Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2014-1598
centurystar 7.12 ActiveX Control has a Stack Buffer Overflow
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://support.ixiacom.com/strikes/exploits/scada/cve_2014_1598_CenturyStar_ActiveX_Control_SetMyAddress_bo.xml'}]
CVE State: PUBLISHED
Explain CVE-2014-1599
Multiple cross-site scripting (XSS) vulnerabilities in the SFR Box router with firmware NB6-MAIN-R3.3.4 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters to (1) dns, (2) dhcp, (3) nat, (4) route, or (5) lan in network/; or (6) wifi/config.
Affected Products: n/a
References: [{'name': '65973', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65973'}, {'name': '20140305 CVE-2014-1599 - 39 Type-1 XSS in SFR DSL/Fiber Box', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/531349/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2014-1603
Multiple cross-site scripting (XSS) vulnerabilities in GetSimple CMS 3.3.1 allow remote attackers to inject arbitrary web script or HTML via the (1) param parameter to admin/load.php or (2) user, (3) email, or (4) name parameter in a Save Settings action to admin/settings.php.
Affected Products: n/a
References: [{'name': '20140513 [CVE-2014-1603] XSS in GetSimple CMS 3.3.1', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2014/May/53'}, {'tags': ['x_refsource_MISC'], 'url': 'https://raw.githubusercontent.com/pedrib/PoC/master/getsimplecms-3.3.1.txt'}, {'name': '67337', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/67337'}]
CVE State: PUBLISHED
Explain CVE-2014-1604
The parser cache functionality in parsergenerator.py in RPLY (aka python-rply) before 0.7.1 allows local users to spoof cache data by pre-creating a temporary rply-*.json file with a predictable name.
Affected Products: n/a
References: [{'name': '[oss-security] 20140114 Fwd: [Python-modules-team] Bug#735263: python-rply: insecure use of /tmp', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/01/17/8'}, {'name': 'rply-cve20141604-insecure-permissions(90593)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/90593'}, {'name': '102202', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/102202'}, {'name': '56429', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/56429'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/alex/rply/commit/fc9bbcd25b0b4f09bbd6339f710ad24c129d5d7c'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=735263'}, {'name': '[oss-security] 20140117 Re: Fwd: [Python-modules-team] Bug#735263: python-rply: insecure use of /tmp', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/01/18/4'}]
CVE State: PUBLISHED
Explain CVE-2014-1607
Cross-site scripting (XSS) vulnerability in the EventCalendar module for Drupal 7.14 allows remote attackers to inject arbitrary web script or HTML via the year parameter to eventcalander/. NOTE: this issue has been disputed by the Drupal Security Team; it may be site-specific.  If so, then this CVE will be REJECTed in the future
Affected Products: n/a
References: [{'name': '20140123 [CVE-2014-1607.] Cross Site Scripting(XSS) in Drupal Event calendar module', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/530876/100/0/threaded'}, {'name': '102574', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/102574'}, {'tags': ['x_refsource_MISC'], 'url': 'https://groups.drupal.org/node/402023'}]
CVE State: PUBLISHED
Explain CVE-2014-1608
SQL injection vulnerability in the mci_file_get function in api/soap/mc_file_api.php in MantisBT before 1.2.16 allows remote attackers to execute arbitrary SQL commands via a crafted envelope tag in a mc_issue_attachment_get SOAP request.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1063111'}, {'name': '103118', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/103118'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.ocert.org/advisories/ocert-2014-001.html'}, {'name': 'DSA-3030', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2014/dsa-3030'}, {'name': '65445', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65445'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/mantisbt/mantisbt/commit/00b4c17088fa56594d85fe46b6c6057bb3421102'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.mantisbt.org/bugs/view.php?id=16879'}, {'name': '61432', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/61432'}]
CVE State: PUBLISHED
Explain CVE-2014-1609
Multiple SQL injection vulnerabilities in MantisBT before 1.2.16 allow remote attackers to execute arbitrary SQL commands via unspecified parameters to the (1) mc_project_get_attachments function in api/soap/mc_project_api.php; the (2) news_get_limited_rows function in core/news_api.php; the (3) summary_print_by_enum, (4) summary_print_by_age, (5) summary_print_by_developer, (6) summary_print_by_reporter, or (7) summary_print_by_category function in core/summary_api.php; the (8) create_bug_enum_summary or (9) enum_bug_group function in plugins/MantisGraph/core/graph_api.php; (10) bug_graph_bycategory.php or (11) bug_graph_bystatus.php in plugins/MantisGraph/pages/; or (12) proj_doc_page.php, related to use of the db_query function, a different vulnerability than CVE-2014-1608.
