Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
LSA-2014-3094 - http://secunia.com/advisories/60193 - http://www.vmware.com/security/advisories/VMSA-2014-0010.html - http://secunia.com/advisories/60063 - http://secunia.com/advisories/60034 - http://secunia.com/advisories/59907 - http://secunia.com/advisories/58200 - http://marc.info/?l=bugtraq&m=141577241923505&w=2 - http://secunia.com/advisories/61643 - http://www.novell.com/support/kb/doc.php?id=7015721 - http://www-01.ibm.com/support/docview.wss?uid=swg21687079 - http://secunia.com/advisories/61503 - http://www-01.ibm.com/support/docview.wss?uid=swg21686246 - http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004915 - http://support.novell.com/security/cve/CVE-2014-6278.html - http://
ww-01.ibm.com/support/docview.wss?uid=ssg1S1004915 - http://support.novell.com/security/cve/CVE-2014-6278.html - http://marc.info/?l=bugtraq&m=141383465822787&w=2 - http://www.qnap.com/i/en/support/con_show.php?cid=61 - http://secunia.com/advisories/61552 - http://secunia.com/advisories/61780 - http://www-01.ibm.com/support/docview.wss?uid=isg3T1021279 - https://support.citrix.com/article/CTX200223 - https://www.exploit-db.com/exploits/39568/ - http://marc.info/?l=bugtraq&m=141330468527613&w=2 - http://secunia.com/advisories/60044 - http://secunia.com/advisories/61291 - http://marc.info/?l=bugtraq&m=141345648114150&w=2 - http://secunia.com/advisories/61287 - http://marc.info/?l=bugtraq&m=141
p://marc.info/?l=bugtraq&m=141345648114150&w=2 - http://secunia.com/advisories/61287 - http://marc.info/?l=bugtraq&m=141383353622268&w=2 - http://marc.info/?l=bugtraq&m=142118135300698&w=2 - http://marc.info/?l=bugtraq&m=142118135300698&w=2 - http://www-01.ibm.com/support/docview.wss?uid=isg3T1021361 - http://marc.info/?l=bugtraq&m=141383304022067&w=2 - http://secunia.com/advisories/61128 - https://support.citrix.com/article/CTX200217 - http://secunia.com/advisories/61471 - http://secunia.com/advisories/60055 - http://secunia.com/advisories/59961 - http://secunia.com/advisories/61550 - http://secunia.com/advisories/61633 - http://lcamtuf.blogspot.com/2014/09/bash-bug-apply-unofficial-patch-n
ries/61550 - http://secunia.com/advisories/61633 - http://lcamtuf.blogspot.com/2014/09/bash-bug-apply-unofficial-patch-now.html - http://www-01.ibm.com/support/docview.wss?uid=swg21686494 - https://kb.bluecoat.com/index?page=content&id=SA82 - http://secunia.com/advisories/61328 - http://www-01.ibm.com/support/docview.wss?uid=swg21685733 - http://secunia.com/advisories/61129 - http://secunia.com/advisories/61603 - http://secunia.com/advisories/61857 - http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004879 - https://www.arista.com/en/support/advisories-notices/security-advisories/1008-security-advisory-0006
CVE ID: CVE-2014-6280 State: PUBLISHED Published: 2014-10-20T14:00:00 Last Updated: 2024-08-06T12:10:13.219Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in OSClass before 3.4.2 allow remote attackers to inject arbitrary web script or HTML via the (1) action or (2) nsextt parameter to oc-admin/index.php or the (3) nsextt parameter in an items_reported action to oc-admin/index.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/533457/100/0/threaded - http://packetstormsecurity.com/files/128286/OsClass-3.4.1-Cross-Site-Scripting.html - http://blog.osclass.org/2014/09/15/o
tp://packetstormsecurity.com/files/128286/OsClass-3.4.1-Cross-Site-Scripting.html - http://blog.osclass.org/2014/09/15/osclass-3-4-2-ready-download - https://www.netsparker.com/xss-vulnerabilities-in-osclass/ - https://github.com/osclass/Osclass/commit/c163bf5910d0d36424d7fc678da6b03a0e443435
CVE ID: CVE-2014-6283 State: PUBLISHED Published: 2014-10-17T23:00:00 Last Updated: 2024-08-06T12:10:13.270Z Vendors: n/a Products: n/a Problem Types: n/a Description: SAP Adaptive Server Enterprise (ASE) 15.7 before SP122 or SP63, 15.5 before ESD#5.4, and 15.0.3 before ESD#4.4 does not properly restrict access, which allows remote authenticated database users to (1) overwrite the master encryption key or (2) trigger a buffer overflow via a crafted RPC message to the hacmpmsgxchg function, and possibly other vectors. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/99935 - http://blog.spiderlabs.com/2014/09/cve-2014-6283-sa
