Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2014-1224
Incomplete blacklist vulnerability in the user registration feature in rexx Recruitment R6.1 and R7 without "fixes from 2014-01-15" allows remote attackers to conduct cross-site scripting (XSS) attacks via the oninput event handler in the fname parameter to the default URI in /reg.
Affected Products: n/a
References: [{'name': '56310', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/56310'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.redteam-pentesting.de/en/advisories/rt-sa-2014-002/-rexx-recruitment-cross-site-scripting-in-user-registration'}, {'name': '20140327 [RT-SA-2014-002] rexx Recruitment: Cross-Site Scripting in User Registration', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/531654/100/0/threaded'}, {'name': '20140327 [RT-SA-2014-002] rexx Recruitment: Cross-Site Scripting in User Registration', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2014/Mar/389'}]
CVE State: PUBLISHED
Explain CVE-2014-1226
The pipe_init_terminal function in main.c in s3dvt allows local users to gain privileges by leveraging setuid permissions and usage of bash 4.3 and earlier.  NOTE: This vulnerability exists because of an incomplete fix for CVE-2013-6876.
Affected Products: n/a
References: [{'name': '20140603 CVE-2014-1226 s3dvt Root shell (still)', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/532278/100/0/threaded'}, {'name': '20140604 CVE-2014-1226 s3dvt Root shell (still)', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2014/Jun/12'}, {'name': '[oss-security] 20140603 CVE-2014-1226 s3dvt Root shell (still)', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/06/03/13'}, {'tags': ['x_refsource_MISC'], 'url': 'http://hmarco.org/bugs/CVE-2014-1226-s3dvt_0.2.2-root-shell.html'}]
CVE State: PUBLISHED
Explain CVE-2014-1232
Cross-site scripting (XSS) vulnerability in the Foliopress WYSIWYG plugin before 2.6.8.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: n/a
References: [{'name': '64666', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/64666'}, {'name': 'foliopress-unspecified-xss(90102)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/90102'}, {'name': '56261', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/56261'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://wordpress.org/plugins/foliopress-wysiwyg/changelog'}]
CVE State: PUBLISHED
Explain CVE-2014-1233
The paratrooper-pingdom gem 1.0.0 for Ruby allows local users to obtain the App-Key, username, and password values by listing the curl process.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.vapid.dhs.org/advisories/paratrooper-api-key-pingdom.html'}, {'name': '[oss-security] 20140107 paratrooper-pingdom-1.0.0 ruby gem exposes API login credentials', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2014/01/08/1'}]
CVE State: PUBLISHED
Explain CVE-2014-1234
The paratrooper-newrelic gem 1.0.1 for Ruby allows local users to obtain the X-Api-Key value by listing the curl process.
Affected Products: n/a
References: [{'name': '[oss-security] 20140107 Paratrooper-newrelic 1.0.1 Ruby Gem exposes API key', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2014/01/08/2'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.vapid.dhs.org/advisories/paratrooper-newrelic-api.html'}]
CVE State: PUBLISHED
Explain CVE-2014-1235
Stack-based buffer overflow in the "yyerror" function in Graphviz 2.34.0 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted file.  NOTE: This vulnerability exists due to an incomplete fix for CVE-2014-0978.
Affected Products: n/a
References: [{'name': 'GLSA-201702-06', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201702-06'}, {'name': '[oss-security] 20140108 Re: CVE Request: graphviz: stack-based buffer overflow in yyerror()', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://seclists.org/oss-sec/2014/q1/54'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/ellson/graphviz/commit/d266bb2b4154d11c27252b56d86963aef4434750'}, {'name': 'graphviz-cve20141235-bo(90198)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/90198'}, {'name': '64736', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/64736'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1050871'}]
CVE State: PUBLISHED
Explain CVE-2014-1236
Stack-based buffer overflow in the chkNum function in lib/cgraph/scan.l in Graphviz 2.34.0 allows remote attackers to have unspecified impact via vectors related to a "badly formed number" and a "long digit list."
