Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2014-0619
Untrusted search path vulnerability in Hamster Free ZIP Archiver 2.0.1.7 allows local users to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse dwmapi.dll that is located in the current working directory.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/128739/Hamster-Free-ZIP-Archiver-2.0.1.7-DLL-Hijacking.html'}, {'name': 'hamster-dll-code-execution(97658)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/97658'}]
CVE State: PUBLISHED
Explain CVE-2014-0620
Multiple cross-site scripting (XSS) vulnerabilities in Technicolor (formerly Thomson) TC7200 STD6.01.12 allow remote attackers to inject arbitrary web script or HTML via the (1) ADDNewDomain parameter to parental/website-filters.asp or (2) VmTracerouteHost parameter to goform/status/diagnostics-route.
Affected Products: n/a
References: [{'name': '30668', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/30668'}, {'name': '64672', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/64672'}]
CVE State: PUBLISHED
Explain CVE-2014-0621
Multiple cross-site request forgery (CSRF) vulnerabilities in Technicolor (formerly Thomson) TC7200 STD6.01.12 allow remote attackers to hijack the authentication of administrators for requests that (1) perform a factory reset via a request to goform/system/factory, (2) disable advanced options via a request to goform/advanced/options, (3) remove ip-filters via the IpFilterAddressDelete1 parameter to goform/advanced/ip-filters, or (4) remove firewall settings via the cbFirewall parameter to goform/advanced/firewall.
Affected Products: n/a
References: [{'name': '30667', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/30667'}]
CVE State: PUBLISHED
Explain CVE-2014-0622
The web service in EMC Documentum Foundation Services (DFS) 6.5 through 6.7 before 6.7 SP1 P22, 6.7 SP2 before P08, 7.0 before P12, and 7.1 before P01 does not properly implement content uploading, which allows remote authenticated users to bypass intended content access restrictions via unspecified vectors.
Affected Products: n/a
References: [{'name': '65398', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65398'}, {'name': 'emc-documentum-cve20140622-sec-bypass(90982)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/90982'}, {'name': '102949', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/102949'}, {'name': '20140205 ESA-2014-005: EMC Documentum Foundation Services (DFS) Content Access Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-02/0007.html'}, {'name': '56845', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/56845'}]
CVE State: PUBLISHED
Explain CVE-2014-0623
Cross-site scripting (XSS) vulnerability in the Self-Service Console in EMC RSA Authentication Manager 7.1 before SP4 P32 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to a "cross frame scripting" issue.
Affected Products: n/a
References: [{'name': '20140326 ESA-2014-015: RSA Authentication Manager Cross Frame Scripting Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-03/0146.html'}]
CVE State: PUBLISHED
Explain CVE-2014-0624
EMC RSA Data Loss Prevention (DLP) 9.x before 9.6-SP2 does not properly manage sessions, which allows remote authenticated users to gain privileges and bypass intended content-reading restrictions via unspecified vectors.
Affected Products: n/a
References: [{'name': '20140228 ESA-2014-003: RSA Data Loss Prevention Improper Session Management Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://seclists.org/bugtraq/2014/Mar/8'}]
CVE State: PUBLISHED
Explain CVE-2014-0625
The SSLSocket implementation in the (1) JSAFE and (2) JSSE APIs in EMC RSA BSAFE SSL-J 5.x before 5.1.3 and 6.x before 6.0.2 allows remote attackers to cause a denial of service (memory consumption) by triggering application-data processing during the TLS handshake, a time at which the data is internally buffered.
Affected Products: n/a
References: [{'name': '20140214 ESA-2014-009: RSA BSAFE SSL-J Multiple Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-02/0061.html'}]
CVE State: PUBLISHED
Explain CVE-2014-0626
The (1) JSAFE and (2) JSSE APIs in EMC RSA BSAFE SSL-J 5.x before 5.1.3 and 6.x before 6.0.2 make it easier for remote attackers to bypass intended cryptographic protection mechanisms by triggering application-data processing during the TLS handshake, a time at which the data is both unencrypted and unauthenticated.
