Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2014-1881 State: PUBLISHED Published: 2014-03-03T02:00:00 Last Updated: 2024-08-06T09:58:15.507Z Vendors: n/a Products: n/a Problem Types: n/a Description: Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier allow remote attackers to bypass intended device-resource restrictions of an event-based bridge via a crafted library clone that leverages IFRAME script execution and waits a certain amount of time for an OnJsPrompt handler return value as an alternative to correct synchronization. Additional Analyst Notes: - CVE Program Container: References: - http://www.cs.utexas.edu/~shmat/shmat_ndss14nofrak.pdf - http://www.internetsociety.org/ndss2014/programme#session
es: - http://www.cs.utexas.edu/~shmat/shmat_ndss14nofrak.pdf - http://www.internetsociety.org/ndss2014/programme#session3 - http://seclists.org/bugtraq/2014/Jan/96 - http://openwall.com/lists/oss-security/2014/02/07/9 - http://packetstormsecurity.com/files/124954/apachecordovaphonegap-bypass.txt
CVE ID: CVE-2014-1882 State: PUBLISHED Published: 2014-03-03T02:00:00 Last Updated: 2024-08-06T09:58:14.474Z Vendors: n/a Products: n/a Problem Types: n/a Description: Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier allow remote attackers to bypass intended device-resource restrictions of an event-based bridge via a crafted library clone that leverages IFRAME script execution and directly accesses bridge JavaScript objects, as demonstrated by certain cordova.require calls. Additional Analyst Notes: - CVE Program Container: References: - http://www.cs.utexas.edu/~shmat/shmat_ndss14nofrak.pdf - http://www.internetsociety.org/ndss2014/programme#session3 - http://seclists.o
texas.edu/~shmat/shmat_ndss14nofrak.pdf - http://www.internetsociety.org/ndss2014/programme#session3 - http://seclists.org/bugtraq/2014/Jan/96 - http://openwall.com/lists/oss-security/2014/02/07/9 - http://packetstormsecurity.com/files/124954/apachecordovaphonegap-bypass.txt
CVE ID: CVE-2014-1883 State: PUBLISHED Published: 2014-03-03T02:00:00 Last Updated: 2024-08-06T09:58:15.600Z Vendors: n/a Products: n/a Problem Types: n/a Description: Adobe PhoneGap before 2.6.0 on Android uses the shouldOverrideUrlLoading callback instead of the proper shouldInterceptRequest callback, which allows remote attackers to bypass intended device-resource restrictions via content that is accessed (1) in an IFRAME element or (2) with the XMLHttpRequest method by a crafted application. Additional Analyst Notes: - CVE Program Container: References: - http://www.cs.utexas.edu/~shmat/shmat_ndss14nofrak.pdf - http://www.internetsociety.org/ndss2014/programme#session3 - http://seclists.
utexas.edu/~shmat/shmat_ndss14nofrak.pdf - http://www.internetsociety.org/ndss2014/programme#session3 - http://seclists.org/bugtraq/2014/Jan/96 - http://openwall.com/lists/oss-security/2014/02/07/9 - https://github.com/phonegap/phonegap/blob/2.6.0/changelog - http://packetstormsecurity.com/files/124954/apachecordovaphonegap-bypass.txt
CVE ID: CVE-2014-1884 State: PUBLISHED Published: 2014-03-03T02:00:00 Last Updated: 2024-08-06T09:58:14.457Z Vendors: n/a Products: n/a Problem Types: n/a Description: Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier on Windows Phone 7 and 8 do not properly restrict navigation events, which allows remote attackers to bypass intended device-resource restrictions via content that is accessed (1) in an IFRAME element or (2) with the XMLHttpRequest method by a crafted application. Additional Analyst Notes: - CVE Program Container: References: - http://www.cs.utexas.edu/~shmat/shmat_ndss14nofrak.pdf - http://www.internetsociety.org/ndss2014/programme#session3 - http://seclist
