Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2014-1365
WebKit, as used in Apple iOS before 7.1.2, Apple Safari before 6.1.5 and 7.x before 7.0.5, and Apple TV before 6.1.2, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-06-30-1, APPLE-SA-2014-06-30-3, and APPLE-SA-2014-06-30-4.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.apple.com/kb/HT6537'}, {'name': 'APPLE-SA-2014-06-30-4', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-06/0175.html'}, {'name': 'APPLE-SA-2014-06-30-3', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-06/0174.html'}, {'name': '59481', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/59481'}, {'name': '1030495', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1030495'}, {'name': 'APPLE-SA-2014-06-30-1', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-06/0171.html'}]
CVE State: PUBLISHED
Explain CVE-2014-1366
WebKit, as used in Apple iOS before 7.1.2, Apple Safari before 6.1.5 and 7.x before 7.0.5, and Apple TV before 6.1.2, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-06-30-1, APPLE-SA-2014-06-30-3, and APPLE-SA-2014-06-30-4.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.apple.com/kb/HT6537'}, {'name': 'APPLE-SA-2014-06-30-4', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-06/0175.html'}, {'name': 'APPLE-SA-2014-06-30-3', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-06/0174.html'}, {'name': '59481', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/59481'}, {'name': '1030495', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1030495'}, {'name': 'APPLE-SA-2014-06-30-1', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-06/0171.html'}]
CVE State: PUBLISHED
Explain CVE-2014-1367
WebKit, as used in Apple iOS before 7.1.2, Apple Safari before 6.1.5 and 7.x before 7.0.5, and Apple TV before 6.1.2, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-06-30-1, APPLE-SA-2014-06-30-3, and APPLE-SA-2014-06-30-4.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.apple.com/kb/HT6537'}, {'name': 'APPLE-SA-2014-06-30-4', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-06/0175.html'}, {'name': 'APPLE-SA-2014-06-30-3', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-06/0174.html'}, {'name': '59481', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/59481'}, {'name': '1030495', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1030495'}, {'name': 'APPLE-SA-2014-06-30-1', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-06/0171.html'}]
CVE State: PUBLISHED
Explain CVE-2014-1368
WebKit, as used in Apple iOS before 7.1.2, Apple Safari before 6.1.5 and 7.x before 7.0.5, and Apple TV before 6.1.2, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-06-30-1, APPLE-SA-2014-06-30-3, and APPLE-SA-2014-06-30-4.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.apple.com/kb/HT6537'}, {'name': 'APPLE-SA-2014-06-30-4', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-06/0175.html'}, {'name': 'APPLE-SA-2014-06-30-3', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-06/0174.html'}, {'name': '59481', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/59481'}, {'name': '1030495', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1030495'}, {'name': 'APPLE-SA-2014-06-30-1', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-06/0171.html'}]
CVE State: PUBLISHED
Explain CVE-2014-1369
WebKit in Apple Safari before 6.1.5 and 7.x before 7.0.5 allows user-assisted remote attackers to access file: URLs by leveraging a URL drag operation that originates at a crafted web site.
