Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2014-1823
Cross-site scripting (XSS) vulnerability in the Web Components Server in Microsoft Lync Server 2010 and 2013 allows remote attackers to inject arbitrary web script or HTML via a crafted URL containing a valid meeting ID, aka "Lync Server Content Sanitization Vulnerability."
Affected Products: n/a
References: [{'name': '1030381', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1030381'}, {'name': 'MS14-032', 'tags': ['vendor-advisory', 'x_refsource_MS'], 'url': 'https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-032'}, {'name': '67893', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/67893'}, {'name': '58537', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/58537'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://blogs.technet.com/b/srd/archive/2014/06/10/assessing-risk-for-the-june-2014-security-updates.aspx'}]
CVE State: PUBLISHED
Explain CVE-2014-1824
Windows Journal in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code via a crafted Journal (aka .JNT) file, aka "Windows Journal Remote Code Execution Vulnerability."
Affected Products: n/a
References: [{'name': '68396', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/68396'}, {'name': '297185', 'tags': ['vendor-advisory', 'x_refsource_MSKB'], 'url': 'https://support.microsoft.com/kb/2971850'}, {'name': 'MS14-038', 'tags': ['vendor-advisory', 'x_refsource_MS'], 'url': 'https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-038'}, {'name': '59776', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/59776'}]
CVE State: PUBLISHED
Explain CVE-2014-1826
Cross-site scripting (XSS) vulnerability in the iThoughtsHD app 4.19 for iOS on iPad devices, when the WiFi Transfer feature is used, allows remote attackers to inject arbitrary web script or HTML via a crafted map name.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.madirish.net/559'}]
CVE State: PUBLISHED
Explain CVE-2014-1827
The iThoughtsHD app 4.19 for iOS on iPad devices, when the WiFi Transfer feature is used, allows remote attackers to upload arbitrary files by placing a %00 sequence after a dangerous extension, as demonstrated by a .html%00.txt file.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.madirish.net/559'}]
CVE State: PUBLISHED
Explain CVE-2014-1828
The iThoughts web server in the iThoughtsHD app 4.19 for iOS on iPad devices allows remote attackers to cause a denial of service (disk consumption) by uploading a large file.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.madirish.net/559'}]
CVE State: PUBLISHED
Explain CVE-2014-1829
Requests (aka python-requests) before 2.3.0 allows remote servers to obtain a netrc password by reading the Authorization header in a redirected request.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=733108'}, {'name': 'MDVSA-2015:133', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2015:133'}, {'name': 'USN-2382-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2382-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/kennethreitz/requests/issues/1885'}, {'name': 'DSA-3146', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2015/dsa-3146'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://advisories.mageia.org/MGASA-2014-0409.html'}]
CVE State: PUBLISHED
Explain CVE-2014-1830
Requests (aka python-requests) before 2.3.0 allows remote servers to obtain sensitive information by reading the Proxy-Authorization header in a redirected request.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=733108'}, {'name': 'MDVSA-2015:133', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2015:133'}, {'name': 'openSUSE-SU-2016:0246', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2016-01/msg00095.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/kennethreitz/requests/issues/1885'}, {'name': 'DSA-3146', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2015/dsa-3146'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://advisories.mageia.org/MGASA-2014-0409.html'}]
CVE State: PUBLISHED
Explain CVE-2014-1831
Phusion Passenger before 4.0.37 allows local users to write to certain files and directories via a symlink attack on (1) control_process.pid or a (2) generation-* file.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=736958'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/phusion/passenger/commit/34b1087870c2'}, {'name': '[oss-security] 20140130 Re: CVE request: temporary file issue in Passenger rubygem', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2014/01/30/3'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1058992'}, {'name': 'FEDORA-2015-1151', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2015-February/149032.html'}, {'name': '[oss-security] 20140128 CVE request: temporary file issue in Passenger rubygem', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2014/01/28/8'}]
CVE State: PUBLISHED
Explain CVE-2014-1832
Phusion Passenger 4.0.37 allows local users to write to certain files and directories via a symlink attack on (1) control_process.pid or a (2) generation-* file.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-1831.