s.utexas.edu/~shmat/shmat_ndss14nofrak.pdf - http://www.internetsociety.org/ndss2014/programme#session3 - http://seclists.org/bugtraq/2014/Jan/96 - http://openwall.com/lists/oss-security/2014/02/07/9 - http://packetstormsecurity.com/files/124954/apachecordovaphonegap-bypass.txt
CVE ID: CVE-2014-1885 State: PUBLISHED Published: 2014-03-03T02:00:00 Last Updated: 2024-08-06T09:58:16.277Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ForzeArmate application for Android, when Adobe PhoneGap 2.9.0 or earlier is used, allows remote attackers to execute arbitrary JavaScript code, and consequently obtain write access to external-storage resources, by leveraging control over any Google syndication advertising domain. Additional Analyst Notes: - CVE Program Container: References: - http://www.cs.utexas.edu/~shmat/shmat_ndss14nofrak.pdf - http://www.internetsociety.org/ndss2014/programme#session3 - http://openwall.com/lists/oss-security/2014/02/07/9
CVE ID: CVE-2014-1886 State: PUBLISHED Published: 2014-03-03T02:00:00 Last Updated: 2024-08-06T09:58:14.487Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Edinburgh by Bus application for Android, when Adobe PhoneGap 2.9.0 or earlier is used, allows remote attackers to execute arbitrary JavaScript code, and consequently access external-storage resources, by leveraging control over one of a number of "obscure Eastern European dating sites." Additional Analyst Notes: - CVE Program Container: References: - http://www.cs.utexas.edu/~shmat/shmat_ndss14nofrak.pdf - http://www.internetsociety.org/ndss2014/programme#session3 - http://openwall.com/lists/oss-security/2014/02/07/9
CVE ID: CVE-2014-1887 State: PUBLISHED Published: 2014-03-03T02:00:00 Last Updated: 2024-08-06T09:58:16.013Z Vendors: n/a Products: n/a Problem Types: n/a Description: The DrinkedIn BarFinder application for Android, when Adobe PhoneGap 2.9.0 or earlier is used, allows remote attackers to execute arbitrary JavaScript code, and consequently obtain sensitive fine-geolocation information, by leveraging control over one of a number of adult sites, as demonstrated by (1) freelifetimecheating.com and (2) www.babesroulette.com. Additional Analyst Notes: - CVE Program Container: References: - http://www.cs.utexas.edu/~shmat/shmat_ndss14nofrak.pdf - http://www.internetsociety.org/ndss2014/programme#s
ferences: - http://www.cs.utexas.edu/~shmat/shmat_ndss14nofrak.pdf - http://www.internetsociety.org/ndss2014/programme#session3 - http://openwall.com/lists/oss-security/2014/02/07/9
CVE ID: CVE-2014-1888 State: PUBLISHED Published: 2014-02-28T17:00:00 Last Updated: 2024-08-06T09:58:16.040Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the BuddyPress plugin before 1.9.2 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the name field to groups/create/step/group-details. NOTE: this can be exploited without authentication by leveraging CVE-2014-1889. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/65555 - https://exchange.xforce.ibmcloud.com/vulnerabilities/91175 - http://secunia.com/advisories/56950 - http://packetstormsecurit
s://exchange.xforce.ibmcloud.com/vulnerabilities/91175 - http://secunia.com/advisories/56950 - http://packetstormsecurity.com/files/125212/WordPress-Buddypress-1.9.1-Cross-Site-Scripting.html - http://buddypress.org/2014/02/buddypress-1-9-2 - http://www.securityfocus.com/archive/1/531049/100/0/threaded - http://osvdb.org/103307
CVE ID: CVE-2014-1889 State: PUBLISHED Published: 2018-04-10T15:00:00 Last Updated: 2024-08-06T09:58:16.144Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Group creation process in the Buddypress plugin before 1.9.2 for WordPress allows remote authenticated users to gain control of arbitrary groups by leveraging a missing permissions check. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/531050/100/0/threaded - https://exchange.xforce.ibmcloud.com/vulnerabilities/91261 - http://www.securityfocus.com/bid/65554 - https://buddypress.org/2014/02/buddypress-1-9-2/
