Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2014-1894
Multiple integer overflows in unspecified suboperations in the flask hypercall in Xen 3.2.x and earlier, when XSM is enabled, allow local users to cause a denial of service (processor fault) via unspecified vectors, a different vulnerability than CVE-2014-1891, CVE-2014-1892, and CVE-2014-1893.
Affected Products: n/a
References: [{'name': 'SUSE-SU-2014:0373', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00011.html'}, {'name': '[oss-security] 20140210 Xen Security Advisory 84 (CVE-2014-1891,CVE-2014-1892,CVE-2014-1893,CVE-2014-1894) - integer overflow in several XSM/Flask hypercalls', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/10/8'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://xenbits.xen.org/xsa/advisory-84.html'}, {'name': '[oss-security] 20140207 Re: Xen Security Advisory 84 - integer overflow in several XSM/Flask hypercalls', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/07/4'}, {'name': 'GLSA-201407-03', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-201407-03.xml'}, {'name': 'SUSE-SU-2014:0372', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00010.html'}, {'name': 'SUSE-SU-2014:0446', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html'}, {'name': '[oss-security] 20140207 Re: Xen Security Advisory 84 - integer overflow in several XSM/Flask hypercalls', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/07/12'}]
CVE State: PUBLISHED
Explain CVE-2014-1895
Off-by-one error in the flask_security_avc_cachestats function in xsm/flask/flask_op.c in Xen 4.2.x and 4.3.x, when the maximum number of physical CPUs are in use, allows local users to cause a denial of service (host crash) or obtain sensitive information from hypervisor memory by leveraging a FLASK_AVC_CACHESTAT hypercall, which triggers a buffer over-read.
Affected Products: n/a
References: [{'name': 'SUSE-SU-2014:0373', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00011.html'}, {'name': 'GLSA-201407-03', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-201407-03.xml'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://xenbits.xen.org/xsa/advisory-85.html'}, {'name': '[oss-security] 20140207 Re: Xen Security Advisory 84 - integer overflow in several XSM/Flask hypercalls', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/07/12'}, {'name': '[oss-security] 20140210 Xen Security Advisory 85 (CVE-2014-1895) - Off-by-one error in FLASK_AVC_CACHESTAT hypercall', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/10/6'}]
CVE State: PUBLISHED
Explain CVE-2014-1896
The (1) do_send and (2) do_recv functions in io.c in libvchan in Xen 4.2.x, 4.3.x, and 4.4-RC series allows local guests to cause a denial of service or possibly gain privileges via crafted xenstore ring indexes, which triggers a "read or write past the end of the ring."
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://xenbits.xen.org/xsa/xsa86.patch'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://xenbits.xen.org/xsa/advisory-86.html'}, {'name': 'SUSE-SU-2014:0373', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00011.html'}, {'name': 'GLSA-201407-03', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-201407-03.xml'}, {'name': '[oss-security] 20140210 Xen Security Advisory 86 (CVE-2014-1896) - libvchan failure handling malicious ring indexes', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/10/7'}, {'name': '[oss-security] 20140207 Re: Xen Security Advisory 84 - integer overflow in several XSM/Flask hypercalls', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/07/12'}]
CVE State: PUBLISHED
Explain CVE-2014-1899
Cross-site scripting (XSS) vulnerability in Citrix NetScaler Gateway (formerly Citrix Access Gateway Enterprise Edition) 9.x before 9.3.66.5 and 10.x before 10.1.123.9 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: n/a
References: [{'name': '1030186', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1030186'}, {'name': '67177', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/67177'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.citrix.com/article/CTX140291'}]
CVE State: PUBLISHED
Explain CVE-2014-1900
Y-Cam camera models SD range YCB003, YCK003, and YCW003; S range YCB004, YCK004, YCW004; EyeBall YCEB03; Bullet VGA YCBL03 and YCBLB3; Bullet HD 720 YCBLHD5; Y-cam Classic Range YCB002, YCK002, and YCW003; and Y-cam Original Range YCB001, YCW001, running firmware 4.30 and earlier, allow remote attackers to bypass authentication and obtain sensitive information via a leading "/./" in a request to en/account/accedit.asp.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2014-007/?fid=3850'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.y-cam.com/y-cam-security-fix/'}]