Affected Products: n/a
References: [{'name': '65461', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65461'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1063111'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.ocert.org/advisories/ocert-2014-001.html'}, {'name': 'DSA-3030', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2014/dsa-3030'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/mantisbt/mantisbt/commit/7efe0175f0853e18ebfacedfd2374c4179028b3f'}, {'name': '61432', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/61432'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.mantisbt.org/bugs/view.php?id=16880'}]
CVE State: PUBLISHED
Explain CVE-2014-1610
MediaWiki 1.22.x before 1.22.2, 1.21.x before 1.21.5, and 1.19.x before 1.19.11, when DjVu or PDF file upload support is enabled, allows remote attackers to execute arbitrary commands via shell metacharacters in (1) the page parameter to includes/media/DjVu.php; (2) the w parameter (aka width field) to thumb.php, which is not properly handled by includes/media/PdfHandler_body.php; and possibly unspecified vectors in (3) includes/media/Bitmap.php and (4) includes/media/ImageHandler.php.
Affected Products: n/a
References: [{'name': '31329', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/31329/'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.checkpoint.com/threatcloud-central/articles/2014-01-28-tc-researchers-discover.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.checkpoint.com/defense/advisories/public/2014/cpai-26-jan.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.wikimedia.org/show_bug.cgi?id=60339'}, {'name': '57472', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/57472'}, {'tags': ['x_refsource_MISC'], 'url': 'https://gerrit.wikimedia.org/r/#/c/110215/'}, {'name': 'DSA-2891', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2014/dsa-2891'}, {'name': '[MediaWiki-announce] 20140128 MediaWiki Security Releases: 1.22.2, 1.21.5 and 1.19.11', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-January/000140.html'}, {'name': '1029707', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1029707'}, {'name': '65223', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65223'}, {'name': 'FEDORA-2014-1802', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127942.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://gerrit.wikimedia.org/r/#/c/110069/2/includes/media/Bitmap.php'}, {'name': '102631', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/102631'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.wikimedia.org/attachment.cgi?id=14361&action=diff'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.wikimedia.org/attachment.cgi?id=14384&action=diff'}, {'name': '56695', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/56695'}, {'tags': ['x_refsource_MISC'], 'url': 'https://gerrit.wikimedia.org/r/#/c/110069/'}, {'name': '102630', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/102630'}, {'name': 'FEDORA-2014-1745', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127948.html'}]
CVE State: PUBLISHED
Explain CVE-2014-1611
Cross-site scripting (XSS) vulnerability in the Anonymous Posting module 7.x-1.2 and 7.x-1.3 for Drupal allows remote attackers to inject arbitrary web script or HTML via the contact name field.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://drupal.org/node/2173321'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/124803/Drupal-Anonymous-Posting-7.x-Cross-Site-Scripting.html'}, {'name': '56476', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/56476'}, {'name': '102126', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/102126'}, {'name': '20140115 [Security-news] SA-CONTRIB-2014-002 - Anonymous Posting - Cross Site Scripting (XSS)', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2014/Jan/77'}, {'name': 'anonymousposting-contactname-xss(90526)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/90526'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://drupal.org/node/2173437'}]
CVE State: PUBLISHED
Explain CVE-2014-1612
Cross-site scripting (XSS) vulnerability in login.esp in the Web Management Interface in Media5 Mediatrix 4402 VoIP Gateway with firmware Dgw 1.1.13.186 and earlier allows remote attackers to inject arbitrary web script or HTML via the username parameter.