CVE ID: CVE-2014-1891 State: PUBLISHED Published: 2014-04-01T01:00:00 Last Updated: 2024-08-06T09:58:15.434Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple integer overflows in the (1) FLASK_GETBOOL, (2) FLASK_SETBOOL, (3) FLASK_USER, and (4) FLASK_CONTEXT_TO_SID suboperations in the flask hypercall in Xen 4.3.x, 4.2.x, 4.1.x, 3.2.x, and earlier, when XSM is enabled, allow local users to cause a denial of service (processor fault) via unspecified vectors, a different vulnerability than CVE-2014-1892, CVE-2014-1893, and CVE-2014-1894. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00011.html
Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00011.html - http://www.openwall.com/lists/oss-security/2014/02/10/8 - http://xenbits.xen.org/xsa/advisory-84.html - http://www.openwall.com/lists/oss-security/2014/02/07/4 - http://security.gentoo.org/glsa/glsa-201407-03.xml - http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00010.html - http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html - http://www.openwall.com/lists/oss-security/2014/02/07/12
CVE ID: CVE-2014-1892 State: PUBLISHED Published: 2014-04-01T01:00:00 Last Updated: 2024-08-06T09:58:16.193Z Vendors: n/a Products: n/a Problem Types: n/a Description: Xen 3.3 through 4.1, when XSM is enabled, allows local users to cause a denial of service via vectors related to a "large memory allocation," a different vulnerability than CVE-2014-1891, CVE-2014-1893, and CVE-2014-1894. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00011.html - http://www.openwall.com/lists/oss-security/2014/02/10/8 - http://xenbits.xen.org/xsa/advisory-84.html - http://www.openwall.com/lists/oss-security/2014/02/07/4 - http:/
02/10/8 - http://xenbits.xen.org/xsa/advisory-84.html - http://www.openwall.com/lists/oss-security/2014/02/07/4 - http://security.gentoo.org/glsa/glsa-201407-03.xml - http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00010.html - http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html - http://www.openwall.com/lists/oss-security/2014/02/07/12
CVE ID: CVE-2014-1893 State: PUBLISHED Published: 2014-04-01T01:00:00 Last Updated: 2024-08-06T09:58:15.946Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple integer overflows in the (1) FLASK_GETBOOL and (2) FLASK_SETBOOL suboperations in the flask hypercall in Xen 4.1.x, 3.3.x, 3.2.x, and earlier, when XSM is enabled, allow local users to cause a denial of service (processor fault) via unspecified vectors, a different vulnerability than CVE-2014-1891, CVE-2014-1892, and CVE-2014-1894. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00011.html - http://www.openwall.com/lists/oss-security/2014
://lists.opensuse.org/opensuse-security-announce/2014-03/msg00011.html - http://www.openwall.com/lists/oss-security/2014/02/10/8 - http://xenbits.xen.org/xsa/advisory-84.html - http://www.openwall.com/lists/oss-security/2014/02/07/4 - http://security.gentoo.org/glsa/glsa-201407-03.xml - http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00010.html - http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html - http://www.openwall.com/lists/oss-security/2014/02/07/12
CVE ID: CVE-2014-1894 State: PUBLISHED Published: 2014-04-01T01:00:00 Last Updated: 2024-08-06T09:58:14.487Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple integer overflows in unspecified suboperations in the flask hypercall in Xen 3.2.x and earlier, when XSM is enabled, allow local users to cause a denial of service (processor fault) via unspecified vectors, a different vulnerability than CVE-2014-1891, CVE-2014-1892, and CVE-2014-1893. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00011.html - http://www.openwall.com/lists/oss-security/2014/02/10/8 - http://xenbits.xen.org/xsa/advisory-