CVE State: PUBLISHED
Explain CVE-2014-1901
Y-Cam camera models SD range YCB003, YCK003, and YCW003; S range YCB004, YCK004, YCW004; EyeBall YCEB03; Bullet VGA YCBL03 and YCBLB3; Bullet HD 720 YCBLHD5; Y-cam Classic Range YCB002, YCK002, and YCW003; and Y-cam Original Range YCB001, YCW001, running firmware 4.30 and earlier, allow remote authenticated users to cause a denial of service (reboot) via a malformed (1) path parameter to en/store_main.asp, (2) item parameter to en/account/accedit.asp, or (3) emailid parameter to en/smtpclient.asp.  NOTE: this issue can be exploited without authentication by leveraging CVE-2014-1900.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2014-007/?fid=3850'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.y-cam.com/y-cam-security-fix/'}]
CVE State: PUBLISHED
Explain CVE-2014-1902
Multiple cross-site scripting (XSS) vulnerabilities in Y-Cam camera models SD range YCB003, YCK003, and YCW003; S range YCB004, YCK004, YCW004; EyeBall YCEB03; Bullet VGA YCBL03 and YCBLB3; Bullet HD 720 YCBLHD5; Y-cam Classic Range YCB002, YCK002, and YCW003; and Y-cam Original Range YCB001, YCW001, running firmware 4.30 and earlier, allow remote authenticated users to inject arbitrary web script or HTML via the (1) SYSCONTACT parameter to form/identityApply, as triggered using en/identity.asp; (2) PASSWD parameter to form/accAdd, as triggered using en/account/accedit.asp; (3) NTPSERVER parameter to form/clockApply, as triggered using en/clock.asp; (4) SERVER parameter to form/smtpclientApply, as triggered using en/smtpclient.asp; (5) SERVER parameter to form/ftpApply, as triggered using en/ftp.asp; or (6) SERVER parameter to form/httpEventApply, as triggered using en/httpevent.asp.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2014-007/?fid=3850'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.y-cam.com/y-cam-security-fix/'}]
CVE State: PUBLISHED
Explain CVE-2014-1903
admin/libraries/view.functions.php in FreePBX 2.9 before 2.9.0.14, 2.10 before 2.10.1.15, 2.11 before 2.11.0.23, and 12 before 12.0.1alpha22 does not restrict the set of functions accessible to the API handler, which allows remote attackers to execute arbitrary PHP code via the function and args parameters to admin/config.php.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://github.com/0x00string/oldays/blob/master/CVE-2014-1903.pl'}, {'name': '103240', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/103240'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://code.freepbx.org/changelog/FreePBX_Framework?cs=a29382efeb293ef4f42aa9b841dfc8eabb2d1e03'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://code.freepbx.org/changelog/FreePBX_SVN?cs=16429'}, {'name': '20140211 Re: Freepbx , php code execution exploit', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://archives.neohapsis.com/archives/fulldisclosure/2014-02/0111.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/125215/FreePBX-2.9-Remote-Code-Execution.html'}, {'name': '20140211 Freepbx , php code execution exploit', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://archives.neohapsis.com/archives/fulldisclosure/2014-02/0097.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://issues.freepbx.org/browse/FREEPBX-7123'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.freepbx.org/news/2014-02-06/security-vulnerability-notice'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://issues.freepbx.org/browse/FREEPBX-7117'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/125166/FreePBX-2.x-Code-Execution.html'}, {'name': '20140211 [CVE-2014-1903] FreePBX 2.9 through 12 RCE', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/531040/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2014-1904
Cross-site scripting (XSS) vulnerability in web/servlet/tags/form/FormTag.java in Spring MVC in Spring Framework 3.0.0 before 3.2.8 and 4.0.0 before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via the requested URI in a default action.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.gopivotal.com/security/cve-2014-1904'}, {'name': '66137', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/66137'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://jira.springsource.org/browse/SPR-11426'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/spring-projects/spring-framework/commit/741b4b229ae032bd17175b46f98673ce0bd2d485'}, {'name': '20140311 CVE-2014-1904 XSS when using Spring MVC', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/531422/100/0/threaded'}, {'name': 'RHSA-2014:0400', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2014-0400.html'}, {'name': '57915', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/57915'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://docs.spring.io/spring/docs/3.2.8.RELEASE/changelog.txt'}, {'name': '20140312 CVE-2014-1904 XSS when using Spring MVC', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2014/Mar/101'}]