Affected Products: n/a
References: [{'name': '20140123 Reflected cross-site scripting (XSS) vulnerability in Mediatrix Web Management Interface login page', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/530871/100/0/threaded'}, {'name': 'mediatrixwebmanagement-cve20141612-xss(90656)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/90656'}, {'name': 'VU#252294', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/252294'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/124931/Mediatrix-4402-Cross-Site-Scripting.html'}, {'name': '102415', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/102415'}, {'name': '65108', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65108'}, {'name': '56638', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/56638'}]
CVE State: PUBLISHED
Explain CVE-2014-1613
Dotclear before 2.6.2 allows remote attackers to execute arbitrary PHP code via a serialized object in the dc_passwd cookie to a password-protected page, which is not properly handled by (1) inc/public/lib.urlhandlers.php or (2) plugins/pages/_public.php.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://labs.mwrinfosecurity.com/advisories/2014/05/14/dotclear-php-object-injection/'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://dotclear.org/blog/post/2014/01/20/Dotclear-2.6.2'}]
CVE State: PUBLISHED
Explain CVE-2014-1615
Multiple cross-site request forgery (CSRF) vulnerabilities in Carbon Black before 4.1.0 allow remote attackers to hijack the authentication of administrators for requests that add new administrative users and have other unspecified action, as demonstrated by a request to api/user.
Affected Products: n/a
References: [{'name': '57645', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/57645'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.secureworks.com/advisories/SWRX-2014-007/SWRX-2014-007.pdf'}]
CVE State: PUBLISHED
Explain CVE-2014-1617
Microsys PROMOTIC 8.2.13 contains an ActiveX Control Start Buffer Overflow vulnerability which can lead to denial of service.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://packetstormsecurity.com/files/cve/CVE-2014-1617'}, {'tags': ['x_refsource_MISC'], 'url': 'http://fortiguardcenter.com/encyclopedia/ips/38068'}]
CVE State: PUBLISHED
Explain CVE-2014-1618
Multiple SQL injection vulnerabilities in UAEPD Shopping Cart Script allow remote attackers to execute arbitrary SQL commands via the (1) cat_id or (2) p_id parameter to products.php or id parameter to (3) page.php or (4) news.php.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.iphobos.com/blog/2014/01/04/uaepd-script-multiple-sql-injection-vulnerabilty'}, {'name': '101899', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/101899'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/124723/uaepdshopping-sql.txt'}, {'name': 'uaepd-multiple-sql-injection(90214)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/90214'}, {'name': '64734', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/64734'}, {'name': '101859', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/101859'}, {'name': '56351', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/56351'}, {'name': '101900', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/101900'}]
CVE State: PUBLISHED
Explain CVE-2014-1619
Multiple SQL injection vulnerabilities in Cubic CMS 5.1.1, 5.1.2, and 5.2 allow remote attackers to execute arbitrary SQL commands via the (1) resource_id or (2) version_id parameter to recursos/agent.php or (3) login or (4) pass parameter to login.usuario.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.cubicfactory.com/es/cubic-cms/changelog/id/260'}, {'name': '101721', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/101721'}, {'name': '101719', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/101719'}, {'name': 'cubiccms-agent-login-sql-injection(90153)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/90153'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/124652'}]
CVE State: PUBLISHED
Explain CVE-2014-1620
Multiple cross-site scripting (XSS) vulnerabilities in add.php in HIOX Guest Book (HGB) 5.0 allow remote attackers to inject arbitrary web script or HTML via the (1) name1, (2) email, or (3) cmt parameter.
Affected Products: n/a
References: [{'name': '101844', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/101844'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/124681/Hiox-Guest-Book-5.0-Cross-Site-Scripting.html'}, {'name': '64683', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/64683'}, {'name': 'hiox-guestbook-add-xss(90156)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/90156'}]
CVE State: PUBLISHED
Explain CVE-2014-1624
Race condition in the xdg.BaseDirectory.get_runtime_dir function in python-xdg 0.25 allows local users to overwrite arbitrary files by pre-creating /tmp/pyxdg-runtime-dir-fallback-victim to point to a victim-owned location, then replacing it with a symlink to an attacker-controlled location once the get_runtime_dir function is called.
