Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2014-9035 State: PUBLISHED Published: 2014-11-25T23:00:00 Last Updated: 2024-08-06T13:33:13.413Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Press This in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.debian.org/security/2014/dsa-3085 - http://openwall.com/lists/oss-security/2014/11/25/12 - http://advisories.mageia.org/MGASA-2014-0493.html - http://www.securitytracker.com/id/1031243 - http://www.securityfocus.com/bid/71236
ies.mageia.org/MGASA-2014-0493.html - http://www.securitytracker.com/id/1031243 - http://www.securityfocus.com/bid/71236 - http://www.mandriva.com/security/advisories?name=MDVSA-2014:233 - https://wordpress.org/news/2014/11/wordpress-4-0-1/
CVE ID: CVE-2014-9036 State: PUBLISHED Published: 2014-11-25T23:00:00 Last Updated: 2024-08-06T13:33:13.392Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to inject arbitrary web script or HTML via a crafted Cascading Style Sheets (CSS) token sequence in a post. Additional Analyst Notes: - CVE Program Container: References: - http://www.debian.org/security/2014/dsa-3085 - http://openwall.com/lists/oss-security/2014/11/25/12 - http://advisories.mageia.org/MGASA-2014-0493.html - http://www.securitytracker.com/id/1031243 - http://w
2014/11/25/12 - http://advisories.mageia.org/MGASA-2014-0493.html - http://www.securitytracker.com/id/1031243 - http://www.securityfocus.com/bid/71236 - http://www.mandriva.com/security/advisories?name=MDVSA-2014:233 - https://wordpress.org/news/2014/11/wordpress-4-0-1/
CVE ID: CVE-2014-9037 State: PUBLISHED Published: 2014-11-25T23:00:00 Last Updated: 2024-08-06T13:33:13.510Z Vendors: n/a Products: n/a Problem Types: n/a Description: WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow remote attackers to obtain access to an account idle since 2008 by leveraging an improper PHP dynamic type comparison for an MD5 hash. Additional Analyst Notes: - CVE Program Container: References: - http://www.debian.org/security/2014/dsa-3085 - http://openwall.com/lists/oss-security/2014/11/25/12 - http://advisories.mageia.org/MGASA-2014-0493.html - http://www.securitytracker.com/id/1031243 - http://www.mandriva.com/security/advi
ries.mageia.org/MGASA-2014-0493.html - http://www.securitytracker.com/id/1031243 - http://www.mandriva.com/security/advisories?name=MDVSA-2014:233 - https://wordpress.org/news/2014/11/wordpress-4-0-1/
CVE ID: CVE-2014-9038 State: PUBLISHED Published: 2014-11-25T23:00:00 Last Updated: 2024-08-06T13:33:13.352Z Vendors: n/a Products: n/a Problem Types: n/a Description: wp-includes/http.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to conduct server-side request forgery (SSRF) attacks by referring to a 127.0.0.0/8 resource. Additional Analyst Notes: - CVE Program Container: References: - http://www.debian.org/security/2014/dsa-3085 - http://openwall.com/lists/oss-security/2014/11/25/12 - https://core.trac.wordpress.org/changeset/30444 - http://advisories.mageia.org/MGASA-2014-0493.html - http://www.securitytracker.com/id/10
wordpress.org/changeset/30444 - http://advisories.mageia.org/MGASA-2014-0493.html - http://www.securitytracker.com/id/1031243 - http://www.mandriva.com/security/advisories?name=MDVSA-2014:233 - https://wordpress.org/news/2014/11/wordpress-4-0-1/
CVE ID: CVE-2014-9039 State: PUBLISHED Published: 2014-11-25T23:00:00 Last Updated: 2024-08-06T13:33:13.527Z Vendors: n/a Products: n/a Problem Types: n/a Description: wp-login.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow remote attackers to reset passwords by leveraging access to an e-mail account that received a password-reset message. Additional Analyst Notes: - CVE Program Container: References: - http://www.debian.org/security/2014/dsa-3085 - http://openwall.com/lists/oss-security/2014/11/25/12 - http://advisories.mageia.org/MGASA-2014-0493.html - http://core.trac.wordpress.org/changeset/30431 - http://www.securitytracker.com/id
