Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2014-2180 State: PUBLISHED Published: 2014-04-29T10:00:00 Last Updated: 2024-08-06T10:06:00.190Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Document Management component in Cisco Unified Contact Center Express does not properly validate a parameter, which allows remote authenticated users to upload files to arbitrary pathnames via a crafted HTTP request, aka Bug ID CSCun74133. Additional Analyst Notes: - CVE Program Container: References: - http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2180
CVE ID: CVE-2014-2181 State: PUBLISHED Published: 2014-05-07T10:00:00 Last Updated: 2024-08-06T10:06:00.191Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cisco Adaptive Security Appliance (ASA) Software allows remote authenticated users to read files by sending a crafted URL to the HTTP server, as demonstrated by reading the running configuration, aka Bug ID CSCun78551. Additional Analyst Notes: - CVE Program Container: References: - http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2181
CVE ID: CVE-2014-2182 State: PUBLISHED Published: 2014-04-29T10:00:00 Last Updated: 2024-08-06T10:05:59.845Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cisco Adaptive Security Appliance (ASA) Software, when DHCPv6 replay is configured, allows remote attackers to cause a denial of service (device reload) via a crafted DHCPv6 packet, aka Bug ID CSCun45520. Additional Analyst Notes: - CVE Program Container: References: - http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2182
CVE ID: CVE-2014-2183 State: PUBLISHED Published: 2014-04-29T10:00:00 Last Updated: 2024-08-06T10:06:00.210Z Vendors: n/a Products: n/a Problem Types: n/a Description: The L2TP module in Cisco IOS XE 3.10S(.2) and earlier on ASR 1000 routers allows remote authenticated users to cause a denial of service (ESP card reload) via a malformed L2TP packet, aka Bug ID CSCun09973. Additional Analyst Notes: - CVE Program Container: References: - http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2183 - http://tools.cisco.com/security/center/viewAlert.x?alertId=33971
CVE ID: CVE-2014-2184 State: PUBLISHED Published: 2014-04-29T10:00:00 Last Updated: 2024-08-06T10:05:59.996Z Vendors: n/a Products: n/a Problem Types: n/a Description: The IP Manager Assistant (IPMA) component in Cisco Unified Communications Manager (Unified CM) allows remote attackers to obtain sensitive information via a crafted URL, aka Bug ID CSCun74352. Additional Analyst Notes: - CVE Program Container: References: - http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2184
CVE ID: CVE-2014-2185 State: PUBLISHED Published: 2014-04-29T10:00:00 Last Updated: 2024-08-06T10:06:00.188Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Call Detail Records (CDR) Management component in Cisco Unified Communications Manager (Unified CM) allows remote authenticated users to obtain sensitive information by reading extraneous fields in an HTML document, aka Bug ID CSCun74374. Additional Analyst Notes: - CVE Program Container: References: - http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2185
CVE ID: CVE-2014-2186 State: PUBLISHED Published: 2014-04-30T10:00:00 Last Updated: 2024-08-06T10:05:59.861Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in the web framework in Cisco WebEx Meetings Server allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuj81777. Additional Analyst Notes: - CVE Program Container: References: - http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2186 - http://www.securitytracker.com/id/1030173
CVE ID: CVE-2014-2188 State: REJECTED Published: 2015-02-27T02:00:00 Last Updated: 2015-03-06T01:57:01 Description: No description available.
