Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2014-0753
Stack-based buffer overflow in the SCADA server in Ecava IntegraXor before 4.1.4390 allows remote attackers to cause a denial of service (system crash) by triggering access to DLL code located in the IntegraXor directory.
Affected Products: n/a
References: [{'name': '102171', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/102171'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.integraxor.com/blog/buffer-overflow-vulnerability-note/'}, {'tags': ['x_refsource_MISC'], 'url': 'http://ics-cert.us-cert.gov/advisories/ICSA-14-016-01'}]
CVE State: PUBLISHED
Explain CVE-2014-0754
Directory traversal vulnerability in SchneiderWEB on Schneider Electric Modicon PLC Ethernet modules 140CPU65x Exec before 5.5, 140NOC78x Exec before 1.62, 140NOE77x Exec before 6.2, BMXNOC0401 before 2.05, BMXNOE0100 before 2.9, BMXNOE0110x Exec before 6.0, TSXETC101 Exec before 2.04, TSXETY4103x Exec before 5.7, TSXETY5103x Exec before 5.9, TSXP57x ETYPort Exec before 5.7, and TSXP57x Ethernet Copro Exec before 5.5 allows remote attackers to visit arbitrary resources via a crafted HTTP request.
Affected Products: n/a
References: [{'name': '70193', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/70193'}, {'tags': ['x_refsource_MISC'], 'url': 'https://ics-cert.us-cert.gov/advisories/ICSA-14-273-01'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://download.schneider-electric.com/files?p_Reference=SEVD-2014-260-01&p_EnDocType=Software%20-%20Updates&p_File_Id=608959359&p_File_Name=SEVD-2014-260-01.pdf'}]
CVE State: PUBLISHED
Explain CVE-2014-0755
Rockwell Automation RSLogix 5000 7 through 20.01, and 21.0, does not properly implement password protection for .ACD files (aka project files), which allows local users to obtain sensitive information or modify data via unspecified vectors.
Affected Products: n/a
References: [{'name': 'rslogix-cve20140755-info-disc(90981)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/90981'}, {'tags': ['x_refsource_MISC'], 'url': 'http://ics-cert.us-cert.gov/advisories/ICSA-14-021-01'}, {'name': '102858', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/102858'}, {'name': '65337', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65337'}]
CVE State: PUBLISHED
Explain CVE-2014-0757
Smart Software Solutions (3S) CoDeSys Runtime Toolkit before 2.4.7.44 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://ics-cert.us-cert.gov/advisories/ICSA-14-030-01'}, {'name': '56713', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/56713'}]
CVE State: PUBLISHED
Explain CVE-2014-0758
An ActiveX control in GenLaunch.htm in ICONICS GENESIS32 8.0, 8.02, 8.04, and 8.05 allows remote attackers to execute arbitrary programs via a crafted HTML document.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://ics-cert.us-cert.gov/advisories/ICSA-14-051-01'}]
CVE State: PUBLISHED
Explain CVE-2014-0759
Unquoted Windows search path vulnerability in Schneider Electric Floating License Manager 1.0.0 through 1.4.0 allows local users to gain privileges via a Trojan horse application with a name composed of an initial substring of a path that contains a space character.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://ics-cert.us-cert.gov/advisories/ICSA-14-058-01'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://download.schneider-electric.com/files?p_Doc_Ref=SEVD%202014-015-01'}]
CVE State: PUBLISHED
Explain CVE-2014-0760
The Festo CECX-X-C1 Modular Master Controller with CoDeSys and CECX-X-M1 Modular Controller with CoDeSys and SoftMotion provide an undocumented access method involving the FTP protocol, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://ics-cert.us-cert.gov/advisories/ICSA-14-084-01'}]
CVE State: PUBLISHED
Explain CVE-2014-0761
The DNP3 driver in CG Automation ePAQ-9410 Substation Gateway allows remote attackers to cause a denial of service (infinite loop or process crash) via a crafted TCP packet.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://ics-cert.us-cert.gov/advisories/ICSA-14-238-01'}]
CVE State: PUBLISHED
Explain CVE-2014-0762
The DNP3 driver in CG Automation ePAQ-9410 Substation Gateway allows physically proximate attackers to cause a denial of service (infinite loop or process crash) via crafted input over a serial line.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://ics-cert.us-cert.gov/advisories/ICSA-14-238-01'}]
CVE State: PUBLISHED
Explain CVE-2014-0763
Multiple SQL injection vulnerabilities in DBVisitor.dll in Advantech WebAccess before 7.2 allow remote attackers to execute arbitrary SQL commands via SOAP requests to unspecified functions.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://ics-cert.us-cert.gov/advisories/ICSA-14-079-03'}, {'name': '66740', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/66740'}]
CVE State: PUBLISHED
Explain CVE-2014-0764
Stack-based buffer overflow in Advantech WebAccess before 7.2 allows remote attackers to execute arbitrary code via a long NodeName parameter.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://ics-cert.us-cert.gov/advisories/ICSA-14-079-03'}, {'name': '66718', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/66718'}]
CVE State: PUBLISHED
Explain CVE-2014-0765