Affected Products: n/a
References: [{'name': '1030495', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1030495'}, {'name': 'APPLE-SA-2014-06-30-1', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-06/0171.html'}]
CVE State: PUBLISHED
Explain CVE-2014-1370
The byte-swapping implementation in copyfile in Apple OS X before 10.9.4 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds memory access and application crash) via a crafted AppleDouble file in a ZIP archive.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6296'}, {'name': '1030505', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1030505'}, {'name': 'APPLE-SA-2014-06-30-2', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-06/0172.html'}, {'name': '20141210 Apple Mac OS X Archive Utility Heap Memory Corruption Vulnerability', 'tags': ['third-party-advisory', 'x_refsource_IDEFENSE'], 'url': 'https://www.verisign.com/en_US/security-services/security-intelligence/vulnerability-reports/articles/index.xhtml?id=1087'}, {'name': '59475', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/59475'}]
CVE State: PUBLISHED
Explain CVE-2014-1371
Array index error in Dock in Apple OS X before 10.9.4 allows attackers to execute arbitrary code or cause a denial of service (incorrect function-pointer dereference and application crash) by leveraging access to a sandboxed application for sending a message.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6296'}, {'name': '1030505', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1030505'}, {'name': 'APPLE-SA-2014-06-30-2', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-06/0172.html'}, {'name': '59475', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/59475'}]
CVE State: PUBLISHED
Explain CVE-2014-1372
Graphics Driver in Apple OS X before 10.9.4 does not properly restrict read operations during processing of an unspecified system call, which allows local users to obtain sensitive information from kernel memory and bypass the ASLR protection mechanism via a crafted call.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6296'}, {'name': '1030505', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1030505'}, {'name': 'APPLE-SA-2014-06-30-2', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-06/0172.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://code.google.com/p/google-security-research/issues/detail?id=18'}, {'name': '59475', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/59475'}]
CVE State: PUBLISHED
Explain CVE-2014-1373
Intel Graphics Driver in Apple OS X before 10.9.4 does not properly restrict an unspecified OpenGL API call, which allows attackers to execute arbitrary code via a crafted application.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6296'}, {'name': '1030505', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1030505'}, {'name': 'APPLE-SA-2014-06-30-2', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-06/0172.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://code.google.com/p/google-security-research/issues/detail?id=22'}, {'name': '59475', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/59475'}]
CVE State: PUBLISHED
Explain CVE-2014-1375
Intel Graphics Driver in Apple OS X before 10.9.4 allows local users to bypass the ASLR protection mechanism by leveraging read access to a kernel pointer in an IOKit object.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6296'}, {'name': '1030505', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1030505'}, {'name': 'APPLE-SA-2014-06-30-2', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-06/0172.html'}, {'name': '59475', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/59475'}]
CVE State: PUBLISHED
Explain CVE-2014-1376
Intel Compute in Apple OS X before 10.9.4 does not properly restrict an unspecified OpenCL API call, which allows attackers to execute arbitrary code via a crafted application.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6296'}, {'name': '1030505', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1030505'}, {'name': 'APPLE-SA-2014-06-30-2', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-06/0172.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://code.google.com/p/google-security-research/issues/detail?id=19'}, {'name': '59475', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/59475'}]
CVE State: PUBLISHED
Explain CVE-2014-1377
Array index error in IOAcceleratorFamily in Apple OS X before 10.9.4 allows attackers to execute arbitrary code via a crafted application.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6296'}, {'name': '1030505', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1030505'}, {'name': 'APPLE-SA-2014-06-30-2', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-06/0172.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://code.google.com/p/google-security-research/issues/detail?id=17'}, {'name': '59475', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/59475'}]
CVE State: PUBLISHED
Explain CVE-2014-1378
IOGraphicsFamily in Apple OS X before 10.9.4 allows local users to bypass the ASLR protection mechanism by leveraging read access to a kernel pointer in an IOKit object.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6296'}, {'name': '1030505', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1030505'}, {'name': 'APPLE-SA-2014-06-30-2', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-06/0172.html'}]
CVE State: PUBLISHED
Explain CVE-2014-1379
Graphics Drivers in Apple OS X before 10.9.4 allows attackers to gain privileges or cause a denial of service (NULL pointer dereference and system crash) via a 32-bit executable file for a crafted application.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6296'}, {'name': '1030505', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1030505'}, {'name': 'APPLE-SA-2014-06-30-2', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-06/0172.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://code.google.com/p/google-security-research/issues/detail?id=20'}, {'name': '59475', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/59475'}]
CVE State: PUBLISHED
Explain CVE-2014-1380
The Security - Keychain component in Apple OS X before 10.9.4 does not properly implement keystroke observers, which allows physically proximate attackers to bypass the screen-lock protection mechanism, and enter characters into an arbitrary window under the lock window, via keyboard input.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6296'}, {'name': '1030505', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1030505'}, {'name': 'APPLE-SA-2014-06-30-2', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-06/0172.html'}]
CVE State: PUBLISHED
Explain CVE-2014-1381
Thunderbolt in Apple OS X before 10.9.4 does not properly restrict IOThunderBoltController API calls, which allows attackers to execute arbitrary code or cause a denial of service (out-of-bounds memory access and application crash) via a crafted call.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6296'}, {'name': '1030505', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1030505'}, {'name': 'APPLE-SA-2014-06-30-2', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-06/0172.html'}, {'name': '59475', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/59475'}]
CVE State: PUBLISHED
Explain CVE-2014-1382
WebKit, as used in Apple iOS before 7.1.2, Apple Safari before 6.1.5 and 7.x before 7.0.5, and Apple TV before 6.1.2, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-06-30-1, APPLE-SA-2014-06-30-3, and APPLE-SA-2014-06-30-4.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.apple.com/kb/HT6537'}, {'name': 'APPLE-SA-2014-06-30-4', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-06/0175.html'}, {'name': 'APPLE-SA-2014-06-30-3', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-06/0174.html'}, {'name': '59481', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/59481'}, {'name': '1030495', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1030495'}, {'name': 'APPLE-SA-2014-06-30-1', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-06/0171.html'}]
CVE State: PUBLISHED
Explain CVE-2014-1383
Apple TV before 6.1.2 allows remote authenticated users to bypass an intended password requirement for iTunes Store purchase transactions via unspecified vectors.