Affected Products: n/a
References: [{'name': '[oss-security] 20140108 Re: Re: CVE Request: graphviz: stack-based buffer overflow in yyerror()', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://seclists.org/oss-sec/2014/q1/51'}, {'name': '101851', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/101851'}, {'name': 'MDVSA-2014:024', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2014:024'}, {'name': 'GLSA-201702-06', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201702-06'}, {'name': '[oss-security] 20140108 Re: CVE Request: graphviz: stack-based buffer overflow in yyerror()', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://seclists.org/oss-sec/2014/q1/54'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/ellson/graphviz/commit/1d1bdec6318746f6f19f245db589eddc887ae8ff'}, {'name': 'DSA-2843', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2014/dsa-2843'}, {'name': '[oss-security] 20140108 Re: Re: CVE Request: graphviz: stack-based buffer overflow in yyerror()', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://seclists.org/oss-sec/2014/q1/46'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1050872'}, {'name': '64737', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/64737'}, {'name': '55666', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/55666'}, {'name': '56244', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/56244'}]
CVE State: PUBLISHED
Explain CVE-2014-1237
Cross-site scripting (XSS) vulnerability in synetics i-doit pro before 1.2.4 allows remote attackers to inject arbitrary web script or HTML via the call parameter.
Affected Products: n/a
References: [{'name': '56802', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/56802'}, {'name': '65353', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65353'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.i-doit.com/en/company/news/single-news/?tx_ttnews%5Btt_news%5D=136'}, {'name': '56834', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/56834'}, {'name': '20140205 CVE-2014-1237 (XSS in i-doit Pro)', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2014/Feb/26'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.csnc.ch/misc/files/advisories/CVE-2014-1237_i-doit_Cross-site_Scripting_-_XSS.txt'}, {'name': '102910', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/102910'}, {'name': 'idoit-cve20141237-xss(90969)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/90969'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/125062'}]
CVE State: PUBLISHED
Explain CVE-2014-1238
Cross-site scripting (XSS) vulnerability in ui/common/managedlistdialog.aspx in Gael Q-Pulse 0.6 and earlier.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://seclists.org/bugtraq/2014/Jan/41'}]
CVE State: PUBLISHED
Explain CVE-2014-1242
Apple iTunes before 11.1.4 uses HTTP for the iTunes Tutorials window, which allows man-in-the-middle attackers to spoof content by gaining control over the client-server data stream.
Affected Products: n/a
References: [{'name': '65088', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65088'}, {'name': '1029671', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1029671'}, {'name': '102410', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/102410'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6001'}, {'name': 'apple-itunes-cve20141242-mitm(90653)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/90653'}]
CVE State: PUBLISHED
Explain CVE-2014-1243
Apple QuickTime before 7.7.5 does not initialize an unspecified pointer, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted track list in a movie file.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6151'}]
CVE State: PUBLISHED
Explain CVE-2014-1244
Buffer overflow in Apple QuickTime before 7.7.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted movie file with H.264 encoding.
Affected Products: n/a
References: [{'name': '65786', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65786'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6151'}]
CVE State: PUBLISHED
Explain CVE-2014-1245
Integer signedness error in Apple QuickTime before 7.7.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted stsz atom in a movie file.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6150'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6151'}]
CVE State: PUBLISHED
Explain CVE-2014-1246
Buffer overflow in Apple QuickTime before 7.7.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted ftab atom in a movie file.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6150'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6151'}]
CVE State: PUBLISHED
Explain CVE-2014-1247
Apple QuickTime before 7.7.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted dref atom in a movie file.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6150'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6151'}]
CVE State: PUBLISHED
Explain CVE-2014-1248
Buffer overflow in Apple QuickTime before 7.7.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted ldat atom in a movie file.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6150'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6151'}]
CVE State: PUBLISHED
Explain CVE-2014-1249
Buffer overflow in Apple QuickTime before 7.7.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted PSD image.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6150'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6151'}]
CVE State: PUBLISHED
Explain CVE-2014-1250
Apple QuickTime before 7.7.5 does not properly perform a byte-swapping operation, which allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds memory access and application crash) via a crafted ttfo element in a movie file.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6150'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6151'}]
CVE State: PUBLISHED
Explain CVE-2014-1251
Buffer overflow in Apple QuickTime before 7.7.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted clef atom in a movie file.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6151'}, {'name': '65787', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65787'}]
CVE State: PUBLISHED
Explain CVE-2014-1252
Double free vulnerability in Apple Pages 2.x before 2.1 and 5.x before 5.1 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted Microsoft Word file.