Stack-based buffer overflow in Advantech WebAccess before 7.2 allows remote attackers to execute arbitrary code via a long GotoCmd argument.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://ics-cert.us-cert.gov/advisories/ICSA-14-079-03'}, {'name': '66722', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/66722'}]
CVE State: PUBLISHED
Explain CVE-2014-0766
Stack-based buffer overflow in Advantech WebAccess before 7.2 allows remote attackers to execute arbitrary code via a long NodeName2 argument.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://ics-cert.us-cert.gov/advisories/ICSA-14-079-03'}, {'name': '66725', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/66725'}]
CVE State: PUBLISHED
Explain CVE-2014-0767
Stack-based buffer overflow in Advantech WebAccess before 7.2 allows remote attackers to execute arbitrary code via a long AccessCode argument.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://ics-cert.us-cert.gov/advisories/ICSA-14-079-03'}, {'name': '66728', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/66728'}]
CVE State: PUBLISHED
Explain CVE-2014-0768
Stack-based buffer overflow in Advantech WebAccess before 7.2 allows remote attackers to execute arbitrary code via a long AccessCode2 argument.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://ics-cert.us-cert.gov/advisories/ICSA-14-079-03'}, {'name': '66732', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/66732'}]
CVE State: PUBLISHED
Explain CVE-2014-0769
The Festo CECX-X-C1 Modular Master Controller with CoDeSys and CECX-X-M1 Modular Controller with CoDeSys and SoftMotion do not require authentication for connections to certain TCP ports, which allows remote attackers to (1) modify the configuration via a request to the debug service on port 4000 or (2) delete log entries via a request to the log service on port 4001.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://ics-cert.us-cert.gov/advisories/ICSA-14-084-01'}]
CVE State: PUBLISHED
Explain CVE-2014-0770
Stack-based buffer overflow in Advantech WebAccess before 7.2 allows remote attackers to execute arbitrary code via a long UserName parameter.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://ics-cert.us-cert.gov/advisories/ICSA-14-079-03'}]
CVE State: PUBLISHED
Explain CVE-2014-0771
The OpenUrlToBuffer method in the BWOCXRUN.BwocxrunCtrl.1 ActiveX control in bwocxrun.ocx in Advantech WebAccess before 7.2 allows remote attackers to read arbitrary files via a file: URL.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://ics-cert.us-cert.gov/advisories/ICSA-14-079-03'}]
CVE State: PUBLISHED
Explain CVE-2014-0772
The OpenUrlToBufferTimeout method in the BWOCXRUN.BwocxrunCtrl.1 ActiveX control in bwocxrun.ocx in Advantech WebAccess before 7.2 allows remote attackers to read arbitrary files via a file: URL.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://ics-cert.us-cert.gov/advisories/ICSA-14-079-03'}]
CVE State: PUBLISHED
Explain CVE-2014-0773
The CreateProcess method in the BWOCXRUN.BwocxrunCtrl.1 ActiveX control in bwocxrun.ocx in Advantech WebAccess before 7.2 allows remote attackers to execute (1) setup.exe, (2) bwvbprt.exe, and (3) bwvbprtl.exe programs from arbitrary pathnames via a crafted argument, as demonstrated by a UNC share pathname.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://ics-cert.us-cert.gov/advisories/ICSA-14-079-03'}]
CVE State: PUBLISHED
Explain CVE-2014-0774
Stack-based buffer overflow in the C++ sample client in Schneider Electric OPC Factory Server (OFS) TLXCDSUOFS33 - 3.35, TLXCDSTOFS33 - 3.35, TLXCDLUOFS33 - 3.35, TLXCDLTOFS33 - 3.35, and TLXCDLFOFS33 - 3.35 allows local users to gain privileges via vectors involving a malformed configuration file.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://ics-cert.us-cert.gov/advisories/ICSA-14-058-02'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://download.schneider-electric.com/files?p_Doc_Ref=SEVD%202014-031-01'}, {'name': '65871', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65871'}]
CVE State: PUBLISHED
Explain CVE-2014-0777
The Modbus slave/outstation driver in the OPC Drivers 1.0.20 and earlier in IOServer OPC Server allows remote attackers to cause a denial of service (out-of-bounds read and daemon crash) via a crafted packet.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://ics-cert.us-cert.gov/advisories/ICSA-14-100-01'}]
CVE State: PUBLISHED
Explain CVE-2014-0778
The TCPUploader module in Progea Movicon 11.4 before 11.4.1150 allows remote attackers to obtain potentially sensitive version information via network traffic to TCP port 10651.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://ics-cert.us-cert.gov/advisories/ICSA-14-105-01'}]
CVE State: PUBLISHED
Explain CVE-2014-0779
The PLC driver in ServerMain.exe in the Kepware KepServerEX 4 component in Schneider Electric StruxureWare SCADA Expert ClearSCADA 2010 R2 build 71.4165, 2010 R2.1 build 71.4325, 2010 R3 build 72.4560, 2010 R3.1 build 72.4644, 2013 R1 build 73.4729, 2013 R1.1 build 73.4832, 2013 R1.1a build 73.4903, 2013 R1.2 build 73.4955, and 2013 R2 build 74.5094 allows remote attackers to cause a denial of service (application crash) via a crafted OPF file (aka project file).
