score="7.8" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="10.0" CVSS_base_score="7.8">
    <desc>
      <descript source="cve">Prosody before 0.9.4 does not properly restrict the processing of compressed XML elements, which allows remote attackers to cause a denial of service (resource consumption) via a crafted XMPP stream, aka an "xmppbomb" attack, related to core/portmanager.lua and util/xmppstream.lua.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://xmpp.org/resources/security-notices/uncontrolled-resource-consumption-with-highly-compressed-xmpp-stanzas/" source="MISC">http://xmpp.org/resources/security-notices/uncontrolled-resource-consumption-with-highly-compressed-xmpp-stanzas/</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2895" source="DEBIAN">DSA-2895</ref>
      <ref url="http://secunia.com/advisories/57710" source="SECUNIA">57710</ref>
      <ref url="http://openwall.com/lists/oss-security/2014/04/09/1" source="MLIST">[oss-security] 20140408 Re: (Openfire M-Link Metronome Prosody Tigase) Possible CVE Request: Uncontrolled Resource Consumption with XMPP-Layer Compression</ref>
      <ref url="http://openwall.com/lists/oss-security/2014/04/07/7" source="MLIST">[oss-security] 20140407 Re: Possible CVE Request: Uncontrolled Resource Consumption with XMPP-Layer Compression</ref>
      <ref url="http://hg.prosody.im/0.9/rev/a97591d2e1ad" source="CONFIRM">http://hg.prosody.im/0.9/rev/a97591d2e1ad</ref>
      <ref url="http://hg.prosody.im/0.9/rev/1107d66d2ab2" source="CONFIRM">http://hg.prosody.im/0.9/rev/1107d66d2ab2</ref>
      <ref url="http://blog.prosody.im/prosody-0-9-4-released/" source="CONFIRM">http://blog.prosody.im/prosody-0-9-4-released/</ref>
    </refs>
    <vuln_soft>
      <prod vendor="prosody" name="prosody">
        <vers num="0.1.0"/>
        <vers num="0.2.0"/>
        <vers num="0.3.0"/>
        <vers num="0.4.0"/>
        <vers num="0.4.1"/>
        <vers num="0.4.2"/>
        <vers num="0.5.0"/>
        <vers num="0.5.1"/>
        <vers num="0.5.2"/>
        <vers num="0.6.0"/>
        <vers num="0.6.1"/>
        <vers num="0.6.2"/>
        <vers num="0.7.0"/>
        <vers num="0.8.0"/>
        <vers num="0.8.1"/>
        <vers num="0.8.2"/>
        <vers num="0.9.0"/>
        <vers num="0.9.1"/>
        <vers num="0.9.2"/>
        <vers prev="1" num="0.9.3"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2746" published="2014-04-10" name="CVE-2014-2746" modified="2014-04-11" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:C)" CVSS_score="7.8" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="10.0" CVSS_base_score="7.8">
    <desc>
      <descript source="cve">net/IOService.java in Tigase before 5.2.1 does not properly restrict the processing of compressed XML elements, which allows remote attackers to cause a denial of service (resource consumption) via a crafted XMPP stream, aka an "xmppbomb" attack.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://projects.tigase.org/projects/tigase-server/repository/revisions/7f5af2f8c5b97bbf9def66fbb9dd47746a7ac292" source="CONFIRM" patch="1">https://projects.tigase.org/projects/tigase-server/repository/revisions/7f5af2f8c5b97bbf9def66fbb9dd47746a7ac292</ref>
      <ref url="https://projects.tigase.org/issues/1780" source="CONFIRM">https://projects.tigase.org/issues/1780</ref>
      <ref url="http://xmpp.org/resources/security-notices/uncontrolled-resource-consumption-with-highly-compressed-xmpp-stanzas/" source="MISC">http://xmpp.org/resources/security-notices/uncontrolled-resource-consumption-with-highly-compressed-xmpp-stanzas/</ref>
      <ref url="http://www.tigase.org/content/uncontrolled-resource-consumption-highly-compressed-xmpp-messages" source="CONFIRM">http://www.tigase.org/content/uncontrolled-resource-consumption-highly-compressed-xmpp-messages</ref>
      <ref url="http://openwall.com/lists/oss-security/2014/04/09/1" source="MLIST">[oss-security] 20140408 Re: (Openfire M-Link Metronome Prosody Tigase) Possible CVE Request: Uncontrolled Resource Consumption with XMPP-Layer Compression</ref>
      <ref url="http://openwall.com/lists/oss-security/2014/04/07/7" source="MLIST">[oss-security] 20140407 Re: Possible CVE Request: Uncontrolled Resource Consumption with XMPP-Layer Compression</ref>
    </refs>
    <vuln_soft>
      <prod vendor="tigase" name="tigase">
        <vers prev="1" num="5.2.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2748" published="2014-04-10" name="CVE-2014-2748" modified="2014-04-24" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">The Security Audit Log facility in SAP Enhancement Package (EHP) 6 for SAP ERP 6.0 allows remote attackers to modify or delete arbitrary log classes via unspecified vectors.  NOTE: some of these details are obtained from third party information.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://service.sap.com/sap/support/notes/1926485" source="MISC">https://service.sap.com/sap/support/notes/1926485</ref>
      <ref url="http://xforce.iss.net/xforce/xfdb/92334" source="XF">sap-ehp-log-sec-bypass(92334)</ref>
      <ref url="http://www.onapsis.com/research-advisories.php" source="MISC">http://www.onapsis.com/research-advisories.php</ref>
      <ref url="http://www.onapsis.com/get.php?resid=adv_onapsis-2014-002" source="MISC">http://www.onapsis.com/get.php?resid=adv_onapsis-2014-002</ref>
      <ref url="http://secunia.com/advisories/57741" source="SECUNIA" adv="1">57741</ref>
    </refs>
    <vuln_soft>
      <prod vendor="sap" name="enhancement_package">
        <vers num="6.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2749" published="2014-04-10" name="CVE-2014-2749" modified="2014-04-24" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:N/A:N)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">The HANA ICM process in SAP HANA allows remote attackers to obtain the platform version, host name, instance number, and possibly other sensitive information via a malformed HTTP GET request.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://service.sap.com/sap/support/notes/1914778" source="MISC">https://service.sap.com/sap/support/notes/1914778</ref>
      <ref url="http://xforce.iss.net/xforce/xfdb/92325" source="XF">sap-hana-icm-info-disc(92325)</ref>
      <ref url="http://www.securityfocus.com/bid/66675" source="BID">66675</ref>
      <ref url="http://www.onapsis.com/research-advisories.php" source="MISC">http://www.onapsis.com/research-advisories.php</ref>
      <ref url="http://www.onapsis.com/get.php?resid=adv_onapsis-2014-001" source="MISC">http://www.onapsis.com/get.php?resid=adv_onapsis-2014-001</ref>
      <ref url="http://secunia.com/advisories/57443" source="SECUNIA" adv="1">57443</ref>
    </refs>
    <vuln_soft>
      <prod vendor="sap" name="hana">
        <vers num="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" seq="2014-2750" reject="1" published="2014-04-10" name="CVE-2014-2750" modified="2014-04-19">
    <desc>
      <descript source="cve">** REJECT **  DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2014-2744, CVE-2014-2745.  Reason: This candidate is a duplicate of CVE-2014-2744 and/or CVE-2014-2745.  Notes: All CVE users should reference CVE-2014-2744 and/or CVE-2014-2745 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage.</descript>
    </desc>
    <refs/>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2751" published="2014-04-10" name="CVE-2014-2751" modified="2014-04-11" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">SAP Print and Output Management has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.onapsis.com/research-advisories.php" source="MISC">http://www.onapsis.com/research-advisories.php</ref>
      <ref url="http://www.onapsis.com/get.php?resid=adv_onapsis-2014-004" source="MISC">http://www.onapsis.com/get.php?resid=adv_onapsis-2014-004</ref>
    </refs>
    <vuln_soft>
      <prod vendor="sap" name="print_and_output_management">
        <vers num="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2752" published="2014-04-10" name="CVE-2014-2752" modified="2014-04-11" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">SAP Business Object Processing Framework (BOPF) for ABAP has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.onapsis.com/research-advisories.php" source="MISC">http://www.onapsis.com/research-advisories.php</ref>
      <ref url="http://www.onapsis.com/get.php?resid=adv_onapsis-2014-003" source="MISC">http://www.onapsis.com/get.php?resid=adv_onapsis-2014-003</ref>
    </refs>
    <vuln_soft>
      <prod vendor="sap" name="business_object_processing_framework_for_abap">
        <vers num="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2828" published="2014-04-15" name="CVE-2014-2828" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:P)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">The V3 API in OpenStack Identity (Keystone) 2013.1 before 2013.2.4 and icehouse before icehouse-rc2 allows remote attackers to cause a denial of service (CPU consumption) via a large number of the same authentication method in a request, aka "authentication chaining."</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://bugs.launchpad.net/keystone/+bug/1300274" source="CONFIRM">https://bugs.launchpad.net/keystone/+bug/1300274</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/04/10/20" source="MLIST">[oss-security] 20140410 [OSSA 2014-013] Keystone DoS through V3 API authentication chaining  (CVE-2014-2828)</ref>
    </refs>
    <vuln_soft>
      <prod vendor="openstack" name="keystone">
        <vers num="2013.1"/>
        <vers num="2013.1.1"/>
        <vers num="2013.1.2"/>
        <vers num="2013.1.3"/>
        <vers num="2013.2"/>
        <vers num="2013.2.1"/>
        <vers num="2013.2.2"/>
        <vers num="2013.2.3"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2829" published="2014-04-10" name="CVE-2014-2829" modified="2014-04-11" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:C)" CVSS_score="7.8" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="10.0" CVSS_base_score="7.8">
    <desc>
      <descript source="cve">Erlang Solutions MongooseIM through 1.3.1 rev. 2 does not properly restrict the processing of compressed XML elements, which allows remote attackers to cause a denial of service (resource consumption) via a crafted XMPP stream, aka an "xmppbomb" attack.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://github.com/esl/MongooseIM/commit/586d96cc12ef218243a3466354b4d208b5472a6c" source="CONFIRM" patch="1">https://github.com/esl/MongooseIM/commit/586d96cc12ef218243a3466354b4d208b5472a6c</ref>
      <ref url="http://xmpp.org/resources/security-notices/uncontrolled-resource-consumption-with-highly-compressed-xmpp-stanzas/" source="MISC">http://xmpp.org/resources/security-notices/uncontrolled-resource-consumption-with-highly-compressed-xmpp-stanzas/</ref>
    </refs>
    <vuln_soft>
      <prod vendor="erlang-solutions" name="mongooseim">
        <vers num="1.2.1"/>
        <vers num="1.2.2"/>
        <vers num="1.3.0"/>
        <vers prev="1" num="1.3.1" edition="-"/>
        <vers prev="1" num="1.3.1" edition="rev2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2842" published="2014-04-15" name="CVE-2014-2842" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:C)" CVSS_score="7.8" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="10.0" CVSS_base_score="7.8">
    <desc>
      <descript source="cve">Juniper ScreenOS 6.3 and earlier allows remote attackers to cause a denial of service (crash and restart or failover) via a malformed SSL/TLS packet.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://kb.juniper.net/InfoCenter/index?page=content&amp;id=JSA10624" source="CONFIRM" adv="1">https://kb.juniper.net/InfoCenter/index?page=content&amp;id=JSA10624</ref>
      <ref url="http://www.securityfocus.com/bid/66802" source="BID">66802</ref>
      <ref url="http://secunia.com/advisories/57910" source="SECUNIA" adv="1">57910</ref>
    </refs>
    <vuln_soft>
      <prod vendor="juniper" name="screenos">
        <vers num="5.4.0"/>
        <vers num="6.0.0"/>
        <vers num="6.1.0"/>
        <vers num="6.2.0"/>
        <vers prev="1" num="6.3.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-2844" published="2014-04-18" name="CVE-2014-2844" modified="2014-04-21" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:S/C:N/I:P/A:N)" CVSS_score="3.5" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="6.8" CVSS_base_score="3.5">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in F-Secure Messaging Secure Gateway 7.5.0 before Patch 1862 allows remote authenticated administrators to inject arbitrary web script or HTML via the new parameter in the SysUser module to admin.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://www.f-secure.com/en/web/labs_global/fsc-2014-2" source="CONFIRM" adv="1">http://www.f-secure.com/en/web/labs_global/fsc-2014-2</ref>
      <ref url="http://secunia.com/advisories/58038" source="SECUNIA" adv="1">58038</ref>
      <ref url="http://seclists.org/fulldisclosure/2014/Apr/223" source="FULLDISC">20140416 Reflected XSS Attacks vulnerabilities F-Secure Messaging Security Gateway V7.5.0.892 (CVE-2014-2844)</ref>
    </refs>
    <vuln_soft>
      <prod vendor="f-secure" name="secure_messaging_secure_gateway">
        <vers num="7.5.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2846" published="2014-04-28" name="CVE-2014-2846" modified="2014-04-29" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">Directory traversal vulnerability in opt/arkeia/wui/htdocs/index.php in the WD Arkeia virtual appliance (AVA) with firmware before 10.2.9 allows remote attackers to read arbitrary files and execute arbitrary PHP code via a ..././ (dot dot dot slash dot slash) in the lang Cookie parameter, as demonstrated by a request to login/doLogin.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.securityfocus.com/archive/1/archive/1/531910/100/0/threaded" source="BUGTRAQ">20140423 SEC Consult SA-20140423-0 :: Path Traversal/Remote Code Execution in WD Arkeia Network Backup Appliances</ref>
      <ref url="http://seclists.org/fulldisclosure/2014/Apr/257" source="FULLDISC">20140423 SEC Consult SA-20140423-0 :: Path Traversal/Remote Code Execution in WD Arkeia Network Backup Appliances</ref>
    </refs>
    <vuln_soft>
      <prod vendor="wdc" name="arkeia_virtual_appliance">
        <vers num="-"/>
      </prod>
      <prod vendor="wdc" name="arkeia_virtual_appliance_firmware">
        <vers prev="1" num="10.2.7"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2847" published="2014-04-11" name="CVE-2014-2847" modified="2014-04-14" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">SQL injection vulnerability in default.asp in CIS Manager CMS allows remote attackers to execute arbitrary SQL commands via the TroncoID parameter.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.securityfocus.com/bid/66590" source="BID">66590</ref>
      <ref url="http://www.osvdb.org/105364" source="OSVDB">105364</ref>
      <ref url="http://www.exploit-db.com/exploits/32660" source="EXPLOIT-DB">32660</ref>
    </refs>
    <vuln_soft>
      <prod vendor="construtiva" name="cis_manager_cms">
        <vers num="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2848" published="2014-04-11" name="CVE-2014-2848" modified="2014-04-14" CVSS_version="2.0" CVSS_vector="(AV:L/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="6.9" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="3.4" CVSS_base_score="6.9">
    <desc>
      <descript source="cve">A race condition in the wmi_malware_scan.nbin plugin before 201402262215 for Nessus 5.2.1 allows local users to gain privileges by replacing the dissolvable agent executable in the Windows temp directory with a Trojan horse program.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="https://www.nccgroup.com/en/learning-and-research-centre/technical-advisories/nessus-authenticated-scan-local-privilege-escalation/" source="MISC">https://www.nccgroup.com/en/learning-and-research-centre/technical-advisories/nessus-authenticated-scan-local-privilege-escalation/</ref>
      <ref url="https://discussions.nessus.org/thread/7195" source="CONFIRM" adv="1">https://discussions.nessus.org/thread/7195</ref>
      <ref url="http://www.securitytracker.com/id/1029946" source="SECTRACK">1029946</ref>
      <ref url="http://secunia.com/advisories/57403" source="SECUNIA" adv="1">57403</ref>
    </refs>
    <vuln_soft>
      <prod vendor="tenable" name="nessus">
        <vers num="5.2.1"/>
      </prod>
      <prod vendor="tenable" name="plugin-set">
        <vers prev="1" num="201402092115"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2849" published="2014-04-11" name="CVE-2014-2849" modified="2014-04-14" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:N/I:C/A:C)" CVSS_score="8.5" CVSS_impact_subscore="9.2" CVSS_exploit_subscore="8.0" CVSS_base_score="8.5">
    <desc>
      <descript source="cve">The Change Password dialog box (change_password) in Sophos Web Appliance before 3.8.2 allows remote authenticated users to change the admin user password via a crafted request.</descript>
    </desc>
    <loss_types>