nces: - https://exchange.xforce.ibmcloud.com/vulnerabilities/99935 - http://blog.spiderlabs.com/2014/09/cve-2014-6283-sap-ase-missing-authorization-checks-and-arbitrary-code-execution.html - http://scn.sap.com/docs/DOC-55451 - https://service.sap.com/sap/support/notes/2044220 - http://secunia.com/advisories/61238 - https://www3.trustwave.com/spiderlabs/advisories/TWSL2014-013.txt
CVE ID: CVE-2014-6284 State: PUBLISHED Published: 2015-06-08T14:00:00 Last Updated: 2024-08-06T12:10:13.261Z Vendors: n/a Products: n/a Problem Types: n/a Description: SAP Adaptive Server Enterprise (ASE) before 15.7 SP132 and 16.0 before 16.0 SP01 allows remote attackers to bypass the challenge and response mechanism and obtain access to the probe account via a crafted response, aka SAP Security Note 2113995. Additional Analyst Notes: - CVE Program Container: References: - https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2015-004/?fid=6200
CVE ID: CVE-2014-6287 State: PUBLISHED Published: 2014-10-07T10:00:00.000Z Last Updated: 2025-10-22T00:05:35.677Z Vendors: n/a Products: n/a Problem Types: n/a Description: The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x before 2.3c allows remote attackers to execute arbitrary programs via a %00 sequence in a search action. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.kb.cert.org/vuls/id/251276 - https://www.exploit-db.com/exploits/39161/ - http://packetstormsecurity.com/files/128243/HttpFileServer-2.3.x-Remote-Command-Execution.html - https://github.com/rapid7/metasploit-framew
curity.com/files/128243/HttpFileServer-2.3.x-Remote-Command-Execution.html - https://github.com/rapid7/metasploit-framework/pull/3793 - http://packetstormsecurity.com/files/135122/Rejetto-HTTP-File-Server-2.3.x-Remote-Code-Execution.html - http://packetstormsecurity.com/files/160264/Rejetto-HttpFileServer-2.3.x-Remote-Command-Execution.html - http://packetstormsecurity.com/files/161503/HFS-HTTP-File-Server-2.3.x-Remote-Code-Execution.html
CVE ID: CVE-2014-6288 State: PUBLISHED Published: 2014-10-03T14:00:00 Last Updated: 2024-08-06T12:10:13.392Z Vendors: n/a Products: n/a Problem Types: n/a Description: The powermail extension 2.x before 2.0.11 for TYPO3 allows remote attackers to bypass the CAPTCHA protection mechanism via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://typo3.org/extensions/repository/view/powermail - http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2014-006/
CVE ID: CVE-2014-6289 State: PUBLISHED Published: 2014-10-03T14:00:00 Last Updated: 2024-08-06T12:10:13.288Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Ajax dispatcher for Extbase in the Yet Another Gallery (yag) extension before 3.0.1 and Tools for Extbase development (pt_extbase) extension before 1.5.1 allows remote attackers to bypass access restrictions and execute arbitrary controller actions via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://typo3.org/extensions/repository/view/yag - http://typo3.org/extensions/repository/view/pt_extbase - http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2
tensions/repository/view/pt_extbase - http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2014-005/
CVE ID: CVE-2014-6290 State: PUBLISHED Published: 2014-10-03T14:00:00 Last Updated: 2024-08-06T12:10:13.254Z Vendors: n/a Products: n/a Problem Types: n/a Description: The News (tt_news) extension before 3.5.2 for TYPO3 allows remote attackers to have unspecified impact via vectors related to an "insecure unserialize" issue. Additional Analyst Notes: - CVE Program Container: References: - http://typo3.org/extensions/repository/view/tt_news - http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2014-003/
CVE ID: CVE-2014-6291 State: PUBLISHED Published: 2014-10-03T14:00:00 Last Updated: 2024-08-06T12:10:13.270Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Alphabetic Sitemap (alpha_sitemap) extension 0.0.3 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2014-002/ - https://exchange.xforce.ibmcloud.com/vulnerabilities/95799 - http://www.securityfocus.com/bid/69689