Affected Products: n/a
References: [{'name': '[oss-security] 20140129 Re: CVE request: temporary file issue in Passenger rubygem', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2014/01/29/6'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=736958'}, {'name': '[oss-security] 20150130 Re: CVE request: temporary file issue in Passenger rubygem', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2014/01/30/3'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1058992'}, {'name': 'FEDORA-2015-1151', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2015-February/149032.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/phusion/passenger/commit/94428057c602da3d6d34ef75c78091066ecac5c0'}]
CVE State: PUBLISHED
Explain CVE-2014-1833
Directory traversal vulnerability in uupdate in devscripts 2.14.1 allows remote attackers to modify arbitrary files via a crafted .orig.tar file, related to a symlink.
Affected Products: n/a
References: [{'name': '[oss-security] 20140131 Re: CVE request: uupdate (devscripts) directory traversal', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/01/31/11'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1059947'}, {'name': '65260', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65260'}, {'name': 'devscripts-cve20141833-dir-trav(90842)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/90842'}, {'name': '[oss-security] 20140131 CVE request: uupdate (devscripts) directory traversal', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/01/31/7'}, {'tags': ['x_refsource_MISC'], 'url': 'http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737160'}, {'name': 'USN-2649-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2649-1'}, {'name': '102748', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/102748'}]
CVE State: PUBLISHED
Explain CVE-2014-1834
The perform_request function in /lib/echor/backplane.rb in echor 0.1.6 Ruby Gem allows local users to inject arbitrary code by adding a semi-colon in their username or password.
Affected Products: n/a
References: [{'name': '[oss-security] 20140131 Re: echor 0.1.6 Ruby Gem exposes login credentials', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/01/31/10'}]
CVE State: PUBLISHED
Explain CVE-2014-1835
The perform_request function in /lib/echor/backplane.rb in echor 0.1.6 Ruby Gem allows local users to steal the login credentials by watching the process table.
Affected Products: n/a
References: [{'name': '[oss-security] 20140131 Re: echor 0.1.6 Ruby Gem exposes login credentials', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/01/31/10'}, {'name': 'echor-ruby-system-process-info-disc(90858)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'http://xforce.iss.net/xforce/xfdb/90858'}]
CVE State: PUBLISHED
Explain CVE-2014-1836
Absolute path traversal vulnerability in htdocs/libraries/image-editor/image-edit.php in ImpressCMS before 1.3.6 allows remote attackers to delete arbitrary files via a full pathname in the image_path parameter in a cancel action.
Affected Products: n/a
References: [{'name': '20140203 [CVE-2014-1836] Arbitrary file deletion in ImpressCMS < 1.3.6 and two XSS issues', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2014/Feb/14'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://community.impresscms.org/modules/smartsection/item.php?itemid=675'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/pedrib/PoC/blob/master/generic/impresscms-1.3.5.txt'}, {'name': '65279', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65279'}, {'name': '102770', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/show/osvdb/102770'}]
CVE State: PUBLISHED
Explain CVE-2014-1837
Cross-site scripting (XSS) vulnerability in the StackIdeas Komento (com_komento) component before 1.7.4 for Joomla! allows remote attackers to inject arbitrary web script or HTML via vectors related to "checking new comments."
Affected Products: n/a
References: [{'name': '56577', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/56577'}, {'name': '102563', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/102563'}, {'name': '65173', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65173'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://stackideas.com/downloads/changelog/komento'}, {'name': 'komento-joomla-cve20141837-xss(90974)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/90974'}]
CVE State: PUBLISHED
Explain CVE-2014-1838
The (1) extract_keys_from_pdf and (2) fill_pdf functions in pdf_ext.py in logilab-commons before 0.61.0 allows local users to overwrite arbitrary files and possibly have other unspecified impact via a symlink attack on /tmp/toto.fdf.