CVE State: PUBLISHED
Explain CVE-2014-1905
Unrestricted file upload vulnerability in ls/vw_snapshots.php in the VideoWhisper Live Streaming Integration plugin before 4.29.5 for WordPress allows remote attackers to execute arbitrary PHP code by uploading a file with a double extension, and then accessing the file via a direct request to a wp-content/plugins/videowhisper-live-streaming-integration/ls/snapshots/ pathname, as demonstrated by a .php.jpg filename.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://www.htbridge.com/advisory/HTB23199'}]
CVE State: PUBLISHED
Explain CVE-2014-1906
Multiple cross-site scripting (XSS) vulnerabilities in the VideoWhisper Live Streaming Integration plugin before 4.29.5 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) m parameter to lb_status.php; (2) msg parameter to vc_chatlog.php; n parameter to (3) channel.php, (4) htmlchat.php, (5) video.php, or (6) videotext.php; (7) message parameter to lb_logout.php; or ct parameter to (8) lb_status.php or (9) v_status.php in ls/.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/125454'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.htbridge.com/advisory/HTB23199'}, {'name': 'videowhisper-cve20141906-xss(91477)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/91477'}]
CVE State: PUBLISHED
Explain CVE-2014-1907
Multiple directory traversal vulnerabilities in the VideoWhisper Live Streaming Integration plugin before 4.29.5 for WordPress allow remote attackers to (1) read arbitrary files via a .. (dot dot) in the s parameter to ls/rtmp_login.php or (2) delete arbitrary files via a .. (dot dot) in the s parameter to ls/rtmp_logout.php.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/125454'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.htbridge.com/advisory/HTB23199'}, {'name': 'videowhisper-cve20141907-dir-trav(91478)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/91478'}]
CVE State: PUBLISHED
Explain CVE-2014-1908
The error-handling feature in (1) bp.php, (2) videowhisper_streaming.php, and (3) ls/rtmp.inc.php in the VideoWhisper Live Streaming Integration plugin before 4.29.5 for WordPress allows remote attackers to obtain sensitive information via a direct request, which reveals the full path in an error message.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://www.htbridge.com/advisory/HTB23199'}]
CVE State: PUBLISHED
Explain CVE-2014-1909
Integer signedness error in system/core/adb/adb_client.c in Android Debug Bridge (ADB) for Android 4.4 in the Android SDK Platform Tools 18.0.1 allows ADB servers to execute arbitrary code via a negative length value, which bypasses a signed comparison and triggers a stack-based buffer overflow.
Affected Products: n/a
References: [{'name': 'openSUSE-SU-2014:0636', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2014-05/msg00038.html'}, {'name': 'openSUSE-SU-2014:0637', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2014-05/msg00039.html'}, {'name': '[oss-security] 20140208 Re: CVE Request: Multiple security issues in Android Debug Bridge (Android SDK Tools)', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://seclists.org/oss-sec/2014/q1/291'}, {'name': 'androidsdk-cve20141909-bo(91291)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/91291'}, {'name': '65403', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65403'}]
CVE State: PUBLISHED
Explain CVE-2014-1910
Citrix ShareFile Mobile and ShareFile Mobile for Tablets before 2.4.4 for Android do not verify X.509 certificates from SSL servers, which allow man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Affected Products: n/a
References: [{'name': '57020', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/57020'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.citrix.com/article/CTX140303'}, {'name': '1029791', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1029791'}]
CVE State: PUBLISHED
Explain CVE-2014-1911