CVE ID: CVE-2014-6292 State: PUBLISHED Published: 2014-10-03T14:00:00 Last Updated: 2024-08-06T12:10:13.275Z Vendors: n/a Products: n/a Problem Types: n/a Description: The femanager extension before 1.0.9 for TYPO3 allows remote frontend users to modify or delete the records of other frontend users via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://typo3.org/extensions/repository/view/femanager - http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2014-002/
CVE ID: CVE-2014-6293 State: PUBLISHED Published: 2014-10-03T14:00:00 Last Updated: 2024-08-06T12:10:13.348Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the Statistics (ke_stats) extension before 1.1.2 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, as exploited in the wild in February 2014. Additional Analyst Notes: - CVE Program Container: References: - http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2014-002/ - http://typo3.org/extensions/repository/view/ke_stats
CVE ID: CVE-2014-6294 State: PUBLISHED Published: 2014-10-03T14:00:00 Last Updated: 2024-08-06T12:10:13.265Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the External links click statistics (outstats) extension 0.0.3 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2014-002/
CVE ID: CVE-2014-6295 State: PUBLISHED Published: 2014-10-03T14:00:00 Last Updated: 2024-08-06T12:10:13.262Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the WEC Map (wec_map) extension before 3.0.3 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2014-002/ - http://typo3.org/extensions/repository/view/wec_map
CVE ID: CVE-2014-6296 State: PUBLISHED Published: 2014-10-03T14:00:00 Last Updated: 2024-08-06T12:10:13.303Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the WEC Map (wec_map) extension before 3.0.3 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2014-002/ - http://typo3.org/extensions/repository/view/wec_map
CVE ID: CVE-2014-6297 State: PUBLISHED Published: 2014-10-03T14:00:00 Last Updated: 2024-08-06T12:10:13.298Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the mm_forum extension before 1.9.3 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://typo3.org/extensions/repository/view/mm_forum - http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2014-001/
CVE ID: CVE-2014-6298 State: PUBLISHED Published: 2014-10-03T14:00:00 Last Updated: 2024-08-06T12:10:13.303Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unrestricted file upload vulnerability in the mm_forum extension before 1.9.3 for TYPO3 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://typo3.org/extensions/repository/view/mm_forum - http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2014-001/
CVE ID: CVE-2014-6299 State: PUBLISHED Published: 2014-10-03T14:00:00 Last Updated: 2024-08-06T12:10:13.320Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in the mm_forum extension before 1.9.3 for TYPO3 allows remote attackers to hijack the authentication of users for requests that create posts via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://typo3.org/extensions/repository/view/mm_forum - http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2014-001/
CVE ID: CVE-2014-6300 State: PUBLISHED Published: 2014-11-08T11:00:00 Last Updated: 2024-08-06T12:10:13.279Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the micro history implementation in phpMyAdmin 4.0.x before 4.0.10.3, 4.1.x before 4.1.14.4, and 4.2.x before 4.2.8.1 allows remote attackers to inject arbitrary web script or HTML, and consequently conduct a cross-site request forgery (CSRF) attack to create a root account, via a crafted URL, related to js/ajax.js. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201505-03 - https://github.com/phpmyadmin/phpmyadmin/commit/33b39f9f1dd9
References: - https://security.gentoo.org/glsa/201505-03 - https://github.com/phpmyadmin/phpmyadmin/commit/33b39f9f1dd9a4d27856530e5ac004e23b30e8ac - http://www.phpmyadmin.net/home_page/security/PMASA-2014-10.php - http://lists.opensuse.org/opensuse-updates/2014-09/msg00032.html - http://www.securityfocus.com/bid/69790