Affected Products: n/a
References: [{'name': '20140214 ESA-2014-009: RSA BSAFE SSL-J Multiple Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-02/0061.html'}]
CVE State: PUBLISHED
Explain CVE-2014-0627
The SSLEngine API implementation in EMC RSA BSAFE SSL-J 5.x before 5.1.3 and 6.x before 6.0.2 allows remote attackers to trigger the selection of a weak cipher suite by using the wrap method during a certain incomplete-handshake state.
Affected Products: n/a
References: [{'name': '20140214 ESA-2014-009: RSA BSAFE SSL-J Multiple Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-02/0061.html'}]
CVE State: PUBLISHED
Explain CVE-2014-0628
The server in EMC RSA BSAFE Micro Edition Suite (MES) 4.0.x before 4.0.5 does not properly process certificate chains, which allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors.
Affected Products: n/a
References: [{'name': '20140324 ESA-2014-011: RSA BSAFE Micro Edition Suite Server Crash Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-03/0130.html'}]
CVE State: PUBLISHED
Explain CVE-2014-0629
EMC Documentum TaskSpace (TSP) 6.7SP1 before P25 and 6.7SP2 before P11 does not properly handle the interaction between the dm_world group and the dm_superusers_dynamic group, which allows remote authenticated users to obtain sensitive information and gain privileges in opportunistic circumstances by leveraging an incorrect group-addition implementation.
Affected Products: n/a
References: [{'name': '20140305 ESA-2014-012: EMC Documentum TaskSpace Multiple Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://seclists.org/bugtraq/2014/Mar/33'}]
CVE State: PUBLISHED
Explain CVE-2014-0630
EMC Documentum TaskSpace (TSP) 6.7SP1 before P25 and 6.7SP2 before P11 allows remote authenticated users to read arbitrary files via a modified imaging-service URL.
Affected Products: n/a
References: [{'name': '20140305 ESA-2014-012: EMC Documentum TaskSpace Multiple Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://seclists.org/bugtraq/2014/Mar/33'}]
CVE State: PUBLISHED
Explain CVE-2014-0632
Directory traversal vulnerability in EMC VPLEX GeoSynchrony 4.x and 5.x before 5.3 allows remote authenticated users to execute arbitrary code via unspecified vectors.
Affected Products: n/a
References: [{'name': '66513', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/66513'}, {'name': '20140326 ESA-2014-016: EMC VPLEX Multiple Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-03/0157.html'}]
CVE State: PUBLISHED
Explain CVE-2014-0633
The GUI in EMC VPLEX GeoSynchrony 4.x and 5.x before 5.3 does not properly validate session-timeout values, which might make it easier for remote attackers to execute arbitrary code by leveraging an unattended workstation.
Affected Products: n/a
References: [{'name': '20140326 ESA-2014-016: EMC VPLEX Multiple Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-03/0157.html'}]
CVE State: PUBLISHED
Explain CVE-2014-0634
EMC VPLEX GeoSynchrony 4.x and 5.x before 5.3 does not include the HTTPOnly flag in a Set-Cookie header for an unspecified cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.
Affected Products: n/a
References: [{'name': '20140326 ESA-2014-016: EMC VPLEX Multiple Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-03/0157.html'}]
CVE State: PUBLISHED
Explain CVE-2014-0635
Session fixation vulnerability in EMC VPLEX GeoSynchrony 4.x and 5.x before 5.3 allows remote attackers to hijack web sessions via unspecified vectors.
Affected Products: n/a
References: [{'name': '20140326 ESA-2014-016: EMC VPLEX Multiple Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-03/0157.html'}]
CVE State: PUBLISHED
Explain CVE-2014-0636
EMC RSA BSAFE Micro Edition Suite (MES) 3.2.x before 3.2.6 and 4.0.x before 4.0.5 does not properly validate X.509 certificate chains, which allows man-in-the-middle attackers to spoof SSL servers via a crafted certificate chain.