The Foscam FI8910W camera with firmware before 11.37.2.55 allows remote attackers to obtain sensitive video and image data via a blank username and password.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://foscam.us/forum/mjpeg-54-firmware-bug-user-logon-bypass-t8442.html'}, {'name': 'VU#525132', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/525132'}]
CVE State: PUBLISHED
Explain CVE-2014-1912
Buffer overflow in the socket.recvfrom_into function in Modules/socketmodule.c in Python 2.5 before 2.7.7, 3.x before 3.3.4, and 3.4.x before 3.4rc1 allows remote attackers to execute arbitrary code via a crafted string.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://hg.python.org/cpython/rev/87673659d8f7'}, {'name': 'openSUSE-SU-2014:0518', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2014-04/msg00035.html'}, {'name': 'openSUSE-SU-2014:0597', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2014-05/msg00008.html'}, {'name': 'RHSA-2015:1064', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2015-1064.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://pastebin.com/raw.php?i=GHXSmNEg'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://bugs.python.org/issue20246'}, {'name': 'DSA-2880', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2014/dsa-2880'}, {'name': 'GLSA-201503-10', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201503-10'}, {'name': '65379', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65379'}, {'name': '[oss-security] 20140212 Re: CVE request? buffer overflow in socket.recvfrom_into', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/12/16'}, {'name': 'APPLE-SA-2015-08-13-2', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html'}, {'name': 'RHSA-2015:1330', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2015-1330.html'}, {'name': '31875', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/31875'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.trustedsec.com/february-2014/python-remote-code-execution-socket-recvfrom_into/'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.apple.com/kb/HT205031'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html'}, {'name': 'USN-2125-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2125-1'}, {'name': '1029831', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1029831'}]
CVE State: PUBLISHED
Explain CVE-2014-1914
Multiple cross-site scripting (XSS) vulnerabilities in Command School Student Management System 1.06.01 allow remote attackers to inject arbitrary web script or HTML via the (1) topic parameter to sw/add_topic.php or (2) nick parameter to sw/chat/message.php.
Affected Products: n/a
References: [{'name': '101891', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/101891'}, {'name': '101892', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/101892'}, {'name': 'commandschool-addtopic-xss(90178)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/90178'}, {'name': 'commandschool-message-xss(90179)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/90179'}, {'name': '64707', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/64707'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/124708/Command-School-Student-Management-System-1.06.01-SQL-Injection-CSRF-XSS.html'}]
CVE State: PUBLISHED
Explain CVE-2014-1915
Multiple cross-site request forgery (CSRF) vulnerabilities in Command School Student Management System 1.06.01 allow remote attackers to hijack the authentication of (1) administrators for requests that change the administrator password via an update action to sw/admin_change_password.php or (2) unspecified victims for requests that add a topic or blog entry to sw/add_topic.php.  NOTE: vector 2 can be leveraged to bypass the authentication requirements for exploiting vector 1 in CVE-2014-1914.
Affected Products: n/a
References: [{'name': '101889', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/101889'}, {'name': '64707', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/64707'}, {'name': '101890', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/101890'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/124708/Command-School-Student-Management-System-1.06.01-SQL-Injection-CSRF-XSS.html'}]
CVE State: PUBLISHED
Explain CVE-2014-1916
The (1) opus_packet_get_nb_frames and (2) opus_packet_get_samples_per_frame functions in the client in MumbleKit before commit fd190328a9b24d37382b269a5674b0c0c7a7e36d and Mumble for iOS 1.1 through 1.2.2 do not properly check the return value of the copyDataBlock method, which allow remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted length prefix value in an Opus voice packet.