Affected Products: n/a
References: [{'name': '[oss-security] 20140121 Re: Fwd: [Python-modules-team] Bug#736247: python-xdg: get_runtime_dir(strict=False): insecure use of /tmp', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/01/21/4'}, {'tags': ['x_refsource_MISC'], 'url': 'http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=736247'}, {'name': 'pythonxdg-cve20141624-symlink(90618)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/90618'}, {'name': '65042', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65042'}, {'name': '[oss-security] 20140121 Fwd: [Python-modules-team] Bug#736247: python-xdg: get_runtime_dir(strict=False): insecure use of /tmp', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/01/21/3'}]
CVE State: PUBLISHED
Explain CVE-2014-1626
XML External Entity (XXE) vulnerability in MARC::File::XML module before 1.0.2 for Perl, as used in Evergreen, Koha, perl4lib, and possibly other products, allows context-dependent attackers to read arbitrary files via a crafted XML file.
Affected Products: n/a
References: [{'name': '102367', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/102367'}, {'name': 'marcfile-xml-info-disc(90620)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/90620'}, {'name': '55404', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/55404'}, {'name': '65057', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65057'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://metacpan.org/source/GMCHARLT/MARC-XML-1.0.2/Changes'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.nntp.perl.org/group/perl.perl4lib/2014/01/msg3073.html'}, {'name': '[Koha] 20140122 SECURITY release: MARC::File::XML 1.0.2', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://lists.katipo.co.nz/pipermail/koha/2014-January/038430.html'}, {'name': '[OPEN-ILS-GENERAL] 20140121 SECURITY release: MARC::File::XML 1.0.2', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://libmail.georgialibraries.org/pipermail/open-ils-general/2014-January/009442.html'}]
CVE State: PUBLISHED
Explain CVE-2014-1631
Eventum before 2.3.5 allows remote attackers to reinstall the application via direct request to /setup/index.php.
Affected Products: n/a
References: [{'name': '20140127 Multiple Vulnerabilities in Eventum', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/530891/100/0/threaded'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://bazaar.launchpad.net/~eventum-developers/eventum/trunk/revision/4666'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.htbridge.com/advisory/HTB23198'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.launchpad.net/eventum/+bug/1271499'}]
CVE State: PUBLISHED
Explain CVE-2014-1632
htdocs/setup/index.php in Eventum before 2.3.5 allows remote attackers to inject and execute arbitrary PHP code via the hostname parameter.
Affected Products: n/a
References: [{'name': '20140127 Multiple Vulnerabilities in Eventum', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/530891/100/0/threaded'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.htbridge.com/advisory/HTB23198'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.launchpad.net/eventum/+bug/1271499'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://bazaar.launchpad.net/~eventum-developers/eventum/trunk/revision/4665'}]
CVE State: PUBLISHED
Explain CVE-2014-1634
SQL Injection exists in Advanced Newsletter Magento extension before 2.3.5 via the /store/advancednewsletter/index/subscribeajax/an_category_id/ PATH_INFO.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://labs.integrity.pt/advisories/cve-2014-1634/'}]
CVE State: PUBLISHED
Explain CVE-2014-1635
Buffer overflow in login.cgi in MiniHttpd in Belkin N750 Router with firmware before F9K1103_WW_1.10.17m allows remote attackers to execute arbitrary code via a long string in the jump parameter.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://labs.integrity.pt/articles/from-0-day-to-exploit-buffer-overflow-in-belkin-n750-cve-2014-1635/'}, {'name': '35184', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/35184'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.belkin.com/us/support-article?articleNum=4831'}, {'tags': ['x_refsource_MISC'], 'url': 'https://labs.integrity.pt/advisories/cve-2014-1635/'}, {'name': '114345', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/show/osvdb/114345'}, {'name': '1031210', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1031210'}, {'name': '70977', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/70977'}]
CVE State: PUBLISHED
Explain CVE-2014-1636
Multiple SQL injection vulnerabilities in Command School Student Management System 1.06.01 allow remote attackers to execute arbitrary SQL commands via the id parameter in an edit action to (1) admin_school_names.php, (2) admin_subjects.php, (3) admin_grades.php, (4) admin_terms.php, (5) admin_school_years.php, (6) admin_sgrades.php, (7) admin_media_codes_1.php, (8) admin_infraction_codes.php, (9) admin_generations.php, (10) admin_relations.php, (11) admin_titles.php, or (12) health_allergies.php in sw/.