CVE ID: CVE-2014-2189 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2014-2190 State: PUBLISHED Published: 2014-05-07T10:00:00 Last Updated: 2024-08-06T10:06:00.179Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in the web framework in Cisco Broadcast Access Center for Telco and Wireless (aka BAC-TW) allows remote attackers to hijack the authentication of arbitrary users for requests that make BAC-TW changes, aka Bug IDs CSCuo23804 and CSCuo26389. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1030199 - http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2190
CVE ID: CVE-2014-2191 State: PUBLISHED Published: 2014-05-07T10:00:00 Last Updated: 2024-08-06T10:05:59.856Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the web framework in Cisco Broadcast Access Center for Telco and Wireless (aka BAC-TW) allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCun91113. Additional Analyst Notes: - CVE Program Container: References: - http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2191 - http://www.securitytracker.com/id/1030198
CVE ID: CVE-2014-2192 State: PUBLISHED Published: 2014-05-20T10:00:00 Last Updated: 2024-08-06T10:06:00.270Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Cisco Unified Web and E-mail Interaction Manager 9.0(2) allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCuj43033. Additional Analyst Notes: - CVE Program Container: References: - http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2192 - http://tools.cisco.com/security/center/viewAlert.x?alertId=34269 - http://www.securityfocus.com/bid/67464
CVE ID: CVE-2014-2193 State: PUBLISHED Published: 2014-05-20T10:00:00 Last Updated: 2024-08-06T10:05:59.773Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cisco Unified Web and E-Mail Interaction Manager places session identifiers in GET requests, which allows remote attackers to inject conversation text by obtaining a valid identifier, aka Bug ID CSCuj43084. Additional Analyst Notes: - CVE Program Container: References: - http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2193
CVE ID: CVE-2014-2194 State: PUBLISHED Published: 2014-05-20T10:00:00 Last Updated: 2024-08-06T10:05:59.998Z Vendors: n/a Products: n/a Problem Types: n/a Description: system/egain/chat/entrypoint in Cisco Unified Web and E-mail Interaction Manager 9.0(2) allows remote attackers to have an unspecified impact by injecting a spoofed XML external entity. Additional Analyst Notes: - CVE Program Container: References: - http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2194 - http://tools.cisco.com/security/center/viewAlert.x?alertId=34270
CVE ID: CVE-2014-2195 State: PUBLISHED Published: 2014-05-20T10:00:00 Last Updated: 2024-08-06T10:05:59.853Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cisco AsyncOS on Email Security Appliance (ESA) and Content Security Management Appliance (SMA) devices, when Active Directory is enabled, does not properly handle group names, which allows remote attackers to gain role privileges by leveraging group-name similarity, aka Bug ID CSCum86085. Additional Analyst Notes: - CVE Program Container: References: - http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2195 - http://www.securitytracker.com/id/1030258
CVE ID: CVE-2014-2196 State: PUBLISHED Published: 2014-05-23T22:00:00 Last Updated: 2024-08-06T10:05:59.771Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cisco Wide Area Application Services (WAAS) 5.1.1 before 5.1.1e, when SharePoint prefetch optimization is enabled, allows remote SharePoint servers to execute arbitrary code via a malformed response, aka Bug ID CSCue18479. Additional Analyst Notes: - CVE Program Container: References: - http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140521-waas - http://www.securitytracker.com/id/1030265
CVE ID: CVE-2014-2197 State: PUBLISHED Published: 2014-07-07T10:00:00 Last Updated: 2024-08-06T10:06:00.218Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Administration GUI in the web framework in Cisco Unified Communications Domain Manager (CDM) in Unified CDM Application Software before 8.1.4 does not properly implement access control, which allows remote authenticated users to modify administrative credentials via a crafted URL, aka Bug ID CSCun49862. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/59573 - http://www.securitytracker.com/id/1030515 - http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-s
http://www.securitytracker.com/id/1030515 - http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140702-cucdm - http://tools.cisco.com/security/center/viewAMBAlert.x?alertId=34689 - http://www.securityfocus.com/bid/68333