e/2014-03/msg00011.html - http://www.openwall.com/lists/oss-security/2014/02/10/8 - http://xenbits.xen.org/xsa/advisory-84.html - http://www.openwall.com/lists/oss-security/2014/02/07/4 - http://security.gentoo.org/glsa/glsa-201407-03.xml - http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00010.html - http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html - http://www.openwall.com/lists/oss-security/2014/02/07/12
CVE ID: CVE-2014-1895 State: PUBLISHED Published: 2014-04-01T01:00:00 Last Updated: 2024-08-06T09:58:15.560Z Vendors: n/a Products: n/a Problem Types: n/a Description: Off-by-one error in the flask_security_avc_cachestats function in xsm/flask/flask_op.c in Xen 4.2.x and 4.3.x, when the maximum number of physical CPUs are in use, allows local users to cause a denial of service (host crash) or obtain sensitive information from hypervisor memory by leveraging a FLASK_AVC_CACHESTAT hypercall, which triggers a buffer over-read. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00011.html - http://security.gentoo.org/g
References: - http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00011.html - http://security.gentoo.org/glsa/glsa-201407-03.xml - http://xenbits.xen.org/xsa/advisory-85.html - http://www.openwall.com/lists/oss-security/2014/02/07/12 - http://www.openwall.com/lists/oss-security/2014/02/10/6
CVE ID: CVE-2014-1896 State: PUBLISHED Published: 2014-04-01T01:00:00 Last Updated: 2024-08-06T09:58:15.436Z Vendors: n/a Products: n/a Problem Types: n/a Description: The (1) do_send and (2) do_recv functions in io.c in libvchan in Xen 4.2.x, 4.3.x, and 4.4-RC series allows local guests to cause a denial of service or possibly gain privileges via crafted xenstore ring indexes, which triggers a "read or write past the end of the ring." Additional Analyst Notes: - CVE Program Container: References: - http://xenbits.xen.org/xsa/xsa86.patch - http://xenbits.xen.org/xsa/advisory-86.html - http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00011.html - http://security.gentoo.org/glsa
y-86.html - http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00011.html - http://security.gentoo.org/glsa/glsa-201407-03.xml - http://www.openwall.com/lists/oss-security/2014/02/10/7 - http://www.openwall.com/lists/oss-security/2014/02/07/12
CVE ID: CVE-2014-1899 State: PUBLISHED Published: 2014-05-02T14:00:00 Last Updated: 2024-08-06T09:58:15.993Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Citrix NetScaler Gateway (formerly Citrix Access Gateway Enterprise Edition) 9.x before 9.3.66.5 and 10.x before 10.1.123.9 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1030186 - http://www.securityfocus.com/bid/67177 - https://support.citrix.com/article/CTX140291
CVE ID: CVE-2014-1900 State: PUBLISHED Published: 2015-05-14T00:00:00 Last Updated: 2024-08-06T09:58:14.489Z Vendors: n/a Products: n/a Problem Types: n/a Description: Y-Cam camera models SD range YCB003, YCK003, and YCW003; S range YCB004, YCK004, YCW004; EyeBall YCEB03; Bullet VGA YCBL03 and YCBLB3; Bullet HD 720 YCBLHD5; Y-cam Classic Range YCB002, YCK002, and YCW003; and Y-cam Original Range YCB001, YCW001, running firmware 4.30 and earlier, allow remote attackers to bypass authentication and obtain sensitive information via a leading "/./" in a request to en/account/accedit.asp. Additional Analyst Notes: - CVE Program Container: References: - https://www.trustwave.com/Resources/Security
cedit.asp. Additional Analyst Notes: - CVE Program Container: References: - https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2014-007/?fid=3850 - http://www.y-cam.com/y-cam-security-fix/