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://download.schneider-electric.com/files?p_Doc_Ref=SEVD%202014-024-01'}, {'tags': ['x_refsource_MISC'], 'url': 'http://ics-cert.us-cert.gov/advisories/ICSA-14-072-01'}]
CVE State: PUBLISHED
Explain CVE-2014-0780
Directory traversal vulnerability in NTWebServer in InduSoft Web Studio 7.1 before SP2 Patch 4 allows remote attackers to read administrative passwords in APP files, and consequently execute arbitrary code, via unspecified web requests.
Affected Products: n/a
References: [{'name': '42699', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/42699/'}, {'tags': ['x_refsource_MISC'], 'url': 'http://ics-cert.us-cert.gov/advisories/ICSA-14-107-02'}, {'name': '67056', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/67056'}]
CVE State: PUBLISHED
Explain CVE-2014-0781
Heap-based buffer overflow in BKCLogSvr.exe in Yokogawa CENTUM CS 3000 R3.09.50 and earlier allows remote attackers to execute arbitrary code via crafted UDP packets.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://ics-cert.us-cert.gov/advisories/ICSA-14-070-01'}, {'name': '66130', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/66130'}, {'tags': ['x_refsource_MISC'], 'url': 'https://community.rapid7.com/community/metasploit/blog/2014/03/10/yokogawa-centum-cs3000-vulnerabilities'}]
CVE State: PUBLISHED
Explain CVE-2014-0782
Stack-based buffer overflow in BKESimmgr.exe in the Expanded Test Functions package in Yokogawa CENTUM CS 1000, CENTUM CS 3000 Entry Class R3.09.50 and earlier, CENTUM VP R5.03.00 and earlier, CENTUM VP Entry Class R5.03.00 and earlier, Exaopc R3.71.02 and earlier, B/M9000CS R5.05.01 and earlier, and B/M9000 VP R7.03.01 and earlier allows remote attackers to execute arbitrary code via a crafted packet.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.yokogawa.com/dcs/security/ysar/YSAR-14-0001E.pdf'}, {'tags': ['x_refsource_MISC'], 'url': 'http://ics-cert.us-cert.gov/advisories/ICSA-14-133-01'}]
CVE State: PUBLISHED
Explain CVE-2014-0783
Stack-based buffer overflow in BKHOdeq.exe in Yokogawa CENTUM CS 3000 R3.09.50 and earlier allows remote attackers to execute arbitrary code via a crafted TCP packet.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://ics-cert.us-cert.gov/advisories/ICSA-14-070-01'}, {'name': '66111', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/66111'}, {'tags': ['x_refsource_MISC'], 'url': 'https://community.rapid7.com/community/metasploit/blog/2014/03/10/yokogawa-centum-cs3000-vulnerabilities'}]
CVE State: PUBLISHED
Explain CVE-2014-0784
Stack-based buffer overflow in BKBCopyD.exe in Yokogawa CENTUM CS 3000 R3.09.50 and earlier allows remote attackers to execute arbitrary code via a crafted TCP packet.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://ics-cert.us-cert.gov/advisories/ICSA-14-070-01'}, {'name': '66114', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/66114'}, {'tags': ['x_refsource_MISC'], 'url': 'https://community.rapid7.com/community/metasploit/blog/2014/03/10/yokogawa-centum-cs3000-vulnerabilities'}]
CVE State: PUBLISHED
Explain CVE-2014-0786
Ecava IntegraXor before 4.1.4393 allows remote attackers to read cleartext credentials for administrative accounts via SELECT statements that leverage the guest role.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.integraxor.com/blog/category/security/vulnerability-note/'}, {'tags': ['x_refsource_MISC'], 'url': 'http://ics-cert.us-cert.gov/advisories/ICSA-14-091-01'}]
CVE State: PUBLISHED
Explain CVE-2014-0787
Stack-based buffer overflow in WellinTech KingSCADA before 3.1.2.13 allows remote attackers to execute arbitrary code via a crafted packet.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://ics-cert.us-cert.gov/advisories/ICSA-14-098-02'}, {'name': '42724', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/42724/'}, {'name': '66709', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/66709'}]
CVE State: PUBLISHED
Explain CVE-2014-0789
Multiple buffer overflows in the OPC Automation 2.0 Server Object ActiveX control in Schneider Electric OPC Factory Server (OFS) TLXCDSUOFS33 3.5 and earlier, TLXCDSTOFS33 3.5 and earlier, TLXCDLUOFS33 3.5 and earlier, TLXCDLTOFS33 3.5 and earlier, and TLXCDLFOFS33 3.5 and earlier allow remote attackers to cause a denial of service via long arguments to unspecified functions.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://ics-cert.us-cert.gov/advisories/ICSA-14-093-01'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.schneider-electric.com/corporate/en/support/cybersecurity/viewer-news.page?c_filepath=/templatedata/Content/News/data/en/local/cybersecurity/general_information/2014/03/20140325_vulnerability_disclosure_opc_factory_server.xml'}]