      <avail/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.zerodayinitiative.com/advisories/ZDI-14-069/" source="MISC">http://www.zerodayinitiative.com/advisories/ZDI-14-069/</ref>
      <ref url="http://www.sophos.com/en-us/support/knowledgebase/120230.aspx" source="CONFIRM" adv="1">http://www.sophos.com/en-us/support/knowledgebase/120230.aspx</ref>
      <ref url="http://www.securityfocus.com/bid/66734" source="BID">66734</ref>
      <ref url="http://www.exploit-db.com/exploits/32789" source="EXPLOIT-DB">32789</ref>
      <ref url="http://secunia.com/advisories/57706" source="SECUNIA" adv="1">57706</ref>
    </refs>
    <vuln_soft>
      <prod vendor="sophos" name="web_appliance_firmware">
        <vers num="3.7.8"/>
      </prod>
      <prod vendor="sophos" name="web_appliance">
        <vers num="-"/>
      </prod>
      <prod vendor="sophos" name="web_appliance_firmware">
        <vers num="3.0.0"/>
        <vers num="3.0.1"/>
        <vers num="3.0.1.1"/>
        <vers num="3.0.2"/>
        <vers num="3.0.3"/>
        <vers num="3.0.4"/>
        <vers num="3.0.5"/>
        <vers num="3.0.5.1"/>
        <vers num="3.1.0"/>
        <vers num="3.1.0.1"/>
        <vers num="3.1.1"/>
        <vers num="3.1.2"/>
        <vers num="3.1.3"/>
        <vers num="3.1.4"/>
        <vers num="3.2.1"/>
        <vers num="3.2.2"/>
        <vers num="3.2.2.1"/>
        <vers num="3.2.3"/>
        <vers num="3.2.4"/>
        <vers num="3.2.5"/>
        <vers num="3.2.6"/>
        <vers num="3.2.7"/>
        <vers num="3.3.0"/>
        <vers num="3.3.1"/>
        <vers num="3.3.2"/>
        <vers num="3.3.3"/>
        <vers num="3.3.3.1"/>
        <vers num="3.3.4"/>
        <vers num="3.3.5"/>
        <vers num="3.3.5.1"/>
        <vers num="3.3.6"/>
        <vers num="3.3.6.1"/>
        <vers num="3.4.0"/>
        <vers num="3.4.1"/>
        <vers num="3.4.2"/>
        <vers num="3.4.3"/>
        <vers num="3.4.3.1"/>
        <vers num="3.4.4"/>
        <vers num="3.4.5"/>
        <vers num="3.4.6"/>
        <vers num="3.4.7"/>
        <vers num="3.4.8"/>
        <vers num="3.5.0"/>
        <vers num="3.5.1"/>
        <vers num="3.5.1.1"/>
        <vers num="3.5.1.2"/>
        <vers num="3.5.2"/>
        <vers num="3.5.3"/>
        <vers num="3.5.4"/>
        <vers num="3.5.5"/>
        <vers num="3.5.6"/>
        <vers num="3.6.1"/>
        <vers num="3.6.1.1"/>
        <vers num="3.6.2"/>
        <vers num="3.6.2.1"/>
        <vers num="3.6.2.3"/>
        <vers num="3.6.2.4.0"/>
        <vers num="3.6.2.4.1"/>
        <vers num="3.6.3"/>
        <vers num="3.6.4"/>
        <vers num="3.6.4.1"/>
        <vers num="3.6.4.2"/>
        <vers num="3.7.0"/>
        <vers num="3.7.1"/>
        <vers num="3.7.2"/>
        <vers num="3.7.3"/>
        <vers num="3.7.4"/>
        <vers num="3.7.5"/>
        <vers num="3.7.6"/>
        <vers num="3.7.7"/>
        <vers num="3.7.8.1"/>
        <vers num="3.7.8.2"/>
        <vers num="3.7.9"/>
        <vers num="3.7.9.1"/>
        <vers num="3.8.0"/>
        <vers num="3.8.1"/>
        <vers prev="1" num="3.8.1.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2850" published="2014-04-11" name="CVE-2014-2850" modified="2014-04-14" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:S/C:C/I:C/A:C)" CVSS_score="8.5" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="6.8" CVSS_base_score="8.5">
    <desc>
      <descript source="cve">The network interface configuration page (netinterface) in Sophos Web Appliance before 3.8.2 allows remote administrators to execute arbitrary commands via shell metacharacters in the address parameter.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.zerodayinitiative.com/advisories/ZDI-14-069/" source="MISC">http://www.zerodayinitiative.com/advisories/ZDI-14-069/</ref>
      <ref url="http://www.sophos.com/en-us/support/knowledgebase/120230.aspx" source="CONFIRM" adv="1">http://www.sophos.com/en-us/support/knowledgebase/120230.aspx</ref>
      <ref url="http://www.securityfocus.com/bid/66734" source="BID">66734</ref>
      <ref url="http://www.exploit-db.com/exploits/32789" source="EXPLOIT-DB">32789</ref>
      <ref url="http://secunia.com/advisories/57706" source="SECUNIA" adv="1">57706</ref>
    </refs>
    <vuln_soft>
      <prod vendor="sophos" name="web_appliance_firmware">
        <vers num="3.7.8"/>
      </prod>
      <prod vendor="sophos" name="web_appliance">
        <vers num="-"/>
      </prod>
      <prod vendor="sophos" name="web_appliance_firmware">
        <vers num="3.0.0"/>
        <vers num="3.0.1"/>
        <vers num="3.0.1.1"/>
        <vers num="3.0.2"/>
        <vers num="3.0.3"/>
        <vers num="3.0.4"/>
        <vers num="3.0.5"/>
        <vers num="3.0.5.1"/>
        <vers num="3.1.0"/>
        <vers num="3.1.0.1"/>
        <vers num="3.1.1"/>
        <vers num="3.1.2"/>
        <vers num="3.1.3"/>
        <vers num="3.1.4"/>
        <vers num="3.2.1"/>
        <vers num="3.2.2"/>
        <vers num="3.2.2.1"/>
        <vers num="3.2.3"/>
        <vers num="3.2.4"/>
        <vers num="3.2.5"/>
        <vers num="3.2.6"/>
        <vers num="3.2.7"/>
        <vers num="3.3.0"/>
        <vers num="3.3.1"/>
        <vers num="3.3.2"/>
        <vers num="3.3.3"/>
        <vers num="3.3.3.1"/>
        <vers num="3.3.4"/>
        <vers num="3.3.5"/>
        <vers num="3.3.5.1"/>
        <vers num="3.3.6"/>
        <vers num="3.3.6.1"/>
        <vers num="3.4.0"/>
        <vers num="3.4.1"/>
        <vers num="3.4.2"/>
        <vers num="3.4.3"/>
        <vers num="3.4.3.1"/>
        <vers num="3.4.4"/>
        <vers num="3.4.5"/>
        <vers num="3.4.6"/>
        <vers num="3.4.7"/>
        <vers num="3.4.8"/>
        <vers num="3.5.0"/>
        <vers num="3.5.1"/>
        <vers num="3.5.1.1"/>
        <vers num="3.5.1.2"/>
        <vers num="3.5.2"/>
        <vers num="3.5.3"/>
        <vers num="3.5.4"/>
        <vers num="3.5.5"/>
        <vers num="3.5.6"/>
        <vers num="3.6.1"/>
        <vers num="3.6.1.1"/>
        <vers num="3.6.2"/>
        <vers num="3.6.2.1"/>
        <vers num="3.6.2.3"/>
        <vers num="3.6.2.4.0"/>
        <vers num="3.6.2.4.1"/>
        <vers num="3.6.3"/>
        <vers num="3.6.4"/>
        <vers num="3.6.4.1"/>
        <vers num="3.6.4.2"/>
        <vers num="3.7.0"/>
        <vers num="3.7.1"/>
        <vers num="3.7.2"/>
        <vers num="3.7.3"/>
        <vers num="3.7.4"/>
        <vers num="3.7.5"/>
        <vers num="3.7.6"/>
        <vers num="3.7.7"/>
        <vers num="3.7.8.1"/>
        <vers num="3.7.8.2"/>
        <vers num="3.7.9"/>
        <vers num="3.7.9.1"/>
        <vers num="3.8.0"/>
        <vers num="3.8.1"/>
        <vers prev="1" num="3.8.1.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2851" published="2014-04-14" name="CVE-2014-2851" modified="2014-04-15" CVSS_version="2.0" CVSS_vector="(AV:L/AC:M/Au:N/C:C/I:C/A:C)" CVSS_score="6.9" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="3.4" CVSS_base_score="6.9">
    <desc>
      <descript source="cve">Integer overflow in the ping_init_sock function in net/ipv4/ping.c in the Linux kernel through 3.14.1 allows local users to cause a denial of service (use-after-free and system crash) or possibly gain privileges via a crafted application that leverages an improperly managed reference counter.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="https://git.kernel.org/cgit/linux/kernel/git/davem/net.git/commit/?id=b04c46190219a4f845e46a459e3102137b7f6cac" source="CONFIRM" patch="1">https://git.kernel.org/cgit/linux/kernel/git/davem/net.git/commit/?id=b04c46190219a4f845e46a459e3102137b7f6cac</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/04/11/4" source="MLIST" patch="1">[oss-security] 20140411 Re: CVE request -- Linux kernel: net: ping: refcount issue in ping_init_sock() function</ref>
      <ref url="https://lkml.org/lkml/2014/4/10/736" source="MLIST">[linux-kernel] 20140411 net: ipv4: current group_info should be put after using.</ref>
      <ref url="https://bugzilla.redhat.com/show_bug.cgi?id=1086730" source="CONFIRM">https://bugzilla.redhat.com/show_bug.cgi?id=1086730</ref>
    </refs>
    <vuln_soft>
      <prod vendor="linux" name="linux_kernel">
        <vers num="3.0" edition="rc1"/>
        <vers num="3.0" edition="rc2"/>
        <vers num="3.0" edition="rc3"/>
        <vers num="3.0" edition="rc4"/>
        <vers num="3.0" edition="rc5"/>
        <vers num="3.0" edition="rc6"/>
        <vers num="3.0" edition="rc7"/>
        <vers num="3.0.1"/>
        <vers num="3.0.10"/>
        <vers num="3.0.11"/>
        <vers num="3.0.12"/>
        <vers num="3.0.13"/>
        <vers num="3.0.14"/>
        <vers num="3.0.15"/>
        <vers num="3.0.16"/>
        <vers num="3.0.17"/>
        <vers num="3.0.18"/>
        <vers num="3.0.19"/>
        <vers num="3.0.2"/>
        <vers num="3.0.20"/>
        <vers num="3.0.21"/>
        <vers num="3.0.22"/>
        <vers num="3.0.23"/>
        <vers num="3.0.24"/>
        <vers num="3.0.25"/>
        <vers num="3.0.26"/>
        <vers num="3.0.27"/>
        <vers num="3.0.28"/>
        <vers num="3.0.29"/>
        <vers num="3.0.3"/>
        <vers num="3.0.30"/>
        <vers num="3.0.31"/>
        <vers num="3.0.32"/>
        <vers num="3.0.33"/>
        <vers num="3.0.34"/>
        <vers num="3.0.35"/>
        <vers num="3.0.36"/>
        <vers num="3.0.37"/>
        <vers num="3.0.38"/>
        <vers num="3.0.39"/>
        <vers num="3.0.4"/>
        <vers num="3.0.40"/>
        <vers num="3.0.41"/>
        <vers num="3.0.42"/>
        <vers num="3.0.43"/>
        <vers num="3.0.44"/>
        <vers num="3.0.45"/>
        <vers num="3.0.46"/>
        <vers num="3.0.47"/>
        <vers num="3.0.48"/>
        <vers num="3.0.49"/>
        <vers num="3.0.5"/>
        <vers num="3.0.50"/>
        <vers num="3.0.51"/>
        <vers num="3.0.52"/>
        <vers num="3.0.53"/>
        <vers num="3.0.54"/>
        <vers num="3.0.55"/>
        <vers num="3.0.56"/>
        <vers num="3.0.57"/>
        <vers num="3.0.58"/>
        <vers num="3.0.59"/>
        <vers num="3.0.6"/>
        <vers num="3.0.60"/>
        <vers num="3.0.61"/>
        <vers num="3.0.62"/>
        <vers num="3.0.63"/>
        <vers num="3.0.64"/>
        <vers num="3.0.65"/>
        <vers num="3.0.66"/>
        <vers num="3.0.67"/>
        <vers num="3.0.68"/>
        <vers num="3.0.7"/>
        <vers num="3.0.8"/>
        <vers num="3.0.9"/>
        <vers num="3.1" edition="rc1"/>
        <vers num="3.1" edition="rc2"/>
        <vers num="3.1" edition="rc3"/>
        <vers num="3.1" edition="rc4"/>
        <vers num="3.1.1"/>
        <vers num="3.1.10"/>
        <vers num="3.1.2"/>
        <vers num="3.1.3"/>
        <vers num="3.1.4"/>
        <vers num="3.1.5"/>
        <vers num="3.1.6"/>
        <vers num="3.1.7"/>
        <vers num="3.1.8"/>
        <vers num="3.1.9"/>
        <vers num="3.10"/>
        <vers num="3.10.1"/>
        <vers num="3.10.10"/>
        <vers num="3.10.11"/>
        <vers num="3.10.12"/>
        <vers num="3.10.13"/>
        <vers num="3.10.14"/>
        <vers num="3.10.15"/>
        <vers num="3.10.16"/>
        <vers num="3.10.17"/>
        <vers num="3.10.18"/>
        <vers num="3.10.19"/>
        <vers num="3.10.2"/>
        <vers num="3.10.20"/>
        <vers num="3.10.21"/>
        <vers num="3.10.22"/>
        <vers num="3.10.23"/>
        <vers num="3.10.24"/>
        <vers num="3.10.25"/>
        <vers num="3.10.26"/>
        <vers num="3.10.27"/>
        <vers num="3.10.28"/>
        <vers num="3.10.29"/>
        <vers num="3.10.3"/>
        <vers num="3.10.4"/>
        <vers num="3.10.5"/>
        <vers num="3.10.6"/>
        <vers num="3.10.7"/>
        <vers num="3.10.8"/>
        <vers num="3.10.9"/>
        <vers num="3.11"/>
        <vers num="3.11.1"/>
        <vers num="3.11.10"/>
        <vers num="3.11.2"/>
        <vers num="3.11.3"/>
        <vers num="3.11.4"/>
        <vers num="3.11.5"/>
        <vers num="3.11.6"/>
        <vers num="3.11.7"/>
        <vers num="3.11.8"/>
        <vers num="3.11.9"/>
        <vers num="3.12"/>
        <vers num="3.12.1"/>
        <vers num="3.12.10"/>
        <vers num="3.12.11"/>
        <vers num="3.12.12"/>
        <vers num="3.12.13"/>
        <vers num="3.12.14"/>
        <vers num="3.12.15"/>
        <vers num="3.12.16"/>
        <vers num="3.12.17"/>
        <vers num="3.12.2"/>
        <vers num="3.12.3"/>
        <vers num="3.12.4"/>
        <vers num="3.12.5"/>
        <vers num="3.12.6"/>
        <vers num="3.12.7"/>
        <vers num="3.12.8"/>
        <vers num="3.12.9"/>
        <vers num="3.13"/>
        <vers num="3.13.1"/>
        <vers num="3.13.2"/>
        <vers num="3.13.3"/>
        <vers num="3.13.4"/>
        <vers num="3.13.5"/>
        <vers num="3.13.6"/>
        <vers num="3.13.7"/>
        <vers num="3.13.8"/>
        <vers num="3.13.9"/>
        <vers prev="1" num="3.14.1"/>
        <vers num="3.2" edition="rc2"/>
        <vers num="3.2" edition="rc3"/>
        <vers num="3.2" edition="rc4"/>
        <vers num="3.2" edition="rc5"/>
        <vers num="3.2" edition="rc6"/>
        <vers num="3.2" edition="rc7"/>
        <vers num="3.2.1"/>
        <vers num="3.2.10"/>
        <vers num="3.2.11"/>
        <vers num="3.2.12"/>
        <vers num="3.2.13"/>
        <vers num="3.2.14"/>
        <vers num="3.2.15"/>
        <vers num="3.2.16"/>
        <vers num="3.2.17"/>
        <vers num="3.2.18"/>
        <vers num="3.2.19"/>
        <vers num="3.2.2"/>
        <vers num="3.2.20"/>
        <vers num="3.2.21"/>
        <vers num="3.2.22"/>
        <vers num="3.2.23"/>
        <vers num="3.2.24"/>
        <vers num="3.2.25"/>
        <vers num="3.2.26"/>
        <vers num="3.2.27"/>
        <vers num="3.2.28"/>
        <vers num="3.2.29"/>
        <vers num="3.2.3"/>
        <vers num="3.2.30"/>
        <vers num="3.2.4"/>
        <vers num="3.2.5"/>
        <vers num="3.2.6"/>
        <vers num="3.2.7"/>
        <vers num="3.2.8"/>
        <vers num="3.2.9"/>
        <vers num="3.3" edition="rc1"/>
        <vers num="3.3" edition="rc2"/>
        <vers num="3.3" edition="rc3"/>
        <vers num="3.3" edition="rc4"/>
        <vers num="3.3" edition="rc5"/>
        <vers num="3.3" edition="rc6"/>
        <vers num="3.3" edition="rc7"/>
        <vers num="3.3.1"/>
        <vers num="3.3.2"/>
        <vers num="3.3.3"/>
        <vers num="3.3.4"/>
        <vers num="3.3.5"/>
        <vers num="3.3.6"/>
        <vers num="3.3.7"/>
        <vers num="3.3.8"/>
        <vers num="3.4" edition="rc1"/>
        <vers num="3.4" edition="rc2"/>
        <vers num="3.4" edition="rc3"/>
        <vers num="3.4" edition="rc4"/>
        <vers num="3.4" edition="rc5"/>
        <vers num="3.4" edition="rc6"/>
        <vers num="3.4" edition="rc7"/>
        <vers num="3.4.1"/>
        <vers num="3.4.10"/>
        <vers num="3.4.11"/>
        <vers num="3.4.12"/>
        <vers num="3.4.13"/>
        <vers num="3.4.14"/>
        <vers num="3.4.15"/>
        <vers num="3.4.16"/>
        <vers num="3.4.17"/>
        <vers num="3.4.18"/>
        <vers num="3.4.19"/>
        <vers num="3.4.2"/>
        <vers num="3.4.20"/>
        <vers num="3.4.21"/>
        <vers num="3.4.22"/>
        <vers num="3.4.23"/>
        <vers num="3.4.24"/>
        <vers num="3.4.25"/>
        <vers num="3.4.26"/>
        <vers num="3.4.27"/>
        <vers num="3.4.28"/>
        <vers num="3.4.29"/>
        <vers num="3.4.3"/>
        <vers num="3.4.30"/>
        <vers num="3.4.31"/>
        <vers num="3.4.32"/>
        <vers num="3.4.33"/>
        <vers num="3.4.34"/>
        <vers num="3.4.35"/>
        <vers num="3.4.36"/>
        <vers num="3.4.37"/>
        <vers num="3.4.38"/>
        <vers num="3.4.39"/>
        <vers num="3.4.4"/>
        <vers num="3.4.40"/>
        <vers num="3.4.41"/>
        <vers num="3.4.42"/>
        <vers num="3.4.43"/>
        <vers num="3.4.44"/>
        <vers num="3.4.45"/>
        <vers num="3.4.46"/>
        <vers num="3.4.47"/>
        <vers num="3.4.48"/>
        <vers num="3.4.49"/>
        <vers num="3.4.5"/>
        <vers num="3.4.50"/>
        <vers num="3.4.51"/>
        <vers num="3.4.52"/>
        <vers num="3.4.53"/>
        <vers num="3.4.54"/>
        <vers num="3.4.55"/>
        <vers num="3.4.56"/>
        <vers num="3.4.57"/>
        <vers num="3.4.58"/>
        <vers num="3.4.59"/>
        <vers num="3.4.6"/>
        <vers num="3.4.60"/>
        <vers num="3.4.61"/>
        <vers num="3.4.62"/>
        <vers num="3.4.63"/>
        <vers num="3.4.64"/>
        <vers num="3.4.65"/>
        <vers num="3.4.66"/>
        <vers num="3.4.67"/>
        <vers num="3.4.68"/>
        <vers num="3.4.69"/>
        <vers num="3.4.7"/>
        <vers num="3.4.70"/>
        <vers num="3.4.71"/>
        <vers num="3.4.72"/>
        <vers num="3.4.73"/>
        <vers num="3.4.74"/>
        <vers num="3.4.75"/>
        <vers num="3.4.76"/>
        <vers num="3.4.77"/>
        <vers num="3.4.78"/>
        <vers num="3.4.79"/>
        <vers num="3.4.8"/>
        <vers num="3.4.9"/>
        <vers num="3.5.1"/>
        <vers num="3.5.2"/>
        <vers num="3.5.3"/>
        <vers num="3.5.4"/>
        <vers num="3.5.5"/>