Affected Products: n/a
References: [{'name': '20140411 ESA-2014-019: RSA BSAFE Micro Edition Suite Certificate Chain Processing Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-04/0069.html'}, {'name': '66791', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/66791'}]
CVE State: PUBLISHED
Explain CVE-2014-0637
Cross-site scripting (XSS) vulnerability in the back-office case-management application in RSA Adaptive Authentication (On-Premise) 6.x and 7.x before 7.1 SP0 P2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: n/a
References: [{'name': '20140401 ESA-2014-020: RSA Adaptive Authentication (On-Premise) Multiple Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-04/0007.html'}]
CVE State: PUBLISHED
Explain CVE-2014-0638
Cross-site scripting (XSS) vulnerability in RSA Adaptive Authentication (On-Premise) 6.x and 7.x before 7.1 SP0 P2 allows remote attackers to inject arbitrary web script or HTML via vectors involving FRAME elements, related to a "cross-frame scripting" issue.
Affected Products: n/a
References: [{'name': '20140401 ESA-2014-020: RSA Adaptive Authentication (On-Premise) Multiple Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-04/0007.html'}]
CVE State: PUBLISHED
Explain CVE-2014-0639
Multiple cross-site scripting (XSS) vulnerabilities in EMC RSA Archer 5.x before GRC 5.4 SP1 P3 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: n/a
References: [{'name': '1030281', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1030281'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/126788/RSA-Archer-GRC-Cross-Site-Scripting.html'}, {'name': '20140523 ESA-2014-021: RSA Archer GRC Multiple Cross-Site Scripting Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-05/0134.html'}, {'name': '67602', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/67602'}]
CVE State: PUBLISHED
Explain CVE-2014-0640
EMC RSA Archer GRC Platform 5.x before 5.5 SP1 allows remote authenticated users to bypass intended restrictions on resource access via unspecified vectors.
Affected Products: n/a
References: [{'name': 'rsaarcher-cve20140640-info-disc(95362)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/95362'}, {'name': '20140819 ESA-2014-071: RSA Archer GRC Platform Multiple Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-08/0097.html'}, {'name': '1030738', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1030738'}, {'name': '69288', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/69288'}]
CVE State: PUBLISHED
Explain CVE-2014-0641
Cross-site request forgery (CSRF) vulnerability in EMC RSA Archer GRC Platform 5.x before 5.5 SP1 allows remote attackers to hijack the authentication of arbitrary users.
Affected Products: n/a
References: [{'name': '69289', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/69289'}, {'name': 'rsaarcher-cve20140641-csrf (95361)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/95361'}, {'name': '20140819 ESA-2014-071: RSA Archer GRC Platform Multiple Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-08/0097.html'}, {'name': '1030738', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1030738'}]
CVE State: PUBLISHED
Explain CVE-2014-0642
EMC Documentum Content Server before 6.7 SP1 P26, 6.7 SP2 before P13, 7.0 before P13, and 7.1 before P02 allows remote authenticated users to bypass intended access restrictions and read metadata from certain folders via unspecified vectors.
Affected Products: n/a
References: [{'name': '20140411 ESA-2014-026: EMC Documentum Content Server Information Disclosure Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-04/0072.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://twitter.com/artika4biz/statuses/455358950116823040'}]
CVE State: PUBLISHED
Explain CVE-2014-0643
EMC RSA NetWitness before 9.8.5.19 and RSA Security Analytics before 10.2.4 and 10.3.x before 10.3.2, when Kerberos PAM is enabled, do not require a password, which allows remote attackers to bypass authentication by leveraging knowledge of a valid account name.
Affected Products: n/a
References: [{'name': '20140512 ESA-2014-027: RSA NetWitness and RSA Security Analytics Authentication Bypass Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-05/0052.html'}]
CVE State: PUBLISHED
Explain CVE-2014-0644
EMC Cloud Tiering Appliance (CTA) 10 through SP1 allows remote attackers to read arbitrary files via an api/login request containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, as demonstrated by reading the /etc/shadow file.