CVE State: PUBLISHED
Explain CVE-2014-0791
Integer overflow in the license_read_scope_list function in libfreerdp/core/license.c in FreeRDP through 1.0.2 allows remote RDP servers to cause a denial of service (application crash) or possibly have unspecified other impact via a large ScopeCount value in a Scope List in a Server License Request packet.
Affected Products: n/a
References: [{'name': '[oss-security] 20140102 CVE for freerdp int overflow?', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2014/01/02/5'}, {'name': 'openSUSE-SU-2016:2400', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2016-09/msg00101.html'}, {'name': 'openSUSE-SU-2014:0862', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2014-07/msg00008.html'}, {'name': '[oss-security] 20140103 Re: CVE for freerdp int overflow?', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2014/01/03/4'}, {'name': 'openSUSE-SU-2016:2402', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2016-09/msg00102.html'}, {'name': 'MDVSA-2015:171', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2015:171'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=998941'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/sidhpurwala-huzaifa/FreeRDP/commit/e2745807c4c3e0a590c0f69a9b655dc74ebaa03e'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://advisories.mageia.org/MGASA-2014-0287.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/FreeRDP/FreeRDP/pull/1649'}, {'name': '[debian-lts-announce] 20200829 [SECURITY] [DLA 2356-1] freerdp security update', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.debian.org/debian-lts-announce/2020/08/msg00054.html'}]
CVE State: PUBLISHED
Explain CVE-2014-0792
Sonatype Nexus 1.x and 2.x before 2.7.1 allows remote attackers to create arbitrary objects and execute arbitrary code via unspecified vectors related to unmarshalling of unintended Object types.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.sonatype.org/advisories/archive/2014-01-13-Nexus'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.sonatype.com/entries/37828023-Nexus-Security-Vulnerability'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://sonatype.zendesk.com/entries/37551958-Configuring-Xstream-Whitelist'}]
CVE State: PUBLISHED
Explain CVE-2014-0793
Multiple cross-site scripting (XSS) vulnerabilities in the StackIdeas Komento (com_komento) component before 1.7.3 for Joomla! allow remote attackers to inject arbitrary web script or HTML via the (1) website or (2) latitude parameter in a comment to the default URI.
Affected Products: n/a
References: [{'name': '64659', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/64659'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://stackideas.com/downloads/changelog/komento'}, {'name': '20140123 Cross-Site Scripting (XSS) in Komento Joomla Extension', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/530873/100/0/threaded'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.htbridge.com/advisory/HTB23194'}, {'name': '31174', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/31174'}]
CVE State: PUBLISHED
Explain CVE-2014-0794
SQL injection vulnerability in the JV Comment (com_jvcomment) component before 3.0.3 for Joomla! allows remote authenticated users to execute arbitrary SQL commands via the id parameter in a comment.like action to index.php.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://extensions.joomla.org/extensions/contacts-and-feedback/articles-comments/23394'}, {'name': '64661', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/64661'}, {'name': 'joomla-jvcomment-unspecified-sql-injection(90532)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/90532'}, {'name': '20140123 SQL Injection in JV Comment Joomla Extension', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/530872/100/0/threaded'}, {'name': '101960', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/101960'}, {'name': '31175', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/31175'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.htbridge.com/advisory/HTB23195'}]
CVE State: PUBLISHED
Explain CVE-2014-0802
Directory traversal vulnerability in the aokitaka ZIP with Pass application 4.5.7 and earlier, and ZIP with Pass Pro application 6.3.8 and earlier, for Android allows attackers to overwrite or create arbitrary files via unspecified vectors.