Affected Products: n/a
References: [{'name': '102957', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/102957'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://mumble.info/security/Mumble-SA-2014-003.txt'}]
CVE State: PUBLISHED
Explain CVE-2014-1921
parcimonie before 0.8.1, when using a large keyring, sleeps for the same amount of time between fetches, which allows attackers to correlate key fetches via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://gaffer.ptitcanardnoir.org/intrigeri/files/parcimonie/App-Parcimonie-0.8.1.tar.gz'}, {'name': '[oss-security] 20140210 Re: CVE request: parcimonie (0.6 to 0.8, included) possible correlation between key fetches', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://seclists.org/oss-sec/2014/q1/308'}, {'name': 'DSA-2860', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2014/dsa-2860'}, {'name': 'parcimonie-cve20141921-info-disc(91118)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/91118'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=738134'}, {'name': '65505', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65505'}, {'name': '[oss-security] 20140210 CVE request: parcimonie (0.6 to 0.8, included) possible correlation between key fetches', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://seclists.org/oss-sec/2014/q1/305'}]
CVE State: PUBLISHED
Explain CVE-2014-1922
Absolute path traversal vulnerability in tools/pdfViewer.pl in Koha before 3.8.23, 3.10.x before 3.10.13, 3.12.x before 3.12.10, and 3.14.x before 3.14.3 allows remote attackers to read arbitrary files via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11660'}, {'tags': ['x_refsource_MISC'], 'url': 'http://koha-community.org/security-release-february-2014/'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/07/10'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/10/3'}]
CVE State: PUBLISHED
Explain CVE-2014-1923
Multiple directory traversal vulnerabilities in the (1) staff interface help editor (edithelp.pl) or (2) member-picupload.pl in Koha before 3.8.23, 3.10.x before 3.10.13, 3.12.x before 3.12.10, and 3.14.x before 3.14.3 allow remote attackers to write to arbitrary files via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://koha-community.org/security-release-february-2014/'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/07/10'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/10/3'}, {'tags': ['x_refsource_MISC'], 'url': 'http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11661'}, {'tags': ['x_refsource_MISC'], 'url': 'http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11662'}]
CVE State: PUBLISHED
Explain CVE-2014-1924
The MARC framework import/export function (admin/import_export_framework.pl) in Koha before 3.8.23, 3.10.x before 3.10.13, 3.12.x before 3.12.10, and 3.14.x before 3.14.3 does not require authentication, which allows remote attackers to conduct SQL injection attacks via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://koha-community.org/security-release-february-2014/'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/07/10'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/10/3'}, {'tags': ['x_refsource_MISC'], 'url': 'http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11666'}]
CVE State: PUBLISHED
Explain CVE-2014-1925
SQL injection vulnerability in the MARC framework import/export function (admin/import_export_framework.pl) in Koha before 3.8.23, 3.10.x before 3.10.13, 3.12.x before 3.12.10, and 3.14.x before 3.14.3 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors. NOTE: this can be leveraged by remote attackers using CVE-2014-1924.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://koha-community.org/security-release-february-2014/'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/07/10'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/10/3'}, {'tags': ['x_refsource_MISC'], 'url': 'http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11666'}]
CVE State: PUBLISHED
Explain CVE-2014-1927
The shell_quote function in python-gnupg 0.3.5 does not properly quote strings, which allows context-dependent attackers to execute arbitrary code via shell metacharacters in unspecified vectors, as demonstrated using "$(" command-substitution sequences, a different vulnerability than CVE-2014-1928.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7323.
Affected Products: n/a
References: [{'name': '56616', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/56616'}, {'name': 'DSA-2946', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2014/dsa-2946'}, {'name': '[oss-security] 20140204 Re: CVE request: python-gnupg before 0.3.5 shell injection', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://seclists.org/oss-sec/2014/q1/245'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://code.google.com/p/python-gnupg/issues/detail?id=98'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://code.google.com/p/python-gnupg/'}, {'name': '[oss-security] 20140209 Re: CVE request: python-gnupg before 0.3.5 shell injection', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://seclists.org/oss-sec/2014/q1/294'}, {'name': '59031', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/59031'}]
CVE State: PUBLISHED
Explain CVE-2014-1928
The shell_quote function in python-gnupg 0.3.5 does not properly escape characters, which allows context-dependent attackers to execute arbitrary code via shell metacharacters in unspecified vectors, as demonstrated using "\" (backslash) characters to form multi-command sequences, a different vulnerability than CVE-2014-1927.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7323.
Affected Products: n/a
References: [{'name': '56616', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/56616'}, {'name': '[oss-security] 20140204 Re: CVE request: python-gnupg before 0.3.5 shell injection', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://seclists.org/oss-sec/2014/q1/246'}, {'name': 'DSA-2946', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2014/dsa-2946'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://code.google.com/p/python-gnupg/issues/detail?id=98'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://code.google.com/p/python-gnupg/'}, {'name': '[oss-security] 20140209 Re: CVE request: python-gnupg before 0.3.5 shell injection', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://seclists.org/oss-sec/2014/q1/294'}, {'name': '59031', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/59031'}]
CVE State: PUBLISHED
Explain CVE-2014-1929
python-gnupg 0.3.5 and 0.3.6 allows context-dependent attackers to have an unspecified impact via vectors related to "option injection through positional arguments." NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7323.