CVE ID: CVE-2014-2198 State: PUBLISHED Published: 2014-07-07T10:00:00 Last Updated: 2024-08-06T10:05:59.911Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cisco Unified Communications Domain Manager (CDM) in Unified CDM Platform Software before 4.4.2 has a hardcoded SSH private key, which makes it easier for remote attackers to obtain access to the support and root accounts by extracting this key from a binary file found in a different installation of the product, aka Bug ID CSCud41130. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/59544 - http://www.securityfocus.com/bid/68334 - http://www.securitytracker.com/id/1030515 - http://
unia.com/advisories/59544 - http://www.securityfocus.com/bid/68334 - http://www.securitytracker.com/id/1030515 - http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140702-cucdm - http://tools.cisco.com/security/center/viewAMBAlert.x?alertId=34689
CVE ID: CVE-2014-2199 State: PUBLISHED Published: 2014-05-20T10:00:00 Last Updated: 2024-08-06T10:05:59.964Z Vendors: n/a Products: n/a Problem Types: n/a Description: meetinginfo.do in Cisco WebEx Event Center, WebEx Meeting Center, WebEx Sales Center, WebEx Training Center, WebEx Meetings Server 1.5(.1.131) and earlier, and WebEx Business Suite (WBS) 27 before 27.32.31.16, 28 before 28.12.13.18, and 29 before 29.5.1.12 allows remote attackers to obtain sensitive meeting information by leveraging knowledge of a meeting identifier, aka Bug IDs CSCuo68624 and CSCue46738. Additional Analyst Notes: - CVE Program Container: References: - http://tools.cisco.com/security/center/viewAlert.x?alertId
itional Analyst Notes: - CVE Program Container: References: - http://tools.cisco.com/security/center/viewAlert.x?alertId=34252 - http://www.securitytracker.com/id/1030251 - http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2199
CVE ID: CVE-2014-2200 State: PUBLISHED Published: 2014-05-24T01:00:00 Last Updated: 2024-08-06T10:06:00.323Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cisco NX-OS 5.0 before 5.0(5) on Nexus 7000 devices, when local authentication and multiple VDCs are enabled, allows remote authenticated users to gain privileges within an unintended VDC via an SSH session to a management interface, aka Bug ID CSCti11629. Additional Analyst Notes: - CVE Program Container: References: - http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140521-nxos
CVE ID: CVE-2014-2201 State: PUBLISHED Published: 2014-05-24T01:00:00 Last Updated: 2024-08-06T10:06:00.199Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Message Transfer Service (MTS) in Cisco NX-OS before 6.2(7) on MDS 9000 devices and 6.0 before 6.0(2) on Nexus 7000 devices allows remote attackers to cause a denial of service (NULL pointer dereference and kernel panic) via a large volume of crafted traffic, aka Bug ID CSCtw98915. Additional Analyst Notes: - CVE Program Container: References: - http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140521-nxos
CVE ID: CVE-2014-2205 State: PUBLISHED Published: 2014-02-26T15:00:00 Last Updated: 2024-08-06T10:06:00.285Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Import and Export Framework in McAfee ePolicy Orchestrator (ePO) before 4.6.7 Hotfix 940148 allows remote authenticated users with permissions to add dashboards to read arbitrary files by importing a crafted XML file, related to an XML External Entity (XXE) issue. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/57114 - https://kc.mcafee.com/corporate/index?page=content&id=SB10065 - http://www.securityfocus.com/archive/1/531255/100/0/threaded - https://www.redteam-pentesting.de
ge=content&id=SB10065 - http://www.securityfocus.com/archive/1/531255/100/0/threaded - https://www.redteam-pentesting.de/advisories/rt-sa-2014-001.txt - http://www.securityfocus.com/bid/65771
CVE ID: CVE-2014-2206 State: PUBLISHED Published: 2014-03-05T15:00:00 Last Updated: 2024-08-06T10:06:00.223Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack-based buffer overflow in GetGo Download Manager 4.9.0.1982, 4.8.2.1346, 4.4.5.502, and earlier allows remote attackers to cause a denial of service (crash) and execute arbitrary code via a long HTTP Response Header. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/531326/100/0/threaded - http://www.rcesecurity.com/2014/03/cve-2014-2206-getgo-download-manager-http-response-header-buffer-overflow-remote-code-execution - http://www.securityfocus.com/bid/65913