Affected Products: n/a
References: [{'name': '101879', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/101879'}, {'name': '101884', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/101884'}, {'name': '101883', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/101883'}, {'name': '101885', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/101885'}, {'name': '101874', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/101874'}, {'name': '101881', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/101881'}, {'name': '101878', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/101878'}, {'name': 'commandschool-id-sql-injection(90175)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/90175'}, {'name': '101877', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/101877'}, {'name': '64707', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/64707'}, {'name': '101880', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/101880'}, {'name': '101882', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/101882'}, {'name': '101876', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/101876'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/124708/Command-School-Student-Management-System-1.06.01-SQL-Injection-CSRF-XSS.html'}, {'name': '101875', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/101875'}]
CVE State: PUBLISHED
Explain CVE-2014-1637
Command School Student Management System 1.06.01 does not properly restrict access to sw/backup/backup_ray2.php, which allows remote attackers to download a database backup via a direct request.
Affected Products: n/a
References: [{'name': '64707', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/64707'}, {'name': '101888', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/101888'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/124708/Command-School-Student-Management-System-1.06.01-SQL-Injection-CSRF-XSS.html'}]
CVE State: PUBLISHED
Explain CVE-2014-1638
(1) debian/postrm and (2) debian/localepurge.config in localepurge before 0.7.3.2 use tempfile to create a safe temporary file but appends a suffix to the original filename and writes to this new filename, which allows local users to overwrite arbitrary files via a symlink attack on the new filename.
Affected Products: n/a
References: [{'name': '[oss-security] 20140122 Re: Getting tempfile/mktemp wrong', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/01/22/4'}, {'name': '102379', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/102379'}, {'name': 'localepurge-cve20141638-symlink(90669)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/90669'}, {'name': '65098', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65098'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=736359'}, {'name': '102381', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/102381'}, {'name': '[oss-security] 20140122 Getting tempfile/mktemp wrong', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/01/22/3'}]
CVE State: PUBLISHED
Explain CVE-2014-1639
syncevo/installcheck-local.sh in syncevolution before 1.3.99.7 uses mktemp to create a safe temporary file but appends a suffix to the original filename and writes to this new filename, which allows local users to overwrite arbitrary files via a symlink attack on the new filename.
Affected Products: n/a
References: [{'name': '[oss-security] 20140122 Re: Getting tempfile/mktemp wrong', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/01/22/4'}, {'name': 'syncevolution-cve20141639-symlink(90662)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/90662'}, {'name': '102380', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/102380'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=736357'}, {'name': '65098', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65098'}, {'name': '[oss-security] 20140122 Getting tempfile/mktemp wrong', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/01/22/3'}]
CVE State: PUBLISHED
Explain CVE-2014-1640
axiom-test.sh in axiom 20100701-1.1 uses tempfile to create a safe temporary file but appends a suffix to the original filename and writes to this new filename, which allows local users to overwrite arbitrary files via a symlink attack on the new filename.