Affected Products: n/a
References: [{'name': 'apple-pages-cve20141252-code-exec(90672)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/90672'}, {'name': '1029683', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1029683'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6150'}, {'name': '56630', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/56630'}, {'name': '56615', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/56615'}, {'name': '65113', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65113'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6162'}, {'name': '102460', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/102460'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6117'}]
CVE State: PUBLISHED
Explain CVE-2014-1253
AppleMNT.sys in Apple Boot Camp 5 before 5.1 allows local users to cause a denial of service (kernel memory corruption) or possibly have unspecified other impact via a malformed header in a Portable Executable (PE) file.
Affected Products: n/a
References: [{'name': '103267', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/103267'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6126'}, {'name': 'APPLE-SA-2014-02-11-1', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://seclists.org/bugtraq/2014/Feb/47'}]
CVE State: PUBLISHED
Explain CVE-2014-1254
Apple Type Services (ATS) in Apple OS X before 10.9.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Type 1 font that is embedded in a document.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6150'}]
CVE State: PUBLISHED
Explain CVE-2014-1255
Apple Type Services (ATS) in Apple OS X before 10.9.2 does not properly validate calls to the free function, which allows attackers to bypass the App Sandbox protection mechanism via crafted Mach messages.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6150'}]
CVE State: PUBLISHED
Explain CVE-2014-1256
Buffer overflow in Apple Type Services (ATS) in Apple OS X before 10.9.2 allows attackers to bypass the App Sandbox protection mechanism via crafted Mach messages.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6150'}]
CVE State: PUBLISHED
Explain CVE-2014-1257
CFNetwork in Apple OS X through 10.8.5 does not remove session cookies upon a Safari reset action, which allows physically proximate attackers to bypass intended access restrictions by leveraging an unattended workstation.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6150'}]
CVE State: PUBLISHED
Explain CVE-2014-1258
Heap-based buffer overflow in CoreAnimation in Apple OS X before 10.9.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted image.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6150'}]
CVE State: PUBLISHED
Explain CVE-2014-1259
Buffer overflow in File Bookmark in Apple OS X before 10.9.2 allows attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted filename.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6150'}]
CVE State: PUBLISHED
Explain CVE-2014-1260
QuickLook in Apple OS X through 10.8.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted Microsoft Office document.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6150'}]
CVE State: PUBLISHED
Explain CVE-2014-1261
Integer signedness error in CoreText in Apple OS X before 10.9.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted Unicode font.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6150'}]
CVE State: PUBLISHED
Explain CVE-2014-1262
Apple Type Services (ATS) in Apple OS X before 10.9.2 allows attackers to bypass the App Sandbox protection mechanism via crafted Mach messages that trigger memory corruption.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6150'}]
CVE State: PUBLISHED
Explain CVE-2014-1263
curl and libcurl 7.27.0 through 7.35.0, when using the SecureTransport/Darwinssl backend, as used in in Apple OS X 10.9.x before 10.9.2, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate when accessing a URL that uses a numerical IP address, which allows man-in-the-middle attackers to spoof servers via an arbitrary valid certificate.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://gist.github.com/rmoriz/fb2b0a6a0ce10550ab73'}, {'name': '57836', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/57836'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6150'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.getchef.com/blog/2014/04/09/chef-server-11-0-12-release/'}, {'tags': ['x_refsource_MISC'], 'url': 'http://twitter.com/agl__/statuses/437029812046422016'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://curl.haxx.se/docs/adv_20140326C.html'}, {'name': '57968', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/57968'}, {'tags': ['x_refsource_MISC'], 'url': 'http://twitter.com/okoeroo/statuses/437272014043496449'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.getchef.com/blog/2014/04/09/enterprise-chef-11-1-3-release/'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.getchef.com/blog/2014/04/09/enterprise-chef-1-4-9-release/'}, {'name': '57966', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/57966'}]