Affected Products: n/a
References: [{'name': 'openSUSE-SU-2014:0306', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2014-02/msg00085.html'}, {'name': '57209', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/57209'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737051'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.logilab.org/ticket/207561'}, {'name': "[oss-security] 20140131 CVE request: temp file issues in python's logilab-common module", 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://comments.gmane.org/gmane.comp.security.oss.general/11986'}]
CVE State: PUBLISHED
Explain CVE-2014-1839
The Execute class in shellutils in logilab-commons before 0.61.0 uses tempfile.mktemp, which allows local users to have an unspecified impact by pre-creating the temporary file.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.logilab.org/ticket/207562'}, {'name': 'openSUSE-SU-2014:0306', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2014-02/msg00085.html'}, {'name': '57209', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/57209'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737051'}, {'name': "[oss-security] 20140131 CVE request: temp file issues in python's logilab-common module", 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://comments.gmane.org/gmane.comp.security.oss.general/11986'}]
CVE State: PUBLISHED
Explain CVE-2014-1840
Cross-site scripting (XSS) vulnerability in Upload/search.php in MyBB 1.6.12 and earlier allows remote attackers to inject arbitrary web script or HTML via the keywords parameter in a do_search action, which is not properly handled in a forced SQL error message.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/125038/MyBB-1.6.12-POST-Cross-Site-Scripting.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://osandamalith.wordpress.com/2014/02/02/mybb-1-6-12-post-xss-0day/'}]
CVE State: PUBLISHED
Explain CVE-2014-1841
Directory traversal vulnerability in the web interface in Titan FTP Server before 10.40 build 1829 allows remote attackers to copy an arbitrary user's home folder via a Move action with a .. (dot dot) in the src parameter.
Affected Products: n/a
References: [{'name': '65462', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65462'}, {'name': '31579', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/31579'}, {'name': '103195', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/103195'}, {'name': '20140210 Titan FTP Server Directory Traversal Vulnerabilities - [CVE-2014-1841 / CVE-2014-1842 / CVE-2014-1843]', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://archives.neohapsis.com/archives/fulldisclosure/2014-02/0092.html'}]
CVE State: PUBLISHED
Explain CVE-2014-1842
Directory traversal vulnerability in the web interface in Titan FTP Server before 10.40 build 1829 allows remote attackers to list all usernames via a Go action with a .. (dot dot) in the search-bar value.
Affected Products: n/a
References: [{'name': '103196', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/103196'}, {'name': '31579', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/31579'}, {'name': '20140210 Titan FTP Server Directory Traversal Vulnerabilities - [CVE-2014-1841 / CVE-2014-1842 / CVE-2014-1843]', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://archives.neohapsis.com/archives/fulldisclosure/2014-02/0092.html'}]
CVE State: PUBLISHED
Explain CVE-2014-1843
Directory traversal vulnerability in the web interface in Titan FTP Server before 10.40 build 1829 allows remote attackers to obtain the property information of an arbitrary home folder via a Properties action with a .. (dot dot) in the src parameter.
Affected Products: n/a
References: [{'name': '103197', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/103197'}, {'name': '65469', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65469'}, {'name': '31579', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/31579'}, {'name': '20140210 Titan FTP Server Directory Traversal Vulnerabilities - [CVE-2014-1841 / CVE-2014-1842 / CVE-2014-1843]', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://archives.neohapsis.com/archives/fulldisclosure/2014-02/0092.html'}]
CVE State: PUBLISHED
Explain CVE-2014-1845
An unspecified setuid root helper in Enlightenment before 0.17.6 allows local users to gain privileges by leveraging failure to properly sanitize the environment.
Affected Products: n/a
References: [{'name': 'enlightenment-helper-priv-esc(91216)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/91216'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://git.enlightenment.org/core/enlightenment.git/commit/?id=bb4a21e98656fe2c7d98ba2163e6defe9a630e2b'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1059410'}, {'name': '[oss-security] 20140203 Re: CVE request: enlightenment sysactions', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/03/19'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://git.enlightenment.org/core/enlightenment.git/commit/?id=666df815cd86a50343859bce36c5cf968c5f38b0'}]
CVE State: PUBLISHED
Explain CVE-2014-1846
Enlightenment before 0.17.6 might allow local users to gain privileges via vectors involving the gdb method.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://git.enlightenment.org/core/enlightenment.git/commit/?id=bb4a21e98656fe2c7d98ba2163e6defe9a630e2b'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1059410'}, {'name': '[oss-security] 20140203 Re: CVE request: enlightenment sysactions', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/03/19'}, {'name': 'enlightenment-configuration-priv-esc(91215)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/91215'}]
CVE State: PUBLISHED
Explain CVE-2014-1849
Foscam IP camera 11.37.2.49 and other versions, when using the Foscam DynDNS option, generates credentials based on predictable camera subdomain names, which allows remote attackers to spoof or hijack arbitrary cameras and conduct other attacks by modifying arbitrary camera records in the Foscam DNS server.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://github.com/artemharutyunyan/getmecamtool/blob/master/src/dnsmod.c'}, {'tags': ['x_refsource_MISC'], 'url': 'http://blog.shekyan.com/2014/05/cve-2014-1849-foscam-dynamic-dns-predictable-credentials-vulnerability.html'}, {'name': '20140508 CVE-2014-1849 Foscam Dynamic DNS predictable credentials vulnerability', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2014/May/35'}]
CVE State: PUBLISHED
Explain CVE-2014-1854
SQL injection vulnerability in library/clicktracker.php in the AdRotate Pro plugin 3.9 through 3.9.5 and AdRotate Free plugin 3.9 through 3.9.4 for WordPress allows remote attackers to execute arbitrary SQL commands via the track parameter.