Affected Products: n/a
References: [{'name': '[oss-security] 20140122 Re: Getting tempfile/mktemp wrong', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/01/22/4'}, {'name': '102383', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/102383'}, {'tags': ['x_refsource_MISC'], 'url': 'http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=736358'}, {'name': 'axiom-cve20141640-symlink(90663)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/90663'}, {'name': '[oss-security] 20140122 Getting tempfile/mktemp wrong', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/01/22/3'}]
CVE State: PUBLISHED
Explain CVE-2014-1642
The IRQ setup in Xen 4.2.x and 4.3.x, when using device passthrough and configured to support a large number of CPUs, frees certain memory that may still be intended for use, which allows local guest administrators to cause a denial of service (memory corruption and hypervisor crash) and possibly execute arbitrary code via vectors related to an out-of-memory error that triggers a (1) use-after-free or (2) double free.
Affected Products: n/a
References: [{'name': 'SUSE-SU-2014:0373', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00011.html'}, {'name': 'FEDORA-2014-1552', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127607.html'}, {'name': 'xen-irq-cve20141642-code-exec(90649)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/90649'}, {'name': '56557', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/56557'}, {'name': 'GLSA-201407-03', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-201407-03.xml'}, {'name': 'FEDORA-2014-1559', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127580.html'}, {'name': '[oss-security] 20140123 Xen Security Advisory 83 (CVE-2014-1642) - Out-of-memory  condition yielding memory corruption during IRQ setup', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/01/23/4'}, {'name': '102406', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/102406'}, {'name': '1029679', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1029679'}, {'name': '65097', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65097'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://xenbits.xen.org/xsa/advisory-83.html'}]
CVE State: PUBLISHED
Explain CVE-2014-1643
The Web Email Protection component in Symantec Encryption Management Server (aka PGP Universal Server) before 3.3.2 allows remote authenticated users to read the stored outbound e-mail messages of arbitrary users via a modified URL.
Affected Products: n/a
References: [{'name': '1029729', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1029729'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20140205_00'}, {'name': '65300', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65300'}, {'name': 'symantec-cve20141643-info-disc(90946)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/90946'}]
CVE State: PUBLISHED
Explain CVE-2014-1644
The forgotten-password feature in forcepasswd.do in the management GUI in Symantec LiveUpdate Administrator (LUA) 2.x before 2.3.2.110 allows remote attackers to reset arbitrary passwords by providing the e-mail address associated with a user account.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20140327_00'}, {'name': '20140328 SEC Consult SA-20140328-0 :: Multiple vulnerabilities in Symantec LiveUpdate Administrator', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-03/0172.html'}, {'name': '66399', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/66399'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140328-0_Symantec_LiveUpdate_Administrator_Multiple_vulnerabilities_wo_poc_v10.txt'}]
CVE State: PUBLISHED
Explain CVE-2014-1645
SQL injection vulnerability in forcepasswd.do in the management GUI in Symantec LiveUpdate Administrator (LUA) 2.x before 2.3.2.110 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20140327_00'}, {'name': '20140328 SEC Consult SA-20140328-0 :: Multiple vulnerabilities in Symantec LiveUpdate Administrator', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-03/0172.html'}, {'name': '66400', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/66400'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140328-0_Symantec_LiveUpdate_Administrator_Multiple_vulnerabilities_wo_poc_v10.txt'}]
CVE State: PUBLISHED
Explain CVE-2014-1646
Symantec PGP Desktop 10.0.x through 10.2.x and Encryption Desktop Professional 10.3.x before 10.3.2 MP1 do not properly perform memory copies, which allows remote attackers to cause a denial of service (read access violation and application crash) via a malformed certificate.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20140423_00'}, {'name': '67016', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/67016'}]
CVE State: PUBLISHED
Explain CVE-2014-1647
Symantec PGP Desktop 10.0.x through 10.2.x and Encryption Desktop Professional 10.3.x before 10.3.2 MP1 do not properly perform block-data moves, which allows remote attackers to cause a denial of service (read access violation and application crash) via a malformed certificate.
Affected Products: n/a
References: [{'name': '67020', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/67020'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20140423_00'}]
CVE State: PUBLISHED
Explain CVE-2014-1648
Cross-site scripting (XSS) vulnerability in brightmail/setting/compliance/DlpConnectFlow$view.flo in the management console in Symantec Messaging Gateway 10.x before 10.5.2 allows remote attackers to inject arbitrary web script or HTML via the displayTab parameter.