Affected Products: n/a
References: [{'name': 'APPLE-SA-2014-06-30-4', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-06/0175.html'}, {'name': '1030503', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1030503'}]
CVE State: PUBLISHED
Explain CVE-2014-1384
WebKit, as used in Apple Safari before 6.1.6 and 7.x before 7.0.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in HT6367.
Affected Products: n/a
References: [{'name': '69223', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/69223'}, {'name': '1030731', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1030731'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6441'}, {'name': 'GLSA-201601-02', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201601-02'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.apple.com/kb/HT6537'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6367'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6442'}, {'name': '61318', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/61318'}, {'name': 'APPLE-SA-2014-09-17-2', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-09/0107.html'}, {'name': 'APPLE-SA-2014-09-17-1', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-09/0106.html'}, {'name': 'apple-safari-cve20141384-code-exec(95267)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/95267'}, {'name': '60705', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/60705'}]
CVE State: PUBLISHED
Explain CVE-2014-1385
WebKit, as used in Apple Safari before 6.1.6 and 7.x before 7.0.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in HT6367.
Affected Products: n/a
References: [{'name': '69223', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/69223'}, {'name': '1030731', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1030731'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6441'}, {'name': 'GLSA-201601-02', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201601-02'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.apple.com/kb/HT6537'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6367'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6442'}, {'name': '61318', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/61318'}, {'name': 'APPLE-SA-2014-09-17-2', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-09/0107.html'}, {'name': 'APPLE-SA-2014-09-17-1', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-09/0106.html'}, {'name': 'apple-safari-cve20141385-code-exec(95268)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/95268'}, {'name': '60705', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/60705'}]
CVE State: PUBLISHED
Explain CVE-2014-1386
WebKit, as used in Apple Safari before 6.1.6 and 7.x before 7.0.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in HT6367.
Affected Products: n/a
References: [{'name': '69223', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/69223'}, {'name': '1030731', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1030731'}, {'name': 'GLSA-201601-02', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201601-02'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.apple.com/kb/HT6537'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6367'}, {'name': 'apple-safari-cve20141386-code-exec(95269)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/95269'}, {'name': '60705', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/60705'}]
CVE State: PUBLISHED
Explain CVE-2014-1387
WebKit, as used in Apple Safari before 6.1.6 and 7.x before 7.0.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in HT6367.
Affected Products: n/a
References: [{'name': '69223', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/69223'}, {'name': '1030731', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1030731'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6441'}, {'name': 'GLSA-201601-02', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201601-02'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.apple.com/kb/HT6537'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6367'}, {'name': 'apple-safari-cve20141387-code-exec(95270)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/95270'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6442'}, {'name': '61318', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/61318'}, {'name': 'APPLE-SA-2014-09-17-2', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-09/0107.html'}, {'name': 'APPLE-SA-2014-09-17-1', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-09/0106.html'}, {'name': '60705', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/60705'}]
CVE State: PUBLISHED
Explain CVE-2014-1388
WebKit, as used in Apple Safari before 6.1.6 and 7.x before 7.0.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in HT6367.