Affected Products: n/a
References: [{'name': '20140416 ESA-2014-028: EMC Cloud Tiering Appliance XML External Entity (XXE) and Information Disclosure Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-04/0094.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://gist.github.com/brandonprry/9895721'}, {'name': '20140331 EMC CTA v10.0 unauthenticated XXE with root perms', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2014/Mar/426'}]
CVE State: PUBLISHED
Explain CVE-2014-0645
EMC Cloud Tiering Appliance (CTA) 9.x through 10 SP1 and File Management Appliance (FMA) 7.x store DES password hashes for the root, super, and admin accounts, which makes it easier for context-dependent attackers to obtain sensitive information via a brute-force attack.
Affected Products: n/a
References: [{'name': '20140416 ESA-2014-028: EMC Cloud Tiering Appliance XML External Entity (XXE) and Information Disclosure Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-04/0094.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://gist.github.com/brandonprry/9895721'}, {'name': '20140331 EMC CTA v10.0 unauthenticated XXE with root perms', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2014/Mar/426'}]
CVE State: PUBLISHED
Explain CVE-2014-0646
The runtime WS component in the server in EMC RSA Access Manager 6.1.3 before 6.1.3.39, 6.1.4 before 6.1.4.22, 6.2.0 before 6.2.0.11, and 6.2.1 before 6.2.1.03, when INFO logging is enabled, allows local users to discover cleartext passwords by reading log files.
Affected Products: n/a
References: [{'name': '20140430 ESA-2014-029: RSA Access Manager Sensitive Information Disclosure Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-04/0191.html'}]
CVE State: PUBLISHED
Explain CVE-2014-0647
The Starbucks 2.6.1 application for iOS stores sensitive information in plaintext in the Crashlytics log file (/Library/Caches/com.crashlytics.data/com.starbucks.mystarbucks/session.clslog), which allows attackers to discover usernames, passwords, and e-mail addresses via an application that reads session.clslog.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.zdnet.com/the-starbucks-bug-not-as-awful-as-reported-7000025269/'}, {'name': '20140113 [CVE-2014-0647] Insecure Data Storage of User Data Elements in Starbucks v2.6.1 iOS mobile application', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2014/Jan/64'}, {'tags': ['x_refsource_MISC'], 'url': 'https://itunes.apple.com/us/app/starbucks/id331177714?mt=8'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.zdnet.com/starbucks-fixes-ios-app-bugs-7000025323/'}, {'name': '20140114 [CVE-2014-0647] Insecure Data Storage of User Data Elements in Starbucks v2.6.1 iOS mobile application', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/530756/100/0/threaded'}, {'name': '20140117 Re: [CVE-2014-0647] Insecure Data Storage of User Data Elements in Starbucks v2.6.1 iOS mobile application', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2014/Jan/123'}, {'name': '64942', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/64942'}, {'name': '102514', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/102514'}, {'name': 'starbucks-cve20140647-info-disclosure(90412)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/90412'}]
CVE State: PUBLISHED
Explain CVE-2014-0648
The RMI interface in Cisco Secure Access Control System (ACS) 5.x before 5.5 does not properly enforce authentication and authorization requirements, which allows remote attackers to obtain administrative access via a request to this interface, aka Bug ID CSCud75187.
Affected Products: n/a
References: [{'name': '64962', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/64962'}, {'name': '56213', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/56213'}, {'name': 'cisco-acs-cve20140648-unauth-access(90431)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/90431'}, {'name': '102117', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/102117'}, {'name': '1029634', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1029634'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://tools.cisco.com/security/center/viewAlert.x?alertId=32379'}, {'name': '20140115 Multiple Vulnerabilities in Cisco Secure Access Control System', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140115-csacs'}]
CVE State: PUBLISHED
Explain CVE-2014-0649
The RMI interface in Cisco Secure Access Control System (ACS) 5.x before 5.5 does not properly enforce authorization requirements, which allows remote authenticated users to obtain superadmin access via a request to this interface, aka Bug ID CSCud75180.