        <vers num="3.5.6"/>
        <vers num="3.5.7"/>
        <vers num="3.6"/>
        <vers num="3.6.1"/>
        <vers num="3.6.10"/>
        <vers num="3.6.11"/>
        <vers num="3.6.2"/>
        <vers num="3.6.3"/>
        <vers num="3.6.4"/>
        <vers num="3.6.5"/>
        <vers num="3.6.6"/>
        <vers num="3.6.7"/>
        <vers num="3.6.8"/>
        <vers num="3.6.9"/>
        <vers num="3.7"/>
        <vers num="3.7.1"/>
        <vers num="3.7.10"/>
        <vers num="3.7.2"/>
        <vers num="3.7.3"/>
        <vers num="3.7.4"/>
        <vers num="3.7.5"/>
        <vers num="3.7.6"/>
        <vers num="3.7.7"/>
        <vers num="3.7.8"/>
        <vers num="3.7.9"/>
        <vers num="3.8.0"/>
        <vers num="3.8.1"/>
        <vers num="3.8.10"/>
        <vers num="3.8.11"/>
        <vers num="3.8.12"/>
        <vers num="3.8.13"/>
        <vers num="3.8.2"/>
        <vers num="3.8.3"/>
        <vers num="3.8.4"/>
        <vers num="3.8.5"/>
        <vers num="3.8.6"/>
        <vers num="3.8.7"/>
        <vers num="3.8.8"/>
        <vers num="3.8.9"/>
        <vers num="3.9" edition="rc1"/>
        <vers num="3.9" edition="rc2"/>
        <vers num="3.9" edition="rc3"/>
        <vers num="3.9" edition="rc4"/>
        <vers num="3.9" edition="rc5"/>
        <vers num="3.9" edition="rc6"/>
        <vers num="3.9" edition="rc7"/>
        <vers num="3.9.0"/>
        <vers num="3.9.1"/>
        <vers num="3.9.10"/>
        <vers num="3.9.11"/>
        <vers num="3.9.2"/>
        <vers num="3.9.3"/>
        <vers num="3.9.4"/>
        <vers num="3.9.5"/>
        <vers num="3.9.6"/>
        <vers num="3.9.7"/>
        <vers num="3.9.8"/>
        <vers num="3.9.9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2852" published="2014-04-14" name="CVE-2014-2852" modified="2014-04-15" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:P)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">OpenAFS before 1.6.7 delays the listen thread when an RXS_CheckResponse fails, which allows remote attackers to cause a denial of service (performance degradation) via an invalid packet.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.openafs.org/frameset/dl/openafs/1.6.7/ChangeLog" source="CONFIRM">http://www.openafs.org/frameset/dl/openafs/1.6.7/ChangeLog</ref>
      <ref url="http://www.debian.org/security/2014/dsa-2899" source="DEBIAN">DSA-2899</ref>
    </refs>
    <vuln_soft>
      <prod vendor="openafs" name="openafs">
        <vers num="1.6.0"/>
        <vers num="1.6.1"/>
        <vers num="1.6.2"/>
        <vers num="1.6.2.1"/>
        <vers num="1.6.3"/>
        <vers num="1.6.4"/>
        <vers num="1.6.5"/>
        <vers num="1.6.5.1"/>
        <vers num="1.6.5.2"/>
        <vers prev="1" num="1.6.6"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2853" published="2014-04-29" name="CVE-2014-2853" modified="2014-04-30" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in includes/actions/InfoAction.php in MediaWiki before 1.21.9 and 1.22.x before 1.22.6 allows remote attackers to inject arbitrary web script or HTML via the sort key in an info action.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="https://www.mediawiki.org/wiki/Release_notes/1.22#Changes_since_1.22.5" source="CONFIRM" adv="1">https://www.mediawiki.org/wiki/Release_notes/1.22#Changes_since_1.22.5</ref>
      <ref url="https://www.mediawiki.org/wiki/Release_notes/1.21#Changes_since_1.21.8" source="CONFIRM" adv="1">https://www.mediawiki.org/wiki/Release_notes/1.21#Changes_since_1.21.8</ref>
      <ref url="https://github.com/wikimedia/mediawiki-core/commit/0b695ae09aada343ab59be4a3c9963995a1143b6" source="MISC">https://github.com/wikimedia/mediawiki-core/commit/0b695ae09aada343ab59be4a3c9963995a1143b6</ref>
      <ref url="https://bugzilla.wikimedia.org/show_bug.cgi?id=63251" source="CONFIRM">https://bugzilla.wikimedia.org/show_bug.cgi?id=63251</ref>
      <ref url="https://bugzilla.redhat.com/show_bug.cgi?id=1091967" source="MISC">https://bugzilla.redhat.com/show_bug.cgi?id=1091967</ref>
      <ref url="http://www.securityfocus.com/bid/67068" source="BID">67068</ref>
      <ref url="http://secunia.com/advisories/58262" source="SECUNIA" adv="1">58262</ref>
      <ref url="http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-April/000149.html" source="MLIST">[MediaWiki-announce] 20140424 MediaWiki Security and Maintenance Releases: 1.22.6 and 1.21.9</ref>
    </refs>
    <vuln_soft>
      <prod vendor="mediawiki" name="mediawiki">
        <vers num="1.1.0"/>
        <vers num="1.10.0" edition="rc1"/>
        <vers num="1.10.0" edition="rc2"/>
        <vers num="1.10.1"/>
        <vers num="1.10.2"/>
        <vers num="1.10.3"/>
        <vers num="1.10.4"/>
        <vers num="1.11"/>
        <vers num="1.11.0" edition="rc1"/>
        <vers num="1.11.1"/>
        <vers num="1.11.2"/>
        <vers num="1.12.0" edition="rc1"/>
        <vers num="1.12.1"/>
        <vers num="1.12.2"/>
        <vers num="1.12.3"/>
        <vers num="1.12.4"/>
        <vers num="1.13.0" edition="rc1"/>
        <vers num="1.13.0" edition="rc2"/>
        <vers num="1.13.1"/>
        <vers num="1.13.2"/>
        <vers num="1.13.3"/>
        <vers num="1.13.4"/>
        <vers num="1.14.0" edition="rc1"/>
        <vers num="1.14.1"/>
        <vers num="1.15.0" edition="rc1"/>
        <vers num="1.15.1"/>
        <vers num="1.15.2"/>
        <vers num="1.15.3"/>
        <vers num="1.15.4"/>
        <vers num="1.15.5"/>
        <vers num="1.16.0" edition="beta1"/>
        <vers num="1.16.0" edition="beta2"/>
        <vers num="1.16.0" edition="beta3"/>
        <vers num="1.16.1"/>
        <vers num="1.16.2"/>
        <vers num="1.17" edition="beta_1"/>
        <vers num="1.17.0" edition="rc1"/>
        <vers num="1.17.1"/>
        <vers num="1.17.2"/>
        <vers num="1.17.3"/>
        <vers num="1.17.4"/>
        <vers num="1.18" edition="beta_1"/>
        <vers num="1.18.0" edition="rc1"/>
        <vers num="1.18.1"/>
        <vers num="1.18.2"/>
        <vers num="1.18.3"/>
        <vers num="1.19" edition="beta_1"/>
        <vers num="1.19" edition="beta_2"/>
        <vers num="1.19.0"/>
        <vers num="1.19.1"/>
        <vers num="1.19.10"/>
        <vers num="1.19.11"/>
        <vers num="1.19.12"/>
        <vers num="1.19.13"/>
        <vers num="1.19.14"/>
        <vers num="1.19.2"/>
        <vers num="1.19.3"/>
        <vers num="1.19.4"/>
        <vers num="1.19.5"/>
        <vers num="1.19.6"/>
        <vers num="1.19.7"/>
        <vers num="1.19.8"/>
        <vers num="1.19.9"/>
        <vers num="1.2.0"/>
        <vers num="1.2.1"/>
        <vers num="1.2.2"/>
        <vers num="1.2.3"/>
        <vers num="1.2.4"/>
        <vers num="1.2.5"/>
        <vers num="1.2.6"/>
        <vers num="1.20"/>
        <vers num="1.20.1"/>
        <vers num="1.20.2"/>
        <vers num="1.20.3"/>
        <vers num="1.20.4"/>
        <vers num="1.20.5"/>
        <vers num="1.20.6"/>
        <vers num="1.20.7"/>
        <vers num="1.20.8"/>
        <vers num="1.21"/>
        <vers num="1.21.1"/>
        <vers num="1.21.2"/>
        <vers num="1.21.3"/>
        <vers num="1.21.4"/>
        <vers num="1.21.5"/>
        <vers num="1.21.6"/>
        <vers num="1.21.7"/>
        <vers prev="1" num="1.21.8"/>
        <vers num="1.22.0"/>
        <vers num="1.22.1"/>
        <vers num="1.22.2"/>
        <vers num="1.22.3"/>
        <vers num="1.22.4"/>
        <vers num="1.22.5"/>
        <vers num="1.3"/>
        <vers num="1.3.0"/>
        <vers num="1.3.1"/>
        <vers num="1.3.10"/>
        <vers num="1.3.11"/>
        <vers num="1.3.12"/>
        <vers num="1.3.13"/>
        <vers num="1.3.14"/>
        <vers num="1.3.15"/>
        <vers num="1.3.2"/>
        <vers num="1.3.3"/>
        <vers num="1.3.4"/>
        <vers num="1.3.5"/>
        <vers num="1.3.6"/>
        <vers num="1.3.7"/>
        <vers num="1.3.8"/>
        <vers num="1.3.9"/>
        <vers num="1.4" edition="beta1"/>
        <vers num="1.4" edition="beta2"/>
        <vers num="1.4" edition="beta3"/>
        <vers num="1.4" edition="beta4"/>
        <vers num="1.4" edition="beta5"/>
        <vers num="1.4" edition="beta6"/>
        <vers num="1.4.0"/>
        <vers num="1.4.1"/>
        <vers num="1.4.10"/>
        <vers num="1.4.11"/>
        <vers num="1.4.12"/>
        <vers num="1.4.13"/>
        <vers num="1.4.14"/>
        <vers num="1.4.2"/>
        <vers num="1.4.3"/>
        <vers num="1.4.4"/>
        <vers num="1.4.5"/>
        <vers num="1.4.6"/>
        <vers num="1.4.7"/>
        <vers num="1.4.8"/>
        <vers num="1.4.9"/>
        <vers num="1.5" edition="alpha1"/>
        <vers num="1.5" edition="alpha2"/>
        <vers num="1.5" edition="beta1"/>
        <vers num="1.5" edition="beta2"/>
        <vers num="1.5" edition="beta3"/>
        <vers num="1.5" edition="beta4"/>
        <vers num="1.5" edition="rc2"/>
        <vers num="1.5" edition="rc3"/>
        <vers num="1.5" edition="rc4"/>
        <vers num="1.5.0"/>
        <vers num="1.5.1"/>
        <vers num="1.5.2"/>
        <vers num="1.5.3"/>
        <vers num="1.5.4"/>
        <vers num="1.5.5"/>
        <vers num="1.5.6"/>
        <vers num="1.5.7"/>
        <vers num="1.5.8"/>
        <vers num="1.6.0"/>
        <vers num="1.6.1"/>
        <vers num="1.6.10"/>
        <vers num="1.6.11"/>
        <vers num="1.6.12"/>
        <vers num="1.6.2"/>
        <vers num="1.6.3"/>
        <vers num="1.6.4"/>
        <vers num="1.6.5"/>
        <vers num="1.6.6"/>
        <vers num="1.6.7"/>
        <vers num="1.6.8"/>
        <vers num="1.6.9"/>
        <vers num="1.7.0"/>
        <vers num="1.7.1"/>
        <vers num="1.7.2"/>
        <vers num="1.7.3"/>
        <vers num="1.8.0"/>
        <vers num="1.8.1"/>
        <vers num="1.8.2"/>
        <vers num="1.8.3"/>
        <vers num="1.8.4"/>
        <vers num="1.8.5"/>
        <vers num="1.9.0" edition="rc2"/>
        <vers num="1.9.1"/>
        <vers num="1.9.2"/>
        <vers num="1.9.3"/>
        <vers num="1.9.4"/>
        <vers num="1.9.5"/>
        <vers num="1.9.6"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2855" published="2014-04-23" name="CVE-2014-2855" modified="2014-04-24" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:P)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">The check_secret function in authenticate.c in rsync 3.1.0 and earlier allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a user name which does not exist in the secrets file.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://git.samba.org/?p=rsync.git;a=commit;h=0dedfbce2c1b851684ba658861fe9d620636c56a" source="CONFIRM">https://git.samba.org/?p=rsync.git;a=commit;h=0dedfbce2c1b851684ba658861fe9d620636c56a</ref>
      <ref url="https://bugzilla.samba.org/show_bug.cgi?id=10551" source="CONFIRM" adv="1">https://bugzilla.samba.org/show_bug.cgi?id=10551</ref>
      <ref url="https://bugs.launchpad.net/ubuntu/+source/rsync/+bug/1307230" source="CONFIRM">https://bugs.launchpad.net/ubuntu/+source/rsync/+bug/1307230</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/04/15/1" source="MLIST">[oss-security] 20140415 Re: CVE Request: rsync denial of service</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/04/14/5" source="MLIST">[oss-security] 20140414 CVE Request: rsync denial of service</ref>
      <ref url="http://secunia.com/advisories/57948" source="SECUNIA" adv="1">57948</ref>
      <ref url="http://lists.fedoraproject.org/pipermail/package-announce/2014-April/131910.html" source="FEDORA">FEDORA-2014-5315</ref>
    </refs>
    <vuln_soft>
      <prod vendor="samba" name="rsync">
        <vers num="2.6.9"/>
        <vers num="2.7.0"/>
        <vers num="2.7.1"/>
        <vers num="2.7.2"/>
        <vers num="2.7.3"/>
        <vers num="2.7.4"/>
        <vers num="2.7.5"/>
        <vers num="2.7.6"/>
        <vers num="2.7.7"/>
        <vers num="2.7.8"/>
        <vers num="2.7.9"/>
        <vers num="2.8.0"/>
        <vers num="2.8.1"/>
        <vers num="2.8.2"/>
        <vers num="2.8.3"/>
        <vers num="2.8.4"/>
        <vers num="2.8.5"/>
        <vers num="2.8.6"/>
        <vers num="2.8.7"/>
        <vers num="2.8.8"/>
        <vers num="2.8.9"/>
        <vers num="2.9.0"/>
        <vers num="2.9.1"/>
        <vers num="2.9.2"/>
        <vers num="2.9.3"/>
        <vers num="2.9.4"/>
        <vers num="2.9.5"/>
        <vers num="2.9.6"/>
        <vers num="2.9.7"/>
        <vers num="2.9.8"/>
        <vers num="2.9.9"/>
        <vers num="3.0.0"/>
        <vers num="3.0.1"/>
        <vers num="3.0.2"/>
        <vers num="3.0.3"/>
        <vers num="3.0.4"/>
        <vers num="3.0.5"/>
        <vers num="3.0.6"/>
        <vers num="3.0.7"/>
        <vers num="3.0.8"/>
        <vers num="3.0.9"/>
        <vers prev="1" num="3.1.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2856" published="2014-04-18" name="CVE-2014-2856" modified="2014-04-21" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in scheduler/client.c in Common Unix Printing System (CUPS) before 1.7.2 allows remote attackers to inject arbitrary web script or HTML via the URL path, related to the is_path_absolute function.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://www.openwall.com/lists/oss-security/2014/04/15/3" source="MLIST">[oss-security] 20140415 Re: CVE request: cross-site scripting issue fixed in CUPS 1.7.2</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/04/14/2" source="MLIST">[oss-security] 20140414 CVE request: cross-site scripting issue fixed in CUPS 1.7.2</ref>
      <ref url="http://www.cups.org/str.php?L4356" source="CONFIRM">http://www.cups.org/str.php?L4356</ref>
      <ref url="http://www.cups.org/documentation.php/relnotes.html" source="CONFIRM">http://www.cups.org/documentation.php/relnotes.html</ref>
      <ref url="http://secunia.com/advisories/57880" source="SECUNIA" adv="1">57880</ref>
    </refs>
    <vuln_soft>
      <prod vendor="apple" name="cups">
        <vers num="1.1"/>
        <vers num="1.1.1"/>
        <vers num="1.1.10"/>
        <vers num="1.1.10-1"/>
        <vers num="1.1.11"/>
        <vers num="1.1.12"/>
        <vers num="1.1.13"/>
        <vers num="1.1.14"/>
        <vers num="1.1.15"/>
        <vers num="1.1.16"/>
        <vers num="1.1.17"/>
        <vers num="1.1.18"/>
        <vers num="1.1.19" edition="rc1"/>
        <vers num="1.1.19" edition="rc2"/>
        <vers num="1.1.19" edition="rc3"/>
        <vers num="1.1.19" edition="rc4"/>
        <vers num="1.1.19" edition="rc5"/>
        <vers num="1.1.2"/>
        <vers num="1.1.20" edition="rc1"/>
        <vers num="1.1.20" edition="rc2"/>
        <vers num="1.1.20" edition="rc3"/>
        <vers num="1.1.20" edition="rc4"/>
        <vers num="1.1.20" edition="rc5"/>
        <vers num="1.1.20" edition="rc6"/>
        <vers num="1.1.21" edition="rc1"/>
        <vers num="1.1.21" edition="rc2"/>
        <vers num="1.1.22" edition="rc1"/>
        <vers num="1.1.22" edition="rc2"/>
        <vers num="1.1.23" edition="rc1"/>
        <vers num="1.1.3"/>
        <vers num="1.1.4"/>
        <vers num="1.1.5"/>
        <vers num="1.1.5-1"/>
        <vers num="1.1.5-2"/>
        <vers num="1.1.6"/>
        <vers num="1.1.6-1"/>
        <vers num="1.1.6-2"/>
        <vers num="1.1.6-3"/>
        <vers num="1.1.7"/>
        <vers num="1.1.8"/>
        <vers num="1.1.9"/>
        <vers num="1.1.9-1"/>
        <vers num="1.2" edition="b1"/>
        <vers num="1.2" edition="b2"/>
        <vers num="1.2" edition="rc1"/>
        <vers num="1.2" edition="rc2"/>
        <vers num="1.2" edition="rc3"/>
        <vers num="1.2.0"/>
        <vers num="1.2.1"/>
        <vers num="1.2.10"/>
        <vers num="1.2.11"/>
        <vers num="1.2.12"/>
        <vers num="1.2.2"/>
        <vers num="1.2.3"/>
        <vers num="1.2.4"/>
        <vers num="1.2.5"/>
        <vers num="1.2.6"/>
        <vers num="1.2.7"/>
        <vers num="1.2.8"/>
        <vers num="1.2.9"/>
        <vers num="1.3" edition="b1"/>
        <vers num="1.3" edition="rc1"/>
        <vers num="1.3" edition="rc2"/>
        <vers num="1.3.0"/>
        <vers num="1.3.1"/>
        <vers num="1.3.10"/>
        <vers num="1.3.11"/>
        <vers num="1.3.2"/>
        <vers num="1.3.3"/>
        <vers num="1.3.4"/>
        <vers num="1.3.5"/>
        <vers num="1.3.6"/>
        <vers num="1.3.7"/>
        <vers num="1.3.8"/>
        <vers num="1.3.9"/>
        <vers num="1.4" edition="b1"/>
        <vers num="1.4" edition="b2"/>
        <vers num="1.4" edition="b3"/>
        <vers num="1.4" edition="rc1"/>
        <vers num="1.4.0"/>
        <vers num="1.4.1"/>
        <vers num="1.4.2"/>
        <vers num="1.4.3"/>
        <vers num="1.4.4"/>
        <vers num="1.4.5"/>
        <vers num="1.4.6"/>
        <vers num="1.4.7"/>
        <vers num="1.4.8"/>
        <vers num="1.5" edition="b1"/>
        <vers num="1.5" edition="b2"/>
        <vers num="1.5" edition="rc1"/>
        <vers num="1.5.0"/>
        <vers num="1.5.1"/>
        <vers num="1.5.2"/>
        <vers num="1.5.3"/>
        <vers num="1.5.4"/>
        <vers num="1.6" edition="b1"/>
        <vers num="1.6" edition="rc1"/>
        <vers num="1.6.1"/>