Affected Products: n/a
References: [{'name': '69223', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/69223'}, {'name': '1030731', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1030731'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6441'}, {'name': 'GLSA-201601-02', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201601-02'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.apple.com/kb/HT6537'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6367'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6442'}, {'name': '61318', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/61318'}, {'name': 'APPLE-SA-2014-09-17-2', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-09/0107.html'}, {'name': 'apple-safari-cve20141388-code-exec(95271)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/95271'}, {'name': 'APPLE-SA-2014-09-17-1', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-09/0106.html'}, {'name': '60705', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/60705'}]
CVE State: PUBLISHED
Explain CVE-2014-1389
WebKit, as used in Apple Safari before 6.1.6 and 7.x before 7.0.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in HT6367.
Affected Products: n/a
References: [{'name': '69223', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/69223'}, {'name': '1030731', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1030731'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6441'}, {'name': 'GLSA-201601-02', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201601-02'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.apple.com/kb/HT6537'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6367'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6442'}, {'name': '61318', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/61318'}, {'name': 'APPLE-SA-2014-09-17-2', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-09/0107.html'}, {'name': 'apple-safari-cve20141389-code-exec(95272)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/95272'}, {'name': 'APPLE-SA-2014-09-17-1', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-09/0106.html'}, {'name': '60705', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/60705'}]
CVE State: PUBLISHED
Explain CVE-2014-1390
WebKit, as used in Apple Safari before 6.1.6 and 7.x before 7.0.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in HT6367.
Affected Products: n/a
References: [{'name': 'apple-safari-cve20141390-code-exec(95273)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/95273'}, {'name': '69223', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/69223'}, {'name': '1030731', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1030731'}, {'name': 'GLSA-201601-02', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201601-02'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.apple.com/kb/HT6537'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6367'}, {'name': '60705', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/60705'}]
CVE State: PUBLISHED
Explain CVE-2014-1391
QT Media Foundation in Apple OS X before 10.9.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file with RLE encoding.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.apple.com/kb/HT6493'}, {'name': '1030868', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1030868'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6443'}, {'name': '69907', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/69907'}, {'name': 'macosx-cve20141391-code-exec(96049)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/96049'}]
CVE State: PUBLISHED
Explain CVE-2014-1398
The entity wrapper access API in the Entity API module 7.x-1.x before 7.x-1.3 for Drupal might allow remote authenticated users to bypass intended access restrictions on comment, user and node statistics properties via unspecified vectors.
Affected Products: n/a
References: [{'name': '64729', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/64729'}, {'name': 'drupal-entityapi-cve20141398-security-bypass(90215)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/90215'}, {'name': 'FEDORA-2014-0508', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2014-January/126811.html'}, {'name': 'FEDORA-2014-0509', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2014-January/126816.html'}, {'name': '[oss-security] 20140109 Re: CVE Request: drupal7-entity: multiple access bypass vulnerabilities', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/01/09/3'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1050802'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.drupal.org/node/2169595'}]
CVE State: PUBLISHED
Explain CVE-2014-1399
The entity wrapper access API in the Entity API module 7.x-1.x before 7.x-1.3 for Drupal might allow remote authenticated users to bypass intended access restrictions on referenced entities via unspecified vectors.
Affected Products: n/a
References: [{'name': '64729', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/64729'}, {'name': 'FEDORA-2014-0508', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2014-January/126811.html'}, {'name': 'FEDORA-2014-0509', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2014-January/126816.html'}, {'name': 'drupal-entityapi-cve20141399-security-bypass(90216)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/90216'}, {'name': '[oss-security] 20140109 Re: CVE Request: drupal7-entity: multiple access bypass vulnerabilities', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/01/09/3'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1050802'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.drupal.org/node/2169595'}]
CVE State: PUBLISHED
Explain CVE-2014-1400
The entity_access API in the Entity API module 7.x-1.x before 7.x-1.3 for Drupal might allow remote authenticated users to bypass intended access restrictions and read unpublished comments via unspecified vectors.