Affected Products: n/a
References: [{'name': 'DSA-2946', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2014/dsa-2946'}, {'name': '[oss-security] 20140204 Re: CVE request: python-gnupg before 0.3.5 shell injection', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://seclists.org/oss-sec/2014/q1/245'}, {'name': '[oss-security] 20140212 Re: CVE request: python-gnupg before 0.3.5 shell injection', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://seclists.org/oss-sec/2014/q1/335'}, {'name': '59031', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/59031'}]
CVE State: PUBLISHED
Explain CVE-2014-1930
Visibility Software Cyber Recruiter before 8.1.00 does not use the appropriate combination of HTTPS transport and response headers to prevent access to (1) AppSelfService.aspx and (2) AgencyPortal.aspx in the browser history, which allows remote attackers to obtain sensitive information by leveraging an unattended workstation.
Affected Products: n/a
References: [{'name': 'VU#566894', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/566894'}, {'name': '102814', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/102814'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.vspublic.com/help/Cyber%20Recruiter/default.aspx?pageid=release_details'}, {'tags': ['x_refsource_MISC'], 'url': 'http://jvn.jp/vu/JVNVU97441356/index.html'}, {'name': '65305', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65305'}, {'name': '102815', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/102815'}]
CVE State: PUBLISHED
Explain CVE-2014-1931
The user login page in Visibility Software Cyber Recruiter before 8.1.00 generates different responses for invalid password-retrieval attempts depending on which data elements are incorrect, which might allow remote attackers to obtain account-related information via a series of requests.
Affected Products: n/a
References: [{'name': '65564', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65564'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.vspublic.com/help/Cyber%20Recruiter/default.aspx?pageid=release_details'}]
CVE State: PUBLISHED
Explain CVE-2014-1932
The (1) load_djpeg function in JpegImagePlugin.py, (2) Ghostscript function in EpsImagePlugin.py, (3) load function in IptcImagePlugin.py, and (4) _copy function in Image.py in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 do not properly create temporary files, which allow local users to overwrite arbitrary files and obtain sensitive information via a symlink attack on the temporary file.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737059'}, {'name': 'GLSA-201612-52', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201612-52'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/python-imaging/Pillow/commit/4e9f367dfd3f04c8f5d23f7f759ec12782e10ee7'}, {'name': '[oss-security] 20140210 Re: CVE requests: Pacemaker, Python Imaging Library, eyeD3, 9base, rc, Gamera, RPLY - insecure use of /tmp', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/11/1'}, {'name': 'USN-2168-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2168-1'}, {'name': '65511', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65511'}, {'name': 'openSUSE-SU-2014:0591', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2014-05/msg00002.html'}]
CVE State: PUBLISHED
Explain CVE-2014-1933
The (1) JpegImagePlugin.py and (2) EpsImagePlugin.py scripts in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 uses the names of temporary files on the command line, which makes it easier for local users to conduct symlink attacks by listing the processes.