        <vers num="1.6.2"/>
        <vers num="1.6.3"/>
        <vers num="1.6.4"/>
        <vers num="1.7" edition="rc1"/>
        <vers num="1.7.0"/>
        <vers prev="1" num="1.7.1" edition="b1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2857" published="2014-04-15" name="CVE-2014-2857" modified="2014-04-22" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:N/A:N)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">The default configuration of the Resources plugin 1.0.0 before 1.2.6 for Pivotal Grails 2.0.0 through 2.3.6 does not properly restrict access to files in the META-INF directory, which allows remote attackers to obtain sensitive information via a direct request.  NOTE: this issue was SPLIT from CVE-2014-0053 due to different researchers per ADT5.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.securityfocus.com/archive/1/archive/1/531281/100/0/threaded" source="BUGTRAQ">20140227 Update: CVE-2014-0053 Information Disclosure when using Grails</ref>
      <ref url="http://www.gopivotal.com/security/cve-2014-0053" source="CONFIRM" adv="1">http://www.gopivotal.com/security/cve-2014-0053</ref>
      <ref url="http://archives.neohapsis.com/archives/fulldisclosure/2014-02/0267.html" source="FULLDISC">20140227 Update: CVE-2014-0053 Information Disclosure when using Grails</ref>
    </refs>
    <vuln_soft>
      <prod vendor="gopivotal" name="grails">
        <vers num="2.0.0"/>
        <vers num="2.0.1"/>
        <vers num="2.0.2"/>
        <vers num="2.0.3"/>
        <vers num="2.0.4"/>
        <vers num="2.1.0"/>
        <vers num="2.1.1"/>
        <vers num="2.1.2"/>
        <vers num="2.1.3"/>
        <vers num="2.1.4"/>
        <vers num="2.1.5"/>
        <vers num="2.2.0"/>
        <vers num="2.2.1"/>
        <vers num="2.2.2"/>
        <vers num="2.2.3"/>
        <vers num="2.2.4"/>
        <vers num="2.2.5"/>
        <vers num="2.3.0"/>
        <vers num="2.3.1"/>
        <vers num="2.3.2"/>
        <vers num="2.3.3"/>
        <vers num="2.3.4"/>
        <vers num="2.3.5"/>
        <vers num="2.3.6"/>
      </prod>
      <prod vendor="gopivotal" name="grails-resources">
        <vers num="1.0.0"/>
        <vers num="1.0.2"/>
        <vers num="1.1.0"/>
        <vers num="1.1.1"/>
        <vers num="1.1.2"/>
        <vers num="1.1.4"/>
        <vers num="1.1.5"/>
        <vers num="1.1.6"/>
        <vers num="1.2.0"/>
        <vers num="1.2.1"/>
        <vers num="1.2.2"/>
        <vers num="1.2.3"/>
        <vers num="1.2.4"/>
        <vers num="1.2.5"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2858" published="2014-04-15" name="CVE-2014-2858" modified="2014-04-22" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:N/A:N)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">Directory traversal vulnerability in the Resources plugin 1.0.0 before 1.2.6 for Pivotal Grails 2.0.0 through 2.3.6 allows remote attackers to obtain sensitive information via unspecified vectors related to a "configured block." NOTE: this issue was SPLIT from CVE-2014-0053 per ADT2 due to different vulnerability types.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.securityfocus.com/archive/1/archive/1/531281/100/0/threaded" source="BUGTRAQ">20140227 Update: CVE-2014-0053 Information Disclosure when using Grails</ref>
      <ref url="http://www.gopivotal.com/security/cve-2014-0053" source="CONFIRM" adv="1">http://www.gopivotal.com/security/cve-2014-0053</ref>
      <ref url="http://archives.neohapsis.com/archives/fulldisclosure/2014-02/0267.html" source="FULLDISC">20140227 Update: CVE-2014-0053 Information Disclosure when using Grails</ref>
    </refs>
    <vuln_soft>
      <prod vendor="gopivotal" name="grails">
        <vers num="2.0.0"/>
        <vers num="2.0.1"/>
        <vers num="2.0.2"/>
        <vers num="2.0.3"/>
        <vers num="2.0.4"/>
        <vers num="2.1.0"/>
        <vers num="2.1.1"/>
        <vers num="2.1.2"/>
        <vers num="2.1.3"/>
        <vers num="2.1.4"/>
        <vers num="2.1.5"/>
        <vers num="2.2.0"/>
        <vers num="2.2.1"/>
        <vers num="2.2.2"/>
        <vers num="2.2.3"/>
        <vers num="2.2.4"/>
        <vers num="2.2.5"/>
        <vers num="2.3.0"/>
        <vers num="2.3.1"/>
        <vers num="2.3.2"/>
        <vers num="2.3.3"/>
        <vers num="2.3.4"/>
        <vers num="2.3.5"/>
        <vers num="2.3.6"/>
      </prod>
      <prod vendor="gopivotal" name="grails-resources">
        <vers num="1.0.0"/>
        <vers num="1.0.2"/>
        <vers num="1.1.0"/>
        <vers num="1.1.1"/>
        <vers num="1.1.2"/>
        <vers num="1.1.4"/>
        <vers num="1.1.5"/>
        <vers num="1.1.6"/>
        <vers num="1.2.0"/>
        <vers num="1.2.1"/>
        <vers num="1.2.2"/>
        <vers num="1.2.3"/>
        <vers num="1.2.4"/>
        <vers num="1.2.5"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2859" published="2014-04-15" name="CVE-2014-2859" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allows remote attackers to bypass intended access restrictions via a direct request.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.kb.cert.org/vuls/id/437385" source="CERT-VN">VU#437385</ref>
    </refs>
    <vuln_soft>
      <prod vendor="paperthin" name="commonspot_content_server">
        <vers prev="1" num="7.0.1"/>
        <vers num="8.0.0"/>
        <vers num="8.0.1"/>
        <vers num="8.0.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2860" published="2014-04-15" name="CVE-2014-2860" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Multiple cross-site scripting (XSS) vulnerabilities in PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allow remote attackers to inject arbitrary web script or HTML via a crafted HTTP request to a (1) ColdFusion or (2) JavaScript component.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://www.kb.cert.org/vuls/id/437385" source="CERT-VN">VU#437385</ref>
    </refs>
    <vuln_soft>
      <prod vendor="paperthin" name="commonspot_content_server">
        <vers prev="1" num="7.0.1"/>
        <vers num="8.0.0"/>
        <vers num="8.0.1"/>
        <vers num="8.0.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2861" published="2014-04-15" name="CVE-2014-2861" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Incomplete blacklist vulnerability in PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted string, as demonstrated by bypassing a protection mechanism that removes only the "alert" string.</descript>
      <descript source="nvd">Per: https://cwe.mitre.org/data/definitions/184.html "CWE-184: Incomplete Blacklist"</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://www.kb.cert.org/vuls/id/437385" source="CERT-VN">VU#437385</ref>
    </refs>
    <vuln_soft>
      <prod vendor="paperthin" name="commonspot_content_server">
        <vers prev="1" num="7.0.1"/>
        <vers num="8.0.0"/>
        <vers num="8.0.1"/>
        <vers num="8.0.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2862" published="2014-04-15" name="CVE-2014-2862" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:P/I:P/A:P)" CVSS_score="6.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.0" CVSS_base_score="6.5">
    <desc>
      <descript source="cve">PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 does not check authorization in unspecified situations, which allows remote authenticated users to perform actions via unknown vectors.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.kb.cert.org/vuls/id/437385" source="CERT-VN">VU#437385</ref>
    </refs>
    <vuln_soft>
      <prod vendor="paperthin" name="commonspot_content_server">
        <vers prev="1" num="7.0.1"/>
        <vers num="8.0.0"/>
        <vers num="8.0.1"/>
        <vers num="8.0.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2863" published="2014-04-15" name="CVE-2014-2863" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:C/I:C/A:C)" CVSS_score="10.0" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="10.0" CVSS_base_score="10.0">
    <desc>
      <descript source="cve">Multiple absolute path traversal vulnerabilities in PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allow remote attackers to have an unspecified impact via a full pathname in a parameter.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.kb.cert.org/vuls/id/437385" source="CERT-VN">VU#437385</ref>
    </refs>
    <vuln_soft>
      <prod vendor="paperthin" name="commonspot_content_server">
        <vers prev="1" num="7.0.1"/>
        <vers num="8.0.0"/>
        <vers num="8.0.1"/>
        <vers num="8.0.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2864" published="2014-04-15" name="CVE-2014-2864" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:C/I:C/A:C)" CVSS_score="10.0" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="10.0" CVSS_base_score="10.0">
    <desc>
      <descript source="cve">Multiple directory traversal vulnerabilities in PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allow remote attackers to have an unspecified impact via a filename parameter containing directory traversal sequences.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.kb.cert.org/vuls/id/437385" source="CERT-VN">VU#437385</ref>
    </refs>
    <vuln_soft>
      <prod vendor="paperthin" name="commonspot_content_server">
        <vers prev="1" num="7.0.1"/>
        <vers num="8.0.0"/>
        <vers num="8.0.1"/>
        <vers num="8.0.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2865" published="2014-04-15" name="CVE-2014-2865" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allows remote attackers to bypass intended access restrictions via a '\0' character, as demonstrated by using this character within a pathname on the drive containing the web root directory of a ColdFusion installation.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.kb.cert.org/vuls/id/437385" source="CERT-VN">VU#437385</ref>
    </refs>
    <vuln_soft>
      <prod vendor="paperthin" name="commonspot_content_server">
        <vers prev="1" num="7.0.1"/>
        <vers num="8.0.0"/>
        <vers num="8.0.1"/>
        <vers num="8.0.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2866" published="2014-04-15" name="CVE-2014-2866" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:C/I:C/A:C)" CVSS_score="10.0" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="10.0" CVSS_base_score="10.0">
    <desc>
      <descript source="cve">PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 relies on client JavaScript code for access restrictions, which allows remote attackers to perform unspecified operations by modifying this code.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.kb.cert.org/vuls/id/437385" source="CERT-VN">VU#437385</ref>
    </refs>
    <vuln_soft>
      <prod vendor="paperthin" name="commonspot_content_server">
        <vers prev="1" num="7.0.1"/>
        <vers num="8.0.0"/>
        <vers num="8.0.1"/>
        <vers num="8.0.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2867" published="2014-04-15" name="CVE-2014-2867" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:C/I:C/A:C)" CVSS_score="10.0" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="10.0" CVSS_base_score="10.0">
    <desc>
      <descript source="cve">Unrestricted file upload vulnerability in PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allows remote attackers to execute arbitrary code by uploading a ColdFusion page, and then accessing it via unspecified vectors.</descript>
      <descript source="nvd">Per: http://cwe.mitre.org/data/definitions/434.html "CWE-434: Unrestricted Upload of File with Dangerous Type"</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.kb.cert.org/vuls/id/437385" source="CERT-VN">VU#437385</ref>
    </refs>
    <vuln_soft>
      <prod vendor="paperthin" name="commonspot_content_server">
        <vers prev="1" num="7.0.1"/>
        <vers num="8.0.0"/>
        <vers num="8.0.1"/>
        <vers num="8.0.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2868" published="2014-04-15" name="CVE-2014-2868" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allows remote attackers to modify the flow of execution of ColdFusion code by using an HTTP GET request to set a ColdFusion variable.</descript>
      <descript source="nvd">Per http://cwe.mitre.org/data/definitions/472.html "CWE-472: External Control of Assumed-Immutable Web Parameter"</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.kb.cert.org/vuls/id/437385" source="CERT-VN">VU#437385</ref>
    </refs>
    <vuln_soft>
      <prod vendor="paperthin" name="commonspot_content_server">
        <vers prev="1" num="7.0.1"/>
        <vers num="8.0.0"/>
        <vers num="8.0.1"/>
        <vers num="8.0.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2869" published="2014-04-15" name="CVE-2014-2869" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:N/A:N)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allows remote attackers to obtain sensitive information via requests to unspecified URIs, as demonstrated by pathname, SQL server, e-mail address, and IP address information.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.kb.cert.org/vuls/id/437385" source="CERT-VN">VU#437385</ref>
    </refs>
    <vuln_soft>
      <prod vendor="paperthin" name="commonspot_content_server">
        <vers prev="1" num="7.0.1"/>
        <vers num="8.0.0"/>
        <vers num="8.0.1"/>
        <vers num="8.0.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2870" published="2014-04-15" name="CVE-2014-2870" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:N/A:N)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">The default configuration of PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 uses cleartext for storage of credentials in a database, which makes it easier for context-dependent attackers to obtain sensitive information via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.kb.cert.org/vuls/id/437385" source="CERT-VN">VU#437385</ref>
    </refs>
    <vuln_soft>
      <prod vendor="paperthin" name="commonspot_content_server">
        <vers prev="1" num="7.0.1"/>
        <vers num="8.0.0"/>
        <vers num="8.0.1"/>
        <vers num="8.0.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2871" published="2014-04-15" name="CVE-2014-2871" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:N/A:N)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 relies on an HTTP session for entering credentials on login pages, which allows remote attackers to obtain sensitive information by sniffing the network.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.kb.cert.org/vuls/id/437385" source="CERT-VN">VU#437385</ref>
    </refs>
    <vuln_soft>
      <prod vendor="paperthin" name="commonspot_content_server">
        <vers prev="1" num="7.0.1"/>
        <vers num="8.0.0"/>
        <vers num="8.0.1"/>
        <vers num="8.0.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2872" published="2014-04-15" name="CVE-2014-2872" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:N/A:N)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allows remote attackers to obtain potentially sensitive information from a directory listing via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.kb.cert.org/vuls/id/437385" source="CERT-VN">VU#437385</ref>
    </refs>
    <vuln_soft>
      <prod vendor="paperthin" name="commonspot_content_server">
        <vers prev="1" num="7.0.1"/>
        <vers num="8.0.0"/>
        <vers num="8.0.1"/>
        <vers num="8.0.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2873" published="2014-04-15" name="CVE-2014-2873" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:N/A:N)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 does not require authentication for access to log files, which allows remote attackers to obtain sensitive server information by using a predictable name in a request for a file.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.kb.cert.org/vuls/id/437385" source="CERT-VN">VU#437385</ref>
    </refs>
    <vuln_soft>
      <prod vendor="paperthin" name="commonspot_content_server">
        <vers prev="1" num="7.0.1"/>
        <vers num="8.0.0"/>
        <vers num="8.0.1"/>
        <vers num="8.0.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2874" published="2014-04-15" name="CVE-2014-2874" modified="2014-04-16" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:C/I:C/A:C)" CVSS_score="10.0" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="10.0" CVSS_base_score="10.0">
    <desc>
      <descript source="cve">PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allows remote attackers to execute arbitrary code via shell metacharacters in an unspecified context.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.kb.cert.org/vuls/id/437385" source="CERT-VN">VU#437385</ref>
    </refs>
    <vuln_soft>
      <prod vendor="paperthin" name="commonspot_content_server">
        <vers prev="1" num="7.0.1"/>
        <vers num="8.0.0"/>
        <vers num="8.0.1"/>