Affected Products: n/a
References: [{'name': 'adrotate-track-sql-injection(91253)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/91253'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.adrotateplugin.com/2014/01/adrotate-pro-3-9-6-and-adrotate-free-3-9-5'}, {'name': '20140220 SQL Injection in AdRotate', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/531176/100/0/threaded'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.htbridge.com/advisory/HTB23201'}, {'name': '65709', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65709'}, {'name': '31834', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/31834'}, {'name': '57079', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/57079'}]
CVE State: PUBLISHED
Explain CVE-2014-1855
Multiple cross-site scripting (XSS) vulnerabilities in Seo Panel before 3.5.0 allow remote attackers to inject arbitrary web script or HTML via the (1) capcheck parameter to directories.php or (2) keyword parameter to proxy.php.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://www.htbridge.com/advisory/HTB23200'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://forum.seopanel.in/viewtopic.php?f=7&t=10978'}, {'name': '58706', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/58706'}, {'name': '20140516 Two Cross-Site Scripting (XSS) Vulnerabilities in Seo Panel', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/532119/100/0/threaded'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/126706/Seo-Panel-3.4.0-Cross-Site-Scripting.html'}]
CVE State: PUBLISHED
Explain CVE-2014-1858
__init__.py in f2py in NumPy before 1.8.1 allows local users to write to arbitrary files via a symlink attack on a temporary file.
Affected Products: n/a
References: [{'name': 'FEDORA-2014-2387', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2014-February/128781.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/numpy/numpy/commit/0bb46c1448b0d3f5453d5182a17ea7ac5854ee15'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737778'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/numpy/numpy/pull/4262'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1062009'}, {'name': '65441', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65441'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/numpy/numpy/blob/maintenance/1.8.x/doc/release/1.8.1-notes.rst'}, {'name': 'numpy-cve20141858-symlink(91318)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/91318'}, {'name': '[oss-security] 20140207 Re: CVE request: f2py insecure temporary file use', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/08/3'}, {'name': 'FEDORA-2014-2289', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2014-February/128358.html'}]
CVE State: PUBLISHED
Explain CVE-2014-1859
(1) core/tests/test_memmap.py, (2) core/tests/test_multiarray.py, (3) f2py/f2py2e.py, and (4) lib/tests/test_io.py in NumPy before 1.8.1 allow local users to write to arbitrary files via a symlink attack on a temporary file.
Affected Products: n/a
References: [{'name': 'FEDORA-2014-2387', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2014-February/128781.html'}, {'name': '65440', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65440'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/numpy/numpy/commit/0bb46c1448b0d3f5453d5182a17ea7ac5854ee15'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737778'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/numpy/numpy/pull/4262'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1062009'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/numpy/numpy/blob/maintenance/1.8.x/doc/release/1.8.1-notes.rst'}, {'name': '[oss-security] 20140207 Re: CVE request: f2py insecure temporary file use', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/08/3'}, {'name': 'FEDORA-2014-2289', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2014-February/128358.html'}, {'name': 'numpy-cve20141859-symlink(91317)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/91317'}]
CVE State: PUBLISHED
Explain CVE-2014-1860
Contao CMS through 3.2.4 has PHP Object Injection Vulnerabilities
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.securityfocus.com/bid/65293'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/03/14'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/07/7'}, {'tags': ['x_refsource_MISC'], 'url': 'https://packetstormsecurity.com/files/cve/CVE-2014-1860'}, {'name': 'Exploit Database', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-database.net/?id=21609'}]
CVE State: PUBLISHED
Explain CVE-2014-1861
The client in Jetro COCKPIT Secure Browsing (JCSB) 4.3.1 and 4.3.3 does not validate the FileName element in an RDP_FILE_TRANSFER document, which allows remote JCSB servers to execute arbitrary programs by providing a .EXE extension.