CVE ID: CVE-2014-1901 State: PUBLISHED Published: 2015-05-14T00:00:00 Last Updated: 2024-08-06T09:58:15.491Z Vendors: n/a Products: n/a Problem Types: n/a Description: Y-Cam camera models SD range YCB003, YCK003, and YCW003; S range YCB004, YCK004, YCW004; EyeBall YCEB03; Bullet VGA YCBL03 and YCBLB3; Bullet HD 720 YCBLHD5; Y-cam Classic Range YCB002, YCK002, and YCW003; and Y-cam Original Range YCB001, YCW001, running firmware 4.30 and earlier, allow remote authenticated users to cause a denial of service (reboot) via a malformed (1) path parameter to en/store_main.asp, (2) item parameter to en/account/accedit.asp, or (3) emailid parameter to en/smtpclient.asp. NOTE: this issue can be explo
) item parameter to en/account/accedit.asp, or (3) emailid parameter to en/smtpclient.asp. NOTE: this issue can be exploited without authentication by leveraging CVE-2014-1900. Additional Analyst Notes: - CVE Program Container: References: - https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2014-007/?fid=3850 - http://www.y-cam.com/y-cam-security-fix/
CVE ID: CVE-2014-1902 State: PUBLISHED Published: 2015-05-14T00:00:00 Last Updated: 2024-08-06T09:58:15.951Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in Y-Cam camera models SD range YCB003, YCK003, and YCW003; S range YCB004, YCK004, YCW004; EyeBall YCEB03; Bullet VGA YCBL03 and YCBLB3; Bullet HD 720 YCBLHD5; Y-cam Classic Range YCB002, YCK002, and YCW003; and Y-cam Original Range YCB001, YCW001, running firmware 4.30 and earlier, allow remote authenticated users to inject arbitrary web script or HTML via the (1) SYSCONTACT parameter to form/identityApply, as triggered using en/identity.asp; (2) PASSWD parameter to form/ac
the (1) SYSCONTACT parameter to form/identityApply, as triggered using en/identity.asp; (2) PASSWD parameter to form/accAdd, as triggered using en/account/accedit.asp; (3) NTPSERVER parameter to form/clockApply, as triggered using en/clock.asp; (4) SERVER parameter to form/smtpclientApply, as triggered using en/smtpclient.asp; (5) SERVER parameter to form/ftpApply, as triggered using en/ftp.asp; or (6) SERVER parameter to form/httpEventApply, as triggered using en/httpevent.asp. Additional Analyst Notes: - CVE Program Container: References: - https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2014-007/?fid=3850 - http://www.y-cam.com/y-cam-security-fix/
CVE ID: CVE-2014-1903 State: PUBLISHED Published: 2014-02-18T11:00:00 Last Updated: 2024-08-06T09:58:14.499Z Vendors: n/a Products: n/a Problem Types: n/a Description: admin/libraries/view.functions.php in FreePBX 2.9 before 2.9.0.14, 2.10 before 2.10.1.15, 2.11 before 2.11.0.23, and 12 before 12.0.1alpha22 does not restrict the set of functions accessible to the API handler, which allows remote attackers to execute arbitrary PHP code via the function and args parameters to admin/config.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/0x00string/oldays/blob/master/CVE-2014-1903.pl - http://osvdb.org/103240 - http://code.freepbx.org/changelog/FreePBX_Fr
/0x00string/oldays/blob/master/CVE-2014-1903.pl - http://osvdb.org/103240 - http://code.freepbx.org/changelog/FreePBX_Framework?cs=a29382efeb293ef4f42aa9b841dfc8eabb2d1e03 - http://code.freepbx.org/changelog/FreePBX_SVN?cs=16429 - http://archives.neohapsis.com/archives/fulldisclosure/2014-02/0111.html - http://packetstormsecurity.com/files/125215/FreePBX-2.9-Remote-Code-Execution.html - http://archives.neohapsis.com/archives/fulldisclosure/2014-02/0097.html - http://issues.freepbx.org/browse/FREEPBX-7123 - http://www.freepbx.org/news/2014-02-06/security-vulnerability-notice - http://issues.freepbx.org/browse/FREEPBX-7117 - http://packetstormsecurity.com/files/125166/FreePBX-2.x-Code-Executio
- http://issues.freepbx.org/browse/FREEPBX-7117 - http://packetstormsecurity.com/files/125166/FreePBX-2.x-Code-Execution.html - http://www.securityfocus.com/archive/1/531040/100/0/threaded