Affected Products: n/a
References: [{'name': '64729', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/64729'}, {'name': 'FEDORA-2014-0508', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2014-January/126811.html'}, {'name': 'FEDORA-2014-0509', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2014-January/126816.html'}, {'name': 'drupal-entity-cve20141400-sec-bypass(90396)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/90396'}, {'name': '[oss-security] 20140109 Re: CVE Request: drupal7-entity: multiple access bypass vulnerabilities', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/01/09/3'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1050802'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.drupal.org/node/2169595'}]
CVE State: PUBLISHED
Explain CVE-2014-1401
Multiple SQL injection vulnerabilities in AuraCMS 2.3 and earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) search parameter to mod/content/content.php or (2) CLIENT_IP, (3) X_FORWARDED_FOR, (4) X_FORWARDED, (5) FORWARDED_FOR, or (6) FORWARDED HTTP header to index.php.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/auracms/AuraCMS/commit/790f66ffbc4f23a6e13636fc79d0aa1a7d81e747'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/auracms/AuraCMS/commit/4fe9d0d31a32df392f4d6ced8e5c25ed4af19ade'}, {'name': 'auracms-cve20141401-sql-injection(90965)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/90965'}, {'name': '31520', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/31520'}, {'name': '20140205 Multiple SQL Injection Vulnerabilities in AuraCMS', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/530930/100/0/threaded'}, {'name': '56804', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/56804'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/125079'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.htbridge.com/advisory/HTB23196'}]
CVE State: PUBLISHED
Explain CVE-2014-1402
The default configuration for bccache.FileSystemBytecodeCache in Jinja2 before 2.7.2 does not properly create temporary files, which allows local users to gain privileges via a crafted .cache file with a name starting with __jinja2_ in /tmp.
Affected Products: n/a
References: [{'name': '[El-errata] 20140611 Oracle Linux Security Advisory ELSA-2014-0747', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://oss.oracle.com/pipermail/el-errata/2014-June/004192.html'}, {'name': '[oss-security] 20140110 Re: CVE Request: python-jinja2: arbitrary code execution vulnerability', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2014/01/10/3'}, {'name': '59017', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/59017'}, {'name': '56287', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/56287'}, {'name': 'MDVSA-2014:096', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2014:096'}, {'name': '58783', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/58783'}, {'name': '58918', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/58918'}, {'name': '60738', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/60738'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=734747'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1051421'}, {'name': '60770', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/60770'}, {'name': 'RHSA-2014:0747', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2014-0747.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://jinja.pocoo.org/docs/changelog/'}, {'name': 'GLSA-201408-13', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://www.gentoo.org/security/en/glsa/glsa-201408-13.xml'}, {'name': '[oss-security] 20140110 CVE Request: python-jinja2: arbitrary code execution vulnerability', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2014/01/10/2'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://advisories.mageia.org/MGASA-2014-0028.html'}, {'name': 'RHSA-2014:0748', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2014-0748.html'}]
CVE State: PUBLISHED
Explain CVE-2014-1403
Cross-site scripting (XSS) vulnerability in name.html in easyXDM before 2.4.19 allows remote attackers to inject arbitrary web script or HTML via the location.hash value.
Affected Products: n/a
References: [{'name': '20140131 [CVE-2014-1403] DOM XSS in EasyXDM 2.4.18', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2014/Feb/5'}, {'name': 'easyxdm-cve20141403-xss(90876)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/90876'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/oyvindkinsey/easyXDM/commit/a3194d32c25a0d27a10a47304eb9c9be93ffbf13#diff-6489956f1e1f52236929b4d33cbeb2db'}, {'name': '56634', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/56634'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/oyvindkinsey/easyXDM/releases/tag/2.4.19'}, {'tags': ['x_refsource_MISC'], 'url': 'http://blog.kotowicz.net/2014/01/xssing-with-shakespeare-name-calling.html'}, {'name': '102803', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/102803'}, {'name': '65291', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65291'}]
CVE State: PUBLISHED
Explain CVE-2014-1405
Multiple open redirect vulnerabilities on the Conceptronic C54APM access point with runtime code 1.26 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via (1) the submit-url parameter in a Refresh action to goform/formWlSiteSurvey or (2) the wlan-url parameter to goform/formWlanSetup.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://antoniovazquezblanco.github.io/docs/advisories/Advisory_C54APM_Multiple.pdf'}, {'name': '101916', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/101916'}, {'name': '101917', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/101917'}]
CVE State: PUBLISHED
Explain CVE-2014-1406
CRLF injection vulnerability in goform/formWlSiteSurvey on the Conceptronic C54APM access point with runtime code 1.26 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the submit-url parameter in a Refresh action.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://antoniovazquezblanco.github.io/docs/advisories/Advisory_C54APM_Multiple.pdf'}]
CVE State: PUBLISHED
Explain CVE-2014-1407
Multiple cross-site scripting (XSS) vulnerabilities on the Conceptronic C54APM access point with runtime code 1.26 allow remote attackers to inject arbitrary web script or HTML via (1) the submit-url parameter in a Refresh action to goform/formWlSiteSurvey or (2) the wlan-url parameter to goform/formWlanSetup.