        <vers num="8.0.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2879" published="2014-04-17" name="CVE-2014-2879" modified="2014-04-18" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Multiple cross-site scripting (XSS) vulnerabilities in Dell SonicWALL Email Security 7.4.5 and earlier allow remote authenticated administrators to inject arbitrary web script or HTML via (1) the uploadPatch parameter to the System/Advanced page (settings_advanced.html) or (2) the uploadLicenses parameter in the License management (settings_upload_dlicense.html) page.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://www.vulnerability-lab.com/get_content.php?id=1191" source="MISC">http://www.vulnerability-lab.com/get_content.php?id=1191</ref>
      <ref url="http://www.sonicwall.com/us/shared/download/Support-Bulletin_Email-Security_Scripting_Vulnerability__Resolved_in__ES746.pdf" source="CONFIRM" adv="1">http://www.sonicwall.com/us/shared/download/Support-Bulletin_Email-Security_Scripting_Vulnerability__Resolved_in__ES746.pdf</ref>
      <ref url="http://www.securitytracker.com/id/1029965" source="SECTRACK">1029965</ref>
      <ref url="http://seclists.org/fulldisclosure/2014/Mar/409" source="FULLDISC">20140328 Dell SonicWall EMail Security 7.4.5 - Multiple Vulnerabilities (Bulletin)</ref>
    </refs>
    <vuln_soft>
      <prod vendor="dell" name="sonicwall_email_security">
        <vers prev="1" num="7.5"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2880" published="2014-04-17" name="CVE-2014-2880" modified="2014-04-18" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:N)" CVSS_score="5.8" CVSS_impact_subscore="4.9" CVSS_exploit_subscore="8.6" CVSS_base_score="5.8">
    <desc>
      <descript source="cve">Open redirect vulnerability in Oracle Identity Manager 11g R2 SP1 (11.1.2.1.0) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the backUrl parameter in a changepwd action to identity/faces/firstlogin.</descript>
    </desc>
    <loss_types>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://www.securityfocus.com/bid/66615" source="BID">66615</ref>
      <ref url="http://www.osvdb.org/105384" source="OSVDB">105384</ref>
      <ref url="http://www.exploit-db.com/exploits/32670" source="EXPLOIT-DB">32670</ref>
      <ref url="http://packetstormsecurity.com/files/125992/Oracle-Identity-Manager-11g-R2-SP1-Unvalidated-Redirect.html" source="MISC">http://packetstormsecurity.com/files/125992/Oracle-Identity-Manager-11g-R2-SP1-Unvalidated-Redirect.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="oracle" name="identity_manager">
        <vers num="11.1.2.1.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2881" published="2014-05-01" name="CVE-2014-2881" modified="2014-05-01" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">Unspecified vulnerability in the Diffie-Hellman key agreement implementation in the management GUI Java applet in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway before 9.3-66.5 and 10.x before 10.1-122.17 has unknown impact and vectors.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.securitytracker.com/id/1030180" source="SECTRACK">1030180</ref>
      <ref url="http://support.citrix.com/article/CTX140651" source="CONFIRM" adv="1">http://support.citrix.com/article/CTX140651</ref>
    </refs>
    <vuln_soft>
      <prod vendor="citrix" name="netscaler_access_gateway_firmware">
        <vers prev="1" num="10.1.e"/>
        <vers num="9.3"/>
      </prod>
      <prod vendor="citrix" name="netscaler_application_delivery_controller_firmware">
        <vers num="10.1"/>
        <vers prev="1" num="9.3.e"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2882" published="2014-05-01" name="CVE-2014-2882" modified="2014-05-01" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">Unspecified vulnerability in the management GUI in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway before 9.3-66.5 and 10.x before 10.1-122.17 has unspecified impact and vectors, related to certificate validation.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.securitytracker.com/id/1030180" source="SECTRACK">1030180</ref>
      <ref url="http://support.citrix.com/article/CTX140651" source="CONFIRM" adv="1">http://support.citrix.com/article/CTX140651</ref>
    </refs>
    <vuln_soft>
      <prod vendor="citrix" name="netscaler_access_gateway_firmware">
        <vers prev="1" num="10.1.e"/>
        <vers num="9.3"/>
      </prod>
      <prod vendor="citrix" name="netscaler_application_delivery_controller_firmware">
        <vers num="10.1"/>
        <vers prev="1" num="9.3.e"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2888" published="2014-04-23" name="CVE-2014-2888" modified="2014-04-24" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">lib/sfpagent/bsig.rb in the sfpagent gem before 0.4.15 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in the module name in a JSON request.</descript>
      <descript source="nvd">Per: https://cwe.mitre.org/data/definitions/77.html

"CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')"</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.vapid.dhs.org/advisories/spfagent-remotecmd.html" source="MISC">http://www.vapid.dhs.org/advisories/spfagent-remotecmd.html</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/04/18/4" source="MLIST">[oss-security] 20140418 Re: Remote Command Injection in Ruby Gem sfpagent 0.4.14</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/04/16/1" source="MLIST">[oss-security] 20140415 Remote Command Injection in Ruby Gem sfpagent 0.4.14</ref>
    </refs>
    <vuln_soft>
      <prod vendor="herry" name="sfpagent">
        <vers num="0.0.1" edition=":~~~ruby~~"/>
        <vers num="0.1.0" edition=":~~~ruby~~"/>
        <vers num="0.1.1" edition=":~~~ruby~~"/>
        <vers num="0.1.10" edition=":~~~ruby~~"/>
        <vers num="0.1.11" edition=":~~~ruby~~"/>
        <vers num="0.1.12" edition=":~~~ruby~~"/>
        <vers num="0.1.13" edition=":~~~ruby~~"/>
        <vers num="0.1.14" edition=":~~~ruby~~"/>
        <vers num="0.1.2" edition=":~~~ruby~~"/>
        <vers num="0.1.3" edition=":~~~ruby~~"/>
        <vers num="0.1.4" edition=":~~~ruby~~"/>
        <vers num="0.1.5" edition=":~~~ruby~~"/>
        <vers num="0.1.6" edition=":~~~ruby~~"/>
        <vers num="0.1.7" edition=":~~~ruby~~"/>
        <vers num="0.1.8" edition=":~~~ruby~~"/>
        <vers num="0.1.9" edition=":~~~ruby~~"/>
        <vers num="0.2.0" edition=":~~~ruby~~"/>
        <vers num="0.2.1" edition=":~~~ruby~~"/>
        <vers num="0.2.10" edition=":~~~ruby~~"/>
        <vers num="0.2.2" edition=":~~~ruby~~"/>
        <vers num="0.2.3" edition=":~~~ruby~~"/>
        <vers num="0.2.4" edition=":~~~ruby~~"/>
        <vers num="0.2.5" edition=":~~~ruby~~"/>
        <vers num="0.2.6" edition=":~~~ruby~~"/>
        <vers num="0.2.7" edition=":~~~ruby~~"/>
        <vers num="0.2.8" edition=":~~~ruby~~"/>
        <vers num="0.2.9" edition=":~~~ruby~~"/>
        <vers num="0.3.0" edition=":~~~ruby~~"/>
        <vers num="0.3.1" edition=":~~~ruby~~"/>
        <vers num="0.3.10" edition=":~~~ruby~~"/>
        <vers num="0.3.2" edition=":~~~ruby~~"/>
        <vers num="0.3.3" edition=":~~~ruby~~"/>
        <vers num="0.3.4" edition=":~~~ruby~~"/>
        <vers num="0.3.5" edition=":~~~ruby~~"/>
        <vers num="0.3.6" edition=":~~~ruby~~"/>
        <vers num="0.3.7" edition=":~~~ruby~~"/>
        <vers num="0.3.8" edition=":~~~ruby~~"/>
        <vers num="0.3.9" edition=":~~~ruby~~"/>
        <vers num="0.4.0" edition=":~~~ruby~~"/>
        <vers num="0.4.1" edition=":~~~ruby~~"/>
        <vers num="0.4.10" edition=":~~~ruby~~"/>
        <vers num="0.4.11" edition=":~~~ruby~~"/>
        <vers num="0.4.12" edition=":~~~ruby~~"/>
        <vers num="0.4.13" edition=":~~~ruby~~"/>
        <vers prev="1" num="0.4.14" edition=":~~~ruby~~"/>
        <vers num="0.4.2" edition=":~~~ruby~~"/>
        <vers num="0.4.3" edition=":~~~ruby~~"/>
        <vers num="0.4.4" edition=":~~~ruby~~"/>
        <vers num="0.4.5" edition=":~~~ruby~~"/>
        <vers num="0.4.6" edition=":~~~ruby~~"/>
        <vers num="0.4.7" edition=":~~~ruby~~"/>
        <vers num="0.4.8" edition=":~~~ruby~~"/>
        <vers num="0.4.9" edition=":~~~ruby~~"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2889" published="2014-04-26" name="CVE-2014-2889" modified="2014-04-28" CVSS_version="2.0" CVSS_vector="(AV:L/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="4.6" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="3.9" CVSS_base_score="4.6">
    <desc>
      <descript source="cve">Off-by-one error in the bpf_jit_compile function in arch/x86/net/bpf_jit_comp.c in the Linux kernel before 3.1.8, when BPF JIT is enabled, allows local users to cause a denial of service (system crash) or possibly gain privileges via a long jump after a conditional jump.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="https://github.com/torvalds/linux/commit/a03ffcf873fe0f2565386ca8ef832144c42e67fa" source="CONFIRM">https://github.com/torvalds/linux/commit/a03ffcf873fe0f2565386ca8ef832144c42e67fa</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/04/18/6" source="MLIST">[oss-security] 20140418 Re: CVE request Linux kernel: arch: x86: net: bpf_jit: an off-by-one bug in x86_64 cond jump target</ref>
      <ref url="http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.1.8" source="CONFIRM">http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.1.8</ref>
      <ref url="http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=a03ffcf873fe0f2565386ca8ef832144c42e67fa" source="CONFIRM">http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=a03ffcf873fe0f2565386ca8ef832144c42e67fa</ref>
    </refs>
    <vuln_soft>
      <prod vendor="linux" name="linux_kernel">
        <vers num="3.0" edition="rc1"/>
        <vers num="3.0" edition="rc2"/>
        <vers num="3.0" edition="rc3"/>
        <vers num="3.0" edition="rc4"/>
        <vers num="3.0" edition="rc5"/>
        <vers num="3.0" edition="rc6"/>
        <vers num="3.0" edition="rc7"/>
        <vers num="3.0.1"/>
        <vers num="3.0.10"/>
        <vers num="3.0.11"/>
        <vers num="3.0.12"/>
        <vers num="3.0.13"/>
        <vers num="3.0.14"/>
        <vers num="3.0.15"/>
        <vers num="3.0.16"/>
        <vers num="3.0.17"/>
        <vers num="3.0.18"/>
        <vers num="3.0.19"/>
        <vers num="3.0.2"/>
        <vers num="3.0.20"/>
        <vers num="3.0.21"/>
        <vers num="3.0.22"/>
        <vers num="3.0.23"/>
        <vers num="3.0.24"/>
        <vers num="3.0.25"/>
        <vers num="3.0.26"/>
        <vers num="3.0.27"/>
        <vers num="3.0.28"/>
        <vers num="3.0.29"/>
        <vers num="3.0.3"/>
        <vers num="3.0.30"/>
        <vers num="3.0.31"/>
        <vers num="3.0.32"/>
        <vers num="3.0.33"/>
        <vers num="3.0.34"/>
        <vers num="3.0.35"/>
        <vers num="3.0.36"/>
        <vers num="3.0.37"/>
        <vers num="3.0.38"/>
        <vers num="3.0.39"/>
        <vers num="3.0.4"/>
        <vers num="3.0.40"/>
        <vers num="3.0.41"/>
        <vers num="3.0.42"/>
        <vers num="3.0.43"/>
        <vers num="3.0.44"/>
        <vers num="3.0.45"/>
        <vers num="3.0.46"/>
        <vers num="3.0.47"/>
        <vers num="3.0.48"/>
        <vers num="3.0.49"/>
        <vers num="3.0.5"/>
        <vers num="3.0.50"/>
        <vers num="3.0.51"/>
        <vers num="3.0.52"/>
        <vers num="3.0.53"/>
        <vers num="3.0.54"/>
        <vers num="3.0.55"/>
        <vers num="3.0.56"/>
        <vers num="3.0.57"/>
        <vers num="3.0.58"/>
        <vers num="3.0.59"/>
        <vers num="3.0.6"/>
        <vers num="3.0.60"/>
        <vers num="3.0.61"/>
        <vers num="3.0.62"/>
        <vers num="3.0.63"/>
        <vers num="3.0.64"/>
        <vers num="3.0.65"/>
        <vers num="3.0.66"/>
        <vers num="3.0.67"/>
        <vers num="3.0.68"/>
        <vers num="3.0.7"/>
        <vers num="3.0.8"/>
        <vers num="3.0.9"/>
        <vers num="3.1" edition="rc1"/>
        <vers num="3.1" edition="rc2"/>
        <vers num="3.1" edition="rc3"/>
        <vers num="3.1" edition="rc4"/>
        <vers num="3.1.1"/>
        <vers num="3.1.2"/>
        <vers num="3.1.3"/>
        <vers num="3.1.4"/>
        <vers num="3.1.5"/>
        <vers num="3.1.6"/>
        <vers prev="1" num="3.1.7"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2890" published="2014-04-22" name="CVE-2014-2890" modified="2014-04-23" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in the wrap_html function in MyID.php in phpMyID 0.9 allows remote attackers to inject arbitrary web script or HTML via the openid_error parameter to MyID.config.php when the openid.mode parameter is set to error, which is not properly handled in an error message.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://www.securityfocus.com/bid/66665" source="BID">66665</ref>
      <ref url="http://seclists.org/oss-sec/2014/q2/141" source="MLIST">[oss-security] 20140418 Re: CVE Request - XXS in phpMyID (openid_error)</ref>
      <ref url="http://seclists.org/oss-sec/2014/q2/122" source="MLIST">[oss-security] 20140417 CVE Request - XXS in phpMyID (openid_error)</ref>
    </refs>
    <vuln_soft>
      <prod vendor="siege" name="phpmyid">
        <vers num="0.9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2892" published="2014-04-22" name="CVE-2014-2892" modified="2014-04-23" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">Heap-based buffer overflow in the get_answer function in mmsh.c in libmms before 0.6.4 allows remote attackers to execute arbitrary code via a long line in an MMS over HTTP (MMSH) server response.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.openwall.com/lists/oss-security/2014/04/18/14" source="MLIST" patch="1">[oss-security] 20140418 Re: libmms heap-based buffer overflow fix</ref>
      <ref url="http://sourceforge.net/p/libmms/code/ci/03bcfccc22919c72742b7338d02859962861e0e8" source="CONFIRM" patch="1">http://sourceforge.net/p/libmms/code/ci/03bcfccc22919c72742b7338d02859962861e0e8</ref>
      <ref url="http://xforce.iss.net/xforce/xfdb/92640" source="XF">libmms-getanswer-bo(92640)</ref>
      <ref url="http://www.securityfocus.com/bid/66933" source="BID">66933</ref>
      <ref url="http://sourceforge.net/p/libmms/code/ci/master/tree/ChangeLog" source="CONFIRM">http://sourceforge.net/p/libmms/code/ci/master/tree/ChangeLog</ref>
      <ref url="http://secunia.com/advisories/57875" source="SECUNIA" adv="1">57875</ref>
    </refs>
    <vuln_soft>
      <prod vendor="libmms_project" name="libmms">
        <vers num="0.6"/>
        <vers num="0.6.1"/>
        <vers num="0.6.2"/>
        <vers prev="1" num="0.6.3"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Low" seq="2014-2893" published="2014-04-23" name="CVE-2014-2893" modified="2014-04-24" CVSS_version="2.0" CVSS_vector="(AV:L/AC:M/Au:N/C:P/I:N/A:N)" CVSS_score="1.9" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="3.4" CVSS_base_score="1.9">
    <desc>
      <descript source="cve">The GetHTMLRunDir function in the scan-build utility in Clang 3.5 and earlier allows local users to obtain sensitive information or overwrite arbitrary files via a symlink attack on temporary directories with predictable names.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=744817" source="MISC">https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=744817</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/04/20/1" source="MLIST">[oss-security] 20140420 Re: Bug#744817: CVE request: insecure temporary file handling in clang's scan-build utility</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/04/16/2" source="MLIST">[oss-security] 20140416 CVE request: insecure temporary file handling in clang's scan-build utility</ref>
    </refs>
    <vuln_soft>
      <prod vendor="llvm" name="clang">
        <vers prev="1" num="3.5"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2894" published="2014-04-23" name="CVE-2014-2894" modified="2014-04-24" CVSS_version="2.0" CVSS_vector="(AV:L/AC:L/Au:N/C:C/I:C/A:C)" CVSS_score="7.2" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="3.9" CVSS_base_score="7.2">
    <desc>
      <descript source="cve">Off-by-one error in the cmd_smart function in the smart self test in hw/ide/core.c in QEMU before 2.0 allows local users to have unspecified impact via a SMART EXECUTE OFFLINE command that triggers a buffer underflow and memory corruption.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="https://lists.nongnu.org/archive/html/qemu-devel/2014-04/msg02152.html" source="MLIST">[Qemu-devel] 20140414 Re: [PATCH for 2.0] ide: Correct improper smart self test c</ref>
      <ref url="https://lists.nongnu.org/archive/html/qemu-devel/2014-04/msg02095.html" source="MLIST">[Qemu-devel] 20140414 Re: [PATCH for 2.0] ide: Correct improper smart self test c</ref>
      <ref url="https://lists.nongnu.org/archive/html/qemu-devel/2014-04/msg02016.html" source="MLIST">[Qemu-devel] 20140412 [PATCH for 2.0] ide: Correct improper smart self test c</ref>
      <ref url="http://www.securityfocus.com/bid/66932" source="BID">66932</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/04/18/5" source="MLIST">[oss-security] 20140418 Re: CVE request Qemu: out of bounds buffer access, guest triggerable via IDE SMART</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/04/15/4" source="MLIST">[oss-security] 20140415 CVE request Qemu: out of bounds buffer access, guest triggerable via IDE SMART</ref>