CVE ID: CVE-2014-1904 State: PUBLISHED Published: 2014-03-20T16:00:00 Last Updated: 2024-08-06T09:58:15.521Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in web/servlet/tags/form/FormTag.java in Spring MVC in Spring Framework 3.0.0 before 3.2.8 and 4.0.0 before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via the requested URI in a default action. Additional Analyst Notes: - CVE Program Container: References: - http://www.gopivotal.com/security/cve-2014-1904 - http://www.securityfocus.com/bid/66137 - https://jira.springsource.org/browse/SPR-11426 - https://github.com/spring-projects/spring-framework/commit/741b4b2
37 - https://jira.springsource.org/browse/SPR-11426 - https://github.com/spring-projects/spring-framework/commit/741b4b229ae032bd17175b46f98673ce0bd2d485 - http://www.securityfocus.com/archive/1/531422/100/0/threaded - http://rhn.redhat.com/errata/RHSA-2014-0400.html - http://secunia.com/advisories/57915 - http://docs.spring.io/spring/docs/3.2.8.RELEASE/changelog.txt - http://seclists.org/fulldisclosure/2014/Mar/101
CVE ID: CVE-2014-1905 State: PUBLISHED Published: 2014-12-29T20:00:00 Last Updated: 2024-08-06T09:58:15.551Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unrestricted file upload vulnerability in ls/vw_snapshots.php in the VideoWhisper Live Streaming Integration plugin before 4.29.5 for WordPress allows remote attackers to execute arbitrary PHP code by uploading a file with a double extension, and then accessing the file via a direct request to a wp-content/plugins/videowhisper-live-streaming-integration/ls/snapshots/ pathname, as demonstrated by a .php.jpg filename. Additional Analyst Notes: - CVE Program Container: References: - https://www.htbridge.com/advisory/HTB23199
CVE ID: CVE-2014-1906 State: PUBLISHED Published: 2014-03-06T15:00:00 Last Updated: 2024-08-06T09:58:15.610Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in the VideoWhisper Live Streaming Integration plugin before 4.29.5 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) m parameter to lb_status.php; (2) msg parameter to vc_chatlog.php; n parameter to (3) channel.php, (4) htmlchat.php, (5) video.php, or (6) videotext.php; (7) message parameter to lb_logout.php; or ct parameter to (8) lb_status.php or (9) v_status.php in ls/. Additional Analyst Notes: - CVE Program Container: References: -
meter to (8) lb_status.php or (9) v_status.php in ls/. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/125454 - https://www.htbridge.com/advisory/HTB23199 - https://exchange.xforce.ibmcloud.com/vulnerabilities/91477
CVE ID: CVE-2014-1907 State: PUBLISHED Published: 2014-03-06T15:00:00 Last Updated: 2024-08-06T09:58:16.012Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple directory traversal vulnerabilities in the VideoWhisper Live Streaming Integration plugin before 4.29.5 for WordPress allow remote attackers to (1) read arbitrary files via a .. (dot dot) in the s parameter to ls/rtmp_login.php or (2) delete arbitrary files via a .. (dot dot) in the s parameter to ls/rtmp_logout.php. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/125454 - https://www.htbridge.com/advisory/HTB23199 - https://exchange.xforce.ibmcloud.com/vulnerabili
ecurity.com/files/125454 - https://www.htbridge.com/advisory/HTB23199 - https://exchange.xforce.ibmcloud.com/vulnerabilities/91478
CVE ID: CVE-2014-1908 State: PUBLISHED Published: 2014-12-29T20:00:00 Last Updated: 2024-08-06T09:58:15.562Z Vendors: n/a Products: n/a Problem Types: n/a Description: The error-handling feature in (1) bp.php, (2) videowhisper_streaming.php, and (3) ls/rtmp.inc.php in the VideoWhisper Live Streaming Integration plugin before 4.29.5 for WordPress allows remote attackers to obtain sensitive information via a direct request, which reveals the full path in an error message. Additional Analyst Notes: - CVE Program Container: References: - https://www.htbridge.com/advisory/HTB23199