Affected Products: n/a
References: [{'name': '20140217 Jetro Cockpit Secure Browsing vulnerability - Client missing input validation allowing RCE', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-02/0075.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://blog.quaji.com/2014/02/remote-code-execution-on-all-enterprise.html'}]
CVE State: PUBLISHED
Explain CVE-2014-1867
suPHP before 0.7.2 source-highlighting feature allows security bypass which could lead to arbitrary code execution
Affected Products: suphp
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://security-tracker.debian.org/tracker/CVE-2014-1867'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.securityfocus.com/bid/65212'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/10/1'}, {'tags': ['x_refsource_MISC'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/91315'}]
CVE State: PUBLISHED
Explain CVE-2014-1868
Restlet Framework 2.1.x before 2.1.7 and 2.x.x before 2.2 RC1, when using XMLRepresentation or XML serializers, allows attackers to cause a denial of service via an XML Entity Expansion (XEE) attack.
Affected Products: n/a
References: [{'name': '56940', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/56940'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/restlet/restlet-framework-java/wiki/XEE-security-enhancements'}, {'name': 'restlet-framework-cve20141868-dos(91181)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/91181'}]
CVE State: PUBLISHED
Explain CVE-2014-1869
Multiple cross-site scripting (XSS) vulnerabilities in ZeroClipboard.swf in ZeroClipboard before 1.3.2, as maintained by Jon Rohan and James M. Greene, allow remote attackers to inject arbitrary web script or HTML via vectors related to certain SWF query parameters (aka loaderInfo.parameters).
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/zeroclipboard/zeroclipboard/pull/335'}, {'name': 'zeroclipboard-cve20141869-xss(91085)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/91085'}, {'name': '56821', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/56821'}, {'name': '65484', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65484'}, {'name': 'RHSA-2016:0070', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2016:0070'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-10-01'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/zeroclipboard/zeroclipboard/releases/tag/v1.3.2'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/zeroclipboard/zeroclipboard/commit/2f9eb9750a433965572d047e24b0fc78fd1415ca'}]
CVE State: PUBLISHED
Explain CVE-2014-1870
Opera before 19 on Mac OS X allows user-assisted remote attackers to spoof the address bar via vectors involving a drag-and-drop operation.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://blogs.opera.com/security/2014/01/security-changes-features-opera-19/'}]
CVE State: PUBLISHED
Explain CVE-2014-1875
The Capture::Tiny module before 0.24 for Perl allows local users to write to arbitrary files via a symlink attack on a temporary file.
Affected Products: n/a
References: [{'name': '65475', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65475'}, {'name': 'capturetiny-perl-symlink(91464)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/91464'}, {'name': '56823', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/56823'}, {'name': 'FEDORA-2014-2261', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2014-February/128823.html'}, {'name': '102963', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/102963'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1062424'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737835'}, {'name': 'FEDORA-2014-2321', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2014-February/128882.html'}, {'name': '[oss-security] 20140206 CVE Request: Capture::Tiny: insecure use of /tmp', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://seclists.org/oss-sec/2014/q1/267'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://cpansearch.perl.org/src/DAGOLDEN/Capture-Tiny-0.24/Changes'}, {'name': '[oss-security] 20140206 Re: CVE Request: Capture::Tiny: insecure use of /tmp', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://seclists.org/oss-sec/2014/q1/272'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/dagolden/Capture-Tiny/commit/635c9eabd52ab8042b0c841823bd6e692de87924'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/dagolden/Capture-Tiny/issues/16'}]
CVE State: PUBLISHED
Explain CVE-2014-1877
Multiple cross-site scripting (XSS) vulnerabilities in Dokeos 2.1.1 allow remote attackers to inject arbitrary web script or HTML via the (1) Phone, (2) Street, (3) Address line, (4) Zip code, or (5) City field to main/auth/profile.php; (6) Subject field to main/social/groups.php; or (7) Message body field to main/messages/view_message.php.