ies.mageia.org/MGASA-2014-0493.html - http://core.trac.wordpress.org/changeset/30431 - http://www.securitytracker.com/id/1031243 - http://www.mandriva.com/security/advisories?name=MDVSA-2014:233 - https://wordpress.org/news/2014/11/wordpress-4-0-1/
CVE ID: CVE-2014-9041 State: PUBLISHED Published: 2015-02-04T18:00:00 Last Updated: 2024-08-06T13:33:13.343Z Vendors: n/a Products: n/a Problem Types: n/a Description: The import functionality in the bookmarks application in ownCloud server before 5.0.18, 6.x before 6.0.6, and 7.x before 7.0.3 does not validate CSRF tokens, which allow remote attackers to conduct CSRF attacks. Additional Analyst Notes: - CVE Program Container: References: - https://owncloud.org/security/advisory/?id=oc-sa-2014-027
CVE ID: CVE-2014-9042 State: PUBLISHED Published: 2015-02-04T18:00:00 Last Updated: 2024-08-06T13:33:13.365Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the import functionality in the bookmarks application in ownCloud before 5.0.18, 6.x before 6.0.6, and 7.x before 7.0.3 allows remote authenticated users to inject arbitrary web script or HTML by importing a link with an unspecified protocol. NOTE: this can be leveraged by remote attackers using CVE-2014-9041. Additional Analyst Notes: - CVE Program Container: References: - https://owncloud.org/security/advisory/?id=oc-sa-2014-028
CVE ID: CVE-2014-9043 State: PUBLISHED Published: 2015-02-04T18:00:00 Last Updated: 2024-08-06T13:33:13.536Z Vendors: n/a Products: n/a Problem Types: n/a Description: The user_ldap (aka LDAP user and group backend) application in ownCloud before 5.0.18, 6.x before 6.0.6, and 7.x before 7.0.3 allows remote attackers to bypass authentication via a null byte in the password and a valid user name, which triggers an unauthenticated bind. Additional Analyst Notes: - CVE Program Container: References: - https://owncloud.org/security/advisory/?id=oc-sa-2014-020
CVE ID: CVE-2014-9044 State: PUBLISHED Published: 2015-02-04T18:00:00 Last Updated: 2024-08-06T13:33:13.429Z Vendors: n/a Products: n/a Problem Types: n/a Description: Asset Pipeline in ownCloud 7.x before 7.0.3 uses an MD5 hash of the absolute file paths of the original CSS and JS files as the name of the concatenated file, which allows remote attackers to obtain sensitive information via a brute force attack. Additional Analyst Notes: - CVE Program Container: References: - https://owncloud.org/security/advisory/?id=oc-sa-2014-021
CVE ID: CVE-2014-9045 State: PUBLISHED Published: 2015-02-04T18:00:00 Last Updated: 2024-08-06T13:33:13.531Z Vendors: n/a Products: n/a Problem Types: n/a Description: The FTP backend in user_external in ownCloud Server before 5.0.18 and 6.x before 6.0.6 allows remote attackers to bypass intended authentication requirements via a crafted password. Additional Analyst Notes: - CVE Program Container: References: - https://owncloud.org/security/advisory/?id=oc-sa-2014-022
CVE ID: CVE-2014-9046 State: PUBLISHED Published: 2015-02-04T18:00:00 Last Updated: 2024-08-06T13:33:13.561Z Vendors: n/a Products: n/a Problem Types: n/a Description: The OC_Util::getUrlContent function in ownCloud Server before 5.0.18, 6.x before 6.0.6, and 7.x before 7.0.3 allows remote attackers to read arbitrary files via a file:// protocol. Additional Analyst Notes: - CVE Program Container: References: - https://owncloud.org/security/advisory/?id=oc-sa-2014-023