Affected Products: n/a
References: [{'name': 'GLSA-201612-52', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201612-52'}, {'name': '[oss-security] 20140210 CVE requests: Pacemaker, Python Imaging Library, eyeD3, 9base, rc, Gamera, RPLY - insecure use of /tmp', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/10/15'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/python-imaging/Pillow/commit/4e9f367dfd3f04c8f5d23f7f759ec12782e10ee7'}, {'name': '[oss-security] 20140210 Re: CVE requests: Pacemaker, Python Imaging Library, eyeD3, 9base, rc, Gamera, RPLY - insecure use of /tmp', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/11/1'}, {'name': 'USN-2168-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2168-1'}, {'name': 'openSUSE-SU-2014:0591', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2014-05/msg00002.html'}, {'name': '65513', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65513'}]
CVE State: PUBLISHED
Explain CVE-2014-1934
tag.py in eyeD3 (aka python-eyed3) 7.0.3, 0.6.18, and earlier for Python allows local users to modify arbitrary files via a symlink attack on a temporary file.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737062'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1063671'}, {'name': 'openSUSE-SU-2014:0619', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2014-05/msg00027.html'}, {'name': 'openSUSE-SU-2014:0620', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2014-05/msg00028.html'}]
CVE State: PUBLISHED
Explain CVE-2014-1935
9base 1:6-6 and 1:6-7 insecurely creates temporary files which results in predictable filenames.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://security-tracker.debian.org/tracker/CVE-2014-1935'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/11/1'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737206'}]
CVE State: PUBLISHED
Explain CVE-2014-1936
rc before 1.7.1-5 insecurely creates temporary files.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/11/1'}, {'tags': ['x_refsource_MISC'], 'url': 'https://security-tracker.debian.org/tracker/CVE-2014-1936'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737125'}]
CVE State: PUBLISHED
Explain CVE-2014-1937
Gamera before 3.4.1 insecurely creates temporary files.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/11/1'}, {'tags': ['x_refsource_MISC'], 'url': 'https://security-tracker.debian.org/tracker/CVE-2014-1937'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737324'}]
CVE State: PUBLISHED
Explain CVE-2014-1938
python-rply before 0.7.4 insecurely creates temporary files.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/11/1'}, {'tags': ['x_refsource_MISC'], 'url': 'https://security-tracker.debian.org/tracker/CVE-2014-1938'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737627'}]
CVE State: PUBLISHED
Explain CVE-2014-1939
java/android/webkit/BrowserFrame.java in Android before 4.4 uses the addJavascriptInterface API in conjunction with creating an object of the SearchBoxImpl class, which allows attackers to execute arbitrary Java code by leveraging access to the searchBoxJavaBridge_ interface at certain Android API levels.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://blog.chromium.org/2013/11/introducing-chromium-powered-android.html'}, {'name': '[oss-security] 20140210 CVE-2014-1939 searchBoxJavaBridge_ in Android Jelly Bean', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2014/02/11/2'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.lenovo.com/us/en/product_security/len_6421'}]
CVE State: PUBLISHED
Explain CVE-2014-1942
Cross-site scripting (XSS) vulnerability in aal/loginverification.aspx in Pearson eSIS Enterprise Student Information System allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: n/a
References: [{'name': 'VU#163188', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/163188'}]
CVE State: PUBLISHED
Explain CVE-2014-1943
Fine Free file before 5.17 allows context-dependent attackers to cause a denial of service (infinite recursion, CPU consumption, and crash) via a crafted indirect offset value in the magic of a file.
Affected Products: n/a
References: [{'name': 'openSUSE-SU-2014:0367', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2014-03/msg00037.html'}, {'name': '[file] 20140211 segfault in magic_buffer', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://mx.gw.com/pipermail/file/2014/001330.html'}, {'name': '[file] 20142010 segfault in magic_buffer', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://mx.gw.com/pipermail/file/2014/001327.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.php.net/ChangeLog-5.php'}, {'name': '[file] 20140213 segfault in magic_buffer', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://mx.gw.com/pipermail/file/2014/001337.html'}, {'name': 'openSUSE-SU-2014:0364', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2014-03/msg00034.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6443'}, {'name': 'RHSA-2014:1765', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2014-1765.html'}, {'name': '[file] 20140211 segfault in magic_buffer', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://mx.gw.com/pipermail/file/2014/001334.html'}, {'name': 'USN-2126-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2126-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/glensc/file/blob/FILE5_17/ChangeLog'}, {'name': 'DSA-2868', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2014/dsa-2868'}, {'name': 'USN-2123-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2123-1'}, {'name': 'DSA-2861', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2014/dsa-2861'}]
CVE State: PUBLISHED
Explain CVE-2014-1944
Cross-site scripting (XSS) vulnerability in Ilch CMS 2.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the text parameter to index.php/guestbook/index/newentry.