      <ref url="http://secunia.com/advisories/57945" source="SECUNIA" adv="1">57945</ref>
    </refs>
    <vuln_soft>
      <prod vendor="qemu" name="qemu">
        <vers num="0.1"/>
        <vers num="0.1.1"/>
        <vers num="0.1.2"/>
        <vers num="0.1.3"/>
        <vers num="0.1.4"/>
        <vers num="0.1.5"/>
        <vers num="0.1.6"/>
        <vers num="0.10.0"/>
        <vers num="0.10.1"/>
        <vers num="0.10.2"/>
        <vers num="0.10.3"/>
        <vers num="0.10.4"/>
        <vers num="0.10.5"/>
        <vers num="0.10.6"/>
        <vers num="0.11.0" edition="rc0"/>
        <vers num="0.11.0" edition="rc1"/>
        <vers num="0.11.0" edition="rc2"/>
        <vers num="0.11.0-rc0"/>
        <vers num="0.11.0-rc1"/>
        <vers num="0.11.0-rc2"/>
        <vers num="0.11.1"/>
        <vers num="0.12.0" edition="rc1"/>
        <vers num="0.12.0" edition="rc2"/>
        <vers num="0.12.1"/>
        <vers num="0.12.2"/>
        <vers num="0.12.3"/>
        <vers num="0.12.4"/>
        <vers num="0.12.5"/>
        <vers num="0.13.0" edition="rc0"/>
        <vers num="0.13.0" edition="rc1"/>
        <vers num="0.14.0" edition="rc0"/>
        <vers num="0.14.0" edition="rc1"/>
        <vers num="0.14.0" edition="rc2"/>
        <vers num="0.14.1"/>
        <vers num="0.15.0" edition="rc1"/>
        <vers num="0.15.0" edition="rc2"/>
        <vers num="0.15.1"/>
        <vers num="0.15.2"/>
        <vers num="0.2"/>
        <vers num="0.3"/>
        <vers num="0.4"/>
        <vers num="0.4.1"/>
        <vers num="0.4.2"/>
        <vers num="0.4.3"/>
        <vers num="0.5.0"/>
        <vers num="0.5.1"/>
        <vers num="0.5.2"/>
        <vers num="0.5.3"/>
        <vers num="0.5.4"/>
        <vers num="0.5.5"/>
        <vers num="0.6.0"/>
        <vers num="0.6.1"/>
        <vers num="0.7.0"/>
        <vers num="0.7.1"/>
        <vers num="0.7.2"/>
        <vers num="0.8.0"/>
        <vers num="0.8.1"/>
        <vers num="0.8.2"/>
        <vers num="0.9.0"/>
        <vers num="0.9.1"/>
        <vers num="0.9.1-5"/>
        <vers num="1.0" edition="rc1"/>
        <vers num="1.0" edition="rc2"/>
        <vers num="1.0" edition="rc3"/>
        <vers num="1.0" edition="rc4"/>
        <vers num="1.0.1"/>
        <vers num="1.1" edition="rc1"/>
        <vers num="1.1" edition="rc2"/>
        <vers num="1.1" edition="rc3"/>
        <vers num="1.1" edition="rc4"/>
        <vers num="1.1.1"/>
        <vers num="1.1.2"/>
        <vers num="1.2.0" edition="rc0"/>
        <vers num="1.2.0" edition="rc1"/>
        <vers num="1.2.0" edition="rc2"/>
        <vers num="1.2.0" edition="rc3"/>
        <vers num="1.2.1"/>
        <vers num="1.2.2"/>
        <vers num="1.3.0" edition="rc0"/>
        <vers num="1.3.0" edition="rc1"/>
        <vers num="1.3.0" edition="rc2"/>
        <vers num="1.3.1"/>
        <vers num="1.4.0" edition="rc0"/>
        <vers num="1.4.0" edition="rc1"/>
        <vers num="1.4.1"/>
        <vers num="1.4.2"/>
        <vers num="1.5.0" edition="rc1"/>
        <vers num="1.5.0" edition="rc2"/>
        <vers num="1.5.0" edition="rc3"/>
        <vers num="1.5.1"/>
        <vers num="1.5.2"/>
        <vers num="1.5.3"/>
        <vers num="1.6.0" edition="rc1"/>
        <vers num="1.6.0" edition="rc2"/>
        <vers num="1.6.0" edition="rc3"/>
        <vers num="1.6.1"/>
        <vers num="1.6.2"/>
        <vers prev="1" num="1.7.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2899" published="2014-04-22" name="CVE-2014-2899" modified="2014-04-23" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:N/A:P)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">wolfSSL CyaSSL before 2.9.4 allows remote attackers to cause a denial of service (NULL pointer dereference) via (1) a request for the peer certificate when a certificate parsing failure occurs or (2) a client_key_exchange message when the ephemeral key is not found.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.wolfssl.com/yaSSL/Docs-cyassl-changelog.html" source="CONFIRM">http://www.wolfssl.com/yaSSL/Docs-cyassl-changelog.html</ref>
      <ref url="http://www.wolfssl.com/yaSSL/Blog/Entries/2014/4/11_wolfSSL_Security_Advisory__April_9%2C_2014.html" source="CONFIRM" adv="1">http://www.wolfssl.com/yaSSL/Blog/Entries/2014/4/11_wolfSSL_Security_Advisory__April_9%2C_2014.html</ref>
      <ref url="http://secunia.com/advisories/57743" source="SECUNIA" adv="1">57743</ref>
      <ref url="http://seclists.org/oss-sec/2014/q2/130" source="MLIST">[oss-security] 20140418 Re: CVE ids for CyaSSL 2.9.4?</ref>
      <ref url="http://seclists.org/oss-sec/2014/q2/126" source="MLIST">[oss-security] 20140417 CVE ids for CyaSSL 2.9.4?</ref>
    </refs>
    <vuln_soft>
      <prod vendor="yassl" name="cyassl">
        <vers num="0.2.0"/>
        <vers num="0.3.0"/>
        <vers num="0.4.0"/>
        <vers num="0.5.0"/>
        <vers num="0.5.5"/>
        <vers num="0.6.0"/>
        <vers num="0.6.2"/>
        <vers num="0.6.3"/>
        <vers num="0.8.0"/>
        <vers num="0.9.0"/>
        <vers num="0.9.6"/>
        <vers num="0.9.8"/>
        <vers num="0.9.9"/>
        <vers num="1.0.0" edition="rc1"/>
        <vers num="1.0.0" edition="rc2"/>
        <vers num="1.0.0" edition="rc3"/>
        <vers num="1.0.2"/>
        <vers num="1.0.3"/>
        <vers num="1.0.6"/>
        <vers num="1.1.0"/>
        <vers num="1.2.0"/>
        <vers num="1.3.0"/>
        <vers num="1.4.0"/>
        <vers num="1.5.0"/>
        <vers num="1.5.4"/>
        <vers num="1.5.6"/>
        <vers num="1.6.0"/>
        <vers num="1.6.5"/>
        <vers num="1.8.0"/>
        <vers num="1.9.0"/>
        <vers num="2.0.0" edition="rc1"/>
        <vers num="2.0.0" edition="rc2"/>
        <vers num="2.0.0" edition="rc3"/>
        <vers num="2.0.2"/>
        <vers num="2.0.6"/>
        <vers num="2.0.8"/>
        <vers num="2.2.0"/>
        <vers num="2.3.0"/>
        <vers num="2.4.0"/>
        <vers num="2.4.6"/>
        <vers num="2.5.0"/>
        <vers num="2.6.0"/>
        <vers num="2.7.0"/>
        <vers num="2.8.0"/>
        <vers prev="1" num="2.9.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2900" published="2014-04-22" name="CVE-2014-2900" modified="2014-04-23" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:N)" CVSS_score="5.8" CVSS_impact_subscore="4.9" CVSS_exploit_subscore="8.6" CVSS_base_score="5.8">
    <desc>
      <descript source="cve">wolfSSL CyaSSL before 2.9.4 does not properly validate X.509 certificates with unknown critical extensions, which allows man-in-the-middle attackers to spoof servers via crafted X.509 certificate.</descript>
    </desc>
    <loss_types>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.wolfssl.com/yaSSL/Docs-cyassl-changelog.html" source="CONFIRM">http://www.wolfssl.com/yaSSL/Docs-cyassl-changelog.html</ref>
      <ref url="http://www.wolfssl.com/yaSSL/Blog/Entries/2014/4/11_wolfSSL_Security_Advisory__April_9%2C_2014.html" source="CONFIRM" adv="1">http://www.wolfssl.com/yaSSL/Blog/Entries/2014/4/11_wolfSSL_Security_Advisory__April_9%2C_2014.html</ref>
      <ref url="http://secunia.com/advisories/57743" source="SECUNIA" adv="1">57743</ref>
      <ref url="http://seclists.org/oss-sec/2014/q2/130" source="MLIST">[oss-security] 20140418 Re: CVE ids for CyaSSL 2.9.4?</ref>
      <ref url="http://seclists.org/oss-sec/2014/q2/126" source="MLIST">[oss-security] 20140417 CVE ids for CyaSSL 2.9.4?</ref>
    </refs>
    <vuln_soft>
      <prod vendor="yassl" name="cyassl">
        <vers num="0.2.0"/>
        <vers num="0.3.0"/>
        <vers num="0.4.0"/>
        <vers num="0.5.0"/>
        <vers num="0.5.5"/>
        <vers num="0.6.0"/>
        <vers num="0.6.2"/>
        <vers num="0.6.3"/>
        <vers num="0.8.0"/>
        <vers num="0.9.0"/>
        <vers num="0.9.6"/>
        <vers num="0.9.8"/>
        <vers num="0.9.9"/>
        <vers num="1.0.0" edition="rc1"/>
        <vers num="1.0.0" edition="rc2"/>
        <vers num="1.0.0" edition="rc3"/>
        <vers num="1.0.2"/>
        <vers num="1.0.3"/>
        <vers num="1.0.6"/>
        <vers num="1.1.0"/>
        <vers num="1.2.0"/>
        <vers num="1.3.0"/>
        <vers num="1.4.0"/>
        <vers num="1.5.0"/>
        <vers num="1.5.4"/>
        <vers num="1.5.6"/>
        <vers num="1.6.0"/>
        <vers num="1.6.5"/>
        <vers num="1.8.0"/>
        <vers num="1.9.0"/>
        <vers num="2.0.0" edition="rc1"/>
        <vers num="2.0.0" edition="rc2"/>
        <vers num="2.0.0" edition="rc3"/>
        <vers num="2.0.2"/>
        <vers num="2.0.6"/>
        <vers num="2.0.8"/>
        <vers num="2.2.0"/>
        <vers num="2.3.0"/>
        <vers num="2.4.0"/>
        <vers num="2.4.6"/>
        <vers num="2.5.0"/>
        <vers num="2.6.0"/>
        <vers num="2.7.0"/>
        <vers num="2.8.0"/>
        <vers prev="1" num="2.9.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" seq="2014-2905" published="2014-05-02" name="CVE-2014-2905" modified="2014-05-02">
    <desc>
      <descript source="cve">fish (aka fish-shell) 1.16.0 before 2.1.1 does not properly check the credentials, which allows local users to gain privileges via the universal variable socket, related to /tmp/fishd.socket.user permissions.</descript>
    </desc>
    <refs>
      <ref url="https://github.com/fish-shell/fish-shell/issues/1436" source="CONFIRM">https://github.com/fish-shell/fish-shell/issues/1436</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/04/28/4" source="MLIST">[oss-security] 20140428 Upcoming security release of fish 2.1.1</ref>
    </refs>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2907" published="2014-04-24" name="CVE-2014-2907" modified="2014-04-24" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:N/A:P)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">The srtp_add_address function in epan/dissectors/packet-rtp.c in the RTP dissector in Wireshark 1.10.x before 1.10.7 does not properly update SRTP conversation data, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=30ba425e7e95f7b61b3a3e5ff0c46e4be9d3d8d7" source="CONFIRM" patch="1">https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=30ba425e7e95f7b61b3a3e5ff0c46e4be9d3d8d7</ref>
      <ref url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9885" source="CONFIRM">https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9885</ref>
      <ref url="http://www.wireshark.org/security/wnpa-sec-2014-06.html" source="CONFIRM" adv="1">http://www.wireshark.org/security/wnpa-sec-2014-06.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="wireshark" name="wireshark">
        <vers num="1.10.0"/>
        <vers num="1.10.1"/>
        <vers num="1.10.2"/>
        <vers num="1.10.3"/>
        <vers num="1.10.4"/>
        <vers num="1.10.5"/>
        <vers num="1.10.6"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2908" published="2014-04-25" name="CVE-2014-2908" modified="2014-04-25" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in the integrated web server on Siemens SIMATIC S7-1200 CPU devices 2.x and 3.x allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://ics-cert.us-cert.gov/advisories/ICSA-14-114-02" source="MISC">http://ics-cert.us-cert.gov/advisories/ICSA-14-114-02</ref>
      <ref url="http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-892012.pdf" source="CONFIRM" adv="1">http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-892012.pdf</ref>
    </refs>
    <vuln_soft>
      <prod vendor="siemens" name="simatic_s7_cpu-1211c">
        <vers num="-"/>
      </prod>
      <prod vendor="siemens" name="simatic_s7_cpu_1212c">
        <vers num="-"/>
      </prod>
      <prod vendor="siemens" name="simatic_s7_cpu_1214c">
        <vers num="-"/>
      </prod>
      <prod vendor="siemens" name="simatic_s7_cpu_1215c">
        <vers num="-"/>
      </prod>
      <prod vendor="siemens" name="simatic_s7_cpu_1217c">
        <vers num="-"/>
      </prod>
      <prod vendor="siemens" name="simatic_s7_cpu_1200_firmware">
        <vers num="2.0"/>
        <vers num="3.0"/>
        <vers num="3.0.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2909" published="2014-04-25" name="CVE-2014-2909" modified="2014-04-25" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:P)" CVSS_score="5.8" CVSS_impact_subscore="4.9" CVSS_exploit_subscore="8.6" CVSS_base_score="5.8">
    <desc>
      <descript source="cve">CRLF injection vulnerability in the integrated web server on Siemens SIMATIC S7-1200 CPU devices 2.x and 3.x allows remote attackers to inject arbitrary HTTP headers via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <avail/>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://ics-cert.us-cert.gov/advisories/ICSA-14-114-02" source="MISC">http://ics-cert.us-cert.gov/advisories/ICSA-14-114-02</ref>
      <ref url="http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-892012.pdf" source="CONFIRM" adv="1">http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-892012.pdf</ref>
    </refs>
    <vuln_soft>
      <prod vendor="siemens" name="simatic_s7_cpu-1211c">
        <vers num="-"/>
      </prod>
      <prod vendor="siemens" name="simatic_s7_cpu_1212c">
        <vers num="-"/>
      </prod>
      <prod vendor="siemens" name="simatic_s7_cpu_1214c">
        <vers num="-"/>
      </prod>
      <prod vendor="siemens" name="simatic_s7_cpu_1215c">
        <vers num="-"/>
      </prod>
      <prod vendor="siemens" name="simatic_s7_cpu_1217c">
        <vers num="-"/>
      </prod>
      <prod vendor="siemens" name="simatic_s7_cpu_1200_firmware">
        <vers num="2.0"/>
        <vers num="3.0"/>
        <vers num="3.0.2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2915" published="2014-04-24" name="CVE-2014-2915" modified="2014-04-24" CVSS_version="2.0" CVSS_vector="(AV:A/AC:L/Au:S/C:N/I:N/A:C)" CVSS_score="5.5" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="5.1" CVSS_base_score="5.5">
    <desc>
      <descript source="cve">Xen 4.4.x, when running on ARM systems, does not properly restrict access to hardware features, which allows local guest users to cause a denial of service (host or guest crash) via unspecified vectors, related to (1) cache control, (2) coprocessors, (3) debug registers, and (4) other unspecified registers.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <local_network/>
    </range>
    <refs>
      <ref url="http://xenbits.xen.org/xsa/advisory-93.html" source="CONFIRM" adv="1">http://xenbits.xen.org/xsa/advisory-93.html</ref>
      <ref url="http://www.securitytracker.com/id/1030135" source="SECTRACK">1030135</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/04/23/2" source="MLIST">[oss-security] 20140423 Xen Security Advisory 93 (CVE-2014-2915) - Hardware features  unintentionally exposed to guests on ARM</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/04/22/10" source="MLIST">[oss-security] 20140422 Re: Xen Security Advisory 93 - Hardware features unintentionally exposed to guests on ARM</ref>
    </refs>
    <vuln_soft>
      <prod vendor="xen" name="xen">
        <vers num="4.4.0" edition="-"/>
        <vers num="4.4.0" edition="rc1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2921" published="2014-04-21" name="CVE-2014-2921" modified="2014-04-22" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">The getObjectByToken function in Newsletter.php in the Pimcore_Tool_Newsletter module in pimcore 1.4.9 through 2.0.0 does not properly handle an object obtained by unserializing Lucene search data, which allows remote attackers to conduct PHP object injection attacks and execute arbitrary code via vectors involving a Zend_Pdf_ElementFactory_Proxy object and a pathname with a trailing \0 character.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.pimcore.org/en/resources/blog/pimcore+2.2+released_b442" source="CONFIRM" patch="1" adv="1">http://www.pimcore.org/en/resources/blog/pimcore+2.2+released_b442</ref>
      <ref url="https://github.com/pedrib/PoC/blob/master/pimcore-2.1.0.txt" source="MISC">https://github.com/pedrib/PoC/blob/master/pimcore-2.1.0.txt</ref>
      <ref url="http://openwall.com/lists/oss-security/2014/04/21/1" source="MLIST">[oss-security] 20140421 Re: Remote code execution in Pimcore CMS</ref>
    </refs>
    <vuln_soft>
      <prod vendor="pimcore" name="pimcore">
        <vers num="1.4.9"/>
        <vers num="1.5.0"/>
        <vers num="2.1.0"/>
        <vers num="2.2.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2922" published="2014-04-21" name="CVE-2014-2922" modified="2014-04-22" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:N/I:P/A:P)" CVSS_score="6.4" CVSS_impact_subscore="4.9" CVSS_exploit_subscore="10.0" CVSS_base_score="6.4">
    <desc>
      <descript source="cve">The getObjectByToken function in Newsletter.php in the Pimcore_Tool_Newsletter module in pimcore 1.4.9 through 2.1.0 does not properly handle an object obtained by unserializing a pathname, which allows remote attackers to conduct PHP object injection attacks and delete arbitrary files via vectors involving a Zend_Http_Response_Stream object.</descript>