CVE State: PUBLISHED
Explain CVE-2014-1264
Finder in Apple OS X before 10.9.2 does not ensure ACL integrity after the viewing of file ACL information, which allows local users to bypass intended access restrictions in opportunistic circumstances via standard filesystem operations on a file with a damaged ACL.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6150'}]
CVE State: PUBLISHED
Explain CVE-2014-1265
The systemsetup program in the Date and Time subsystem in Apple OS X before 10.9.2 allows local users to bypass intended access restrictions by changing the current time on the system clock.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6150'}]
CVE State: PUBLISHED
Explain CVE-2014-1266
The SSLVerifySignedServerKeyExchange function in libsecurity_ssl/lib/sslKeyExchange.c in the Secure Transport feature in the Data Security component in Apple iOS 6.x before 6.1.6 and 7.x before 7.0.6, Apple TV 6.x before 6.0.2, and Apple OS X 10.9.x before 10.9.2 does not check the signature in a TLS Server Key Exchange message, which allows man-in-the-middle attackers to spoof SSL servers by (1) using an arbitrary private key for the signing step or (2) omitting the signing step.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6147'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6148'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.cs.columbia.edu/~smb/blog/2014-02/2014-02-23.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6150'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6146'}, {'tags': ['x_refsource_MISC'], 'url': 'http://it.slashdot.org/comments.pl?sid=4821073&cid=46310187'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.cs.columbia.edu/~smb/blog/2014-02/2014-02-24.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.imperialviolet.org/2014/02/22/applebug.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://news.ycombinator.com/item?id=7281378'}]
CVE State: PUBLISHED
Explain CVE-2014-1267
The Configuration Profiles component in Apple iOS before 7.1 and Apple TV before 6.1 does not properly evaluate the expiration date of a mobile configuration profile, which allows attackers to bypass intended access restrictions by using a profile after the date has passed.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6163'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6162'}]
CVE State: PUBLISHED
Explain CVE-2014-1268
WebKit, as used in Apple Safari before 6.1.2 and 7.x before 7.0.2, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2014-1269 and CVE-2014-1270.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6145'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.apple.com/kb/HT6537'}]
CVE State: PUBLISHED
Explain CVE-2014-1269
WebKit, as used in Apple Safari before 6.1.2 and 7.x before 7.0.2, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2014-1268 and CVE-2014-1270.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6145'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6163'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.apple.com/kb/HT6537'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6162'}]
CVE State: PUBLISHED
Explain CVE-2014-1270
WebKit, as used in Apple Safari before 6.1.2 and 7.x before 7.0.2, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2014-1268 and CVE-2014-1269.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6145'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6163'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.apple.com/kb/HT6537'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6162'}]
CVE State: PUBLISHED
Explain CVE-2014-1271
CoreCapture in Apple iOS before 7.1 and Apple TV before 6.1 does not properly validate IOKit API calls, which allows attackers to cause a denial of service (assertion failure and device crash) via a crafted app.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6163'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6162'}]
CVE State: PUBLISHED
Explain CVE-2014-1272
CrashHouseKeeping in Crash Reporting in Apple iOS before 7.1 and Apple TV before 6.1 allows local users to change arbitrary file permissions by leveraging a symlink.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6163'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6162'}]
CVE State: PUBLISHED
Explain CVE-2014-1273
dyld in Apple iOS before 7.1 and Apple TV before 6.1 allows attackers to bypass code-signing requirements by leveraging use of text-relocation instructions in a dynamic library.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6163'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6162'}]
CVE State: PUBLISHED
Explain CVE-2014-1274
FaceTime in Apple iOS before 7.1 allows physically proximate attackers to obtain sensitive FaceTime contact information by using the lock screen for an invalid FaceTime call.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6162'}]
CVE State: PUBLISHED
Explain CVE-2014-1275
Buffer overflow in ImageIO in Apple iOS before 7.1 and Apple TV before 6.1 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted JPEG2000 data in a PDF document.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6163'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6162'}]