Affected Products: n/a
References: [{'name': 'JVNDB-2014-000001', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2014-000001'}, {'name': 'JVN#88313872', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN88313872/index.html'}]
CVE State: PUBLISHED
Explain CVE-2014-0803
Directory traversal vulnerability in the tetra filer application 2.3.1 and earlier for Android 4.0.3, tetra filer free application 2.3.1 and earlier for Android 4.0.3, tetra filer application 1.5.1 and earlier for Android before 4.0.3, and tetra filer free application 1.5.1 and earlier for Android before 4.0.3 allows attackers to overwrite or create arbitrary files via unspecified vectors.
Affected Products: n/a
References: [{'name': 'JVNDB-2014-000002', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2014-000002'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://play.google.com/store/apps/details?id=jp.main.brits.android.filer.free'}, {'name': 'JVN#51285738', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN51285738/index.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://play.google.com/store/apps/details?id=jp.main.brits.android.filer.app'}]
CVE State: PUBLISHED
Explain CVE-2014-0804
Directory traversal vulnerability in the CGENE Security File Manager Pro application 1.0.6 and earlier, and Security File Manager Trial application 1.0.6 and earlier, for Android allows attackers to overwrite or create arbitrary files via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://play.google.com/store/apps/details?id=com.cgene.android.secret.filelock.free'}, {'name': 'JVN#44392991', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN44392991/index.html'}, {'name': 'JVNDB-2014-000003', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2014-000003'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://play.google.com/store/apps/details?id=com.cgene.android.secret.filelock.pro'}]
CVE State: PUBLISHED
Explain CVE-2014-0805
Directory traversal vulnerability in the NeoFiler application 5.4.3 and earlier, NeoFiler Free application 5.4.3 and earlier, and NeoFiler Lite application 2.4.2 and earlier for Android allows attackers to overwrite or create arbitrary files via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://play.google.com/store/apps/details?id=com.skyarts.android.neofiler'}, {'name': 'JVN#85716574', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN85716574/index.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://play.google.com/store/apps/details?id=com.skyarts.android.neofilerlite'}, {'name': 'JVNDB-2014-000004', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2014-000004'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.skyarts.com/products/android/neofiler/index.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://play.google.com/store/apps/details?id=com.skyarts.android.neofilerfree'}]
CVE State: PUBLISHED
Explain CVE-2014-0806
The Sleipnir Mobile application 2.12.1 and earlier and Sleipnir Mobile Black Edition application 2.12.1 and earlier for Android provide Geolocation API data without verifying user consent, which allows remote attackers to obtain sensitive location information via a web site that makes API calls.
Affected Products: n/a
References: [{'name': 'JVN#81637882', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN81637882/index.html'}, {'name': 'JVNDB-2014-000007', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2014-000007'}]
CVE State: PUBLISHED
Explain CVE-2014-0807
data/class/pages/shopping/LC_Page_Shopping_Deliv.php in LOCKON EC-CUBE 2.4.4 and earlier, and 2.11.0 through 2.12.2, allows remote attackers to modify data via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.ec-cube.net/info/weakness/weakness.php?id=56'}, {'name': 'JVN#17849447', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN17849447/index.html'}, {'name': 'JVNDB-2014-000005', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2014-000005'}]
CVE State: PUBLISHED
Explain CVE-2014-0808
The lfCheckError function in data/class/pages/shopping/LC_Page_Shopping_Multiple.php in LOCKON EC-CUBE 2.11.0 through 2.12.2 allows remote attackers to obtain sensitive shipping information via unspecified vectors.
Affected Products: n/a
References: [{'name': 'JVNDB-2014-000006', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2014-000006'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.ec-cube.net/info/weakness/weakness.php?id=57'}, {'name': 'JVN#51770585', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN51770585/index.html'}]
CVE State: PUBLISHED
Explain CVE-2014-0809
Directory traversal vulnerability in the Gapless Player SimZip (aka Simple Zip Viewer) application before 1.2.1 for Android allows remote attackers to overwrite or create arbitrary files via a crafted filename.