Affected Products: n/a
References: [{'name': '56213', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/56213'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://tools.cisco.com/security/center/viewAlert.x?alertId=32378'}, {'name': '1029634', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1029634'}, {'name': '102116', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/102116'}, {'name': '64958', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/64958'}, {'name': 'cisco-acs-cve20140649-priv-esc(90430)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/90430'}, {'name': '20140115 Multiple Vulnerabilities in Cisco Secure Access Control System', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140115-csacs'}]
CVE State: PUBLISHED
Explain CVE-2014-0650
The web interface in Cisco Secure Access Control System (ACS) 5.x before 5.4 Patch 3 allows remote attackers to execute arbitrary operating-system commands via a request to this interface, aka Bug ID CSCue65962.
Affected Products: n/a
References: [{'name': '102115', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/102115'}, {'name': '56213', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/56213'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://tools.cisco.com/security/center/viewAlert.x?alertId=32380'}, {'name': '64964', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/64964'}, {'name': '1029634', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1029634'}, {'name': 'cisco-acs-cve20140650-command-exec(90432)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/90432'}, {'name': '20140115 Multiple Vulnerabilities in Cisco Secure Access Control System', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140115-csacs'}]
CVE State: PUBLISHED
Explain CVE-2014-0651
The administrative interface in Cisco Context Directory Agent (CDA) does not properly enforce authorization requirements, which allows remote authenticated users to obtain administrative access by hijacking a session, aka Bug ID CSCuj45347.
Affected Products: n/a
References: [{'name': '101809', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/101809'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://tools.cisco.com/security/center/viewAlert.x?alertId=32364'}, {'name': '56365', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/56365'}, {'name': '1029573', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1029573'}, {'name': '20140107 Cisco Context Directory Agent Privilege Escalation Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0651'}, {'name': 'cisco-cda-cve20140651-priv-esc(90166)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/90166'}, {'name': '64706', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/64706'}]
CVE State: PUBLISHED
Explain CVE-2014-0652
Cross-site scripting (XSS) vulnerability in the Mappings page in Cisco Context Directory Agent (CDA) allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCuj45358.
Affected Products: n/a
References: [{'name': '64703', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/64703'}, {'name': '101803', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/101803'}, {'name': '20140107 Cisco Context Directory Agent Mappings Page Cross-Site Scripting Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0652'}, {'name': '56365', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/56365'}, {'name': 'cisco-cda-cve20140652-xss(90167)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/90167'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://tools.cisco.com/security/center/viewAlert.x?alertId=32365'}, {'name': '1029572', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1029572'}]
CVE State: PUBLISHED
Explain CVE-2014-0653
The Identity Firewall (IDFW) functionality in Cisco Adaptive Security Appliance (ASA) Software allows remote attackers to trigger authentication-state modifications via a crafted NetBIOS logout probe response, aka Bug ID CSCuj45340.
Affected Products: n/a
References: [{'name': '20140107 Cisco Adaptive Security Appliance Identity Firewall NetBIOS Logout Probe Auth State Change Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0653'}, {'name': 'cisco-asa-cve20140653-sec-bypass(90165)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/90165'}, {'name': '64708', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/64708'}, {'name': '56366', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/56366'}, {'name': '1029570', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1029570'}, {'name': '101834', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/101834'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://tools.cisco.com/security/center/viewAlert.x?alertId=32363'}]
CVE State: PUBLISHED
Explain CVE-2014-0654
Cisco Context Directory Agent (CDA) allows remote attackers to modify the cache via a replay attack involving crafted RADIUS accounting messages, aka Bug ID CSCuj45383.