CVE ID: CVE-2014-9047 State: PUBLISHED Published: 2015-02-04T18:00:00 Last Updated: 2024-08-06T13:33:13.517Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple unspecified vulnerabilities in the preview system in ownCloud 6.x before 6.0.6 and 7.x before 7.0.3 allow remote attackers to read arbitrary files via unknown vectors. Additional Analyst Notes: - CVE Program Container: References: - https://owncloud.org/security/advisory/?id=oc-sa-2014-026
CVE ID: CVE-2014-9048 State: PUBLISHED Published: 2015-02-04T18:00:00 Last Updated: 2024-08-06T13:33:13.629Z Vendors: n/a Products: n/a Problem Types: n/a Description: The documents application in ownCloud Server 6.x before 6.0.6 and 7.x before 7.0.3 allows remote attackers to bypass the password-protection for shared files via the API. Additional Analyst Notes: - CVE Program Container: References: - https://owncloud.org/security/advisory/?id=oc-sa-2014-024
CVE ID: CVE-2014-9049 State: PUBLISHED Published: 2015-02-04T18:00:00 Last Updated: 2024-08-06T13:33:13.568Z Vendors: n/a Products: n/a Problem Types: n/a Description: The documents application in ownCloud Server 6.x before 6.0.6 and 7.x before 7.0.3 allows remote authenticated users to obtain all valid session IDs via an unspecified API method. Additional Analyst Notes: - CVE Program Container: References: - https://owncloud.org/security/advisory/?id=oc-sa-2014-025
CVE ID: CVE-2014-9050 State: PUBLISHED Published: 2014-12-01T15:00:00 Last Updated: 2024-08-06T13:33:13.419Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap-based buffer overflow in the cli_scanpe function in libclamav/pe.c in ClamAV before 0.98.5 allows remote attackers to cause a denial of service (crash) via a crafted y0da Crypter PE file. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2014-12/msg00003.html - http://lists.opensuse.org/opensuse-security-announce/2014-12/msg00006.html - http://www.securityfocus.com/bid/71242 - http://lists.fedoraproject.org/pipermail/package-announce/2014-November/144979.
http://www.securityfocus.com/bid/71242 - http://lists.fedoraproject.org/pipermail/package-announce/2014-November/144979.html - http://secunia.com/advisories/62542 - http://blog.clamav.net/2014/11/clamav-0985-has-been-released.html - http://www.openwall.com/lists/oss-security/2014/11/22/1 - http://secunia.com/advisories/59645 - http://www.ubuntu.com/usn/USN-2423-1 - http://www.securitytracker.com/id/1031268 - https://github.com/vrtadmin/clamav-devel/commit/fc3794a54d2affe5770c1f876484a871c783e91e - http://lists.opensuse.org/opensuse-security-announce/2014-12/msg00007.html
CVE ID: CVE-2014-9057 State: PUBLISHED Published: 2014-12-16T18:00:00 Last Updated: 2024-08-06T13:33:13.433Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the XML-RPC interface in Movable Type before 5.18, 5.2.x before 5.2.11, and 6.x before 6.0.6 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/61227 - https://www.debian.org/security/2015/dsa-3183 - https://movabletype.org/news/2014/12/6.0.6.html - https://movabletype.org/documentation/appendices/release-notes/6.0.6.html
CVE ID: CVE-2014-9059 State: PUBLISHED Published: 2014-11-24T11:00:00 Last Updated: 2024-08-06T13:33:13.509Z Vendors: n/a Products: n/a Problem Types: n/a Description: lib/setup.php in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 does not provide charset information in HTTP headers, which might allow remote attackers to conduct cross-site scripting (XSS) attacks via UTF-7 characters during interaction with AJAX scripts. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1031215 - http://openwall.com/lists/oss-security/2014/11/17/11 - http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-4
/openwall.com/lists/oss-security/2014/11/17/11 - http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-47966 - https://moodle.org/mod/forum/discuss.php?d=275146 - http://www.securityfocus.com/bid/71133