Affected Products: n/a
References: [{'name': '66966', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/66966'}, {'name': '1030136', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1030136'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20140422_00'}, {'name': '20140422 (CVE-2014-1648) Symantec Messaging Gateway Management Console Cross Site Scripting Vulnerability', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2014/Apr/256'}]
CVE State: PUBLISHED
Explain CVE-2014-1649
The server in Symantec Workspace Streaming (SWS) before 7.5.0.749 allows remote attackers to access files and functionality by sending a crafted XMLRPC request over HTTPS.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://zerodayinitiative.com/advisories/ZDI-14-127/'}, {'name': '67189', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/67189'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20140512_00'}, {'name': '33521', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/33521'}]
CVE State: PUBLISHED
Explain CVE-2014-1650
SQL injection vulnerability in user.php in the management console in Symantec Web Gateway (SWG) before 5.2.1 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
Affected Products: n/a
References: [{'name': '1030443', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1030443'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2014&suid=20140616_00'}, {'name': '67753', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/67753'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=securit%20y_advisory&pvid=security_advisory&year=&suid=20140616_00'}]
CVE State: PUBLISHED
Explain CVE-2014-1651
SQL injection vulnerability in clientreport.php in the management console in Symantec Web Gateway (SWG) before 5.2 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Affected Products: n/a
References: [{'name': '1030443', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1030443'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2014&suid=20140616_00'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=securit%20y_advisory&pvid=security_advisory&year=&suid=20140616_00'}, {'name': '67754', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/67754'}, {'name': 'VU#719172', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/719172'}]
CVE State: PUBLISHED
Explain CVE-2014-1652
Multiple cross-site scripting (XSS) vulnerabilities in the management console in Symantec Web Gateway (SWG) before 5.2 allow remote authenticated users to inject arbitrary web script or HTML via unspecified report parameters.
Affected Products: n/a
References: [{'name': '67755', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/67755'}, {'name': '1030443', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1030443'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2014&suid=20140616_00'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=securit%20y_advisory&pvid=security_advisory&year=&suid=20140616_00'}, {'name': 'VU#719172', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/719172'}]
CVE State: PUBLISHED
Explain CVE-2014-1663
Unspecified vulnerability in Citrix XenMobile Device Manager server (formerly Zenprise Device Manager server) 8.5, 8.6, and MDM 8.0.1 allows remote attackers to obtain sensitive information via unknown vectors.
Affected Products: n/a
References: [{'name': 'citrix-xenmobile-cve20141663-info-disc(90959)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/90959'}, {'name': '1029728', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1029728'}, {'name': '102884', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/102884'}, {'name': '65348', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65348'}, {'name': '56438', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/56438'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.citrix.com/article/CTX140044'}]
CVE State: PUBLISHED
Explain CVE-2014-1664
The Citrix GoToMeeting application 5.0.799.1238 for Android logs HTTP requests containing sensitive information, which allows attackers to obtain user IDs, meeting details, and authentication tokens via an application that reads the system log file.
Affected Products: n/a
References: [{'name': '65123', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65123'}, {'name': '20140124 [CVE-2014-1664] GoToMeeting Information Disclosure via Logging Output (Android)', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/530879/100/0/threaded'}, {'name': 'gotomeeting-cve20141664-info-disc(90695)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/90695'}, {'name': '102559', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/102559'}]
CVE State: PUBLISHED
Explain CVE-2014-1665
Cross-site scripting (XSS) vulnerability in ownCloud before 6.0.1 allows remote authenticated users to inject arbitrary web script or HTML via the filename of an uploaded file.