    </desc>
    <loss_types>
      <avail/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://github.com/pedrib/PoC/blob/master/pimcore-2.1.0.txt" source="MISC">https://github.com/pedrib/PoC/blob/master/pimcore-2.1.0.txt</ref>
      <ref url="http://www.pimcore.org/en/resources/blog/pimcore+2.2+released_b442" source="CONFIRM" adv="1">http://www.pimcore.org/en/resources/blog/pimcore+2.2+released_b442</ref>
      <ref url="http://openwall.com/lists/oss-security/2014/04/21/1" source="MLIST">[oss-security] 20140421 Re: Remote code execution in Pimcore CMS</ref>
    </refs>
    <vuln_soft>
      <prod vendor="pimcore" name="pimcore">
        <vers num="1.4.9"/>
        <vers num="1.5.0"/>
        <vers num="2.1.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2925" published="2014-04-22" name="CVE-2014-2925" modified="2014-04-22" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in Advanced_Wireless_Content.asp in ASUS RT-AC68U and other RT series routers with firmware before 3.0.0.4.374.5047 allows remote attackers to inject arbitrary web script or HTML via the current_page parameter to apply.cgi.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://www.asus.com/Networking/RTAC68U/HelpDesk_Download/" source="CONFIRM">http://www.asus.com/Networking/RTAC68U/HelpDesk_Download/</ref>
      <ref url="http://support.asus.com/download.aspx?m=RT-N66U+%28VER.B1%29" source="CONFIRM">http://support.asus.com/download.aspx?m=RT-N66U+%28VER.B1%29</ref>
      <ref url="http://seclists.org/fulldisclosure/2014/Apr/59" source="FULLDISC">20140404 Reflected Cross-Site Scripting within the ASUS RT-AC68U Managing Web Interface</ref>
    </refs>
    <vuln_soft>
      <prod vendor="asus" name="rt-ac68u">
        <vers num="-"/>
      </prod>
      <prod vendor="asus" name="rt-ac68u_firmware">
        <vers num="3.0.0.4.374.4755"/>
        <vers num="3.0.0.4.374_4887"/>
        <vers prev="1" num="3.0.0.4.374_4983"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2976" published="2014-04-23" name="CVE-2014-2976" modified="2014-04-24" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:N/A:N)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">Directory traversal vulnerability in Sixnet SixView Manager 2.4.1 allows remote attackers to read arbitrary files via a .. (dot dot) in an HTTP GET request to TCP port 18081.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://www.exploit-db.com/exploits/32973" source="EXPLOIT-DB">32973</ref>
    </refs>
    <vuln_soft>
      <prod vendor="sixnet" name="sixview_manager">
        <vers num="2.4.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2980" published="2014-04-28" name="CVE-2014-2980" modified="2014-04-29" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:N/A:P)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Tools/gdomap.c in gdomap in GNUstep Base 1.24.6 and earlier, when run in daemon mode, does not properly handle the file descriptor for the logger, which allows remote attackers to cause a denial of service (abort) via an invalid request.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://svn.gna.org/viewcvs/gnustep/libs/base/trunk/Tools/gdomap.c?r1=37756&amp;r2=37755&amp;pathrev=37756" source="CONFIRM" patch="1">http://svn.gna.org/viewcvs/gnustep/libs/base/trunk/Tools/gdomap.c?r1=37756&amp;r2=37755&amp;pathrev=37756</ref>
      <ref url="https://savannah.gnu.org/bugs/?41751" source="CONFIRM">https://savannah.gnu.org/bugs/?41751</ref>
      <ref url="http://xforce.iss.net/xforce/xfdb/92688" source="XF">gnustep-cve20142980-dos(92688)</ref>
      <ref url="http://www.securityfocus.com/bid/66992" source="BID">66992</ref>
      <ref url="http://svn.gna.org/viewcvs/gnustep/libs/base/trunk/ChangeLog?r1=37756&amp;r2=37755&amp;pathrev=37756" source="CONFIRM">http://svn.gna.org/viewcvs/gnustep/libs/base/trunk/ChangeLog?r1=37756&amp;r2=37755&amp;pathrev=37756</ref>
      <ref url="http://secunia.com/advisories/58104" source="SECUNIA" adv="1">58104</ref>
      <ref url="http://seclists.org/oss-sec/2014/q2/152" source="MLIST">[oss-security] 20140421 Re: CVE request / advisory: gdomap (GNUstep core package &lt;= 1.24.6)</ref>
      <ref url="http://seclists.org/oss-sec/2014/q2/143" source="MLIST">[oss-security] 20140419 CVE request / advisory: gdomap (GNUstep core package &lt;= 1.24.6)</ref>
    </refs>
    <vuln_soft>
      <prod vendor="gnustep" name="base">
        <vers prev="1" num="1.24.6"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2983" published="2014-04-23" name="CVE-2014-2983" modified="2014-04-24" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:N/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Drupal 6.x before 6.31 and 7.x before 7.27 does not properly isolate the cached data of different anonymous users, which allows remote anonymous users to obtain sensitive interim form input information in opportunistic situations via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://drupal.org/SA-CORE-2014-002" source="CONFIRM" patch="1" adv="1">https://drupal.org/SA-CORE-2014-002</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/04/22/2" source="MLIST">[oss-security] 20140421 Re: CVE Request for Drupal Core</ref>
    </refs>
    <vuln_soft>
      <prod vendor="drupal" name="drupal">
        <vers num="6.0" edition="beta1"/>
        <vers num="6.0" edition="beta2"/>
        <vers num="6.0" edition="beta3"/>
        <vers num="6.0" edition="beta4"/>
        <vers num="6.0" edition="dev"/>
        <vers num="6.0" edition="rc1"/>
        <vers num="6.0" edition="rc2"/>
        <vers num="6.0" edition="rc3"/>
        <vers num="6.0" edition="rc4"/>
        <vers num="6.1"/>
        <vers num="6.10"/>
        <vers num="6.11"/>
        <vers num="6.12"/>
        <vers num="6.13"/>
        <vers num="6.14"/>
        <vers num="6.15"/>
        <vers num="6.16"/>
        <vers num="6.17"/>
        <vers num="6.18"/>
        <vers num="6.19"/>
        <vers num="6.2"/>
        <vers num="6.20"/>
        <vers num="6.21"/>
        <vers num="6.22"/>
        <vers num="6.23"/>
        <vers num="6.24"/>
        <vers num="6.25"/>
        <vers num="6.26"/>
        <vers num="6.27"/>
        <vers num="6.28"/>
        <vers num="6.29"/>
        <vers num="6.3"/>
        <vers prev="1" num="6.30"/>
        <vers num="7.0" edition="alpha1"/>
        <vers num="7.0" edition="alpha2"/>
        <vers num="7.0" edition="alpha3"/>
        <vers num="7.0" edition="alpha4"/>
        <vers num="7.0" edition="alpha5"/>
        <vers num="7.0" edition="alpha6"/>
        <vers num="7.0" edition="alpha7"/>
        <vers num="7.0" edition="beta1"/>
        <vers num="7.0" edition="beta2"/>
        <vers num="7.0" edition="beta3"/>
        <vers num="7.0" edition="dev"/>
        <vers num="7.0" edition="rc1"/>
        <vers num="7.0" edition="rc2"/>
        <vers num="7.0" edition="rc3"/>
        <vers num="7.0" edition="rc4"/>
        <vers num="7.1"/>
        <vers num="7.10"/>
        <vers num="7.11"/>
        <vers num="7.12"/>
        <vers num="7.13"/>
        <vers num="7.14"/>
        <vers num="7.15"/>
        <vers num="7.16"/>
        <vers num="7.17"/>
        <vers num="7.18"/>
        <vers num="7.19"/>
        <vers num="7.2"/>
        <vers num="7.20"/>
        <vers num="7.21"/>
        <vers num="7.22"/>
        <vers num="7.23"/>
        <vers num="7.24"/>
        <vers num="7.25"/>
        <vers prev="1" num="7.26"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" seq="2014-2984" reject="1" published="2014-04-25" name="CVE-2014-2984" modified="2014-04-25">
    <desc>
      <descript source="cve">** REJECT **  DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2014-2650.  Reason: This candidate is a reservation duplicate of CVE-2014-2650.  Notes: All CVE users should reference CVE-2014-2650 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage.</descript>
    </desc>
    <refs/>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2986" published="2014-04-28" name="CVE-2014-2986" modified="2014-04-29" CVSS_version="2.0" CVSS_vector="(AV:A/AC:L/Au:S/C:N/I:N/A:C)" CVSS_score="5.5" CVSS_impact_subscore="6.9" CVSS_exploit_subscore="5.1" CVSS_base_score="5.5">
    <desc>
      <descript source="cve">The vgic_distr_mmio_write function in the virtual guest interrupt controller (GIC) distributor (arch/arm/vgic.c) in Xen 4.4.x, when running on an ARM system, allows local guest users to cause a denial of service (NULL pointer dereference and host crash) via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <avail/>
    </loss_types>
    <range>
      <local_network/>
    </range>
    <refs>
      <ref url="http://xenbits.xen.org/xsa/advisory-94.html" source="CONFIRM" patch="1" adv="1">http://xenbits.xen.org/xsa/advisory-94.html</ref>
      <ref url="http://www.securitytracker.com/id/1030146" source="SECTRACK">1030146</ref>
      <ref url="http://www.securityfocus.com/bid/67047" source="BID">67047</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/04/23/5" source="MLIST">[oss-security] 20140423 Xen Security Advisory 94 (CVE-2014-2986) - ARM hypervisor crash on guest interrupt controller access</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/04/23/4" source="MLIST">[oss-security] 20140423 Re: Xen Security Advisory 94 - ARM hypervisor crash on guest interrupt controller access</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/04/23/3" source="MLIST">[oss-security] 20140423 Xen Security Advisory 94 - ARM hypervisor crash on guest interrupt controller access</ref>
    </refs>
    <vuln_soft>
      <prod vendor="xen" name="xen">
        <vers num="4.4.0" edition="-"/>
        <vers num="4.4.0" edition="rc1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2992" published="2014-04-25" name="CVE-2014-2992" modified="2014-04-28" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:N)" CVSS_score="6.4" CVSS_impact_subscore="4.9" CVSS_exploit_subscore="10.0" CVSS_base_score="6.4">
    <desc>
      <descript source="cve">The Misli.com application for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.</descript>
    </desc>
    <loss_types>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://sceptive.com/p/mislicom-android-app-ssl-certificate-validation-weakness-" source="MISC">http://sceptive.com/p/mislicom-android-app-ssl-certificate-validation-weakness-</ref>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/current/0152.html" source="BUGTRAQ">20140424 Misli.com Android App SSL certificate validation weakness</ref>
    </refs>
    <vuln_soft>
      <prod vendor="misli" name="misli.com_app">
        <vers num="-" edition=":~~~~android~"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-2993" published="2014-04-25" name="CVE-2014-2993" modified="2014-04-28" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:N)" CVSS_score="6.4" CVSS_impact_subscore="4.9" CVSS_exploit_subscore="10.0" CVSS_base_score="6.4">
    <desc>
      <descript source="cve">The Birebin.com application for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.</descript>
    </desc>
    <loss_types>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://sceptive.com/p/birebincom-android-app-ssl-certificate-validation-weakness-" source="MISC">http://sceptive.com/p/birebincom-android-app-ssl-certificate-validation-weakness-</ref>
      <ref url="http://archives.neohapsis.com/archives/bugtraq/current/0153.html" source="BUGTRAQ">20140424 Birebin.com Android App SSL certificate validation weakness</ref>
    </refs>
    <vuln_soft>
      <prod vendor="birebin" name="birebin.com_app">
        <vers num="-" edition=":~~~~android~"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2994" published="2014-04-27" name="CVE-2014-2994" modified="2014-04-28" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:C/I:C/A:C)" CVSS_score="10.0" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="10.0" CVSS_base_score="10.0">
    <desc>
      <descript source="cve">Stack-based buffer overflow in Acunetix Web Vulnerability Scanner (WVS) 8 build 20120704 allows remote attackers to execute arbitrary code via an HTML file containing an IMG element with a long URL (src attribute).</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://www.youtube.com/watch?v=RHaMx8K1GeM" source="MISC">https://www.youtube.com/watch?v=RHaMx8K1GeM</ref>
      <ref url="http://www.exploit-db.com/exploits/32997" source="EXPLOIT-DB">32997</ref>
      <ref url="http://www.acunetix.com/blog/news/misleading-reports-0-day-acunetix-wvs/" source="CONFIRM" adv="1">http://www.acunetix.com/blog/news/misleading-reports-0-day-acunetix-wvs/</ref>
      <ref url="http://packetstormsecurity.com/files/126307/Acunetix-8-Scanner-Buffer-Overflow.html" source="MISC">http://packetstormsecurity.com/files/126307/Acunetix-8-Scanner-Buffer-Overflow.html</ref>
      <ref url="http://packetstormsecurity.com/files/126306/Acunetix-8-Stack-Buffer-Overflow.html" source="MISC">http://packetstormsecurity.com/files/126306/Acunetix-8-Stack-Buffer-Overflow.html</ref>
      <ref url="http://osandamalith.wordpress.com/2014/04/24/pwning-script-kiddies-acunetix-buffer-overflow/" source="MISC">http://osandamalith.wordpress.com/2014/04/24/pwning-script-kiddies-acunetix-buffer-overflow/</ref>
      <ref url="http://an7isec.blogspot.co.il/2014/04/pown-noobs-acunetix-0day.html" source="MISC">http://an7isec.blogspot.co.il/2014/04/pown-noobs-acunetix-0day.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="acunetix" name="web_vulnerability_scanner">
        <vers num="8" edition="build_20120704"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-2996" published="2014-04-25" name="CVE-2014-2996" modified="2014-04-28" CVSS_version="2.0" CVSS_vector="(AV:N/AC:H/Au:S/C:C/I:C/A:C)" CVSS_score="7.1" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="3.9" CVSS_base_score="7.1">
    <desc>
      <descript source="cve">XCloner Standalone 3.5 and earlier, when enable_db_backup and sql_mem are enabled, allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in the dbbackup_comp parameter in a generate action to index2.php.  NOTE: it is not clear whether this issue crosses privilege boundaries, since administrators might already have the privileges to execute code.  NOTE: this can be leveraged by remote attackers using CVE-2014-2579.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://www.htbridge.com/advisory/HTB23207" source="MISC">https://www.htbridge.com/advisory/HTB23207</ref>
      <ref url="http://www.securityfocus.com/archive/1/archive/1/531780/100/0/threaded" source="BUGTRAQ">20140409 &amp;ETH;&amp;iexcl;ross-Site Request Forgery (CSRF) in XCloner Standalone</ref>
      <ref url="http://www.exploit-db.com/exploits/32790" source="EXPLOIT-DB">32790</ref>
    </refs>
    <vuln_soft>
      <prod vendor="xcloner" name="xcloner">
        <vers prev="1" num="3.5" edition=":standalone"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" seq="2014-3000" published="2014-05-02" name="CVE-2014-3000" modified="2014-05-02">
    <desc>
      <descript source="cve">The TCP reassembly function in the inet module in FreeBSD 8.3 before p16, 8.4 before p9, 9.1 before p12, 9.2 before p5, and 10.0 before p2 allows remote attackers to cause a denial of service (undefined memory access and system crash) or possibly read system memory via multiple crafted packets, related to moving a reassemble queue entry to the segment list when the queue is full.</descript>
    </desc>
    <refs>
      <ref url="http://www.securitytracker.com/id/1030172" source="SECTRACK">1030172</ref>
      <ref url="http://www.securityfocus.com/bid/67153" source="BID">67153</ref>
      <ref url="http://www.freebsd.org/security/advisories/FreeBSD-SA-14:08.tcp.asc" source="FREEBSD">FreeBSD-SA-14:08</ref>
      <ref url="http://secunia.com/advisories/58293" source="SECUNIA">58293</ref>
    </refs>
  </entry>
  <entry type="CVE" seq="2014-3001" published="2014-05-02" name="CVE-2014-3001" modified="2014-05-02">
    <desc>
      <descript source="cve">The device file system (aka devfs) in FreeBSD 10.0 before p2 does not load default rulesets when booting, which allows context-dependent attackers to bypass intended restrictions by leveraging a jailed device node process.</descript>
    </desc>
    <refs>
      <ref url="http://www.securitytracker.com/id/1030171" source="SECTRACK">1030171</ref>
      <ref url="http://www.securityfocus.com/bid/67158" source="BID">67158</ref>
      <ref url="http://www.freebsd.org/security/advisories/FreeBSD-SA-14:07.devfs.asc" source="FREEBSD">FreeBSD-SA-14:07</ref>
    </refs>
  </entry>
  <entry type="CVE" seq="2014-3006" published="2014-05-02" name="CVE-2014-3006" modified="2014-05-02">
    <desc>
      <descript source="cve">Sitepark Information Enterprise Server (IES) 2.9 before 2.9.6, when upgraded from an earlier version, does not properly restrict access, which allows remote attackers to change the manager account password and obtain sensitive information via a request to install/.</descript>
    </desc>
    <refs>
      <ref url="https://www.lsexperts.de/advisories/lse-2014-04-10.txt" source="MISC">https://www.lsexperts.de/advisories/lse-2014-04-10.txt</ref>
      <ref url="http://www.securityfocus.com/bid/67165" source="BID">67165</ref>