Affected Products: n/a
References: [{'name': '[oss-security] 20140206 Dokeos 2.1.1 Multiple Stored XSS Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://seclists.org/oss-sec/2014/q1/258'}, {'name': '[oss-security] 20140207 Re: Dokeos 2.1.1 Multiple Stored XSS Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://seclists.org/oss-sec/2014/q1/286'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.xchg.info/?p=381'}, {'name': '65416', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65416'}, {'name': 'dokeos-cve20141877-xss(91295)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/91295'}]
CVE State: PUBLISHED
Explain CVE-2014-1878
Stack-based buffer overflow in the cmd_submitf function in cgi/cmd.c in Nagios Core, possibly 4.0.3rc1 and earlier, and Icinga before 1.8.6, 1.9 before 1.9.5, and 1.10 before 1.10.3 allows remote attackers to cause a denial of service (segmentation fault) via a long message to cmd.cgi.
Affected Products: n/a
References: [{'name': 'openSUSE-SU-2014:0516', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2014-04/msg00033.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://dev.icinga.org/issues/5434'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.icinga.org/2014/02/11/bugfix-releases-1-10-3-1-9-5-1-8-6'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1066578'}, {'name': '65605', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65605'}, {'name': '[debian-lts-announce] 20181224 [SECURITY] [DLA 1615-1] nagios3 security update', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.debian.org/debian-lts-announce/2018/12/msg00014.html'}, {'name': '57024', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/57024'}]
CVE State: PUBLISHED
Explain CVE-2014-1879
Cross-site scripting (XSS) vulnerability in import.php in phpMyAdmin before 4.1.7 allows remote authenticated users to inject arbitrary web script or HTML via a crafted filename in an import action.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.phpmyadmin.net/home_page/security/PMASA-2014-1.php'}, {'name': '65717', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65717'}, {'name': '59832', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/59832'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/phpmyadmin/phpmyadmin/commit/968d5d5f486820bfa30af046f063b9f23304e14a'}, {'name': 'openSUSE-SU-2014:0344', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2014-03/msg00017.html'}]
CVE State: PUBLISHED
Explain CVE-2014-1881
Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier allow remote attackers to bypass intended device-resource restrictions of an event-based bridge via a crafted library clone that leverages IFRAME script execution and waits a certain amount of time for an OnJsPrompt handler return value as an alternative to correct synchronization.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.cs.utexas.edu/~shmat/shmat_ndss14nofrak.pdf'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.internetsociety.org/ndss2014/programme#session3'}, {'name': '20140124 Security Vulnerabilities in Apache Cordova / PhoneGap', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://seclists.org/bugtraq/2014/Jan/96'}, {'name': '[oss-security] 20140207 Re: CVE request: multiple issues in Apache Cordova/PhoneGap', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2014/02/07/9'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/124954/apachecordovaphonegap-bypass.txt'}]
CVE State: PUBLISHED
Explain CVE-2014-1882
Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier allow remote attackers to bypass intended device-resource restrictions of an event-based bridge via a crafted library clone that leverages IFRAME script execution and directly accesses bridge JavaScript objects, as demonstrated by certain cordova.require calls.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.cs.utexas.edu/~shmat/shmat_ndss14nofrak.pdf'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.internetsociety.org/ndss2014/programme#session3'}, {'name': '20140124 Security Vulnerabilities in Apache Cordova / PhoneGap', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://seclists.org/bugtraq/2014/Jan/96'}, {'name': '[oss-security] 20140207 Re: CVE request: multiple issues in Apache Cordova/PhoneGap', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2014/02/07/9'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/124954/apachecordovaphonegap-bypass.txt'}]
CVE State: PUBLISHED
Explain CVE-2014-1883