CVE ID: CVE-2014-6301 State: PUBLISHED Published: 2015-02-19T11:00:00 Last Updated: 2024-08-06T12:10:13.446Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in the tables-management module in PNMsoft Sequence Kinetics before 7.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://licensing.pnmsoft.com/documents/Security%20Bulletins/Security%20Bulletin%202014-1.htm - http://twitter.com/d_gianni/statuses/562628862648270849/photo/1
CVE ID: CVE-2014-6302 State: PUBLISHED Published: 2015-02-19T11:00:00 Last Updated: 2024-08-06T12:10:13.301Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Monitoring Administration pages in PNMsoft Sequence Kinetics before 7.7 allow remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. Additional Analyst Notes: - CVE Program Container: References: - http://licensing.pnmsoft.com/documents/Security%20Bulletins/Security%20Bulletin%202014-1.htm - http://twitter.com/d_gianni/statuses/562628862648270849/photo/1
CVE ID: CVE-2014-6303 State: PUBLISHED Published: 2015-02-19T11:00:00 Last Updated: 2024-08-06T12:10:13.296Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Monitoring Administration pages in PNMsoft Sequence Kinetics before 7.7 do not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (resource consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564. Additional Analyst Notes: - CVE Program Container: References: - http://licensing.pnmsoft.com/documents/Security%20Bulletins/Security%20Bulletin%202014-1.htm - http://twitter.com/d_gianni/statuses/562
g.pnmsoft.com/documents/Security%20Bulletins/Security%20Bulletin%202014-1.htm - http://twitter.com/d_gianni/statuses/562628862648270849/photo/1
CVE ID: CVE-2014-6304 State: PUBLISHED Published: 2015-02-19T11:00:00 Last Updated: 2024-08-06T12:10:13.389Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Form Controls CSS file in PNMsoft Sequence Kinetics before 7.7 allows remote attackers to obtain sensitive source-code information via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://licensing.pnmsoft.com/documents/Security%20Bulletins/Security%20Bulletin%202014-1.htm - http://twitter.com/d_gianni/statuses/562628862648270849/photo/1
CVE ID: CVE-2014-6308 State: PUBLISHED Published: 2014-10-20T14:00:00 Last Updated: 2024-08-06T12:10:13.294Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in OSClass before 3.4.2 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter in a render action to oc-admin/index.php. Additional Analyst Notes: - CVE Program Container: References: - http://blog.osclass.org/2014/09/15/osclass-3-4-2-ready-download/ - http://packetstormsecurity.com/files/128285/OsClass-3.4.1-Local-File-Inclusion.html - https://www.netsparker.com/lfi-vulnerability-in-osclass/ - https://github.com/osclass/Osclass/commit/c163bf5910d0d36424d7fc67
://www.netsparker.com/lfi-vulnerability-in-osclass/ - https://github.com/osclass/Osclass/commit/c163bf5910d0d36424d7fc678da6b03a0e443435 - http://www.securityfocus.com/archive/1/533456/100/0/threaded
CVE ID: CVE-2014-6309 State: PUBLISHED Published: 2018-04-12T15:00:00 Last Updated: 2024-08-06T12:10:13.297Z Vendors: n/a Products: n/a Problem Types: n/a Description: The HTTP and WebSocket engine components in the server in Kaazing Gateway 4.0.2, 4.0.3, and 4.0.4 and Gateway - JMS Edition 4.0.2, 4.0.3, and 4.0.4 allow remote attackers to obtain sensitive information via vectors related to HTTP request handling. Additional Analyst Notes: - CVE Program Container: References: - https://support.kaazing.com/hc/en-us/articles/115004550547-Advisory-for-KGS-879
CVE ID: CVE-2014-6310 State: PUBLISHED Published: 2019-11-22T18:07:36 Last Updated: 2024-08-06T12:10:13.270Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in CHICKEN 4.9.0 and 4.9.0.1 may allow remote attackers to execute arbitrary code via the 'select' function. Additional Analyst Notes: - CVE Program Container: References: - https://security-tracker.debian.org/tracker/CVE-2014-6310 - http://www.openwall.com/lists/oss-security/2014/09/11/6 - http://www.securityfocus.com/bid/69727 - https://lists.nongnu.org/archive/html/chicken-users/2014-08/msg00055.html