Affected Products: n/a
References: [{'name': '1029574', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1029574'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://tools.cisco.com/security/center/viewAlert.x?alertId=32366'}, {'name': '64709', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/64709'}, {'name': '56365', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/56365'}, {'name': '20140107 Cisco Context Directory Agent Replayed RADIUS Accounting Message Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0654'}, {'name': '101802', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/101802'}, {'name': 'cisco-cda-cve20140654-sec-bypass(90168)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/90168'}]
CVE State: PUBLISHED
Explain CVE-2014-0655
The Identity Firewall (IDFW) functionality in Cisco Adaptive Security Appliance (ASA) Software allows remote attackers to change the user-cache contents via a replay attack involving crafted RADIUS Change of Authorization (CoA) messages, aka Bug ID CSCuj45332.
Affected Products: n/a
References: [{'name': '1029575', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1029575'}, {'name': '56366', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/56366'}, {'name': '20140107 Cisco Adaptive Security Appliance RADIUS Change of Authorization Message Replay Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0655'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://tools.cisco.com/security/center/viewAlert.x?alertId=32362'}, {'name': '64700', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/64700'}, {'name': '101838', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/101838'}, {'name': 'cisco-asa-cve20140655-sec-bypass(90164)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/90164'}]
CVE State: PUBLISHED
Explain CVE-2014-0656
Cisco Context Directory Agent (CDA) allows remote authenticated users to trigger the omission of certain user-interface data via crafted field values, aka Bug ID CSCuj45353.
Affected Products: n/a
References: [{'name': 'cisco-cda-cve20140656-sec-bypass(90169)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/90169'}, {'name': '101801', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/101801'}, {'name': '1029569', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1029569'}, {'name': '64701', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/64701'}, {'name': '20140107 Cisco Context Directory Agent Hidden Input Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0656'}]
CVE State: PUBLISHED
Explain CVE-2014-0657
The administration portal in Cisco Unified Communications Manager (Unified CM) 9.1(1) and earlier does not properly handle role restrictions, which allows remote authenticated users to bypass role-based access control via multiple visits to a forbidden portal URL, aka Bug ID CSCuj83540.
Affected Products: n/a
References: [{'name': '101800', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/101800'}, {'name': 'cisco-ucm-cve20140657-sec-bypass(90120)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/90120'}, {'name': '56368', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/56368'}, {'name': '20140107 Cisco Unified Communications Manager Role Bypass Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0657'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://tools.cisco.com/security/center/viewAlert.x?alertId=32341'}, {'name': '64690', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/64690'}, {'name': '1029571', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1029571'}]
CVE State: PUBLISHED
Explain CVE-2014-0658
Cisco 9900 Unified IP phones allow remote attackers to cause a denial of service (unregistration) via a crafted SIP header, aka Bug ID CSCul24898.
Affected Products: n/a
References: [{'name': '20140110 Cisco 9900 Series IP Phone Crafted Header Unregister Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0658'}, {'name': 'cisco-unified-cve20140658-dos(90236)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/90236'}, {'name': '101913', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/101913'}, {'name': '1029596', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1029596'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://tools.cisco.com/security/center/viewAlert.x?alertId=32402'}, {'name': '56384', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/56384'}, {'name': '64770', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/64770'}]
CVE State: PUBLISHED
Explain CVE-2014-0659
The Cisco WAP4410N access point with firmware through 2.0.6.1, WRVS4400N router with firmware 1.x through 1.1.13 and 2.x through 2.0.2.1, and RVS4000 router with firmware through 2.0.3.2 allow remote attackers to read credential and configuration data, and execute arbitrary commands, via requests to the test interface on TCP port 32764, aka Bug IDs CSCum37566, CSCum43693, CSCum43700, and CSCum43685.