      <ref url="http://www.securityfocus.com/archive/1/archive/1/531986/100/0/threaded" source="BUGTRAQ">20140430 LSE Leading Security Experts GmbH - LSE-2014-04-10 - Sitepark IES - Unauthenticated Access</ref>
      <ref url="http://seclists.org/fulldisclosure/2014/Apr/317" source="FULLDISC">20140430 LSE Leading Security Experts GmbH - LSE-2014-04-10 - Sitepark IES - Unauthenticated Access</ref>
    </refs>
  </entry>
  <entry type="CVE" severity="High" seq="2014-3007" published="2014-04-27" name="CVE-2014-3007" modified="2014-04-28" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:C/I:C/A:C)" CVSS_score="10.0" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="10.0" CVSS_base_score="10.0">
    <desc>
      <descript source="cve">Python Image Library (PIL) 1.1.7 and earlier and Pillow 2.3 might allow remote attackers to execute arbitrary commands via shell metacharacters in unspecified vectors related to CVE-2014-1932, possibly JpegImagePlugin.py.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737059" source="MISC">https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737059</ref>
      <ref url="http://people.canonical.com/~ubuntu-security/cve/2014/CVE-2014-1932.html" source="MISC">http://people.canonical.com/~ubuntu-security/cve/2014/CVE-2014-1932.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="python" name="pillow">
        <vers num="2.3.0"/>
      </prod>
      <prod vendor="pythonware" name="python_imaging_library">
        <vers prev="1" num="1.1.7"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-3008" published="2014-04-28" name="CVE-2014-3008" modified="2014-04-29" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:C/I:C/A:C)" CVSS_score="10.0" CVSS_impact_subscore="10.0" CVSS_exploit_subscore="10.0" CVSS_base_score="10.0">
    <desc>
      <descript source="cve">Unitrends Enterprise Backup 7.3.0 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the comm parameter to recoveryconsole/bpl/snmpd.php.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://gist.github.com/brandonprry/10745756" source="MISC">https://gist.github.com/brandonprry/10745756</ref>
      <ref url="http://xforce.iss.net/xforce/xfdb/92642" source="XF">unitrends-snmpod-command-exec(92642)</ref>
      <ref url="http://www.securityfocus.com/bid/66928" source="BID">66928</ref>
      <ref url="http://www.exploit-db.com/exploits/32885" source="EXPLOIT-DB">32885</ref>
      <ref url="http://secunia.com/advisories/58001" source="SECUNIA" adv="1">58001</ref>
      <ref url="http://seclists.org/fulldisclosure/2014/Apr/204" source="FULLDISC">20140415 Unitrends enterprise backup remote unauthenticated root</ref>
    </refs>
    <vuln_soft>
      <prod vendor="unitrends" name="enterprise_backup">
        <vers num="7.3.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" seq="2014-3125" published="2014-05-02" name="CVE-2014-3125" modified="2014-05-02">
    <desc>
      <descript source="cve">Xen 4.4.x, when running on an ARM system, does not properly context switch the CNTKCTL_EL1 register, which allows local guest users to modify the hardware timers and cause a denial of service (crash) via unspecified vectors.</descript>
    </desc>
    <refs>
      <ref url="http://xenbits.xen.org/xsa/advisory-91.html" source="CONFIRM">http://xenbits.xen.org/xsa/advisory-91.html</ref>
      <ref url="http://www.securitytracker.com/id/1030184" source="SECTRACK">1030184</ref>
      <ref url="http://www.securityfocus.com/bid/67157" source="BID">67157</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/04/30/5" source="MLIST">[oss-security] 20140430 Xen Security Advisory 91 - Hardware timer context is not properly context switched on ARM</ref>
      <ref url="http://www.openwall.com/lists/oss-security/2014/04/30/11" source="MLIST">[oss-security] 20140430 Re: Xen Security Advisory 91 - Hardware timer context is not properly context switched on ARM</ref>
      <ref url="http://secunia.com/advisories/58347" source="SECUNIA">58347</ref>
    </refs>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-3129" published="2014-04-30" name="CVE-2014-3129" modified="2014-05-01" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:N/A:N)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">The Java Server Pages in the Software Lifecycle Manager (SLM) in SAP NetWeaver allows remote attackers to obtain sensitive information via a crafted request, related to SAP Solution Manager 7.1.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://service.sap.com/sap/support/notes/1894049" source="CONFIRM">https://service.sap.com/sap/support/notes/1894049</ref>
      <ref url="http://www.securitytracker.com/id/1030157" source="SECTRACK">1030157</ref>
      <ref url="http://www.onapsis.com/resources/get.php?resid=adv_onapsis-2014-005" source="MISC">http://www.onapsis.com/resources/get.php?resid=adv_onapsis-2014-005</ref>
      <ref url="http://seclists.org/fulldisclosure/2014/Apr/294" source="FULLDISC">20140428 [Onapsis Security Advisory 2014-005] Information disclosure in SAP Software Lifeclycle Manager</ref>
      <ref url="http://scn.sap.com/docs/DOC-8218" source="CONFIRM">http://scn.sap.com/docs/DOC-8218</ref>
    </refs>
    <vuln_soft>
      <prod vendor="sap" name="netweaver_software_lifecycle_manager">
        <vers num="7.1"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-3130" published="2014-04-30" name="CVE-2014-3130" modified="2014-05-01" CVSS_version="2.0" CVSS_vector="(AV:L/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="4.6" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="3.9" CVSS_base_score="4.6">
    <desc>
      <descript source="cve">The ABAP Help documentation and translation tools (BC-DOC-HLP) in Basis in SAP Netweaver ABAP Application Server does not properly restrict access, which allows local users to gain privileges and execute ABAP instructions via crafted help messages.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
      <sec_prot other="1"/>
    </loss_types>
    <range>
      <local/>
    </range>
    <refs>
      <ref url="https://service.sap.com/sap/support/notes/1910914" source="CONFIRM">https://service.sap.com/sap/support/notes/1910914</ref>
      <ref url="http://www.onapsis.com/resources/get.php?resid=adv_onapsis-2014-009" source="MISC">http://www.onapsis.com/resources/get.php?resid=adv_onapsis-2014-009</ref>
      <ref url="http://seclists.org/fulldisclosure/2014/Apr/302" source="FULLDISC">20140428 [Onapsis Security Advisory 2014-009] SAP BASIS Missing Authorization Check</ref>
      <ref url="http://scn.sap.com/docs/DOC-8218" source="CONFIRM">http://scn.sap.com/docs/DOC-8218</ref>
    </refs>
    <vuln_soft>
      <prod vendor="sap" name="netweaver_abap_application_server">
        <vers num="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-3131" published="2014-04-30" name="CVE-2014-3131" modified="2014-05-01" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:P/I:N/A:N)" CVSS_score="4.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.0" CVSS_base_score="4.0">
    <desc>
      <descript source="cve">SAP Profile Maintenance does not properly restrict access, which allows remote authenticated users to obtain sensitive information via an unspecified RFC function, related to SAP Solution Manager 7.1.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://service.sap.com/sap/support/notes/1917381" source="CONFIRM">https://service.sap.com/sap/support/notes/1917381</ref>
      <ref url="http://www.onapsis.com/resources/get.php?resid=adv_onapsis-2014-007" source="MISC">http://www.onapsis.com/resources/get.php?resid=adv_onapsis-2014-007</ref>
      <ref url="http://seclists.org/fulldisclosure/2014/Apr/300" source="FULLDISC">20140428 [Onapsis Security Advisory 2014-007] Missing authorization check in SAP Profile Maintenance</ref>
      <ref url="http://scn.sap.com/docs/DOC-8218" source="CONFIRM">http://scn.sap.com/docs/DOC-8218</ref>
    </refs>
    <vuln_soft>
      <prod vendor="sap" name="profile_maintenance">
        <vers num="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-3132" published="2014-04-30" name="CVE-2014-3132" modified="2014-05-01" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:P/I:N/A:N)" CVSS_score="4.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.0" CVSS_base_score="4.0">
    <desc>
      <descript source="cve">SAP Background Processing does not properly restrict access, which allows remote authenticated users to obtain sensitive information via an unspecified RFC function, related to SAP Solution Manager 7.1.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://service.sap.com/sap/support/notes/1918333" source="CONFIRM">https://service.sap.com/sap/support/notes/1918333</ref>
      <ref url="http://www.onapsis.com/resources/get.php?resid=adv_onapsis-2014-006" source="MISC">http://www.onapsis.com/resources/get.php?resid=adv_onapsis-2014-006</ref>
      <ref url="http://seclists.org/fulldisclosure/2014/Apr/299" source="FULLDISC">20140428 [Onapsis Security Advisory 2014-006] Missing authorization check in SAP Background Processing RFC</ref>
      <ref url="http://scn.sap.com/docs/DOC-8218" source="CONFIRM">http://scn.sap.com/docs/DOC-8218</ref>
    </refs>
    <vuln_soft>
      <prod vendor="sap" name="background_processing">
        <vers num="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-3133" published="2014-04-30" name="CVE-2014-3133" modified="2014-05-01" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:N/A:N)" CVSS_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0" CVSS_base_score="5.0">
    <desc>
      <descript source="cve">SAP Netweaver Java Application Server does not properly restrict access, which allows remote attackers to obtain the list of SAP systems registered on an SLD via an unspecified webdynpro, related to SystemSelection.</descript>
    </desc>
    <loss_types>
      <conf/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://service.sap.com/sap/support/notes/1922547" source="CONFIRM">https://service.sap.com/sap/support/notes/1922547</ref>
      <ref url="http://www.onapsis.com/resources/get.php?resid=adv_onapsis-2014-008" source="MISC">http://www.onapsis.com/resources/get.php?resid=adv_onapsis-2014-008</ref>
      <ref url="http://seclists.org/fulldisclosure/2014/Apr/301" source="FULLDISC">20140428 [Onapsis Security Advisory 2014-008] SAP NW Portal WD Information Disclosure</ref>
      <ref url="http://scn.sap.com/docs/DOC-8218" source="CONFIRM">http://scn.sap.com/docs/DOC-8218</ref>
    </refs>
    <vuln_soft>
      <prod vendor="sap" name="netweaver_java_application_server">
        <vers num="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-3134" published="2014-04-30" name="CVE-2014-3134" modified="2014-05-01" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Cross-site scripting (XSS) vulnerability in the InfoView application in SAP BusinessObjects allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="https://service.sap.com/sap/support/notes/1931399" source="CONFIRM">https://service.sap.com/sap/support/notes/1931399</ref>
      <ref url="http://www.onapsis.com/resources/get.php?resid=adv_onapsis-2014-010" source="MISC">http://www.onapsis.com/resources/get.php?resid=adv_onapsis-2014-010</ref>
      <ref url="http://seclists.org/fulldisclosure/2014/Apr/303" source="FULLDISC">20140428 [Onapsis Security Advisory 2014-010] SAP BusinessObjects InfoView Reflected Cross Site Scripting</ref>
      <ref url="http://scn.sap.com/docs/DOC-8218" source="CONFIRM">http://scn.sap.com/docs/DOC-8218</ref>
    </refs>
    <vuln_soft>
      <prod vendor="sap" name="businessobjects">
        <vers num="-"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-3135" published="2014-04-30" name="CVE-2014-3135" modified="2014-05-01" CVSS_version="2.0" CVSS_vector="(AV:N/AC:M/Au:N/C:N/I:P/A:N)" CVSS_score="4.3" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="8.6" CVSS_base_score="4.3">
    <desc>
      <descript source="cve">Multiple cross-site scripting (XSS) vulnerabilities in vBulletin 5.1.1 Alpha 9 allow remote attackers to inject arbitrary web script or HTML via (1) the PATH_INFO to privatemessage/new/, (2) the folderid parameter to a private message in privatemessage/view, (3) a fragment indicator to /help, or (4) the view parameter to a topic, as demonstrated by a request to forum/anunturi-importante/rst-power/67030-rst-admin-restore.</descript>
    </desc>
    <loss_types>
      <int/>
    </loss_types>
    <range>
      <network/>
      <user_init/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/92664" source="XF">vbulletin-multiple-scripts-xss(92664)</ref>
      <ref url="http://www.securityfocus.com/bid/66972" source="BID">66972</ref>
      <ref url="http://packetstormsecurity.com/files/126226/vBulletin-5.1-Cross-Site-Scripting.html" source="MISC">http://packetstormsecurity.com/files/126226/vBulletin-5.1-Cross-Site-Scripting.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="vbulletin" name="vbulletin">
        <vers num="5.1.1" edition="alpha9"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="Medium" seq="2014-3138" published="2014-05-01" name="CVE-2014-3138" modified="2014-05-02" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:S/C:P/I:P/A:P)" CVSS_score="6.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.0" CVSS_base_score="6.5">
    <desc>
      <descript source="cve">SQL injection vulnerability in Xerox DocuShare before 6.53 Patch 6 Hotfix 2, 6.6.1 Update 1before Hotfix 24, and 6.6.1 Update 2 before Hotfix 3 allows remote authenticated users to execute arbitrary SQL commands via the PATH_INFO to /docushare/dsweb/ResultBackgroundJobMultiple/.  NOTE: some of these details are obtained from third party information.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="http://xforce.iss.net/xforce/xfdb/92548" source="XF">xerox-docushare-sql-injection(92548)</ref>
      <ref url="http://www.xerox.com/download/security/security-bulletin/a72cd-4f7a54ce14460/cert_XRX14-003_V1.0.pdf" source="MISC" adv="1">http://www.xerox.com/download/security/security-bulletin/a72cd-4f7a54ce14460/cert_XRX14-003_V1.0.pdf</ref>
      <ref url="http://www.securityfocus.com/bid/66922" source="BID">66922</ref>
      <ref url="http://www.osvdb.org/105972" source="OSVDB">105972</ref>
      <ref url="http://www.exploit-db.com/exploits/32886" source="EXPLOIT-DB">32886</ref>
      <ref url="http://secunia.com/advisories/57996" source="SECUNIA" adv="1">57996</ref>
      <ref url="http://seclists.org/fulldisclosure/2014/Apr/205" source="FULLDISC">20140415 Xerox DocuShare authenticated SQL injection</ref>
      <ref url="http://packetstormsecurity.com/files/126171/Xerox-DocuShare-SQL-Injection.html" source="MISC">http://packetstormsecurity.com/files/126171/Xerox-DocuShare-SQL-Injection.html</ref>
    </refs>
    <vuln_soft>
      <prod vendor="xerox" name="docushare">
        <vers num="6.5.3" edition="-"/>
        <vers num="6.5.3" edition="patch6"/>
        <vers num="6.6.1" edition="-"/>
        <vers num="6.6.1" edition="update1"/>
        <vers num="6.6.1" edition="update2"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" severity="High" seq="2014-3139" published="2014-05-02" name="CVE-2014-3139" modified="2014-05-02" CVSS_version="2.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:P/A:P)" CVSS_score="7.5" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="10.0" CVSS_base_score="7.5">
    <desc>
      <descript source="cve">recoveryconsole/bpl/snmpd.php in Unitrends Enterprise Backup 7.3.0 allows remote attackers to bypass authentication by setting the auth parameter to a certain string.</descript>
    </desc>
    <loss_types>
      <avail/>
      <conf/>
      <int/>
    </loss_types>
    <range>
      <network/>
    </range>
    <refs>
      <ref url="https://gist.github.com/brandonprry/10745756" source="MISC">https://gist.github.com/brandonprry/10745756</ref>
      <ref url="http://www.exploit-db.com/exploits/32885" source="EXPLOIT-DB">32885</ref>
      <ref url="http://seclists.org/fulldisclosure/2014/Apr/204" source="FULLDISC">20140415 Unitrends enterprise backup remote unauthenticated root</ref>
    </refs>
    <vuln_soft>
      <prod vendor="unitrends" name="enterprise_backup">
        <vers num="7.3.0"/>
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" seq="2014-5795" reject="1" published="2014-03-27" name="CVE-2014-5795" modified="2014-03-27">
    <desc>
      <descript source="cve">** REJECT **  DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2013-5795.  Reason: This candidate is a duplicate of CVE-2013-5795.  A typo caused the wrong ID to be used.  Notes: All CVE users should reference CVE-2013-5795 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage.</descript>
    </desc>
    <refs/>
  </entry>
  <entry type="CVE" seq="2014-5880" reject="1" published="2014-03-27" name="CVE-2014-5880" modified="2014-03-27">
    <desc>
      <descript source="cve">** REJECT **  DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2013-5880.  Reason: This candidate is a duplicate of CVE-2013-5880.  A typo caused the wrong ID to be used.  Notes: All CVE users should reference CVE-2013-5880 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage.</descript>
    </desc>
    <refs/>
  </entry>
</nvd>