CVE ID: CVE-2014-9060 State: PUBLISHED Published: 2014-11-24T11:00:00 Last Updated: 2024-08-06T13:33:13.411Z Vendors: n/a Products: n/a Problem Types: n/a Description: The LTI module in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 does not properly restrict the parameters used in a return URL, which allows remote attackers to trigger the generation of arbitrary messages via a modified URL, related to mod/lti/locallib.php and mod/lti/return.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1031215 - http://openwall.com/lists/oss-security/2014/11/17/11 - http://git.moodle.org/gw?p=moodle.git&a=search
r.com/id/1031215 - http://openwall.com/lists/oss-security/2014/11/17/11 - http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-47927 - https://moodle.org/mod/forum/discuss.php?d=275165
CVE ID: CVE-2014-9065 State: PUBLISHED Published: 2014-12-09T22:52:00 Last Updated: 2024-08-06T13:33:13.456Z Vendors: n/a Products: n/a Problem Types: n/a Description: common/spinlock.c in Xen 4.4.x and earlier does not properly handle read and write locks, which allows local x86 guest users to cause a denial of service (write denial or NMI watchdog timeout and host crash) via a large number of read requests, a different vulnerability to CVE-2014-9066. Additional Analyst Notes: - CVE Program Container: References: - http://xenbits.xen.org/xsa/advisory-114.html - https://security.gentoo.org/glsa/201504-04 - http://www.securityfocus.com/bid/71544 - http://lists.opensuse.org/opensuse-security-a
urity.gentoo.org/glsa/201504-04 - http://www.securityfocus.com/bid/71544 - http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00005.html - http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00010.html - http://www.openwall.com/lists/oss-security/2014/12/08/4
CVE ID: CVE-2014-9066 State: PUBLISHED Published: 2014-12-09T22:52:00 Last Updated: 2024-08-06T13:33:13.484Z Vendors: n/a Products: n/a Problem Types: n/a Description: Xen 4.4.x and earlier, when using a large number of VCPUs, does not properly handle read and write locks, which allows local x86 guest users to cause a denial of service (write denial or NMI watchdog timeout and host crash) via a large number of read requests, a different vulnerability than CVE-2014-9065. Additional Analyst Notes: - CVE Program Container: References: - http://xenbits.xen.org/xsa/advisory-114.html - https://security.gentoo.org/glsa/201504-04 - http://lists.opensuse.org/opensuse-security-announce/2015-02/msg0000
html - https://security.gentoo.org/glsa/201504-04 - http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00005.html - http://www.securityfocus.com/bid/71546 - http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00010.html - http://www.openwall.com/lists/oss-security/2014/12/08/4
CVE ID: CVE-2014-9087 State: PUBLISHED Published: 2014-12-01T15:00:00 Last Updated: 2024-08-06T13:33:13.454Z Vendors: n/a Products: n/a Problem Types: n/a Description: Integer underflow in the ksba_oid_to_str function in Libksba before 1.3.2, as used in GnuPG, allows remote attackers to cause a denial of service (crash) via a crafted OID in a (1) S/MIME message or (2) ECC based OpenPGP data, which triggers a buffer overflow. Additional Analyst Notes: - CVE Program Container: References: - https://blog.fuzzing-project.org/2-Buffer-overflow-and-other-minor-issues-in-GnuPG-and-libksba-TFPA-0012014.html - http://www.mandriva.com/security/advisories?name=MDVSA-2015:151 - http://secunia.com/adviso
-libksba-TFPA-0012014.html - http://www.mandriva.com/security/advisories?name=MDVSA-2015:151 - http://secunia.com/advisories/60233 - http://www.debian.org/security/2014/dsa-3078 - http://advisories.mageia.org/MGASA-2014-0498.html - http://www.mandriva.com/security/advisories?name=MDVSA-2014:234 - http://www.securityfocus.com/bid/71285 - http://secunia.com/advisories/60073 - http://secunia.com/advisories/60189 - http://lists.gnupg.org/pipermail/gnupg-announce/2014q4/000359.html - http://www.ubuntu.com/usn/USN-2427-1