CVE ID: CVE-2014-2208 State: PUBLISHED Published: 2014-12-28T15:00:00 Last Updated: 2024-08-06T10:06:00.272Z Vendors: n/a Products: n/a Problem Types: n/a Description: CRLF injection vulnerability in the LightProcess protocol implementation in hphp/util/light-process.cpp in Facebook HipHop Virtual Machine (HHVM) before 2.4.2 allows remote attackers to execute arbitrary commands by entering a \n (newline) character before the end of a string. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/facebook/hhvm/commit/506a44194a9016406c752ad8e010c01aeffc18cc
CVE ID: CVE-2014-2209 State: PUBLISHED Published: 2014-12-28T15:00:00 Last Updated: 2024-08-06T10:06:00.247Z Vendors: n/a Products: n/a Problem Types: n/a Description: Facebook HipHop Virtual Machine (HHVM) before 3.1.0 does not drop supplemental group memberships within hphp/util/capability.cpp and hphp/util/light-process.cpp, which allows remote attackers to bypass intended access restrictions by leveraging group permissions for a file or directory. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/facebook/hhvm/commit/851fff90a9b7461df2393af32239ba217bc25946
CVE ID: CVE-2014-2210 State: PUBLISHED Published: 2014-04-04T15:00:00 Last Updated: 2024-08-06T10:06:00.280Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple directory traversal vulnerabilities in CA ERwin Web Portal 9.5 allow remote attackers to obtain sensitive information, bypass intended access restrictions, cause a denial of service, or possibly execute arbitrary code via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1030017 - http://www.securityfocus.com/bid/66644 - https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=%7B7F968A14-7407-4BCF-9EB1-EFE9F0E6D663%7D
CVE ID: CVE-2014-2211 State: PUBLISHED Published: 2014-03-03T16:00:00 Last Updated: 2024-08-06T10:06:00.220Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in portal/addtoapplication.php in POSH (aka Posh portal or Portaneo) 3.0 before 3.3.0 allows remote attackers to execute arbitrary SQL commands via the rssurl parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.sysdream.com/CVE-2014-2211_2214 - http://www.securityfocus.com/bid/65817 - http://sourceforge.net/p/posh/svn/3540/ - http://www.sysdream.com/system/files/POSH-3.2.1-advisory_0.pdf - http://seclists.org/oss-sec/2014/q1/444
CVE ID: CVE-2014-2212 State: PUBLISHED Published: 2014-04-01T17:00:00 Last Updated: 2024-08-06T10:06:00.190Z Vendors: n/a Products: n/a Problem Types: n/a Description: The remember me feature in portal/scr_authentif.php in POSH (aka Posh portal or Portaneo) 3.0, 3.2.1, 3.3.0, and earlier stores the username and MD5 digest of the password in cleartext in a cookie, which allows attackers to obtain sensitive information by reading this cookie. Additional Analyst Notes: - CVE Program Container: References: - http://www.sysdream.com/CVE-2014-2211_2214 - http://www.sysdream.com/system/files/POSH-3.2.1-advisory_0.pdf - http://seclists.org/oss-sec/2014/q1/444
CVE ID: CVE-2014-2213 State: PUBLISHED Published: 2019-11-22T18:39:15 Last Updated: 2024-08-06T10:06:00.197Z Vendors: n/a Products: n/a Problem Types: n/a Description: Open redirect vulnerability in the password reset functionality in POSH 3.0 through 3.2.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the redirect parameter to portal/scr_sendmd5.php. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/oss-sec/2014/q1/444 - http://www.securityfocus.com/bid/65843 - https://sysdream.com/news/lab/posh-3-2-1-multiple-vulnerabilities/
CVE ID: CVE-2014-2214 State: PUBLISHED Published: 2019-11-22T18:39:19 Last Updated: 2024-08-06T10:05:59.980Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in POSH (aka Posh portal or Portaneo) 3.0 through 3.2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) error parameter to /includes/plugins/mobile/scripts/login.php or (2) id parameter to portal/openrssarticle.php Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/oss-sec/2014/q1/444 - https://sysdream.com/news/lab/posh-3-2-1-multiple-vulnerabilities/
CVE ID: CVE-2014-2215 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2014-2216 State: PUBLISHED Published: 2014-08-25T14:00:00 Last Updated: 2024-08-06T10:05:59.970Z Vendors: n/a Products: n/a Problem Types: n/a Description: The FortiManager protocol service in Fortinet FortiOS before 4.3.16 and 5.0.0 before 5.0.8 on FortiGate devices allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted request. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/69338 - http://secunia.com/advisories/60724 - http://www.fortiguard.com/advisory/FG-IR-14-006/ - http://www.kb.cert.org/vuls/id/730964 - http://www.securitytracker.com/id/1030753 - https://exchange.xforce.ibmcl
006/ - http://www.kb.cert.org/vuls/id/730964 - http://www.securitytracker.com/id/1030753 - https://exchange.xforce.ibmcloud.com/vulnerabilities/95442