CVE State: PUBLISHED
Explain CVE-2014-1276
IOKit HID Event in Apple iOS before 7.1 allows attackers to conduct user-action monitoring attacks against arbitrary apps via a crafted app that accesses an IOKit framework interface.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6162'}]
CVE State: PUBLISHED
Explain CVE-2014-1278
The ptmx_get_ioctl function in the ARM kernel in Apple iOS before 7.1 and Apple TV before 6.1 allows local users to gain privileges or cause a denial of service (out-of-bounds memory access and device crash) via a crafted call.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6163'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6162'}]
CVE State: PUBLISHED
Explain CVE-2014-1280
Video Driver in Apple iOS before 7.1 and Apple TV before 6.1 allows remote attackers to cause a denial of service (NULL pointer dereference and device hang) via a crafted video file with MPEG-4 encoding.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6163'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6162'}]
CVE State: PUBLISHED
Explain CVE-2014-1281
Photos Backend in Apple iOS before 7.1 does not properly manage the asset-library cache during deletions, which allows physically proximate attackers to obtain sensitive photo data by launching the Photos app and looking under a transparent image.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6162'}]
CVE State: PUBLISHED
Explain CVE-2014-1282
The Profiles component in Apple iOS before 7.1 and Apple TV before 6.1 allows attackers to bypass intended configuration-profile visibility requirements via a long name.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6163'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6162'}]
CVE State: PUBLISHED
Explain CVE-2014-1285
Springboard in Apple iOS before 7.1 allows physically proximate attackers to bypass intended access restrictions and read the home screen by leveraging an application crash during activation of an unactivated device.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6162'}]
CVE State: PUBLISHED
Explain CVE-2014-1286
SpringBoard Lock Screen in Apple iOS before 7.1 allows remote attackers to cause a denial of service (lock-screen hang) by leveraging a state-management error.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6162'}]
CVE State: PUBLISHED
Explain CVE-2014-1287
USB Host in Apple iOS before 7.1 and Apple TV before 6.1 allows physically proximate attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted USB messages.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6163'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6162'}]
CVE State: PUBLISHED
Explain CVE-2014-1289
WebKit, as used in Apple iOS before 7.1 and Apple TV before 6.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2014-1290, CVE-2014-1291, CVE-2014-1292, CVE-2014-1293, and CVE-2014-1294.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6163'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.apple.com/kb/HT6537'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6162'}, {'name': 'APPLE-SA-2014-04-01-1', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-04/0009.html'}]
CVE State: PUBLISHED
Explain CVE-2014-1290
WebKit, as used in Apple iOS before 7.1 and Apple TV before 6.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2014-1289, CVE-2014-1291, CVE-2014-1292, CVE-2014-1293, and CVE-2014-1294.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6163'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.apple.com/kb/HT6537'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6162'}, {'name': 'APPLE-SA-2014-04-01-1', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-04/0009.html'}]
CVE State: PUBLISHED
Explain CVE-2014-1291
WebKit, as used in Apple iOS before 7.1 and Apple TV before 6.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2014-1289, CVE-2014-1290, CVE-2014-1292, CVE-2014-1293, and CVE-2014-1294.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6163'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.apple.com/kb/HT6537'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6162'}, {'name': 'APPLE-SA-2014-04-01-1', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-04/0009.html'}]
CVE State: PUBLISHED
Explain CVE-2014-1292
WebKit, as used in Apple iOS before 7.1 and Apple TV before 6.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2014-1289, CVE-2014-1290, CVE-2014-1291, CVE-2014-1293, and CVE-2014-1294.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6163'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.apple.com/kb/HT6537'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6162'}, {'name': 'APPLE-SA-2014-04-01-1', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-04/0009.html'}]
CVE State: PUBLISHED
Explain CVE-2014-1293