CVE ID: CVE-2014-9089 State: PUBLISHED Published: 2014-11-28T15:00:00 Last Updated: 2024-08-06T13:33:13.375Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in view_all_bug_page.php in MantisBT before 1.2.18 allow remote attackers to execute arbitrary SQL commands via the (1) sort or (2) dir parameter to view_all_set.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.mantisbt.org/bugs/view.php?id=17841 - https://github.com/mantisbt/mantisbt/commit/b0021673ab23249244119bde3c7fcecd4daa4e7f - http://secunia.com/advisories/62101 - http://www.securityfocus.com/bid/71298 - http://www.openwall.com/lists/oss-security/20
://secunia.com/advisories/62101 - http://www.securityfocus.com/bid/71298 - http://www.openwall.com/lists/oss-security/2014/11/25/14 - http://www.debian.org/security/2015/dsa-3120 - http://www.openwall.com/lists/oss-security/2014/11/26/6
CVE ID: CVE-2014-9090 State: PUBLISHED Published: 2014-11-30T01:00:00 Last Updated: 2024-08-06T13:33:13.681Z Vendors: n/a Products: n/a Problem Types: n/a Description: The do_double_fault function in arch/x86/kernel/traps.c in the Linux kernel through 3.17.4 does not properly handle faults associated with the Stack Segment (SS) segment register, which allows local users to cause a denial of service (panic) via a modify_ldt system call, as demonstrated by sigreturn_32 in the linux-clock-tests test suite. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00015.html - http://www.debian.org/security/2014/dsa-3093 - ht
/lists.opensuse.org/opensuse-security-announce/2015-04/msg00015.html - http://www.debian.org/security/2014/dsa-3093 - http://www.openwall.com/lists/oss-security/2014/11/26/5 - http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00025.html - https://github.com/torvalds/linux/commit/6f442be2fb22be02cafa606f1769fa1e6f894441 - http://secunia.com/advisories/62336 - http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=6f442be2fb22be02cafa606f1769fa1e6f894441 - http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00020.html
CVE ID: CVE-2014-9091 State: PUBLISHED Published: 2014-12-10T15:00:00 Last Updated: 2024-08-06T13:33:13.557Z Vendors: n/a Products: n/a Problem Types: n/a Description: Icecast before 2.4.0 does not change the supplementary group privileges when <changeowner> is configured, which allows local users to gain privileges via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/oss-sec/2014/q4/794 - https://bugzilla.redhat.com/show_bug.cgi?id=1168146 - https://trac.xiph.org/changeset/19137/ - http://icecast.org/news/icecast-release-2_4_0/ - http://seclists.org/oss-sec/2014/q4/802 - http://lists.opensuse.org/opensuse-updates/2014-12/msg00037.html
CVE ID: CVE-2014-9092 State: PUBLISHED Published: 2017-10-10T13:00:00 Last Updated: 2024-08-06T13:33:13.553Z Vendors: n/a Products: n/a Problem Types: n/a Description: libjpeg-turbo before 1.3.1 allows remote attackers to cause a denial of service (crash) via a crafted JPEG file, related to the Exif marker. Additional Analyst Notes: - CVE Program Container: References: - http://www.imagemagick.org/discourse-server/viewtopic.php?f=3&t=26482&sid=81658bc2f51a8d9893279cd01e83783f - https://bugzilla.redhat.com/show_bug.cgi?id=1169845 - http://lists.fedoraproject.org/pipermail/package-announce/2015-March/150967.html - https://usn.ubuntu.com/3706-2/ - http://lists.fedoraproject.org/pipermail/packag