Affected Products: n/a
References: [{'name': 'JVN#49384502', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN49384502/index.html'}, {'name': 'JVNDB-2014-000008', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2014-000008'}, {'name': 'simple-zip-cve20140809-dir-traversal(90980)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/90980'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://play.google.com/store/apps/details?id=com.acidzazz.simzip'}]
CVE State: PUBLISHED
Explain CVE-2014-0810
Unspecified vulnerability in JustSystems Sanshiro 2007 before update 3, 2008 before update 5, 2009 before update 6, and 2010 before update 6, and Sanshiro Viewer before 2.0.2.0, allows remote attackers to execute arbitrary code via a crafted document.
Affected Products: n/a
References: [{'name': 'JVN#28011378', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN28011378/index.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.justsystems.com/jp/info/js14001.html'}, {'name': 'JVNDB-2014-000011', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2014-000011'}]
CVE State: PUBLISHED
Explain CVE-2014-0811
Cross-site scripting (XSS) vulnerability in Blackboard Vista/CE 8.0 SP6 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: n/a
References: [{'name': 'JVN#24730765', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN24730765/index.html'}, {'name': '65742', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65742'}, {'name': 'JVNDB-2014-000012', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2014-000012'}]
CVE State: PUBLISHED
Explain CVE-2014-0812
Cross-site scripting (XSS) vulnerability in KENT-WEB Joyful Note 2.8 and earlier, when Internet Explorer 7 or earlier is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.kent-web.com/bbs/joyful.html'}, {'name': '102740', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/102740'}, {'name': '65301', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65301'}, {'name': 'JVN#30718178', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN30718178/index.html'}, {'name': 'JVNDB-2014-000013', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2014-000013'}]
CVE State: PUBLISHED
Explain CVE-2014-0813
Cross-site request forgery (CSRF) vulnerability in phpMyFAQ before 2.8.6 allows remote attackers to hijack the authentication of arbitrary users for requests that modify settings.
Affected Products: n/a
References: [{'name': 'JVN#50943964', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN50943964/index.html'}, {'name': '102939', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/102939'}, {'name': 'JVNDB-2014-000016', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2014-000016'}, {'name': '65368', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65368'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.phpmyfaq.de/advisory_2014-02-04.php'}, {'name': '56006', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/56006'}, {'name': 'phpmyfaq-cve20140813-csrf(90963)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/90963'}]
CVE State: PUBLISHED
Explain CVE-2014-0814
Cross-site scripting (XSS) vulnerability in phpMyFAQ before 2.8.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: n/a
References: [{'name': 'JVNDB-2014-000015', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2014-000015'}, {'name': '65368', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65368'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.phpmyfaq.de/advisory_2014-02-04.php'}, {'name': '56006', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/56006'}, {'name': 'JVN#30050348', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN30050348/index.html'}, {'name': '102940', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/102940'}]
CVE State: PUBLISHED
Explain CVE-2014-0815
The intent: URL implementation in Opera before 18 on Android allows attackers to read local files by leveraging an interaction error, as demonstrated by reading stored cookies.
Affected Products: n/a
References: [{'name': 'opera-android-cve20140815-info-disc(91090)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/91090'}, {'name': 'JVNDB-2014-000014', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2014-000014'}, {'name': '65391', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65391'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://blogs.opera.com/security/2014/01/security-changes-features-opera-19/'}, {'name': 'JVN#23256725', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN23256725/index.html'}]
CVE State: PUBLISHED
Explain CVE-2014-0816
Unspecified vulnerability in Norman Security Suite 10.1 and earlier allows local users to gain privileges via unknown vectors.
Affected Products: n/a
References: [{'name': 'JVNDB-2014-000026', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2014-000026'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://jvn.jp/en/jp/JVN02017463/995510/index.html'}, {'name': 'JVN#02017463', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN02017463/index.html'}]
CVE State: PUBLISHED
Explain CVE-2014-0817
Cybozu Garoon 2.x through 2.5.4 and 3.x through 3.7 SP3 does not properly manage sessions, which allows remote authenticated users to impersonate arbitrary users via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://cs.cybozu.co.jp/information/gr20140225up03.php'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.cybozu.com/ja-jp/article/7992'}, {'name': 'JVNDB-2014-000021', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2014-000021'}, {'name': 'JVN#24035499', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN24035499/index.html'}]
CVE State: PUBLISHED
Explain CVE-2014-0818
Untrusted search path vulnerability in Autodesk AutoCAD before 2014 allows local users to gain privileges and execute arbitrary VBScript code via a Trojan horse FAS file in the FAS file search path.