CVE ID: CVE-2014-6311 State: PUBLISHED Published: 2019-11-22T18:22:17 Last Updated: 2024-08-06T12:10:13.280Z Vendors: n/a Products: n/a Problem Types: n/a Description: generate_doygen.pl in ace before 6.2.7+dfsg-2 creates predictable file names in the /tmp directory which allows attackers to gain elevated privileges. Additional Analyst Notes: - CVE Program Container: References: - https://security-tracker.debian.org/tracker/CVE-2014-6311 - http://www.openwall.com/lists/oss-security/2014/09/12/6 - http://www.openwall.com/lists/oss-security/2014/09/11/5 - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=760709
CVE ID: CVE-2014-6312 State: PUBLISHED Published: 2014-10-15T14:00:00 Last Updated: 2024-08-06T12:10:13.274Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in the Login Widget With Shortcode (login-sidebar-widget) plugin before 3.2.1 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the custom_style_afo parameter on the login_widget_afo page to wp-admin/options-general.php. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2014/Sep/58 - http://www.exploit-db.com/exploits/34762 - https:
tainer: References: - http://seclists.org/fulldisclosure/2014/Sep/58 - http://www.exploit-db.com/exploits/34762 - https://wordpress.org/plugins/login-sidebar-widget/changelog - https://security.dxw.com/advisories/csrfxss-vulnerablity-in-login-widget-with-shortcode-allows-unauthenticated-attackers-to-do-anything-an-admin-can-do - http://osvdb.org/show/osvdb/111757 - http://osvdb.org/show/osvdb/111700
CVE ID: CVE-2014-6313 State: PUBLISHED Published: 2014-10-14T14:00:00 Last Updated: 2024-08-06T12:10:13.288Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the WooCommerce plugin before 2.2.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the range parameter on the wc-reports page to wp-admin/admin.php. Additional Analyst Notes: - CVE Program Container: References: - https://security.dxw.com/advisories/reflected-xss-in-woocommerce-excelling-ecommerce-allows-attackers-ability-to-do-almost-anything-an-admin-user-can-do - http://seclists.org/fulldisclosure/2014/Sep/59 - https://wordpress.org/plugins/woocom
st-anything-an-admin-user-can-do - http://seclists.org/fulldisclosure/2014/Sep/59 - https://wordpress.org/plugins/woocommerce/changelog - http://secunia.com/advisories/61377
CVE ID: CVE-2014-6315 State: PUBLISHED Published: 2014-10-10T14:00:00 Last Updated: 2024-08-06T12:10:13.333Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in the Web-Dorado Photo Gallery plugin 1.1.30 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) callback, (2) dir, or (3) extensions parameter in an addImages action to wp-admin/admin-ajax.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/70204 - http://www.securityfocus.com/archive/1/533595/100/0/threaded - https://exchange.xforce.ibmcloud.com/vulnerabilities/96799 - https:
.securityfocus.com/archive/1/533595/100/0/threaded - https://exchange.xforce.ibmcloud.com/vulnerabilities/96799 - https://www.htbridge.com/advisory/HTB23232 - http://packetstormsecurity.com/files/128518/WordPress-Photo-Gallery-1.1.30-Cross-Site-Scripting.html - https://plugins.trac.wordpress.org/changeset?new=986500 - http://secunia.com/advisories/61649
CVE ID: CVE-2014-6316 State: PUBLISHED Published: 2014-12-12T11:00:00 Last Updated: 2024-08-06T12:10:13.283Z Vendors: n/a Products: n/a Problem Types: n/a Description: core/string_api.php in MantisBT before 1.2.18 does not properly categorize URLs when running under the web root, which allows remote attackers to conduct open redirect and phishing attacks via a crafted URL in the return parameter to login_page.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.mantisbt.org/bugs/view.php?id=17648 - https://exchange.xforce.ibmcloud.com/vulnerabilities/99128 - http://www.securityfocus.com/bid/71478 - https://github.com/mantisbt/mantisbt/commit/e66ecc9f - http://sec
ities/99128 - http://www.securityfocus.com/bid/71478 - https://github.com/mantisbt/mantisbt/commit/e66ecc9f - http://seclists.org/oss-sec/2014/q4/931 - http://www.openwall.com/lists/oss-security/2014/12/03/11 - http://secunia.com/advisories/62101 - http://www.debian.org/security/2015/dsa-3120