Adobe PhoneGap before 2.6.0 on Android uses the shouldOverrideUrlLoading callback instead of the proper shouldInterceptRequest callback, which allows remote attackers to bypass intended device-resource restrictions via content that is accessed (1) in an IFRAME element or (2) with the XMLHttpRequest method by a crafted application.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.cs.utexas.edu/~shmat/shmat_ndss14nofrak.pdf'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.internetsociety.org/ndss2014/programme#session3'}, {'name': '20140124 Security Vulnerabilities in Apache Cordova / PhoneGap', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://seclists.org/bugtraq/2014/Jan/96'}, {'name': '[oss-security] 20140207 Re: CVE request: multiple issues in Apache Cordova/PhoneGap', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2014/02/07/9'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/phonegap/phonegap/blob/2.6.0/changelog'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/124954/apachecordovaphonegap-bypass.txt'}]
CVE State: PUBLISHED
Explain CVE-2014-1884
Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier on Windows Phone 7 and 8 do not properly restrict navigation events, which allows remote attackers to bypass intended device-resource restrictions via content that is accessed (1) in an IFRAME element or (2) with the XMLHttpRequest method by a crafted application.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.cs.utexas.edu/~shmat/shmat_ndss14nofrak.pdf'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.internetsociety.org/ndss2014/programme#session3'}, {'name': '20140124 Security Vulnerabilities in Apache Cordova / PhoneGap', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://seclists.org/bugtraq/2014/Jan/96'}, {'name': '[oss-security] 20140207 Re: CVE request: multiple issues in Apache Cordova/PhoneGap', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2014/02/07/9'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/124954/apachecordovaphonegap-bypass.txt'}]
CVE State: PUBLISHED
Explain CVE-2014-1885
The ForzeArmate application for Android, when Adobe PhoneGap 2.9.0 or earlier is used, allows remote attackers to execute arbitrary JavaScript code, and consequently obtain write access to external-storage resources, by leveraging control over any Google syndication advertising domain.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.cs.utexas.edu/~shmat/shmat_ndss14nofrak.pdf'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.internetsociety.org/ndss2014/programme#session3'}, {'name': '[oss-security] 20140207 Re: CVE request: multiple issues in Apache Cordova/PhoneGap', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2014/02/07/9'}]
CVE State: PUBLISHED
Explain CVE-2014-1886
The Edinburgh by Bus application for Android, when Adobe PhoneGap 2.9.0 or earlier is used, allows remote attackers to execute arbitrary JavaScript code, and consequently access external-storage resources, by leveraging control over one of a number of "obscure Eastern European dating sites."
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.cs.utexas.edu/~shmat/shmat_ndss14nofrak.pdf'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.internetsociety.org/ndss2014/programme#session3'}, {'name': '[oss-security] 20140207 Re: CVE request: multiple issues in Apache Cordova/PhoneGap', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2014/02/07/9'}]
CVE State: PUBLISHED
Explain CVE-2014-1887
The DrinkedIn BarFinder application for Android, when Adobe PhoneGap 2.9.0 or earlier is used, allows remote attackers to execute arbitrary JavaScript code, and consequently obtain sensitive fine-geolocation information, by leveraging control over one of a number of adult sites, as demonstrated by (1) freelifetimecheating.com and (2) www.babesroulette.com.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.cs.utexas.edu/~shmat/shmat_ndss14nofrak.pdf'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.internetsociety.org/ndss2014/programme#session3'}, {'name': '[oss-security] 20140207 Re: CVE request: multiple issues in Apache Cordova/PhoneGap', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2014/02/07/9'}]
CVE State: PUBLISHED
Explain CVE-2014-1888
Cross-site scripting (XSS) vulnerability in the BuddyPress plugin before 1.9.2 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the name field to groups/create/step/group-details.  NOTE: this can be exploited without authentication by leveraging CVE-2014-1889.
Affected Products: n/a
References: [{'name': '65555', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65555'}, {'name': 'buddypress-cve20141888-xss(91175)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/91175'}, {'name': '56950', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/56950'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/125212/WordPress-Buddypress-1.9.1-Cross-Site-Scripting.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://buddypress.org/2014/02/buddypress-1-9-2'}, {'name': '20140213 Wordpress plugin Buddypress <= 1.9.1 stored xss vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/531049/100/0/threaded'}, {'name': '103307', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/103307'}]
CVE State: PUBLISHED
Explain CVE-2014-1889
The Group creation process in the Buddypress plugin before 1.9.2 for WordPress allows remote authenticated users to gain control of arbitrary groups by leveraging a missing permissions check.