Affected Products: n/a
References: [{'name': '101919', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/101919'}, {'tags': ['x_refsource_MISC'], 'url': 'http://antoniovazquezblanco.github.io/docs/advisories/Advisory_C54APM_Multiple.pdf'}, {'name': '101921', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/101921'}]
CVE State: PUBLISHED
Explain CVE-2014-1408
The Conceptronic C54APM access point with runtime code 1.26 has a default password of admin for the admin account, which makes it easier for remote attackers to obtain access via an HTTP request, as demonstrated by stored XSS attacks.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://antoniovazquezblanco.github.io/docs/advisories/Advisory_C54APM_Multiple.pdf'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://download.conceptronic.net/manuals/C04-058_C54APM_v2.0_Quick_Guide_ML.pdf'}]
CVE State: PUBLISHED
Explain CVE-2014-1409
MobileIron VSP versions prior to 5.9.1 and Sentry versions prior to 5.0 have an authentication bypass vulnerability due to an XML file with obfuscated passwords
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://seclists.org/fulldisclosure/2014/Apr/21'}, {'tags': ['x_refsource_MISC'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/92351'}, {'tags': ['x_refsource_MISC'], 'url': 'https://packetstormsecurity.com/files/cve/CVE-2014-1409'}]
CVE State: PUBLISHED
Explain CVE-2014-1418
Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly include the (1) Vary: Cookie or (2) Cache-Control header in responses, which allows remote attackers to obtain sensitive information or poison the cache via a request from certain browsers.
Affected Products: n/a
References: [{'name': '61281', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/61281'}, {'name': 'DSA-2934', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2014/dsa-2934'}, {'name': 'USN-2212-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://ubuntu.com/usn/usn-2212-1'}, {'name': 'openSUSE-SU-2014:1132', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2014-09/msg00023.html'}, {'name': '[oss-security] 20140514 Re: CVE Reuest: Django: Malformed URLs from user input incorrectly validated', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/05/15/3'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.djangoproject.com/weblog/2014/may/14/security-releases-issued/'}, {'name': '[oss-security] 20140514 CVE Reuest: Django: Malformed URLs from user input incorrectly validated', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/05/14/10'}]
CVE State: PUBLISHED
Explain CVE-2014-1419
Race condition in the power policy functions in policy-funcs in acpi-support before 0.142 allows local users to gain privileges via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.launchpad.net/ubuntu/%2Bsource/acpi-support/%2Bbug/1340812'}, {'name': '60319', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/60319'}, {'name': 'USN-2297-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2297-1'}, {'name': 'DSA-2984', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2014/dsa-2984'}]
CVE State: PUBLISHED
Explain CVE-2014-1420
On desktop, Ubuntu UI Toolkit's StateSaver would serialise data on tmp/ files which an attacker could use to expose potentially sensitive data. StateSaver would also open files without the O_EXCL flag. An attacker could exploit this to launch a symlink attack, though this is partially mitigated by symlink and hardlink restrictions in Ubuntu. Fixed in 1.1.1188+14.10.20140813.4-0ubuntu1.