Affected Products: n/a
References: [{'name': '65457', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65457'}, {'tags': ['x_refsource_MISC'], 'url': 'https://packetstormsecurity.com/files/125086'}, {'name': 'owncloud-indexphp-xss(91012)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/91012'}, {'name': '31427', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/31427/'}, {'tags': ['x_refsource_MISC'], 'url': 'http://blog.noobroot.com/2014/02/owncloud-600a-when-xss-vulnerability.html'}]
CVE State: PUBLISHED
Explain CVE-2014-1666
The do_physdev_op function in Xen 4.1.5, 4.1.6.1, 4.2.2 through 4.2.3, and 4.3.x does not properly restrict access to the (1) PHYSDEVOP_prepare_msix and (2) PHYSDEVOP_release_msix operations, which allows local PV guests to cause a denial of service (host or guest malfunction) or possibly gain privileges via unspecified vectors.
Affected Products: n/a
References: [{'name': '102536', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/102536'}, {'name': '65125', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65125'}, {'name': 'xen-cve20141666-priv-esc(90675)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/90675'}, {'name': 'SUSE-SU-2014:0373', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00011.html'}, {'name': 'FEDORA-2014-1552', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127607.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.citrix.com/article/CTX200288'}, {'name': 'GLSA-201407-03', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-201407-03.xml'}, {'name': 'FEDORA-2014-1559', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127580.html'}, {'name': '[oss-security] 20140123 Xen Security Advisory 87 (CVE-2014-1666) - PHYSDEVOP_{prepare,release}_msix  exposed to unprivileged guests', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/01/24/6'}, {'name': '1029684', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1029684'}, {'name': 'SUSE-SU-2014:0372', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00010.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://xenbits.xen.org/xsa/advisory-87.html'}, {'name': '56650', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/56650'}, {'tags': ['x_refsource_MISC'], 'url': 'http://xenbits.xen.org/xsa/xsa87-unstable-4.3.patch'}]
CVE State: PUBLISHED
Explain CVE-2014-1670
The Microsoft Bing application before 4.2.1 for Android allows remote attackers to install arbitrary APK files via vectors involving a crafted DNS response.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://blog.trustlook.com/2014/01/23/trustlook-reported-microsofts-first-ever-android-vulnerability/'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.youtube.com/watch?v=_j1RKtTxZ3k'}, {'name': '102575', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/102575'}, {'name': 'ms-bing-cve20141670-code-exec(90977)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/90977'}, {'name': '65128', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65128'}, {'tags': ['x_refsource_MISC'], 'url': 'https://play.google.com/store/apps/details?id=com.microsoft.bing'}]
CVE State: PUBLISHED
Explain CVE-2014-1671
Multiple SQL injection vulnerabilities in Dell KACE K1000 5.4.76847 and possibly earlier allow remote attackers or remote authenticated users to execute arbitrary SQL commands via the macAddress element in a (1) getUploadPath or (2) getKBot SOAP request to service/kbot_service.php; the ID parameter to (3) userui/advisory_detail.php or (4) userui/ticket.php; and the (5) ORDER[] parameter to userui/ticket_list.php.
Affected Products: n/a
References: [{'name': '56396', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/56396'}, {'name': 'kace-multiple-sql-injection(90592)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/90592'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.baesystemsdetica.com.au/Research/Advisories/Dell-KACE-K1000-SQL-Injection-%28DS-2014-001%29'}, {'name': '65029', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65029'}]
CVE State: PUBLISHED
Explain CVE-2014-1672
Check Point R75.47 Security Gateway and Management Server does not properly enforce Anti-Spoofing when the routing table is modified and the "Get - Interfaces with Topology" action is performed, which allows attackers to bypass intended access restrictions.
Affected Products: n/a
References: [{'name': 'checkpoint-gateway-cve20141672-sec-bypass(90976)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/90976'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk98087'}]
CVE State: PUBLISHED
Explain CVE-2014-1673
Check Point Session Authentication Agent allows remote attackers to obtain sensitive information (user credentials) via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk98263'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/124967'}, {'name': '102418', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/102418'}, {'name': 'check-point-cve20141673-unauth-access(90746)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/90746'}, {'name': '20140127 [CVE-2014-1673] Check Point Session Authentication Agent vulnerability', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2014/Jan/185'}]
CVE State: PUBLISHED