Affected Products: n/a
References: [{'name': 'JVNDB-2014-000019', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2014-000019'}, {'name': 'JVN#33382534', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN33382534/index.html'}]
CVE State: PUBLISHED
Explain CVE-2014-0819
Untrusted search path vulnerability in Autodesk AutoCAD before 2014 allows local users to gain privileges via a Trojan horse DLL in the current working directory.
Affected Products: n/a
References: [{'name': 'JVNDB-2014-000020', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2014-000020'}, {'name': 'JVN#43254599', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN43254599/index.html'}]
CVE State: PUBLISHED
Explain CVE-2014-0820
Directory traversal vulnerability in the download feature in Cybozu Garoon 2.x through 2.5.4 and 3.x through 3.7 SP3 allows remote authenticated users to read arbitrary files via unspecified vectors.
Affected Products: n/a
References: [{'name': 'JVN#26393529', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN26393529/index.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://cs.cybozu.co.jp/information/gr20140225up05.php'}, {'name': 'JVNDB-2014-000023', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2014-000023'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.cybozu.com/ja-jp/article/7994'}, {'name': '65815', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65815'}]
CVE State: PUBLISHED
Explain CVE-2014-0821
SQL injection vulnerability in the download feature in Cybozu Garoon 2.x through 2.5.4 and 3.x through 3.7 SP3 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, a different vulnerability than CVE-2013-6930 and CVE-2013-6931.
Affected Products: n/a
References: [{'name': 'JVN#71045461', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN71045461/index.html'}, {'name': 'JVNDB-2014-000024', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2014-000024'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.cybozu.com/ja-jp/article/7993'}, {'name': '65809', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65809'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://cs.cybozu.co.jp/information/gr20140225up04.php'}]
CVE State: PUBLISHED
Explain CVE-2014-0822
The IMAP server in IBM Domino 8.5.x before 8.5.3 FP6 IF1 and 9.0.x before 9.0.1 FP1 allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors, aka SPR KLYH9F4S2Z.
Affected Products: n/a
References: [{'name': '102912', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/102912'}, {'name': '56791', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/56791'}, {'name': 'ibm-domino-cve20140822-dos(90235)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/90235'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg21663023'}]
CVE State: PUBLISHED
Explain CVE-2014-0823
IBM WebSphere Application Server (WAS) 8.x before 8.0.0.9 and 8.5.x before 8.5.5.2 allows remote attackers to read arbitrary files via a crafted URL.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg21676092'}, {'name': '67329', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/67329'}, {'name': 'PI05324', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg1PI05324'}, {'name': 'ibm-was-cve20140823-viewfiles(90498)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/90498'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg21669554'}]
CVE State: PUBLISHED
Explain CVE-2014-0824
Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 7.x before 7.1.1.8 LAFIX.20140319-0839 and 7.1.1.12 before IFIX.20140321-1336 and Tivoli IT Asset Management for IT, Tivoli Service Request Manager, Maximo Service Desk, and Change and Configuration Management Database (CCMDB) 7.x before 7.1.1.8 LAFIX.20140319-0839 and 7.1.1.12 before IFIX.20140218-1510 allows remote authenticated users to inject arbitrary web script or HTML via an attachment URL.
Affected Products: n/a
References: [{'name': 'IV52829', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg1IV52829'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg21670870'}, {'name': 'ibm-maximo-cve20140824-xss(90500)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/90500'}]
CVE State: PUBLISHED
Explain CVE-2014-0825
Cross-site scripting (XSS) vulnerability in openreport.jsp in IBM Maximo Asset Management 7.x before 7.1.1.12 IFIX.20140321-1336 and 7.5.x before 7.5.0.5 IFIX006; SmartCloud Control Desk 7.x before 7.5.0.3 and 7.5.1.x before 7.5.1.2; and Tivoli IT Asset Management for IT, Tivoli Service Request Manager, Maximo Service Desk, and Change and Configuration Management Database (CCMDB) 7.x before 7.1.1.12 IFIX.20140218-1510 allows remote authenticated users to inject arbitrary web script or HTML via a crafted report parameter.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg21670870'}, {'name': 'ibm-maximo-cve20140825-xss(90501)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/90501'}, {'name': 'IV53362', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg1IV53362'}]
CVE State: PUBLISHED
Explain CVE-2014-0827
Cross-site scripting (XSS) vulnerability in IBM InfoSphere Optim Workload Replay 1.1 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg21669093'}, {'name': 'ibm-infosphere-cve20140827-xss(90503)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/90503'}, {'name': '66621', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/66621'}]
CVE State: PUBLISHED
Explain CVE-2014-0828