Affected Products: n/a
References: [{'name': '56292', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/56292'}, {'name': '20140110 Undocumented Test Interface in Cisco Small Business Devices', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140110-sbd'}, {'name': 'cisco-small-cve20140659-priv-esc(90233)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/90233'}, {'name': '64776', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/64776'}, {'name': '1029580', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1029580'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://tools.cisco.com/security/center/viewAlert.x?alertId=32381'}, {'name': '1029579', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1029579'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/elvanderb/TCP-32764'}]
CVE State: PUBLISHED
Explain CVE-2014-0660
Cisco TelePresence ISDN Gateway with software before 2.2(1.92) allows remote attackers to cause a denial of service (D-channel call outage) via a crafted Q.931 STATUS message, aka Bug ID CSCui50360.
Affected Products: n/a
References: [{'name': '65072', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65072'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://tools.cisco.com/security/center/viewAlert.x?alertId=32460'}, {'name': '20140122 Cisco TelePresence ISDN Gateway D-Channel Denial of Service Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140122-isdngw'}, {'name': '1029657', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1029657'}, {'name': 'cisco-isdn-cve20140660-dos(90622)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/90622'}, {'name': '56591', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/56591'}, {'name': '102361', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/102361'}]
CVE State: PUBLISHED
Explain CVE-2014-0661
The System Status Collection Daemon (SSCD) in Cisco TelePresence System 500-37, 1000, 1300-65, and 3xxx before 1.10.2(42), and 500-32, 1300-47, TX1310 65, and TX9xxx before 6.0.4(11), allows remote attackers to execute arbitrary commands or cause a denial of service (stack memory corruption) via a crafted XML-RPC message, aka Bug ID CSCui32796.
Affected Products: n/a
References: [{'name': '102362', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/102362'}, {'name': '20140122 Cisco TelePresence System Software Command Execution Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140122-cts'}, {'name': 'cisco-telepresence-cve20140661-command-exec(90624)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/90624'}, {'name': '65071', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65071'}, {'name': '56533', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/56533'}, {'name': '1029656', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1029656'}]
CVE State: PUBLISHED
Explain CVE-2014-0662
The SIP module in Cisco TelePresence Video Communication Server (VCS) before 8.1 allows remote attackers to cause a denial of service (process failure) via a crafted SDP message, aka Bug ID CSCue97632.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://tools.cisco.com/security/center/viewAMBAlert.x?alertId=32409'}, {'name': '65076', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65076'}, {'name': '20140122 Cisco TelePresence Video Communication Server SIP Denial of Service Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140122-vcs'}, {'name': '102363', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/102363'}, {'name': '1029655', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1029655'}, {'name': '56592', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/56592'}, {'name': 'cisco-vcs-cve20140662-dos(90621)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/90621'}]
CVE State: PUBLISHED
Explain CVE-2014-0663
Cross-site scripting (XSS) vulnerability in the web framework in Cisco Secure Access Control System (ACS) allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCum03625.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://tools.cisco.com/security/center/viewAlert.x?alertId=32403'}, {'name': '1029595', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1029595'}, {'name': '101914', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/101914'}, {'name': '64773', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/64773'}, {'name': 'cisco-acs-cve20140663-xss(90232)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/90232'}, {'name': '56382', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/56382'}, {'name': '20140110 Cisco Secure Access Control System Cross-Site Scripting Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0663'}]
CVE State: PUBLISHED
Explain CVE-2014-0664
The server in Cisco Unity Connection allows remote authenticated users to cause a denial of service (CPU consumption) via unspecified IMAP commands, aka Bug ID CSCul49976.
Affected Products: n/a
References: [{'name': '101915', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/101915'}, {'name': '1029593', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1029593'}, {'name': '20140110 Cisco Unity Connection Internet Message Access Protocol Denial of Service Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0664'}, {'name': 'cisco-unity-cve20140664-dos(90234)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/90234'}, {'name': '56370', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/56370'}, {'name': '64772', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/64772'}]
CVE State: PUBLISHED
Explain CVE-2014-0665
The RBAC implementation in Cisco Identity Services Engine (ISE) Software does not properly verify privileges for support-bundle downloads, which allows remote authenticated users to obtain sensitive information via a download action, as demonstrated by obtaining read access to the user database, aka Bug ID CSCul83904.