WebKit, as used in Apple iOS before 7.1 and Apple TV before 6.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2014-1289, CVE-2014-1290, CVE-2014-1291, CVE-2014-1292, and CVE-2014-1294.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6163'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.apple.com/kb/HT6537'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6162'}, {'name': 'APPLE-SA-2014-04-01-1', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-04/0009.html'}]
CVE State: PUBLISHED
Explain CVE-2014-1294
WebKit, as used in Apple iOS before 7.1 and Apple TV before 6.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2014-1289, CVE-2014-1290, CVE-2014-1291, CVE-2014-1292, and CVE-2014-1293.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6163'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.apple.com/kb/HT6537'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6162'}, {'name': 'APPLE-SA-2014-04-01-1', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-04/0009.html'}]
CVE State: PUBLISHED
Explain CVE-2014-1295
Secure Transport in Apple iOS before 7.1.1, Apple OS X 10.8.x and 10.9.x through 10.9.2, and Apple TV before 6.1.1 does not ensure that a server's X.509 certificate is the same during renegotiation as it was before renegotiation, which allows man-in-the-middle attackers to obtain sensitive information or modify TLS session data via a "triple handshake attack."
Affected Products: n/a
References: [{'name': 'APPLE-SA-2014-04-22-1', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-04/0134.html'}, {'name': 'APPLE-SA-2014-04-22-2', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-04/0136.html'}, {'name': 'APPLE-SA-2014-04-22-3', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-04/0135.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://secure-resumption.com/'}]
CVE State: PUBLISHED
Explain CVE-2014-1296
CFNetwork in Apple iOS before 7.1.1, Apple OS X through 10.9.2, and Apple TV before 6.1.1 does not ensure that a Set-Cookie HTTP header is complete before interpreting the header's value, which allows remote attackers to bypass intended access restrictions by triggering the closing of a TCP connection during transmission of a header, as demonstrated by an HTTPOnly restriction.
Affected Products: n/a
References: [{'name': 'APPLE-SA-2014-04-22-1', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-04/0134.html'}, {'name': 'APPLE-SA-2014-04-22-2', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-04/0136.html'}, {'name': 'APPLE-SA-2014-04-22-3', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-04/0135.html'}]
CVE State: PUBLISHED
Explain CVE-2014-1297
WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, does not properly validate WebProcess IPC messages, which allows remote attackers to bypass a sandbox protection mechanism and read arbitrary files by leveraging WebProcess access.
Affected Products: n/a
References: [{'name': 'APPLE-SA-2014-04-01-1', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-04/0009.html'}]
CVE State: PUBLISHED
Explain CVE-2014-1298
WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1.
Affected Products: n/a
References: [{'name': 'APPLE-SA-2014-04-22-2', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-04/0136.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.apple.com/kb/HT6537'}, {'name': 'APPLE-SA-2014-04-22-3', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-04/0135.html'}, {'name': 'APPLE-SA-2014-04-01-1', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-04/0009.html'}]
CVE State: PUBLISHED
Explain CVE-2014-1299
WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1.
Affected Products: n/a
References: [{'name': 'APPLE-SA-2014-04-22-2', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-04/0136.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.apple.com/kb/HT6537'}, {'name': 'APPLE-SA-2014-04-22-3', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-04/0135.html'}, {'name': 'APPLE-SA-2014-04-01-1', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-04/0009.html'}]
CVE State: PUBLISHED
Explain CVE-2014-1300
Unspecified vulnerability in Apple Safari 7.0.2 on OS X allows remote attackers to execute arbitrary code with root privileges via unknown vectors, as demonstrated by Google during a Pwn4Fun competition at CanSecWest 2014.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://twitter.com/thezdi/statuses/443796547872903168'}, {'name': 'APPLE-SA-2014-04-22-2', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-04/0136.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.apple.com/kb/HT6537'}, {'name': 'APPLE-SA-2014-04-22-3', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-04/0135.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.pwn2own.com/2014/03/pwn2own-results-for-wednesday-day-one/'}, {'name': 'APPLE-SA-2014-04-01-1', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-04/0009.html'}]
CVE State: PUBLISHED
Explain CVE-2014-1301
WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.apple.com/kb/HT6537'}, {'name': 'APPLE-SA-2014-04-01-1', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-04/0009.html'}]
CVE State: PUBLISHED
Explain CVE-2014-1302
WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1.