Cross-site scripting (XSS) vulnerability in the WCM (Web Content Manager) UI in IBM WebSphere Portal 6.1.0.x through 6.1.0.6 CF27, 6.1.5.x through 6.1.5.3 CF27, 7.0.0.x through 7.0.0.2 CF27, and 8.0.0.x before 8.0.0.1 CF11 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg21667016'}, {'name': 'PI10734', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg1PI10734'}, {'name': 'ibm-wsportal-cve20140828-wcm-xss(90566)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/90566'}, {'name': '66556', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/66556'}]
CVE State: PUBLISHED
Explain CVE-2014-0829
Multiple buffer overflows in IBM Rational ClearCase 7.x before 7.1.2.13, 8.0.0.x before 8.0.0.10, and 8.0.1.x before 8.0.1.3 allow remote authenticated users to obtain privileged access via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-01.ibm.com/support/docview.wss?&uid=swg21662086'}, {'name': '66339', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/66339'}, {'name': 'ibm-clearcase-cve20140829-bo(90568)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/90568'}]
CVE State: PUBLISHED
Explain CVE-2014-0830
Directory traversal vulnerability in the table-export implementation in the OAC component in IBM Financial Transaction Manager (FTM) 2.0 before 2.0.0.3 and 2.1 before 2.1.0.1 allows remote authenticated users to read arbitrary files via a modified pathname.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg21662714'}, {'name': 'ibm-ftm-cve20140830-trav(90584)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/90584'}]
CVE State: PUBLISHED
Explain CVE-2014-0831
Cross-site request forgery (CSRF) vulnerability in the OAC component in IBM Financial Transaction Manager (FTM) 2.0 before 2.0.0.3 allows remote attackers to hijack the authentication of arbitrary users for requests that modify configuration data.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg21662714'}, {'name': '102766', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/102766'}, {'name': 'ibm-ftm-cve20140831-csrf(90585)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/90585'}]
CVE State: PUBLISHED
Explain CVE-2014-0832
Multiple cross-site scripting (XSS) vulnerabilities in configuration-details screens in the OAC component in IBM Financial Transaction Manager (FTM) 2.0 before 2.0.0.3 allow remote authenticated users to inject arbitrary web script or HTML via a crafted text value.
Affected Products: n/a
References: [{'name': 'ibm-ftm-cve20140832-xss(90586)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/90586'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg21662714'}]
CVE State: PUBLISHED
Explain CVE-2014-0833
The OAC component in IBM Financial Transaction Manager (FTM) 2.0 before 2.0.0.3 does not properly enforce operator-intervention requirements, which allows remote authenticated users to bypass intended access restrictions via an unspecified process step.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg21662714'}, {'name': '102767', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/102767'}, {'name': 'ibm-ftm-cve20140833-auth(90612)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/90612'}]
CVE State: PUBLISHED
Explain CVE-2014-0834
IBM General Parallel File System (GPFS) 3.4 through 3.4.0.27 and 3.5 through 3.5.0.16 allows attackers to cause a denial of service (daemon crash) via crafted arguments to a setuid program.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=isg3T1020542'}, {'name': '65297', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65297'}, {'name': 'ibm-gpfs-cve20140834-dos(90647)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/90647'}, {'name': 'IV52863', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg1IV52863'}, {'name': '102765', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/102765'}, {'name': 'IV54381', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg1IV54381'}]
CVE State: PUBLISHED
Explain CVE-2014-0835
Cross-site request forgery (CSRF) vulnerability in IBM Security QRadar SIEM 7.2 MR1 and earlier allows remote attackers to hijack the authentication of administrators for requests that modify console Auto Update settings.
Affected Products: n/a
References: [{'name': '65127', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65127'}, {'name': 'ibm-qradar-cve20140835-csrf(90678)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/90678'}, {'tags': ['x_refsource_MISC'], 'url': 'http://thomaspollet.blogspot.be/2014/01/ibm-qradar-siem-csrf-xss-mitm-rce.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg21663066'}, {'name': '102554', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/102554'}, {'name': '20140124 ADV: IBM QRadar SIEM', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2014/Jan/166'}, {'name': '56653', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/56653'}]
CVE State: PUBLISHED
Explain CVE-2014-0836
Cross-site scripting (XSS) vulnerability in IBM Security QRadar SIEM 7.2 MR1 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
Affected Products: n/a
References: [{'name': '65127', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65127'}, {'name': 'ibm-qradar-cve20140836-xss(90679)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/90679'}, {'name': '102555', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/102555'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg21663066'}, {'name': '20140124 ADV: IBM QRadar SIEM', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2014/Jan/166'}, {'name': '56653', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/56653'}]
CVE State: PUBLISHED