Affected Products: n/a
References: [{'name': 'ilchcms-cve20141944-xss(91538)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/91538'}, {'name': '32076', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/32076'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.htbridge.com/advisory/HTB23203'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/IlchCMS/Ilch-2.0/commit/381e15f39d07d3cdf6aaaa25c0f2321f817935f7'}, {'name': '20140305 Cross-Site Scripting (XSS) in Ilch CMS', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/531350/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2014-1945
SQL injection vulnerability in ajax_udf.php in OpenDocMan before 1.2.7.2 allows remote attackers to execute arbitrary SQL commands via the add_value parameter.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.opendocman.com/opendocman-v1-2-7-1-release'}, {'name': '65775', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65775'}, {'name': '56189', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/56189'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.opendocman.com/opendocman-v1-2-7-2-released'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.htbridge.com/advisory/HTB23202'}]
CVE State: PUBLISHED
Explain CVE-2014-1946
OpenDocMan 1.2.7 and earlier does not properly validate allowed actions, which allows remote authenticated users to bypass an intended access restrictions and assign administrative privileges to themselves via a crafted request to signup.php.
Affected Products: n/a
References: [{'name': 'opendocman-cve20141946-sec-bypass(91577)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/91577'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.htbridge.com/advisory/HTB23202'}, {'name': '20140305 Multiple Vulnerabilities in OpenDocMan', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/531351/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2014-1947
Stack-based buffer overflow in the WritePSDImage function in coders/psd.c in ImageMagick 6.5.4 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large number of layers in a PSD image, involving the L%02ld string, a different vulnerability than CVE-2014-2030.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/12/13'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/12/2'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/13/2'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/13/5'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/19/13'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1064098'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.suse.com/support/update/announcement/2014/suse-su-20140359-1.html'}]
CVE State: PUBLISHED
Explain CVE-2014-1948
OpenStack Image Registry and Delivery Service (Glance) 2013.2 through 2013.2.1 and Icehouse before icehouse-2 logs a URL containing the Swift store backend password when authentication fails and WARNING level logging is enabled, which allows local users to obtain sensitive information by reading the log.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.launchpad.net/glance/+bug/1275062'}, {'name': '56419', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/56419'}, {'name': 'RHSA-2014:0229', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2014-0229.html'}, {'name': '65507', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65507'}, {'name': '[oss-security] 20140212 [OSSA 2014-004] Glance Swift store backend password leak  (CVE-2014-1948)', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/12/18'}]
CVE State: PUBLISHED
Explain CVE-2014-1949
GTK+ 3.10.9 and earlier, as used in cinnamon-screensaver, gnome-screensaver, and other applications, allows physically proximate attackers to bypass the lock screen by pressing the menu button.
Affected Products: n/a
References: [{'name': '[oss-security] 20140212 cinnamon-screensaver lock bypass (tested on Fedora 20)', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://seclists.org/oss-sec/2014/q1/327'}, {'name': 'USN-2475-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2475-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=759145'}, {'name': 'MDVSA-2015:162', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2015:162'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/linuxmint/cinnamon-screensaver/issues/44'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://advisories.mageia.org/MGASA-2014-0374.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1064695'}, {'name': '[oss-security] 20140212 Re: cinnamon-screensaver lock bypass (tested on Fedora 20)', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://seclists.org/oss-sec/2014/q1/331'}]
CVE State: PUBLISHED
Explain CVE-2014-1950
Use-after-free vulnerability in the xc_cpupool_getinfo function in Xen 4.1.x through 4.3.x, when using a multithreaded toolstack, does not properly handle a failure by the xc_cpumap_alloc function, which allows local users with access to management functions to cause a denial of service (heap corruption) and possibly gain privileges via unspecified vectors.
Affected Products: n/a
References: [{'name': 'SUSE-SU-2014:0373', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00011.html'}, {'name': '[oss-security] 20140212 Xen Security Advisory 88 (CVE-2014-1950) - use-after-free in xc_cpupool_getinfo() under memory pressure', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/12/17'}, {'name': 'SUSE-SU-2014:0372', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00010.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://xenbits.xen.org/xsa/advisory-88.html'}, {'name': 'DSA-3006', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2014/dsa-3006'}]
CVE State: PUBLISHED
Explain CVE-2014-1955
Cross-site scripting (XSS) vulnerability in FortiGuard FortiWeb before 5.0.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.fortiguard.com/advisory/FG-IR-13-009/'}]
CVE State: PUBLISHED
Explain CVE-2014-1956
CRLF injection vulnerability in FortiGuard FortiWeb before 5.0.3 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.fortiguard.com/advisory/FG-IR-13-009/'}]
CVE State: PUBLISHED