Affected Products: n/a
References: [{'name': 'APPLE-SA-2014-04-22-2', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-04/0136.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.apple.com/kb/HT6537'}, {'name': 'APPLE-SA-2014-04-22-3', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-04/0135.html'}, {'name': 'APPLE-SA-2014-04-01-1', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-04/0009.html'}]
CVE State: PUBLISHED
Explain CVE-2014-1303
Heap-based buffer overflow in Apple Safari 7.0.2 allows remote attackers to execute arbitrary code and bypass a sandbox protection mechanism via unspecified vectors, as demonstrated by Liang Chen during a Pwn2Own competition at CanSecWest 2014.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.pwn2own.com/2014/03/pwn2own-results-thursday-day-two/'}, {'name': 'APPLE-SA-2014-04-22-2', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-04/0136.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.apple.com/kb/HT6537'}, {'name': 'APPLE-SA-2014-04-22-3', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-04/0135.html'}, {'name': 'APPLE-SA-2014-04-01-1', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-04/0009.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://twitter.com/thezdi/statuses/444157530139136000'}]
CVE State: PUBLISHED
Explain CVE-2014-1304
WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1.
Affected Products: n/a
References: [{'name': 'APPLE-SA-2014-04-22-2', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-04/0136.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.apple.com/kb/HT6537'}, {'name': 'APPLE-SA-2014-04-22-3', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-04/0135.html'}, {'name': 'APPLE-SA-2014-04-01-1', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-04/0009.html'}]
CVE State: PUBLISHED
Explain CVE-2014-1305
WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1.
Affected Products: n/a
References: [{'name': 'APPLE-SA-2014-04-22-2', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-04/0136.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.apple.com/kb/HT6537'}, {'name': 'APPLE-SA-2014-04-22-3', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-04/0135.html'}, {'name': 'APPLE-SA-2014-04-01-1', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-04/0009.html'}]
CVE State: PUBLISHED
Explain CVE-2014-1307
WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1.
Affected Products: n/a
References: [{'name': 'APPLE-SA-2014-04-22-2', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-04/0136.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.apple.com/kb/HT6537'}, {'name': 'APPLE-SA-2014-04-22-3', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-04/0135.html'}, {'name': 'APPLE-SA-2014-04-01-1', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-04/0009.html'}]
CVE State: PUBLISHED
Explain CVE-2014-1308
WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1.
Affected Products: n/a
References: [{'name': 'APPLE-SA-2014-04-22-2', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-04/0136.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.apple.com/kb/HT6537'}, {'name': 'APPLE-SA-2014-04-22-3', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-04/0135.html'}, {'name': 'APPLE-SA-2014-04-01-1', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-04/0009.html'}]
CVE State: PUBLISHED
Explain CVE-2014-1309
WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1.
Affected Products: n/a
References: [{'name': 'APPLE-SA-2014-04-22-2', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-04/0136.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.apple.com/kb/HT6537'}, {'name': 'APPLE-SA-2014-04-22-3', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-04/0135.html'}, {'name': 'APPLE-SA-2014-04-01-1', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-04/0009.html'}]
CVE State: PUBLISHED
Explain CVE-2014-1310
WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1.
Affected Products: n/a
References: [{'name': 'APPLE-SA-2014-04-22-2', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-04/0136.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.apple.com/kb/HT6537'}, {'name': 'APPLE-SA-2014-04-22-3', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-04/0135.html'}, {'name': 'APPLE-SA-2014-04-01-1', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-04/0009.html'}]
CVE State: PUBLISHED