CVE ID: CVE-2014-2217 State: PUBLISHED Published: 2014-12-25T21:00:00 Last Updated: 2024-08-06T10:06:00.211Z Vendors: n/a Products: n/a Problem Types: n/a Description: Absolute path traversal vulnerability in the RadAsyncUpload control in the RadControls in Telerik UI for ASP.NET AJAX before Q3 2012 SP2 allows remote attackers to write to arbitrary files, and consequently execute arbitrary code, via a full pathname in the UploadID metadata value. Additional Analyst Notes: - CVE Program Container: References: - http://itq.nl/arbitrary-file-write-in-telerik-ui-for-asp-net-ajax/
CVE ID: CVE-2014-2219 State: PUBLISHED Published: 2014-03-20T16:00:00 Last Updated: 2024-08-06T10:06:00.246Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in whizzywig/wb.php in CMSimple Classic 3.54 and earlier, possibly as downloaded before February 26, 2014, allows remote attackers to inject arbitrary web script or HTML via the d parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/531527/100/0/threaded - http://www.securityfocus.com/bid/66312 - https://www.htbridge.com/advisory/HTB23205
CVE ID: CVE-2014-2223 State: PUBLISHED Published: 2014-09-11T14:00:00 Last Updated: 2024-08-06T10:06:00.289Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unrestricted file upload vulnerability in plog-admin/plog-upload.php in Plogger 1.0 RC1 and earlier allows remote authenticated users to execute arbitrary code by uploading a ZIP file that contains a PHP file and a non-zero length PNG file, then accessing the PHP file via a direct request to it in plog-content/uploads/archive/. Additional Analyst Notes: - CVE Program Container: References: - https://www.sysdream.com/CVE-2014-2223_CVE-2014-2224 - https://www.sysdream.com/system/files/PLOGGER-1.0RC1-advisory.pdf - http://seclist
eam.com/CVE-2014-2223_CVE-2014-2224 - https://www.sysdream.com/system/files/PLOGGER-1.0RC1-advisory.pdf - http://seclists.org/oss-sec/2014/q1/443 - http://seclists.org/oss-sec/2014/q1/446 - http://packetstormsecurity.com/files/128029/Plogger-Authenticated-Arbitrary-File-Upload.html - http://www.exploit-db.com/exploits/34447
CVE ID: CVE-2014-2224 State: PUBLISHED Published: 2014-12-29T20:00:00 Last Updated: 2024-08-06T10:06:00.202Z Vendors: n/a Products: n/a Problem Types: n/a Description: Plogger 1.0 RC1 and earlier, when the Lucid theme is used, does not assign new values for certain codes, which makes it easier for remote attackers to bypass the CAPTCHA protection mechanism via a series of form submissions. Additional Analyst Notes: - CVE Program Container: References: - https://www.sysdream.com/CVE-2014-2223_CVE-2014-2224
CVE ID: CVE-2014-2225 State: PUBLISHED Published: 2020-02-08T15:56:28 Last Updated: 2024-08-06T10:05:59.987Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site request forgery (CSRF) vulnerabilities in Ubiquiti Networks UniFi Controller before 3.2.1 allow remote attackers to hijack the authentication of administrators for requests that (1) create a new admin user via a request to api/add/admin; (2) have unspecified impact via a request to api/add/wlanconf; change the guest (3) password, (4) authentication method, or (5) restricted subnets via a request to api/set/setting/guest_access; (6) block, (7) unblock, or (8) reconnect users by MAC address via a request to a
equest to api/set/setting/guest_access; (6) block, (7) unblock, or (8) reconnect users by MAC address via a request to api/cmd/stamgr; change the syslog (9) server or (10) port via a request to api/set/setting/rsyslogd; (11) have unspecified impact via a request to api/set/setting/smtp; change the syslog (12) server, (13) port, or (14) authentication settings via a request to api/cmd/cfgmgr; or (15) change the Unifi Controller name via a request to api/set/setting/identity. Additional Analyst Notes: - CVE Program Container: References: - http://sethsec.blogspot.com/2014/07/cve-2014-2225.html - http://seclists.org/fulldisclosure/2014/Jul/126
CVE ID: CVE-2014-2226 State: PUBLISHED Published: 2014-07-29T14:00:00 Last Updated: 2024-08-06T10:06:00.189Z Vendors: n/a Products: n/a Problem Types: n/a Description: Ubiquiti UniFi Controller before 3.2.1 logs the administrative password hash in syslog messages, which allows man-in-the-middle attackers to obtain sensitive information via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/68869 - http://packetstormsecurity.com/files/127616/Ubiquiti-UbiFi-Controller-2.4.5-Password-Hash-Disclosure.html - http://seclists.org/fulldisclosure/2014/Jul/127 - http://sethsec.blogspot.com/2014/07/cve-2014-2226.html