ckage-announce/2015-March/150967.html - https://usn.ubuntu.com/3706-2/ - http://lists.fedoraproject.org/pipermail/package-announce/2015-March/150957.html - https://tapani.tarvainen.info/linux/convertbug/ - http://lists.fedoraproject.org/pipermail/package-announce/2015-January/147315.html - https://usn.ubuntu.com/3706-1/ - http://www.securityfocus.com/bid/71326 - http://www.openwall.com/lists/oss-security/2014/11/26/8 - http://lists.fedoraproject.org/pipermail/package-announce/2015-January/147336.html
CVE ID: CVE-2014-9093 State: PUBLISHED Published: 2014-11-26T15:00:00 Last Updated: 2024-08-06T13:33:13.508Z Vendors: n/a Products: n/a Problem Types: n/a Description: LibreOffice before 4.3.5 allows remote attackers to cause a denial of service (invalid write operation and crash) and possibly execute arbitrary code via a crafted RTF file. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2014/11/19/3 - https://bugs.freedesktop.org/show_bug.cgi?id=86449 - http://lists.fedoraproject.org/pipermail/package-announce/2014-November/144836.html - http://www.debian.org/security/2015/dsa-3163 - http://www.openwall.com/lists/oss-security/2014/1
-November/144836.html - http://www.debian.org/security/2015/dsa-3163 - http://www.openwall.com/lists/oss-security/2014/11/26/7 - http://www.ubuntu.com/usn/USN-2578-1 - https://security.gentoo.org/glsa/201603-05
CVE ID: CVE-2014-9094 State: PUBLISHED Published: 2014-11-26T15:00:00 Last Updated: 2024-08-06T13:33:13.398Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in deploy/designer/preview.php in the Digital Zoom Studio (DZS) Video Gallery plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) swfloc or (2) designrand parameter. Additional Analyst Notes: - CVE Program Container: References: - http://websecurity.com.ua/7152/ - http://seclists.org/fulldisclosure/2014/Jul/65 - http://www.securityfocus.com/bid/68525 - http://www.securityfocus.com/bid/108579
CVE ID: CVE-2014-9095 State: PUBLISHED Published: 2014-11-26T15:00:00 Last Updated: 2024-08-06T13:33:13.609Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in Raritan Power IQ 4.1.0 and 4.2.1 allow remote attackers to execute arbitrary SQL commands via the (1) sort or (2) dir parameter to license/records. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/127525/Raritan-PowerIQ-Unauthenticated-SQL-Injection.html - http://secunia.com/advisories/60138 - http://seclists.org/fulldisclosure/2014/Jul/79 - http://www.securityfocus.com/bid/68722
CVE ID: CVE-2014-9096 State: PUBLISHED Published: 2014-11-26T15:00:00Z Last Updated: 2024-09-16T17:04:09.217Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in recover.php in Pligg CMS 2.0.1 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id or (2) n parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/68893 - http://packetstormsecurity.com/files/127615/Pligg-2.0.1-SQL-Injection-Command-Execution.html - https://github.com/Pligg/pligg-cms/commit/efb967b944375cd3ea3cd84c80d86d339dbe030e - http://seclists.org/fulldisclosure/2014/Jul/136 - https://github.com
s/commit/efb967b944375cd3ea3cd84c80d86d339dbe030e - http://seclists.org/fulldisclosure/2014/Jul/136 - https://github.com/Pligg/pligg-cms/commit/4891c4d8742b9dabd67e7250840e3434865aebed
CVE ID: CVE-2014-9097 State: PUBLISHED Published: 2014-11-26T15:00:00Z Last Updated: 2024-09-16T16:59:11.572Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in the Apptha WordPress Video Gallery (contus-video-gallery) plugin 2.5, possibly as distributed before 2014-07-23, for WordPress allow (1) remote attackers to execute arbitrary SQL commands via the vid parameter in a myextract action to wp-admin/admin-ajax.php or (2) remote authenticated users to execute arbitrary SQL commands via the playlistId parameter in the newplaylist page or (3) videoId parameter in a newvideo page to wp-admin/admin.php. Additional Analyst Notes: - CVE Program Co