Affected Products: ubuntu-ui-toolkit
References: [{'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'https://launchpad.net/bugs/1348241'}, {'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://bazaar.launchpad.net/~ubuntu-sdk-team/ubuntu-ui-toolkit/staging/revision/1182'}]
CVE State: PUBLISHED
Explain CVE-2014-1421
mountall 1.54, as used in Ubuntu 14.10, does not properly handle the umask when using the mount utility, which allows local users to bypass intended access restrictions via unspecified vectors.
Affected Products: n/a
References: [{'name': 'USN-2411-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2411-1'}]
CVE State: PUBLISHED
Explain CVE-2014-1422
In Ubuntu's trust-store, if a user revokes location access from an application, the location is still available to the application because the application will honour incorrect, cached permissions. This is because the cache was not ordered by creation time by the Select struct in src/core/trust/impl/sqlite3/store.cpp. Fixed in trust-store (Ubuntu) version 1.1.0+15.04.20150123-0ubuntu1 and trust-store (Ubuntu RTM) version 1.1.0+15.04.20150123~rtm-0ubuntu1.
Affected Products: trust-store (Ubuntu)
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://launchpad.net/bugs/1387734'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bazaar.launchpad.net/~phablet-team/trust-store/trunk/revision/82'}]
CVE State: PUBLISHED
Explain CVE-2014-1423
signond before 8.57+15.04.20141127.1-0ubuntu1, as used in Ubuntu Touch, did not properly restrict applications from querying oath tokens due to incorrect checks and the missing installation of the signon-apparmor-extension. An attacker could use this create a malicious click app that collects oauth tokens for other applications, exposing sensitive information.
Affected Products: signon
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://bazaar.launchpad.net/~online-accounts/signon/upstream/revision/644'}, {'tags': ['x_refsource_MISC'], 'url': 'http://bazaar.launchpad.net/~online-accounts/signon/upstream/revision/645'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugs.launchpad.net/ubuntu/+source/signon/+bug/1392380'}]
CVE State: PUBLISHED
Explain CVE-2014-1424
apparmor_parser in the apparmor package before 2.8.95~2430-0ubuntu5.1 in Ubuntu 14.04 allows attackers to bypass AppArmor policies via unspecified vectors, related to a "miscompilation flaw."
Affected Products: n/a
References: [{'name': 'USN-2413-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2413-1'}]
CVE State: PUBLISHED
Explain CVE-2014-1425
cmanager 0.32 does not properly enforce nesting when modifying cgroup properties, which allows local users to set cgroup values for all cgroups via unspecified vectors.
Affected Products: n/a
References: [{'name': 'USN-2451-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2451-1'}]
CVE State: PUBLISHED
Explain CVE-2014-1426
A vulnerability in maasserver.api.get_file_by_name of Ubuntu MAAS allows unauthenticated network clients to download any file. This issue affects: Ubuntu MAAS versions prior to 1.9.2.
Affected Products: maas
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://launchpad.net/maas/+milestone/1.9.2'}]
CVE State: PUBLISHED
Explain CVE-2014-1427
A vulnerability in the REST API of Ubuntu MAAS allows an attacker to cause a logged-in user to execute commands via cross-site scripting. This issue affects MAAS versions prior to 1.9.2.
Affected Products: MAAS
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://launchpad.net/maas/+milestone/1.9.2'}]
CVE State: PUBLISHED
Explain CVE-2014-1428
A vulnerability in generate_filestorage_key of Ubuntu MAAS allows an attacker to brute-force filenames. This issue affects Ubuntu MAAS versions prior to 1.9.2.
Affected Products: MAAS
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://launchpad.net/maas/+milestone/1.9.2'}]
CVE State: PUBLISHED
Explain CVE-2014-1439
The libxml_disable_entity_loader function in runtime/ext/ext_simplexml.cpp in HipHop Virtual Machine for PHP (HHVM) before 2.4.0 and 2.3.x before 2.3.3 does not properly disable a certain libxml handler, which allows remote attackers to conduct XML External Entity (XXE) attacks.
Affected Products: n/a
References: [{'name': 'hhvm-cve20141439-info-disc(90979)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/90979'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/facebook/hhvm/commit/95f96e7287effe2fcdfb9a5338d1a7e4f55b083b'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.hhvm.com/blog/3287/hhvm-2-4-0'}]
CVE State: PUBLISHED