Affected Products: n/a
References: [{'name': 'cisco-ise-cve2040665-unsuth-access(90463)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/90463'}, {'name': '102118', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/102118'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://tools.cisco.com/security/center/viewAlert.x?alertId=32448'}, {'name': '1029624', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1029624'}, {'name': '56439', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/56439'}, {'name': '64939', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/64939'}, {'name': '20140115 Cisco ISE Unprivileged Support Bundle Download Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0665'}]
CVE State: PUBLISHED
Explain CVE-2014-0666
Directory traversal vulnerability in the Send Screen Capture implementation in Cisco Jabber 9.2(.1) and earlier on Windows allows remote attackers to upload arbitrary types of files, and consequently execute arbitrary code, via modified packets, aka Bug ID CSCug48056.
Affected Products: n/a
References: [{'name': '1029635', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1029635'}, {'name': '20140115 Cisco Jabber for Windows Remote Code Execution Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0666'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://tools.cisco.com/security/center/viewAlert.x?alertId=32451'}, {'name': '56331', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/56331'}, {'name': '64965', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/64965'}, {'name': 'cisco-jabber-cve20140666-code-exec(90435)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/90435'}, {'name': '102122', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/102122'}]
CVE State: PUBLISHED
Explain CVE-2014-0667
The RMI interface in Cisco Secure Access Control System (ACS) does not properly enforce authorization requirements, which allows remote authenticated users to read arbitrary files via a request to this interface, aka Bug ID CSCud75169.
Affected Products: n/a
References: [{'name': '1029641', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1029641'}, {'name': '64983', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/64983'}, {'name': '102168', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/102168'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://tools.cisco.com/security/center/viewAlert.x?alertId=32468'}, {'name': '20140116 Cisco Secure ACS RMI Arbitrary File Read Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0667'}, {'name': 'cisco-acs-cve20140667-info-disc(90497)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/90497'}]
CVE State: PUBLISHED
Explain CVE-2014-0668
Cross-site scripting (XSS) vulnerability in the portal in Cisco Secure Access Control System (ACS) allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCue65949.
Affected Products: n/a
References: [{'name': 'cisco-acs-cve20140668-xss(90561)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/90561'}, {'name': '20140117 Cisco Secure ACS Portal Cross-Site Scripting Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0668'}, {'name': '56543', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/56543'}, {'name': '102256', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/102256'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://tools.cisco.com/security/center/viewAlert.x?alertId=32489'}, {'name': '65016', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65016'}, {'name': '1029654', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1029654'}]
CVE State: PUBLISHED
Explain CVE-2014-0669
The Wireless Session Protocol (WSP) feature in the Gateway GPRS Support Node (GGSN) component on Cisco ASR 5000 series devices allows remote attackers to bypass intended Top-Up payment restrictions via unspecified WSP packets, aka Bug ID CSCuh28371.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://tools.cisco.com/security/center/viewAlert.x?alertId=32513'}, {'name': 'cisco-ggsn-cve20140669-sec-bypass(90614)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/90614'}, {'name': '20140121 Cisco ASR 5000 Series Gateway GPRS Support Node Traffic Bypass Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0669'}, {'name': '102318', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/102318'}, {'name': '65052', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65052'}, {'name': '56546', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/56546'}, {'name': '1029666', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1029666'}]
CVE State: PUBLISHED
Explain CVE-2014-0670
Cross-site scripting (XSS) vulnerability in the Search and Play interface in Cisco MediaSense allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCum16686.
Affected Products: n/a
References: [{'name': '1029667', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1029667'}, {'name': '56563', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/56563'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://tools.cisco.com/security/center/viewAlert.x?alertId=32514'}, {'name': '20140121 Cisco MediaSense Search and Play Cross-Site Scripting Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0670'}, {'name': '102319', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/102319'}, {'name': '65053', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65053'}, {'name': 'cisco-mediasense-cve20140670-xss(90615)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/90615'}]
CVE State: PUBLISHED