Affected Products: n/a
References: [{'name': '20140213 Wordpress plugin Buddypress <= 1.9.1 privilege escalation vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/531050/100/0/threaded'}, {'name': 'buddypress-cve20141889-sec-bypass(91261)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/91261'}, {'name': '65554', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65554'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://buddypress.org/2014/02/buddypress-1-9-2/'}]
CVE State: PUBLISHED
Explain CVE-2014-1891
Multiple integer overflows in the (1) FLASK_GETBOOL, (2) FLASK_SETBOOL, (3) FLASK_USER, and (4) FLASK_CONTEXT_TO_SID suboperations in the flask hypercall in Xen 4.3.x, 4.2.x, 4.1.x, 3.2.x, and earlier, when XSM is enabled, allow local users to cause a denial of service (processor fault) via unspecified vectors, a different vulnerability than CVE-2014-1892, CVE-2014-1893, and CVE-2014-1894.
Affected Products: n/a
References: [{'name': 'SUSE-SU-2014:0373', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00011.html'}, {'name': '[oss-security] 20140210 Xen Security Advisory 84 (CVE-2014-1891,CVE-2014-1892,CVE-2014-1893,CVE-2014-1894) - integer overflow in several XSM/Flask hypercalls', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/10/8'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://xenbits.xen.org/xsa/advisory-84.html'}, {'name': '[oss-security] 20140207 Re: Xen Security Advisory 84 - integer overflow in several XSM/Flask hypercalls', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/07/4'}, {'name': 'GLSA-201407-03', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-201407-03.xml'}, {'name': 'SUSE-SU-2014:0372', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00010.html'}, {'name': 'SUSE-SU-2014:0446', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html'}, {'name': '[oss-security] 20140207 Re: Xen Security Advisory 84 - integer overflow in several XSM/Flask hypercalls', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/07/12'}]
CVE State: PUBLISHED
Explain CVE-2014-1892
Xen 3.3 through 4.1, when XSM is enabled, allows local users to cause a denial of service via vectors related to a "large memory allocation," a different vulnerability than CVE-2014-1891, CVE-2014-1893, and CVE-2014-1894.
Affected Products: n/a
References: [{'name': 'SUSE-SU-2014:0373', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00011.html'}, {'name': '[oss-security] 20140210 Xen Security Advisory 84 (CVE-2014-1891,CVE-2014-1892,CVE-2014-1893,CVE-2014-1894) - integer overflow in several XSM/Flask hypercalls', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/10/8'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://xenbits.xen.org/xsa/advisory-84.html'}, {'name': '[oss-security] 20140207 Re: Xen Security Advisory 84 - integer overflow in several XSM/Flask hypercalls', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/07/4'}, {'name': 'GLSA-201407-03', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-201407-03.xml'}, {'name': 'SUSE-SU-2014:0372', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00010.html'}, {'name': 'SUSE-SU-2014:0446', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html'}, {'name': '[oss-security] 20140207 Re: Xen Security Advisory 84 - integer overflow in several XSM/Flask hypercalls', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/07/12'}]
CVE State: PUBLISHED
Explain CVE-2014-1893
Multiple integer overflows in the (1) FLASK_GETBOOL and (2) FLASK_SETBOOL suboperations in the flask hypercall in Xen 4.1.x, 3.3.x, 3.2.x, and earlier, when XSM is enabled, allow local users to cause a denial of service (processor fault) via unspecified vectors, a different vulnerability than CVE-2014-1891, CVE-2014-1892, and CVE-2014-1894.
Affected Products: n/a
References: [{'name': 'SUSE-SU-2014:0373', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00011.html'}, {'name': '[oss-security] 20140210 Xen Security Advisory 84 (CVE-2014-1891,CVE-2014-1892,CVE-2014-1893,CVE-2014-1894) - integer overflow in several XSM/Flask hypercalls', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/10/8'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://xenbits.xen.org/xsa/advisory-84.html'}, {'name': '[oss-security] 20140207 Re: Xen Security Advisory 84 - integer overflow in several XSM/Flask hypercalls', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/07/4'}, {'name': 'GLSA-201407-03', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-201407-03.xml'}, {'name': 'SUSE-SU-2014:0372', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00010.html'}, {'name': 'SUSE-SU-2014:0446', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html'}, {'name': '[oss-security] 20140207 Re: Xen Security Advisory 84 - integer overflow in several XSM/Flask hypercalls', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/07/12'}]
CVE State: PUBLISHED